Change HAVE_LOGIN_CAP to HAVE_SETCLASSRESOURCES because the former isn't
[exim.git] / src / src / transports / pipe.c
1 /* $Cambridge: exim/src/src/transports/pipe.c,v 1.11 2006/03/16 12:25:24 ph10 Exp $ */
2
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
6
7 /* Copyright (c) University of Cambridge 1995 - 2006 */
8 /* See the file NOTICE for conditions of use and distribution. */
9
10
11 #include "../exim.h"
12 #include "pipe.h"
13
14 #ifdef HAVE_SETCLASSRESOURCES
15 #include <login_cap.h>
16 #endif
17
18
19
20 /* Options specific to the pipe transport. They must be in alphabetic
21 order (note that "_" comes before the lower case letters). Those starting
22 with "*" are not settable by the user but are used by the option-reading
23 software for alternative value types. Some options are stored in the transport
24 instance block so as to be publicly visible; these are flagged with opt_public.
25 */
26
27 optionlist pipe_transport_options[] = {
28 { "allow_commands", opt_stringptr,
29 (void *)offsetof(pipe_transport_options_block, allow_commands) },
30 { "batch_id", opt_stringptr | opt_public,
31 (void *)offsetof(transport_instance, batch_id) },
32 { "batch_max", opt_int | opt_public,
33 (void *)offsetof(transport_instance, batch_max) },
34 { "check_string", opt_stringptr,
35 (void *)offsetof(pipe_transport_options_block, check_string) },
36 { "command", opt_stringptr,
37 (void *)offsetof(pipe_transport_options_block, cmd) },
38 { "environment", opt_stringptr,
39 (void *)offsetof(pipe_transport_options_block, environment) },
40 { "escape_string", opt_stringptr,
41 (void *)offsetof(pipe_transport_options_block, escape_string) },
42 { "freeze_exec_fail", opt_bool,
43 (void *)offsetof(pipe_transport_options_block, freeze_exec_fail) },
44 { "ignore_status", opt_bool,
45 (void *)offsetof(pipe_transport_options_block, ignore_status) },
46 { "log_defer_output", opt_bool | opt_public,
47 (void *)offsetof(transport_instance, log_defer_output) },
48 { "log_fail_output", opt_bool | opt_public,
49 (void *)offsetof(transport_instance, log_fail_output) },
50 { "log_output", opt_bool | opt_public,
51 (void *)offsetof(transport_instance, log_output) },
52 { "max_output", opt_mkint,
53 (void *)offsetof(pipe_transport_options_block, max_output) },
54 { "message_prefix", opt_stringptr,
55 (void *)offsetof(pipe_transport_options_block, message_prefix) },
56 { "message_suffix", opt_stringptr,
57 (void *)offsetof(pipe_transport_options_block, message_suffix) },
58 { "path", opt_stringptr,
59 (void *)offsetof(pipe_transport_options_block, path) },
60 { "pipe_as_creator", opt_bool | opt_public,
61 (void *)offsetof(transport_instance, deliver_as_creator) },
62 { "restrict_to_path", opt_bool,
63 (void *)offsetof(pipe_transport_options_block, restrict_to_path) },
64 { "return_fail_output",opt_bool | opt_public,
65 (void *)offsetof(transport_instance, return_fail_output) },
66 { "return_output", opt_bool | opt_public,
67 (void *)offsetof(transport_instance, return_output) },
68 { "temp_errors", opt_stringptr,
69 (void *)offsetof(pipe_transport_options_block, temp_errors) },
70 { "timeout", opt_time,
71 (void *)offsetof(pipe_transport_options_block, timeout) },
72 { "timeout_defer", opt_bool,
73 (void *)offsetof(pipe_transport_options_block, timeout_defer) },
74 { "umask", opt_octint,
75 (void *)offsetof(pipe_transport_options_block, umask) },
76 { "use_bsmtp", opt_bool,
77 (void *)offsetof(pipe_transport_options_block, use_bsmtp) },
78 #ifdef HAVE_SETCLASSRESOURCES
79 { "use_classresources", opt_bool,
80 (void *)offsetof(pipe_transport_options_block, use_classresources) },
81 #endif
82 { "use_crlf", opt_bool,
83 (void *)offsetof(pipe_transport_options_block, use_crlf) },
84 { "use_shell", opt_bool,
85 (void *)offsetof(pipe_transport_options_block, use_shell) },
86 };
87
88 /* Size of the options list. An extern variable has to be used so that its
89 address can appear in the tables drtables.c. */
90
91 int pipe_transport_options_count =
92 sizeof(pipe_transport_options)/sizeof(optionlist);
93
94 /* Default private options block for the pipe transport. */
95
96 pipe_transport_options_block pipe_transport_option_defaults = {
97 NULL, /* cmd */
98 NULL, /* allow_commands */
99 NULL, /* environment */
100 US"/bin:/usr/bin", /* path */
101 NULL, /* message_prefix (reset in init if not bsmtp) */
102 NULL, /* message_suffix (ditto) */
103 US mac_expanded_string(EX_TEMPFAIL) ":" /* temp_errors */
104 mac_expanded_string(EX_CANTCREAT),
105 NULL, /* check_string */
106 NULL, /* escape_string */
107 022, /* umask */
108 20480, /* max_output */
109 60*60, /* timeout */
110 0, /* options */
111 FALSE, /* freeze_exec_fail */
112 FALSE, /* ignore_status */
113 FALSE, /* restrict_to_path */
114 FALSE, /* timeout_defer */
115 FALSE, /* use_shell */
116 FALSE, /* use_bsmtp */
117 FALSE, /* use_classresources */
118 FALSE /* use_crlf */
119 };
120
121
122
123 /*************************************************
124 * Setup entry point *
125 *************************************************/
126
127 /* Called for each delivery in the privileged state, just before the uid/gid
128 are changed and the main entry point is called. In a system that supports the
129 login_cap facilities, this function is used to set the class resource limits
130 for the user.
