48c18abc67bc830e5761944d4dc979bdcf1d1d68
[exim.git] / src / src / transport.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* General functions concerned with transportation, and generic options for all
9 transports. */
10
11
12 #include "exim.h"
13
14 /* Generic options for transports, all of which live inside transport_instance
15 data blocks and which therefore have the opt_public flag set. Note that there
16 are other options living inside this structure which can be set only from
17 certain transports. */
18
19 optionlist optionlist_transports[] = {
20 /* name type value */
21 { "*expand_group", opt_stringptr|opt_hidden|opt_public,
22 (void *)offsetof(transport_instance, expand_gid) },
23 { "*expand_user", opt_stringptr|opt_hidden|opt_public,
24 (void *)offsetof(transport_instance, expand_uid) },
25 { "*headers_rewrite_flags", opt_int|opt_public|opt_hidden,
26 (void *)offsetof(transport_instance, rewrite_existflags) },
27 { "*headers_rewrite_rules", opt_void|opt_public|opt_hidden,
28 (void *)offsetof(transport_instance, rewrite_rules) },
29 { "*set_group", opt_bool|opt_hidden|opt_public,
30 (void *)offsetof(transport_instance, gid_set) },
31 { "*set_user", opt_bool|opt_hidden|opt_public,
32 (void *)offsetof(transport_instance, uid_set) },
33 { "body_only", opt_bool|opt_public,
34 (void *)offsetof(transport_instance, body_only) },
35 { "current_directory", opt_stringptr|opt_public,
36 (void *)offsetof(transport_instance, current_dir) },
37 { "debug_print", opt_stringptr | opt_public,
38 (void *)offsetof(transport_instance, debug_string) },
39 { "delivery_date_add", opt_bool|opt_public,
40 (void *)(offsetof(transport_instance, delivery_date_add)) },
41 { "disable_logging", opt_bool|opt_public,
42 (void *)(offsetof(transport_instance, disable_logging)) },
43 { "driver", opt_stringptr|opt_public,
44 (void *)offsetof(transport_instance, driver_name) },
45 { "envelope_to_add", opt_bool|opt_public,
46 (void *)(offsetof(transport_instance, envelope_to_add)) },
47 #ifndef DISABLE_EVENT
48 { "event_action", opt_stringptr | opt_public,
49 (void *)offsetof(transport_instance, event_action) },
50 #endif
51 { "group", opt_expand_gid|opt_public,
52 (void *)offsetof(transport_instance, gid) },
53 { "headers_add", opt_stringptr|opt_public|opt_rep_str,
54 (void *)offsetof(transport_instance, add_headers) },
55 { "headers_only", opt_bool|opt_public,
56 (void *)offsetof(transport_instance, headers_only) },
57 { "headers_remove", opt_stringptr|opt_public|opt_rep_str,
58 (void *)offsetof(transport_instance, remove_headers) },
59 { "headers_rewrite", opt_rewrite|opt_public,
60 (void *)offsetof(transport_instance, headers_rewrite) },
61 { "home_directory", opt_stringptr|opt_public,
62 (void *)offsetof(transport_instance, home_dir) },
63 { "initgroups", opt_bool|opt_public,
64 (void *)offsetof(transport_instance, initgroups) },
65 { "max_parallel", opt_stringptr|opt_public,
66 (void *)offsetof(transport_instance, max_parallel) },
67 { "message_size_limit", opt_stringptr|opt_public,
68 (void *)offsetof(transport_instance, message_size_limit) },
69 { "rcpt_include_affixes", opt_bool|opt_public,
70 (void *)offsetof(transport_instance, rcpt_include_affixes) },
71 { "retry_use_local_part", opt_bool|opt_public,
72 (void *)offsetof(transport_instance, retry_use_local_part) },
73 { "return_path", opt_stringptr|opt_public,
74 (void *)(offsetof(transport_instance, return_path)) },
75 { "return_path_add", opt_bool|opt_public,
76 (void *)(offsetof(transport_instance, return_path_add)) },
77 { "shadow_condition", opt_stringptr|opt_public,
78 (void *)offsetof(transport_instance, shadow_condition) },
79 { "shadow_transport", opt_stringptr|opt_public,
80 (void *)offsetof(transport_instance, shadow) },
81 { "transport_filter", opt_stringptr|opt_public,
82 (void *)offsetof(transport_instance, filter_command) },
83 { "transport_filter_timeout", opt_time|opt_public,
84 (void *)offsetof(transport_instance, filter_timeout) },
85 { "user", opt_expand_uid|opt_public,
86 (void *)offsetof(transport_instance, uid) }
87 };
88
89 int optionlist_transports_size = nelem(optionlist_transports);
90
91 #ifdef MACRO_PREDEF
92
93 # include "macro_predef.h"
94
95 void
96 options_transports(void)
97 {
98 struct transport_info * ti;
99 uschar buf[64];
100
101 options_from_list(optionlist_transports, nelem(optionlist_transports), US"TRANSPORTS", NULL);
102
103 for (ti = transports_available; ti->driver_name[0]; ti++)
104 {
105 spf(buf, sizeof(buf), US"_DRIVER_TRANSPORT_%T", ti->driver_name);
106 builtin_macro_create(buf);
107 options_from_list(ti->options, (unsigned)*ti->options_count, US"TRANSPORT", ti->driver_name);
108 }
109 }
110
111 #else /*!MACRO_PREDEF*/
112
113 /* Structure for keeping list of addresses that have been added to
114 Envelope-To:, in order to avoid duplication. */
115
116 struct aci {
117 struct aci *next;
118 address_item *ptr;
119 };
120
121
122 /* Static data for write_chunk() */
123
124 static uschar *chunk_ptr; /* chunk pointer */
125 static uschar *nl_check; /* string to look for at line start */
126 static int nl_check_length; /* length of same */
127 static uschar *nl_escape; /* string to insert */
128 static int nl_escape_length; /* length of same */
129 static int nl_partial_match; /* length matched at chunk end */
130
131
132 /*************************************************
133 * Initialize transport list *
134 *************************************************/
135
136 /* Read the transports section of the configuration file, and set up a chain of
137 transport instances according to its contents. Each transport has generic
138 options and may also have its own private options. This function is only ever
139 called when transports == NULL. We use generic code in readconf to do most of
140 the work. */
141
142 void
143 transport_init(void)
144 {
145 transport_instance *t;
146
147 readconf_driver_init(US"transport",
148 (driver_instance **)(&transports), /* chain anchor */
149 (driver_info *)transports_available, /* available drivers */
150 sizeof(transport_info), /* size of info block */
151 &transport_defaults, /* default values for generic options */
152 sizeof(transport_instance), /* size of instance block */
153 optionlist_transports, /* generic options */
154 optionlist_transports_size);
155
156 /* Now scan the configured transports and check inconsistencies. A shadow
157 transport is permitted only for local transports. */
158
159 for (t = transports; t; t = t->next)
160 {
161 if (!t->info->local && t->shadow)
162 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
163 "shadow transport not allowed on non-local transport %s", t->name);
164
165 if (t->body_only && t->headers_only)
166 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
167 "%s transport: body_only and headers_only are mutually exclusive",
168 t->name);
169 }
170 }
171
172
173
174 /*************************************************
175 * Write block of data *
176 *************************************************/
177
178 /* Subroutine called by write_chunk() and at the end of the message actually
179 to write a data block. Also called directly by some transports to write
180 additional data to the file descriptor (e.g. prefix, suffix).
181
182 If a transport wants data transfers to be timed, it sets a non-zero value in
183 transport_write_timeout. A non-zero transport_write_timeout causes a timer to
184 be set for each block of data written from here. If time runs out, then write()
185 fails and provokes an error return. The caller can then inspect sigalrm_seen to
186 check for a timeout.
187
188 On some systems, if a quota is exceeded during the write, the yield is the
189 number of bytes written rather than an immediate error code. This also happens
190 on some systems in other cases, for example a pipe that goes away because the
191 other end's process terminates (Linux). On other systems, (e.g. Solaris 2) you
192 get the error codes the first time.
193
194 The write() function is also interruptible; the Solaris 2.6 man page says:
195
196 If write() is interrupted by a signal before it writes any
197 data, it will return -1 with errno set to EINTR.
198
199 If write() is interrupted by a signal after it successfully
200 writes some data, it will return the number of bytes written.
201
202 To handle these cases, we want to restart the write() to output the remainder
203 of the data after a non-negative return from write(), except after a timeout.
204 In the error cases (EDQUOT, EPIPE) no bytes get written the second time, and a
205 proper error then occurs. In principle, after an interruption, the second
206 write() could suffer the same fate, but we do not want to continue for
207 evermore, so stick a maximum repetition count on the loop to act as a
208 longstop.
