Avoid exposing passwords in log, on failing ldap lookup expansion. Bug 165
[exim.git] / src / src / route.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions concerned with routing, and the list of generic router options. */
9
10
11 #include "exim.h"
12
13
14
15 /* Generic options for routers, all of which live inside router_instance
16 data blocks and which therefore have the opt_public flag set. */
17
18 optionlist optionlist_routers[] = {
19 { "*expand_group", opt_stringptr | opt_hidden | opt_public,
20 (void *)(offsetof(router_instance, expand_gid)) },
21 { "*expand_more", opt_stringptr | opt_hidden | opt_public,
22 (void *)(offsetof(router_instance, expand_more)) },
23 { "*expand_unseen", opt_stringptr | opt_hidden | opt_public,
24 (void *)(offsetof(router_instance, expand_unseen)) },
25 { "*expand_user", opt_stringptr | opt_hidden | opt_public,
26 (void *)(offsetof(router_instance, expand_uid)) },
27 { "*set_group", opt_bool | opt_hidden | opt_public,
28 (void *)(offsetof(router_instance, gid_set)) },
29 { "*set_user", opt_bool | opt_hidden | opt_public,
30 (void *)(offsetof(router_instance, uid_set)) },
31 { "address_data", opt_stringptr|opt_public,
32 (void *)(offsetof(router_instance, address_data)) },
33 { "address_test", opt_bool|opt_public,
34 (void *)(offsetof(router_instance, address_test)) },
35 #ifdef EXPERIMENTAL_BRIGHTMAIL
36 { "bmi_deliver_alternate", opt_bool | opt_public,
37 (void *)(offsetof(router_instance, bmi_deliver_alternate)) },
38 { "bmi_deliver_default", opt_bool | opt_public,
39 (void *)(offsetof(router_instance, bmi_deliver_default)) },
40 { "bmi_dont_deliver", opt_bool | opt_public,
41 (void *)(offsetof(router_instance, bmi_dont_deliver)) },
42 { "bmi_rule", opt_stringptr|opt_public,
43 (void *)(offsetof(router_instance, bmi_rule)) },
44 #endif
45 { "cannot_route_message", opt_stringptr | opt_public,
46 (void *)(offsetof(router_instance, cannot_route_message)) },
47 { "caseful_local_part", opt_bool | opt_public,
48 (void *)(offsetof(router_instance, caseful_local_part)) },
49 { "check_local_user", opt_bool | opt_public,
50 (void *)(offsetof(router_instance, check_local_user)) },
51 { "condition", opt_stringptr|opt_public|opt_rep_con,
52 (void *)offsetof(router_instance, condition) },
53 { "debug_print", opt_stringptr | opt_public,
54 (void *)offsetof(router_instance, debug_string) },
55 { "disable_logging", opt_bool | opt_public,
56 (void *)offsetof(router_instance, disable_logging) },
57 { "dnssec_request_domains", opt_stringptr|opt_public,
58 (void *)offsetof(router_instance, dnssec.request) },
59 { "dnssec_require_domains", opt_stringptr|opt_public,
60 (void *)offsetof(router_instance, dnssec.require) },
61 { "domains", opt_stringptr|opt_public,
62 (void *)offsetof(router_instance, domains) },
63 { "driver", opt_stringptr|opt_public,
64 (void *)offsetof(router_instance, driver_name) },
65 { "dsn_lasthop", opt_bool|opt_public,
66 (void *)offsetof(router_instance, dsn_lasthop) },
67 { "errors_to", opt_stringptr|opt_public,
68 (void *)(offsetof(router_instance, errors_to)) },
69 { "expn", opt_bool|opt_public,
70 (void *)offsetof(router_instance, expn) },
71 { "fail_verify", opt_bool_verify|opt_hidden|opt_public,
72 (void *)offsetof(router_instance, fail_verify_sender) },
73 { "fail_verify_recipient", opt_bool|opt_public,
74 (void *)offsetof(router_instance, fail_verify_recipient) },
75 { "fail_verify_sender", opt_bool|opt_public,
76 (void *)offsetof(router_instance, fail_verify_sender) },
77 { "fallback_hosts", opt_stringptr|opt_public,
78 (void *)offsetof(router_instance, fallback_hosts) },
79 { "group", opt_expand_gid | opt_public,
80 (void *)(offsetof(router_instance, gid)) },
81 { "headers_add", opt_stringptr|opt_public|opt_rep_str,
82 (void *)offsetof(router_instance, extra_headers) },
83 { "headers_remove", opt_stringptr|opt_public|opt_rep_str,
84 (void *)offsetof(router_instance, remove_headers) },
85 { "ignore_target_hosts",opt_stringptr|opt_public,
86 (void *)offsetof(router_instance, ignore_target_hosts) },
87 { "initgroups", opt_bool | opt_public,
88 (void *)(offsetof(router_instance, initgroups)) },
89 { "local_part_prefix", opt_stringptr|opt_public,
90 (void *)offsetof(router_instance, prefix) },
91 { "local_part_prefix_optional",opt_bool|opt_public,
92 (void *)offsetof(router_instance, prefix_optional) },
93 { "local_part_suffix", opt_stringptr|opt_public,
94 (void *)offsetof(router_instance, suffix) },
95 { "local_part_suffix_optional",opt_bool|opt_public,
96 (void *)offsetof(router_instance, suffix_optional) },
97 { "local_parts", opt_stringptr|opt_public,
98 (void *)offsetof(router_instance, local_parts) },
99 { "log_as_local", opt_bool|opt_public,
100 (void *)offsetof(router_instance, log_as_local) },
101 { "more", opt_expand_bool|opt_public,
102 (void *)offsetof(router_instance, more) },
103 { "pass_on_timeout", opt_bool|opt_public,
104 (void *)offsetof(router_instance, pass_on_timeout) },
105 { "pass_router", opt_stringptr|opt_public,
106 (void *)offsetof(router_instance, pass_router_name) },
107 { "redirect_router", opt_stringptr|opt_public,
108 (void *)offsetof(router_instance, redirect_router_name) },
109 { "require_files", opt_stringptr|opt_public,
110 (void *)offsetof(router_instance, require_files) },
111 { "retry_use_local_part", opt_bool|opt_public,
112 (void *)offsetof(router_instance, retry_use_local_part) },
113 { "router_home_directory", opt_stringptr|opt_public,
114 (void *)offsetof(router_instance, router_home_directory) },
115 { "self", opt_stringptr|opt_public,
116 (void *)(offsetof(router_instance, self)) },
117 { "senders", opt_stringptr|opt_public,
118 (void *)offsetof(router_instance, senders) },
119 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
120 { "translate_ip_address", opt_stringptr|opt_public,
121 (void *)offsetof(router_instance, translate_ip_address) },
122 #endif
123 { "transport", opt_stringptr|opt_public,
124 (void *)offsetof(router_instance, transport_name) },
125 { "transport_current_directory", opt_stringptr|opt_public,
126 (void *)offsetof(router_instance, current_directory) },
127 { "transport_home_directory", opt_stringptr|opt_public,
128 (void *)offsetof(router_instance, home_directory) },
129 { "unseen", opt_expand_bool|opt_public,
130 (void *)offsetof(router_instance, unseen) },
131 { "user", opt_expand_uid | opt_public,
132 (void *)(offsetof(router_instance, uid)) },
133 { "verify", opt_bool_verify|opt_hidden|opt_public,
134 (void *)offsetof(router_instance, verify_sender) },
135 { "verify_only", opt_bool|opt_public,
136 (void *)offsetof(router_instance, verify_only) },
137 { "verify_recipient", opt_bool|opt_public,
138 (void *)offsetof(router_instance, verify_recipient) },
139 { "verify_sender", opt_bool|opt_public,
140 (void *)offsetof(router_instance, verify_sender) }
141 };
142
143 int optionlist_routers_size = sizeof(optionlist_routers)/sizeof(optionlist);
144
145
146
147 /*************************************************
148 * Set router pointer from name *
149 *************************************************/
150
151 /* This function is used for the redirect_router and pass_router options and
152 called from route_init() below.
