diff options
Diffstat (limited to '')
| -rw-r--r-- | src/deliver.c | 8678 |
1 files changed, 8678 insertions, 0 deletions
diff --git a/src/deliver.c b/src/deliver.c new file mode 100644 index 0000000..f5f065e --- /dev/null +++ b/src/deliver.c @@ -0,0 +1,8678 @@ +/************************************************* +* Exim - an Internet mail transport agent * +*************************************************/ + +/* Copyright (c) University of Cambridge 1995 - 2018 */ +/* Copyright (c) The Exim Maintainers 2020 */ +/* See the file NOTICE for conditions of use and distribution. */ + +/* The main code for delivering a message. */ + + +#include "exim.h" +#include "transports/smtp.h" +#include <sys/uio.h> +#include <assert.h> + + +/* Data block for keeping track of subprocesses for parallel remote +delivery. */ + +typedef struct pardata { + address_item *addrlist; /* chain of addresses */ + address_item *addr; /* next address data expected for */ + pid_t pid; /* subprocess pid */ + int fd; /* pipe fd for getting result from subprocess */ + int transport_count; /* returned transport count value */ + BOOL done; /* no more data needed */ + uschar *msg; /* error message */ + uschar *return_path; /* return_path for these addresses */ +} pardata; + +/* Values for the process_recipients variable */ + +enum { RECIP_ACCEPT, RECIP_IGNORE, RECIP_DEFER, + RECIP_FAIL, RECIP_FAIL_FILTER, RECIP_FAIL_TIMEOUT, + RECIP_FAIL_LOOP}; + +/* Mutually recursive functions for marking addresses done. */ + +static void child_done(address_item *, uschar *); +static void address_done(address_item *, uschar *); + +/* Table for turning base-62 numbers into binary */ + +static uschar tab62[] = + {0,1,2,3,4,5,6,7,8,9,0,0,0,0,0,0, /* 0-9 */ + 0,10,11,12,13,14,15,16,17,18,19,20, /* A-K */ + 21,22,23,24,25,26,27,28,29,30,31,32, /* L-W */ + 33,34,35, 0, 0, 0, 0, 0, /* X-Z */ + 0,36,37,38,39,40,41,42,43,44,45,46, /* a-k */ + 47,48,49,50,51,52,53,54,55,56,57,58, /* l-w */ + 59,60,61}; /* x-z */ + + +/************************************************* +* Local static variables * +*************************************************/ + +/* addr_duplicate is global because it needs to be seen from the Envelope-To +writing code. */ + +static address_item *addr_defer = NULL; +static address_item *addr_failed = NULL; +static address_item *addr_fallback = NULL; +static address_item *addr_local = NULL; +static address_item *addr_new = NULL; +static address_item *addr_remote = NULL; +static address_item *addr_route = NULL; +static address_item *addr_succeed = NULL; +static address_item *addr_senddsn = NULL; + +static FILE *message_log = NULL; +static BOOL update_spool; +static BOOL remove_journal; +static int parcount = 0; +static pardata *parlist = NULL; +static int return_count; +static uschar *frozen_info = US""; +static uschar *used_return_path = NULL; + + + +/************************************************* +* read as much as requested * +*************************************************/ + +/* The syscall read(2) doesn't always returns as much as we want. For +several reasons it might get less. (Not talking about signals, as syscalls +are restartable). When reading from a network or pipe connection the sender +might send in smaller chunks, with delays between these chunks. The read(2) +may return such a chunk. + +The more the writer writes and the smaller the pipe between write and read is, +the more we get the chance of reading leass than requested. (See bug 2130) + +This function read(2)s until we got all the data we *requested*. + +Note: This function may block. Use it only if you're sure about the +amount of data you will get. + +Argument: + fd the file descriptor to read from + buffer pointer to a buffer of size len + len the requested(!) amount of bytes + +Returns: the amount of bytes read +*/ +static ssize_t +readn(int fd, void * buffer, size_t len) +{ +uschar * next = buffer; +uschar * end = next + len; + +while (next < end) + { + ssize_t got = read(fd, next, end - next); + + /* I'm not sure if there are signals that can interrupt us, + for now I assume the worst */ + if (got == -1 && errno == EINTR) continue; + if (got <= 0) return next - US buffer; + next += got; + } + +return len; +} + + +/************************************************* +* Make a new address item * +*************************************************/ + +/* This function gets the store and initializes with default values. The +transport_return value defaults to DEFER, so that any unexpected failure to +deliver does not wipe out the message. The default unique string is set to a +copy of the address, so that its domain can be lowercased. + +Argument: + address the RFC822 address string + copy force a copy of the address + +Returns: a pointer to an initialized address_item +*/ + +address_item * +deliver_make_addr(uschar *address, BOOL copy) +{ +address_item *addr = store_get(sizeof(address_item), FALSE); +*addr = address_defaults; +if (copy) address = string_copy(address); +addr->address = address; +addr->unique = string_copy(address); +return addr; +} + + + + +/************************************************* +* Set expansion values for an address * +*************************************************/ + +/* Certain expansion variables are valid only when handling an address or +address list. This function sets them up or clears the values, according to its +argument. + +Arguments: + addr the address in question, or NULL to clear values +Returns: nothing +*/ + +void +deliver_set_expansions(address_item *addr) +{ +if (!addr) + { + const uschar ***p = address_expansions; + while (*p) **p++ = NULL; + return; + } + +/* Exactly what gets set depends on whether there is one or more addresses, and +what they contain. These first ones are always set, taking their values from +the first address. */ + +if (!addr->host_list) + { + deliver_host = deliver_host_address = US""; + deliver_host_port = 0; + } +else + { + deliver_host = addr->host_list->name; + deliver_host_address = addr->host_list->address; + deliver_host_port = addr->host_list->port; + } + +deliver_recipients = addr; +deliver_address_data = addr->prop.address_data; +deliver_domain_data = addr->prop.domain_data; +deliver_localpart_data = addr->prop.localpart_data; +router_var = addr->prop.variables; + +/* These may be unset for multiple addresses */ + +deliver_domain = addr->domain; +self_hostname = addr->self_hostname; + +#ifdef EXPERIMENTAL_BRIGHTMAIL +bmi_deliver = 1; /* deliver by default */ +bmi_alt_location = NULL; +bmi_base64_verdict = NULL; +bmi_base64_tracker_verdict = NULL; +#endif + +/* If there's only one address we can set everything. */ + +if (!addr->next) + { + address_item *addr_orig; + + deliver_localpart = addr->local_part; + deliver_localpart_prefix = addr->prefix; + deliver_localpart_prefix_v = addr->prefix_v; + deliver_localpart_suffix = addr->suffix; + deliver_localpart_suffix_v = addr->suffix_v; + + for (addr_orig = addr; addr_orig->parent; addr_orig = addr_orig->parent) ; + deliver_domain_orig = addr_orig->domain; + + /* Re-instate any prefix and suffix in the original local part. In all + normal cases, the address will have a router associated with it, and we can + choose the caseful or caseless version accordingly. However, when a system + filter sets up a pipe, file, or autoreply delivery, no router is involved. + In this case, though, there won't be any prefix or suffix to worry about. */ + + deliver_localpart_orig = !addr_orig->router + ? addr_orig->local_part + : addr_orig->router->caseful_local_part + ? addr_orig->cc_local_part + : addr_orig->lc_local_part; + + /* If there's a parent, make its domain and local part available, and if + delivering to a pipe or file, or sending an autoreply, get the local + part from the parent. For pipes and files, put the pipe or file string + into address_pipe and address_file. */ + + if (addr->parent) + { + deliver_domain_parent = addr->parent->domain; + deliver_localpart_parent = !addr->parent->router + ? addr->parent->local_part + : addr->parent->router->caseful_local_part + ? addr->parent->cc_local_part + : addr->parent->lc_local_part; + + /* File deliveries have their own flag because they need to be picked out + as special more often. */ + + if (testflag(addr, af_pfr)) + { + if (testflag(addr, af_file)) address_file = addr->local_part; + else if (deliver_localpart[0] == '|') address_pipe = addr->local_part; + deliver_localpart = addr->parent->local_part; + deliver_localpart_prefix = addr->parent->prefix; + deliver_localpart_prefix_v = addr->parent->prefix_v; + deliver_localpart_suffix = addr->parent->suffix; + deliver_localpart_suffix_v = addr->parent->suffix_v; + } + } + +#ifdef EXPERIMENTAL_BRIGHTMAIL + /* Set expansion variables related to Brightmail AntiSpam */ + bmi_base64_verdict = bmi_get_base64_verdict(deliver_localpart_orig, deliver_domain_orig); + bmi_base64_tracker_verdict = bmi_get_base64_tracker_verdict(bmi_base64_verdict); + /* get message delivery status (0 - don't deliver | 1 - deliver) */ + bmi_deliver = bmi_get_delivery_status(bmi_base64_verdict); + /* if message is to be delivered, get eventual alternate location */ + if (bmi_deliver == 1) + bmi_alt_location = bmi_get_alt_location(bmi_base64_verdict); +#endif + + } + +/* For multiple addresses, don't set local part, and leave the domain and +self_hostname set only if it is the same for all of them. It is possible to +have