209
210 Arguments:
211 tctx transport context: file descriptor or string to write to
212 block block of bytes to write
213 len number of bytes to write
214 more further data expected soon
215
216 Returns: TRUE on success, FALSE on failure (with errno preserved);
217 transport_count is incremented by the number of bytes written
218 */
219
220 static BOOL
221 transport_write_block_fd(transport_ctx * tctx, uschar *block, int len, BOOL more)
222 {
223 int i, rc, save_errno;
224 int local_timeout = transport_write_timeout;
225 int fd = tctx->u.fd;
226
227 /* This loop is for handling incomplete writes and other retries. In most
228 normal cases, it is only ever executed once. */
229
230 for (i = 0; i < 100; i++)
231 {
232 DEBUG(D_transport)
233 debug_printf("writing data block fd=%d size=%d timeout=%d%s\n",
234 fd, len, local_timeout, more ? " (more expected)" : "");
235
236 /* This code makes use of alarm() in order to implement the timeout. This
237 isn't a very tidy way of doing things. Using non-blocking I/O with select()
238 provides a neater approach. However, I don't know how to do this when TLS is
239 in use. */
240
241 if (transport_write_timeout <= 0) /* No timeout wanted */
242 {
243 rc =
244 #ifdef SUPPORT_TLS
245 tls_out.active.sock == fd ? tls_write(tls_out.active.tls_ctx, block, len, more) :
246 #endif
247 #ifdef MSG_MORE
248 more && !(tctx->options & topt_not_socket)
249 ? send(fd, block, len, MSG_MORE) :
250 #endif
251 write(fd, block, len);
252 save_errno = errno;
253 }
254
255 /* Timeout wanted. */
256
257 else
258 {
259 ALARM(local_timeout);
260
261 rc =
262 #ifdef SUPPORT_TLS
263 tls_out.active.sock == fd ? tls_write(tls_out.active.tls_ctx, block, len, more) :
264 #endif
265 #ifdef MSG_MORE
266 more && !(tctx->options & topt_not_socket)
267 ? send(fd, block, len, MSG_MORE) :
268 #endif
269 write(fd, block, len);
270
271 save_errno = errno;
272 local_timeout = ALARM_CLR(0);
273 if (sigalrm_seen)
274 {
275 errno = ETIMEDOUT;
276 return FALSE;
277 }
278 }
279
280 /* Hopefully, the most common case is success, so test that first. */
281
282 if (rc == len) { transport_count += len; return TRUE; }
283
284 /* A non-negative return code is an incomplete write. Try again for the rest
285 of the block. If we have exactly hit the timeout, give up. */
286
287 if (rc >= 0)
288 {
289 len -= rc;
290 block += rc;
291 transport_count += rc;
292 DEBUG(D_transport) debug_printf("write incomplete (%d)\n", rc);
293 goto CHECK_TIMEOUT; /* A few lines below */
294 }
295
296 /* A negative return code with an EINTR error is another form of
297 incomplete write, zero bytes having been written */
298
299 if (save_errno == EINTR)
300 {
301 DEBUG(D_transport)
302 debug_printf("write interrupted before anything written\n");
303 goto CHECK_TIMEOUT; /* A few lines below */
304 }
305
306 /* A response of EAGAIN from write() is likely only in the case of writing
307 to a FIFO that is not swallowing the data as fast as Exim is writing it. */
308
309 if (save_errno == EAGAIN)
310 {
311 DEBUG(D_transport)
312 debug_printf("write temporarily locked out, waiting 1 sec\n");
313 sleep(1);
314
315 /* Before continuing to try another write, check that we haven't run out of
316 time. */
317
318 CHECK_TIMEOUT:
319 if (transport_write_timeout > 0 && local_timeout <= 0)
320 {
321 errno = ETIMEDOUT;
322 return FALSE;
323 }
324 continue;
325 }
326
327 /* Otherwise there's been an error */
328
329 DEBUG(D_transport) debug_printf("writing error %d: %s\n", save_errno,
330 strerror(save_errno));
331 errno = save_errno;
332 return FALSE;
333 }
334
335 /* We've tried and tried and tried but still failed */
336
337 errno = ERRNO_WRITEINCOMPLETE;
338 return FALSE;
339 }
340
341
342 BOOL
343 transport_write_block(transport_ctx * tctx, uschar *block, int len, BOOL more)
344 {
345 if (!(tctx->options & topt_output_string))
346 return transport_write_block_fd(tctx, block, len, more);
347
348 /* Write to expanding-string. NOTE: not NUL-terminated */
349
350 if (!tctx->u.msg)
351 tctx->u.msg = string_get(1024);
352
353 tctx->u.msg = string_catn(tctx->u.msg, block, len);
354 return TRUE;
355 }
356
357
358
359
360 /*************************************************
361 * Write formatted string *
362 *************************************************/
363
364 /* This is called by various transports. It is a convenience function.
365
366 Arguments:
367 fd file descriptor
368 format string format
369 ... arguments for format
370
371 Returns: the yield of transport_write_block()
372 */
373
374 BOOL
375 transport_write_string(int fd, const char *format, ...)
376 {
377 transport_ctx tctx = {{0}};
378 va_list ap;
379 va_start(ap, format);
380 if (!string_vformat(big_buffer, big_buffer_size, format, ap))
381 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "overlong formatted string in transport");
382 va_end(ap);
383 tctx.u.fd = fd;
384 return transport_write_block(&tctx, big_buffer, Ustrlen(big_buffer), FALSE);
385 }
386
387
388
389
390 void
391 transport_write_reset(int options)
392 {
393 if (!(options & topt_continuation)) chunk_ptr = deliver_out_buffer;
394 nl_partial_match = -1;
395 nl_check_length = nl_escape_length = 0;
396 }
397
398
399
400 /*************************************************
401 * Write character chunk *
402 *************************************************/
403
404 /* Subroutine used by transport_write_message() to scan character chunks for
405 newlines and act appropriately. The object is to minimise the number of writes.
406 The output byte stream is buffered up in deliver_out_buffer, which is written
407 only when it gets full, thus minimizing write operations and TCP packets.
408
409 Static data is used to handle the case when the last character of the previous
410 chunk was NL, or matched part of the data that has to be escaped.
411
412 Arguments:
413 tctx transport context - processing to be done during output,
414 and file descriptor to write to
415 chunk pointer to data to write
416 len length of data to write
417
418 In addition, the static nl_xxx variables must be set as required.
419
420 Returns: TRUE on success, FALSE on failure (with errno preserved)
421 */
422
423 BOOL
424 write_chunk(transport_ctx * tctx, uschar *chunk, int len)
425 {
426 uschar *start = chunk;
427 uschar *end = chunk + len;
428 uschar *ptr;
429 int mlen = DELIVER_OUT_BUFFER_SIZE - nl_escape_length - 2;
430
431 /* The assumption is made that the check string will never stretch over move
432 than one chunk since the only time there are partial matches is when copying
433 the body in large buffers. There is always enough room in the buffer for an
434 escape string, since the loop below ensures this for each character it
435 processes, and it won't have stuck in the escape string if it left a partial
436 match. */
437
438 if (nl_partial_match >= 0)
439 {
440 if (nl_check_length > 0 && len >= nl_check_length &&
441 Ustrncmp(start, nl_check + nl_partial_match,
442 nl_check_length - nl_partial_match) == 0)
443 {
444 Ustrncpy(chunk_ptr, nl_escape, nl_escape_length);
445 chunk_ptr += nl_escape_length;
446 start += nl_check_length - nl_partial_match;
447 }
448
449 /* The partial match was a false one. Insert the characters carried over
450 from the previous chunk. */
451
452 else if (nl_partial_match > 0)
453 {
454 Ustrncpy(chunk_ptr, nl_check, nl_partial_match);
455 chunk_ptr += nl_partial_match;
456 }
457
458 nl_partial_match = -1;
459 }
460
461 /* Now process the characters in the chunk. Whenever we hit a newline we check
462 for possible escaping. The code for the non-NL route should be as fast as
463 possible. */
464
465 for (ptr = start; ptr < end; ptr++)
466 {
467 int ch, len;
468
469 /* Flush the buffer if it has reached the threshold - we want to leave enough
470 room for the next uschar, plus a possible extra CR for an LF, plus the escape
471 string. */
472
473 if ((len = chunk_ptr - deliver_out_buffer) > mlen)
474 {
475 DEBUG(D_transport) debug_printf("flushing headers buffer\n");
476
477 /* If CHUNKING, prefix with BDAT (size) NON-LAST. Also, reap responses
478 from previous SMTP commands. */
479
480 if (tctx->options & topt_use_bdat && tctx->chunk_cb)
481 {
482 if ( tctx->chunk_cb(tctx, (unsigned)len, 0) != OK
483 || !transport_write_block(tctx, deliver_out_buffer, len, FALSE)
484 || tctx->chunk_cb(tctx, 0, tc_reap_prev) != OK
485 )
486 return FALSE;
487 }
488 else
489 if (!transport_write_block(tctx, deliver_out_buffer, len, FALSE))
490 return FALSE;
491 chunk_ptr = deliver_out_buffer;
492 }
493
494 /* Remove CR before NL if required */
495
496 if ( *ptr == '\r' && ptr[1] == '\n'
497 && !(tctx->options & topt_use_crlf)
498 && f.spool_file_wireformat
499 )
500 ptr++;
501
502 if ((ch = *ptr) == '\n')
503 {
504 int left = end - ptr - 1; /* count of chars left after NL */
505
506 /* Insert CR before NL if required */
507
508 if (tctx->options & topt_use_crlf && !f.spool_file_wireformat)
509 *chunk_ptr++ = '\r';
510 *chunk_ptr++ = '\n';
511 transport_newlines++;
512
513 /* The check_string test (formerly "from hack") replaces the specific
514 string at the start of a line with an escape string (e.g. "From " becomes
515 ">From " or "." becomes "..". It is a case-sensitive test. The length
516 check above ensures there is always enough room to insert this string. */
517
518 if (nl_check_length > 0)
519 {
520 if (left >= nl_check_length &&
521 Ustrncmp(ptr+1, nl_check, nl_check_length) == 0)
522 {
523 Ustrncpy(chunk_ptr, nl_escape, nl_escape_length);
524 chunk_ptr += nl_escape_length;
525 ptr += nl_check_length;
526 }
527
528 /* Handle the case when there isn't enough left to match the whole
529 check string, but there may be a partial match. We remember how many
530 characters matched, and finish processing this chunk. */
531
532 else if (left <= 0) nl_partial_match = 0;
533
534 else if (Ustrncmp(ptr+1, nl_check, left) == 0)
535 {
536 nl_partial_match = left;
537 ptr = end;
538 }
539 }
540 }
541
542 /* Not a NL character */
543
544 else *chunk_ptr++ = ch;
545 }
546
547 return TRUE;
548 }
549
550
551
552
553 /*************************************************
554 * Generate address for RCPT TO *
555 *************************************************/
556
557 /* This function puts together an address for RCPT to, using the caseful
558 version of the local part and the caseful version of the domain. If there is no
559 prefix or suffix, or if affixes are to be retained, we can just use the
560 original address. Otherwise, if there is a prefix but no suffix we can use a
561 pointer into the original address. If there is a suffix, however, we have to
562 build a new string.
563
564 Arguments:
565 addr the address item
566 include_affixes TRUE if affixes are to be included
567
568 Returns: a string
569 */
570
571 uschar *
572 transport_rcpt_address(address_item *addr, BOOL include_affixes)
573 {
574 uschar *at;
575 int plen, slen;
576
577 if (include_affixes)
578 {
579 setflag(addr, af_include_affixes); /* Affects logged => line */
580 return addr->address;
581 }
582
583 if (addr->suffix == NULL)
584 {
585 if (addr->prefix == NULL) return addr->address;
586 return addr->address + Ustrlen(addr->prefix);
587 }
588
589 at = Ustrrchr(addr->address, '@');
590 plen = (addr->prefix == NULL)? 0 : Ustrlen(addr->prefix);
591 slen = Ustrlen(addr->suffix);
592
593 return string_sprintf("%.*s@%s", (int)(at - addr->address - plen - slen),
594 addr->address + plen, at + 1);
595 }
596
597
598 /*************************************************
599 * Output Envelope-To: address & scan duplicates *
600 *************************************************/
601
602 /* This function is called from internal_transport_write_message() below, when
603 generating an Envelope-To: header line. It checks for duplicates of the given
604 address and its ancestors. When one is found, this function calls itself
605 recursively, to output the envelope address of the duplicate.