153
154 Arguments:
155 r the current router
156 name new router name
157 ptr where to put the pointer
158 after TRUE if router must follow this one
159
160 Returns: nothing.
161 */
162
163 static void
164 set_router(router_instance *r, uschar *name, router_instance **ptr, BOOL after)
165 {
166 BOOL afterthis = FALSE;
167 router_instance *rr;
168
169 for (rr = routers; rr; rr = rr->next)
170 {
171 if (Ustrcmp(name, rr->name) == 0)
172 {
173 *ptr = rr;
174 break;
175 }
176 if (rr == r) afterthis = TRUE;
177 }
178
179 if (!rr)
180 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
181 "new_router \"%s\" not found for \"%s\" router", name, r->name);
182
183 if (after && !afterthis)
184 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
185 "new_router \"%s\" does not follow \"%s\" router", name, r->name);
186 }
187
188
189
190 /*************************************************
191 * Initialize router list *
192 *************************************************/
193
194 /* Read the routers section of the configuration file, and set up a chain of
195 router instances according to its contents. Each router has generic options and
196 may also have its own private options. This function is only ever called when
197 routers == NULL. We use generic code in readconf to do the work. It will set
198 values from the configuration file, and then call the driver's initialization
199 function. */
200
201 void
202 route_init(void)
203 {
204 router_instance *r;
205
206 readconf_driver_init(US"router",
207 (driver_instance **)(&routers), /* chain anchor */
208 (driver_info *)routers_available, /* available drivers */
209 sizeof(router_info), /* size of info blocks */
210 &router_defaults, /* default values for generic options */
211 sizeof(router_instance), /* size of instance block */
212 optionlist_routers, /* generic options */
213 optionlist_routers_size);
214
215 for (r = routers; r; r = r->next)
216 {
217 uschar *s = r->self;
218
219 /* If log_as_local is unset, its overall default is FALSE. (The accept
220 router defaults it to TRUE.) */
221
222 if (r->log_as_local == TRUE_UNSET) r->log_as_local = FALSE;
223
224 /* Check for transport or no transport on certain routers */
225
226 if ((r->info->ri_flags & ri_yestransport) != 0 &&
227 r->transport_name == NULL &&
228 !r->verify_only)
229 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
230 "a transport is required for this router", r->name);
231
232 if ((r->info->ri_flags & ri_notransport) != 0 &&
233 r->transport_name != NULL)
234 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
235 "a transport must not be defined for this router", r->name);
236
237 /* The "self" option needs to be decoded into a code value and possibly a
238 new domain string and a rewrite boolean. */
239
240 if (Ustrcmp(s, "freeze") == 0) r->self_code = self_freeze;
241 else if (Ustrcmp(s, "defer") == 0) r->self_code = self_defer;
242 else if (Ustrcmp(s, "send") == 0) r->self_code = self_send;
243 else if (Ustrcmp(s, "pass") == 0) r->self_code = self_pass;
244 else if (Ustrcmp(s, "fail") == 0) r->self_code = self_fail;
245 else if (Ustrncmp(s, "reroute:", 8) == 0)
246 {
247 s += 8;
248 while (isspace(*s)) s++;
249 if (Ustrncmp(s, "rewrite:", 8) == 0)
250 {
251 r->self_rewrite = TRUE;
252 s += 8;
253 while (isspace(*s)) s++;
254 }
255 r->self = s;
256 r->self_code = self_reroute;
257 }
258
259 else log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s router:\n "
260 "%s is not valid for the self option", r->name, s);
261
262 /* If any router has check_local_user set, default retry_use_local_part
263 TRUE; otherwise its default is FALSE. */
264
265 if (r->retry_use_local_part == TRUE_UNSET)
266 r->retry_use_local_part = r->check_local_user;
267
268 /* Build a host list if fallback hosts is set. */
269
270 host_build_hostlist(&(r->fallback_hostlist), r->fallback_hosts, FALSE);
271
272 /* Check redirect_router and pass_router are valid */
273
274 if (r->redirect_router_name != NULL)
275 set_router(r, r->redirect_router_name, &(r->redirect_router), FALSE);
276
277 if (r->pass_router_name != NULL)
278 set_router(r, r->pass_router_name, &(r->pass_router), TRUE);
279
280 DEBUG(D_route) debug_printf("DSN: %s %s\n", r->name,
281 r->dsn_lasthop ? "lasthop set" : "propagating DSN");
282 }
283 }
284
285
286
287 /*************************************************
288 * Tidy up after routing *
289 *************************************************/
290
291 /* Routers are entitled to keep hold of certain resources in their instance
292 blocks so as to save setting them up each time. An example is an open file.
293 Such routers must provide a tidyup entry point which is called when all routing
294 is finished, via this function. */
295
296 void
297 route_tidyup(void)
298 {
299 router_instance *r;
300 for (r = routers; r; r = r->next)
301 if (r->info->tidyup) (r->info->tidyup)(r);
302 }
303
304
305
306 /*************************************************
307 * Check local part for prefix *
308 *************************************************/
309
310 /* This function is handed a local part and a list of possible prefixes; if any
311 one matches, return the prefix length. A prefix beginning with '*' is a
312 wildcard.
313
314 Arguments:
315 local_part the local part to check
316 prefixes the list of prefixes
317
318 Returns: length of matching prefix or zero
319 */
320
321 int
322 route_check_prefix(const uschar *local_part, const uschar *prefixes)
323 {
324 int sep = 0;
325 uschar *prefix;
326 const uschar *listptr = prefixes;
327 uschar prebuf[64];
328
329 while ((prefix = string_nextinlist(&listptr, &sep, prebuf, sizeof(prebuf))))
330 {
331 int plen = Ustrlen(prefix);
332 if (prefix[0] == '*')
333 {
334 const uschar *p;
335 prefix++;
336 for (p = local_part + Ustrlen(local_part) - (--plen);
337 p >= local_part; p--)
338 if (strncmpic(prefix, p, plen) == 0) return plen + p - local_part;
339 }
340 else
341 if (strncmpic(prefix, local_part, plen) == 0) return plen;
342 }
343
344 return 0;
345 }
346
347
348
349 /*************************************************
350 * Check local part for suffix *
351 *************************************************/
352
353 /* This function is handed a local part and a list of possible suffixes;
354 if any one matches, return the suffix length. A suffix ending with '*'
355 is a wildcard.
356
357 Arguments:
358 local_part the local part to check
359 suffixes the list of suffixes
360
361 Returns: length of matching suffix or zero
362 */
363
364 int
365 route_check_suffix(const uschar *local_part, const uschar *suffixes)
366 {
367 int sep = 0;
368 int alen = Ustrlen(local_part);
369 uschar *suffix;
370 const uschar *listptr = suffixes;
371 uschar sufbuf[64];
372
373 while ((suffix = string_nextinlist(&listptr, &sep, sufbuf, sizeof(sufbuf))))
374 {
375 int slen = Ustrlen(suffix);
376 if (suffix[slen-1] == '*')
377 {
378 const uschar *p, *pend;
379 pend = local_part + alen - (--slen) + 1;
380 for (p = local_part; p < pend; p++)
381 if (strncmpic(suffix, p, slen) == 0) return alen - (p - local_part);
382 }
383 else
384 if (alen > slen && strncmpic(suffix, local_part + alen - slen, slen) == 0)
385 return slen;
386 }
387
388 return 0;
389 }
390
391
392
393
394 /*************************************************
395 * Check local part, domain, or sender *
396 *************************************************/
397
398 /* The checks in check_router_conditions() require similar code, so we use
399 this function to save repetition.
400
401 Arguments:
402 rname router name for error messages
403 type type of check, for error message
404 list domains, local_parts, or senders list
405 anchorptr -> tree for possibly cached items (domains)
406 cache_bits cached bits pointer
407 listtype MCL_DOMAIN for domain check
408 MCL_LOCALPART for local part check
409 MCL_ADDRESS for sender check
410 domloc current domain, current local part, or NULL for sender check
411 ldata where to put lookup data
412 caseless passed on to match_isinlist()
413 perror where to put an error message
414
415 Returns: OK item is in list
416 SKIP item is not in list, router is to be skipped
417 DEFER lookup or other defer
418 */
419
420 static int
421 route_check_dls(uschar *rname, uschar *type, const uschar *list,
422 tree_node **anchorptr, unsigned int *cache_bits, int listtype,
423 const uschar *domloc, const uschar **ldata, BOOL caseless, uschar **perror)
424 {
425 if (!list) return OK; /* Empty list always succeeds */
426
427 DEBUG(D_route) debug_printf("checking %s\n", type);
428
429 /* The domain and local part use the same matching function, whereas sender
430 has its own code. */
431
432 switch(domloc
433 ? match_isinlist(domloc, &list, 0, anchorptr, cache_bits, listtype,
434 caseless, ldata)
435 : match_address_list(sender_address ? sender_address : US"",
436 TRUE, TRUE, &list, cache_bits, -1, 0, CUSS &sender_data)
437 )
438 {
439 case OK:
440 return OK;
441
442 case FAIL:
443 *perror = string_sprintf("%s router skipped: %s mismatch", rname, type);
444 DEBUG(D_route) debug_printf("%s\n", *perror);
445 return SKIP;
446
447 default: /* Paranoia, and keeps compilers happy */
448 case DEFER:
449 *perror = string_sprintf("%s check lookup or other defer", type);
450 DEBUG(D_route) debug_printf("%s\n", *perror);
451 return DEFER;
452 }
453 }
454
455
456
457 /*************************************************
458 * Check access by a given uid/gid *
459 *************************************************/
460
461 /* This function checks whether a given uid/gid has access to a given file or
462 directory. It is called only from check_files() below. This is hopefully a
463 cheapish check that does the job most of the time. Exim does *not* rely on this
464 test when actually accessing any file. The test is used when routing to make it
465 possible to take actions such as "if user x can access file y then run this
466 router".