131
132 Arguments:
133 tblock points to the transport instance
134 addrlist addresses about to be delivered (not used)
135 dummy not used (doesn't pass back data)
136 uid the uid that will be set (not used)
137 gid the gid that will be set (not used)
138 errmsg where to put an error message
139
140 Returns: OK, FAIL, or DEFER
141 */
142
143 static int
144 pipe_transport_setup(transport_instance *tblock, address_item *addrlist,
145 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
146 {
147 pipe_transport_options_block *ob =
148 (pipe_transport_options_block *)(tblock->options_block);
149
150 addrlist = addrlist; /* Keep compiler happy */
151 dummy = dummy;
152 uid = uid;
153 gid = gid;
154 errmsg = errmsg;
155 ob = ob;
156
157 #ifdef HAVE_SETCLASSRESOURCES
158 if (ob->use_classresources)
159 {
160 struct passwd *pw = getpwuid(uid);
161 if (pw != NULL)
162 {
163 login_cap_t *lc = login_getpwclass(pw);
164 if (lc != NULL)
165 {
166 setclassresources(lc);
167 login_close(lc);
168 }
169 }
170 }
171 #endif
172
173 return OK;
174 }
175
176
177
178 /*************************************************
179 * Initialization entry point *
180 *************************************************/
181
182 /* Called for each instance, after its options have been read, to
183 enable consistency checks to be done, or anything else that needs
184 to be set up. */
185
186 void
187 pipe_transport_init(transport_instance *tblock)
188 {
189 pipe_transport_options_block *ob =
190 (pipe_transport_options_block *)(tblock->options_block);
191
192 /* Set up the setup entry point, to be called in the privileged state */
193
194 tblock->setup = pipe_transport_setup;
195
196 /* If pipe_as_creator is set, then uid/gid should not be set. */
197
198 if (tblock->deliver_as_creator && (tblock->uid_set || tblock->gid_set ||
199 tblock->expand_uid != NULL || tblock->expand_gid != NULL))
200 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
201 "both pipe_as_creator and an explicit uid/gid are set for the %s "
202 "transport", tblock->name);
203
204 /* If a fixed uid field is set, then a gid field must also be set. */
205
206 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
207 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
208 "user set without group for the %s transport", tblock->name);
209
210 /* Temp_errors must consist only of digits and colons, but there can be
211 spaces round the colons, so allow them too. */
212
213 if (ob->temp_errors != NULL && Ustrcmp(ob->temp_errors, "*") != 0)
214 {
215 size_t p = Ustrspn(ob->temp_errors, "0123456789: ");
216 if (ob->temp_errors[p] != 0)
217 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
218 "temp_errors must be a list of numbers or an asterisk for the %s "
219 "transport", tblock->name);
220 }
221
222 /* Only one of return_output/return_fail_output or log_output/log_fail_output
223 should be set. */
224
225 if (tblock->return_output && tblock->return_fail_output)
226 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
227 "both return_output and return_fail_output set for %s transport",
228 tblock->name);
229
230 if (tblock->log_output && tblock->log_fail_output)
231 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
232 "both log_output and log_fail_output set for the %s transport",
233 tblock->name);
234
235 /* If batch SMTP is set, force the check and escape strings, and arrange that
236 headers are also escaped. */
237
238 if (ob->use_bsmtp)
239 {
240 ob->check_string = US".";
241 ob->escape_string = US"..";
242 ob->options |= topt_escape_headers;
243 }
244
245 /* If not batch SMTP, and message_prefix or message_suffix are unset, insert
246 default values for them. */
247
248 else
249 {
250 if (ob->message_prefix == NULL) ob->message_prefix =
251 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
252 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
253 }
254
255 /* The restrict_to_path and use_shell options are incompatible */
256
257 if (ob->restrict_to_path && ob->use_shell)
258 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
259 "both restrict_to_path and use_shell set for %s transport",
260 tblock->name);
261
262 /* The allow_commands and use_shell options are incompatible */
263
264 if (ob->allow_commands && ob->use_shell)
265 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
266 "both allow_commands and use_shell set for %s transport",
267 tblock->name);
268
269 /* Set up the bitwise options for transport_write_message from the various
270 driver options. Only one of body_only and headers_only can be set. */
271
272 ob->options |=
273 (tblock->body_only? topt_no_headers : 0) |
274 (tblock->headers_only? topt_no_body : 0) |
275 (tblock->return_path_add? topt_add_return_path : 0) |
276 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
277 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
278 (ob->use_crlf? topt_use_crlf : 0);
279 }
280
281
282
283 /*************************************************
284 * Set up direct (non-shell) command *
285 *************************************************/
286
287 /* This function is called when a command line is to be parsed by the transport
288 and executed directly, without the use of /bin/sh.
