diff options
Diffstat (limited to '')
| -rw-r--r-- | src/route.c | 1930 |
1 files changed, 1930 insertions, 0 deletions
diff --git a/src/route.c b/src/route.c new file mode 100644 index 0000000..d419d1c --- /dev/null +++ b/src/route.c @@ -0,0 +1,1930 @@ +/************************************************* +* Exim - an Internet mail transport agent * +*************************************************/ + +/* Copyright (c) University of Cambridge 1995 - 2018 */ +/* See the file NOTICE for conditions of use and distribution. */ + +/* Functions concerned with routing, and the list of generic router options. */ + + +#include "exim.h" + + + +/* Generic options for routers, all of which live inside router_instance +data blocks and which therefore have the opt_public flag set. */ + +optionlist optionlist_routers[] = { + { "*expand_group", opt_stringptr | opt_hidden | opt_public, + (void *)(offsetof(router_instance, expand_gid)) }, + { "*expand_more", opt_stringptr | opt_hidden | opt_public, + (void *)(offsetof(router_instance, expand_more)) }, + { "*expand_unseen", opt_stringptr | opt_hidden | opt_public, + (void *)(offsetof(router_instance, expand_unseen)) }, + { "*expand_user", opt_stringptr | opt_hidden | opt_public, + (void *)(offsetof(router_instance, expand_uid)) }, + { "*set_group", opt_bool | opt_hidden | opt_public, + (void *)(offsetof(router_instance, gid_set)) }, + { "*set_user", opt_bool | opt_hidden | opt_public, + (void *)(offsetof(router_instance, uid_set)) }, + { "address_data", opt_stringptr|opt_public, + (void *)(offsetof(router_instance, address_data)) }, + { "address_test", opt_bool|opt_public, + (void *)(offsetof(router_instance, address_test)) }, +#ifdef EXPERIMENTAL_BRIGHTMAIL + { "bmi_deliver_alternate", opt_bool | opt_public, + (void *)(offsetof(router_instance, bmi_deliver_alternate)) }, + { "bmi_deliver_default", opt_bool | opt_public, + (void *)(offsetof(router_instance, bmi_deliver_default)) }, + { "bmi_dont_deliver", opt_bool | opt_public, + (void *)(offsetof(router_instance, bmi_dont_deliver)) }, + { "bmi_rule", opt_stringptr|opt_public, + (void *)(offsetof(router_instance, bmi_rule)) }, +#endif + { "cannot_route_message", opt_stringptr | opt_public, + (void *)(offsetof(router_instance, cannot_route_message)) }, + { "caseful_local_part", opt_bool | opt_public, + (void *)(offsetof(router_instance, caseful_local_part)) }, + { "check_local_user", opt_bool | opt_public, + (void *)(offsetof(router_instance, check_local_user)) }, + { "condition", opt_stringptr|opt_public|opt_rep_con, + (void *)offsetof(router_instance, condition) }, + { "debug_print", opt_stringptr | opt_public, + (void *)offsetof(router_instance, debug_string) }, + { "disable_logging", opt_bool | opt_public, + (void *)offsetof(router_instance, disable_logging) }, + { "dnssec_request_domains", opt_stringptr|opt_public, + (void *)offsetof(router_instance, dnssec.request) }, + { "dnssec_require_domains", opt_stringptr|opt_public, + (void *)offsetof(router_instance, dnssec.require) }, + { "domains", opt_stringptr|opt_public, + (void *)offsetof(router_instance, domains) }, + { "driver", opt_stringptr|opt_public, + (void *)offsetof(router_instance, driver_name) }, + { "dsn_lasthop", opt_bool|opt_public, + (void *)offsetof(router_instance, dsn_lasthop) }, + { "errors_to", opt_stringptr|opt_public, + (void *)(offsetof(router_instance, errors_to)) }, + { "expn", opt_bool|opt_public, + (void *)offsetof(router_instance, expn) }, + { "fail_verify", opt_bool_verify|opt_hidden|opt_public, + (void *)offsetof(router_instance, fail_verify_sender) }, + { "fail_verify_recipient", opt_bool|opt_public, + (void *)offsetof(router_instance, fail_verify_recipient) }, + { "fail_verify_sender", opt_bool|opt_public, + (void *)offsetof(router_instance, fail_verify_sender) }, + { "fallback_hosts", opt_stringptr|opt_public, + (void *)offsetof(router_instance, fallback_hosts) }, + { "group", opt_expand_gid | opt_public, + (void *)(offsetof(router_instance, gid)) }, + { "headers_add", opt_stringptr|opt_public|opt_rep_str, + (void *)offsetof(router_instance, extra_headers) }, + { "headers_remove", opt_stringptr|opt_public|opt_rep_str, + (void *)offsetof(router_instance, remove_headers) }, + { "ignore_target_hosts",opt_stringptr|opt_public, + (void *)offsetof(router_instance, ignore_target_hosts) }, + { "initgroups", opt_bool | opt_public, + (void *)(offsetof(router_instance, initgroups)) }, + { "local_part_prefix", opt_stringptr|opt_public, + (void *)offsetof(router_instance, prefix) }, + { "local_part_prefix_optional",opt_bool|opt_public, + (void *)offsetof(router_instance, prefix_optional) }, + { "local_part_suffix", opt_stringptr|opt_public, + (void *)offsetof(router_instance, suffix) }, + { "local_part_suffix_optional",opt_bool|opt_public, + (void *)offsetof(router_instance, suffix_optional) }, + { "local_parts", opt_stringptr|opt_public, + (void *)offsetof(router_instance, local_parts) }, + { "log_as_local", opt_bool|opt_public, + (void *)offsetof(router_instance, log_as_local) }, + { "more", opt_expand_bool|opt_public, + (void *)offsetof(router_instance, more) }, + { "pass_on_timeout", opt_bool|opt_public, + (void *)offsetof(router_instance, pass_on_timeout) }, + { "pass_router", opt_stringptr|opt_public, + (void *)offsetof(router_instance, pass_router_name) }, + { "redirect_router", opt_stringptr|opt_public, + (void *)offsetof(router_instance, redirect_router_name) }, + { "require_files", opt_stringptr|opt_public, + (void *)offsetof(router_instance, require_files) }, + { "retry_use_local_part", opt_bool|opt_public, + (void *)offsetof(router_instance, retry_use_local_part) }, + { "router_home_directory", opt_stringptr|opt_public, + (void *)offsetof(router_instance, router_home_directory) }, + { "self", opt_stringptr|opt_public, + (void *)(offsetof(router_instance, self)) }, + { "senders", opt_stringptr|opt_public, + (void *)offsetof(router_instance, senders) }, + #ifdef SUPPORT_TRANSLATE_IP_ADDRESS + { "translate_ip_address", opt_stringptr|opt_public, + (void *)offsetof(router_instance, translate_ip_address) }, + #endif + { "transport", opt_stringptr|opt_public, + (void *)offsetof(router_instance, transport_name) }, + { "transport_current_directory", opt_stringptr|opt_public, + (void *)offsetof(router_instance, current_directory) }, + { "transport_home_directory", opt_stringptr|opt_public, + (void *)offsetof(router_instance, home_directory) }, + { "unseen", opt_expand_bool|opt_public, + (void *)offsetof(router_instance, unseen) }, + { "user", opt_expand_uid | opt_public, + (void *)(offsetof(router_instance, uid)) }, + { "verify", opt_bool_verify|opt_hidden|opt_public, + (void *)offsetof(router_instance, verify_sender) }, + { "verify_only", opt_bool|opt_public, + (void *)offsetof(router_instance, verify_only) }, + { "verify_recipient", opt_bool|opt_public, + (void *)offsetof(router_instance, verify_recipient) }, + { "verify_sender", opt_bool|opt_public, + (void *)offsetof(router_instance, verify_sender) } +}; + +int optionlist_routers_size = nelem(optionlist_routers); + + +#ifdef MACRO_PREDEF + +# include "macro_predef.h" + +void +options_routers(void) +{ +struct router_info * ri; +uschar buf[64]; + +options_from_list(optionlist_routers, nelem(optionlist_routers), US"ROUTERS", NULL); + +for (ri = routers_available; ri->driver_name[0]; ri++) + { + spf(buf, sizeof(buf), US"_DRIVER_ROUTER_%T", ri->driver_name); + builtin_macro_create(buf); + options_from_list(ri->options, (unsigned)*ri->options_count, US"ROUTER", ri->driver_name); + } +} + +#else /*!MACRO_PREDEF*/ + +/************************************************* +* Set router pointer from name * +*************************************************/ + +/* This function is used for the redirect_router and pass_router options and +called from route_init() below. + +Arguments: + r the current router + name new router name + ptr where to put the pointer + after TRUE if router must follow this one + +Returns: nothing. +*/ + +static void +set_router(router_instance *r, uschar *name, router_instance **ptr, BOOL after) +{ +BOOL afterthis = FALSE; +router_instance *rr; + +for (rr = routers; rr; rr = rr->next) + { + if (Ustrcmp(name, rr->name) == 0) + { + *ptr = rr; + break; + } + if (rr == r) afterthis = TRUE; + } + +if (!rr) + log_write(0, LOG_PANIC_DIE|LOG_CONFIG, + "new_router \"%s\" not found for \"%s\" router", name, r->name); + +if (after && !afterthis) + log_write(0, LOG_PANIC_DIE|LOG_CONFIG, + "new_router \"%s\" does not follow \"%s\" router", name, r->name); +} + + + +/************************************************* +* Initialize router list * +*************************************************/ + +/* Read the routers section of the configuration file, and set up a chain of +router instances according to its contents. Each router has generic options and +may also have its own private options. This function is only ever called when +routers == NULL. We use generic code in readconf to do the work. It will set +values from the configuration file, and then call the driver's initialization +function. */ + +void +route_init(void) +{ +router_instance *r; + +readconf_driver_init(US"router", + (driver_instance **)(&routers), /* chain anchor */ + (driver_info *)routers_available, /* available drivers */ + sizeof(router_info), /* size of info blocks */ + &router_defaults, /* default values for generic options */ + sizeof(router_instance), /* size of instance block */ + optionlist_routers, /* generic options */ + optionlist_routers_size); + +for (r = routers; r; r = r->next) + { + uschar *s = r->self; + + /* If log_as_local is unset, its overall default is FALSE. (The accept + router defaults it to TRUE.) */ + + if (r->log_as_local == TRUE_UNSET) r->log_as_local = FALSE; + + /* Check for transport or no transport on certain routers */ + + if ( (r->info->ri_flags & ri_yestransport) + && !r->transport_name && !r->verify_only) + log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n " + "a transport is required for this router", r->name); + + if ((r->info->ri_flags & ri_notransport) && r->transport_name) + log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n " + "a transport must not be defined for this router", r->name); + + /* The "self" option needs to be decoded into a code value and possibly a + new domain string and a rewrite boolean. */ + + if (Ustrcmp(s, "freeze") == 0) r->self_code = self_freeze; + else if (Ustrcmp(s, "defer") == 0) r->self_code = self_defer; + else if (Ustrcmp(s, "send") == 0) r->self_code = self_send; + else if (Ustrcmp(s, "pass") == 0) r->self_code = self_pass; + else if (Ustrcmp(s, "fail") == 0) r->self_code = self_fail; + else if (Ustrncmp(s, "reroute:", 8) == 0) + { + s += 8; + while (isspace(*s)) s++; + if (Ustrncmp(s, "rewrite:", 8) == 0) + { + r->self_rewrite = TRUE; + s += 8; + while (isspace(*s)) s++; + } + r->self = s; + r->self_code = self_reroute; + } + + else log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s router:\n " + "%s is not valid for the self option", r->name, s); + + /* If any router has check_local_user set, default retry_use_local_part + TRUE; otherwise its default is FALSE. */ + + if (r->retry_use_local_part == TRUE_UNSET) + r->retry_use_local_part = r->check_local_user; + + /* Build a host list if fallback hosts is set. */ + + host_build_hostlist(&(r->fallback_hostlist), r->fallback_hosts, FALSE); + + /* Check redirect_router and pass_router are valid */ + + if (r->redirect_router_name) + set_router(r, r->redirect_router_name, &(r->redirect_router), FALSE); + + if (r->pass_router_name) + set_router(r, r->pass_router_name, &(r->pass_router), TRUE); + +#ifdef notdef + DEBUG(D_route) debug_printf("DSN: %s %s\n", r->name, + r->dsn_lasthop ? "lasthop set" : "propagating DSN"); +#endif + } +} + + + +/************************************************* +* Tidy up after routing * +*************************************************/ + +/* Routers are entitled to keep hold of certain resources in their instance +blocks so as to save setting them up each time. An example is an open file. +Such routers must provide a tidyup entry point which is called when all routing +is finished, via this function. */ + +void +route_tidyup(void) +{ +router_instance *r; +for (r = routers; r; r = r->next) + if (r->info->tidyup) (r->info->tidyup)(r); +} + + + +/************************************************* +* Check local part for prefix * +*************************************************/ + +/* This function is handed a local part and a list of possible prefixes; if any +one matches, return the prefix length. A prefix beginning with '*' is a +wildcard. + +Arguments: + local_part the local part to check + prefixes the list of prefixes + +Returns: length of matching prefix or zero +*/ + +int +route_check_prefix(const uschar *local_part, const uschar *prefixes) +{ +int sep = 0; +uschar *prefix; +const uschar *listptr = prefixes; +uschar prebuf[64]; + +while ((prefix = string_nextinlist(&listptr, &sep, prebuf, sizeof(prebuf)))) + { + int plen = Ustrlen(prefix); + if (prefix[0] == '*') + { + const uschar *p; + prefix++; + for (p = local_part + Ustrlen(local_part) - (--plen); + p >= local_part; p--) + if (strncmpic(prefix, p, plen) == 0) return plen + p - local_part; + } + else + if (strncmpic(prefix, local_part, plen) == 0) return plen; + } + +return 0; +} + + + +/************************************************* +* Check local part for suffix * +*************************************************/ + +/* This function is handed a local part and a list of possible suffixes; +if any one matches, return the suffix length. A suffix ending with '*' +is a wildcard. + +Arguments: + local_part the local part to check + suffixes the list of suffixes + +Returns: length of matching suffix or zero +*/ + +int +route_check_suffix(const uschar *local_part, const uschar *suffixes) +{ +int sep = 0; +int alen = Ustrlen(local_part); +uschar *suffix; +const uschar *listptr = suffixes; +uschar sufbuf[64]; + +while ((suffix = string_nextinlist(&listptr, &sep, sufbuf, sizeof(sufbuf)))) + { + int slen = Ustrlen(suffix); + if (suffix[slen-1] == '*') + { + const uschar *p, *pend; + pend = local_part + alen - (--slen) + 1; + for (p = local_part; p < pend; p++) + if (strncmpic(suffix, p, slen) == 0) return alen - (p - local_part); + } + else + if (alen > slen && strncmpic(suffix, local_part + alen - slen, slen) == 0) + return slen; + } + +return 0; +} + + + + +/************************************************* +* Check local part, domain, or sender * +*************************************************/ + +/* The checks in check_router_conditions() require similar code, so we use +this function to save repetition. + +Arguments: + rname router name for error messages + type type of check, for error message + list domains, local_parts, or senders list + anchorptr -> tree for possibly cached