467
468 During routing, Exim is normally running as root, and so the test will work
469 except for NFS non-root mounts. When verifying during message reception, Exim
470 is running as "exim", so the test may not work. This is a limitation of the
471 Exim design.
472
473 Code in check_files() below detects the case when it cannot stat() the file (as
474 root), and in that situation it uses a setuid subprocess in which to run this
475 test.
476
477 Arguments:
478 path the path to check
479 uid the user
480 gid the group
481 bits the bits required in the final component
482
483 Returns: TRUE
484 FALSE errno=EACCES or ENOENT (or others from realpath or stat)
485 */
486
487 static BOOL
488 route_check_access(uschar *path, uid_t uid, gid_t gid, int bits)
489 {
490 struct stat statbuf;
491 uschar *slash;
492 uschar *rp = US realpath(CS path, CS big_buffer);
493 uschar *sp = rp + 1;
494
495 DEBUG(D_route) debug_printf("route_check_access(%s,%d,%d,%o)\n", path,
496 (int)uid, (int)gid, bits);
497
498 if (!rp) return FALSE;
499
500 while ((slash = Ustrchr(sp, '/')))
501 {
502 *slash = 0;
503 DEBUG(D_route) debug_printf("stat %s\n", rp);
504 if (Ustat(rp, &statbuf) < 0) return FALSE;
505 if ((statbuf.st_mode &
506 ((statbuf.st_uid == uid)? 0100 : (statbuf.st_gid == gid)? 0010 : 001)
507 ) == 0)
508 {
509 errno = EACCES;
510 return FALSE;
511 }
512 *slash = '/';
513 sp = slash + 1;
514 }
515
516 /* Down to the final component */
517
518 DEBUG(D_route) debug_printf("stat %s\n", rp);
519
520 if (Ustat(rp, &statbuf) < 0) return FALSE;
521
522 if (statbuf.st_uid == uid) bits = bits << 6;
523 else if (statbuf.st_gid == gid) bits = bits << 3;
524 if ((statbuf.st_mode & bits) != bits)
525 {
526 errno = EACCES;
527 return FALSE;
528 }
529
530 DEBUG(D_route) debug_printf("route_check_access() succeeded\n");
531 return TRUE;
532 }
533
534
535
536 /*************************************************
537 * Do file existence tests *
538 *************************************************/
539
540 /* This function is given a colon-separated list of file tests, each of which
541 is expanded before use. A test consists of a file name, optionally preceded by
542 ! (require non-existence) and/or + for handling permission denied (+ means
543 treat as non-existing).
544
545 An item that contains no slashes is interpreted as a username or id, with an
546 optional group id, for checking access to the file. This cannot be done
547 "perfectly", but it is good enough for a number of applications.
548
549 Arguments:
550 s a colon-separated list of file tests or NULL
551 perror a pointer to an anchor for an error text in the case of a DEFER
552
553 Returns: OK if s == NULL or all tests are as required
554 DEFER if the existence of at least one of the files is
555 unclear (an error other than non-existence occurred);
556 DEFER if an expansion failed
557 DEFER if a name is not absolute
558 DEFER if problems with user/group
559 SKIP otherwise
560 */
561
562 static int
563 check_files(const uschar *s, uschar **perror)
564 {
565 int sep = 0; /* List has default separators */
566 uid_t uid = 0; /* For picky compilers */
567 gid_t gid = 0; /* For picky compilers */
568 BOOL ugid_set = FALSE;
569 const uschar *listptr;
570 uschar *check;
571 uschar buffer[1024];
572
573 if (!s) return OK;
574
575 DEBUG(D_route) debug_printf("checking require_files\n");
576
577 listptr = s;
578 while ((check = string_nextinlist(&listptr, &sep, buffer, sizeof(buffer))))
579 {
580 int rc;
581 int eacces_code = 0;
582 BOOL invert = FALSE;
583 struct stat statbuf;
584 uschar *ss = expand_string(check);
585
586 if (!ss)
587 {
588 if (expand_string_forcedfail) continue;
589 *perror = string_sprintf("failed to expand \"%s\" for require_files: %s",
590 check, expand_string_message);
591 goto RETURN_DEFER;
592 }
593
594 /* Empty items are just skipped */
595
596 if (*ss == 0) continue;
597
598 /* If there are no slashes in the string, we have a user name or uid, with
599 optional group/gid. */
600
601 if (Ustrchr(ss, '/') == NULL)
602 {
603 BOOL ok;
604 struct passwd *pw;
605 uschar *comma = Ustrchr(ss, ',');
606
607 /* If there's a comma, temporarily terminate the user name/number
608 at that point. Then set the uid. */
609
610 if (comma != NULL) *comma = 0;
611 ok = route_finduser(ss, &pw, &uid);
612 if (comma != NULL) *comma = ',';
613
614 if (!ok)
615 {
616 *perror = string_sprintf("user \"%s\" for require_files not found", ss);
617 goto RETURN_DEFER;
618 }
619
620 /* If there was no comma, the gid is that associated with the user. */
621
622 if (comma == NULL)
623 {
624 if (pw != NULL) gid = pw->pw_gid; else
625 {
626 *perror = string_sprintf("group missing after numerical uid %d for "
627 "require_files", (int)uid);
628 goto RETURN_DEFER;
629 }
630 }
631 else
632 {
633 if (!route_findgroup(comma + 1, &gid))
634 {
635 *perror = string_sprintf("group \"%s\" for require_files not found\n",
636 comma + 1);
637 goto RETURN_DEFER;
638 }
639 }
640
641 /* Note that we have values set, and proceed to next item */
642
643 DEBUG(D_route)
644 debug_printf("check subsequent files for access by %s\n", ss);
645 ugid_set = TRUE;
646 continue;
647 }
648
649 /* Path, possibly preceded by + and ! */
650
651 if (*ss == '+')
652 {
653 eacces_code = 1;
654 while (isspace((*(++ss))));
655 }
656
657 if (*ss == '!')
658 {
659 invert = TRUE;
660 while (isspace((*(++ss))));
661 }
662
663 if (*ss != '/')
664 {
665 *perror = string_sprintf("require_files: \"%s\" is not absolute", ss);
666 goto RETURN_DEFER;
667 }
668
669 /* Stat the file, either as root (while routing) or as exim (while verifying
670 during message reception). */
671
672 rc = Ustat(ss, &statbuf);
673
674 DEBUG(D_route)
675 {
676 debug_printf("file check: %s\n", check);
677 if (ss != check) debug_printf("expanded file: %s\n", ss);
678 debug_printf("stat() yielded %d\n", rc);
679 }
680
681 /* If permission is denied, and we are running as root (i.e. routing for
682 delivery rather than verifying), and the requirement is to test for access by
683 a particular uid/gid, it must mean that the file is on a non-root-mounted NFS
684 system. In this case, we have to use a subprocess that runs as the relevant
685 uid in order to do the test. */
686
687 if (rc != 0 && errno == EACCES && ugid_set && getuid() == root_uid)
688 {
689 int status;
690 pid_t pid;
691 void (*oldsignal)(int);
692
693 DEBUG(D_route) debug_printf("root is denied access: forking to check "
694 "in subprocess\n");
695
696 /* Before forking, ensure that SIGCHLD is set to SIG_DFL before forking, so
697 that the child process can be waited for, just in case get here with it set
698 otherwise. Save the old state for resetting on the wait. */
699
700 oldsignal = signal(SIGCHLD, SIG_DFL);
701 pid = fork();
702
703 /* If fork() fails, reinstate the original error and behave as if
704 this block of code were not present. This is the same behavious as happens
705 when Exim is not running as root at this point. */
706
707 if (pid < 0)
708 {
709 DEBUG(D_route)
710 debug_printf("require_files: fork failed: %s\n", strerror(errno));
711 errno = EACCES;
712 goto HANDLE_ERROR;
713 }
714
715 /* In the child process, change uid and gid, and then do the check using
716 the route_check_access() function. This does more than just stat the file;
717 it tests permissions as well. Return 0 for OK and 1 for failure. */
718
719 if (pid == 0)
720 {
721 exim_setugid(uid, gid, TRUE,
722 string_sprintf("require_files check, file=%s", ss));
723 if (route_check_access(ss, uid, gid, 4)) _exit(0);
724 DEBUG(D_route) debug_printf("route_check_access() failed\n");
725 _exit(1);
726 }
727
728 /* In the parent, wait for the child to finish */
729
730 while (waitpid(pid, &status, 0) < 0)
731 {
732 if (errno != EINTR) /* unexpected error, interpret as failure */
733 {
734 status = 1;
735 break;
736 }
737 }
738
739 signal(SIGCHLD, oldsignal); /* restore */
740 if ((status == 0) == invert) return SKIP;
741 continue; /* to test the next file */
742 }
743
744 /* Control reaches here if the initial stat() succeeds, or fails with an
745 error other than EACCES, or no uid/gid is set, or we are not running as root.