289
290 Arguments:
291 argvptr pointer to anchor for argv vector
292 cmd points to the command string
293 expand_arguments true if expansion is to occur
294 expand_fail error if expansion fails
295 addr chain of addresses
296 tname the transport name
297 ob the transport options block
298
299 Returns: TRUE if all went well; otherwise an error will be
300 set in the first address and FALSE returned
301 */
302
303 static BOOL
304 set_up_direct_command(uschar ***argvptr, uschar *cmd, BOOL expand_arguments,
305 int expand_fail, address_item *addr, uschar *tname,
306 pipe_transport_options_block *ob)
307 {
308 BOOL permitted = FALSE;
309 uschar **argv;
310 uschar buffer[64];
311
312 /* Set up "transport <name>" to be put in any error messages, and then
313 call the common function for creating an argument list and expanding
314 the items if necessary. If it fails, this function fails (error information
315 is in the addresses). */
316
317 sprintf(CS buffer, "%.50s transport", tname);
318 if (!transport_set_up_command(argvptr, cmd, expand_arguments, expand_fail,
319 addr, buffer, NULL))
320 return FALSE;
321
322 /* Point to the set-up arguments. */
323
324 argv = *argvptr;
325
326 /* If allow_commands is set, see if the command is in the permitted list. */
327
328 if (ob->allow_commands != NULL)
329 {
330 int sep = 0;
331 uschar *s, *p;
332 uschar buffer[256];
333
334 s = expand_string(ob->allow_commands);
335 if (s == NULL)
336 {
337 addr->transport_return = DEFER;
338 addr->message = string_sprintf("failed to expand string \"%s\" "
339 "for %s transport: %s", ob->allow_commands, tname, expand_string_message);
340 return FALSE;
341 }
342
343 while ((p = string_nextinlist(&s, &sep, buffer, sizeof(buffer))) != NULL)
344 {
345 if (Ustrcmp(p, argv[0]) == 0) { permitted = TRUE; break; }
346 }
347 }
348
349 /* If permitted is TRUE it means the command was found in the allowed list, and
350 no further checks are done. If permitted = FALSE, it either means
351 allow_commands wasn't set, or that the command didn't match anything in the
352 list. In both cases, if restrict_to_path is set, we fail if the command
353 contains any slashes, but if restrict_to_path is not set, we must fail the
354 command only if allow_commands is set. */
355
356 if (!permitted)
357 {
358 if (ob->restrict_to_path)
359 {
360 if (Ustrchr(argv[0], '/') != NULL)
361 {
362 addr->transport_return = FAIL;
363 addr->message = string_sprintf("\"/\" found in \"%s\" (command for %s "
364 "transport) - failed for security reasons", cmd, tname);
365 return FALSE;
366 }
367 }
368
369 else if (ob->allow_commands != NULL)
370 {
371 addr->transport_return = FAIL;
372 addr->message = string_sprintf("\"%s\" command not permitted by %s "
373 "transport", argv[0], tname);
374 return FALSE;
375 }
376 }
377
378 /* If the command is not an absolute path, search the PATH directories
379 for it. */
380
381 if (argv[0][0] != '/')
382 {
383 int sep = 0;
384 uschar *p;
385 uschar *listptr = ob->path;
386 uschar buffer[1024];
387
388 while ((p = string_nextinlist(&listptr, &sep, buffer, sizeof(buffer))) != NULL)
389 {
390 struct stat statbuf;
391 sprintf(CS big_buffer, "%.256s/%.256s", p, argv[0]);
392 if (Ustat(big_buffer, &statbuf) == 0)
393 {
394 argv[0] = string_copy(big_buffer);
395 break;
396 }
397 }
398 if (p == NULL)
399 {
400 addr->transport_return = FAIL;
401 addr->message = string_sprintf("\"%s\" command not found for %s transport",
402 argv[0], tname);
403 return FALSE;
404 }
405 }
406
407 return TRUE;
408 }
409
410
411 /*************************************************
412 * Set up shell command *
413 *************************************************/
414
415 /* This function is called when a command line is to be passed to /bin/sh
416 without parsing inside the transport.