multiple pipe and file addresses, but only when all addresses have routed +to the same pipe or file. */ + +else + { + if (testflag(addr, af_pfr)) + { + if (testflag(addr, af_file)) address_file = addr->local_part; + else if (addr->local_part[0] == '|') address_pipe = addr->local_part; + } + for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next) + { + if (deliver_domain && Ustrcmp(deliver_domain, addr2->domain) != 0) + deliver_domain = NULL; + if ( self_hostname + && ( !addr2->self_hostname + || Ustrcmp(self_hostname, addr2->self_hostname) != 0 + ) ) + self_hostname = NULL; + if (!deliver_domain && !self_hostname) break; + } + } +} + + + + +/************************************************* +* Open a msglog file * +*************************************************/ + +/* This function is used both for normal message logs, and for files in the +msglog directory that are used to catch output from pipes. Try to create the +directory if it does not exist. From release 4.21, normal message logs should +be created when the message is received. + +Called from deliver_message(), can be operating as root. + +Argument: + filename the file name + mode the mode required + error used for saying what failed + +Returns: a file descriptor, or -1 (with errno set) +*/ + +static int +open_msglog_file(uschar *filename, int mode, uschar **error) +{ +if (Ustrstr(filename, US"/../")) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, + "Attempt to open msglog file path with upward-traversal: '%s'\n", filename); + +for (int i = 2; i > 0; i--) + { + int fd = Uopen(filename, +#ifdef O_CLOEXEC + O_CLOEXEC | +#endif +#ifdef O_NOFOLLOW + O_NOFOLLOW | +#endif + O_WRONLY|O_APPEND|O_CREAT, mode); + if (fd >= 0) + { + /* Set the close-on-exec flag and change the owner to the exim uid/gid (this + function is called as root). Double check the mode, because the group setting + doesn't always get set automatically. */ + +#ifndef O_CLOEXEC + (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC); +#endif + if (exim_fchown(fd, exim_uid, exim_gid, filename) < 0) + { + *error = US"chown"; + return -1; + } + if (fchmod(fd, mode) < 0) + { + *error = US"chmod"; + return -1; + } + return fd; + } + if (errno != ENOENT) + break; + + (void)directory_make(spool_directory, + spool_sname(US"msglog", message_subdir), + MSGLOG_DIRECTORY_MODE, TRUE); + } + +*error = US"create or open"; +return -1; +} + + + + +/************************************************* +* Write to msglog if required * +*************************************************/ + +/* Write to the message log, if configured. This function may also be called +from transports. + +Arguments: + format a string format + +Returns: nothing +*/ + +void +deliver_msglog(const char *format, ...) +{ +va_list ap; +if (!message_logs) return; +va_start(ap, format); +vfprintf(message_log, format, ap); +fflush(message_log); +va_end(ap); +} + + + + +/************************************************* +* Replicate status for batch * +*************************************************/ + +/* When a transport handles a batch of addresses, it may treat them +individually, or it may just put the status in the first one, and return FALSE, +requesting that the status be copied to all the others externally. This is the +replication function. As well as the status, it copies the transport pointer, +which may have changed if appendfile passed the addresses on to a different +transport. + +Argument: pointer to the first address in a chain +Returns: nothing +*/ + +static void +replicate_status(address_item *addr) +{ +for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next) + { + addr2->transport = addr->transport; + addr2->transport_return = addr->transport_return; + addr2->basic_errno = addr->basic_errno; + addr2->more_errno = addr->more_errno; + addr2->delivery_time = addr->delivery_time; + addr2->special_action = addr->special_action; + addr2->message = addr->message; + addr2->user_message = addr->user_message; + } +} + + + +/************************************************* +* Compare lists of hosts * +*************************************************/ + +/* This function is given two pointers to chains of host items, and it yields +TRUE if the lists refer to the same hosts in the same order, except that + +(1) Multiple hosts with the same non-negative MX values are permitted to appear + in different orders. Round-robinning nameservers can cause this to happen. + +(2) Multiple hosts with the same negative MX values less than MX_NONE are also + permitted to appear in different orders. This is caused by randomizing + hosts lists. + +This enables Exim to use a single SMTP transaction for sending to two entirely +different domains that happen to end up pointing at the same hosts. + +We do not try to batch up different A-record host names that refer to the +same IP. + +Arguments: + one points to the first host list + two points to the second host list + +Returns: TRUE if the lists refer to the same host set +*/ + +static BOOL +same_hosts(host_item *one, host_item *two) +{ +while (one && two) + { + if (Ustrcmp(one->name, two->name) != 0) + { + int mx = one->mx; + host_item *end_one = one; + host_item *end_two = two; + + /* Batch up only if there was no MX and the list was not randomized */ + + if (mx == MX_NONE) return FALSE; + + /* Find the ends of the shortest sequence of identical MX values */ + + while ( end_one->next && end_one->next->mx == mx + && end_two->next && end_two->next->mx == mx) + { + end_one = end_one->next; + end_two = end_two->next; + } + + /* If there aren't any duplicates, there's no match. */ + + if (end_one == one) return FALSE; + + /* For each host in the 'one' sequence, check that it appears in the 'two' + sequence, returning FALSE if not. */ + + for (;;) + { + host_item *hi; + for (hi = two; hi != end_two->next; hi = hi->next) + if (Ustrcmp(one->name, hi->name) == 0) break; + if (hi == end_two->next) return FALSE; + if (one == end_one) break; + one = one->next; + } + + /* All the hosts in the 'one' sequence were found in the 'two' sequence. + Ensure both are pointing at the last host, and carry on as for equality. */ + + two = end_two; + } + + /* if the names matched but ports do not, mismatch */ + else if (one->port != two->port) + return FALSE; + + /* Hosts matched */ + + one = one->next; + two = two->next; + } + +/* True if both are NULL */ + +return (one == two); +} + + + +/************************************************* +* Compare header lines * +*************************************************/ + +/* This function is given two pointers to chains of header items, and it yields +TRUE if they are the same header texts in the same order. + +Arguments: + one points to the first header list + two points to the second header list + +Returns: TRUE if the lists refer to the same header set +*/ + +static BOOL +same_headers(header_line *one, header_line *two) +{ +for (;; one = one->next, two = two->next) + { + if (one == two) return TRUE; /* Includes the case where both NULL */ + if (!one || !two) return FALSE; + if (Ustrcmp(one->text, two->text) != 0) return FALSE; + } +} + + + +/************************************************* +* Compare string settings * +*************************************************/ + +/* This function is given two pointers to strings, and it returns +TRUE if they are the same pointer, or if the two strings are the same. + +Arguments: + one points to the first string + two points to the second string + +Returns: TRUE or FALSE +*/ + +static BOOL +same_strings(uschar *one, uschar *two) +{ +if (one == two) return TRUE; /* Includes the case where both NULL */ +if (!one || !two) return FALSE; +return (Ustrcmp(one, two) == 0); +} + + + +/************************************************* +* Compare uid/gid for addresses * +*************************************************/ + +/* This function is given a transport and two addresses. It yields TRUE if the +uid/gid/initgroups settings for the two addresses are going to be the same when +they are delivered. + +Arguments: + tp the transort + addr1 the first address + addr2 the second address + +Returns: TRUE or FALSE +*/ + +static BOOL +same_ugid(transport_instance *tp, address_item *addr1, address_item *addr2) +{ +if ( !tp->uid_set && !tp->expand_uid + && !tp->deliver_as_creator + && ( testflag(addr1, af_uid_set) != testflag(addr2, af_gid_set) + || ( testflag(addr1, af_uid_set) + && ( addr1->uid != addr2->uid + || testflag(addr1, af_initgroups) != testflag(addr2, af_initgroups) + ) ) ) ) + return FALSE; + +if ( !tp->gid_set && !tp->expand_gid + && ( testflag(addr1, af_gid_set) != testflag(addr2, af_gid_set) + || ( testflag(addr1, af_gid_set) + && addr1->gid != addr2->gid + ) ) ) + return FALSE; + +return TRUE; +} + + + + +/************************************************* +* Record that an address is complete * +*************************************************/ + +/* This function records that an address is complete. This is straightforward +for most addresses, where the unique address is just the full address with the +domain lower cased. For homonyms (addresses that are the same as one of their +ancestors) their are complications. Their unique addresses have \x\ prepended +(where x = 0, 1, 2...), so that de-duplication works correctly for siblings and +cousins. + +Exim used to record the unique addresses of homonyms as "complete". This, +however, fails