746 If we know the file exists and uid/gid are set, try to check read access for
747 that uid/gid as best we can. */
748
749 if (rc == 0 && ugid_set && !route_check_access(ss, uid, gid, 4))
750 {
751 DEBUG(D_route) debug_printf("route_check_access() failed\n");
752 rc = -1;
753 }
754
755 /* Handle error returns from stat() or route_check_access(). The EACESS error
756 is handled specially. At present, we can force it to be treated as
757 non-existence. Write the code so that it will be easy to add forcing for
758 existence if required later. */
759
760 HANDLE_ERROR:
761 if (rc < 0)
762 {
763 DEBUG(D_route) debug_printf("errno = %d\n", errno);
764 if (errno == EACCES)
765 {
766 if (eacces_code == 1)
767 {
768 DEBUG(D_route) debug_printf("EACCES => ENOENT\n");
769 errno = ENOENT; /* Treat as non-existent */
770 }
771 }
772 if (errno != ENOENT)
773 {
774 *perror = string_sprintf("require_files: error for %s: %s", ss,
775 strerror(errno));
776 goto RETURN_DEFER;
777 }
778 }
779
780 /* At this point, rc < 0 => non-existence; rc >= 0 => existence */
781
782 if ((rc >= 0) == invert) return SKIP;
783 }
784
785 return OK;
786
787 /* Come here on any of the errors that return DEFER. */
788
789 RETURN_DEFER:
790 DEBUG(D_route) debug_printf("%s\n", *perror);
791 return DEFER;
792 }
793
794
795
796
797
798 /*************************************************
799 * Check for router skipping *
800 *************************************************/
801
802 /* This function performs various checks to see whether a router should be
803 skipped. The order in which they are performed is important.
804
805 Arguments:
806 r pointer to router instance block
807 addr address that is being handled
808 verify the verification type
809 pw ptr to ptr to passwd structure for local user
810 perror for lookup errors
811
812 Returns: OK if all the tests succeed
813 SKIP if router is to be skipped
814 DEFER for a lookup defer
815 FAIL for address to be failed
816 */
817
818 static BOOL
819 check_router_conditions(router_instance *r, address_item *addr, int verify,
820 struct passwd **pw, uschar **perror)
821 {
822 int rc;
823 uschar *check_local_part;
824 unsigned int *localpart_cache;
825
826 /* Reset variables to hold a home directory and data from lookup of a domain or
827 local part, and ensure search_find_defer is unset, in case there aren't any
828 actual lookups. */
829
830 deliver_home = NULL;
831 deliver_domain_data = NULL;
832 deliver_localpart_data = NULL;
833 sender_data = NULL;
834 local_user_gid = (gid_t)(-1);
835 local_user_uid = (uid_t)(-1);
836 search_find_defer = FALSE;
837
838 /* Skip this router if not verifying and it has verify_only set */
839
840 if ((verify == v_none || verify == v_expn) && r->verify_only)
841 {
842 DEBUG(D_route) debug_printf("%s router skipped: verify_only set\n", r->name);
843 return SKIP;
844 }
845
846 /* Skip this router if testing an address (-bt) and address_test is not set */
847
848 if (address_test_mode && !r->address_test)
849 {
850 DEBUG(D_route) debug_printf("%s router skipped: address_test is unset\n",
851 r->name);
852 return SKIP;
853 }
854
855 /* Skip this router if verifying and it hasn't got the appropriate verify flag
856 set. */
857
858 if ((verify == v_sender && !r->verify_sender) ||
859 (verify == v_recipient && !r->verify_recipient))
860 {
861 DEBUG(D_route) debug_printf("%s router skipped: verify %d %d %d\n",
862 r->name, verify, r->verify_sender, r->verify_recipient);
863 return SKIP;
864 }
865
866 /* Skip this router if processing EXPN and it doesn't have expn set */
867
868 if (verify == v_expn && !r->expn)
869 {
870 DEBUG(D_route) debug_printf("%s router skipped: no_expn set\n", r->name);
871 return SKIP;
872 }
873
874 /* Skip this router if there's a domain mismatch. */
875
876 if ((rc = route_check_dls(r->name, US"domains", r->domains, &domainlist_anchor,
877 addr->domain_cache, TRUE, addr->domain, CUSS &deliver_domain_data,
878 MCL_DOMAIN, perror)) != OK)
879 return rc;
880
881 /* Skip this router if there's a local part mismatch. We want to pass over the
882 caseful local part, so that +caseful can restore it, even if this router is
883 handling local parts caselessly. However, we can't just pass cc_local_part,
884 because that doesn't have the prefix or suffix stripped. A bit of massaging is
885 required. Also, we only use the match cache for local parts that have not had
886 a prefix or suffix stripped. */
887
888 if (!addr->prefix && !addr->suffix)
889 {
890 localpart_cache = addr->localpart_cache;
891 check_local_part = addr->cc_local_part;
892 }
893 else
894 {
895 localpart_cache = NULL;
896 check_local_part = string_copy(addr->cc_local_part);
897 if (addr->prefix)
898 check_local_part += Ustrlen(addr->prefix);
899 if (addr->suffix)
900 check_local_part[Ustrlen(check_local_part) - Ustrlen(addr->suffix)] = 0;
901 }
902
903 if ((rc = route_check_dls(r->name, US"local_parts", r->local_parts,
904 &localpartlist_anchor, localpart_cache, MCL_LOCALPART,
905 check_local_part, CUSS &deliver_localpart_data,
906 !r->caseful_local_part, perror)) != OK)
907 return rc;
908
909 /* If the check_local_user option is set, check that the local_part is the
910 login of a local user. Note: the third argument to route_finduser() must be
911 NULL here, to prevent a numeric string being taken as a numeric uid. If the
912 user is found, set deliver_home to the home directory, and also set
913 local_user_{uid,gid}. */
914
915 if (r->check_local_user)
916 {
917 DEBUG(D_route) debug_printf("checking for local user\n");
918 if (!route_finduser(addr->local_part, pw, NULL))
919 {
920 DEBUG(D_route) debug_printf("%s router skipped: %s is not a local user\n",
921 r->name, addr->local_part);
922 return SKIP;
923 }
924 deliver_home = string_copy(US (*pw)->pw_dir);
925 local_user_gid = (*pw)->pw_gid;
926 local_user_uid = (*pw)->pw_uid;
927 }
928
929 /* Set (or override in the case of check_local_user) the home directory if
930 router_home_directory is set. This is done here so that it overrides $home from
931 check_local_user before any subsequent expansions are done. Otherwise, $home
932 could mean different things for different options, which would be extremely
933 confusing. */
934
935 if (r->router_home_directory)
936 {
937 uschar *router_home = expand_string(r->router_home_directory);
938 if (!router_home)
939 {
940 if (!expand_string_forcedfail)
941 {
942 *perror = string_sprintf("failed to expand \"%s\" for "
943 "router_home_directory: %s", r->router_home_directory,
944 expand_string_message);
945 return DEFER;
946 }
947 }
948 else
949 {
950 setflag(addr, af_home_expanded); /* Note set from router_home_directory */
951 deliver_home = router_home;
952 }
953 }
954
955 /* Skip if the sender condition is not met. We leave this one till after the
956 local user check so that $home is set - enabling the possiblity of letting
957 individual recipients specify lists of acceptable/unacceptable senders. */
958
959 if ((rc = route_check_dls(r->name, US"senders", r->senders, NULL,
960 sender_address_cache, MCL_ADDRESS, NULL, NULL, FALSE, perror)) != OK)
961 return rc;
962
963 /* This is the point at which we print out the router's debugging string if it
964 is set. We wait till here so as to have $home available for local users (and