417
418 Arguments:
419 argvptr pointer to anchor for argv vector
420 cmd points to the command string
421 expand_arguments true if expansion is to occur
422 expand_fail error if expansion fails
423 addr chain of addresses
424 tname the transport name
425
426 Returns: TRUE if all went well; otherwise an error will be
427 set in the first address and FALSE returned
428 */
429
430 static BOOL
431 set_up_shell_command(uschar ***argvptr, uschar *cmd, BOOL expand_arguments,
432 int expand_fail, address_item *addr, uschar *tname)
433 {
434 uschar **argv;
435
436 *argvptr = argv = store_get((4)*sizeof(uschar *));
437
438 argv[0] = US"/bin/sh";
439 argv[1] = US"-c";
440
441 /* We have to take special action to handle the special "variable" called
442 $pipe_addresses, which is not recognized by the normal expansion function. */
443
444 DEBUG(D_transport)
445 debug_printf("shell pipe command before expansion:\n %s\n", cmd);
446
447 if (expand_arguments)
448 {
449 uschar *s = cmd;
450 uschar *p = Ustrstr(cmd, "pipe_addresses");
451
452 if (p != NULL && (
453 (p > cmd && p[-1] == '$') ||
454 (p > cmd + 1 && p[-2] == '$' && p[-1] == '{' && p[14] == '}')))
455 {
456 address_item *ad;
457 uschar *q = p + 14;
458 int size = Ustrlen(cmd) + 64;
459 int offset;
460
461 if (p[-1] == '{') { q++; p--; }
462
463 s = store_get(size);
464 offset = p - cmd - 1;
465 Ustrncpy(s, cmd, offset);
466
467 for (ad = addr; ad != NULL; ad = ad->next)
468 {
469 if (ad != addr) string_cat(s, &size, &offset, US" ", 1);
470 string_cat(s, &size, &offset, ad->address, Ustrlen(ad->address));
471 }
472
473 string_cat(s, &size, &offset, q, Ustrlen(q));
474 s[offset] = 0;
475 }
476
477 /* Allow $recipients in the expansion iff it comes from a system filter */
478
479 enable_dollar_recipients = addr != NULL &&
480 addr->parent != NULL &&
481 Ustrcmp(addr->parent->address, "system-filter") == 0;
482 argv[2] = expand_string(s);
483 enable_dollar_recipients = FALSE;
484
485 if (argv[2] == NULL)
486 {
487 addr->transport_return = search_find_defer? DEFER : expand_fail;
488 addr->message = string_sprintf("Expansion of command \"%s\" "
489 "in %s transport failed: %s",
490 cmd, tname, expand_string_message);
491 return FALSE;
492 }
493
494 DEBUG(D_transport)
495 debug_printf("shell pipe command after expansion:\n %s\n", argv[2]);
496 }
497 else argv[2] = cmd;
498
499 argv[3] = (uschar *)0;
500 return TRUE;
501 }
502
503
504
505
506 /*************************************************
507 * Main entry point *
508 *************************************************/
509
510 /* See local README for interface details. This transport always returns FALSE,
511 indicating that the status in the first address is the status for all addresses
512 in a batch. */
513
514 BOOL
515 pipe_transport_entry(
516 transport_instance *tblock, /* data for this instantiation */
517 address_item *addr) /* address(es) we are working on */
518 {
519 pid_t pid, outpid;
520 int fd_in, fd_out, rc;
521 int envcount = 0;
522 int envsep = 0;
523 int expand_fail;
524 pipe_transport_options_block *ob =
525 (pipe_transport_options_block *)(tblock->options_block);
526 int timeout = ob->timeout;
527 BOOL written_ok = FALSE;
528 BOOL expand_arguments;
529 uschar **argv;
530 uschar *envp[50];
531 uschar *envlist = ob->environment;
532 uschar *cmd, *ss;
533 uschar *eol = (ob->use_crlf)? US"\r\n" : US"\n";
534
535 DEBUG(D_transport) debug_printf("%s transport entered\n", tblock->name);
536
537 /* Set up for the good case */
538
539 addr->transport_return = OK;
540 addr->basic_errno = 0;
541
542 /* Pipes are not accepted as general addresses, but they can be generated from
543 .forward files or alias files. In those cases, the pfr flag is set, and the
544 command to be obeyed is pointed to by addr->local_part; it starts with the pipe
545 symbol. In other cases, the command is supplied as one of the pipe transport's
546 options. */
547
548 if (testflag(addr, af_pfr) && addr->local_part[0] == '|')
549 {
550 cmd = addr->local_part + 1;
551 while (isspace(*cmd)) cmd++;
552 expand_arguments = testflag(addr, af_expand_pipe);
553 expand_fail = FAIL;
554 }
555 else
556 {
557 cmd = ob->cmd;
558 expand_arguments = TRUE;
559 expand_fail = PANIC;
560 }
561
562 /* If no command has been supplied, we are in trouble. */