606
607 We want to avoid duplication in the list, which can arise for example when
608 A->B,C and then both B and C alias to D. This can also happen when there are
609 unseen drivers in use. So a list of addresses that have been output is kept in
610 the plist variable.
611
612 It is also possible to have loops in the address ancestry/duplication graph,
613 for example if there are two top level addresses A and B and we have A->B,C and
614 B->A. To break the loop, we use a list of processed addresses in the dlist
615 variable.
616
617 After handling duplication, this function outputs the progenitor of the given
618 address.
619
620 Arguments:
621 p the address we are interested in
622 pplist address of anchor of the list of addresses not to output
623 pdlist address of anchor of the list of processed addresses
624 first TRUE if this is the first address; set it FALSE afterwards
625 tctx transport context - processing to be done during output
626 and the file descriptor to write to
627
628 Returns: FALSE if writing failed
629 */
630
631 static BOOL
632 write_env_to(address_item *p, struct aci **pplist, struct aci **pdlist,
633 BOOL *first, transport_ctx * tctx)
634 {
635 address_item *pp;
636 struct aci *ppp;
637
638 /* Do nothing if we have already handled this address. If not, remember it
639 so that we don't handle it again. */
640
641 for (ppp = *pdlist; ppp; ppp = ppp->next) if (p == ppp->ptr) return TRUE;
642
643 ppp = store_get(sizeof(struct aci));
644 ppp->next = *pdlist;
645 *pdlist = ppp;
646 ppp->ptr = p;
647
648 /* Now scan up the ancestry, checking for duplicates at each generation. */
649
650 for (pp = p;; pp = pp->parent)
651 {
652 address_item *dup;
653 for (dup = addr_duplicate; dup; dup = dup->next)
654 if (dup->dupof == pp) /* a dup of our address */
655 if (!write_env_to(dup, pplist, pdlist, first, tctx))
656 return FALSE;
657 if (!pp->parent) break;
658 }
659
660 /* Check to see if we have already output the progenitor. */
661
662 for (ppp = *pplist; ppp; ppp = ppp->next) if (pp == ppp->ptr) break;
663 if (ppp) return TRUE;
664
665 /* Remember what we have output, and output it. */
666
667 ppp = store_get(sizeof(struct aci));
668 ppp->next = *pplist;
669 *pplist = ppp;
670 ppp->ptr = pp;
671
672 if (!*first && !write_chunk(tctx, US",\n ", 3)) return FALSE;
673 *first = FALSE;
674 return write_chunk(tctx, pp->address, Ustrlen(pp->address));
675 }
676
677
678
679
680 /* Add/remove/rewrite headers, and send them plus the empty-line separator.
681
682 Globals:
683 header_list
684
685 Arguments:
686 addr (chain of) addresses (for extra headers), or NULL;
687 only the first address is used
688 tctx transport context
689 sendfn function for output (transport or verify)
690
691 Returns: TRUE on success; FALSE on failure.
692 */
693 BOOL
694 transport_headers_send(transport_ctx * tctx,
695 BOOL (*sendfn)(transport_ctx * tctx, uschar * s, int len))
696 {
697 header_line *h;
698 const uschar *list;
699 transport_instance * tblock = tctx ? tctx->tblock : NULL;
700 address_item * addr = tctx ? tctx->addr : NULL;
701
702 /* Then the message's headers. Don't write any that are flagged as "old";
703 that means they were rewritten, or are a record of envelope rewriting, or
704 were removed (e.g. Bcc). If remove_headers is not null, skip any headers that
705 match any entries therein. It is a colon-sep list; expand the items
706 separately and squash any empty ones.
707 Then check addr->prop.remove_headers too, provided that addr is not NULL. */
708
709 for (h = header_list; h; h = h->next) if (h->type != htype_old)
710 {
711 int i;
712 BOOL include_header = TRUE;
713
714 list = tblock ? tblock->remove_headers : NULL;
715 for (i = 0; i < 2; i++) /* For remove_headers && addr->prop.remove_headers */
716 {
717 if (list)
718 {
719 int sep = ':'; /* This is specified as a colon-separated list */
720 uschar *s, *ss;
721 while ((s = string_nextinlist(&list, &sep, NULL, 0)))
722 {
723 int len;
724
725 if (i == 0)
726 if (!(s = expand_string(s)) && !f.expand_string_forcedfail)
727 {
728 errno = ERRNO_CHHEADER_FAIL;
729 return FALSE;
730 }
731 len = s ? Ustrlen(s) : 0;
732 if (strncmpic(h->text, s, len) != 0) continue;
733 ss = h->text + len;
734 while (*ss == ' ' || *ss == '\t') ss++;
735 if (*ss == ':') break;
736 }
737 if (s) { include_header = FALSE; break; }
738 }
739 if (addr) list = addr->prop.remove_headers;
740 }
741
742 /* If this header is to be output, try to rewrite it if there are rewriting
743 rules. */
744
745 if (include_header)
746 {
747 if (tblock && tblock->rewrite_rules)
748 {
749 void *reset_point = store_get(0);
750 header_line *hh;
751
752 if ((hh = rewrite_header(h, NULL, NULL, tblock->rewrite_rules,
753 tblock->rewrite_existflags, FALSE)))
754 {
755 if (!sendfn(tctx, hh->text, hh->slen)) return FALSE;
756 store_reset(reset_point);
757 continue; /* With the next header line */
758 }
759 }
760
761 /* Either no rewriting rules, or it didn't get rewritten */
762
763 if (!sendfn(tctx, h->text, h->slen)) return FALSE;
764 }
765
766 /* Header removed */
767
768 else
769 DEBUG(D_transport) debug_printf("removed header line:\n%s---\n", h->text);
770 }
771
772 /* Add on any address-specific headers. If there are multiple addresses,
773 they will all have the same headers in order to be batched. The headers
774 are chained in reverse order of adding (so several addresses from the
775 same alias might share some of them) but we want to output them in the
776 opposite order. This is a bit tedious, but there shouldn't be very many
777 of them. We just walk the list twice, reversing the pointers each time,
778 but on the second time, write out the items.
779
780 Headers added to an address by a router are guaranteed to end with a newline.
781 */
782
783 if (addr)
784 {
785 int i;
786 header_line *hprev = addr->prop.extra_headers;
787 header_line *hnext;
788 for (i = 0; i < 2; i++)
789 for (h = hprev, hprev = NULL; h; h = hnext)
790 {
791 hnext = h->next;
792 h->next = hprev;
793 hprev = h;
794 if (i == 1)
795 {
796 if (!sendfn(tctx, h->text, h->slen)) return FALSE;
797 DEBUG(D_transport)
798 debug_printf("added header line(s):\n%s---\n", h->text);
799 }
800 }
801 }
802
803 /* If a string containing additional headers exists it is a newline-sep
804 list. Expand each item and write out the result. This is done last so that
805 if it (deliberately or accidentally) isn't in header format, it won't mess
806 up any other headers. An empty string or a forced expansion failure are
807 noops. An added header string from a transport may not end with a newline;
808 add one if it does not. */
809
810 if (tblock && (list = CUS tblock->add_headers))
811 {
812 int sep = '\n';
813 uschar * s;
814
815 while ((s = string_nextinlist(&list, &sep, NULL, 0)))
816 if ((s = expand_string(s)))
817 {
818 int len = Ustrlen(s);
819 if (len > 0)
820 {
821 if (!sendfn(tctx, s, len)) return FALSE;
822 if (s[len-1] != '\n' && !sendfn(tctx, US"\n", 1))
823 return FALSE;
824 DEBUG(D_transport)
825 {
826 debug_printf("added header line:\n%s", s);
827 if (s[len-1] != '\n') debug_printf("\n");
828 debug_printf("---\n");
829 }
830 }
831 }
832 else if (!f.expand_string_forcedfail)
833 { errno = ERRNO_CHHEADER_FAIL; return FALSE; }
834 }
835
836 /* Separate headers from body with a blank line */
837
838 return sendfn(tctx, US"\n", 1);
839 }
840
841
842 /*************************************************
843 * Write the message *
844 *************************************************/
845
846 /* This function writes the message to the given file descriptor. The headers
847 are in the in-store data structure, and the rest of the message is in the open
848 file descriptor deliver_datafile. Make sure we start it at the beginning.
849
850 . If add_return_path is TRUE, a "return-path:" header is added to the message,
851 containing the envelope sender's address.
852
853 . If add_envelope_to is TRUE, a "envelope-to:" header is added to the message,
854 giving the top-level envelope address that caused this delivery to happen.
855
856 . If add_delivery_date is TRUE, a "delivery-date:" header is added to the
857 message. It gives the time and date that delivery took place.
858
859 . If check_string is not null, the start of each line is checked for that
860 string. If it is found, it is replaced by escape_string. This used to be
861 the "from hack" for files, and "smtp_dots" for escaping SMTP dots.
862
863 . If use_crlf is true, newlines are turned into CRLF (SMTP output).
864
865 The yield is TRUE if all went well, and FALSE if not. Exit *immediately* after
866 any writing or reading error, leaving the code in errno intact. Error exits
867 can include timeouts for certain transports, which are requested by setting
868 transport_write_timeout non-zero.
869
870 Arguments:
871 tctx
872 (fd, msg) Either and fd, to write the message to,
873 or a string: if null write message to allocated space
874 otherwire take content as headers.
875 addr (chain of) addresses (for extra headers), or NULL;
876 only the first address is used
877 tblock optional transport instance block (NULL signifies NULL/0):
878 add_headers a string containing one or more headers to add; it is
879 expanded, and must be in correct RFC 822 format as
880 it is transmitted verbatim; NULL => no additions,
881 and so does empty string or forced expansion fail
882 remove_headers a colon-separated list of headers to remove, or NULL
883 rewrite_rules chain of header rewriting rules
884 rewrite_existflags flags for the rewriting rules
885 options bit-wise options:
886 add_return_path if TRUE, add a "return-path" header
887 add_envelope_to if TRUE, add a "envelope-to" header
888 add_delivery_date if TRUE, add a "delivery-date" header
889 use_crlf if TRUE, turn NL into CR LF
890 end_dot if TRUE, send a terminating "." line at the end
891 no_headers if TRUE, omit the headers
892 no_body if TRUE, omit the body
893 check_string a string to check for at the start of lines, or NULL
894 escape_string a string to insert in front of any check string
895 size_limit if > 0, this is a limit to the size of message written;
896 it is used when returning messages to their senders,
897 and is approximate rather than exact, owing to chunk
898 buffering
899
900 Returns: TRUE on success; FALSE (with errno) on failure.
901 In addition, the global variable transport_count
902 is incremented by the number of bytes written.