965 anyway, we don't want too much stuff for skipped routers). */
966
967 debug_print_string(r->debug_string);
968
969 /* Perform file existence tests. */
970
971 if ((rc = check_files(r->require_files, perror)) != OK)
972 {
973 DEBUG(D_route) debug_printf("%s router %s: file check\n", r->name,
974 (rc == SKIP)? "skipped" : "deferred");
975 return rc;
976 }
977
978 /* Now the general condition test. */
979
980 if (r->condition)
981 {
982 DEBUG(D_route) debug_printf("checking \"condition\"\n");
983 if (!expand_check_condition(r->condition, r->name, US"router"))
984 {
985 if (search_find_defer)
986 {
987 *perror = US"condition check lookup defer";
988 DEBUG(D_route) debug_printf("%s\n", *perror);
989 return DEFER;
990 }
991 DEBUG(D_route)
992 debug_printf("%s router skipped: condition failure\n", r->name);
993 return SKIP;
994 }
995 }
996
997 #ifdef EXPERIMENTAL_BRIGHTMAIL
998 /* check if a specific Brightmail AntiSpam rule fired on the message */
999 if (r->bmi_rule)
1000 {
1001 DEBUG(D_route) debug_printf("checking bmi_rule\n");
1002 if (bmi_check_rule(bmi_base64_verdict, r->bmi_rule) == 0)
1003 { /* none of the rules fired */
1004 DEBUG(D_route)
1005 debug_printf("%s router skipped: none of bmi_rule rules fired\n", r->name);
1006 return SKIP;
1007 }
1008 }
1009
1010 /* check if message should not be delivered */
1011 if (r->bmi_dont_deliver && bmi_deliver == 1)
1012 {
1013 DEBUG(D_route)
1014 debug_printf("%s router skipped: bmi_dont_deliver is FALSE\n", r->name);
1015 return SKIP;
1016 }
1017
1018 /* check if message should go to an alternate location */
1019 if ( r->bmi_deliver_alternate
1020 && (bmi_deliver == 0 || !bmi_alt_location)
1021 )
1022 {
1023 DEBUG(D_route)
1024 debug_printf("%s router skipped: bmi_deliver_alternate is FALSE\n", r->name);
1025 return SKIP;
1026 }
1027
1028 /* check if message should go to default location */
1029 if ( r->bmi_deliver_default
1030 && (bmi_deliver == 0 || bmi_alt_location)
1031 )
1032 {
1033 DEBUG(D_route)
1034 debug_printf("%s router skipped: bmi_deliver_default is FALSE\n", r->name);
1035 return SKIP;
1036 }
1037 #endif
1038
1039 /* All the checks passed. */
1040
1041 return OK;
1042 }
1043
1044
1045
1046
1047 /*************************************************
1048 * Find a local user *
1049 *************************************************/
1050
1051 /* Try several times (if configured) to find a local user, in case delays in
1052 NIS or NFS whatever cause an incorrect refusal. It's a pity that getpwnam()
1053 doesn't have some kind of indication as to why it has failed. If the string
1054 given consists entirely of digits, and the third argument is not NULL, assume
1055 the string is the numerical value of the uid. Otherwise it is looked up using
1056 getpwnam(). The uid is passed back via return_uid, if not NULL, and the
1057 pointer to a passwd structure, if found, is passed back via pw, if not NULL.
1058
1059 Because this may be called several times in succession for the same user for
1060 different routers, cache the result of the previous getpwnam call so that it
1061 can be re-used. Note that we can't just copy the structure, as the store it
1062 points to can get trashed.
1063
1064 Arguments:
1065 s the login name or textual form of the numerical uid of the user
1066 pw if not NULL, return the result of getpwnam here, or set NULL
1067 if no call to getpwnam is made (s numeric, return_uid != NULL)
1068 return_uid if not NULL, return the uid via this address
1069
1070 Returns: TRUE if s is numerical or was looked up successfully
1071
1072 */
1073
1074 static struct passwd pwcopy;
1075 static struct passwd *lastpw = NULL;
1076 static uschar lastname[48] = { 0 };
1077 static uschar lastdir[128];
1078 static uschar lastgecos[128];
1079 static uschar lastshell[128];
1080
1081 BOOL
1082 route_finduser(const uschar *s, struct passwd **pw, uid_t *return_uid)
1083 {
1084 BOOL cache_set = (Ustrcmp(lastname, s) == 0);
1085
1086 DEBUG(D_uid) debug_printf("seeking password data for user \"%s\": %s\n", s,
1087 cache_set? "using cached result" : "cache not available");
1088
1089 if (!cache_set)
1090 {
1091 int i = 0;
1092
1093 if (return_uid && (isdigit(*s) || *s == '-') &&
1094 s[Ustrspn(s+1, "0123456789")+1] == 0)
1095 {
1096 *return_uid = (uid_t)Uatoi(s);
1097 if (pw) *pw = NULL;
1098 return TRUE;
1099 }
1100
1101 (void)string_format(lastname, sizeof(lastname), "%s", s);
1102
1103 /* Force failure if string length is greater than given maximum */
1104
1105 if (max_username_length > 0 && Ustrlen(lastname) > max_username_length)
1106 {
1107 DEBUG(D_uid) debug_printf("forced failure of finduser(): string "
1108 "length of %s is greater than %d\n", lastname, max_username_length);
1109 lastpw = NULL;
1110 }
1111
1112 /* Try a few times if so configured; this handles delays in NIS etc. */
1113
1114 else for (;;)
1115 {
1116 errno = 0;
1117 if ((lastpw = getpwnam(CS s))) break;
1118 if (++i > finduser_retries) break;
1119 sleep(1);
1120 }
1121
1122 if (lastpw)
1123 {
1124 pwcopy.pw_uid = lastpw->pw_uid;
1125 pwcopy.pw_gid = lastpw->pw_gid;
1126 (void)string_format(lastdir, sizeof(lastdir), "%s", lastpw->pw_dir);
1127 (void)string_format(lastgecos, sizeof(lastgecos), "%s", lastpw->pw_gecos);
1128 (void)string_format(lastshell, sizeof(lastshell), "%s", lastpw->pw_shell);
1129 pwcopy.pw_name = CS lastname;
1130 pwcopy.pw_dir = CS lastdir;
1131 pwcopy.pw_gecos = CS lastgecos;
1132 pwcopy.pw_shell = CS lastshell;
1133 lastpw = &pwcopy;
1134 }
1135
1136 else DEBUG(D_uid) if (errno != 0)
1137 debug_printf("getpwnam(%s) failed: %s\n", s, strerror(errno));
1138 }
1139
1140 if (!lastpw)
1141 {
1142 DEBUG(D_uid) debug_printf("getpwnam() returned NULL (user not found)\n");
1143 return FALSE;
1144 }
1145
1146 DEBUG(D_uid) debug_printf("getpwnam() succeeded uid=%d gid=%d\n",
1147 lastpw->pw_uid, lastpw->pw_gid);
1148
1149 if (return_uid) *return_uid = lastpw->pw_uid;
1150 if (pw) *pw = lastpw;
1151
1152 return TRUE;
1153 }
1154
1155
1156
1157
1158 /*************************************************
1159 * Find a local group *
1160 *************************************************/
1161
1162 /* Try several times (if configured) to find a local group, in case delays in
1163 NIS or NFS whatever cause an incorrect refusal. It's a pity that getgrnam()
1164 doesn't have some kind of indication as to why it has failed.
1165
1166 Arguments:
1167 s the group namd or textual form of the numerical gid
1168 return_gid return the gid via this address
1169
1170 Returns: TRUE if the group was found; FALSE otherwise
1171
1172 */
1173
1174 BOOL
1175 route_findgroup(uschar *s, gid_t *return_gid)
1176 {
1177 int i = 0;
1178 struct group *gr;
1179
1180 if ((isdigit(*s) || *s == '-') && s[Ustrspn(s+1, "0123456789")+1] == 0)
1181 {
1182 *return_gid = (gid_t)Uatoi(s);
1183 return TRUE;
1184 }
1185
1186 for (;;)
1187 {
1188 if ((gr = getgrnam(CS s)))
1189 {
1190 *return_gid = gr->gr_gid;
1191 return TRUE;
1192 }
1193 if (++i > finduser_retries) break;
1194 sleep(1);
1195 }
1196
1197 return FALSE;
1198 }
1199
1200
1201
1202
1203 /*************************************************
1204 * Find user by expanding string *
1205 *************************************************/
1206
1207 /* Expands a string, and then looks up the result in the passwd file.
