41716bc0e4ad2d9bcb5c6049501d3a52137f36b9
[exim.git] / src / src / route.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions concerned with routing, and the list of generic router options. */
9
10
11 #include "exim.h"
12
13
14
15 /* Generic options for routers, all of which live inside router_instance
16 data blocks and which therefore have the opt_public flag set. */
17
18 optionlist optionlist_routers[] = {
19 { "*expand_group", opt_stringptr | opt_hidden | opt_public,
20 (void *)(offsetof(router_instance, expand_gid)) },
21 { "*expand_more", opt_stringptr | opt_hidden | opt_public,
22 (void *)(offsetof(router_instance, expand_more)) },
23 { "*expand_unseen", opt_stringptr | opt_hidden | opt_public,
24 (void *)(offsetof(router_instance, expand_unseen)) },
25 { "*expand_user", opt_stringptr | opt_hidden | opt_public,
26 (void *)(offsetof(router_instance, expand_uid)) },
27 { "*set_group", opt_bool | opt_hidden | opt_public,
28 (void *)(offsetof(router_instance, gid_set)) },
29 { "*set_user", opt_bool | opt_hidden | opt_public,
30 (void *)(offsetof(router_instance, uid_set)) },
31 { "address_data", opt_stringptr|opt_public,
32 (void *)(offsetof(router_instance, address_data)) },
33 { "address_test", opt_bool|opt_public,
34 (void *)(offsetof(router_instance, address_test)) },
35 #ifdef EXPERIMENTAL_BRIGHTMAIL
36 { "bmi_deliver_alternate", opt_bool | opt_public,
37 (void *)(offsetof(router_instance, bmi_deliver_alternate)) },
38 { "bmi_deliver_default", opt_bool | opt_public,
39 (void *)(offsetof(router_instance, bmi_deliver_default)) },
40 { "bmi_dont_deliver", opt_bool | opt_public,
41 (void *)(offsetof(router_instance, bmi_dont_deliver)) },
42 { "bmi_rule", opt_stringptr|opt_public,
43 (void *)(offsetof(router_instance, bmi_rule)) },
44 #endif
45 { "cannot_route_message", opt_stringptr | opt_public,
46 (void *)(offsetof(router_instance, cannot_route_message)) },
47 { "caseful_local_part", opt_bool | opt_public,
48 (void *)(offsetof(router_instance, caseful_local_part)) },
49 { "check_local_user", opt_bool | opt_public,
50 (void *)(offsetof(router_instance, check_local_user)) },
51 { "condition", opt_stringptr|opt_public|opt_rep_con,
52 (void *)offsetof(router_instance, condition) },
53 { "debug_print", opt_stringptr | opt_public,
54 (void *)offsetof(router_instance, debug_string) },
55 { "disable_logging", opt_bool | opt_public,
56 (void *)offsetof(router_instance, disable_logging) },
57 { "dnssec_request_domains", opt_stringptr|opt_public,
58 (void *)offsetof(router_instance, dnssec.request) },
59 { "dnssec_require_domains", opt_stringptr|opt_public,
60 (void *)offsetof(router_instance, dnssec.require) },
61 { "domains", opt_stringptr|opt_public,
62 (void *)offsetof(router_instance, domains) },
63 { "driver", opt_stringptr|opt_public,
64 (void *)offsetof(router_instance, driver_name) },
65 { "dsn_lasthop", opt_bool|opt_public,
66 (void *)offsetof(router_instance, dsn_lasthop) },
67 { "errors_to", opt_stringptr|opt_public,
68 (void *)(offsetof(router_instance, errors_to)) },
69 { "expn", opt_bool|opt_public,
70 (void *)offsetof(router_instance, expn) },
71 { "fail_verify", opt_bool_verify|opt_hidden|opt_public,
72 (void *)offsetof(router_instance, fail_verify_sender) },
73 { "fail_verify_recipient", opt_bool|opt_public,
74 (void *)offsetof(router_instance, fail_verify_recipient) },
75 { "fail_verify_sender", opt_bool|opt_public,
76 (void *)offsetof(router_instance, fail_verify_sender) },
77 { "fallback_hosts", opt_stringptr|opt_public,
78 (void *)offsetof(router_instance, fallback_hosts) },
79 { "group", opt_expand_gid | opt_public,
80 (void *)(offsetof(router_instance, gid)) },
81 { "headers_add", opt_stringptr|opt_public|opt_rep_str,
82 (void *)offsetof(router_instance, extra_headers) },
83 { "headers_remove", opt_stringptr|opt_public|opt_rep_str,
84 (void *)offsetof(router_instance, remove_headers) },
85 { "ignore_target_hosts",opt_stringptr|opt_public,
86 (void *)offsetof(router_instance, ignore_target_hosts) },
87 { "initgroups", opt_bool | opt_public,
88 (void *)(offsetof(router_instance, initgroups)) },
89 { "local_part_prefix", opt_stringptr|opt_public,
90 (void *)offsetof(router_instance, prefix) },
91 { "local_part_prefix_optional",opt_bool|opt_public,
92 (void *)offsetof(router_instance, prefix_optional) },
93 { "local_part_suffix", opt_stringptr|opt_public,
94 (void *)offsetof(router_instance, suffix) },
95 { "local_part_suffix_optional",opt_bool|opt_public,
96 (void *)offsetof(router_instance, suffix_optional) },
97 { "local_parts", opt_stringptr|opt_public,
98 (void *)offsetof(router_instance, local_parts) },
99 { "log_as_local", opt_bool|opt_public,
100 (void *)offsetof(router_instance, log_as_local) },
101 { "more", opt_expand_bool|opt_public,
102 (void *)offsetof(router_instance, more) },
103 { "pass_on_timeout", opt_bool|opt_public,
104 (void *)offsetof(router_instance, pass_on_timeout) },
105 { "pass_router", opt_stringptr|opt_public,
106 (void *)offsetof(router_instance, pass_router_name) },
107 { "redirect_router", opt_stringptr|opt_public,
108 (void *)offsetof(router_instance, redirect_router_name) },
109 { "require_files", opt_stringptr|opt_public,
110 (void *)offsetof(router_instance, require_files) },
111 { "retry_use_local_part", opt_bool|opt_public,
112 (void *)offsetof(router_instance, retry_use_local_part) },
113 { "router_home_directory", opt_stringptr|opt_public,
114 (void *)offsetof(router_instance, router_home_directory) },
115 { "self", opt_stringptr|opt_public,
116 (void *)(offsetof(router_instance, self)) },
117 { "senders", opt_stringptr|opt_public,
118 (void *)offsetof(router_instance, senders) },
119 { "set", opt_stringptr|opt_public|opt_rep_str,
120 (void *)offsetof(router_instance, set) },
121 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
122 { "translate_ip_address", opt_stringptr|opt_public,
123 (void *)offsetof(router_instance, translate_ip_address) },
124 #endif
125 { "transport", opt_stringptr|opt_public,
126 (void *)offsetof(router_instance, transport_name) },
127 { "transport_current_directory", opt_stringptr|opt_public,
128 (void *)offsetof(router_instance, current_directory) },
129 { "transport_home_directory", opt_stringptr|opt_public,
130 (void *)offsetof(router_instance, home_directory) },
131 { "unseen", opt_expand_bool|opt_public,
132 (void *)offsetof(router_instance, unseen) },
133 { "user", opt_expand_uid | opt_public,
134 (void *)(offsetof(router_instance, uid)) },
135 { "verify", opt_bool_verify|opt_hidden|opt_public,
136 (void *)offsetof(router_instance, verify_sender) },
137 { "verify_only", opt_bool|opt_public,
138 (void *)offsetof(router_instance, verify_only) },
139 { "verify_recipient", opt_bool|opt_public,
140 (void *)offsetof(router_instance, verify_recipient) },
141 { "verify_sender", opt_bool|opt_public,
142 (void *)offsetof(router_instance, verify_sender) }
143 };
144
145 int optionlist_routers_size = nelem(optionlist_routers);
146
147
148 #ifdef MACRO_PREDEF
149
150 # include "macro_predef.h"
151
152 void
153 options_routers(void)
154 {
155 uschar buf[64];
156
157 options_from_list(optionlist_routers, nelem(optionlist_routers), US"ROUTERS", NULL);
158
159 for (router_info * ri = routers_available; ri->driver_name[0]; ri++)
160 {
161 spf(buf, sizeof(buf), US"_DRIVER_ROUTER_%T", ri->driver_name);
162 builtin_macro_create(buf);
163 options_from_list(ri->options, (unsigned)*ri->options_count, US"ROUTER", ri->driver_name);
164 }
165 }
166
167 #else /*!MACRO_PREDEF*/
168
169 /*************************************************
170 * Set router pointer from name *
171 *************************************************/
172
173 /* This function is used for the redirect_router and pass_router options and
174 called from route_init() below.