903 */
904
905 static BOOL
906 internal_transport_write_message(transport_ctx * tctx, int size_limit)
907 {
908 int len, size = 0;
909
910 /* Initialize pointer in output buffer. */
911
912 transport_write_reset(tctx->options);
913
914 /* Set up the data for start-of-line data checking and escaping */
915
916 if (tctx->check_string && tctx->escape_string)
917 {
918 nl_check = tctx->check_string;
919 nl_check_length = Ustrlen(nl_check);
920 nl_escape = tctx->escape_string;
921 nl_escape_length = Ustrlen(nl_escape);
922 }
923
924 /* Whether the escaping mechanism is applied to headers or not is controlled by
925 an option (set for SMTP, not otherwise). Negate the length if not wanted till
926 after the headers. */
927
928 if (!(tctx->options & topt_escape_headers))
929 nl_check_length = -nl_check_length;
930
931 /* Write the headers if required, including any that have to be added. If there
932 are header rewriting rules, apply them. The datasource is not the -D spoolfile
933 so temporarily hide the global that adjusts for its format. */
934
935 if (!(tctx->options & topt_no_headers))
936 {
937 BOOL save_wireformat = f.spool_file_wireformat;
938 f.spool_file_wireformat = FALSE;
939
940 /* Add return-path: if requested. */
941
942 if (tctx->options & topt_add_return_path)
943 {
944 uschar buffer[ADDRESS_MAXLENGTH + 20];
945 int n = sprintf(CS buffer, "Return-path: <%.*s>\n", ADDRESS_MAXLENGTH,
946 return_path);
947 if (!write_chunk(tctx, buffer, n)) goto bad;
948 }
949
950 /* Add envelope-to: if requested */
951
952 if (tctx->options & topt_add_envelope_to)
953 {
954 BOOL first = TRUE;
955 address_item *p;
956 struct aci *plist = NULL;
957 struct aci *dlist = NULL;
958 void *reset_point = store_get(0);
959
960 if (!write_chunk(tctx, US"Envelope-to: ", 13)) goto bad;
961
962 /* Pick up from all the addresses. The plist and dlist variables are
963 anchors for lists of addresses already handled; they have to be defined at
964 this level because write_env_to() calls itself recursively. */
965
966 for (p = tctx->addr; p; p = p->next)
967 if (!write_env_to(p, &plist, &dlist, &first, tctx)) goto bad;
968
969 /* Add a final newline and reset the store used for tracking duplicates */
970
971 if (!write_chunk(tctx, US"\n", 1)) goto bad;
972 store_reset(reset_point);
973 }
974
975 /* Add delivery-date: if requested. */
976
977 if (tctx->options & topt_add_delivery_date)
978 {
979 uschar * s = tod_stamp(tod_full);
980
981 if ( !write_chunk(tctx, US"Delivery-date: ", 15)
982 || !write_chunk(tctx, s, Ustrlen(s))
983 || !write_chunk(tctx, US"\n", 1)) goto bad;
984 }
985
986 /* Then the message's headers. Don't write any that are flagged as "old";
987 that means they were rewritten, or are a record of envelope rewriting, or
988 were removed (e.g. Bcc). If remove_headers is not null, skip any headers that
989 match any entries therein. Then check addr->prop.remove_headers too, provided that
990 addr is not NULL. */
991
992 if (!transport_headers_send(tctx, &write_chunk))
993 {
994 bad:
995 f.spool_file_wireformat = save_wireformat;
996 return FALSE;
997 }
998
999 f.spool_file_wireformat = save_wireformat;
1000 }
1001
1002 /* When doing RFC3030 CHUNKING output, work out how much data would be in a
1003 last-BDAT, consisting of the current write_chunk() output buffer fill
1004 (optimally, all of the headers - but it does not matter if we already had to
1005 flush that buffer with non-last BDAT prependix) plus the amount of body data
1006 (as expanded for CRLF lines). Then create and write BDAT(s), and ensure
1007 that further use of write_chunk() will not prepend BDATs.
1008 The first BDAT written will also first flush any outstanding MAIL and RCPT
1009 commands which were buffered thans to PIPELINING.
1010 Commands go out (using a send()) from a different buffer to data (using a
1011 write()). They might not end up in the same TCP segment, which is
1012 suboptimal. */
1013
1014 if (tctx->options & topt_use_bdat)
1015 {
1016 off_t fsize;
1017 int hsize;
1018
1019 if ((hsize = chunk_ptr - deliver_out_buffer) < 0)
1020 hsize = 0;
1021 if (!(tctx->options & topt_no_body))
1022 {
1023 if ((fsize = lseek(deliver_datafile, 0, SEEK_END)) < 0) return FALSE;
1024 fsize -= SPOOL_DATA_START_OFFSET;
1025 if (size_limit > 0 && fsize > size_limit)
1026 fsize = size_limit;
1027 size = hsize + fsize;
1028 if (tctx->options & topt_use_crlf && !f.spool_file_wireformat)
1029 size += body_linecount; /* account for CRLF-expansion */
1030
1031 /* With topt_use_bdat we never do dot-stuffing; no need to
1032 account for any expansion due to that. */
1033 }
1034
1035 /* If the message is large, emit first a non-LAST chunk with just the
1036 headers, and reap the command responses. This lets us error out early
1037 on RCPT rejects rather than sending megabytes of data. Include headers
1038 on the assumption they are cheap enough and some clever implementations
1039 might errorcheck them too, on-the-fly, and reject that chunk. */
1040
1041 if (size > DELIVER_OUT_BUFFER_SIZE && hsize > 0)
1042 {
1043 DEBUG(D_transport)
1044 debug_printf("sending small initial BDAT; hsize=%d\n", hsize);
1045 if ( tctx->chunk_cb(tctx, hsize, 0) != OK
1046 || !transport_write_block(tctx, deliver_out_buffer, hsize, FALSE)
1047 || tctx->chunk_cb(tctx, 0, tc_reap_prev) != OK
1048 )
1049 return FALSE;
1050 chunk_ptr = deliver_out_buffer;
1051 size -= hsize;
1052 }
1053
1054 /* Emit a LAST datachunk command, and unmark the context for further
1055 BDAT commands. */
1056
1057 if (tctx->chunk_cb(tctx, size, tc_chunk_last) != OK)
1058 return FALSE;
1059 tctx->options &= ~topt_use_bdat;
1060 }
1061
1062 /* If the body is required, ensure that the data for check strings (formerly
1063 the "from hack") is enabled by negating the length if necessary. (It will be
1064 negative in cases where it isn't to apply to the headers). Then ensure the body
1065 is positioned at the start of its file (following the message id), then write
1066 it, applying the size limit if required. */
1067
1068 /* If we have a wireformat -D file (CRNL lines, non-dotstuffed, no ending dot)
1069 and we want to send a body without dotstuffing or ending-dot, in-clear,
1070 then we can just dump it using sendfile.
1071 This should get used for CHUNKING output and also for writing the -K file for
1072 dkim signing, when we had CHUNKING input. */
1073
1074 #ifdef OS_SENDFILE
1075 if ( f.spool_file_wireformat
1076 && !(tctx->options & (topt_no_body | topt_end_dot))
1077 && !nl_check_length
1078 && tls_out.active.sock != tctx->u.fd
1079 )
1080 {
1081 ssize_t copied = 0;
1082 off_t offset = SPOOL_DATA_START_OFFSET;
1083
1084 /* Write out any header data in the buffer */
1085
1086 if ((len = chunk_ptr - deliver_out_buffer) > 0)
1087 {
1088 if (!transport_write_block(tctx, deliver_out_buffer, len, TRUE))
1089 return FALSE;
1090 size -= len;
1091 }
1092
1093 DEBUG(D_transport) debug_printf("using sendfile for body\n");
1094
1095 while(size > 0)
1096 {
1097 if ((copied = os_sendfile(tctx->u.fd, deliver_datafile, &offset, size)) <= 0) break;
1098 size -= copied;
1099 }
1100 return copied >= 0;
1101 }
1102 #else
1103 DEBUG(D_transport) debug_printf("cannot use sendfile for body: no support\n");
1104 #endif
1105
1106 DEBUG(D_transport)
1107 if (!(tctx->options & topt_no_body))
1108 debug_printf("cannot use sendfile for body: %s\n",
1109 !f.spool_file_wireformat ? "spoolfile not wireformat"
1110 : tctx->options & topt_end_dot ? "terminating dot wanted"
1111 : nl_check_length ? "dot- or From-stuffing wanted"
1112 : "TLS output wanted");
1113
1114 if (!(tctx->options & topt_no_body))
1115 {
1116 int size = size_limit;
1117
1118 nl_check_length = abs(nl_check_length);
1119 nl_partial_match = 0;
1120 if (lseek(deliver_datafile, SPOOL_DATA_START_OFFSET, SEEK_SET) < 0)
1121 return FALSE;
1122 while ( (len = MAX(DELIVER_IN_BUFFER_SIZE, size)) > 0
1123 && (len = read(deliver_datafile, deliver_in_buffer, len)) > 0)
1124 {
1125 if (!write_chunk(tctx, deliver_in_buffer, len))
1126 return FALSE;
1127 size -= len;
1128 }
1129
1130 /* A read error on the body will have left len == -1 and errno set. */
1131
1132 if (len != 0) return FALSE;
1133 }
1134
1135 /* Finished with the check string, and spool-format consideration */
1136
1137 nl_check_length = nl_escape_length = 0;
1138 f.spool_file_wireformat = FALSE;
1139
1140 /* If requested, add a terminating "." line (SMTP output). */
1141
1142 if (tctx->options & topt_end_dot && !write_chunk(tctx, US".\n", 2))
1143 return FALSE;
1144
1145 /* Write out any remaining data in the buffer before returning. */
1146
1147 return (len = chunk_ptr - deliver_out_buffer) <= 0 ||
1148 transport_write_block(tctx, deliver_out_buffer, len, FALSE);
1149 }
1150
1151
1152
1153
1154 /*************************************************
1155 * External interface to write the message *
1156 *************************************************/
1157
1158 /* If there is no filtering required, call the internal function above to do
1159 the real work, passing over all the arguments from this function. Otherwise,
1160 set up a filtering process, fork another process to call the internal function
1161 to write to the filter, and in this process just suck from the filter and write
1162 down the fd in the transport context. At the end, tidy up the pipes and the
1163 processes.