1208
1209 Arguments:
1210 string the string to be expanded, yielding a login name or a numerical
1211 uid value (to be passed to route_finduser())
1212 driver_name caller name for panic error message (only)
1213 driver_type caller type for panic error message (only)
1214 pw return passwd entry via this pointer
1215 uid return uid via this pointer
1216 errmsg where to point a message on failure
1217
1218 Returns: TRUE if user found, FALSE otherwise
1219 */
1220
1221 BOOL
1222 route_find_expanded_user(uschar *string, uschar *driver_name,
1223 uschar *driver_type, struct passwd **pw, uid_t *uid, uschar **errmsg)
1224 {
1225 uschar *user = expand_string(string);
1226
1227 if (!user)
1228 {
1229 *errmsg = string_sprintf("Failed to expand user string \"%s\" for the "
1230 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1231 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1232 return FALSE;
1233 }
1234
1235 if (route_finduser(user, pw, uid)) return TRUE;
1236
1237 *errmsg = string_sprintf("Failed to find user \"%s\" from expanded string "
1238 "\"%s\" for the %s %s", user, string, driver_name, driver_type);
1239 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1240 return FALSE;
1241 }
1242
1243
1244
1245 /*************************************************
1246 * Find group by expanding string *
1247 *************************************************/
1248
1249 /* Expands a string and then looks up the result in the group file.
1250
1251 Arguments:
1252 string the string to be expanded, yielding a group name or a numerical
1253 gid value (to be passed to route_findgroup())
1254 driver_name caller name for panic error message (only)
1255 driver_type caller type for panic error message (only)
1256 gid return gid via this pointer
1257 errmsg return error message via this pointer
1258
1259 Returns: TRUE if found group, FALSE otherwise
1260 */
1261
1262 BOOL
1263 route_find_expanded_group(uschar *string, uschar *driver_name, uschar *driver_type,
1264 gid_t *gid, uschar **errmsg)
1265 {
1266 BOOL yield = TRUE;
1267 uschar *group = expand_string(string);
1268
1269 if (!group)
1270 {
1271 *errmsg = string_sprintf("Failed to expand group string \"%s\" for the "
1272 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1273 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1274 return FALSE;
1275 }
1276
1277 if (!route_findgroup(group, gid))
1278 {
1279 *errmsg = string_sprintf("Failed to find group \"%s\" from expanded string "
1280 "\"%s\" for the %s %s", group, string, driver_name, driver_type);
1281 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1282 yield = FALSE;
1283 }
1284
1285 return yield;
1286 }
1287
1288
1289
1290 /*************************************************
1291 * Handle an unseen routing *
1292 *************************************************/
1293
1294 /* This function is called when an address is routed by a router with "unseen"
1295 set. It must make a clone of the address, for handling by subsequent drivers.
1296 The clone is set to start routing at the next router.
1297
1298 The original address must be replaced by an invented "parent" which has the
1299 routed address plus the clone as its children. This is necessary in case the
1300 address is at the top level - we don't want to mark it complete until both
1301 deliveries have been done.
1302
1303 A new unique field must be made, so that the record of the delivery isn't a
1304 record of the original address, and checking for already delivered has
1305 therefore to be done here. If the delivery has happened, then take the base
1306 address off whichever delivery queue it is on - it will always be the top item.
1307
1308 Arguments:
1309 name router name
1310 addr address that was routed
1311 paddr_local chain of local-delivery addresses
1312 paddr_remote chain of remote-delivery addresses
1313 addr_new chain for newly created addresses
1314
1315 Returns: nothing
1316 */
1317
1318 static void
1319 route_unseen(uschar *name, address_item *addr, address_item **paddr_local,
1320 address_item **paddr_remote, address_item **addr_new)
1321 {
1322 address_item *parent = deliver_make_addr(addr->address, TRUE);
1323 address_item *new = deliver_make_addr(addr->address, TRUE);
1324
1325 /* The invented parent is a copy that replaces the original; note that
1326 this copies its parent pointer. It has two children, and its errors_address is
1327 from the original address' parent, if present, otherwise unset. */
1328
1329 *parent = *addr;
1330 parent->child_count = 2;
1331 parent->prop.errors_address =
1332 addr->parent ? addr->parent->prop.errors_address : NULL;
1333
1334 /* The routed address gets a new parent. */
1335
1336 addr->parent = parent;
1337
1338 /* The clone has this parent too. Set its errors address from the parent. This
1339 was set from the original parent (or to NULL) - see above. We do NOT want to
1340 take the errors address from the unseen router. */
1341
1342 new->parent = parent;
1343 new->prop.errors_address = parent->prop.errors_address;
1344
1345 /* Copy the propagated flags and address_data from the original. */
1346
1347 copyflag(new, addr, af_propagate);
1348 new->prop.address_data = addr->prop.address_data;
1349 new->dsn_flags = addr->dsn_flags;
1350 new->dsn_orcpt = addr->dsn_orcpt;
1351
1352
1353 /* As it has turned out, we haven't set headers_add or headers_remove for the
1354 * clone. Thinking about it, it isn't entirely clear whether they should be
1355 * copied from the original parent, like errors_address, or taken from the
1356 * unseen router, like address_data and the flags. Until somebody brings this
1357 * up, I propose to leave the code as it is.
1358 */
1359
1360
1361 /* Set the cloned address to start at the next router, and put it onto the
1362 chain of new addresses. */
1363
1364 new->start_router = addr->router->next;
1365 new->next = *addr_new;
1366 *addr_new = new;
1367
1368 DEBUG(D_route) debug_printf("\"unseen\" set: replicated %s\n", addr->address);
1369
1370 /* Make a new unique field, to distinguish from the normal one. */
1371
1372 addr->unique = string_sprintf("%s/%s", addr->unique, name);
1373
1374 /* If the address has been routed to a transport, see if it was previously
1375 delivered. If so, we take it off the relevant queue so that it isn't delivered
1376 again. Otherwise, it was an alias or something, and the addresses it generated
1377 are handled in the normal way. */
1378
1379 if (addr->transport && tree_search(tree_nonrecipients, addr->unique))
1380 {
1381 DEBUG(D_route)
1382 debug_printf("\"unseen\" delivery previously done - discarded\n");
1383 parent->child_count--;
1384 if (*paddr_remote == addr) *paddr_remote = addr->next;
1385 if (*paddr_local == addr) *paddr_local = addr->next;
1386 }
1387 }
1388
1389
1390
1391 /*************************************************
1392 * Route one address *
1393 *************************************************/
1394
1395 /* This function is passed in one address item, for processing by the routers.
1396 The verify flag is set if this is being called for verification rather than
1397 delivery. If the router doesn't have its "verify" flag set, it is skipped.
1398
1399 Arguments:
1400 addr address to route
1401 paddr_local chain of local-delivery addresses
1402 paddr_remote chain of remote-delivery addresses
1403 addr_new chain for newly created addresses
1404 addr_succeed chain for completed addresses
1405 verify v_none if not verifying
1406 v_sender if verifying a sender address
1407 v_recipient if verifying a recipient address
1408 v_expn if processing an EXPN address
1409
1410 Returns: OK => address successfully routed
1411 DISCARD => address was discarded
1412 FAIL => address could not be routed
1413 DEFER => some temporary problem
1414 ERROR => some major internal or configuration failure
1415 */
1416
1417 int
1418 route_address(address_item *addr, address_item **paddr_local,
1419 address_item **paddr_remote, address_item **addr_new,
1420 address_item **addr_succeed, int verify)
1421 {
1422 int yield = OK;
1423 BOOL unseen;
1424 router_instance *r, *nextr;
1425 const uschar *old_domain = addr->domain;
1426
1427 HDEBUG(D_route)
1428 {
1429 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1430 debug_printf("routing %s\n", addr->address);
1431 }
1432
1433 /* Loop through all router instances until a router succeeds, fails, defers, or
1434 encounters an error. If the address has start_router set, we begin from there
1435 instead of at the first router. */
1436
1437 for (r = addr->start_router ? addr->start_router : routers; r; r = nextr)
1438 {
1439 uschar *error;
1440 struct passwd *pw = NULL;
1441 struct passwd pwcopy;
1442 address_item *parent;
1443 BOOL loop_detected = FALSE;
1444 BOOL more;
1445 int loopcount = 0;
1446 int rc;
1447
1448 DEBUG(D_route) debug_printf("--------> %s router <--------\n", r->name);
1449
1450 /* Reset any search error message from the previous router. */
1451
1452 search_error_message = NULL;
1453
1454 /* There are some weird cases where logging is disabled */
1455
1456 disable_logging = r->disable_logging;
1457
1458 /* Record the last router to handle the address, and set the default
1459 next router. */
1460
1461 addr->router = r;
1462 nextr = r->next;
1463
1464 /* Loop protection: If this address has an ancestor with the same address,
1465 and that ancestor was routed by this router, we skip this router. This
1466 prevents a variety of looping states when a new address is created by
1467 redirection or by the use of "unseen" on a router.