563
564 if (cmd == NULL)
565 {
566 addr->transport_return = DEFER;
567 addr->message = string_sprintf("no command specified for %s transport",
568 tblock->name);
569 return FALSE;
570 }
571
572 /* When a pipe is set up by a filter file, there may be values for $thisaddress
573 and numerical the variables in existence. These are passed in
574 addr->pipe_expandn for use here. */
575
576 if (expand_arguments && addr->pipe_expandn != NULL)
577 {
578 uschar **ss = addr->pipe_expandn;
579 expand_nmax = -1;
580 if (*ss != NULL) filter_thisaddress = *ss++;
581 while (*ss != NULL)
582 {
583 expand_nstring[++expand_nmax] = *ss;
584 expand_nlength[expand_nmax] = Ustrlen(*ss++);
585 }
586 }
587
588 /* The default way of processing the command is to split it up into arguments
589 here, and run it directly. This offers some security advantages. However, there
590 are installations that want by default to run commands under /bin/sh always, so
591 there is an option to do that. */
592
593 if (ob->use_shell)
594 {
595 if (!set_up_shell_command(&argv, cmd, expand_arguments, expand_fail, addr,
596 tblock->name)) return FALSE;
597 }
598 else if (!set_up_direct_command(&argv, cmd, expand_arguments, expand_fail, addr,
599 tblock->name, ob)) return FALSE;
600
601 expand_nmax = -1; /* Reset */
602 filter_thisaddress = NULL;
603
604 /* Set up the environment for the command. */
605
606 envp[envcount++] = string_sprintf("LOCAL_PART=%s", deliver_localpart);
607 envp[envcount++] = string_sprintf("LOGNAME=%s", deliver_localpart);
608 envp[envcount++] = string_sprintf("USER=%s", deliver_localpart);
609 envp[envcount++] = string_sprintf("LOCAL_PART_PREFIX=%#s",
610 deliver_localpart_prefix);
611 envp[envcount++] = string_sprintf("LOCAL_PART_SUFFIX=%#s",
612 deliver_localpart_suffix);
613 envp[envcount++] = string_sprintf("DOMAIN=%s", deliver_domain);
614 envp[envcount++] = string_sprintf("HOME=%#s", deliver_home);
615 envp[envcount++] = string_sprintf("MESSAGE_ID=%s", message_id);
616 envp[envcount++] = string_sprintf("PATH=%s", ob->path);
617 envp[envcount++] = string_sprintf("RECIPIENT=%#s%#s%#s@%#s",
618 deliver_localpart_prefix, deliver_localpart, deliver_localpart_suffix,
619 deliver_domain);
620 envp[envcount++] = string_sprintf("QUALIFY_DOMAIN=%s", qualify_domain_sender);
621 envp[envcount++] = string_sprintf("SENDER=%s", sender_address);
622 envp[envcount++] = US"SHELL=/bin/sh";
623
624 if (addr->host_list != NULL)
625 envp[envcount++] = string_sprintf("HOST=%s", addr->host_list->name);
626
627 if (timestamps_utc) envp[envcount++] = US"TZ=UTC";
628 else if (timezone_string != NULL && timezone_string[0] != 0)
629 envp[envcount++] = string_sprintf("TZ=%s", timezone_string);
630
631 /* Add any requested items */
632
633 if (envlist != NULL)
634 {
635 envlist = expand_string(envlist);
636 if (envlist == NULL)
637 {
638 addr->transport_return = DEFER;
639 addr->message = string_sprintf("failed to expand string \"%s\" "
640 "for %s transport: %s", ob->environment, tblock->name,
641 expand_string_message);
642 return FALSE;
643 }
644 }
645
646 while ((ss = string_nextinlist(&envlist, &envsep, big_buffer, big_buffer_size))
647 != NULL)
648 {
649 if (envcount > sizeof(envp)/sizeof(uschar *) - 2)
650 {
651 addr->transport_return = DEFER;
652 addr->message = string_sprintf("too many environment settings for "
653 "%s transport", tblock->name);
654 return FALSE;
655 }
656 envp[envcount++] = string_copy(ss);
657 }
658
659 envp[envcount] = NULL;
660
661 /* If the -N option is set, can't do any more. */
662
663 if (dont_deliver)
664 {
665 DEBUG(D_transport)
666 debug_printf("*** delivery by %s transport bypassed by -N option",
667 tblock->name);
668 return FALSE;
669 }
670
671
672 /* Handling the output from the pipe is tricky. If a file for catching this
673 output is provided, we could in theory just hand that fd over to the process,
674 but this isn't very safe because it might loop and carry on writing for
675 ever (which is exactly what happened in early versions of Exim). Therefore we
676 use the standard child_open() function, which creates pipes. We can then read
677 our end of the output pipe and count the number of bytes that come through,
678 chopping the sub-process if it exceeds some limit.