175
176 Arguments:
177 r the current router
178 name new router name
179 ptr where to put the pointer
180 after TRUE if router must follow this one
181
182 Returns: nothing.
183 */
184
185 static void
186 set_router(router_instance *r, uschar *name, router_instance **ptr, BOOL after)
187 {
188 BOOL afterthis = FALSE;
189 router_instance *rr;
190
191 for (rr = routers; rr; rr = rr->next)
192 {
193 if (Ustrcmp(name, rr->name) == 0)
194 {
195 *ptr = rr;
196 break;
197 }
198 if (rr == r) afterthis = TRUE;
199 }
200
201 if (!rr)
202 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
203 "new_router \"%s\" not found for \"%s\" router", name, r->name);
204
205 if (after && !afterthis)
206 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
207 "new_router \"%s\" does not follow \"%s\" router", name, r->name);
208 }
209
210
211
212 /*************************************************
213 * Initialize router list *
214 *************************************************/
215
216 /* Read the routers section of the configuration file, and set up a chain of
217 router instances according to its contents. Each router has generic options and
218 may also have its own private options. This function is only ever called when
219 routers == NULL. We use generic code in readconf to do the work. It will set
220 values from the configuration file, and then call the driver's initialization
221 function. */
222
223 void
224 route_init(void)
225 {
226 readconf_driver_init(US"router",
227 (driver_instance **)(&routers), /* chain anchor */
228 (driver_info *)routers_available, /* available drivers */
229 sizeof(router_info), /* size of info blocks */
230 &router_defaults, /* default values for generic options */
231 sizeof(router_instance), /* size of instance block */
232 optionlist_routers, /* generic options */
233 optionlist_routers_size);
234
235 for (router_instance * r = routers; r; r = r->next)
236 {
237 uschar *s = r->self;
238
239 /* If log_as_local is unset, its overall default is FALSE. (The accept
240 router defaults it to TRUE.) */
241
242 if (r->log_as_local == TRUE_UNSET) r->log_as_local = FALSE;
243
244 /* Check for transport or no transport on certain routers */
245
246 if ( (r->info->ri_flags & ri_yestransport)
247 && !r->transport_name && !r->verify_only)
248 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
249 "a transport is required for this router", r->name);
250
251 if ((r->info->ri_flags & ri_notransport) && r->transport_name)
252 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
253 "a transport must not be defined for this router", r->name);
254
255 /* The "self" option needs to be decoded into a code value and possibly a
256 new domain string and a rewrite boolean. */
257
258 if (Ustrcmp(s, "freeze") == 0) r->self_code = self_freeze;
259 else if (Ustrcmp(s, "defer") == 0) r->self_code = self_defer;
260 else if (Ustrcmp(s, "send") == 0) r->self_code = self_send;
261 else if (Ustrcmp(s, "pass") == 0) r->self_code = self_pass;
262 else if (Ustrcmp(s, "fail") == 0) r->self_code = self_fail;
263 else if (Ustrncmp(s, "reroute:", 8) == 0)
264 {
265 s += 8;
266 while (isspace(*s)) s++;
267 if (Ustrncmp(s, "rewrite:", 8) == 0)
268 {
269 r->self_rewrite = TRUE;
270 s += 8;
271 while (isspace(*s)) s++;
272 }
273 r->self = s;
274 r->self_code = self_reroute;
275 }
276
277 else log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s router:\n "
278 "%s is not valid for the self option", r->name, s);
279
280 /* If any router has check_local_user set, default retry_use_local_part
281 TRUE; otherwise its default is FALSE. */
282
283 if (r->retry_use_local_part == TRUE_UNSET)
284 r->retry_use_local_part = r->check_local_user;
285
286 /* Build a host list if fallback hosts is set. */
287
288 host_build_hostlist(&(r->fallback_hostlist), r->fallback_hosts, FALSE);
289
290 /* Check redirect_router and pass_router are valid */
291
292 if (r->redirect_router_name)
293 set_router(r, r->redirect_router_name, &(r->redirect_router), FALSE);
294
295 if (r->pass_router_name)
296 set_router(r, r->pass_router_name, &(r->pass_router), TRUE);
297
298 #ifdef notdef
299 DEBUG(D_route) debug_printf("DSN: %s %s\n", r->name,
300 r->dsn_lasthop ? "lasthop set" : "propagating DSN");
301 #endif
302 }
303 }
304
305
306
307 /*************************************************
308 * Tidy up after routing *
309 *************************************************/
310
311 /* Routers are entitled to keep hold of certain resources in their instance
312 blocks so as to save setting them up each time. An example is an open file.
313 Such routers must provide a tidyup entry point which is called when all routing
314 is finished, via this function. */
315
316 void
317 route_tidyup(void)
318 {
319 for (router_instance * r = routers; r; r = r->next)
320 if (r->info->tidyup) (r->info->tidyup)(r);
321 }
322
323
324
325 /*************************************************
326 * Check local part for prefix *
327 *************************************************/
328
329 /* This function is handed a local part and a list of possible prefixes; if any
330 one matches, return the prefix length. A prefix beginning with '*' is a
331 wildcard.
332
333 Arguments:
334 local_part the local part to check
335 prefixes the list of prefixes
336
337 Returns: length of matching prefix or zero
338 */
339
340 int
341 route_check_prefix(const uschar *local_part, const uschar *prefixes)
342 {
343 int sep = 0;
344 uschar *prefix;
345 const uschar *listptr = prefixes;
346 uschar prebuf[64];
347
348 while ((prefix = string_nextinlist(&listptr, &sep, prebuf, sizeof(prebuf))))
349 {
350 int plen = Ustrlen(prefix);
351 if (prefix[0] == '*')
352 {
353 prefix++;
354 for (const uschar * p = local_part + Ustrlen(local_part) - (--plen);
355 p >= local_part; p--)
356 if (strncmpic(prefix, p, plen) == 0) return plen + p - local_part;
357 }
358 else
359 if (strncmpic(prefix, local_part, plen) == 0) return plen;
360 }
361
362 return 0;
363 }
364
365
366
367 /*************************************************
368 * Check local part for suffix *
369 *************************************************/
370
371 /* This function is handed a local part and a list of possible suffixes;
372 if any one matches, return the suffix length. A suffix ending with '*'
373 is a wildcard.
374
375 Arguments:
376 local_part the local part to check
377 suffixes the list of suffixes
378
379 Returns: length of matching suffix or zero
380 */
381
382 int
383 route_check_suffix(const uschar *local_part, const uschar *suffixes)
384 {
385 int sep = 0;
386 int alen = Ustrlen(local_part);
387 uschar *suffix;
388 const uschar *listptr = suffixes;
389 uschar sufbuf[64];
390
391 while ((suffix = string_nextinlist(&listptr, &sep, sufbuf, sizeof(sufbuf))))
392 {
393 int slen = Ustrlen(suffix);
394 if (suffix[slen-1] == '*')
395 {
396 const uschar *pend = local_part + alen - (--slen) + 1;
397 for (const uschar * p = local_part; p < pend; p++)
398 if (strncmpic(suffix, p, slen) == 0) return alen - (p - local_part);
399 }
400 else
401 if (alen > slen && strncmpic(suffix, local_part + alen - slen, slen) == 0)
402 return slen;
403 }
404
405 return 0;
406 }
407
408
409
410
411 /*************************************************
412 * Check local part, domain, or sender *
413 *************************************************/
414
415 /* The checks in check_router_conditions() require similar code, so we use
416 this function to save repetition.
417
418 Arguments:
419 rname router name for error messages
420 type type of check, for error message
421 list domains, local_parts, or senders list
422 anchorptr -> tree for possibly cached items (domains)
423 cache_bits cached bits pointer
424 listtype MCL_DOMAIN for domain check
425 MCL_LOCALPART for local part check
426 MCL_ADDRESS for sender check
427 domloc current domain, current local part, or NULL for sender check
428 ldata where to put lookup data
429 caseless passed on to match_isinlist()
430 perror where to put an error message
431
432 Returns: OK item is in list
433 SKIP item is not in list, router is to be skipped
434 DEFER lookup or other defer
435 */
436
437 static int
438 route_check_dls(uschar *rname, uschar *type, const uschar *list,
439 tree_node **anchorptr, unsigned int *cache_bits, int listtype,
440 const uschar *domloc, const uschar **ldata, BOOL caseless, uschar **perror)
441 {
442 if (!list) return OK; /* Empty list always succeeds */
443
444 DEBUG(D_route) debug_printf("checking %s\n", type);
445
446 /* The domain and local part use the same matching function, whereas sender
447 has its own code. */
448
449 switch(domloc
450 ? match_isinlist(domloc, &list, 0, anchorptr, cache_bits, listtype,
451 caseless, ldata)
452 : match_address_list(sender_address ? sender_address : US"",
453 TRUE, TRUE, &list, cache_bits, -1, 0, CUSS &sender_data)
454 )
455 {
456 case OK:
457 return OK;
458
459 case FAIL:
460 *perror = string_sprintf("%s router skipped: %s mismatch", rname, type);
461 DEBUG(D_route) debug_printf("%s\n", *perror);
462 return SKIP;
463
464 default: /* Paranoia, and keeps compilers happy */
465 case DEFER:
466 *perror = string_sprintf("%s check lookup or other defer", type);
467 DEBUG(D_route) debug_printf("%s\n", *perror);
468 return DEFER;
469 }
470 }
471
472
473
474 /*************************************************
475 * Check access by a given uid/gid *
476 *************************************************/
477
478 /* This function checks whether a given uid/gid has access to a given file or
479 directory. It is called only from check_files() below. This is hopefully a
480 cheapish check that does the job most of the time. Exim does *not* rely on this
481 test when actually accessing any file. The test is used when routing to make it
482 possible to take actions such as "if user x can access file y then run this
483 router".