1468
1469 If no_repeat_use is set on the router, we skip if _any_ ancestor was routed
1470 by this router, even if it was different to the current address.
1471
1472 Just in case someone does put it into a loop (possible with redirection
1473 continally adding to an address, for example), put a long stop counter on
1474 the number of parents. */
1475
1476 for (parent = addr->parent; parent; parent = parent->parent)
1477 {
1478 if (parent->router == r)
1479 {
1480 BOOL break_loop = !r->repeat_use;
1481
1482 /* When repeat_use is set, first check the active addresses caselessly.
1483 If they match, we have to do a further caseful check of the local parts
1484 when caseful_local_part is set. This is assumed to be rare, which is why
1485 the code is written this way. */
1486
1487 if (!break_loop)
1488 {
1489 break_loop = strcmpic(parent->address, addr->address) == 0;
1490 if (break_loop && r->caseful_local_part)
1491 break_loop = Ustrncmp(parent->address, addr->address,
1492 Ustrrchr(addr->address, '@') - addr->address) == 0;
1493 }
1494
1495 if (break_loop)
1496 {
1497 DEBUG(D_route) debug_printf("%s router skipped: previously routed %s\n",
1498 r->name, parent->address);
1499 loop_detected = TRUE;
1500 break;
1501 }
1502 }
1503
1504 /* Continue with parents, limiting the size of the dynasty. */
1505
1506 if (loopcount++ > 100)
1507 {
1508 log_write(0, LOG_MAIN|LOG_PANIC, "routing loop for %s", addr->address);
1509 yield = DEFER;
1510 goto ROUTE_EXIT;
1511 }
1512 }
1513
1514 if (loop_detected) continue;
1515
1516 /* Default no affixes and select whether to use a caseful or caseless local
1517 part in this router. */
1518
1519 addr->prefix = addr->suffix = NULL;
1520 addr->local_part = r->caseful_local_part?
1521 addr->cc_local_part : addr->lc_local_part;
1522
1523 DEBUG(D_route) debug_printf("local_part=%s domain=%s\n", addr->local_part,
1524 addr->domain);
1525
1526 /* Handle any configured prefix by replacing the local_part address,
1527 and setting the prefix. Skip the router if the prefix doesn't match,
1528 unless the prefix is optional. */
1529
1530 if (r->prefix)
1531 {
1532 int plen = route_check_prefix(addr->local_part, r->prefix);
1533 if (plen > 0)
1534 {
1535 addr->prefix = string_copyn(addr->local_part, plen);
1536 addr->local_part += plen;
1537 DEBUG(D_route) debug_printf("stripped prefix %s\n", addr->prefix);
1538 }
1539 else if (!r->prefix_optional)
1540 {
1541 DEBUG(D_route) debug_printf("%s router skipped: prefix mismatch\n",
1542 r->name);
1543 continue;
1544 }
1545 }
1546
1547 /* Handle any configured suffix likewise. */
1548
1549 if (r->suffix)
1550 {
1551 int slen = route_check_suffix(addr->local_part, r->suffix);
1552 if (slen > 0)
1553 {
1554 int lplen = Ustrlen(addr->local_part) - slen;
1555 addr->suffix = addr->local_part + lplen;
1556 addr->local_part = string_copyn(addr->local_part, lplen);
1557 DEBUG(D_route) debug_printf("stripped suffix %s\n", addr->suffix);
1558 }
1559 else if (!r->suffix_optional)
1560 {
1561 DEBUG(D_route) debug_printf("%s router skipped: suffix mismatch\n",
1562 r->name);
1563 continue;
1564 }
1565 }
1566
1567 /* Set the expansion variables now that we have the affixes and the case of
1568 the local part sorted. */
1569
1570 router_name = r->name;
1571 deliver_set_expansions(addr);
1572
1573 /* For convenience, the pre-router checks are in a separate function, which
1574 returns OK, SKIP, FAIL, or DEFER. */
1575
1576 if ((rc = check_router_conditions(r, addr, verify, &pw, &error)) != OK)
1577 {
1578 router_name = NULL;
1579 if (rc == SKIP) continue;
1580 addr->message = error;
1581 yield = rc;
1582 goto ROUTE_EXIT;
1583 }
1584
1585 /* All pre-conditions have been met. Reset any search error message from
1586 pre-condition tests. These can arise in negated tests where the failure of
1587 the lookup leads to a TRUE pre-condition. */
1588
1589 search_error_message = NULL;
1590
1591 /* Finally, expand the address_data field in the router. Forced failure
1592 behaves as if the router declined. Any other failure is more serious. On
1593 success, the string is attached to the address for all subsequent processing.
1594 */
1595
1596 if (r->address_data)
1597 {
1598 DEBUG(D_route) debug_printf("processing address_data\n");
1599 deliver_address_data = expand_string(r->address_data);
1600 if (!deliver_address_data)
1601 {
1602 if (expand_string_forcedfail)
1603 {
1604 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1605 "(address_data): decline action taken\n", r->address_data);
1606
1607 /* Expand "more" if necessary; DEFER => an expansion failed */
1608
1609 yield = exp_bool(addr, US"router", r->name, D_route,
1610 US"more", r->more, r->expand_more, &more);
1611 if (yield != OK) goto ROUTE_EXIT;
1612
1613 if (!more)
1614 {
1615 DEBUG(D_route)
1616 debug_printf("\"more\"=false: skipping remaining routers\n");
1617 router_name = NULL;
1618 r = NULL;
1619 break;
1620 }
1621 else continue; /* With next router */
1622 }
1623
1624 else
1625 {
1626 addr->message = string_sprintf("expansion of \"%s\" failed "
1627 "in %s router: %s", r->address_data, r->name, expand_string_message);
1628 yield = DEFER;
1629 goto ROUTE_EXIT;
1630 }
1631 }
1632 addr->prop.address_data = deliver_address_data;
1633 }
1634
1635 /* We are finally cleared for take-off with this router. Clear the the flag
1636 that records that a local host was removed from a routed host list. Make a
1637 copy of relevant fields in the password information from check_local_user,
1638 because it will be overwritten if check_local_user is invoked again while
1639 verifying an errors_address setting. */
1640
1641 clearflag(addr, af_local_host_removed);
1642
1643 if (pw)
1644 {
1645 pwcopy.pw_name = CS string_copy(US pw->pw_name);
1646 pwcopy.pw_uid = pw->pw_uid;
1647 pwcopy.pw_gid = pw->pw_gid;
1648 pwcopy.pw_gecos = CS string_copy(US pw->pw_gecos);
1649 pwcopy.pw_dir = CS string_copy(US pw->pw_dir);
1650 pwcopy.pw_shell = CS string_copy(US pw->pw_shell);
1651 pw = &pwcopy;
1652 }
1653
1654 /* Run the router, and handle the consequences. */
1655
1656 /* ... but let us check on DSN before. If this should be the last hop for DSN
1657 set flag. */
1658
1659 if (r->dsn_lasthop && !(addr->dsn_flags & rf_dsnlasthop))
1660 {
1661 addr->dsn_flags |= rf_dsnlasthop;
1662 HDEBUG(D_route) debug_printf("DSN: last hop for %s\n", addr->address);
1663 }
1664
1665 HDEBUG(D_route) debug_printf("calling %s router\n", r->name);
1666
1667 yield = (r->info->code)(r, addr, pw, verify, paddr_local, paddr_remote,
1668 addr_new, addr_succeed);
1669
1670 router_name = NULL;
1671
1672 if (yield == FAIL)
1673 {
1674 HDEBUG(D_route) debug_printf("%s router forced address failure\n", r->name);
1675 goto ROUTE_EXIT;
1676 }
1677
1678 /* If succeeded while verifying but fail_verify is set, convert into
1679 a failure, and take it off the local or remote delivery list. */
1680
1681 if (((verify == v_sender && r->fail_verify_sender) ||
1682 (verify == v_recipient && r->fail_verify_recipient)) &&
1683 (yield == OK || yield == PASS))
1684 {
1685 addr->message = string_sprintf("%s router forced verify failure", r->name);
1686 if (*paddr_remote == addr) *paddr_remote = addr->next;