1164
1165 Arguments: as for internal_transport_write_message() above
1166
1167 Returns: TRUE on success; FALSE (with errno) for any failure
1168 transport_count is incremented by the number of bytes written
1169 */
1170
1171 BOOL
1172 transport_write_message(transport_ctx * tctx, int size_limit)
1173 {
1174 BOOL last_filter_was_NL = TRUE;
1175 BOOL save_spool_file_wireformat = f.spool_file_wireformat;
1176 int rc, len, yield, fd_read, fd_write, save_errno;
1177 int pfd[2] = {-1, -1};
1178 pid_t filter_pid, write_pid;
1179
1180 f.transport_filter_timed_out = FALSE;
1181
1182 /* If there is no filter command set up, call the internal function that does
1183 the actual work, passing it the incoming fd, and return its result. */
1184
1185 if ( !transport_filter_argv
1186 || !*transport_filter_argv
1187 || !**transport_filter_argv
1188 )
1189 return internal_transport_write_message(tctx, size_limit);
1190
1191 /* Otherwise the message must be written to a filter process and read back
1192 before being written to the incoming fd. First set up the special processing to
1193 be done during the copying. */
1194
1195 nl_partial_match = -1;
1196
1197 if (tctx->check_string && tctx->escape_string)
1198 {
1199 nl_check = tctx->check_string;
1200 nl_check_length = Ustrlen(nl_check);
1201 nl_escape = tctx->escape_string;
1202 nl_escape_length = Ustrlen(nl_escape);
1203 }
1204 else nl_check_length = nl_escape_length = 0;
1205
1206 /* Start up a subprocess to run the command. Ensure that our main fd will
1207 be closed when the subprocess execs, but remove the flag afterwards.
1208 (Otherwise, if this is a TCP/IP socket, it can't get passed on to another
1209 process to deliver another message.) We get back stdin/stdout file descriptors.
1210 If the process creation failed, give an error return. */
1211
1212 fd_read = -1;
1213 fd_write = -1;
1214 save_errno = 0;
1215 yield = FALSE;
1216 write_pid = (pid_t)(-1);
1217
1218 {
1219 int bits = fcntl(tctx->u.fd, F_GETFD);
1220 (void)fcntl(tctx->u.fd, F_SETFD, bits | FD_CLOEXEC);
1221 filter_pid = child_open(USS transport_filter_argv, NULL, 077,
1222 &fd_write, &fd_read, FALSE);
1223 (void)fcntl(tctx->u.fd, F_SETFD, bits & ~FD_CLOEXEC);
1224 }
1225 if (filter_pid < 0) goto TIDY_UP; /* errno set */
1226
1227 DEBUG(D_transport)
1228 debug_printf("process %d running as transport filter: fd_write=%d fd_read=%d\n",
1229 (int)filter_pid, fd_write, fd_read);
1230
1231 /* Fork subprocess to write the message to the filter, and return the result
1232 via a(nother) pipe. While writing to the filter, we do not do the CRLF,
1233 smtp dots, or check string processing. */
1234
1235 if (pipe(pfd) != 0) goto TIDY_UP; /* errno set */
1236 if ((write_pid = fork()) == 0)
1237 {
1238 BOOL rc;
1239 (void)close(fd_read);
1240 (void)close(pfd[pipe_read]);
1241 nl_check_length = nl_escape_length = 0;
1242
1243 tctx->u.fd = fd_write;
1244 tctx->check_string = tctx->escape_string = NULL;
1245 tctx->options &= ~(topt_use_crlf | topt_end_dot | topt_use_bdat);
1246
1247 rc = internal_transport_write_message(tctx, size_limit);
1248
1249 save_errno = errno;
1250 if ( write(pfd[pipe_write], (void *)&rc, sizeof(BOOL))
1251 != sizeof(BOOL)
1252 || write(pfd[pipe_write], (void *)&save_errno, sizeof(int))
1253 != sizeof(int)
1254 || write(pfd[pipe_write], (void *)&tctx->addr->more_errno, sizeof(int))
1255 != sizeof(int)
1256 || write(pfd[pipe_write], (void *)&tctx->addr->delivery_usec, sizeof(int))
1257 != sizeof(int)
1258 )
1259 rc = FALSE; /* compiler quietening */
1260 _exit(0);
1261 }
1262 save_errno = errno;
1263
1264 /* Parent process: close our copy of the writing subprocess' pipes. */
1265
1266 (void)close(pfd[pipe_write]);
1267 (void)close(fd_write);
1268 fd_write = -1;
1269
1270 /* Writing process creation failed */
1271
1272 if (write_pid < 0)
1273 {
1274 errno = save_errno; /* restore */
1275 goto TIDY_UP;
1276 }
1277
1278 /* When testing, let the subprocess get going */
1279
1280 if (f.running_in_test_harness) millisleep(250);
1281
1282 DEBUG(D_transport)
1283 debug_printf("process %d writing to transport filter\n", (int)write_pid);
1284
1285 /* Copy the message from the filter to the output fd. A read error leaves len
1286 == -1 and errno set. We need to apply a timeout to the read, to cope with
1287 the case when the filter gets stuck, but it can be quite a long one. The
1288 default is 5m, but this is now configurable. */
1289
1290 DEBUG(D_transport) debug_printf("copying from the filter\n");
1291
1292 /* Copy the output of the filter, remembering if the last character was NL. If
1293 no data is returned, that counts as "ended with NL" (default setting of the
1294 variable is TRUE). The output should always be unix-format as we converted
1295 any wireformat source on writing input to the filter. */
1296
1297 f.spool_file_wireformat = FALSE;
1298 chunk_ptr = deliver_out_buffer;
1299
1300 for (;;)
1301 {
1302 sigalrm_seen = FALSE;
1303 ALARM(transport_filter_timeout);
1304 len = read(fd_read, deliver_in_buffer, DELIVER_IN_BUFFER_SIZE);
1305 ALARM_CLR(0);
1306 if (sigalrm_seen)
1307 {
1308 errno = ETIMEDOUT;
1309 f.transport_filter_timed_out = TRUE;
1310 goto TIDY_UP;
1311 }
1312
1313 /* If the read was successful, write the block down the original fd,
1314 remembering whether it ends in \n or not. */
1315
1316 if (len > 0)
1317 {
1318 if (!write_chunk(tctx, deliver_in_buffer, len)) goto TIDY_UP;
1319 last_filter_was_NL = (deliver_in_buffer[len-1] == '\n');
1320 }
1321
1322 /* Otherwise, break the loop. If we have hit EOF, set yield = TRUE. */
1323
1324 else
1325 {
1326 if (len == 0) yield = TRUE;
1327 break;
1328 }
1329 }
1330
1331 /* Tidying up code. If yield = FALSE there has been an error and errno is set
1332 to something. Ensure the pipes are all closed and the processes are removed. If
1333 there has been an error, kill the processes before waiting for them, just to be
1334 sure. Also apply a paranoia timeout. */
1335
1336 TIDY_UP:
1337 f.spool_file_wireformat = save_spool_file_wireformat;
1338 save_errno = errno;
1339
1340 (void)close(fd_read);
1341 if (fd_write > 0) (void)close(fd_write);
1342
1343 if (!yield)
1344 {
1345 if (filter_pid > 0) kill(filter_pid, SIGKILL);
1346 if (write_pid > 0) kill(write_pid, SIGKILL);
1347 }
1348
1349 /* Wait for the filter process to complete. */
1350
1351 DEBUG(D_transport) debug_printf("waiting for filter process\n");
1352 if (filter_pid > 0 && (rc = child_close(filter_pid, 30)) != 0 && yield)
1353 {
1354 yield = FALSE;
1355 save_errno = ERRNO_FILTER_FAIL;
1356 tctx->addr->more_errno = rc;
1357 DEBUG(D_transport) debug_printf("filter process returned %d\n", rc);
1358 }
1359
1360 /* Wait for the writing process to complete. If it ends successfully,
1361 read the results from its pipe, provided we haven't already had a filter
1362 process failure. */
1363
1364 DEBUG(D_transport) debug_printf("waiting for writing process\n");
1365 if (write_pid > 0)
1366 {
1367 rc = child_close(write_pid, 30);
1368 if (yield)
1369 if (rc == 0)
1370 {
1371 BOOL ok;
1372 if (read(pfd[pipe_read], (void *)&ok, sizeof(BOOL)) != sizeof(BOOL))
1373 {
1374 DEBUG(D_transport)
1375 debug_printf("pipe read from writing process: %s\n", strerror(errno));
1376 save_errno = ERRNO_FILTER_FAIL;
1377 yield = FALSE;
1378 }
1379 else if (!ok)
1380 {
1381 int dummy = read(pfd[pipe_read], (void *)&save_errno, sizeof(int));
1382 dummy = read(pfd[pipe_read], (void *)&tctx->addr->more_errno, sizeof(int));
1383 dummy = read(pfd[pipe_read], (void *)&tctx->addr->delivery_usec, sizeof(int));
1384 dummy = dummy; /* compiler quietening */
1385 yield = FALSE;
1386 }
1387 }
1388 else
1389 {
1390 yield = FALSE;
1391 save_errno = ERRNO_FILTER_FAIL;
1392 tctx->addr->more_errno = rc;
1393 DEBUG(D_transport) debug_printf("writing process returned %d\n", rc);
1394 }
1395 }
1396 (void)close(pfd[pipe_read]);
1397
1398 /* If there have been no problems we can now add the terminating "." if this is
1399 SMTP output, turning off escaping beforehand. If the last character from the
1400 filter was not NL, insert a NL to make the SMTP protocol work. */
1401
1402 if (yield)
1403 {
1404 nl_check_length = nl_escape_length = 0;
1405 f.spool_file_wireformat = FALSE;
1406 if ( tctx->options & topt_end_dot
1407 && ( last_filter_was_NL
1408 ? !write_chunk(tctx, US".\n", 2)
1409 : !write_chunk(tctx, US"\n.\n", 3)
1410 ) )
1411 yield = FALSE;
1412
1413 /* Write out any remaining data in the buffer. */
1414
1415 else
1416 yield = (len = chunk_ptr - deliver_out_buffer) <= 0
1417 || transport_write_block(tctx, deliver_out_buffer, len, FALSE);
1418 }
1419 else
1420 errno = save_errno; /* From some earlier error */
1421
1422 DEBUG(D_transport)
1423 {
1424 debug_printf("end of filtering transport writing: yield=%d\n", yield);
1425 if (!yield)
1426 debug_printf("errno=%d more_errno=%d\n", errno, tctx->addr->more_errno);
1427 }
1428
1429 return yield;
1430 }
1431
1432
1433
1434
1435
1436 /*************************************************
1437 * Update waiting database *
1438 *************************************************/
1439
1440 /* This is called when an address is deferred by remote transports that are
1441 capable of sending more than one message over one connection. A database is
1442 maintained for each transport, keeping track of which messages are waiting for
1443 which hosts. The transport can then consult this when eventually a successful
1444 delivery happens, and if it finds that another message is waiting for the same
1445 host, it can fire up a new process to deal with it using the same connection.