484
485 During routing, Exim is normally running as root, and so the test will work
486 except for NFS non-root mounts. When verifying during message reception, Exim
487 is running as "exim", so the test may not work. This is a limitation of the
488 Exim design.
489
490 Code in check_files() below detects the case when it cannot stat() the file (as
491 root), and in that situation it uses a setuid subprocess in which to run this
492 test.
493
494 Arguments:
495 path the path to check
496 uid the user
497 gid the group
498 bits the bits required in the final component
499
500 Returns: TRUE
501 FALSE errno=EACCES or ENOENT (or others from realpath or stat)
502 */
503
504 static BOOL
505 route_check_access(uschar *path, uid_t uid, gid_t gid, int bits)
506 {
507 struct stat statbuf;
508 uschar *slash;
509 uschar *rp = US realpath(CS path, CS big_buffer);
510 uschar *sp = rp + 1;
511
512 DEBUG(D_route) debug_printf("route_check_access(%s,%d,%d,%o)\n", path,
513 (int)uid, (int)gid, bits);
514
515 if (!rp) return FALSE;
516
517 while ((slash = Ustrchr(sp, '/')))
518 {
519 *slash = 0;
520 DEBUG(D_route) debug_printf("stat %s\n", rp);
521 if (Ustat(rp, &statbuf) < 0) return FALSE;
522 if ((statbuf.st_mode &
523 ((statbuf.st_uid == uid)? 0100 : (statbuf.st_gid == gid)? 0010 : 001)
524 ) == 0)
525 {
526 errno = EACCES;
527 return FALSE;
528 }
529 *slash = '/';
530 sp = slash + 1;
531 }
532
533 /* Down to the final component */
534
535 DEBUG(D_route) debug_printf("stat %s\n", rp);
536
537 if (Ustat(rp, &statbuf) < 0) return FALSE;
538
539 if (statbuf.st_uid == uid) bits = bits << 6;
540 else if (statbuf.st_gid == gid) bits = bits << 3;
541 if ((statbuf.st_mode & bits) != bits)
542 {
543 errno = EACCES;
544 return FALSE;
545 }
546
547 DEBUG(D_route) debug_printf("route_check_access() succeeded\n");
548 return TRUE;
549 }
550
551
552
553 /*************************************************
554 * Do file existence tests *
555 *************************************************/
556
557 /* This function is given a colon-separated list of file tests, each of which
558 is expanded before use. A test consists of a file name, optionally preceded by
559 ! (require non-existence) and/or + for handling permission denied (+ means
560 treat as non-existing).
561
562 An item that contains no slashes is interpreted as a username or id, with an
563 optional group id, for checking access to the file. This cannot be done
564 "perfectly", but it is good enough for a number of applications.
565
566 Arguments:
567 s a colon-separated list of file tests or NULL
568 perror a pointer to an anchor for an error text in the case of a DEFER
569
570 Returns: OK if s == NULL or all tests are as required
571 DEFER if the existence of at least one of the files is
572 unclear (an error other than non-existence occurred);
573 DEFER if an expansion failed
574 DEFER if a name is not absolute
575 DEFER if problems with user/group
576 SKIP otherwise
577 */
578
579 static int
580 check_files(const uschar *s, uschar **perror)
581 {
582 int sep = 0; /* List has default separators */
583 uid_t uid = 0; /* For picky compilers */
584 gid_t gid = 0; /* For picky compilers */
585 BOOL ugid_set = FALSE;
586 const uschar *listptr;
587 uschar *check;
588 uschar buffer[1024];
589
590 if (!s) return OK;
591
592 DEBUG(D_route) debug_printf("checking require_files\n");
593
594 listptr = s;
595 while ((check = string_nextinlist(&listptr, &sep, buffer, sizeof(buffer))))
596 {
597 int rc;
598 int eacces_code = 0;
599 BOOL invert = FALSE;
600 struct stat statbuf;
601 uschar *ss = expand_string(check);
602
603 if (!ss)
604 {
605 if (f.expand_string_forcedfail) continue;
606 *perror = string_sprintf("failed to expand \"%s\" for require_files: %s",
607 check, expand_string_message);
608 goto RETURN_DEFER;
609 }
610
611 /* Empty items are just skipped */
612
613 if (*ss == 0) continue;
614
615 /* If there are no slashes in the string, we have a user name or uid, with
616 optional group/gid. */
617
618 if (Ustrchr(ss, '/') == NULL)
619 {
620 BOOL ok;
621 struct passwd *pw;
622 uschar *comma = Ustrchr(ss, ',');
623
624 /* If there's a comma, temporarily terminate the user name/number
625 at that point. Then set the uid. */
626
627 if (comma != NULL) *comma = 0;
628 ok = route_finduser(ss, &pw, &uid);
629 if (comma != NULL) *comma = ',';
630
631 if (!ok)
632 {
633 *perror = string_sprintf("user \"%s\" for require_files not found", ss);
634 goto RETURN_DEFER;
635 }
636
637 /* If there was no comma, the gid is that associated with the user. */
638
639 if (comma == NULL)
640 {
641 if (pw != NULL) gid = pw->pw_gid; else
642 {
643 *perror = string_sprintf("group missing after numerical uid %d for "
644 "require_files", (int)uid);
645 goto RETURN_DEFER;
646 }
647 }
648 else
649 {
650 if (!route_findgroup(comma + 1, &gid))
651 {
652 *perror = string_sprintf("group \"%s\" for require_files not found\n",
653 comma + 1);
654 goto RETURN_DEFER;
655 }
656 }
657
658 /* Note that we have values set, and proceed to next item */
659
660 DEBUG(D_route)
661 debug_printf("check subsequent files for access by %s\n", ss);
662 ugid_set = TRUE;
663 continue;
664 }
665
666 /* Path, possibly preceded by + and ! */
667
668 if (*ss == '+')
669 {
670 eacces_code = 1;
671 while (isspace((*(++ss))));
672 }
673
674 if (*ss == '!')
675 {
676 invert = TRUE;
677 while (isspace((*(++ss))));
678 }
679
680 if (*ss != '/')
681 {
682 *perror = string_sprintf("require_files: \"%s\" is not absolute", ss);
683 goto RETURN_DEFER;
684 }
685
686 /* Stat the file, either as root (while routing) or as exim (while verifying
687 during message reception). */
688
689 rc = Ustat(ss, &statbuf);
690
691 DEBUG(D_route)
692 {
693 debug_printf("file check: %s\n", check);
694 if (ss != check) debug_printf("expanded file: %s\n", ss);
695 debug_printf("stat() yielded %d\n", rc);
696 }
697
698 /* If permission is denied, and we are running as root (i.e. routing for
699 delivery rather than verifying), and the requirement is to test for access by
700 a particular uid/gid, it must mean that the file is on a non-root-mounted NFS
701 system. In this case, we have to use a subprocess that runs as the relevant
702 uid in order to do the test. */
703
704 if (rc != 0 && errno == EACCES && ugid_set && getuid() == root_uid)
705 {
706 int status;
707 pid_t pid;
708 void (*oldsignal)(int);
709
710 DEBUG(D_route) debug_printf("root is denied access: forking to check "
711 "in subprocess\n");
712
713 /* Before forking, ensure that SIGCHLD is set to SIG_DFL before forking, so
714 that the child process can be waited for, just in case get here with it set
715 otherwise. Save the old state for resetting on the wait. */
716
717 oldsignal = signal(SIGCHLD, SIG_DFL);
718 pid = fork();
719
720 /* If fork() fails, reinstate the original error and behave as if
721 this block of code were not present. This is the same behaviour as happens
722 when Exim is not running as root at this point. */
723
724 if (pid < 0)
725 {
726 DEBUG(D_route)
727 debug_printf("require_files: fork failed: %s\n", strerror(errno));
728 errno = EACCES;
729 goto HANDLE_ERROR;
730 }
731
732 /* In the child process, change uid and gid, and then do the check using
733 the route_check_access() function. This does more than just stat the file;
734 it tests permissions as well. Return 0 for OK and 1 for failure. */
735
736 if (pid == 0)
737 {
738 exim_setugid(uid, gid, TRUE,
739 string_sprintf("require_files check, file=%s", ss));
740 if (route_check_access(ss, uid, gid, 4))
741 exim_underbar_exit(0);
742 DEBUG(D_route) debug_printf("route_check_access() failed\n");
743 exim_underbar_exit(1);
744 }
745
746 /* In the parent, wait for the child to finish */
747
748 while (waitpid(pid, &status, 0) < 0)
749 if (errno != EINTR) /* unexpected error, interpret as failure */
750 {
751 status = 1;
752 break;
753 }
754
755 signal(SIGCHLD, oldsignal); /* restore */
756 if ((status == 0) == invert) return SKIP;
757 continue; /* to test the next file */
758 }
759
760 /* Control reaches here if the initial stat() succeeds, or fails with an
761 error other than EACCES, or no uid/gid is set, or we are not running as root.