when the pattern of redirection varies over time (e.g. if taking +unseen copies at only some times of day) because the prepended numbers may vary +from one delivery run to the next. This problem is solved by never recording +prepended unique addresses as complete. Instead, when a homonymic address has +actually been delivered via a transport, we record its basic unique address +followed by the name of the transport. This is checked in subsequent delivery +runs whenever an address is routed to a transport. + +If the completed address is a top-level one (has no parent, which means it +cannot be homonymic) we also add the original address to the non-recipients +tree, so that it gets recorded in the spool file and therefore appears as +"done" in any spool listings. The original address may differ from the unique +address in the case of the domain. + +Finally, this function scans the list of duplicates, marks as done any that +match this address, and calls child_done() for their ancestors. + +Arguments: + addr address item that has been completed + now current time as a string + +Returns: nothing +*/ + +static void +address_done(address_item *addr, uschar *now) +{ +update_spool = TRUE; /* Ensure spool gets updated */ + +/* Top-level address */ + +if (!addr->parent) + { + tree_add_nonrecipient(addr->unique); + tree_add_nonrecipient(addr->address); + } + +/* Homonymous child address */ + +else if (testflag(addr, af_homonym)) + { + if (addr->transport) + tree_add_nonrecipient( + string_sprintf("%s/%s", addr->unique + 3, addr->transport->name)); + } + +/* Non-homonymous child address */ + +else tree_add_nonrecipient(addr->unique); + +/* Check the list of duplicate addresses and ensure they are now marked +done as well. */ + +for (address_item * dup = addr_duplicate; dup; dup = dup->next) + if (Ustrcmp(addr->unique, dup->unique) == 0) + { + tree_add_nonrecipient(dup->unique); + child_done(dup, now); + } +} + + + + +/************************************************* +* Decrease counts in parents and mark done * +*************************************************/ + +/* This function is called when an address is complete. If there is a parent +address, its count of children is decremented. If there are still other +children outstanding, the function exits. Otherwise, if the count has become +zero, address_done() is called to mark the parent and its duplicates complete. +Then loop for any earlier ancestors. + +Arguments: + addr points to the completed address item + now the current time as a string, for writing to the message log + +Returns: nothing +*/ + +static void +child_done(address_item *addr, uschar *now) +{ +while (addr->parent) + { + address_item *aa; + + addr = addr->parent; + if (--addr->child_count > 0) return; /* Incomplete parent */ + address_done(addr, now); + + /* Log the completion of all descendents only when there is no ancestor with + the same original address. */ + + for (aa = addr->parent; aa; aa = aa->parent) + if (Ustrcmp(aa->address, addr->address) == 0) break; + if (aa) continue; + + deliver_msglog("%s %s: children all complete\n", now, addr->address); + DEBUG(D_deliver) debug_printf("%s: children all complete\n", addr->address); + } +} + + + +/************************************************* +* Delivery logging support functions * +*************************************************/ + +/* The LOGGING() checks in d_log_interface() are complicated for backwards +compatibility. When outgoing interface logging was originally added, it was +conditional on just incoming_interface (which is off by default). The +outgoing_interface option is on by default to preserve this behaviour, but +you can enable incoming_interface and disable outgoing_interface to get I= +fields on incoming lines only. + +Arguments: + g The log line + addr The address to be logged + +Returns: New value for s +*/ + +static gstring * +d_log_interface(gstring * g) +{ +if (LOGGING(incoming_interface) && LOGGING(outgoing_interface) + && sending_ip_address) + { + g = string_fmt_append(g, " I=[%s]", sending_ip_address); + if (LOGGING(outgoing_port)) + g = string_fmt_append(g, ":%d", sending_port); + } +return g; +} + + + +static gstring * +d_hostlog(gstring * g, address_item * addr) +{ +host_item * h = addr->host_used; + +g = string_append(g, 2, US" H=", h->name); + +if (LOGGING(dnssec) && h->dnssec == DS_YES) + g = string_catn(g, US" DS", 3); + +g = string_append(g, 3, US" [", h->address, US"]"); + +if (LOGGING(outgoing_port)) + g = string_fmt_append(g, ":%d", h->port); + +#ifdef SUPPORT_SOCKS +if (LOGGING(proxy) && proxy_local_address) + { + g = string_append(g, 3, US" PRX=[", proxy_local_address, US"]"); + if (LOGGING(outgoing_port)) + g = string_fmt_append(g, ":%d", proxy_local_port); + } +#endif + +g = d_log_interface(g); + +if (testflag(addr, af_tcp_fastopen)) + g = string_catn(g, US" TFO*", testflag(addr, af_tcp_fastopen_data) ? 5 : 4); + +return g; +} + + + + + +#ifndef DISABLE_TLS +static gstring * +d_tlslog(gstring * g, address_item * addr) +{ +if (LOGGING(tls_cipher) && addr->cipher) + { + g = string_append(g, 2, US" X=", addr->cipher); +#ifdef EXPERIMENTAL_TLS_RESUME + if (LOGGING(tls_resumption) && testflag(addr, af_tls_resume)) + g = string_catn(g, US"*", 1); +#endif + } +if (LOGGING(tls_certificate_verified) && addr->cipher) + g = string_append(g, 2, US" CV=", + testflag(addr, af_cert_verified) + ? +#ifdef SUPPORT_DANE + testflag(addr, af_dane_verified) + ? "dane" + : +#endif + "yes" + : "no"); +if (LOGGING(tls_peerdn) && addr->peerdn) + g = string_append(g, 3, US" DN=\"", string_printing(addr->peerdn), US"\""); +return g; +} +#endif + + + + +#ifndef DISABLE_EVENT +uschar * +event_raise(uschar * action, const uschar * event, uschar * ev_data) +{ +uschar * s; +if (action) + { + DEBUG(D_deliver) + debug_printf("Event(%s): event_action=|%s| delivery_IP=%s\n", + event, + action, deliver_host_address); + + event_name = event; + event_data = ev_data; + + if (!(s = expand_string(action)) && *expand_string_message) + log_write(0, LOG_MAIN|LOG_PANIC, + "failed to expand event_action %s in %s: %s\n", + event, transport_name ? transport_name : US"main", expand_string_message); + + event_name = event_data = NULL; + + /* If the expansion returns anything but an empty string, flag for + the caller to modify his normal processing + */ + if (s && *s) + { + DEBUG(D_deliver) + debug_printf("Event(%s): event_action returned \"%s\"\n", event, s); + errno = ERRNO_EVENT; + return s; + } + } +return NULL; +} + +void +msg_event_raise(const uschar * event, const address_item * addr) +{ +const uschar * save_domain = deliver_domain; +uschar * save_local = deliver_localpart; +const uschar * save_host = deliver_host; +const uschar * save_address = deliver_host_address; +const int save_port = deliver_host_port; + +router_name = addr->router ? addr->router->name : NULL; +deliver_domain = addr->domain; +deliver_localpart = addr->local_part; +deliver_host = addr->host_used ? addr->host_used->name : NULL; + +if (!addr->transport) + { + if (Ustrcmp(event, "msg:fail:delivery") == 0) + { + /* An address failed with no transport involved. This happens when + a filter was used which triggered a fail command (in such a case + a transport isn't needed). Convert it to an internal fail event. */ + + (void) event_raise(event_action, US"msg:fail:internal", addr->message); + } + } +else + { + transport_name = addr->transport->name; + + (void) event_raise(addr->transport->event_action, event, + addr->host_used + || Ustrcmp(addr->transport->driver_name, "smtp") == 0 + || Ustrcmp(addr->transport->driver_name, "lmtp") == 0 + || Ustrcmp(addr->transport->driver_name, "autoreply") == 0 + ? addr->message : NULL); + } + +deliver_host_port = save_port; +deliver_host_address = save_address; +deliver_host = save_host; +deliver_localpart = save_local; +deliver_domain = save_domain; +router_name = transport_name = NULL; +} +#endif /*DISABLE_EVENT*/ + + + +/******************************************************************************/ + + +/************************************************* +* Generate local prt for logging * +*************************************************/ + +/* This function is a subroutine for use in string_log_address() below. + +Arguments: + addr the address being logged + yield the current dynamic buffer pointer + +Returns: the new value of the buffer pointer +*/ + +static gstring * +string_get_localpart(address_item * addr, gstring * yield) +{ +uschar * s; + +s = addr->prefix; +if (testflag(addr, af_include_affixes) && s) + { +#ifdef SUPPORT_I18N + if (testflag(addr, af_utf8_downcvt)) + s = string_localpart_utf8_to_alabel(s, NULL); +#endif + yield = string_cat(yield, s); + } + +s = addr->local_part; +#ifdef SUPPORT_I18N +if (testflag(addr, af_utf8_downcvt)) + s = string_localpart_utf8_to_alabel(s, NULL); +#endif +yield = string_cat(yield, s); + +s = addr->suffix; +if (testflag(addr, af_include_affixes) && s) + { +#ifdef SUPPORT_I18N + if (testflag(addr, af_utf8_downcvt)) + s = string_localpart_utf8_to_alabel(s, NULL); +#endif + yield = string_cat(yield, s); + } + +return yield; +} + + +/************************************************* +* Generate log address list * +*************************************************/ + +/* This function generates a list consisting of an address and its parents, for +use in logging lines. For saved onetime aliased addresses, the onetime parent +field is used. If the address was delivered by a transport with rcpt_include_ +affixes set, the af_include_affixes bit will be set in the address. In that +case, we include the affixes here too. + +Arguments: + g points to growing-string struct + addr bottom (ultimate) address + all_parents if TRUE, include all parents + success TRUE for successful delivery + +Returns: a growable string in dynamic store +*/ + +static gstring * +string_log_address(gstring * g, + address_item *addr, BOOL all_parents, BOOL success) +{ +BOOL add_topaddr = TRUE; +address_item *topaddr; + +/* Find the ultimate parent */ + +for (topaddr = addr; topaddr->parent; topaddr = topaddr->parent) ; + +/* We start with just the local part for pipe, file, and reply deliveries, and +for successful local deliveries from routers that have the log_as_local flag +set. File deliveries from filters can be specified as non-absolute paths in +cases where the transport is going to complete the path. If there is an error +before this happens (expansion failure) the local part will not be updated, and +so won't necessarily look like a path. Add extra text for this case. */ + +if ( testflag(addr, af_pfr) + || ( success + && addr->router && addr->router->log_as_local + && addr->transport && addr->transport->info->local + ) ) + { + if (testflag(addr, af_file) && addr->local_part[0] != '/') + g = string_catn(g, CUS"save ", 5); + g = string_get_localpart(addr, g); + } + +/* Other deliveries start with the full address. It we have split it into local +part and domain, use those fields. Some early failures can happen before the +splitting is done; in those cases use the original field. */ + +else + { + uschar * cmp; + int off = g->ptr; /* start of the "full address" */ + + if (addr->local_part) + { + const uschar * s; + g = string_get_localpart(addr, g); + g = string_catn(g, US"@", 1); + s = addr->domain; +#ifdef SUPPORT_I18N + if (testflag(addr, af_utf8_downcvt)) + s = string_localpart_utf8_to_alabel(s, NULL); +#endif + g = string_cat(g, s); + } + else + g = string_cat(g, addr->address); + + /* If the address we are going to print is the same as the top address, + and all parents are not being included, don't add on the top address. First + of all, do a caseless comparison; if this succeeds, do a caseful comparison + on the local parts. */ + + cmp = g->s + off; /* only now, as rebuffer likely done */ + string_from_gstring(g); /* ensure nul-terminated */ + if ( strcmpic(cmp, topaddr->address) == 0 + && Ustrncmp(cmp, topaddr->address, Ustrchr(cmp, '@') - cmp) == 0 + && !addr->onetime_parent + && (!all_parents || !addr->parent || addr->parent == topaddr) + ) + add_topaddr = FALSE; + } + +/* If all parents are requested, or this is a local pipe/file/reply, and +there is at least one intermediate parent, show it in brackets, and continue +with all of them if all are wanted. */ + +if ( (all_parents || testflag(addr, af_pfr)) + && addr->parent + && addr->parent != topaddr) + { + uschar *s = US" ("; + for (address_item * addr2 = addr->parent; addr2 != topaddr; addr2 = addr2->parent) + { + g = string_catn(g, s, 2); + g = string_cat (g, addr2->address); + if (!all_parents) break; + s = US", "; + } + g = string_catn(g, US")", 1); + } + +/* Add the top address if it is required */ + +if (add_topaddr) + g = string_append(g, 3, + US" <", + addr->onetime_parent ? addr->onetime_parent : topaddr->address, + US">"); + +return g; +} + + + +/******************************************************************************/ + + + +/* If msg is NULL this is a delivery log and logchar is used. Otherwise +this is a nonstandard call; no two-character delivery flag is written +but sender-host and sender are prefixed and "msg" is inserted in the log line. + +Arguments: + flags passed to log_write() +*/ +void +delivery_log(int flags, address_item * addr, int logchar, uschar * msg) +{ +gstring * g; /* Used for a temporary, expanding buffer, for building log lines */ +rmark reset_point; + +/* Log the delivery on the main log. We use an extensible string to build up +the log line, and reset the store afterwards. Remote deliveries should always +have a pointer to the host item that succeeded; local deliveries can have a +pointer to a single host item in their host list, for use by the transport. */ + +#ifndef DISABLE_EVENT + /* presume no successful remote delivery */ + lookup_dnssec_authenticated = NULL; +#endif + +reset_point = store_mark(); +g = string_get_tainted(256, TRUE); /* addrs will be tainted, so avoid copy */ + +if (msg) + g = string_append(g, 2, host_and_ident(TRUE), US" "); +else + { + g->s[0] = logchar; g->ptr = 1; + g = string_catn(g, US"> ", 2); + } +g = string_log_address(g, addr, LOGGING(all_parents), TRUE); + +if (LOGGING(sender_on_delivery) || msg) + g = string_append(g, 3, US" F=<", +#ifdef SUPPORT_I18N + testflag(addr, af_utf8_downcvt) + ? string_address_utf8_to_alabel(sender_address, NULL) + : +#endif + sender_address, + US">"); + +if (*queue_name) + g = string_append(g, 2, US" Q=", queue_name); + +#ifdef EXPERIMENTAL_SRS +if(addr->prop.srs_sender) + g = string_append(g, 3, US" SRS=<", addr->prop.srs_sender, US">"); +#endif + +/* You might think that the return path must always be set for a successful +delivery; indeed, I did for some time, until this statement crashed. The case +when it is not set is for a delivery to /dev/null which is optimised by not +being run at all. */ + +if (used_return_path && LOGGING(return_path_on_delivery)) + g = string_append(g, 3, US" P=<", used_return_path, US">"); + +if (msg) + g = string_append(g, 2, US" ", msg); + +/* For a delivery from a system filter, there may not be a router */ +if (addr->router) + g = string_append(g, 2, US" R=", addr->router->name); + +g = string_append(g, 2, US" T=", addr->transport->name); + +if (LOGGING(delivery_size)) + g = string_fmt_append(g, " S=%d", transport_count); + +/* Local delivery */ + +if (addr->transport->info->local) + { + if (addr->host_list) + g = string_append(g, 2, US" H=", addr->host_list->name); + g = d_log_interface(g); + if (addr->shadow_message) + g = string_cat(g, addr->shadow_message); + } + +/* Remote delivery */ + +else + { + if (addr->host_used) + { + g = d_hostlog(g, addr); + if (continue_sequence > 1) /*XXX this is wrong for a dropped proxyconn. Would have to pass back from transport */ + g = string_catn(g, US"*", 1); + +#ifndef DISABLE_EVENT + deliver_host_address = addr->host_used->address; + deliver_host_port = addr->host_used->port; + deliver_host = addr->host_used->name; + + /* DNS lookup status */ + lookup_dnssec_authenticated = addr->host_used->dnssec==DS_YES ? US"yes" + : addr->host_used->dnssec==DS_NO ? US"no" + : NULL; +#endif + } + +#ifndef DISABLE_TLS + g = d_tlslog(g, addr); +#endif + + if (addr->authenticator) + { + g = string_append(g, 2, US" A=", addr->authenticator); + if (addr->auth_id) + { + g = string_append(g, 2, US":", addr->auth_id); + if (LOGGING(smtp_mailauth) && addr->auth_sndr) + g = string_append(g, 2, US":", addr->auth_sndr); + } + } + + if (LOGGING(pipelining)) + { + if (testflag(addr, af_pipelining)) + g = string_catn(g, US" L", 2); +#ifndef DISABLE_PIPE_CONNECT + if (testflag(addr, af_early_pipe)) + g = string_catn(g, US"*", 1); +#endif + } + +#ifndef DISABLE_PRDR + if (testflag(addr, af_prdr_used)) + g = string_catn(g, US" PRDR", 5); +#endif + + if (testflag(addr, af_chunking_used)) + g = string_catn(g, US" K", 2); + } + +/* confirmation message (SMTP (host_used) and LMTP (driver_name)) */ + +if ( LOGGING(smtp_confirmation) + && addr->message + && (addr->host_used || Ustrcmp(addr->transport->driver_name, "lmtp") == 0) + ) + { + unsigned lim = big_buffer_size < 1024 ? big_buffer_size : 1024; + uschar *p = big_buffer; + uschar *ss = addr->message; + *p++ = '\"'; + for (int i = 0; i < lim && ss[i] != 0; i++) /* limit logged amount */ + { + if (ss[i] == '\"' || ss[i] == '\\') *p++ = '\\'; /* quote \ and " */ + *p++ = ss[i]; + } + *p++ = '\"'; + *p = 0; + g = string_append(g, 2, US" C=", big_buffer); + } + +/* Time on queue and actual time taken to deliver */ + +if (LOGGING(queue_time)) + g = string_append(g, 2, US" QT=", + string_timesince(&received_time)); + +if (LOGGING(deliver_time)) + g = string_append(g, 2, US" DT=", string_timediff(&addr->delivery_time)); + +/* string_cat() always leaves room for the terminator. Release the +store we used to build the line after writing it. */ + +log_write(0, flags, "%s", string_from_gstring(g)); + +#ifndef DISABLE_EVENT +if (!msg) msg_event_raise(US"msg:delivery", addr); +#endif + +store_reset(reset_point); +return; +} + + + +static void +deferral_log(address_item * addr, uschar * now, + int logflags, uschar * driver_name, uschar * driver_kind) +{ +rmark reset_point = store_mark(); +gstring * g = string_get(256); + +/* Build up the line that is used for both the message log and the main +log. */ + +/* Create the address string for logging. Must not do this earlier, because +an OK result may be changed to FAIL when a pipe returns text. */ + +g = string_log_address(g, addr, LOGGING(all_parents), FALSE); + +if (*queue_name) + g = string_append(g, 2, US" Q=", queue_name); + +/* Either driver_name contains something and driver_kind contains +" router" or " transport" (note the leading space), or driver_name is +a null string and driver_kind contains "routing" without the leading +space, if all routing has been deferred. When a domain has been held, +so nothing has been done at all, both variables contain null strings. */ + +if (driver_name) + { + if (driver_kind[1] == 't' && addr->router) + g = string_append(g, 2, US" R=", addr->router->name); + g = string_fmt_append(g, " %c=%s", toupper(driver_kind[1]), driver_name); + } +else if (driver_kind) + g = string_append(g, 2, US" ", driver_kind); + +g = string_fmt_append(g, " defer (%d)", addr->basic_errno); + +if (addr->basic_errno > 0) + g = string_append(g, 2, US": ", + US strerror(addr->basic_errno)); + +if (addr->host_used) + { + g = string_append(g, 5, + US" H=", addr->host_used->name, + US" [", addr->host_used->address, US"]"); + if (LOGGING(outgoing_port)) + { + int port = addr->host_used->port; + g = string_fmt_append(g, ":%d", port == PORT_NONE ? 