679
680 However, this means we want to run a sub-process with both its input and output
681 attached to pipes. We can't handle that easily from a single parent process
682 using straightforward code such as the transport_write_message() function
683 because the subprocess might not be reading its input because it is trying to
684 write to a full output pipe. The complication of redesigning the world to
685 handle this is too great - simpler just to run another process to do the
686 reading of the output pipe. */
687
688
689 /* As this is a local transport, we are already running with the required
690 uid/gid and current directory. Request that the new process be a process group
691 leader, so we can kill it and all its children on a timeout. */
692
693 if ((pid = child_open(argv, envp, ob->umask, &fd_in, &fd_out, TRUE)) < 0)
694 {
695 addr->transport_return = DEFER;
696 addr->message = string_sprintf(
697 "Failed to create child process for %s transport: %s", tblock->name,
698 strerror(errno));
699 return FALSE;
700 }
701
702 /* Now fork a process to handle the output that comes down the pipe. */
703
704 if ((outpid = fork()) < 0)
705 {
706 addr->basic_errno = errno;
707 addr->transport_return = DEFER;
708 addr->message = string_sprintf(
709 "Failed to create process for handling output in %s transport",
710 tblock->name);
711 (void)close(fd_in);
712 (void)close(fd_out);
713 return FALSE;
714 }
715
716 /* This is the code for the output-handling subprocess. Read from the pipe
717 in chunks, and write to the return file if one is provided. Keep track of
718 the number of bytes handled. If the limit is exceeded, try to kill the
719 subprocess group, and in any case close the pipe and exit, which should cause
720 the subprocess to fail. */
721
722 if (outpid == 0)
723 {
724 int count = 0;
725 (void)close(fd_in);
726 set_process_info("reading output from |%s", cmd);
727 while ((rc = read(fd_out, big_buffer, big_buffer_size)) > 0)
728 {
729 if (addr->return_file >= 0)
730 write(addr->return_file, big_buffer, rc);
731 count += rc;
732 if (count > ob->max_output)
733 {
734 uschar *message = US"\n\n*** Too much output - remainder discarded ***\n";
735 DEBUG(D_transport) debug_printf("Too much output from pipe - killed\n");
736 if (addr->return_file >= 0)
737 write(addr->return_file, message, Ustrlen(message));
738 killpg(pid, SIGKILL);
739 break;
740 }
741 }
742 (void)close(fd_out);
743 _exit(0);
744 }
745
746 (void)close(fd_out); /* Not used in this process */
747
748
749 /* Carrying on now with the main parent process. Attempt to write the message
750 to it down the pipe. It is a fallacy to think that you can detect write errors
751 when the sub-process fails to read the pipe. The parent process may complete
752 writing and close the pipe before the sub-process completes. We could sleep a
753 bit here to let the sub-process get going, but it may still not complete. So we
754 ignore all writing errors. (When in the test harness, we do do a short sleep so
755 any debugging output is likely to be in the same order.) */
756
757 if (running_in_test_harness) millisleep(500);
758
759 DEBUG(D_transport) debug_printf("Writing message to pipe\n");
760
761 /* Arrange to time out writes if there is a timeout set. */
762
763 if (timeout > 0)
764 {
765 sigalrm_seen = FALSE;
766 transport_write_timeout = timeout;
767 }
768
769 /* Reset the counter of bytes written */
770
771 transport_count = 0;
772
773 /* First write any configured prefix information */
774
775 if (ob->message_prefix != NULL)
776 {
777 uschar *prefix = expand_string(ob->message_prefix);
778 if (prefix == NULL)
779 {
780 addr->transport_return = search_find_defer? DEFER : PANIC;
781 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
782 "transport) failed: %s", ob->message_prefix, tblock->name,
783 expand_string_message);
784 return FALSE;
785 }
786 if (!transport_write_block(fd_in, prefix, Ustrlen(prefix)))
787 goto END_WRITE;
788 }
789
790 /* If the use_bsmtp option is set, we need to write SMTP prefix information.
791 The various different values for batching are handled outside; if there is more
792 than one address available here, all must be included. Force SMTP dot-handling.