1446
1447 The database records are keyed by host name. They can get full if there are
1448 lots of messages waiting, and so there is a continuation mechanism for them.
1449
1450 Each record contains a list of message ids, packed end to end without any
1451 zeros. Each one is MESSAGE_ID_LENGTH bytes long. The count field says how many
1452 in this record, and the sequence field says if there are any other records for
1453 this host. If the sequence field is 0, there are none. If it is 1, then another
1454 record with the name <hostname>:0 exists; if it is 2, then two other records
1455 with sequence numbers 0 and 1 exist, and so on.
1456
1457 Currently, an exhaustive search of all continuation records has to be done to
1458 determine whether to add a message id to a given record. This shouldn't be
1459 too bad except in extreme cases. I can't figure out a *simple* way of doing
1460 better.
1461
1462 Old records should eventually get swept up by the exim_tidydb utility.
1463
1464 Arguments:
1465 hostlist list of hosts that this message could be sent to
1466 tpname name of the transport
1467
1468 Returns: nothing
1469 */
1470
1471 void
1472 transport_update_waiting(host_item *hostlist, uschar *tpname)
1473 {
1474 const uschar *prevname = US"";
1475 host_item *host;
1476 open_db dbblock;
1477 open_db *dbm_file;
1478
1479 DEBUG(D_transport) debug_printf("updating wait-%s database\n", tpname);
1480
1481 /* Open the database for this transport */
1482
1483 if (!(dbm_file = dbfn_open(string_sprintf("wait-%.200s", tpname),
1484 O_RDWR, &dbblock, TRUE)))
1485 return;
1486
1487 /* Scan the list of hosts for which this message is waiting, and ensure
1488 that the message id is in each host record. */
1489
1490 for (host = hostlist; host; host = host->next)
1491 {
1492 BOOL already = FALSE;
1493 dbdata_wait *host_record;
1494 uschar *s;
1495 int i, host_length;
1496 uschar buffer[256];
1497
1498 /* Skip if this is the same host as we just processed; otherwise remember
1499 the name for next time. */
1500
1501 if (Ustrcmp(prevname, host->name) == 0) continue;
1502 prevname = host->name;
1503
1504 /* Look up the host record; if there isn't one, make an empty one. */
1505
1506 if (!(host_record = dbfn_read(dbm_file, host->name)))
1507 {
1508 host_record = store_get(sizeof(dbdata_wait) + MESSAGE_ID_LENGTH);
1509 host_record->count = host_record->sequence = 0;
1510 }
1511
1512 /* Compute the current length */
1513
1514 host_length = host_record->count * MESSAGE_ID_LENGTH;
1515
1516 /* Search the record to see if the current message is already in it. */
1517
1518 for (s = host_record->text; s < host_record->text + host_length;
1519 s += MESSAGE_ID_LENGTH)
1520 if (Ustrncmp(s, message_id, MESSAGE_ID_LENGTH) == 0)
1521 { already = TRUE; break; }
1522
1523 /* If we haven't found this message in the main record, search any
1524 continuation records that exist. */
1525
1526 for (i = host_record->sequence - 1; i >= 0 && !already; i--)
1527 {
1528 dbdata_wait *cont;
1529 sprintf(CS buffer, "%.200s:%d", host->name, i);
1530 if ((cont = dbfn_read(dbm_file, buffer)))
1531 {
1532 int clen = cont->count * MESSAGE_ID_LENGTH;
1533 for (s = cont->text; s < cont->text + clen; s += MESSAGE_ID_LENGTH)
1534 if (Ustrncmp(s, message_id, MESSAGE_ID_LENGTH) == 0)
1535 { already = TRUE; break; }
1536 }
1537 }
1538
1539 /* If this message is already in a record, no need to update. */
1540
1541 if (already)
1542 {
1543 DEBUG(D_transport) debug_printf("already listed for %s\n", host->name);
1544 continue;
1545 }
1546
1547
1548 /* If this record is full, write it out with a new name constructed
1549 from the sequence number, increase the sequence number, and empty
1550 the record. */
1551
1552 if (host_record->count >= WAIT_NAME_MAX)
1553 {
1554 sprintf(CS buffer, "%.200s:%d", host->name, host_record->sequence);
1555 dbfn_write(dbm_file, buffer, host_record, sizeof(dbdata_wait) + host_length);
1556 host_record->sequence++;
1557 host_record->count = 0;
1558 host_length = 0;
1559 }
1560
1561 /* If this record is not full, increase the size of the record to
1562 allow for one new message id. */
1563
1564 else
1565 {
1566 dbdata_wait *newr =
1567 store_get(sizeof(dbdata_wait) + host_length + MESSAGE_ID_LENGTH);
1568 memcpy(newr, host_record, sizeof(dbdata_wait) + host_length);
1569 host_record = newr;
1570 }
1571
1572 /* Now add the new name on the end */
1573
1574 memcpy(host_record->text + host_length, message_id, MESSAGE_ID_LENGTH);
1575 host_record->count++;
1576 host_length += MESSAGE_ID_LENGTH;
1577
1578 /* Update the database */
1579
1580 dbfn_write(dbm_file, host->name, host_record, sizeof(dbdata_wait) + host_length);
1581 DEBUG(D_transport) debug_printf("added to list for %s\n", host->name);
1582 }
1583
1584 /* All now done */
1585
1586 dbfn_close(dbm_file);
1587 }
1588
1589
1590
1591
1592 /*************************************************
1593 * Test for waiting messages *
1594 *************************************************/
1595
1596 /* This function is called by a remote transport which uses the previous
1597 function to remember which messages are waiting for which remote hosts. It's
1598 called after a successful delivery and its job is to check whether there is
1599 another message waiting for the same host. However, it doesn't do this if the
1600 current continue sequence is greater than the maximum supplied as an argument,
1601 or greater than the global connection_max_messages, which, if set, overrides.
1602
1603 Arguments:
1604 transport_name name of the transport
1605 hostname name of the host
1606 local_message_max maximum number of messages down one connection
1607 as set by the caller transport
1608 new_message_id set to the message id of a waiting message
1609 more set TRUE if there are yet more messages waiting
1610 oicf_func function to call to validate if it is ok to send
1611 to this message_id from the current instance.
1612 oicf_data opaque data for oicf_func
1613
1614 Returns: TRUE if new_message_id set; FALSE otherwise
1615 */
1616
1617 typedef struct msgq_s
1618 {
1619 uschar message_id [MESSAGE_ID_LENGTH + 1];
1620 BOOL bKeep;
1621 } msgq_t;
1622
1623 BOOL
1624 transport_check_waiting(const uschar *transport_name, const uschar *hostname,
1625 int local_message_max, uschar *new_message_id, BOOL *more, oicf oicf_func, void *oicf_data)
1626 {
1627 dbdata_wait *host_record;
1628 int host_length;
1629 open_db dbblock;
1630 open_db *dbm_file;
1631
1632 int i;
1633 struct stat statbuf;
1634
1635 *more = FALSE;
1636
1637 DEBUG(D_transport)
1638 {
1639 debug_printf("transport_check_waiting entered\n");
1640 debug_printf(" sequence=%d local_max=%d global_max=%d\n",
1641 continue_sequence, local_message_max, connection_max_messages);
1642 }
1643
1644 /* Do nothing if we have hit the maximum number that can be send down one
1645 connection. */
1646
1647 if (connection_max_messages >= 0) local_message_max = connection_max_messages;
1648 if (local_message_max > 0 && continue_sequence >= local_message_max)
1649 {
1650 DEBUG(D_transport)
1651 debug_printf("max messages for one connection reached: returning\n");
1652 return FALSE;
1653 }
1654
1655 /* Open the waiting information database. */
1656
1657 if (!(dbm_file = dbfn_open(string_sprintf("wait-%.200s", transport_name),
1658 O_RDWR, &dbblock, TRUE)))
1659 return FALSE;
1660
1661 /* See if there is a record for this host; if not, there's nothing to do. */
1662
1663 if (!(host_record = dbfn_read(dbm_file, hostname)))
1664 {
1665 dbfn_close(dbm_file);
1666 DEBUG(D_transport) debug_printf("no messages waiting for %s\n", hostname);
1667 return FALSE;
1668 }
1669
1670 /* If the data in the record looks corrupt, just log something and
1671 don't try to use it. */
1672
1673 if (host_record->count > WAIT_NAME_MAX)
1674 {
1675 dbfn_close(dbm_file);
1676 log_write(0, LOG_MAIN|LOG_PANIC, "smtp-wait database entry for %s has bad "
1677 "count=%d (max=%d)", hostname, host_record->count, WAIT_NAME_MAX);
1678 return FALSE;
1679 }
1680
1681 /* Scan the message ids in the record from the end towards the beginning,
1682 until one is found for which a spool file actually exists. If the record gets
1683 emptied, delete it and continue with any continuation records that may exist.