items (domains) + cache_bits cached bits pointer + listtype MCL_DOMAIN for domain check + MCL_LOCALPART for local part check + MCL_ADDRESS for sender check + domloc current domain, current local part, or NULL for sender check + ldata where to put lookup data + caseless passed on to match_isinlist() + perror where to put an error message + +Returns: OK item is in list + SKIP item is not in list, router is to be skipped + DEFER lookup or other defer +*/ + +static int +route_check_dls(uschar *rname, uschar *type, const uschar *list, + tree_node **anchorptr, unsigned int *cache_bits, int listtype, + const uschar *domloc, const uschar **ldata, BOOL caseless, uschar **perror) +{ +if (!list) return OK; /* Empty list always succeeds */ + +DEBUG(D_route) debug_printf("checking %s\n", type); + +/* The domain and local part use the same matching function, whereas sender +has its own code. */ + +switch(domloc + ? match_isinlist(domloc, &list, 0, anchorptr, cache_bits, listtype, + caseless, ldata) + : match_address_list(sender_address ? sender_address : US"", + TRUE, TRUE, &list, cache_bits, -1, 0, CUSS &sender_data) + ) + { + case OK: + return OK; + + case FAIL: + *perror = string_sprintf("%s router skipped: %s mismatch", rname, type); + DEBUG(D_route) debug_printf("%s\n", *perror); + return SKIP; + + default: /* Paranoia, and keeps compilers happy */ + case DEFER: + *perror = string_sprintf("%s check lookup or other defer", type); + DEBUG(D_route) debug_printf("%s\n", *perror); + return DEFER; + } +} + + + +/************************************************* +* Check access by a given uid/gid * +*************************************************/ + +/* This function checks whether a given uid/gid has access to a given file or +directory. It is called only from check_files() below. This is hopefully a +cheapish check that does the job most of the time. Exim does *not* rely on this +test when actually accessing any file. The test is used when routing to make it +possible to take actions such as "if user x can access file y then run this +router". + +During routing, Exim is normally running as root, and so the test will work +except for NFS non-root mounts. When verifying during message reception, Exim +is running as "exim", so the test may not work. This is a limitation of the +Exim design. + +Code in check_files() below detects the case when it cannot stat() the file (as +root), and in that situation it uses a setuid subprocess in which to run this +test. + +Arguments: + path the path to check + uid the user + gid the group + bits the bits required in the final component + +Returns: TRUE + FALSE errno=EACCES or ENOENT (or others from realpath or stat) +*/ + +static BOOL +route_check_access(uschar *path, uid_t uid, gid_t gid, int bits) +{ +struct stat statbuf; +uschar *slash; +uschar *rp = US realpath(CS path, CS big_buffer); +uschar *sp = rp + 1; + +DEBUG(D_route) debug_printf("route_check_access(%s,%d,%d,%o)\n", path, + (int)uid, (int)gid, bits); + +if (!rp) return FALSE; + +while ((slash = Ustrchr(sp, '/'))) + { + *slash = 0; + DEBUG(D_route) debug_printf("stat %s\n", rp); + if (Ustat(rp, &statbuf) < 0) return FALSE; + if ((statbuf.st_mode & + ((statbuf.st_uid == uid)? 0100 : (statbuf.st_gid == gid)? 0010 : 001) + ) == 0) + { + errno = EACCES; + return FALSE; + } + *slash = '/'; + sp = slash + 1; + } + +/* Down to the final component */ + +DEBUG(D_route) debug_printf("stat %s\n", rp); + +if (Ustat(rp, &statbuf) < 0) return FALSE; + +if (statbuf.st_uid == uid) bits = bits << 6; + else if (statbuf.st_gid == gid) bits = bits << 3; +if ((statbuf.st_mode & bits) != bits) + { + errno = EACCES; + return FALSE; + } + +DEBUG(D_route) debug_printf("route_check_access() succeeded\n"); +return TRUE; +} + + + +/************************************************* +* Do file existence tests * +*************************************************/ + +/* This function is given a colon-separated list of file tests, each of which +is expanded before use. A test consists of a file name, optionally preceded by +! (require non-existence) and/or + for handling permission denied (+ means +treat as non-existing). + +An item that contains no slashes is interpreted as a username or id, with an +optional group id, for checking access to the file. This cannot be done +"perfectly", but it is good enough for a number of applications. + +Arguments: + s a colon-separated list of file tests or NULL + perror a pointer to an anchor for an error text in the case of a DEFER + +Returns: OK if s == NULL or all tests are as required + DEFER if the existence of at least one of the files is + unclear (an error other than non-existence occurred); + DEFER if an expansion failed + DEFER if a name is not absolute + DEFER if problems with user/group + SKIP otherwise +*/ + +static int +check_files(const uschar *s, uschar **perror) +{ +int sep = 0; /* List has default separators */ +uid_t uid = 0; /* For picky compilers */ +gid_t gid = 0; /* For picky compilers */ +BOOL ugid_set = FALSE; +const uschar *listptr; +uschar *check; +uschar buffer[1024]; + +if (!s) return OK; + +DEBUG(D_route) debug_printf("checking require_files\n"); + +listptr = s; +while ((check = string_nextinlist(&listptr, &sep, buffer, sizeof(buffer)))) + { + int rc; + int eacces_code = 0; + BOOL invert = FALSE; + struct stat statbuf; + uschar *ss = expand_string(check); + + if (!ss) + { + if (f.expand_string_forcedfail) continue; + *perror = string_sprintf("failed to expand \"%s\" for require_files: %s", + check, expand_string_message); + goto RETURN_DEFER; + } + + /* Empty items are just skipped */ + + if (*ss == 0) continue; + + /* If there are no slashes in the string, we have a user name or uid, with + optional group/gid. */ + + if (Ustrchr(ss, '/') == NULL) + { + BOOL ok; + struct passwd *pw; + uschar *comma = Ustrchr(ss, ','); + + /* If there's a comma, temporarily terminate the user name/number + at that point. Then set the uid. */ + + if (comma != NULL) *comma = 0; + ok = route_finduser(ss, &pw, &uid); + if (comma != NULL) *comma = ','; + + if (!ok) + { + *perror = string_sprintf("user \"%s\" for require_files not found", ss); + goto RETURN_DEFER; + } + + /* If there was no comma, the gid is that associated with the user. */ + + if (comma == NULL) + { + if (pw != NULL) gid = pw->pw_gid; else + { + *perror = string_sprintf("group missing after numerical uid %d for " + "require_files", (int)uid); + goto RETURN_DEFER; + } + } + else + { + if (!route_findgroup(comma + 1, &gid)) + { + *perror = string_sprintf("group \"%s\" for require_files not found\n", + comma + 1); + goto RETURN_DEFER; + } + } + + /* Note that we have values set, and proceed to next item */ + + DEBUG(D_route) + debug_printf("check subsequent files for access by %s\n", ss); + ugid_set = TRUE; + continue; + } + + /* Path, possibly preceded by + and ! */ + + if (*ss == '+') + { + eacces_code = 1; + while (isspace((*(++ss)))); + } + + if (*ss == '!') + { + invert = TRUE; + while (isspace((*(++ss)))); + } + + if (*ss != '/') + { + *perror = string_sprintf("require_files: \"%s\" is not absolute", ss); + goto RETURN_DEFER; + } + + /* Stat the file, either as root (while routing) or as exim (while verifying + during message reception). */ + + rc = Ustat(ss, &statbuf); + + DEBUG(D_route) + { + debug_printf("file check: %s\n", check); + if (ss != check) debug_printf("expanded file: %s\n", ss); + debug_printf("stat() yielded %d\n", rc); + } + + /* If permission is denied, and we are running as root (i.e. routing for + delivery rather than verifying), and the requirement is to test for access by + a particular uid/gid, it must mean that the file is on a non-root-mounted NFS + system. In this case, we have to use a subprocess that runs as the relevant + uid in order to do the test. */ + + if (rc != 0 && errno == EACCES && ugid_set && getuid() == root_uid) + { + int status; + pid_t pid; + void (*oldsignal)(int); + + DEBUG(D_route) debug_printf("root is denied access: forking to check " + "in subprocess\n"); + + /* Before forking, ensure that SIGCHLD is set to SIG_DFL before forking, so + that the child process can be waited for, just in case get here with it set + otherwise. Save the old state for resetting on the wait. */ + + oldsignal = signal(SIGCHLD, SIG_DFL); + pid = fork(); + + /* If fork() fails, reinstate the original error and behave as if + this block of code were not present. This is the same behaviour as happens + when Exim is not running as root at this point. */ + + if (pid < 0) + { + DEBUG(D_route) + debug_printf("require_files: fork failed: %s\n", strerror(errno)); + errno = EACCES; + goto HANDLE_ERROR; + } + + /* In the child process, change uid and gid, and then do the check using + the route_check_access() function. This does more than just stat the file; + it tests permissions as well. Return 0 for OK and 1 for failure. */ + + if (pid == 0) + { + exim_setugid(uid, gid, TRUE, + string_sprintf("require_files check, file=%s", ss)); + if (route_check_access(ss, uid, gid, 4)) _exit(0); + DEBUG(D_route) debug_printf("route_check_access() failed\n"); + _exit(1); + } + + /* In the parent, wait for the child to finish */ + + while (waitpid(pid, &status, 0) < 0) + { + if (errno != EINTR) /* unexpected error, interpret as failure */ + { + status = 1; + break; + } + } + + signal(SIGCHLD, oldsignal); /* restore */ + if ((status == 0) == invert) return SKIP; + continue; /* to test the next file */ + } + + /* Control reaches here if the initial stat() succeeds, or fails with an + error other than EACCES, or no uid/gid is set, or we are not running as root. + If we know the file exists and uid/gid are set, try to check read access for + that uid/gid as best we can. */ + + if (rc == 0 && ugid_set && !route_check_access(ss, uid, gid, 4)) + { + DEBUG(D_route) debug_printf("route_check_access() failed\n"); + rc = -1; + } + + /* Handle error returns from stat() or route_check_access(). The EACCES error + is handled specially. At present, we can force it to be treated as + non-existence. Write the code so that it will be easy to add forcing for + existence if required later. */ + + HANDLE_ERROR: + if (rc < 0) + { + DEBUG(D_route) debug_printf("errno = %d\n", errno); + if (errno == EACCES) + { + if (eacces_code == 1) + { + DEBUG(D_route) debug_printf("EACCES => ENOENT\n"); + errno = ENOENT; /* Treat as non-existent */ + } + } + if (errno != ENOENT) + { + *perror = string_sprintf("require_files: error for %s: %s", ss, + strerror(errno)); + goto RETURN_DEFER; + } + } + + /* At this point, rc < 0 => non-existence; rc >= 0 => existence */ + + if ((rc >= 0) == invert) return SKIP; + } + +return OK; + +/* Come here on any of the errors that return DEFER. */ + +RETURN_DEFER: +DEBUG(D_route) debug_printf("%s\n", *perror); +return DEFER; +} + + + + + +/************************************************* +* Check for router skipping * +*************************************************/ + +/* This function performs various checks to see whether a router should be +skipped. The order in which they are performed is important. + +Arguments: + r pointer to router instance block + addr address that is being handled + verify the verification type + pw ptr to ptr to passwd structure for local user + perror for lookup errors + +Returns: OK if all the tests succeed + SKIP if router is to be skipped + DEFER for a lookup defer + FAIL for address to be failed +*/ + +static BOOL +check_router_conditions(router_instance *r, address_item *addr, int verify, + struct passwd **pw, uschar **perror) +{ +int rc; +uschar *check_local_part; +unsigned int *localpart_cache; + +/* Reset variables to hold a home directory and data from lookup of a domain or +local part, and ensure search_find_defer is unset, in case there aren't any +actual lookups. */ + +deliver_home = NULL; +deliver_domain_data = NULL; +deliver_localpart_data = NULL; +sender_data = NULL; +local_user_gid = (gid_t)(-1); +local_user_uid = (uid_t)(-1); +f.search_find_defer = FALSE; + +/* Skip this router if not verifying and it has verify_only set */ + +if ((verify == v_none || verify == v_expn) && r->verify_only) + { + DEBUG(D_route) debug_printf("%s router skipped: verify_only set\n", r->name); + return SKIP; + } + +/* Skip this router if testing an address (-bt) and address_test is not set */ + +if (f.address_test_mode && !r->address_test) + { + DEBUG(D_route) debug_printf("%s router skipped: address_test is unset\n", + r->name); + return SKIP; + } + +/* Skip this router if verifying and it hasn't got the appropriate verify flag +set. */ + +if ((verify == v_sender && !r->verify_sender) || + (verify == v_recipient && !r->verify_recipient)) + { + DEBUG(D_route) debug_printf("%s router skipped: verify %d %d %d\n", + r->name, verify, r->verify_sender, r->verify_recipient); + return SKIP; + } + +/* Skip this router if processing EXPN and it doesn't have expn set */ + +if (verify == v_expn && !r->expn) + { + DEBUG(D_route) debug_printf("%s router skipped: no_expn set\n", r->name); + return SKIP; + } + +/* Skip this router if there's a domain mismatch. */ + +if ((rc = route_check_dls(r->name, US"domains", r->domains, &domainlist_anchor, + addr->domain_cache, TRUE, addr->domain, CUSS &deliver_domain_data, + MCL_DOMAIN, perror)) != OK) + return rc; + +/* Skip this router if there's a local part mismatch. We want to pass over the +caseful local part, so that +caseful can restore it, even if this router is +handling local parts caselessly. However, we can't just pass cc_local_part, +because that doesn't have the prefix or suffix stripped. A bit of massaging is +required. Also, we only use the match cache for local parts that have not had +a prefix or suffix stripped. */ + +if (!addr->prefix && !addr->suffix) + { + localpart_cache = addr->localpart_cache; + check_local_part = addr->cc_local_part; + } +else + { + localpart_cache = NULL; + check_local_part = string_copy(addr->cc_local_part); + if (addr->prefix) + check_local_part += Ustrlen(addr->prefix); + if (addr->suffix) + check_local_part[Ustrlen(check_local_part) - Ustrlen(addr->suffix)] = 0; + } + +if ((rc = route_check_dls(r->name, US"local_parts", r->local_parts, + &localpartlist_anchor, localpart_cache, MCL_LOCALPART, + check_local_part, CUSS &deliver_localpart_data, + !r->caseful_local_part, perror)) != OK) + return rc; + +/* If the check_local_user option is set, check that the local_part is the +login of a local user. Note: the third argument to route_finduser() must be +NULL here, to prevent a numeric string being taken as a numeric uid. If the +user is found, set deliver_home to the home directory, and also set +local_user_{uid,gid}. */ + +if (r->check_local_user) + { + DEBUG(D_route) debug_printf("checking for local user\n"); + if (!route_finduser(addr->local_part, pw, NULL)) + { + DEBUG(D_route) debug_printf("%s router skipped: %s is not a local