793 */
794
795 if (ob->use_bsmtp)
796 {
797 address_item *a;
798
799 if (!transport_write_string(fd_in, "MAIL FROM:<%s>%s", return_path, eol))
800 goto END_WRITE;
801
802 for (a = addr; a != NULL; a = a->next)
803 {
804 if (!transport_write_string(fd_in,
805 "RCPT TO:<%s>%s",
806 transport_rcpt_address(a, tblock->rcpt_include_affixes),
807 eol))
808 goto END_WRITE;
809 }
810
811 if (!transport_write_string(fd_in, "DATA%s", eol)) goto END_WRITE;
812 }
813
814 /* Now the actual message - the options were set at initialization time */
815
816 if (!transport_write_message(addr, fd_in, ob->options, 0, tblock->add_headers,
817 tblock->remove_headers, ob->check_string, ob->escape_string,
818 tblock->rewrite_rules, tblock->rewrite_existflags))
819 goto END_WRITE;
820
821 /* Now any configured suffix */
822
823 if (ob->message_suffix != NULL)
824 {
825 uschar *suffix = expand_string(ob->message_suffix);
826 if (suffix == NULL)
827 {
828 addr->transport_return = search_find_defer? DEFER : PANIC;
829 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
830 "transport) failed: %s", ob->message_suffix, tblock->name,
831 expand_string_message);
832 return FALSE;
833 }
834 if (!transport_write_block(fd_in, suffix, Ustrlen(suffix)))
835 goto END_WRITE;
836 }
837
838 /* If local_smtp, write the terminating dot. */
839
840 if (ob->use_bsmtp && !transport_write_string(fd_in, ".%s", eol))
841 goto END_WRITE;
842
843 /* Flag all writing completed successfully. */
844
845 written_ok = TRUE;
846
847 /* Come here if there are errors during writing. */
848
849 END_WRITE:
850
851 /* OK, the writing is now all done. Close the pipe. */
852
853 (void) close(fd_in);
854
855 /* Handle errors during writing. For timeouts, set the timeout for waiting for
856 the child process to 1 second. If the process at the far end of the pipe died
857 without reading all of it, we expect an EPIPE error, which should be ignored.
858 We used also to ignore WRITEINCOMPLETE but the writing function is now cleverer
859 at handling OS where the death of a pipe doesn't give EPIPE immediately. See
860 comments therein. */
861
862 if (!written_ok)
863 {
864 if (errno == ETIMEDOUT)
865 {
866 addr->message = string_sprintf("%stimeout while writing to pipe",
867 transport_filter_timed_out? "transport filter " : "");
868 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
869 timeout = 1;
870 }
871 else if (errno == EPIPE)
872 {
873 debug_printf("transport error EPIPE ignored\n");
874 }
875 else
876 {
877 addr->transport_return = PANIC;
878 addr->basic_errno = errno;
879 if (errno == ERRNO_CHHEADER_FAIL)
880 addr->message =
881 string_sprintf("Failed to expand headers_add or headers_remove: %s",
882 expand_string_message);
883 else if (errno == ERRNO_FILTER_FAIL)
884 addr->message = string_sprintf("Transport filter process failed (%d)%s",
885 addr->more_errno,
886 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
887 else if (errno == ERRNO_WRITEINCOMPLETE)
888 addr->message = string_sprintf("Failed repeatedly to write data");
889 else
890 addr->message = string_sprintf("Error %d", errno);
891 return FALSE;
892 }
893 }
894
895 /* Wait for the child process to complete and take action if the returned
896 status is nonzero. The timeout will be just 1 second if any of the writes
897 above timed out. */
898
899 if ((rc = child_close(pid, timeout)) != 0)
900 {
901 uschar *tmsg = (addr->message == NULL)? US"" :
902 string_sprintf(" (preceded by %s)", addr->message);
903
904 /* The process did not complete in time; kill its process group and fail
905 the delivery. It appears to be necessary to kill the output process too, as
906 otherwise it hangs on for some time if the actual pipe process is sleeping.
907 (At least, that's what I observed on Solaris 2.5.1.) Since we are failing
908 the delivery, that shouldn't cause any problem. */
909
910 if (rc == -256)
911 {
912 killpg(pid, SIGKILL);
913 kill(outpid, SIGKILL);
914 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
915 addr->message = string_sprintf("pipe delivery process timed out%s", tmsg);
916 }
917
918 /* Wait() failed. */
919
920 else if (rc == -257)
921 {
922 addr->transport_return = PANIC;
923 addr->message = string_sprintf("Wait() failed for child process of %s "
924 "transport: %s%s", tblock->name, strerror(errno), tmsg);
925 }
926
927 /* Either the process completed, but yielded a non-zero (necessarily
928 positive) status, or the process was terminated by a signal (rc will contain
929 the negation of the signal number). Treat killing by signal as failure unless
930 status is being ignored. */
931
932 else if (rc < 0)
933 {
934 if (!ob->ignore_status)
935 {
936 addr->transport_return = FAIL;
937 addr->message = string_sprintf("Child process of %s transport (running "
938 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
939 -rc, os_strsignal(-rc), tmsg);
940 }
941 }
942
943 /* For positive values (process terminated with non-zero status), we need a
944 status code to request deferral. A number of systems contain the following
945 line in sysexits.h:
946
947 #define EX_TEMPFAIL 75
948
949 with the description
950
951 EX_TEMPFAIL -- temporary failure, indicating something that
952 is not really an error. In sendmail, this means
953 that a mailer (e.g.) could not create a connection,
954 and the request should be reattempted later.
955
956 Based on this, we use exit code EX_TEMPFAIL as a default to mean "defer" when
957 not ignoring the returned status. However, there is now an option that
958 contains a list of temporary codes, with TEMPFAIL and CANTCREAT as defaults.