762 If we know the file exists and uid/gid are set, try to check read access for
763 that uid/gid as best we can. */
764
765 if (rc == 0 && ugid_set && !route_check_access(ss, uid, gid, 4))
766 {
767 DEBUG(D_route) debug_printf("route_check_access() failed\n");
768 rc = -1;
769 }
770
771 /* Handle error returns from stat() or route_check_access(). The EACCES error
772 is handled specially. At present, we can force it to be treated as
773 non-existence. Write the code so that it will be easy to add forcing for
774 existence if required later. */
775
776 HANDLE_ERROR:
777 if (rc < 0)
778 {
779 DEBUG(D_route) debug_printf("errno = %d\n", errno);
780 if (errno == EACCES)
781 {
782 if (eacces_code == 1)
783 {
784 DEBUG(D_route) debug_printf("EACCES => ENOENT\n");
785 errno = ENOENT; /* Treat as non-existent */
786 }
787 }
788 if (errno != ENOENT)
789 {
790 *perror = string_sprintf("require_files: error for %s: %s", ss,
791 strerror(errno));
792 goto RETURN_DEFER;
793 }
794 }
795
796 /* At this point, rc < 0 => non-existence; rc >= 0 => existence */
797
798 if ((rc >= 0) == invert) return SKIP;
799 }
800
801 return OK;
802
803 /* Come here on any of the errors that return DEFER. */
804
805 RETURN_DEFER:
806 DEBUG(D_route) debug_printf("%s\n", *perror);
807 return DEFER;
808 }
809
810
811
812
813
814 /*************************************************
815 * Check for router skipping *
816 *************************************************/
817
818 /* This function performs various checks to see whether a router should be
819 skipped. The order in which they are performed is important.
820
821 Arguments:
822 r pointer to router instance block
823 addr address that is being handled
824 verify the verification type
825 pw ptr to ptr to passwd structure for local user
826 perror for lookup errors
827
828 Returns: OK if all the tests succeed
829 SKIP if router is to be skipped
830 DEFER for a lookup defer
831 FAIL for address to be failed
832 */
833
834 static BOOL
835 check_router_conditions(router_instance *r, address_item *addr, int verify,
836 struct passwd **pw, uschar **perror)
837 {
838 int rc;
839 uschar *check_local_part;
840 unsigned int *localpart_cache;
841
842 /* Reset variables to hold a home directory and data from lookup of a domain or
843 local part, and ensure search_find_defer is unset, in case there aren't any
844 actual lookups. */
845
846 deliver_home = NULL;
847 deliver_domain_data = NULL;
848 deliver_localpart_data = NULL;
849 sender_data = NULL;
850 local_user_gid = (gid_t)(-1);
851 local_user_uid = (uid_t)(-1);
852 f.search_find_defer = FALSE;
853
854 /* Skip this router if not verifying and it has verify_only set */
855
856 if ((verify == v_none || verify == v_expn) && r->verify_only)
857 {
858 DEBUG(D_route) debug_printf("%s router skipped: verify_only set\n", r->name);
859 return SKIP;
860 }
861
862 /* Skip this router if testing an address (-bt) and address_test is not set */
863
864 if (f.address_test_mode && !r->address_test)
865 {
866 DEBUG(D_route) debug_printf("%s router skipped: address_test is unset\n",
867 r->name);
868 return SKIP;
869 }
870
871 /* Skip this router if verifying and it hasn't got the appropriate verify flag
872 set. */
873
874 if ((verify == v_sender && !r->verify_sender) ||
875 (verify == v_recipient && !r->verify_recipient))
876 {
877 DEBUG(D_route) debug_printf("%s router skipped: verify %d %d %d\n",
878 r->name, verify, r->verify_sender, r->verify_recipient);
879 return SKIP;
880 }
881
882 /* Skip this router if processing EXPN and it doesn't have expn set */
883
884 if (verify == v_expn && !r->expn)
885 {
886 DEBUG(D_route) debug_printf("%s router skipped: no_expn set\n", r->name);
887 return SKIP;
888 }
889
890 /* Skip this router if there's a domain mismatch. */
891
892 if ((rc = route_check_dls(r->name, US"domains", r->domains, &domainlist_anchor,
893 addr->domain_cache, TRUE, addr->domain, CUSS &deliver_domain_data,
894 MCL_DOMAIN, perror)) != OK)
895 return rc;
896
897 /* Skip this router if there's a local part mismatch. We want to pass over the
898 caseful local part, so that +caseful can restore it, even if this router is
899 handling local parts caselessly. However, we can't just pass cc_local_part,
900 because that doesn't have the prefix or suffix stripped. A bit of massaging is
901 required. Also, we only use the match cache for local parts that have not had
902 a prefix or suffix stripped. */
903
904 if (!addr->prefix && !addr->suffix)
905 {
906 localpart_cache = addr->localpart_cache;
907 check_local_part = addr->cc_local_part;
908 }
909 else
910 {
911 localpart_cache = NULL;
912 check_local_part = string_copy(addr->cc_local_part);
913 if (addr->prefix)
914 check_local_part += Ustrlen(addr->prefix);
915 if (addr->suffix)
916 check_local_part[Ustrlen(check_local_part) - Ustrlen(addr->suffix)] = 0;
917 }
918
919 if ((rc = route_check_dls(r->name, US"local_parts", r->local_parts,
920 &localpartlist_anchor, localpart_cache, MCL_LOCALPART,
921 check_local_part, CUSS &deliver_localpart_data,
922 !r->caseful_local_part, perror)) != OK)
923 return rc;
924
925 /* If the check_local_user option is set, check that the local_part is the
926 login of a local user. Note: the third argument to route_finduser() must be
927 NULL here, to prevent a numeric string being taken as a numeric uid. If the
928 user is found, set deliver_home to the home directory, and also set
929 local_user_{uid,gid}. */
930
931 if (r->check_local_user)
932 {
933 DEBUG(D_route) debug_printf("checking for local user\n");
934 if (!route_finduser(addr->local_part, pw, NULL))
935 {
936 DEBUG(D_route) debug_printf("%s router skipped: %s is not a local user\n",
937 r->name, addr->local_part);
938 return SKIP;
939 }
940 deliver_home = string_copy(US (*pw)->pw_dir);
941 local_user_gid = (*pw)->pw_gid;
942 local_user_uid = (*pw)->pw_uid;
943 }
944
945 /* Set (or override in the case of check_local_user) the home directory if
946 router_home_directory is set. This is done here so that it overrides $home from
947 check_local_user before any subsequent expansions are done. Otherwise, $home
948 could mean different things for different options, which would be extremely
949 confusing. */
950
951 if (r->router_home_directory)
952 {
953 uschar *router_home = expand_string(r->router_home_directory);
954 if (!router_home)
955 {
956 if (!f.expand_string_forcedfail)
957 {
958 *perror = string_sprintf("failed to expand \"%s\" for "
959 "router_home_directory: %s", r->router_home_directory,
960 expand_string_message);
961 return DEFER;
962 }
963 }
964 else
965 {
966 setflag(addr, af_home_expanded); /* Note set from router_home_directory */
967 deliver_home = router_home;
968 }
969 }
970
971 /* Skip if the sender condition is not met. We leave this one till after the
972 local user check so that $home is set - enabling the possibility of letting
973 individual recipients specify lists of acceptable/unacceptable senders. */
974
975 if ((rc = route_check_dls(r->name, US"senders", r->senders, NULL,
976 sender_address_cache, MCL_ADDRESS, NULL, NULL, FALSE, perror)) != OK)
977 return rc;
978
979 /* This is the point at which we print out the router's debugging string if it
980 is set. We wait till here so as to have $home available for local users (and
981 anyway, we don't want too much stuff for skipped routers). */
982
983 debug_print_string(r->debug_string);
984
985 /* Perform file existence tests. */
986
987 if ((rc = check_files(r->require_files, perror)) != OK)
988 {
989 DEBUG(D_route) debug_printf("%s router %s: file check\n", r->name,
990 (rc == SKIP)? "skipped" : "deferred");
991 return rc;
992 }
993
994 /* Now the general condition test. */
995
996 if (r->condition)
997 {
998 DEBUG(D_route) debug_printf("checking \"condition\" \"%.80s\"...\n", r->condition);
999 if (!expand_check_condition(r->condition, r->name, US"router"))
1000 {
1001 if (f.search_find_defer)
1002 {
1003 *perror = US"condition check lookup defer";
1004 DEBUG(D_route) debug_printf("%s\n", *perror);
1005 return DEFER;
1006 }
1007 DEBUG(D_route)
1008 debug_printf("%s router skipped: condition failure\n", r->name);
1009 return SKIP;
1010 }
1011 }
1012
1013 #ifdef EXPERIMENTAL_BRIGHTMAIL
1014 /* check if a specific Brightmail AntiSpam rule fired on the message */
1015 if (r->bmi_rule)
1016 {
1017 DEBUG(D_route) debug_printf("checking bmi_rule\n");
1018 if (bmi_check_rule(bmi_base64_verdict, r->bmi_rule) == 0)
1019 { /* none of the rules fired */
1020 DEBUG(D_route)
1021 debug_printf("%s router skipped: none of bmi_rule rules fired\n", r->name);
1022 return SKIP;
1023 }
1024 }
1025
1026 /* check if message should not be delivered */
1027 if (r->bmi_dont_deliver && bmi_deliver == 1)
1028 {
1029 DEBUG(D_route)
1030 debug_printf("%s router skipped: bmi_dont_deliver is FALSE\n", r->name);
1031 return SKIP;
1032 }
1033
1034 /* check if message should go to an alternate location */
1035 if ( r->bmi_deliver_alternate
1036 && (bmi_deliver == 0 || !bmi_alt_location)
1037 )
1038 {
1039 DEBUG(D_route)
1040 debug_printf("%s router skipped: bmi_deliver_alternate is FALSE\n", r->name);
1041 return SKIP;
1042 }
1043
1044 /* check if message should go to default location */
1045 if ( r->bmi_deliver_default
1046 && (bmi_deliver == 0 || bmi_alt_location)
1047 )
1048 {
1049 DEBUG(D_route)
1050 debug_printf("%s router skipped: bmi_deliver_default is FALSE\n", r->name);
1051 return SKIP;
1052 }
1053 #endif
1054
1055 /* All the checks passed. */
1056
1057 return OK;
1058 }
1059
1060
1061
1062
1063 /*************************************************
1064 * Find a local user *
1065 *************************************************/
1066
1067 /* Try several times (if configured) to find a local user, in case delays in
1068 NIS or NFS whatever cause an incorrect refusal. It's a pity that getpwnam()
1069 doesn't have some kind of indication as to why it has failed. If the string
1070 given consists entirely of digits, and the third argument is not NULL, assume
1071 the string is the numerical value of the uid. Otherwise it is looked up using
1072 getpwnam(). The uid is passed back via return_uid, if not NULL, and the
1073 pointer to a passwd structure, if found, is passed back via pw, if not NULL.