user\n", + r->name, addr->local_part); + return SKIP; + } + deliver_home = string_copy(US (*pw)->pw_dir); + local_user_gid = (*pw)->pw_gid; + local_user_uid = (*pw)->pw_uid; + } + +/* Set (or override in the case of check_local_user) the home directory if +router_home_directory is set. This is done here so that it overrides $home from +check_local_user before any subsequent expansions are done. Otherwise, $home +could mean different things for different options, which would be extremely +confusing. */ + +if (r->router_home_directory) + { + uschar *router_home = expand_string(r->router_home_directory); + if (!router_home) + { + if (!f.expand_string_forcedfail) + { + *perror = string_sprintf("failed to expand \"%s\" for " + "router_home_directory: %s", r->router_home_directory, + expand_string_message); + return DEFER; + } + } + else + { + setflag(addr, af_home_expanded); /* Note set from router_home_directory */ + deliver_home = router_home; + } + } + +/* Skip if the sender condition is not met. We leave this one till after the +local user check so that $home is set - enabling the possibility of letting +individual recipients specify lists of acceptable/unacceptable senders. */ + +if ((rc = route_check_dls(r->name, US"senders", r->senders, NULL, + sender_address_cache, MCL_ADDRESS, NULL, NULL, FALSE, perror)) != OK) + return rc; + +/* This is the point at which we print out the router's debugging string if it +is set. We wait till here so as to have $home available for local users (and +anyway, we don't want too much stuff for skipped routers). */ + +debug_print_string(r->debug_string); + +/* Perform file existence tests. */ + +if ((rc = check_files(r->require_files, perror)) != OK) + { + DEBUG(D_route) debug_printf("%s router %s: file check\n", r->name, + (rc == SKIP)? "skipped" : "deferred"); + return rc; + } + +/* Now the general condition test. */ + +if (r->condition) + { + DEBUG(D_route) debug_printf("checking \"condition\" \"%.80s\"...\n", r->condition); + if (!expand_check_condition(r->condition, r->name, US"router")) + { + if (f.search_find_defer) + { + *perror = US"condition check lookup defer"; + DEBUG(D_route) debug_printf("%s\n", *perror); + return DEFER; + } + DEBUG(D_route) + debug_printf("%s router skipped: condition failure\n", r->name); + return SKIP; + } + } + +#ifdef EXPERIMENTAL_BRIGHTMAIL +/* check if a specific Brightmail AntiSpam rule fired on the message */ +if (r->bmi_rule) + { + DEBUG(D_route) debug_printf("checking bmi_rule\n"); + if (bmi_check_rule(bmi_base64_verdict, r->bmi_rule) == 0) + { /* none of the rules fired */ + DEBUG(D_route) + debug_printf("%s router skipped: none of bmi_rule rules fired\n", r->name); + return SKIP; + } + } + +/* check if message should not be delivered */ +if (r->bmi_dont_deliver && bmi_deliver == 1) + { + DEBUG(D_route) + debug_printf("%s router skipped: bmi_dont_deliver is FALSE\n", r->name); + return SKIP; + } + +/* check if message should go to an alternate location */ +if ( r->bmi_deliver_alternate + && (bmi_deliver == 0 || !bmi_alt_location) + ) + { + DEBUG(D_route) + debug_printf("%s router skipped: bmi_deliver_alternate is FALSE\n", r->name); + return SKIP; + } + +/* check if message should go to default location */ +if ( r->bmi_deliver_default + && (bmi_deliver == 0 || bmi_alt_location) + ) + { + DEBUG(D_route) + debug_printf("%s router skipped: bmi_deliver_default is FALSE\n", r->name); + return SKIP; + } +#endif + +/* All the checks passed. */ + +return OK; +} + + + + +/************************************************* +* Find a local user * +*************************************************/ + +/* Try several times (if configured) to find a local user, in case delays in +NIS or NFS whatever cause an incorrect refusal. It's a pity that getpwnam() +doesn't have some kind of indication as to why it has failed. If the string +given consists entirely of digits, and the third argument is not NULL, assume +the string is the numerical value of the uid. Otherwise it is looked up using +getpwnam(). The uid is passed back via return_uid, if not NULL, and the +pointer to a passwd structure, if found, is passed back via pw, if not NULL. + +Because this may be called several times in succession for the same user for +different routers, cache the result of the previous getpwnam call so that it +can be re-used. Note that we can't just copy the structure, as the store it +points to can get trashed. + +Arguments: + s the login name or textual form of the numerical uid of the user + pw if not NULL, return the result of getpwnam here, or set NULL + if no call to getpwnam is made (s numeric, return_uid != NULL) + return_uid if not NULL, return the uid via this address + +Returns: TRUE if s is numerical or was looked up successfully + +*/ + +static struct passwd pwcopy; +static struct passwd *lastpw = NULL; +static uschar lastname[48] = { 0 }; +static uschar lastdir[128]; +static uschar lastgecos[128]; +static uschar lastshell[128]; + +BOOL +route_finduser(const uschar *s, struct passwd **pw, uid_t *return_uid) +{ +BOOL cache_set = (Ustrcmp(lastname, s) == 0); + +DEBUG(D_uid) debug_printf("seeking password data for user \"%s\": %s\n", s, + cache_set? "using cached result" : "cache not available"); + +if (!cache_set) + { + int i = 0; + + if (return_uid && (isdigit(*s) || *s == '-') && + s[Ustrspn(s+1, "0123456789")+1] == 0) + { + *return_uid = (uid_t)Uatoi(s); + if (pw) *pw = NULL; + return TRUE; + } + + (void)string_format(lastname, sizeof(lastname), "%s", s); + + /* Force failure if string length is greater than given maximum */ + + if (max_username_length > 0 && Ustrlen(lastname) > max_username_length) + { + DEBUG(D_uid) debug_printf("forced failure of finduser(): string " + "length of %s is greater than %d\n", lastname, max_username_length); + lastpw = NULL; + } + + /* Try a few times if so configured; this handles delays in NIS etc. */ + + else for (;;) + { + errno = 0; + if ((lastpw = getpwnam(CS s))) break; + if (++i > finduser_retries) break; + sleep(1); + } + + if (lastpw) + { + pwcopy.pw_uid = lastpw->pw_uid; + pwcopy.pw_gid = lastpw->pw_gid; + (void)string_format(lastdir, sizeof(lastdir), "%s", lastpw->pw_dir); + (void)string_format(lastgecos, sizeof(lastgecos), "%s", lastpw->pw_gecos); + (void)string_format(lastshell, sizeof(lastshell), "%s", lastpw->pw_shell); + pwcopy.pw_name = CS lastname; + pwcopy.pw_dir = CS lastdir; + pwcopy.pw_gecos = CS lastgecos; + pwcopy.pw_shell = CS lastshell; + lastpw = &pwcopy; + } + + else DEBUG(D_uid) if (errno != 0) + debug_printf("getpwnam(%s) failed: %s\n", s, strerror(errno)); + } + +if (!lastpw) + { + DEBUG(D_uid) debug_printf("getpwnam() returned NULL (user not found)\n"); + return FALSE; + } + +DEBUG(D_uid) debug_printf("getpwnam() succeeded uid=%d gid=%d\n", + lastpw->pw_uid, lastpw->pw_gid); + +if (return_uid) *return_uid = lastpw->pw_uid; +if (pw) *pw = lastpw; + +return TRUE; +} + + + + +/************************************************* +* Find a local group * +*************************************************/ + +/* Try several times (if configured) to find a local group, in case delays in +NIS or NFS whatever cause an incorrect refusal. It's a pity that getgrnam() +doesn't have some kind of indication as to why it has failed. + +Arguments: + s the group name or textual form of the numerical gid + return_gid return the gid via this address + +Returns: TRUE if the group was found; FALSE otherwise + +*/ + +BOOL +route_findgroup(uschar *s, gid_t *return_gid) +{ +int i = 0; +struct group *gr; + +if ((isdigit(*s) || *s == '-') && s[Ustrspn(s+1, "0123456789")+1] == 0) + { + *return_gid = (gid_t)Uatoi(s); + return TRUE; + } + +for (;;) + { + if ((gr = getgrnam(CS s))) + { + *return_gid = gr->gr_gid; + return TRUE; + } + if (++i > finduser_retries) break; + sleep(1); + } + +return FALSE; +} + + + + +/************************************************* +* Find user by expanding string * +*************************************************/ + +/* Expands a string, and then looks up the result in the passwd file. + +Arguments: + string the string to be expanded, yielding a login name or a numerical + uid value (to be passed to route_finduser()) + driver_name caller name for panic error message (only) + driver_type caller type for panic error message (only) + pw return passwd entry via this pointer + uid return uid via this pointer + errmsg where to point a message on failure + +Returns: TRUE if user found, FALSE otherwise +*/ + +BOOL +route_find_expanded_user(uschar *string, uschar *driver_name, + uschar *driver_type, struct passwd **pw, uid_t *uid, uschar **errmsg) +{ +uschar *user = expand_string(string); + +if (!user) + { + *errmsg = string_sprintf("Failed to expand user string \"%s\" for the " + "%s %s: %s", string, driver_name, driver_type, expand_string_message); + log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg); + return FALSE; + } + +if (route_finduser(user, pw, uid)) return TRUE; + +*errmsg = string_sprintf("Failed to find user \"%s\" from expanded string " + "\"%s\" for the %s %s", user, string, driver_name, driver_type); +log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg); +return FALSE; +} + + + +/************************************************* +* Find group by expanding string * +*************************************************/ + +/* Expands a string and then looks up the result in the group file. + +Arguments: + string the string to be expanded, yielding a group name or a numerical + gid value (to be passed to route_findgroup()) + driver_name caller name for panic error message (only) + driver_type caller type for panic error message (only) + gid return gid via this pointer + errmsg return error message via this pointer + +Returns: TRUE if found group, FALSE otherwise +*/ + +BOOL +route_find_expanded_group(uschar *string, uschar *driver_name, uschar *driver_type, + gid_t *gid, uschar **errmsg) +{ +BOOL yield = TRUE; +uschar *group = expand_string(string); + +if (!group) + { + *errmsg = string_sprintf("Failed to expand group string \"%s\" for the " + "%s %s: %s", string, driver_name, driver_type, expand_string_message); + log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg); + return FALSE; + } + +if (!route_findgroup(group, gid)) + { + *errmsg = string_sprintf("Failed to find group \"%s\" from expanded string " + "\"%s\" for the %s %s", group, string, driver_name, driver_type); + log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg); + yield = FALSE; + } + +return yield; +} + + + +/************************************************* +* Handle an unseen routing * +*************************************************/ + +/* This function is called when an address is routed by a router with "unseen" +set. It must make a clone of the address, for handling by subsequent drivers. +The clone is set to start routing at the next router. + +The original address must be replaced by an invented "parent" which has the +routed address plus the clone as its children. This is necessary in case the +address is at the top level - we don't want to mark it complete until both +deliveries have been done. + +A new unique field must be made, so that the record of the delivery isn't a +record of the original address, and checking for already delivered has +therefore to be done here. If the delivery has happened, then take the base +address off whichever delivery queue it is on - it will always be the top item. + +Arguments: + name router name + addr address that was routed + paddr_local chain of local-delivery addresses + paddr_remote chain of remote-delivery addresses + addr_new chain for newly created addresses + +Returns: nothing +*/ + +static void +route_unseen(uschar *name, address_item *addr, address_item **paddr_local, + address_item **paddr_remote, address_item **addr_new) +{ +address_item *parent = deliver_make_addr(addr->address, TRUE); +address_item *new = deliver_make_addr(addr->address, TRUE); + +/* The invented parent is a copy that replaces the original; note that +this copies its parent pointer. It has two children, and its errors_address is +from the original address' parent, if present, otherwise unset. */ + +*parent = *addr; +parent->child_count = 2; +parent->prop.errors_address = + addr->parent ? addr->parent->prop.errors_address : NULL; + +/* The routed address gets a new parent. */ + +addr->parent = parent; + +/* The clone has this parent too. Set its errors address from the parent. This +was set from the original parent (or to NULL) - see above. We do NOT want to +take the errors address from the unseen router. */ + +new->parent = parent; +new->prop.errors_address = parent->prop.errors_address; + +/* Copy the propagated flags and address_data from the original. */ + +new->prop.ignore_error = addr->prop.ignore_error; +new->prop.address_data = addr->prop.address_data; +new->dsn_flags = addr->dsn_flags; +new->dsn_orcpt = addr->dsn_orcpt; + + +/* As it has turned out, we haven't set headers_add or headers_remove for the + * clone. Thinking about it, it isn't entirely clear whether they should be + * copied from the original parent, like errors_address, or taken from the + * unseen router, like address_data and the flags. Until somebody brings this + * up, I propose to leave the code as it is. + */ + + +/* Set the cloned address to start at the next router, and put it onto the +chain of new addresses. */ + +new->start_router = addr->router->next; +new->next = *addr_new; +*addr_new = new; + +DEBUG(D_route) debug_printf("\"unseen\" set: replicated %s\n", addr->address); + +/* Make a new unique field, to distinguish from the normal one. */ + +addr->unique = string_sprintf("%s/%s", addr->unique, name); + +/* If the address has been routed to a transport, see if it was previously +delivered. If so, we take it off the relevant queue so that it isn't delivered +again. Otherwise, it was an alias or something, and the addresses it generated +are handled in the normal way. */ + +if (addr->transport && tree_search(tree_nonrecipients, addr->unique)) + { + DEBUG(D_route) + debug_printf("\"unseen\" delivery previously done - discarded\n"); + parent->child_count--; + if (*paddr_remote == addr) *paddr_remote = addr->next; + if (*paddr_local == addr) *paddr_local = addr->next; + } +} + + + +/************************************************* +* Route one address * +*************************************************/ + +/* This function is passed in one address item, for processing by the routers. +The verify flag is set if this is being called for verification rather than +delivery. If the router doesn't have its "verify" flag set, it is skipped. + +Arguments: + addr address to route + paddr_local chain of local-delivery addresses + paddr_remote chain of remote-delivery addresses + addr_new chain for newly created addresses + addr_succeed chain for completed addresses + verify v_none