25 : port); + } + } + +if (LOGGING(deliver_time)) + g = string_append(g, 2, US" DT=", string_timediff(&addr->delivery_time)); + +if (addr->message) + g = string_append(g, 2, US": ", addr->message); + +(void) string_from_gstring(g); + +/* Log the deferment in the message log, but don't clutter it +up with retry-time defers after the first delivery attempt. */ + +if (f.deliver_firsttime || addr->basic_errno > ERRNO_RETRY_BASE) + deliver_msglog("%s %s\n", now, g->s); + +/* Write the main log and reset the store. +For errors of the type "retry time not reached" (also remotes skipped +on queue run), logging is controlled by L_retry_defer. Note that this kind +of error number is negative, and all the retry ones are less than any +others. */ + + +log_write(addr->basic_errno <= ERRNO_RETRY_BASE ? L_retry_defer : 0, logflags, + "== %s", g->s); + +store_reset(reset_point); +return; +} + + + +static void +failure_log(address_item * addr, uschar * driver_kind, uschar * now) +{ +rmark reset_point = store_mark(); +gstring * g = string_get(256); + +#ifndef DISABLE_EVENT +/* Message failures for which we will send a DSN get their event raised +later so avoid doing it here. */ + +if ( !addr->prop.ignore_error + && !(addr->dsn_flags & (rf_dsnflags & ~rf_notify_failure)) + ) + msg_event_raise(US"msg:fail:delivery", addr); +#endif + +/* Build up the log line for the message and main logs */ + +/* Create the address string for logging. Must not do this earlier, because +an OK result may be changed to FAIL when a pipe returns text. */ + +g = string_log_address(g, addr, LOGGING(all_parents), FALSE); + +if (LOGGING(sender_on_delivery)) + g = string_append(g, 3, US" F=<", sender_address, US">"); + +if (*queue_name) + g = string_append(g, 2, US" Q=", queue_name); + +/* Return path may not be set if no delivery actually happened */ + +if (used_return_path && LOGGING(return_path_on_delivery)) + g = string_append(g, 3, US" P=<", used_return_path, US">"); + +if (addr->router) + g = string_append(g, 2, US" R=", addr->router->name); +if (addr->transport) + g = string_append(g, 2, US" T=", addr->transport->name); + +if (addr->host_used) + g = d_hostlog(g, addr); + +#ifndef DISABLE_TLS +g = d_tlslog(g, addr); +#endif + +if (addr->basic_errno > 0) + g = string_append(g, 2, US": ", US strerror(addr->basic_errno)); + +if (addr->message) + g = string_append(g, 2, US": ", addr->message); + +if (LOGGING(deliver_time)) + g = string_append(g, 2, US" DT=", string_timediff(&addr->delivery_time)); + +(void) string_from_gstring(g); + +/* Do the logging. For the message log, "routing failed" for those cases, +just to make it clearer. */ + +if (driver_kind) + deliver_msglog("%s %s failed for %s\n", now, driver_kind, g->s); +else + deliver_msglog("%s %s\n", now, g->s); + +log_write(0, LOG_MAIN, "** %s", g->s); + +store_reset(reset_point); +return; +} + + + +/************************************************* +* Actions at the end of handling an address * +*************************************************/ + +/* This is a function for processing a single address when all that can be done +with it has been done. + +Arguments: + addr points to the address block + result the result of the delivery attempt + logflags flags for log_write() (LOG_MAIN and/or LOG_PANIC) + driver_type indicates which type of driver (transport, or router) was last + to process the address + logchar '=' or '-' for use when logging deliveries with => or -> + +Returns: nothing +*/ + +static void +post_process_one(address_item *addr, int result, int logflags, int driver_type, + int logchar) +{ +uschar *now = tod_stamp(tod_log); +uschar *driver_kind = NULL; +uschar *driver_name = NULL; + +DEBUG(D_deliver) debug_printf("post-process %s (%d)\n", addr->address, result); + +/* Set up driver kind and name for logging. Disable logging if the router or +transport has disabled it. */ + +if (driver_type == EXIM_DTYPE_TRANSPORT) + { + if (addr->transport) + { + driver_name = addr->transport->name; + driver_kind = US" transport"; + f.disable_logging = addr->transport->disable_logging; + } + else driver_kind = US"transporting"; + } +else if (driver_type == EXIM_DTYPE_ROUTER) + { + if (addr->router) + { + driver_name = addr->router->name; + driver_kind = US" router"; + f.disable_logging = addr->router->disable_logging; + } + else driver_kind = US"routing"; + } + +/* If there's an error message set, ensure that it contains only printing +characters - it should, but occasionally things slip in and this at least +stops the log format from getting wrecked. We also scan the message for an LDAP +expansion item that has a password setting, and flatten the password. This is a +fudge, but I don't know a cleaner way of doing this. (If the item is badly +malformed, it won't ever have gone near LDAP.) */ + +if (addr->message) + { + const uschar * s = string_printing(addr->message); + + /* deconst cast ok as string_printing known to have alloc'n'copied */ + addr->message = expand_hide_passwords(US s); + } + +/* If we used a transport that has one of the "return_output" options set, and +if it did in fact generate some output, then for return_output we treat the +message as failed if it was not already set that way, so that the output gets +returned to the sender, provided there is a sender to send it to. For +return_fail_output, do this only if the delivery failed. Otherwise we just +unlink the file, and remove the name so that if the delivery failed, we don't +try to send back an empty or unwanted file. The log_output options operate only +on a non-empty file. + +In any case, we close the message file, because we cannot afford to leave a +file-descriptor for one address while processing (maybe very many) others. */ + +if (addr->return_file >= 0 && addr->return_filename) + { + BOOL return_output = FALSE; + struct stat statbuf; + (void)EXIMfsync(addr->return_file); + + /* If there is no output, do nothing. */ + + if (fstat(addr->return_file, &statbuf) == 0 && statbuf.st_size > 0) + { + transport_instance *tb = addr->transport; + + /* Handle logging options */ + + if ( tb->log_output + || result == FAIL && tb->log_fail_output + || result == DEFER && tb->log_defer_output + ) + { + uschar *s; + FILE *f = Ufopen(addr->return_filename, "rb"); + if (!f) + log_write(0, LOG_MAIN|LOG_PANIC, "failed to open %s to log output " + "from %s transport: %s", addr->return_filename, tb->name, + strerror(errno)); + else + if ((s = US Ufgets(big_buffer, big_buffer_size, f))) + { + uschar *p = big_buffer + Ustrlen(big_buffer); + const uschar * sp; + while (p > big_buffer && isspace(p[-1])) p--; + *p = 0; + sp = string_printing(big_buffer); + log_write(0, LOG_MAIN, "<%s>: %s transport output: %s", + addr->address, tb->name, sp); + } + (void)fclose(f); + } + + /* Handle returning options, but only if there is an address to return + the text to. */ + + if (sender_address[0] != 0 || addr->prop.errors_address) + if (tb->return_output) + { + addr->transport_return = result = FAIL; + if (addr->basic_errno == 0 && !addr->message) + addr->message = US"return message generated"; + return_output = TRUE; + } + else + if (tb->return_fail_output && result == FAIL) return_output = TRUE; + } + + /* Get rid of the file unless it might be returned, but close it in + all cases. */ + + if (!return_output) + { + Uunlink(addr->return_filename); + addr->return_filename = NULL; + addr->return_file = -1; + } + + (void)close(addr->return_file); + } + +/* The success case happens only after delivery by a transport. */ + +if (result == OK) + { + addr->next = addr_succeed; + addr_succeed = addr; + + /* Call address_done() to ensure that we don't deliver to this address again, + and write appropriate things to the message log. If it is a child address, we + call child_done() to scan the ancestors and mark them complete if this is the + last child to complete. */ + + address_done(addr, now); + DEBUG(D_deliver) debug_printf("%s delivered\n", addr->address); + + if (!addr->parent) + deliver_msglog("%s %s: %s%s succeeded\n", now, addr->address, + driver_name, driver_kind); + else + { + deliver_msglog("%s %s <%s>: %s%s succeeded\n", now, addr->address, + addr->parent->address, driver_name, driver_kind); + child_done(addr, now); + } + + /* Certificates for logging (via events) */ +#ifndef DISABLE_TLS + tls_out.ourcert = addr->ourcert; + addr->ourcert = NULL; + tls_out.peercert = addr->peercert; + addr->peercert = NULL; + + tls_out.ver = addr->tlsver; + tls_out.cipher = addr->cipher; + tls_out.peerdn = addr->peerdn; + tls_out.ocsp = addr->ocsp; +# ifdef SUPPORT_DANE + tls_out.dane_verified = testflag(addr, af_dane_verified); +# endif +#endif + + delivery_log(LOG_MAIN, addr, logchar, NULL); + +#ifndef DISABLE_TLS + tls_free_cert(&tls_out.ourcert); + tls_free_cert(&tls_out.peercert); + tls_out.ver = NULL; + tls_out.cipher = NULL; + tls_out.peerdn = NULL; + tls_out.ocsp = OCSP_NOT_REQ; +# ifdef SUPPORT_DANE + tls_out.dane_verified = FALSE; +# endif +#endif + } + + +/* Soft failure, or local delivery process failed; freezing may be +requested. */ + +else if (result == DEFER || result == PANIC) + { + if (result == PANIC) logflags |= LOG_PANIC; + + /* This puts them on the chain in reverse order. Do not change this, because + the code for handling retries assumes that the one with the retry + information is last. */ + + addr->next = addr_defer; + addr_defer = addr; + + /* The only currently implemented special action is to freeze the + message. Logging of this is done later, just before the -H file is + updated. */ + + if (addr->special_action == SPECIAL_FREEZE) + { + f.deliver_freeze = TRUE; + deliver_frozen_at = time(NULL); + update_spool = TRUE; + } + + /* If doing a 2-stage queue run, we skip writing to either the message + log or the main log for SMTP defers. */ + + if (!f.queue_2stage || addr->basic_errno != 0) + deferral_log(addr, now, logflags, driver_name, driver_kind); + } + + +/* Hard failure. If there is an address to which an error message can be sent, +put this address on the failed list. If not, put it on the deferred list and +freeze the mail message for human attention. The latter action can also be +explicitly requested by a router or transport. */ + +else + { + /* If this is a delivery error, or a message for which no replies are + wanted, and the message's age is greater than ignore_bounce_errors_after, + force the af_ignore_error flag. This will cause the address to be discarded + later (with a log entry). */ + + if (!*sender_address && message_age >= ignore_bounce_errors_after) + addr->prop.ignore_error = TRUE; + + /* Freeze the message if requested, or if this is a bounce message (or other + message with null sender) and this address does not have its own errors + address. However, don't freeze if errors are being ignored. The actual code + to ignore occurs later, instead of sending a message. Logging of freezing + occurs later, just before writing the -H file. */ + + if ( !addr->prop.ignore_error + && ( addr->special_action == SPECIAL_FREEZE + || (sender_address[0] == 0 && !addr->prop.errors_address) + ) ) + { + frozen_info = addr->special_action == SPECIAL_FREEZE + ? US"" + : f.sender_local && !f.local_error_message + ? US" (message created with -f <>)" + : US" (delivery error message)"; + f.deliver_freeze = TRUE; + deliver_frozen_at = time(NULL); + update_spool = TRUE; + + /* The address is put on the defer rather than the failed queue, because + the message is being retained. */ + + addr->next = addr_defer; + addr_defer = addr; + } + + /* Don't put the address on the nonrecipients tree yet; wait until an + error message has been successfully sent. */ + + else + { + addr->next = addr_failed; + addr_failed = addr; + } + + failure_log(addr, driver_name ? NULL : driver_kind, now); + } + +/* Ensure logging is turned on again in all cases */ + +f.disable_logging = FALSE; +} + + + + +/************************************************* +* Address-independent error * +*************************************************/ + +/* This function is called when there's an error that is not dependent on a +particular address, such as an expansion string failure. It puts the error into +all the addresses in a batch, logs the incident on the main and panic logs, and +clears the expansions. It is mostly called from local_deliver(), but can be +called for a remote delivery via findugid(). + +Arguments: + logit TRUE if (MAIN+PANIC) logging required + addr the first of the chain of addresses + code the error code + format format string for error message, or NULL if already set in addr + ... arguments for the format + +Returns: nothing +*/ + +static void +common_error(BOOL logit, address_item *addr, int code, uschar *format, ...) +{ +addr->basic_errno = code; + +if (format) + { + va_list ap; + gstring * g; + + va_start(ap, format); + g = string_vformat(NULL, SVFMT_EXTEND|SVFMT_REBUFFER, CS format, ap); + va_end(ap); + addr->message = string_from_gstring(g); + } + +for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next) + { + addr2->basic_errno = code; + addr2->message = addr->message; + } + +if (logit) log_write(0, LOG_MAIN|LOG_PANIC, "%s", addr->message); +deliver_set_expansions(NULL); +} + + + + +/************************************************* +* Check a "never users" list * +*************************************************/ + +/* This function is called to check whether a uid is on one of the two "never +users" lists. + +Arguments: + uid the uid to be checked + nusers the list to be scanned; the first item in the list is the count + +Returns: TRUE if the uid is on the list +*/ + +static BOOL +check_never_users(uid_t uid, uid_t *nusers) +{ +if (!nusers) return FALSE; +for (int i = 1; i <= (int)(nusers[0]); i++) if (nusers[i] == uid) return TRUE; +return FALSE; +} + + + +/************************************************* +* Find uid and gid for a transport * +*************************************************/ + +/* This function is called for both local and remote deliveries, to find the +uid/gid under which to run the delivery. The values are taken preferentially +from the transport (either explicit or deliver_as_creator), then from the +address (i.e. the router), and if nothing is set, the exim uid/gid are used. If +the resulting uid is on the "never_users" or the "fixed_never_users" list, a +panic error is logged, and the function fails (which normally leads to delivery +deferral). + +Arguments: + addr the address (possibly a chain) + tp the transport + uidp pointer to uid field + gidp pointer to gid field + igfp pointer to the use_initgroups field + +Returns: FALSE if failed - error has been set in address(es) +*/ + +static BOOL +findugid(address_item *addr, transport_instance *tp, uid_t *uidp, gid_t *gidp, + BOOL *igfp) +{ +uschar *nuname; +BOOL gid_set = FALSE; + +/* Default initgroups flag comes from the transport */ + +*igfp = tp->initgroups; + +/* First see if there's a gid on the transport, either fixed or expandable. +The expanding function always logs failure itself. */ + +if (tp->gid_set) + { + *gidp = tp->gid; + gid_set = TRUE; + } +else if (tp->expand_gid) + { + if (!route_find_expanded_group(tp->expand_gid, tp->name, US"transport", gidp, + &(addr->message))) + { + common_error(FALSE, addr, ERRNO_GIDFAIL, NULL); + return FALSE; + } + gid_set = TRUE; + } + +/* If the transport did not set a group, see if the router did. */ + +if (!gid_set && testflag(addr, af_gid_set)) + { + *gidp = addr->gid; + gid_set = TRUE; + } + +/* Pick up a uid from the transport if one is set. */ + +if (tp->uid_set) *uidp = tp->uid; + +/* Otherwise, try for an expandable uid field. If it ends up as a numeric id, +it does not provide a passwd value from which a gid can be taken. */ + +else if (tp->expand_uid) + { + struct passwd *pw; + if (!route_find_expanded_user(tp->expand_uid, tp->name, US"transport", &pw, + uidp, &(addr->message))) + { + common_error(FALSE, addr, ERRNO_UIDFAIL, NULL); + return FALSE; + } + if (!gid_set && pw) + { + *gidp = pw->pw_gid; + gid_set = TRUE; + } + } + +/* If the transport doesn't set the uid, test the deliver_as_creator flag. */ + +else if (tp->deliver_as_creator) + { + *uidp = originator_uid; + if (!gid_set) + { + *gidp = originator_gid; + gid_set = TRUE; + } + } + +/* Otherwise see if the address specifies the uid and if so, take it and its +initgroups flag. */ + +else if (testflag(addr, af_uid_set)) + { + *uidp = addr->uid; + *igfp = testflag(addr, af_initgroups); + } + +/* Nothing has specified the uid - default to the Exim user, and group if the +gid is not set. */ + +else + { + *uidp = exim_uid; + if (!gid_set) + { + *gidp = exim_gid; + gid_set = TRUE; + } + } + +/* If no gid is set, it is a disaster. We default to the Exim gid only if +defaulting to the Exim uid. In other words, if the configuration has specified +a uid, it must also provide a gid. */ + +if (!gid_set) + { + common_error(TRUE, addr, ERRNO_GIDFAIL, US"User set without group for " + "%s transport", tp->name); + return FALSE; + } + +/* Check that the uid is not on the lists of banned uids that may not be used +for delivery processes. */ + +nuname = check_never_users(*uidp, never_users) + ? US"never_users" + : check_never_users(*uidp, fixed_never_users) + ? US"fixed_never_users" + : NULL; +if (nuname) + { + common_error(TRUE, addr, ERRNO_UIDFAIL, US"User %ld set for %s transport " + "is on the %s list", (long int)(*uidp), tp->name, nuname); + return FALSE; + } + +/* All is well */ + +return TRUE; +} + + + + +/************************************************* +* Check the size of a message for a transport * +*************************************************/ + +/* Checks that the message isn't too big for the selected transport. +This is called only when it is known that the limit is set. + +Arguments: + tp the transport + addr the (first) address being delivered + +Returns: OK + DEFER expansion failed or did not yield an integer + FAIL message too big +*/ + +int +check_message_size(transport_instance *tp, address_item *addr) +{ +int rc = OK; +int size_limit; + +deliver_set_expansions(addr); +size_limit = expand_string_integer(tp->message_size_limit, TRUE); +deliver_set_expansions(NULL); + +if (expand_string_message) + { + rc = DEFER; + addr->message = size_limit == -1 + ? string_sprintf("failed to expand message_size_limit " + "in %s transport: %s", tp->name, expand_string_message) + : string_sprintf("invalid message_size_limit " + "in %s transport: %s", tp->name, expand_string_message); + } +else if (size_limit > 0 && message_size > size_limit) + { + rc = FAIL; + addr->message = + string_sprintf("message is too big (transport limit = %d)", + size_limit); + } + +return rc; +} + + + +/************************************************* +* Transport-time check for a previous delivery * +*************************************************/ + +/* Check that this base address hasn't previously been delivered to its routed +transport. If it has been delivered, mark it done. The check is necessary at +delivery time in order to handle homonymic addresses correctly in cases where +the pattern of redirection changes between delivery attempts (so the unique +fields change). Non-homonymic previous delivery is detected earlier, at routing +time (which saves unnecessary routing). + +Arguments: + addr the address item + testing TRUE if testing wanted only, without side effects + +Returns: TRUE if previously delivered by the transport +*/ + +static BOOL +previously_transported(address_item *addr, BOOL testing) +{ +uschar * s = string_sprintf("%s/%s", + addr->unique + (testflag(addr, af_homonym)? 3:0), addr->transport->name); + +if (tree_search(tree_nonrecipients, s) != 0) + { + DEBUG(D_deliver|D_route|D_transport) + debug_printf("%s was previously delivered (%s transport): discarded\n", + addr->address, addr->transport->name); + if (!testing) child_done(addr, tod_stamp(tod_log)); + return TRUE; + } + +return FALSE; +} + + + +/****************************************************** +* Check for a given header in a header string * +******************************************************/ + +/* This function is used when generating quota warnings. The configuration may +specify any header lines it likes in quota_warn_message. If certain of them are +missing, defaults are inserted, so we need to be able to test for the presence +of a given header. + +Arguments: + hdr the required header name + hstring the header string + +Returns: TRUE the header is in the string + FALSE the header is not in the string +*/ + +static BOOL +contains_header(uschar *hdr, uschar *hstring) +{ +int len = Ustrlen(hdr); +uschar *p = hstring; +while (*p != 0) + { + if (strncmpic(p, hdr, len) == 0) + { + p += len; + while (*p == ' ' || *p == '\t') p++; + if (*p == ':') return TRUE; + } + while (*p != 0 && *p != '\n') p++; + if (*p == '\n') p++; + } +return FALSE; +} + + + + +/************************************************* +* Perform a local delivery * +*************************************************/ + +/* Each local delivery is performed in a separate process which sets its +uid and gid as specified. This is a safer way than simply changing and +restoring using seteuid(); there is a body of opinion that seteuid() +cannot be used safely. From release 4, Exim no longer makes any use of +it for delivery. Besides, not all systems have seteuid(). + +If the uid/gid are specified in the transport_instance, they are used; the +transport initialization must ensure that either both or neither are set. +Otherwise, the values associated with the address are used. If neither are set, +it is a configuration error. + +The transport or the address may specify a home directory (transport over- +rides), and if they do, this is set as $home. If neither have set a working +directory, this value is used for that as well. Otherwise $home is left unset +and the cwd is set to "/" - a directory that should be accessible to all users. + +Using a separate process makes it more complicated to get error information +back. We use a pipe to pass the return code and also an error code and error +text string back to the parent process. + +Arguments: + addr points to an address block for this delivery; for "normal" local + deliveries this is the only address to be delivered, but for + pseudo-remote deliveries (e.g. by batch SMTP to a file or pipe) + a number of addresses can be handled simultaneously, and in this + case addr will point to a chain of addresses with the same + characteristics. + + shadowing TRUE if running a shadow transport; this causes output from pipes + to be ignored. + +Returns: nothing +*/ + +static void +deliver_local(address_item *addr, BOOL shadowing) +{ +BOOL use_initgroups; +uid_t uid; +gid_t gid; +int status, len, rc; +int pfd[2]; +pid_t pid; +uschar *working_directory; +address_item *addr2; +transport_instance *tp = addr->transport; + +/* Set up the return path from the errors or sender address. If the transport +has its own return path setting, expand it and replace the existing value. */ + +if(addr->prop.errors_address) + return_path = addr->prop.errors_address; +#ifdef EXPERIMENTAL_SRS +else if (addr->prop.srs_sender) + return_path = addr->prop.srs_sender; +#endif +else + return_path = sender_address; + +if (tp->return_path) + { + uschar *new_return_path = expand_string(tp->return_path); + if (!new_return_path) + { + if (!f.expand_string_forcedfail) + { + common_error(TRUE, addr, ERRNO_EXPANDFAIL, + US"Failed to expand return path \"%s\" in %s transport: %s", + tp->return_path, tp->name, expand_string_message); + return; + } + } + else return_path = new_return_path; + } + +/* For local deliveries, one at a time, the value used for logging can just be +set directly, once and for all. */ + +used_return_path = return_path; + +/* Sort out the uid, gid, and initgroups flag. If an error occurs, the message +gets put into the address(es), and the expansions are unset, so we can just +return. */ + +if (!findugid(addr, tp, &uid, &gid, &use_initgroups)) return; + +/* See if either the transport or the address specifies a home directory. A +home directory set in the address may already be expanded; a flag is set to +indicate that. In other cases we must expand it. */ + +if ( (deliver_home = tp->home_dir) /* Set in transport, or */ + || ( (deliver_home = addr->home_dir) /* Set in address and */ + && !testflag(addr, af_home_expanded) /* not expanded */ + ) ) + { + uschar *rawhome = deliver_home; + deliver_home = NULL; /* in case it contains $home */ + if (!(deliver_home = expand_string(rawhome))) + { + common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"home directory \"%s\" failed " + "to expand for %s transport: %s", rawhome, tp->name, + expand_string_message); + return; + } + if (*deliver_home != '/') + { + common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"home directory path \"%s\" " + "is not absolute for %s transport", deliver_home, tp->name); + return; + } + } + +/* See if either the transport or the address specifies a current directory, +and if so, expand it. If nothing is set, use the home directory, unless it is +also unset in which case use "/", which is assumed to be a directory to which +all users have access. It is necessary to be in a visible directory for some +operating systems when running pipes, as some commands (e.g. "rm" under Solaris +2.5) require this. */ + +working_directory = tp->current_dir ? tp->current_dir : addr->current_dir; +if (working_directory) + { + uschar *raw = working_directory; + if (!(working_directory = expand_string(raw))) + { + common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"current directory \"%s\" " + "failed to expand for %s transport: %s", raw, tp->name, + expand_string_message); + return; + } + if (*working_directory != '/') + { + common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"current directory path " + "\"%s\" is not absolute for %s transport", working_directory, tp->name); + return; + } + } +else working_directory = deliver_home ? deliver_home : US"/"; + +/* If one of the return_output flags is set on the transport, create and open a +file in the message log directory for the transport to write its output onto. +This is mainly used by pipe transports. The file needs to be unique to the +address. This feature is not available for shadow transports. */ + +if ( !shadowing + && ( tp->return_output || tp->return_fail_output + || tp->log_output || tp->log_fail_output || tp->log_defer_output + ) ) + { + uschar * error; + + addr->return_filename = + spool_fname(US"msglog", message_subdir, message_id, + string_sprintf("-%d-%d", getpid(), return_count++)); + + if ((addr->return_file = open_msglog_file(addr->return_filename, 0400, &error)) < 0) + { + common_error(TRUE, addr, errno, US"Unable to %s file for %s transport " + "to return message: %s", error, tp->name, strerror(errno)); + return; + } + } + +/* Create the pipe for inter-process communication. */ + +if (pipe(pfd) != 0) + { + common_error(TRUE, addr, ERRNO_PIPEFAIL, US"Creation of pipe failed: %s", + strerror(errno)); + return; + } + +/* Now fork the process to do the real work in the subprocess, but first +ensure that all cached resources are freed so that the subprocess starts with +a clean slate and doesn't interfere with the parent process. */ + +search_tidyup(); + +if ((pid = exim_fork(US"delivery-local")) == 0) + { + BOOL replicate = TRUE; + + /* Prevent core dumps, as we don't want them in users' home directories. + HP-UX