1074
1075 Because this may be called several times in succession for the same user for
1076 different routers, cache the result of the previous getpwnam call so that it
1077 can be re-used. Note that we can't just copy the structure, as the store it
1078 points to can get trashed.
1079
1080 Arguments:
1081 s the login name or textual form of the numerical uid of the user
1082 pw if not NULL, return the result of getpwnam here, or set NULL
1083 if no call to getpwnam is made (s numeric, return_uid != NULL)
1084 return_uid if not NULL, return the uid via this address
1085
1086 Returns: TRUE if s is numerical or was looked up successfully
1087
1088 */
1089
1090 static struct passwd pwcopy;
1091 static struct passwd *lastpw = NULL;
1092 static uschar lastname[48] = { 0 };
1093 static uschar lastdir[128];
1094 static uschar lastgecos[128];
1095 static uschar lastshell[128];
1096
1097 BOOL
1098 route_finduser(const uschar *s, struct passwd **pw, uid_t *return_uid)
1099 {
1100 BOOL cache_set = (Ustrcmp(lastname, s) == 0);
1101
1102 DEBUG(D_uid) debug_printf("seeking password data for user \"%s\": %s\n", s,
1103 cache_set ? "using cached result" : "cache not available");
1104
1105 if (!cache_set)
1106 {
1107 int i = 0;
1108
1109 if (return_uid && (isdigit(*s) || *s == '-') &&
1110 s[Ustrspn(s+1, "0123456789")+1] == 0)
1111 {
1112 *return_uid = (uid_t)Uatoi(s);
1113 if (pw) *pw = NULL;
1114 return TRUE;
1115 }
1116
1117 string_format_nt(lastname, sizeof(lastname), "%s", s);
1118
1119 /* Force failure if string length is greater than given maximum */
1120
1121 if (max_username_length > 0 && Ustrlen(lastname) > max_username_length)
1122 {
1123 DEBUG(D_uid) debug_printf("forced failure of finduser(): string "
1124 "length of %s is greater than %d\n", lastname, max_username_length);
1125 lastpw = NULL;
1126 }
1127
1128 /* Try a few times if so configured; this handles delays in NIS etc. */
1129
1130 else for (;;)
1131 {
1132 errno = 0;
1133 if ((lastpw = getpwnam(CS s))) break;
1134 if (++i > finduser_retries) break;
1135 sleep(1);
1136 }
1137
1138 if (lastpw)
1139 {
1140 pwcopy.pw_uid = lastpw->pw_uid;
1141 pwcopy.pw_gid = lastpw->pw_gid;
1142 (void)string_format(lastdir, sizeof(lastdir), "%s", lastpw->pw_dir);
1143 (void)string_format(lastgecos, sizeof(lastgecos), "%s", lastpw->pw_gecos);
1144 (void)string_format(lastshell, sizeof(lastshell), "%s", lastpw->pw_shell);
1145 pwcopy.pw_name = CS lastname;
1146 pwcopy.pw_dir = CS lastdir;
1147 pwcopy.pw_gecos = CS lastgecos;
1148 pwcopy.pw_shell = CS lastshell;
1149 lastpw = &pwcopy;
1150 }
1151
1152 else DEBUG(D_uid) if (errno != 0)
1153 debug_printf("getpwnam(%s) failed: %s\n", s, strerror(errno));
1154 }
1155
1156 if (!lastpw)
1157 {
1158 DEBUG(D_uid) debug_printf("getpwnam() returned NULL (user not found)\n");
1159 return FALSE;
1160 }
1161
1162 DEBUG(D_uid) debug_printf("getpwnam() succeeded uid=%d gid=%d\n",
1163 lastpw->pw_uid, lastpw->pw_gid);
1164
1165 if (return_uid) *return_uid = lastpw->pw_uid;
1166 if (pw) *pw = lastpw;
1167
1168 return TRUE;
1169 }
1170
1171
1172
1173
1174 /*************************************************
1175 * Find a local group *
1176 *************************************************/
1177
1178 /* Try several times (if configured) to find a local group, in case delays in
1179 NIS or NFS whatever cause an incorrect refusal. It's a pity that getgrnam()
1180 doesn't have some kind of indication as to why it has failed.
1181
1182 Arguments:
1183 s the group name or textual form of the numerical gid
1184 return_gid return the gid via this address
1185
1186 Returns: TRUE if the group was found; FALSE otherwise
1187
1188 */
1189
1190 BOOL
1191 route_findgroup(uschar *s, gid_t *return_gid)
1192 {
1193 int i = 0;
1194 struct group *gr;
1195
1196 if ((isdigit(*s) || *s == '-') && s[Ustrspn(s+1, "0123456789")+1] == 0)
1197 {
1198 *return_gid = (gid_t)Uatoi(s);
1199 return TRUE;
1200 }
1201
1202 for (;;)
1203 {
1204 if ((gr = getgrnam(CS s)))
1205 {
1206 *return_gid = gr->gr_gid;
1207 return TRUE;
1208 }
1209 if (++i > finduser_retries) break;
1210 sleep(1);
1211 }
1212
1213 return FALSE;
1214 }
1215
1216
1217
1218
1219 /*************************************************
1220 * Find user by expanding string *
1221 *************************************************/
1222
1223 /* Expands a string, and then looks up the result in the passwd file.
1224
1225 Arguments:
1226 string the string to be expanded, yielding a login name or a numerical
1227 uid value (to be passed to route_finduser())
1228 driver_name caller name for panic error message (only)
1229 driver_type caller type for panic error message (only)
1230 pw return passwd entry via this pointer
1231 uid return uid via this pointer
1232 errmsg where to point a message on failure
1233
1234 Returns: TRUE if user found, FALSE otherwise
1235 */
1236
1237 BOOL
1238 route_find_expanded_user(uschar *string, uschar *driver_name,
1239 uschar *driver_type, struct passwd **pw, uid_t *uid, uschar **errmsg)
1240 {
1241 uschar *user = expand_string(string);
1242
1243 if (!user)
1244 {
1245 *errmsg = string_sprintf("Failed to expand user string \"%s\" for the "
1246 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1247 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1248 return FALSE;
1249 }
1250
1251 if (route_finduser(user, pw, uid)) return TRUE;
1252
1253 *errmsg = string_sprintf("Failed to find user \"%s\" from expanded string "
1254 "\"%s\" for the %s %s", user, string, driver_name, driver_type);
1255 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1256 return FALSE;
1257 }
1258
1259
1260
1261 /*************************************************
1262 * Find group by expanding string *
1263 *************************************************/
1264
1265 /* Expands a string and then looks up the result in the group file.