if not verifying + v_sender if verifying a sender address + v_recipient if verifying a recipient address + v_expn if processing an EXPN address + +Returns: OK => address successfully routed + DISCARD => address was discarded + FAIL => address could not be routed + DEFER => some temporary problem + ERROR => some major internal or configuration failure +*/ + +int +route_address(address_item *addr, address_item **paddr_local, + address_item **paddr_remote, address_item **addr_new, + address_item **addr_succeed, int verify) +{ +int yield = OK; +BOOL unseen; +router_instance *r, *nextr; +const uschar *old_domain = addr->domain; + +HDEBUG(D_route) + { + debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"); + debug_printf("routing %s\n", addr->address); + } + +/* Loop through all router instances until a router succeeds, fails, defers, or +encounters an error. If the address has start_router set, we begin from there +instead of at the first router. */ + +for (r = addr->start_router ? addr->start_router : routers; r; r = nextr) + { + uschar *error; + struct passwd *pw = NULL; + struct passwd pwcopy; + address_item *parent; + BOOL loop_detected = FALSE; + BOOL more; + int loopcount = 0; + int rc; + + DEBUG(D_route) debug_printf("--------> %s router <--------\n", r->name); + + /* Reset any search error message from the previous router. */ + + search_error_message = NULL; + + /* There are some weird cases where logging is disabled */ + + f.disable_logging = r->disable_logging; + + /* Record the last router to handle the address, and set the default + next router. */ + + addr->router = r; + nextr = r->next; + + /* Loop protection: If this address has an ancestor with the same address, + and that ancestor was routed by this router, we skip this router. This + prevents a variety of looping states when a new address is created by + redirection or by the use of "unseen" on a router. + + If no_repeat_use is set on the router, we skip if _any_ ancestor was routed + by this router, even if it was different to the current address. + + Just in case someone does put it into a loop (possible with redirection + continually adding to an address, for example), put a long stop counter on + the number of parents. */ + + for (parent = addr->parent; parent; parent = parent->parent) + { + if (parent->router == r) + { + BOOL break_loop = !r->repeat_use; + + /* When repeat_use is set, first check the active addresses caselessly. + If they match, we have to do a further caseful check of the local parts + when caseful_local_part is set. This is assumed to be rare, which is why + the code is written this way. */ + + if (!break_loop) + { + break_loop = strcmpic(parent->address, addr->address) == 0; + if (break_loop && r->caseful_local_part) + break_loop = Ustrncmp(parent->address, addr->address, + Ustrrchr(addr->address, '@') - addr->address) == 0; + } + + if (break_loop) + { + DEBUG(D_route) debug_printf("%s router skipped: previously routed %s\n", + r->name, parent->address); + loop_detected = TRUE; + break; + } + } + + /* Continue with parents, limiting the size of the dynasty. */ + + if (loopcount++ > 100) + { + log_write(0, LOG_MAIN|LOG_PANIC, "routing loop for %s", addr->address); + yield = DEFER; + goto ROUTE_EXIT; + } + } + + if (loop_detected) continue; + + /* Default no affixes and select whether to use a caseful or caseless local + part in this router. */ + + addr->prefix = addr->suffix = NULL; + addr->local_part = r->caseful_local_part? + addr->cc_local_part : addr->lc_local_part; + + DEBUG(D_route) debug_printf("local_part=%s domain=%s\n", addr->local_part, + addr->domain); + + /* Handle any configured prefix by replacing the local_part address, + and setting the prefix. Skip the router if the prefix doesn't match, + unless the prefix is optional. */ + + if (r->prefix) + { + int plen = route_check_prefix(addr->local_part, r->prefix); + if (plen > 0) + { + addr->prefix = string_copyn(addr->local_part, plen); + addr->local_part += plen; + DEBUG(D_route) debug_printf("stripped prefix %s\n", addr->prefix); + } + else if (!r->prefix_optional) + { + DEBUG(D_route) debug_printf("%s router skipped: prefix mismatch\n", + r->name); + continue; + } + } + + /* Handle any configured suffix likewise. */ + + if (r->suffix) + { + int slen = route_check_suffix(addr->local_part, r->suffix); + if (slen > 0) + { + int lplen = Ustrlen(addr->local_part) - slen; + addr->suffix = addr->local_part + lplen; + addr->local_part = string_copyn(addr->local_part, lplen); + DEBUG(D_route) debug_printf("stripped suffix %s\n", addr->suffix); + } + else if (!r->suffix_optional) + { + DEBUG(D_route) debug_printf("%s router skipped: suffix mismatch\n", + r->name); + continue; + } + } + + /* Set the expansion variables now that we have the affixes and the case of + the local part sorted. */ + + router_name = r->name; + deliver_set_expansions(addr); + + /* For convenience, the pre-router checks are in a separate function, which + returns OK, SKIP, FAIL, or DEFER. */ + + if ((rc = check_router_conditions(r, addr, verify, &pw, &error)) != OK) + { + router_name = NULL; + if (rc == SKIP) continue; + addr->message = error; + yield = rc; + goto ROUTE_EXIT; + } + + /* All pre-conditions have been met. Reset any search error message from + pre-condition tests. These can arise in negated tests where the failure of + the lookup leads to a TRUE pre-condition. */ + + search_error_message = NULL; + + /* Finally, expand the address_data field in the router. Forced failure + behaves as if the router declined. Any other failure is more serious. On + success, the string is attached to the address for all subsequent processing. + */ + + if (r->address_data) + { + DEBUG(D_route) debug_printf("processing address_data\n"); + deliver_address_data = expand_string(r->address_data); + if (!deliver_address_data) + { + if (f.expand_string_forcedfail) + { + DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" " + "(address_data): decline action taken\n", r->address_data); + + /* Expand "more" if necessary; DEFER => an expansion failed */ + + yield = exp_bool(addr, US"router", r->name, D_route, + US"more", r->more, r->expand_more, &more); + if (yield != OK) goto ROUTE_EXIT; + + if (!more) + { + DEBUG(D_route) + debug_printf("\"more\"=false: skipping remaining routers\n"); + router_name = NULL; + r = NULL; + break; + } + else continue; /* With next router */ + } + + else + { + addr->message = string_sprintf("expansion of \"%s\" failed " + "in %s router: %s", r->address_data, r->name, expand_string_message); + yield = DEFER; + goto ROUTE_EXIT; + } + } + addr->prop.address_data = deliver_address_data; + } + + /* We are finally cleared for take-off with this router. Clear the the flag + that records that a local host was removed from a routed host list. Make a + copy of relevant fields in the password information from check_local_user, + because it will be overwritten if check_local_user is invoked again while + verifying an errors_address setting. */ + + clearflag(addr, af_local_host_removed); + + if (pw) + { + pwcopy.pw_name = CS string_copy(US pw->pw_name); + pwcopy.pw_uid = pw->pw_uid; + pwcopy.pw_gid = pw->pw_gid; + pwcopy.pw_gecos = CS string_copy(US pw->pw_gecos); + pwcopy.pw_dir = CS string_copy(US pw->pw_dir); + pwcopy.pw_shell = CS string_copy(US pw->pw_shell); + pw = &pwcopy; + } + + /* If this should be the last hop for DSN flag the addr. */ + + if (r->dsn_lasthop && !