1687 if (*paddr_local == addr) *paddr_local = addr->next;
1688 yield = FAIL;
1689 goto ROUTE_EXIT;
1690 }
1691
1692 /* PASS and DECLINE are the only two cases where the loop continues. For all
1693 other returns, we break the loop and handle the result below. */
1694
1695 if (yield != PASS && yield != DECLINE) break;
1696
1697 HDEBUG(D_route)
1698 {
1699 debug_printf("%s router %s for %s\n", r->name,
1700 (yield == PASS)? "passed" : "declined", addr->address);
1701 if (Ustrcmp(old_domain, addr->domain) != 0)
1702 debug_printf("domain %s rewritten\n", old_domain);
1703 }
1704
1705 /* PASS always continues to another router; DECLINE does so if "more"
1706 is true. Initialization insists that pass_router is always a following
1707 router. Otherwise, break the loop as if at the end of the routers. */
1708
1709 if (yield == PASS)
1710 {
1711 if (r->pass_router != NULL) nextr = r->pass_router;
1712 }
1713 else
1714 {
1715 /* Expand "more" if necessary */
1716
1717 yield = exp_bool(addr, US"router", r->name, D_route,
1718 US"more", r->more, r->expand_more, &more);
1719 if (yield != OK) goto ROUTE_EXIT;
1720
1721 if (!more)
1722 {
1723 HDEBUG(D_route)
1724 debug_printf("\"more\" is false: skipping remaining routers\n");
1725 r = NULL;
1726 break;
1727 }
1728 }
1729 } /* Loop for all routers */
1730
1731 /* On exit from the routers loop, if r == NULL we have run out of routers,
1732 either genuinely, or as a result of no_more. Otherwise, the loop ended
1733 prematurely, either because a router succeeded, or because of some special
1734 router response. Note that FAIL errors and errors detected before actually
1735 running a router go direct to ROUTE_EXIT from code above. */
1736
1737 if (!r)
1738 {
1739 HDEBUG(D_route) debug_printf("no more routers\n");
1740 if (!addr->message)
1741 {
1742 uschar *message = US"Unrouteable address";
1743 if (addr->router && addr->router->cannot_route_message)
1744 {
1745 uschar *expmessage = expand_string(addr->router->cannot_route_message);
1746 if (!expmessage)
1747 {
1748 if (!expand_string_forcedfail)
1749 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
1750 "cannot_route_message in %s router: %s", addr->router->name,
1751 expand_string_message);
1752 }
1753 else message = expmessage;
1754 }
1755 addr->user_message = addr->message = message;
1756 }
1757 addr->router = NULL; /* For logging */
1758 yield = FAIL;
1759 goto ROUTE_EXIT;
1760 }
1761
1762 if (yield == DEFER)
1763 {
1764 HDEBUG(D_route)
1765 {
1766 debug_printf("%s router: defer for %s\n", r->name, addr->address);
1767 debug_printf(" message: %s\n", (addr->message == NULL)?
1768 US"<none>" : addr->message);
1769 }
1770 goto ROUTE_EXIT;
1771 }
1772
1773 if (yield == DISCARD) goto ROUTE_EXIT;
1774
1775 /* The yield must be either OK or REROUTED. */
1776
1777 if (yield != OK && yield != REROUTED)
1778 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router returned unknown value %d",
1779 r->name, yield);
1780
1781 /* If the yield was REROUTED, the router put a child address on the new chain
1782 as a result of a domain change of some sort (widening, typically). */
1783
1784 if (yield == REROUTED)
1785 {
1786 HDEBUG(D_route) debug_printf("re-routed to %s\n", addr->address);
1787 yield = OK;
1788 goto ROUTE_EXIT;
1789 }
1790
1791 /* The only remaining possibility is that the router succeeded. If the
1792 translate_ip_address options is set and host addresses were associated with the
1793 address, run them through the translation. This feature is for weird and
1794 wonderful situations (the amateur packet radio people need it) or very broken
1795 networking, so it is included in the binary only if requested. */
1796
1797 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
1798
1799 if (r->translate_ip_address)
1800 {
1801 int rc;
1802 int old_pool = store_pool;
1803 host_item *h;
1804 for (h = addr->host_list; h; h = h->next)
1805 {
1806 uschar *newaddress;
1807 uschar *oldaddress, *oldname;
1808
1809 if (!h->address) continue;
1810
1811 deliver_host_address = h->address;
1812 newaddress = expand_string(r->translate_ip_address);
1813 deliver_host_address = NULL;
1814
1815 if (!newaddress)
1816 {
1817 if (expand_string_forcedfail) continue;
1818 addr->basic_errno = ERRNO_EXPANDFAIL;
1819 addr->message = string_sprintf("translate_ip_address expansion "
1820 "failed: %s", expand_string_message);
1821 yield = DEFER;
1822 goto ROUTE_EXIT;
1823 }
1824
1825 DEBUG(D_route) debug_printf("%s [%s] translated to %s\n",
1826 h->name, h->address, newaddress);
1827 if (string_is_ip_address(newaddress, NULL) != 0)
1828 {
1829 h->address = newaddress;
1830 continue;
1831 }
1832
1833 oldname = h->name;
1834 oldaddress = h->address;
1835 h->name = newaddress;
1836 h->address = NULL;
1837 h->mx = MX_NONE;
1838
1839 store_pool = POOL_PERM;
1840 rc = host_find_byname(h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, TRUE);
1841 store_pool = old_pool;
1842
1843 if (rc == HOST_FIND_FAILED || rc == HOST_FIND_AGAIN)
1844 {
1845 addr->basic_errno = ERRNO_UNKNOWNHOST;
1846 addr->message = string_sprintf("host %s not found when "
1847 "translating %s [%s]", h->name, oldname, oldaddress);
1848 yield = DEFER;
1849 goto ROUTE_EXIT;
1850 }
1851 }
1852 }
1853 #endif /* SUPPORT_TRANSLATE_IP_ADDRESS */
1854
1855 /* See if this is an unseen routing; first expand the option if necessary.
1856 DEFER can be given if the expansion fails */
1857
1858 yield = exp_bool(addr, US"router", r->name, D_route,
1859 US"unseen", r->unseen, r->expand_unseen, &unseen);
1860 if (yield != OK) goto ROUTE_EXIT;
1861
1862 /* Debugging output recording a successful routing */
1863
1864 HDEBUG(D_route) debug_printf("routed by %s router%s\n", r->name,
1865 unseen? " (unseen)" : "");
1866
1867 DEBUG(D_route)
1868 {
1869 host_item *h;
1870
1871 debug_printf(" envelope to: %s\n", addr->address);
1872 debug_printf(" transport: %s\n", (addr->transport == NULL)?
1873 US"<none>" : addr->transport->name);
1874
1875 if (addr->prop.errors_address)
1876 debug_printf(" errors to %s\n", addr->prop.errors_address);
1877
1878 for (h = addr->host_list; h; h = h->next)
1879 {
1880 debug_printf(" host %s", h->name);
1881 if (h->address) debug_printf(" [%s]", h->address);
1882 if (h->mx >= 0) debug_printf(" MX=%d", h->mx);
1883 else if (h->mx != MX_NONE) debug_printf(" rgroup=%d", h->mx);
1884 if (h->port != PORT_NONE) debug_printf(" port=%d", h->port);
1885 if (h->dnssec != DS_UNK) debug_printf(" dnssec=%s", h->dnssec==DS_YES ? "yes" : "no");
1886 debug_printf("\n");
1887 }
1888 }
1889
1890 /* Clear any temporary error message set by a router that declined, and handle
1891 the "unseen" option (ignore if there are no further routers). */
1892
1893 addr->message = NULL;
1894 if (unseen && r->next)
1895 route_unseen(r->name, addr, paddr_local, paddr_remote, addr_new);
1896
1897 /* Unset the address expansions, and return the final result. */
1898
1899 ROUTE_EXIT:
1900 if (yield == DEFER && addr->message)
1901 addr->message = expand_hide_passwords(addr->message);
1902
1903 deliver_set_expansions(NULL);
1904 router_name = NULL;
1905 disable_logging = FALSE;
1906 return yield;
1907 }
1908
1909 /* End of route.c */