1684 */
1685
1686 /* For Bug 1141, I refactored this major portion of the routine, it is risky
1687 but the 1 off will remain without it. This code now allows me to SKIP over
1688 a message I do not want to send out on this run. */
1689
1690 host_length = host_record->count * MESSAGE_ID_LENGTH;
1691
1692 while (1)
1693 {
1694 msgq_t *msgq;
1695 int msgq_count = 0;
1696 int msgq_actual = 0;
1697 BOOL bFound = FALSE;
1698 BOOL bContinuation = FALSE;
1699
1700 /* create an array to read entire message queue into memory for processing */
1701
1702 msgq = store_malloc(sizeof(msgq_t) * host_record->count);
1703 msgq_count = host_record->count;
1704 msgq_actual = msgq_count;
1705
1706 for (i = 0; i < host_record->count; ++i)
1707 {
1708 msgq[i].bKeep = TRUE;
1709
1710 Ustrncpy(msgq[i].message_id, host_record->text + (i * MESSAGE_ID_LENGTH),
1711 MESSAGE_ID_LENGTH);
1712 msgq[i].message_id[MESSAGE_ID_LENGTH] = 0;
1713 }
1714
1715 /* first thing remove current message id if it exists */
1716
1717 for (i = 0; i < msgq_count; ++i)
1718 if (Ustrcmp(msgq[i].message_id, message_id) == 0)
1719 {
1720 msgq[i].bKeep = FALSE;
1721 break;
1722 }
1723
1724 /* now find the next acceptable message_id */
1725
1726 for (i = msgq_count - 1; i >= 0; --i) if (msgq[i].bKeep)
1727 {
1728 uschar subdir[2];
1729
1730 subdir[0] = split_spool_directory ? msgq[i].message_id[5] : 0;
1731 subdir[1] = 0;
1732
1733 if (Ustat(spool_fname(US"input", subdir, msgq[i].message_id, US"-D"),
1734 &statbuf) != 0)
1735 msgq[i].bKeep = FALSE;
1736 else if (!oicf_func || oicf_func(msgq[i].message_id, oicf_data))
1737 {
1738 Ustrcpy(new_message_id, msgq[i].message_id);
1739 msgq[i].bKeep = FALSE;
1740 bFound = TRUE;
1741 break;
1742 }
1743 }
1744
1745 /* re-count */
1746 for (msgq_actual = 0, i = 0; i < msgq_count; ++i)
1747 if (msgq[i].bKeep)
1748 msgq_actual++;
1749
1750 /* reassemble the host record, based on removed message ids, from in
1751 memory queue */
1752
1753 if (msgq_actual <= 0)
1754 {
1755 host_length = 0;
1756 host_record->count = 0;
1757 }
1758 else
1759 {
1760 host_length = msgq_actual * MESSAGE_ID_LENGTH;
1761 host_record->count = msgq_actual;
1762
1763 if (msgq_actual < msgq_count)
1764 {
1765 int new_count;
1766 for (new_count = 0, i = 0; i < msgq_count; ++i)
1767 if (msgq[i].bKeep)
1768 Ustrncpy(&host_record->text[new_count++ * MESSAGE_ID_LENGTH],
1769 msgq[i].message_id, MESSAGE_ID_LENGTH);
1770
1771 host_record->text[new_count * MESSAGE_ID_LENGTH] = 0;
1772 }
1773 }
1774
1775 /* Check for a continuation record. */
1776
1777 while (host_length <= 0)
1778 {
1779 int i;
1780 dbdata_wait * newr = NULL;
1781 uschar buffer[256];
1782
1783 /* Search for a continuation */
1784
1785 for (i = host_record->sequence - 1; i >= 0 && !newr; i--)
1786 {
1787 sprintf(CS buffer, "%.200s:%d", hostname, i);
1788 newr = dbfn_read(dbm_file, buffer);
1789 }
1790
1791 /* If no continuation, delete the current and break the loop */
1792
1793 if (!newr)
1794 {
1795 dbfn_delete(dbm_file, hostname);
1796 break;
1797 }
1798
1799 /* Else replace the current with the continuation */
1800
1801 dbfn_delete(dbm_file, buffer);
1802 host_record = newr;
1803 host_length = host_record->count * MESSAGE_ID_LENGTH;
1804
1805 bContinuation = TRUE;
1806 }
1807
1808 if (bFound) /* Usual exit from main loop */
1809 {
1810 store_free (msgq);
1811 break;
1812 }
1813
1814 /* If host_length <= 0 we have emptied a record and not found a good message,
1815 and there are no continuation records. Otherwise there is a continuation
1816 record to process. */
1817
1818 if (host_length <= 0)
1819 {
1820 dbfn_close(dbm_file);
1821 DEBUG(D_transport) debug_printf("waiting messages already delivered\n");
1822 return FALSE;
1823 }
1824
1825 /* we were not able to find an acceptable message, nor was there a
1826 * continuation record. So bug out, outer logic will clean this up.
1827 */
1828
1829 if (!bContinuation)
1830 {
1831 Ustrcpy(new_message_id, message_id);
1832 dbfn_close(dbm_file);
1833 return FALSE;
1834 }
1835
1836 store_free(msgq);
1837 } /* we need to process a continuation record */
1838
1839 /* Control gets here when an existing message has been encountered; its
1840 id is in new_message_id, and host_length is the revised length of the
1841 host record. If it is zero, the record has been removed. Update the
1842 record if required, close the database, and return TRUE. */
1843
1844 if (host_length > 0)
1845 {
1846 host_record->count = host_length/MESSAGE_ID_LENGTH;
1847
1848 dbfn_write(dbm_file, hostname, host_record, (int)sizeof(dbdata_wait) + host_length);
1849 *more = TRUE;
1850 }
1851
1852 dbfn_close(dbm_file);
1853 return TRUE;
1854 }
1855
1856 /*************************************************
1857 * Deliver waiting message down same socket *
1858 *************************************************/
1859
1860 /* Just the regain-root-privilege exec portion */
1861 void
1862 transport_do_pass_socket(const uschar *transport_name, const uschar *hostname,
1863 const uschar *hostaddress, uschar *id, int socket_fd)
1864 {
1865 int i = 20;
1866 const uschar **argv;
1867
1868 /* Set up the calling arguments; use the standard function for the basics,
1869 but we have a number of extras that may be added. */
1870
1871 argv = CUSS child_exec_exim(CEE_RETURN_ARGV, TRUE, &i, FALSE, 0);
1872
1873 if (f.smtp_authenticated) argv[i++] = US"-MCA";
1874 if (smtp_peer_options & OPTION_CHUNKING) argv[i++] = US"-MCK";
1875 if (smtp_peer_options & OPTION_DSN) argv[i++] = US"-MCD";
1876 if (smtp_peer_options & OPTION_PIPE) argv[i++] = US"-MCP";
1877 if (smtp_peer_options & OPTION_SIZE) argv[i++] = US"-MCS";
1878 #ifdef SUPPORT_TLS
1879 if (smtp_peer_options & OPTION_TLS)
1880 if (tls_out.active.sock >= 0 || continue_proxy_cipher)
1881 {
1882 argv[i++] = US"-MCt";
1883 argv[i++] = sending_ip_address;
1884 argv[i++] = string_sprintf("%d", sending_port);
1885 argv[i++] = tls_out.active.sock >= 0 ? tls_out.cipher : continue_proxy_cipher;
1886 }
1887 else
1888 argv[i++] = US"-MCT";
1889 #endif
1890
1891 if (queue_run_pid != (pid_t)0)
1892 {
1893 argv[i++] = US"-MCQ";
1894 argv[i++] = string_sprintf("%d", queue_run_pid);
1895 argv[i++] = string_sprintf("%d", queue_run_pipe);
1896 }
1897
1898 argv[i++] = US"-MC";
1899 argv[i++] = US transport_name;
1900 argv[i++] = US hostname;
1901 argv[i++] = US hostaddress;
1902 argv[i++] = string_sprintf("%d", continue_sequence + 1);
1903 argv[i++] = id;
1904 argv[i++] = NULL;
1905
1906 /* Arrange for the channel to be on stdin. */
1907
1908 if (socket_fd != 0)
1909 {
1910 (void)dup2(socket_fd, 0);
1911 (void)close(socket_fd);
1912 }
1913
1914 DEBUG(D_exec) debug_print_argv(argv);
1915 exim_nullstd(); /* Ensure std{out,err} exist */
1916 execv(CS argv[0], (char *const *)argv);
1917
1918 DEBUG(D_any) debug_printf("execv failed: %s\n", strerror(errno));
1919 _exit(errno); /* Note: must be _exit(), NOT exit() */
1920 }
1921
1922
1923
1924 /* Fork a new exim process to deliver the message, and do a re-exec, both to
1925 get a clean delivery process, and to regain root privilege in cases where it
1926 has been given away.
1927
1928 Arguments:
1929 transport_name to pass to the new process
1930 hostname ditto
1931 hostaddress ditto
1932 id the new message to process
1933 socket_fd the connected socket
1934
1935 Returns: FALSE if fork fails; TRUE otherwise
1936 */
1937
1938 BOOL
1939 transport_pass_socket(const uschar *transport_name, const uschar *hostname,
1940 const uschar *hostaddress, uschar *id, int socket_fd)
1941 {
1942 pid_t pid;
1943 int status;
1944
1945 DEBUG(D_transport) debug_printf("transport_pass_socket entered\n");
1946
1947 if ((pid = fork()) == 0)
1948 {
1949 /* Disconnect entirely from the parent process. If we are running in the
1950 test harness, wait for a bit to allow the previous process time to finish,
1951 write the log, etc., so that the output is always in the same order for
1952 automatic comparison. */
1953
1954 if ((pid = fork()) != 0)
1955 {
1956 DEBUG(D_transport) debug_printf("transport_pass_socket succeeded (final-pid %d)\n", pid);
1957 _exit(EXIT_SUCCESS);
1958 }
1959 if (f.running_in_test_harness) sleep(1);
1960
1961 transport_do_pass_socket(transport_name, hostname, hostaddress,
1962 id, socket_fd);
1963 }
1964
1965 /* If the process creation succeeded, wait for the first-level child, which
1966 immediately exits, leaving the second level process entirely disconnected from
1967 this one. */
1968
1969 if (pid > 0)
1970 {
1971 int rc;
1972 while ((rc = wait(&status)) != pid && (rc >= 0 || errno != ECHILD));
1973 DEBUG(D_transport) debug_printf("transport_pass_socket succeeded (inter-pid %d)\n", pid);
1974 return TRUE;
1975 }
1976 else
1977 {
1978 DEBUG(D_transport) debug_printf("transport_pass_socket failed to fork: %s\n",
1979 strerror(errno));
1980 return FALSE;
1981 }
1982 }
1983
1984
1985
1986 /*************************************************
1987 * Set up direct (non-shell) command *
1988 *************************************************/
1989
1990 /* This function is called when a command line is to be parsed and executed
1991 directly, without the use of /bin/sh. It is called by the pipe transport,
1992 the queryprogram router, and also from the main delivery code when setting up a
1993 transport filter process. The code for ETRN also makes use of this; in that
1994 case, no addresses are passed.