1266
1267 Arguments:
1268 string the string to be expanded, yielding a group name or a numerical
1269 gid value (to be passed to route_findgroup())
1270 driver_name caller name for panic error message (only)
1271 driver_type caller type for panic error message (only)
1272 gid return gid via this pointer
1273 errmsg return error message via this pointer
1274
1275 Returns: TRUE if found group, FALSE otherwise
1276 */
1277
1278 BOOL
1279 route_find_expanded_group(uschar *string, uschar *driver_name, uschar *driver_type,
1280 gid_t *gid, uschar **errmsg)
1281 {
1282 BOOL yield = TRUE;
1283 uschar *group = expand_string(string);
1284
1285 if (!group)
1286 {
1287 *errmsg = string_sprintf("Failed to expand group string \"%s\" for the "
1288 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1289 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1290 return FALSE;
1291 }
1292
1293 if (!route_findgroup(group, gid))
1294 {
1295 *errmsg = string_sprintf("Failed to find group \"%s\" from expanded string "
1296 "\"%s\" for the %s %s", group, string, driver_name, driver_type);
1297 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1298 yield = FALSE;
1299 }
1300
1301 return yield;
1302 }
1303
1304
1305
1306 /*************************************************
1307 * Handle an unseen routing *
1308 *************************************************/
1309
1310 /* This function is called when an address is routed by a router with "unseen"
1311 set. It must make a clone of the address, for handling by subsequent drivers.
1312 The clone is set to start routing at the next router.
1313
1314 The original address must be replaced by an invented "parent" which has the
1315 routed address plus the clone as its children. This is necessary in case the
1316 address is at the top level - we don't want to mark it complete until both
1317 deliveries have been done.
1318
1319 A new unique field must be made, so that the record of the delivery isn't a
1320 record of the original address, and checking for already delivered has
1321 therefore to be done here. If the delivery has happened, then take the base
1322 address off whichever delivery queue it is on - it will always be the top item.
1323
1324 Arguments:
1325 name router name
1326 addr address that was routed
1327 paddr_local chain of local-delivery addresses
1328 paddr_remote chain of remote-delivery addresses
1329 addr_new chain for newly created addresses
1330
1331 Returns: nothing
1332 */
1333
1334 static void
1335 route_unseen(uschar *name, address_item *addr, address_item **paddr_local,
1336 address_item **paddr_remote, address_item **addr_new)
1337 {
1338 address_item *parent = deliver_make_addr(addr->address, TRUE);
1339 address_item *new = deliver_make_addr(addr->address, TRUE);
1340
1341 /* The invented parent is a copy that replaces the original; note that
1342 this copies its parent pointer. It has two children, and its errors_address is
1343 from the original address' parent, if present, otherwise unset. */
1344
1345 *parent = *addr;
1346 parent->child_count = 2;
1347 parent->prop.errors_address =
1348 addr->parent ? addr->parent->prop.errors_address : NULL;
1349
1350 /* The routed address gets a new parent. */
1351
1352 addr->parent = parent;
1353
1354 /* The clone has this parent too. Set its errors address from the parent. This
1355 was set from the original parent (or to NULL) - see above. We do NOT want to
1356 take the errors address from the unseen router. */
1357
1358 new->parent = parent;
1359 new->prop.errors_address = parent->prop.errors_address;
1360
1361 /* Copy the propagated flags and address_data from the original. */
1362
1363 new->prop.ignore_error = addr->prop.ignore_error;
1364 new->prop.address_data = addr->prop.address_data;
1365 new->prop.variables = NULL;
1366 tree_dup((tree_node **)&new->prop.variables, addr->prop.variables);
1367 new->dsn_flags = addr->dsn_flags;
1368 new->dsn_orcpt = addr->dsn_orcpt;
1369
1370
1371 /* As it has turned out, we haven't set headers_add or headers_remove for the
1372 * clone. Thinking about it, it isn't entirely clear whether they should be
1373 * copied from the original parent, like errors_address, or taken from the
1374 * unseen router, like address_data and the flags. Until somebody brings this
1375 * up, I propose to leave the code as it is.
1376 */
1377
1378
1379 /* Set the cloned address to start at the next router, and put it onto the
1380 chain of new addresses. */
1381
1382 new->start_router = addr->router->next;
1383 new->next = *addr_new;
1384 *addr_new = new;
1385
1386 DEBUG(D_route) debug_printf("\"unseen\" set: replicated %s\n", addr->address);
1387
1388 /* Make a new unique field, to distinguish from the normal one. */
1389
1390 addr->unique = string_sprintf("%s/%s", addr->unique, name);
1391
1392 /* If the address has been routed to a transport, see if it was previously
1393 delivered. If so, we take it off the relevant queue so that it isn't delivered
1394 again. Otherwise, it was an alias or something, and the addresses it generated
1395 are handled in the normal way. */
1396
1397 if (addr->transport && tree_search(tree_nonrecipients, addr->unique))
1398 {
1399 DEBUG(D_route)
1400 debug_printf("\"unseen\" delivery previously done - discarded\n");
1401 parent->child_count--;
1402 if (*paddr_remote == addr) *paddr_remote = addr->next;
1403 if (*paddr_local == addr) *paddr_local = addr->next;
1404 }
1405 }
1406
1407
1408
1409 /************************************************/
1410 /* Add router-assigned variables
1411 Return OK/DEFER/FAIL/PASS */
1412
1413 static int
1414 set_router_vars(address_item * addr, const router_instance * r)
1415 {
1416 const uschar * varlist = r->set;
1417 tree_node ** root = (tree_node **) &addr->prop.variables;
1418 int sep = ';';
1419
1420 if (!varlist) return OK;
1421
1422 /* Walk the varlist, creating variables */
1423
1424 for (uschar * ele; (ele = string_nextinlist(&varlist, &sep, NULL, 0)); )
1425 {
1426 const uschar * assignment = ele;
1427 int esep = '=';
1428 uschar * name = string_nextinlist(&assignment, &esep, NULL, 0);
1429 uschar * val;
1430 tree_node * node;
1431
1432 /* Variable name must exist and start "r_". */
1433
1434 if (!name || name[0] != 'r' || name[1] != '_' || !name[2])
1435 {
1436 log_write(0, LOG_MAIN|LOG_PANIC,
1437 "bad router variable name '%s' in router '%s'\n", name, r->name);
1438 return FAIL;
1439 }
1440 name += 2;
1441
1442 while (isspace(*assignment)) assignment++;
1443
1444 if (!(val = expand_string(US assignment)))
1445 if (f.expand_string_forcedfail)
1446 {
1447 int yield;
1448 BOOL more;
1449 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1450 "(router variable): decline action taken\n", ele);
1451
1452 /* Expand "more" if necessary; DEFER => an expansion failed */
1453
1454 yield = exp_bool(addr, US"router", r->name, D_route,
1455 US"more", r->more, r->expand_more, &more);
1456 if (yield != OK) return yield;
1457
1458 if (!more)
1459 {
1460 DEBUG(D_route)
1461 debug_printf("\"more\"=false: skipping remaining routers\n");
1462 router_name = NULL;
1463 r = NULL;
1464 return FAIL;
1465 }
1466 return PASS;
1467 }
1468 else
1469 {
1470 addr->message = string_sprintf("expansion of \"%s\" failed "
1471 "in %s router: %s", ele, r->name, expand_string_message);
1472 return DEFER;
1473 }
1474
1475 if (!(node = tree_search(*root, name)))
1476 { /* name should never be tainted */
1477 node = store_get(sizeof(tree_node) + Ustrlen(name), FALSE);
1478 Ustrcpy(node->name, name);
1479 (void)tree_insertnode(root, node);
1480 }
1481 node->data.ptr = US val;
1482 DEBUG(D_route) debug_printf("set r_%s%s = '%s'%s\n",
1483 name, is_tainted(name)?" (tainted)":"",
1484 val, is_tainted(val)?" (tainted)":"");
1485
1486 /* All expansions after this point need visibility of that variable */
1487 router_var = *root;
1488 }
1489 return OK;
1490 }
1491
1492
1493 /*************************************************
1494 * Route one address *
1495 *************************************************/
1496
1497 /* This function is passed in one address item, for processing by the routers.
1498 The verify flag is set if this is being called for verification rather than
1499 delivery. If the router doesn't have its "verify" flag set, it is skipped.