959
960 Another case that needs special treatment is if execve() failed (typically
961 the command that was given is a non-existent path). By default this is
962 treated as just another failure, but if freeze_exec_fail is set, the reaction
963 is to freeze the message rather than bounce the address. Exim used to signal
964 this failure with EX_UNAVAILABLE, which is definined in many systems as
965
966 #define EX_UNAVAILABLE 69
967
968 with the description
969
970 EX_UNAVAILABLE -- A service is unavailable. This can occur
971 if a support program or file does not exist. This
972 can also be used as a catchall message when something
973 you wanted to do doesn't work, but you don't know why.
974
975 However, this can be confused with a command that actually returns 69 because
976 something *it* wanted is unavailable. At release 4.21, Exim was changed to
977 use return code 127 instead, because this is what the shell returns when it
978 is unable to exec a command. We define it as EX_EXECFAILED, and use it in
979 child.c to signal execve() failure and other unexpected failures such as
980 setuid() not working - though that won't be the case here because we aren't
981 changing uid. */
982
983 else
984 {
985 /* Always handle execve() failure specially if requested to */
986
987 if (ob->freeze_exec_fail && (rc == EX_EXECFAILED))
988 {
989 addr->transport_return = DEFER;
990 addr->special_action = SPECIAL_FREEZE;
991 addr->message = string_sprintf("pipe process failed to exec \"%s\"%s",
992 cmd, tmsg);
993 }
994
995 /* Otherwise take action only if not ignoring status */
996
997 else if (!ob->ignore_status)
998 {
999 uschar *ss;
1000 int size, ptr, i;
1001
1002 /* If temp_errors is "*" all codes are temporary. Initializion checks
1003 that it's either "*" or a list of numbers. If not "*", scan the list of
1004 temporary failure codes; if any match, the result is DEFER. */
1005
1006 if (ob->temp_errors[0] == '*')
1007 addr->transport_return = DEFER;
1008
1009 else
1010 {
1011 uschar *s = ob->temp_errors;
1012 uschar *p;
1013 uschar buffer[64];
1014 int sep = 0;
1015
1016 addr->transport_return = FAIL;
1017 while ((p = string_nextinlist(&s,&sep,buffer,sizeof(buffer))) != NULL)
1018 {
1019 if (rc == Uatoi(p)) { addr->transport_return = DEFER; break; }
1020 }
1021 }
1022
1023 /* Ensure the message contains the expanded command and arguments. This
1024 doesn't have to be brilliantly efficient - it is an error situation. */
1025
1026 addr->message = string_sprintf("Child process of %s transport returned "
1027 "%d", tblock->name, rc);
1028
1029 ptr = Ustrlen(addr->message);
1030 size = ptr + 1;
1031
1032 /* If the return code is > 128, it often means that a shell command
1033 was terminated by a signal. */
1034
1035 ss = (rc > 128)?
1036 string_sprintf("(could mean shell command ended by signal %d (%s))",
1037 rc-128, os_strsignal(rc-128)) :
1038 US os_strexit(rc);
1039
1040 if (*ss != 0)
1041 {
1042 addr->message = string_cat(addr->message, &size, &ptr, US" ", 1);
1043 addr->message = string_cat(addr->message, &size, &ptr,
1044 ss, Ustrlen(ss));
1045 }
1046
1047 /* Now add the command and arguments */
1048
1049 addr->message = string_cat(addr->message, &size, &ptr,
1050 US" from command:", 14);
1051
1052 for (i = 0; i < sizeof(argv)/sizeof(int *) && argv[i] != NULL; i++)
1053 {
1054 BOOL quote = FALSE;
1055 addr->message = string_cat(addr->message, &size, &ptr, US" ", 1);
1056 if (Ustrpbrk(argv[i], " \t") != NULL)
1057 {
1058 quote = TRUE;
1059 addr->message = string_cat(addr->message, &size, &ptr, US"\"", 1);
1060 }
1061 addr->message = string_cat(addr->message, &size, &ptr, argv[i],
1062 Ustrlen(argv[i]));
1063 if (quote)
1064 addr->message = string_cat(addr->message, &size, &ptr, US"\"", 1);
1065 }
1066
1067 /* Add previous filter timeout message, if present. */
1068
1069 if (*tmsg != 0)
1070 addr->message = string_cat(addr->message, &size, &ptr, tmsg,
1071 Ustrlen(tmsg));
1072
1073 addr->message[ptr] = 0; /* Ensure concatenated string terminated */
1074 }
1075 }
1076 }
1077
1078 /* Ensure all subprocesses (in particular, the output handling process)
1079 are complete before we pass this point. */
1080
1081 while (wait(&rc) >= 0);
1082
1083 DEBUG(D_transport) debug_printf("%s transport yielded %d\n", tblock->name,
1084 addr->transport_return);
1085
1086 /* If there has been a problem, the message in addr->message contains details
1087 of the pipe command. We don't want to expose these to the world, so we set up
1088 something bland to return to the sender. */
1089
1090 if (addr->transport_return != OK)
1091 addr->user_message = US"local delivery failed";
1092
1093 return FALSE;
1094 }
1095
1096 /* End of transport/pipe.c */