1995
1996 Arguments:
1997 argvptr pointer to anchor for argv vector
1998 cmd points to the command string (modified IN PLACE)
1999 expand_arguments true if expansion is to occur
2000 expand_failed error value to set if expansion fails; not relevant if
2001 addr == NULL
2002 addr chain of addresses, or NULL
2003 etext text for use in error messages
2004 errptr where to put error message if addr is NULL;
2005 otherwise it is put in the first address
2006
2007 Returns: TRUE if all went well; otherwise an error will be
2008 set in the first address and FALSE returned
2009 */
2010
2011 BOOL
2012 transport_set_up_command(const uschar ***argvptr, uschar *cmd,
2013 BOOL expand_arguments, int expand_failed, address_item *addr,
2014 uschar *etext, uschar **errptr)
2015 {
2016 address_item *ad;
2017 const uschar **argv;
2018 uschar *s, *ss;
2019 int address_count = 0;
2020 int argcount = 0;
2021 int i, max_args;
2022
2023 /* Get store in which to build an argument list. Count the number of addresses
2024 supplied, and allow for that many arguments, plus an additional 60, which
2025 should be enough for anybody. Multiple addresses happen only when the local
2026 delivery batch option is set. */
2027
2028 for (ad = addr; ad != NULL; ad = ad->next) address_count++;
2029 max_args = address_count + 60;
2030 *argvptr = argv = store_get((max_args+1)*sizeof(uschar *));
2031
2032 /* Split the command up into arguments terminated by white space. Lose
2033 trailing space at the start and end. Double-quoted arguments can contain \\ and
2034 \" escapes and so can be handled by the standard function; single-quoted
2035 arguments are verbatim. Copy each argument into a new string. */
2036
2037 s = cmd;
2038 while (isspace(*s)) s++;
2039
2040 while (*s != 0 && argcount < max_args)
2041 {
2042 if (*s == '\'')
2043 {
2044 ss = s + 1;
2045 while (*ss != 0 && *ss != '\'') ss++;
2046 argv[argcount++] = ss = store_get(ss - s++);
2047 while (*s != 0 && *s != '\'') *ss++ = *s++;
2048 if (*s != 0) s++;
2049 *ss++ = 0;
2050 }
2051 else argv[argcount++] = string_copy(string_dequote(CUSS &s));
2052 while (isspace(*s)) s++;
2053 }
2054
2055 argv[argcount] = US 0;
2056
2057 /* If *s != 0 we have run out of argument slots. */
2058
2059 if (*s != 0)
2060 {
2061 uschar *msg = string_sprintf("Too many arguments in command \"%s\" in "
2062 "%s", cmd, etext);
2063 if (addr != NULL)
2064 {
2065 addr->transport_return = FAIL;
2066 addr->message = msg;
2067 }
2068 else *errptr = msg;
2069 return FALSE;
2070 }
2071
2072 /* Expand each individual argument if required. Expansion happens for pipes set
2073 up in filter files and with directly-supplied commands. It does not happen if
2074 the pipe comes from a traditional .forward file. A failing expansion is a big
2075 disaster if the command came from Exim's configuration; if it came from a user
2076 it is just a normal failure. The expand_failed value is used as the error value
2077 to cater for these two cases.
2078
2079 An argument consisting just of the text "$pipe_addresses" is treated specially.
2080 It is not passed to the general expansion function. Instead, it is replaced by
2081 a number of arguments, one for each address. This avoids problems with shell
2082 metacharacters and spaces in addresses.
2083
2084 If the parent of the top address has an original part of "system-filter", this
2085 pipe was set up by the system filter, and we can permit the expansion of
2086 $recipients. */
2087
2088 DEBUG(D_transport)
2089 {
2090 debug_printf("direct command:\n");
2091 for (i = 0; argv[i] != US 0; i++)
2092 debug_printf(" argv[%d] = %s\n", i, string_printing(argv[i]));
2093 }
2094
2095 if (expand_arguments)
2096 {
2097 BOOL allow_dollar_recipients = addr != NULL &&
2098 addr->parent != NULL &&
2099 Ustrcmp(addr->parent->address, "system-filter") == 0;
2100
2101 for (i = 0; argv[i] != US 0; i++)
2102 {
2103
2104 /* Handle special fudge for passing an address list */
2105
2106 if (addr != NULL &&
2107 (Ustrcmp(argv[i], "$pipe_addresses") == 0 ||
2108 Ustrcmp(argv[i], "${pipe_addresses}") == 0))
2109 {
2110 int additional;
2111
2112 if (argcount + address_count - 1 > max_args)
2113 {
2114 addr->transport_return = FAIL;
2115 addr->message = string_sprintf("Too many arguments to command \"%s\" "
2116 "in %s", cmd, etext);
2117 return FALSE;
2118 }
2119
2120 additional = address_count - 1;
2121 if (additional > 0)
2122 memmove(argv + i + 1 + additional, argv + i + 1,
2123 (argcount - i)*sizeof(uschar *));
2124
2125 for (ad = addr; ad != NULL; ad = ad->next) {
2126 argv[i++] = ad->address;
2127 argcount++;
2128 }
2129
2130 /* Subtract one since we replace $pipe_addresses */
2131 argcount--;
2132 i--;
2133 }
2134
2135 /* Handle special case of $address_pipe when af_force_command is set */
2136
2137 else if (addr != NULL && testflag(addr,af_force_command) &&
2138 (Ustrcmp(argv[i], "$address_pipe") == 0 ||
2139 Ustrcmp(argv[i], "${address_pipe}") == 0))
2140 {
2141 int address_pipe_i;
2142 int address_pipe_argcount = 0;
2143 int address_pipe_max_args;
2144 uschar **address_pipe_argv;
2145
2146 /* We can never have more then the argv we will be loading into */
2147 address_pipe_max_args = max_args - argcount + 1;
2148
2149 DEBUG(D_transport)
2150 debug_printf("address_pipe_max_args=%d\n", address_pipe_max_args);
2151
2152 /* We allocate an additional for (uschar *)0 */
2153 address_pipe_argv = store_get((address_pipe_max_args+1)*sizeof(uschar *));
2154
2155 /* +1 because addr->local_part[0] == '|' since af_force_command is set */
2156 s = expand_string(addr->local_part + 1);
2157
2158 if (s == NULL || *s == '\0')
2159 {
2160 addr->transport_return = FAIL;
2161 addr->message = string_sprintf("Expansion of \"%s\" "
2162 "from command \"%s\" in %s failed: %s",
2163 (addr->local_part + 1), cmd, etext, expand_string_message);
2164 return FALSE;
2165 }
2166
2167 while (isspace(*s)) s++; /* strip leading space */
2168
2169 while (*s != 0 && address_pipe_argcount < address_pipe_max_args)
2170 {
2171 if (*s == '\'')
2172 {
2173 ss = s + 1;
2174 while (*ss != 0 && *ss != '\'') ss++;
2175 address_pipe_argv[address_pipe_argcount++] = ss = store_get(ss - s++);
2176 while (*s != 0 && *s != '\'') *ss++ = *s++;
2177 if (*s != 0) s++;
2178 *ss++ = 0;
2179 }
2180 else address_pipe_argv[address_pipe_argcount++] =
2181 string_copy(string_dequote(CUSS &s));
2182 while (isspace(*s)) s++; /* strip space after arg */
2183 }
2184
2185 address_pipe_argv[address_pipe_argcount] = US 0;
2186
2187 /* If *s != 0 we have run out of argument slots. */
2188 if (*s != 0)
2189 {
2190 uschar *msg = string_sprintf("Too many arguments in $address_pipe "
2191 "\"%s\" in %s", addr->local_part + 1, etext);
2192 if (addr != NULL)
2193 {
2194 addr->transport_return = FAIL;
2195 addr->message = msg;
2196 }
2197 else *errptr = msg;
2198 return FALSE;
2199 }
2200
2201 /* address_pipe_argcount - 1
2202 * because we are replacing $address_pipe in the argument list
2203 * with the first thing it expands to */
2204 if (argcount + address_pipe_argcount - 1 > max_args)
2205 {
2206 addr->transport_return = FAIL;
2207 addr->message = string_sprintf("Too many arguments to command "
2208 "\"%s\" after expanding $address_pipe in %s", cmd, etext);
2209 return FALSE;
2210 }
2211
2212 /* If we are not just able to replace the slot that contained
2213 * $address_pipe (address_pipe_argcount == 1)
2214 * We have to move the existing argv by address_pipe_argcount - 1
2215 * Visually if address_pipe_argcount == 2:
2216 * [argv 0][argv 1][argv 2($address_pipe)][argv 3][0]
2217 * [argv 0][argv 1][ap_arg0][ap_arg1][old argv 3][0]
2218 */
2219 if (address_pipe_argcount > 1)
2220 memmove(
2221 /* current position + additional args */
2222 argv + i + address_pipe_argcount,
2223 /* current position + 1 (for the (uschar *)0 at the end) */
2224 argv + i + 1,
2225 /* -1 for the (uschar *)0 at the end)*/
2226 (argcount - i)*sizeof(uschar *)
2227 );
2228
2229 /* Now we fill in the slots we just moved argv out of
2230 * [argv 0][argv 1][argv 2=pipeargv[0]][argv 3=pipeargv[1]][old argv 3][0]
2231 */
2232 for (address_pipe_i = 0;
2233 address_pipe_argv[address_pipe_i] != US 0;
2234 address_pipe_i++)
2235 {
2236 argv[i++] = address_pipe_argv[address_pipe_i];
2237 argcount++;
2238 }
2239
2240 /* Subtract one since we replace $address_pipe */
2241 argcount--;
2242 i--;
2243 }
2244
2245 /* Handle normal expansion string */
2246
2247 else
2248 {
2249 const uschar *expanded_arg;
2250 f.enable_dollar_recipients = allow_dollar_recipients;
2251 expanded_arg = expand_cstring(argv[i]);
2252 f.enable_dollar_recipients = FALSE;
2253
2254 if (expanded_arg == NULL)
2255 {
2256 uschar *msg = string_sprintf("Expansion of \"%s\" "
2257 "from command \"%s\" in %s failed: %s",
2258 argv[i], cmd, etext, expand_string_message);
2259 if (addr != NULL)
2260 {
2261 addr->transport_return = expand_failed;
2262 addr->message = msg;
2263 }
2264 else *errptr = msg;
2265 return FALSE;
2266 }
2267 argv[i] = expanded_arg;
2268 }
2269 }
2270
2271 DEBUG(D_transport)
2272 {
2273 debug_printf("direct command after expansion:\n");
2274 for (i = 0; argv[i] != US 0; i++)
2275 debug_printf(" argv[%d] = %s\n", i, string_printing(argv[i]));
2276 }
2277 }
2278
2279 return TRUE;
2280 }
2281
2282 #endif /*!MACRO_PREDEF*/
2283 /* vi: aw ai sw=2
2284 */
2285 /* End of transport.c */