1500
1501 Arguments:
1502 addr address to route
1503 paddr_local chain of local-delivery addresses
1504 paddr_remote chain of remote-delivery addresses
1505 addr_new chain for newly created addresses
1506 addr_succeed chain for completed addresses
1507 verify v_none if not verifying
1508 v_sender if verifying a sender address
1509 v_recipient if verifying a recipient address
1510 v_expn if processing an EXPN address
1511
1512 Returns: OK => address successfully routed
1513 DISCARD => address was discarded
1514 FAIL => address could not be routed
1515 DEFER => some temporary problem
1516 ERROR => some major internal or configuration failure
1517 */
1518
1519 int
1520 route_address(address_item *addr, address_item **paddr_local,
1521 address_item **paddr_remote, address_item **addr_new,
1522 address_item **addr_succeed, int verify)
1523 {
1524 int yield = OK;
1525 BOOL unseen;
1526 router_instance *r, *nextr;
1527 const uschar *old_domain = addr->domain;
1528
1529 HDEBUG(D_route)
1530 {
1531 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1532 debug_printf("routing %s\n", addr->address);
1533 }
1534
1535 /* Loop through all router instances until a router succeeds, fails, defers, or
1536 encounters an error. If the address has start_router set, we begin from there
1537 instead of at the first router. */
1538
1539 for (r = addr->start_router ? addr->start_router : routers; r; r = nextr)
1540 {
1541 uschar *error;
1542 struct passwd *pw = NULL;
1543 struct passwd pwcopy;
1544 BOOL loop_detected = FALSE;
1545 BOOL more;
1546 int loopcount = 0;
1547 int rc;
1548
1549 DEBUG(D_route) debug_printf("--------> %s router <--------\n", r->name);
1550
1551 /* Reset any search error message from the previous router. */
1552
1553 search_error_message = NULL;
1554
1555 /* There are some weird cases where logging is disabled */
1556
1557 f.disable_logging = r->disable_logging;
1558
1559 /* Record the last router to handle the address, and set the default
1560 next router. */
1561
1562 addr->router = r;
1563 nextr = r->next;
1564
1565 /* Loop protection: If this address has an ancestor with the same address,
1566 and that ancestor was routed by this router, we skip this router. This
1567 prevents a variety of looping states when a new address is created by
1568 redirection or by the use of "unseen" on a router.
1569
1570 If no_repeat_use is set on the router, we skip if _any_ ancestor was routed
1571 by this router, even if it was different to the current address.
1572
1573 Just in case someone does put it into a loop (possible with redirection
1574 continually adding to an address, for example), put a long stop counter on
1575 the number of parents. */
1576
1577 for (address_item * parent = addr->parent; parent; parent = parent->parent)
1578 {
1579 if (parent->router == r)
1580 {
1581 BOOL break_loop = !r->repeat_use;
1582
1583 /* When repeat_use is set, first check the active addresses caselessly.
1584 If they match, we have to do a further caseful check of the local parts
1585 when caseful_local_part is set. This is assumed to be rare, which is why
1586 the code is written this way. */
1587
1588 if (!break_loop)
1589 {
1590 break_loop = strcmpic(parent->address, addr->address) == 0;
1591 if (break_loop && r->caseful_local_part)
1592 break_loop = Ustrncmp(parent->address, addr->address,
1593 Ustrrchr(addr->address, '@') - addr->address) == 0;
1594 }
1595
1596 if (break_loop)
1597 {
1598 DEBUG(D_route) debug_printf("%s router skipped: previously routed %s\n",
1599 r->name, parent->address);
1600 loop_detected = TRUE;
1601 break;
1602 }
1603 }
1604
1605 /* Continue with parents, limiting the size of the dynasty. */
1606
1607 if (loopcount++ > 100)
1608 {
1609 log_write(0, LOG_MAIN|LOG_PANIC, "routing loop for %s", addr->address);
1610 yield = DEFER;
1611 goto ROUTE_EXIT;
1612 }
1613 }
1614
1615 if (loop_detected) continue;
1616
1617 /* Default no affixes and select whether to use a caseful or caseless local
1618 part in this router. */
1619
1620 addr->prefix = addr->suffix = NULL;
1621 addr->local_part = r->caseful_local_part?
1622 addr->cc_local_part : addr->lc_local_part;
1623
1624 DEBUG(D_route) debug_printf("local_part=%s domain=%s\n", addr->local_part,
1625 addr->domain);
1626
1627 /* Handle any configured prefix by replacing the local_part address,
1628 and setting the prefix. Skip the router if the prefix doesn't match,
1629 unless the prefix is optional. */
1630
1631 if (r->prefix)
1632 {
1633 int plen = route_check_prefix(addr->local_part, r->prefix);
1634 if (plen > 0)
1635 {
1636 addr->prefix = string_copyn(addr->local_part, plen);
1637 addr->local_part += plen;
1638 DEBUG(D_route) debug_printf("stripped prefix %s\n", addr->prefix);
1639 }
1640 else if (!r->prefix_optional)
1641 {
1642 DEBUG(D_route) debug_printf("%s router skipped: prefix mismatch\n",
1643 r->name);
1644 continue;
1645 }
1646 }
1647
1648 /* Handle any configured suffix likewise. */
1649
1650 if (r->suffix)
1651 {
1652 int slen = route_check_suffix(addr->local_part, r->suffix);
1653 if (slen > 0)
1654 {
1655 int lplen = Ustrlen(addr->local_part) - slen;
1656 addr->suffix = addr->local_part + lplen;
1657 addr->local_part = string_copyn(addr->local_part, lplen);
1658 DEBUG(D_route) debug_printf("stripped suffix %s\n", addr->suffix);
1659 }
1660 else if (!r->suffix_optional)
1661 {
1662 DEBUG(D_route) debug_printf("%s router skipped: suffix mismatch\n",
1663 r->name);
1664 continue;
1665 }
1666 }
1667
1668 /* Set the expansion variables now that we have the affixes and the case of
1669 the local part sorted. */
1670
1671 router_name = r->name;
1672 deliver_set_expansions(addr);
1673
1674 /* For convenience, the pre-router checks are in a separate function, which
1675 returns OK, SKIP, FAIL, or DEFER. */
1676
1677 if ((rc = check_router_conditions(r, addr, verify, &pw, &error)) != OK)
1678 {
1679 router_name = NULL;
1680 if (rc == SKIP) continue;
1681 addr->message = error;
1682 yield = rc;
1683 goto ROUTE_EXIT;
1684 }
1685
1686 /* All pre-conditions have been met. Reset any search error message from
1687 pre-condition tests. These can arise in negated tests where the failure of
1688 the lookup leads to a TRUE pre-condition. */
1689
1690 search_error_message = NULL;
1691
1692 /* Add any variable-settings that are on the router, to the set on the
1693 addr. Expansion is done here and not later when the addr is used. There may
1694 be multiple settings, gathered during readconf; this code gathers them during
1695 router traversal. On the addr string they are held as a variable tree, so
1696 as to maintain the post-expansion taints separate. */
1697
1698 switch (set_router_vars(addr, r))
1699 {
1700 case OK: break;
1701 case PASS: continue; /* with next router */
1702 default: goto ROUTE_EXIT;
1703 }
1704
1705 /* Finally, expand the address_data field in the router. Forced failure
1706 behaves as if the router declined. Any other failure is more serious. On
1707 success, the string is attached to the address for all subsequent processing.