(addr->dsn_flags & rf_dsnlasthop)) + { + addr->dsn_flags |= rf_dsnlasthop; + HDEBUG(D_route) debug_printf("DSN: last hop for %s\n", addr->address); + } + + /* Run the router, and handle the consequences. */ + + HDEBUG(D_route) debug_printf("calling %s router\n", r->name); + + yield = (r->info->code)(r, addr, pw, verify, paddr_local, paddr_remote, + addr_new, addr_succeed); + + router_name = NULL; + + if (yield == FAIL) + { + HDEBUG(D_route) debug_printf("%s router forced address failure\n", r->name); + goto ROUTE_EXIT; + } + + /* If succeeded while verifying but fail_verify is set, convert into + a failure, and take it off the local or remote delivery list. */ + + if (((verify == v_sender && r->fail_verify_sender) || + (verify == v_recipient && r->fail_verify_recipient)) && + (yield == OK || yield == PASS)) + { + addr->message = string_sprintf("%s router forced verify failure", r->name); + if (*paddr_remote == addr) *paddr_remote = addr->next; + if (*paddr_local == addr) *paddr_local = addr->next; + yield = FAIL; + goto ROUTE_EXIT; + } + + /* PASS and DECLINE are the only two cases where the loop continues. For all + other returns, we break the loop and handle the result below. */ + + if (yield != PASS && yield != DECLINE) break; + + HDEBUG(D_route) + { + debug_printf("%s router %s for %s\n", r->name, + (yield == PASS)? "passed" : "declined", addr->address); + if (Ustrcmp(old_domain, addr->domain) != 0) + debug_printf("domain %s rewritten\n", old_domain); + } + + /* PASS always continues to another router; DECLINE does so if "more" + is true. Initialization insists that pass_router is always a following + router. Otherwise, break the loop as if at the end of the routers. */ + + if (yield == PASS) + { + if (r->pass_router != NULL) nextr = r->pass_router; + } + else + { + /* Expand "more" if necessary */ + + yield = exp_bool(addr, US"router", r->name, D_route, + US"more", r->more, r->expand_more, &more); + if (yield != OK) goto ROUTE_EXIT; + + if (!more) + { + HDEBUG(D_route) + debug_printf("\"more\" is false: skipping remaining routers\n"); + r = NULL; + break; + } + } + } /* Loop for all routers */ + +/* On exit from the routers loop, if r == NULL we have run out of routers, +either genuinely, or as a result of no_more. Otherwise, the loop ended +prematurely, either because a router succeeded, or because of some special +router response. Note that FAIL errors and errors detected before actually +running a router go direct to ROUTE_EXIT from code above. */ + +if (!r) + { + HDEBUG(D_route) debug_printf("no more routers\n"); + if (!addr->message) + { + uschar *message = US"Unrouteable address"; + if (addr->router && addr->router->cannot_route_message) + { + uschar *expmessage = expand_string(addr->router->cannot_route_message); + if (!expmessage) + { + if (!f.expand_string_forcedfail) + log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand " + "cannot_route_message in %s router: %s", addr->router->name, + expand_string_message); + } + else message = expmessage; + } + addr->user_message = addr->message = message; + } + addr->router = NULL; /* For logging */ + yield = FAIL; + goto ROUTE_EXIT; + } + +if (yield == DEFER) + { + HDEBUG(D_route) + { + debug_printf("%s router: defer for %s\n", r->name, addr->address); + debug_printf(" message: %s\n", (addr->message == NULL)? + US"<none>" : addr->message); + } + goto ROUTE_EXIT; + } + +if (yield == DISCARD) goto ROUTE_EXIT; + +/* The yield must be either OK or REROUTED. */ + +if (yield != OK && yield != REROUTED) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router returned unknown value %d", + r->name, yield); + +/* If the yield was REROUTED, the router put a child address on the new chain +as a result of a domain change of some sort (widening, typically). */ + +if (yield == REROUTED) + { + HDEBUG(D_route) debug_printf("re-routed to %s\n", addr->address); + yield = OK; + goto ROUTE_EXIT; + } + +/* The only remaining possibility is that the router succeeded. If the +translate_ip_address options is set and host addresses were associated with the +address, run them through the translation. This feature is for weird and +wonderful situations (the amateur packet radio people need it) or very broken +networking, so it is included in the binary only if requested. */ + +#ifdef SUPPORT_TRANSLATE_IP_ADDRESS + +if (r->translate_ip_address) + { + int rc; + int old_pool = store_pool; + host_item *h; + for (h = addr->host_list; h; h = h->next) + { + uschar *newaddress; + uschar *oldaddress, *oldname; + + if (!h->address) continue; + + deliver_host_address = h->address; + newaddress = expand_string(r->translate_ip_address); + deliver_host_address = NULL; + + if (!newaddress) + { + if (f.expand_string_forcedfail) continue; + addr->basic_errno = ERRNO_EXPANDFAIL; + addr->message = string_sprintf("translate_ip_address expansion " + "failed: %s", expand_string_message); + yield = DEFER; + goto ROUTE_EXIT; + } + + DEBUG(D_route) debug_printf("%s [%s] translated to %s\n", + h->name, h->address, newaddress); + if (string_is_ip_address(newaddress, NULL) != 0) + { + h->address = newaddress; + continue; + } + + oldname = h->name; + oldaddress = h->address; + h->name = newaddress; + h->address = NULL; + h->mx = MX_NONE; + + store_pool = POOL_PERM; + rc = host_find_byname(h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, TRUE); + store_pool = old_pool; + + if (rc == HOST_FIND_FAILED || rc == HOST_FIND_AGAIN) + { + addr->basic_errno = ERRNO_UNKNOWNHOST; + addr->message = string_sprintf("host %s not found when " + "translating %s [%s]", h->name, oldname, oldaddress); + yield = DEFER; + goto ROUTE_EXIT; + } + } + } +#endif /* SUPPORT_TRANSLATE_IP_ADDRESS */ + +/* See if this is an unseen routing; first expand the option if necessary. +DEFER can be given if the expansion fails */ + +yield = exp_bool(addr, US"router", r->name, D_route, + US"unseen", r->unseen, r->expand_unseen, &unseen); +if (yield != OK) goto ROUTE_EXIT; + +/* Debugging output recording a successful routing */ + +HDEBUG(D_route) debug_printf("routed by %s router%s\n", r->name, + unseen? " (unseen)" : ""); + +DEBUG(D_route) + { + host_item *h; + + debug_printf(" envelope to: %s\n", addr->address); + debug_printf(" transport: %s\n", (addr->transport == NULL)? + US"<none>" : addr->transport->name); + + if (addr->prop.errors_address) + debug_printf(" errors to %s\n", addr->prop.errors_address); + + for (h = addr->host_list; h; h = h->next) + { + debug_printf(" host %s", h->name); + if (h->address) debug_printf(" [%s]", h->address); + if (h->mx >= 0) debug_printf(" MX=%d", h->mx); + else if (h->mx != MX_NONE) debug_printf(" rgroup=%d", h->mx); + if (h->port != PORT_NONE) debug_printf(" port=%d", h->port); + if (h->dnssec != DS_UNK) debug_printf(" dnssec=%s", h->dnssec==DS_YES ? "yes" : "no"); + debug_printf("\n"); + } + } + +/* Clear any temporary error message set by a router that declined, and handle +the "unseen" option (ignore if there are no further routers). */ + +addr->message = NULL; +if (unseen && r->next) + route_unseen(r->name, addr, paddr_local, paddr_remote, addr_new); + +/* Unset the address expansions, and return the final result. */ + +ROUTE_EXIT: +if (yield == DEFER && addr->message) + addr->message = expand_hide_passwords(addr->message); + +deliver_set_expansions(NULL); +router_name = NULL; +f.disable_logging = FALSE; +return yield; +} + +#endif /*!MACRO_PREDEF*/ +/* End of route.c */ |