1708 */
1709
1710 if (r->address_data)
1711 {
1712 DEBUG(D_route) debug_printf("processing address_data\n");
1713 if (!(deliver_address_data = expand_string(r->address_data)))
1714 {
1715 if (f.expand_string_forcedfail)
1716 {
1717 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1718 "(address_data): decline action taken\n", r->address_data);
1719
1720 /* Expand "more" if necessary; DEFER => an expansion failed */
1721
1722 yield = exp_bool(addr, US"router", r->name, D_route,
1723 US"more", r->more, r->expand_more, &more);
1724 if (yield != OK) goto ROUTE_EXIT;
1725
1726 if (!more)
1727 {
1728 DEBUG(D_route)
1729 debug_printf("\"more\"=false: skipping remaining routers\n");
1730 router_name = NULL;
1731 r = NULL;
1732 break;
1733 }
1734 else continue; /* With next router */
1735 }
1736
1737 else
1738 {
1739 addr->message = string_sprintf("expansion of \"%s\" failed "
1740 "in %s router: %s", r->address_data, r->name, expand_string_message);
1741 yield = DEFER;
1742 goto ROUTE_EXIT;
1743 }
1744 }
1745 addr->prop.address_data = deliver_address_data;
1746 }
1747
1748 /* We are finally cleared for take-off with this router. Clear the the flag
1749 that records that a local host was removed from a routed host list. Make a
1750 copy of relevant fields in the password information from check_local_user,
1751 because it will be overwritten if check_local_user is invoked again while
1752 verifying an errors_address setting. */
1753
1754 clearflag(addr, af_local_host_removed);
1755
1756 if (pw)
1757 {
1758 pwcopy.pw_name = CS string_copy(US pw->pw_name);
1759 pwcopy.pw_uid = pw->pw_uid;
1760 pwcopy.pw_gid = pw->pw_gid;
1761 pwcopy.pw_gecos = CS string_copy(US pw->pw_gecos);
1762 pwcopy.pw_dir = CS string_copy(US pw->pw_dir);
1763 pwcopy.pw_shell = CS string_copy(US pw->pw_shell);
1764 pw = &pwcopy;
1765 }
1766
1767 /* If this should be the last hop for DSN flag the addr. */
1768
1769 if (r->dsn_lasthop && !(addr->dsn_flags & rf_dsnlasthop))
1770 {
1771 addr->dsn_flags |= rf_dsnlasthop;
1772 HDEBUG(D_route) debug_printf("DSN: last hop for %s\n", addr->address);
1773 }
1774
1775 /* Run the router, and handle the consequences. */
1776
1777 HDEBUG(D_route) debug_printf("calling %s router\n", r->name);
1778
1779 yield = (r->info->code)(r, addr, pw, verify, paddr_local, paddr_remote,
1780 addr_new, addr_succeed);
1781
1782 router_name = NULL;
1783
1784 if (yield == FAIL)
1785 {
1786 HDEBUG(D_route) debug_printf("%s router forced address failure\n", r->name);
1787 goto ROUTE_EXIT;
1788 }
1789
1790 /* If succeeded while verifying but fail_verify is set, convert into
1791 a failure, and take it off the local or remote delivery list. */
1792
1793 if ( ( verify == v_sender && r->fail_verify_sender
1794 || verify == v_recipient && r->fail_verify_recipient
1795 )
1796 && (yield == OK || yield == PASS))
1797 {
1798 addr->message = string_sprintf("%s router forced verify failure", r->name);
1799 if (*paddr_remote == addr) *paddr_remote = addr->next;
1800 if (*paddr_local == addr) *paddr_local = addr->next;
1801 yield = FAIL;
1802 goto ROUTE_EXIT;
1803 }
1804
1805 /* PASS and DECLINE are the only two cases where the loop continues. For all
1806 other returns, we break the loop and handle the result below. */
1807
1808 if (yield != PASS && yield != DECLINE) break;
1809
1810 HDEBUG(D_route)
1811 {
1812 debug_printf("%s router %s for %s\n", r->name,
1813 yield == PASS ? "passed" : "declined", addr->address);
1814 if (Ustrcmp(old_domain, addr->domain) != 0)
1815 debug_printf("domain %s rewritten\n", old_domain);
1816 }
1817
1818 /* PASS always continues to another router; DECLINE does so if "more"
1819 is true. Initialization insists that pass_router is always a following
1820 router. Otherwise, break the loop as if at the end of the routers. */
1821
1822 if (yield == PASS)
1823 {
1824 if (r->pass_router != NULL) nextr = r->pass_router;
1825 }
1826 else
1827 {
1828 /* Expand "more" if necessary */
1829
1830 yield = exp_bool(addr, US"router", r->name, D_route,
1831 US"more", r->more, r->expand_more, &more);
1832 if (yield != OK) goto ROUTE_EXIT;
1833
1834 if (!more)
1835 {
1836 HDEBUG(D_route)
1837 debug_printf("\"more\" is false: skipping remaining routers\n");
1838 r = NULL;
1839 break;
1840 }
1841 }
1842 } /* Loop for all routers */
1843
1844 /* On exit from the routers loop, if r == NULL we have run out of routers,
1845 either genuinely, or as a result of no_more. Otherwise, the loop ended
1846 prematurely, either because a router succeeded, or because of some special
1847 router response. Note that FAIL errors and errors detected before actually
1848 running a router go direct to ROUTE_EXIT from code above. */
1849
1850 if (!r)
1851 {
1852 HDEBUG(D_route) debug_printf("no more routers\n");
1853 if (!addr->message)
1854 {
1855 uschar *message = US"Unrouteable address";
1856 if (addr->router && addr->router->cannot_route_message)
1857 {
1858 uschar *expmessage = expand_string(addr->router->cannot_route_message);
1859 if (!expmessage)
1860 {
1861 if (!f.expand_string_forcedfail)
1862 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
1863 "cannot_route_message in %s router: %s", addr->router->name,
1864 expand_string_message);
1865 }
1866 else message = expmessage;
1867 }
1868 addr->user_message = addr->message = message;
1869 }
1870 addr->router = NULL; /* For logging */
1871 yield = FAIL;
1872 goto ROUTE_EXIT;
1873 }
1874
1875 if (yield == DEFER)
1876 {
1877 HDEBUG(D_route) debug_printf("%s router: defer for %s\n message: %s\n",
1878 r->name, addr->address, addr->message ? addr->message : US"<none>");
1879 goto ROUTE_EXIT;
1880 }
1881
1882 if (yield == DISCARD) goto ROUTE_EXIT;
1883
1884 /* The yield must be either OK or REROUTED. */
1885
1886 if (yield != OK && yield != REROUTED)
1887 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router returned unknown value %d",
1888 r->name, yield);
1889
1890 /* If the yield was REROUTED, the router put a child address on the new chain
1891 as a result of a domain change of some sort (widening, typically). */
1892
1893 if (yield == REROUTED)
1894 {
1895 HDEBUG(D_route) debug_printf("re-routed to %s\n", addr->address);
1896 yield = OK;
1897 goto ROUTE_EXIT;
1898 }
1899
1900 /* The only remaining possibility is that the router succeeded. If the
1901 translate_ip_address options is set and host addresses were associated with the
1902 address, run them through the translation. This feature is for weird and
1903 wonderful situations (the amateur packet radio people need it) or very broken
1904 networking, so it is included in the binary only if requested. */
1905
1906 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
1907
1908 if (r->translate_ip_address)
1909 {
1910 int rc;
1911 int old_pool = store_pool;
1912 for (host_item * h = addr->host_list; h; h = h->next)
1913 {
1914 uschar *newaddress;
1915 uschar *oldaddress, *oldname;
1916
1917 if (!h->address) continue;
1918
1919 deliver_host_address = h->address;
1920 newaddress = expand_string(r->translate_ip_address);
1921 deliver_host_address = NULL;
1922
1923 if (!newaddress)
1924 {
1925 if (f.expand_string_forcedfail) continue;
1926 addr->basic_errno = ERRNO_EXPANDFAIL;
1927 addr->message = string_sprintf("translate_ip_address expansion "
1928 "failed: %s", expand_string_message);
1929 yield = DEFER;
1930 goto ROUTE_EXIT;
1931 }
1932
1933 DEBUG(D_route) debug_printf("%s [%s] translated to %s\n",
1934 h->name, h->address, newaddress);
1935 if (string_is_ip_address(newaddress, NULL) != 0)
1936 {
1937 h->address = newaddress;
1938 continue;
1939 }
1940
1941 oldname = h->name;
1942 oldaddress = h->address;
1943 h->name = newaddress;
1944 h->address = NULL;
1945 h->mx = MX_NONE;
1946
1947 store_pool = POOL_PERM;
1948 rc = host_find_byname(h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, TRUE);
1949 store_pool = old_pool;
1950
1951 if (rc == HOST_FIND_FAILED || rc == HOST_FIND_AGAIN)
1952 {
1953 addr->basic_errno = ERRNO_UNKNOWNHOST;
1954 addr->message = string_sprintf("host %s not found when "
1955 "translating %s [%s]", h->name, oldname, oldaddress);
1956 yield = DEFER;
1957 goto ROUTE_EXIT;
1958 }
1959 }
1960 }
1961 #endif /* SUPPORT_TRANSLATE_IP_ADDRESS */
1962
1963 /* See if this is an unseen routing; first expand the option if necessary.
1964 DEFER can be given if the expansion fails */
1965
1966 yield = exp_bool(addr, US"router", r->name, D_route,
1967 US"unseen", r->unseen, r->expand_unseen, &unseen);
1968 if (yield != OK) goto ROUTE_EXIT;
1969
1970 /* Debugging output recording a successful routing */
1971
1972 HDEBUG(D_route) debug_printf("routed by %s router%s\n", r->name,
1973 unseen? " (unseen)" : "");
1974
1975 DEBUG(D_route)
1976 {
1977 debug_printf(" envelope to: %s\n", addr->address);
1978 debug_printf(" transport: %s\n", addr->transport
1979 ? addr->transport->name : US"<none>");
1980
1981 if (addr->prop.errors_address)
1982 debug_printf(" errors to %s\n", addr->prop.errors_address);
1983
1984 for (host_item * h = addr->host_list; h; h = h->next)
1985 {
1986 debug_printf(" host %s", h->name);
1987 if (h->address) debug_printf(" [%s]", h->address);
1988 if (h->mx >= 0) debug_printf(" MX=%d", h->mx);
1989 else if (h->mx != MX_NONE) debug_printf(" rgroup=%d", h->mx);
1990 if (h->port != PORT_NONE) debug_printf(" port=%d", h->port);
1991 if (h->dnssec != DS_UNK) debug_printf(" dnssec=%s", h->dnssec==DS_YES ? "yes" : "no");
1992 debug_printf("\n");
1993 }
1994 }
1995
1996 /* Clear any temporary error message set by a router that declined, and handle
1997 the "unseen" option (ignore if there are no further routers). */
1998
1999 addr->message = NULL;
2000 if (unseen && r->next)
2001 route_unseen(r->name, addr, paddr_local, paddr_remote, addr_new);
2002
2003 /* Unset the address expansions, and return the final result. */
2004
2005 ROUTE_EXIT:
2006 if (yield == DEFER && addr->message)
2007 addr->message = expand_hide_passwords(addr->message);
2008
2009 deliver_set_expansions(NULL);
2010 router_name = NULL;
2011 f.disable_logging = FALSE;
2012 return yield;
2013 }
2014
2015 #endif /*!MACRO_PREDEF*/
2016 /* End of route.c */