doesn't have RLIMIT_CORE; I don't know how to do this in that + system. Some experimental/developing systems (e.g. GNU/Hurd) may define + RLIMIT_CORE but not support it in setrlimit(). For such systems, do not + complain if the error is "not supported". + + There are two scenarios where changing the max limit has an effect. In one, + the user is using a .forward and invoking a command of their choice via pipe; + for these, we do need the max limit to be 0 unless the admin chooses to + permit an increased limit. In the other, the command is invoked directly by + the transport and is under administrator control, thus being able to raise + the limit aids in debugging. So there's no general always-right answer. + + Thus we inhibit core-dumps completely but let individual transports, while + still root, re-raise the limits back up to aid debugging. We make the + default be no core-dumps -- few enough people can use core dumps in + diagnosis that it's reasonable to make them something that has to be explicitly requested. + */ + +#ifdef RLIMIT_CORE + struct rlimit rl; + rl.rlim_cur = 0; + rl.rlim_max = 0; + if (setrlimit(RLIMIT_CORE, &rl) < 0) + { +# ifdef SETRLIMIT_NOT_SUPPORTED + if (errno != ENOSYS && errno != ENOTSUP) +# endif + log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_CORE) failed: %s", + strerror(errno)); + } +#endif + + /* Reset the random number generator, so different processes don't all + have the same sequence. */ + + random_seed = 0; + + /* If the transport has a setup entry, call this first, while still + privileged. (Appendfile uses this to expand quota, for example, while + able to read private files.) */ + + if (addr->transport->setup) + switch((addr->transport->setup)(addr->transport, addr, NULL, uid, gid, + &(addr->message))) + { + case DEFER: + addr->transport_return = DEFER; + goto PASS_BACK; + + case FAIL: + addr->transport_return = PANIC; + goto PASS_BACK; + } + + /* Ignore SIGINT and SIGTERM during delivery. Also ignore SIGUSR1, as + when the process becomes unprivileged, it won't be able to write to the + process log. SIGHUP is ignored throughout exim, except when it is being + run as a daemon. */ + + signal(SIGINT, SIG_IGN); + signal(SIGTERM, SIG_IGN); + signal(SIGUSR1, SIG_IGN); + + /* Close the unwanted half of the pipe, and set close-on-exec for the other + half - for transports that exec things (e.g. pipe). Then set the required + gid/uid. */ + + (void)close(pfd[pipe_read]); + (void)fcntl(pfd[pipe_write], F_SETFD, fcntl(pfd[pipe_write], F_GETFD) | + FD_CLOEXEC); + exim_setugid(uid, gid, use_initgroups, + string_sprintf("local delivery to %s <%s> transport=%s", addr->local_part, + addr->address, addr->transport->name)); + + DEBUG(D_deliver) + { + debug_printf(" home=%s current=%s\n", deliver_home, working_directory); + for (address_item * batched = addr->next; batched; batched = batched->next) + debug_printf("additional batched address: %s\n", batched->address); + } + + /* Set an appropriate working directory. */ + + if (Uchdir(working_directory) < 0) + { + addr->transport_return = DEFER; + addr->basic_errno = errno; + addr->message = string_sprintf("failed to chdir to %s", working_directory); + } + + /* If successful, call the transport */ + + else + { + BOOL ok = TRUE; + set_process_info("delivering %s to %s using %s", message_id, + addr->local_part, addr->transport->name); + + /* Setting this global in the subprocess means we need never clear it */ + transport_name = addr->transport->name; + + /* If a transport filter has been specified, set up its argument list. + Any errors will get put into the address, and FALSE yielded. */ + + if (addr->transport->filter_command) + { + ok = transport_set_up_command(&transport_filter_argv, + addr->transport->filter_command, + TRUE, PANIC, addr, US"transport filter", NULL); + transport_filter_timeout = addr->transport->filter_timeout; + } + else transport_filter_argv = NULL; + + if (ok) + { + debug_print_string(addr->transport->debug_string); + replicate = !(addr->transport->info->code)(addr->transport, addr); + } + } + + /* Pass the results back down the pipe. If necessary, first replicate the + status in the top address to the others in the batch. The label is the + subject of a goto when a call to the transport's setup function fails. We + pass the pointer to the transport back in case it got changed as a result of + file_format in appendfile. */ + + PASS_BACK: + + if (replicate) replicate_status(addr); + for (addr2 = addr; addr2; addr2 = addr2->next) + { + int i; + int local_part_length = Ustrlen(addr2->local_part); + uschar *s; + int ret; + + if( (ret = write(pfd[pipe_write], &addr2->transport_return, sizeof(int))) != sizeof(int) + || (ret = write(pfd[pipe_write], &transport_count, sizeof(transport_count))) != sizeof(transport_count) + || (ret = write(pfd[pipe_write], &addr2->flags, sizeof(addr2->flags))) != sizeof(addr2->flags) + || (ret = write(pfd[pipe_write], &addr2->basic_errno, sizeof(int))) != sizeof(int) + || (ret = write(pfd[pipe_write], &addr2->more_errno, sizeof(int))) != sizeof(int) + || (ret = write(pfd[pipe_write], &addr2->delivery_time, sizeof(struct timeval))) != sizeof(struct timeval) + || (ret = write(pfd[pipe_write], &addr2->special_action, sizeof(int))) != sizeof(int) + || (ret = write(pfd[pipe_write], &addr2->transport, + sizeof(transport_instance *))) != sizeof(transport_instance *) + + /* For a file delivery, pass back the local part, in case the original + was only part of the final delivery path. This gives more complete + logging. */ + + || (testflag(addr2, af_file) + && ( (ret = write(pfd[pipe_write], &local_part_length, sizeof(int))) != sizeof(int) + || (ret = write(pfd[pipe_write], addr2->local_part, local_part_length)) != local_part_length + ) + ) + ) + log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s", + ret == -1 ? strerror(errno) : "short write"); + + /* Now any messages */ + + for (i = 0, s = addr2->message; i < 2; i++, s = addr2->user_message) + { + int message_length = s ? Ustrlen(s) + 1 : 0; + if( (ret = write(pfd[pipe_write], &message_length, sizeof(int))) != sizeof(int) + || message_length > 0 && (ret = write(pfd[pipe_write], s, message_length)) != message_length + ) + log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s", + ret == -1 ? strerror(errno) : "short write"); + } + } + + /* OK, this process is now done. Free any cached resources that it opened, + and close the pipe we were writing down before exiting. */ + + (void)close(pfd[pipe_write]); + search_tidyup(); + exit(EXIT_SUCCESS); + } + +/* Back in the main process: panic if the fork did not succeed. This seems +better than returning an error - if forking is failing it is probably best +not to try other deliveries for this message. */ + +if (pid < 0) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Fork failed for local delivery to %s", + addr->address); + +/* Read the pipe to get the delivery status codes and error messages. Our copy +of the writing end must be closed first, as otherwise read() won't return zero +on an empty pipe. We check that a status exists for each address before +overwriting the address structure. If data is missing, the default DEFER status +will remain. Afterwards, close the reading end. */ + +(void)close(pfd[pipe_write]); + +for (addr2 = addr; addr2; addr2 = addr2->next) + { + if ((len = read(pfd[pipe_read], &status, sizeof(int))) > 0) + { + int i; + uschar **sptr; + + addr2->transport_return = status; + len = read(pfd[pipe_read], &transport_count, + sizeof(transport_count)); + len = read(pfd[pipe_read], &addr2->flags, sizeof(addr2->flags)); + len = read(pfd[pipe_read], &addr2->basic_errno, sizeof(int)); + len = read(pfd[pipe_read], &addr2->more_errno, sizeof(int)); + len = read(pfd[pipe_read], &addr2->delivery_time, sizeof(struct timeval)); + len = read(pfd[pipe_read], &addr2->special_action, sizeof(int)); + len = read(pfd[pipe_read], &addr2->transport, + sizeof(transport_instance *)); + + if (testflag(addr2, af_file)) + { + int llen; + if ( read(pfd[pipe_read], &llen, sizeof(int)) != sizeof(int) + || llen > 64*4 /* limit from rfc 5821, times I18N factor */ + ) + { + log_write(0, LOG_MAIN|LOG_PANIC, "bad local_part length read" + " from delivery subprocess"); + break; + } + /* sanity-checked llen so disable the Coverity error */ + /* coverity[tainted_data] */ + if (read(pfd[pipe_read], big_buffer, llen) != llen) + { + log_write(0, LOG_MAIN|LOG_PANIC, "bad local_part read" + " from delivery subprocess"); + break; + } + big_buffer[llen] = 0; + addr2->local_part = string_copy(big_buffer); + } + + for (i = 0, sptr = &addr2->message; i < 2; i++, sptr = &addr2->user_message) + { + int message_length; + len = read(pfd[pipe_read], &message_length, sizeof(int)); + if (message_length > 0) + { + len = read(pfd[pipe_read], big_buffer, message_length); + big_buffer[big_buffer_size-1] = '\0'; /* guard byte */ + if (len > 0) *sptr = string_copy(big_buffer); + } + } + } + + else + { + log_write(0, LOG_MAIN|LOG_PANIC, "failed to read delivery status for %s " + "from delivery subprocess", addr2->unique); + break; + } + } + +(void)close(pfd[pipe_read]); + +/* Unless shadowing, write all successful addresses immediately to the journal +file, to ensure they are recorded asap. For homonymic addresses, use the base +address plus the transport name. Failure to write the journal is panic-worthy, +but don't stop, as it may prove possible subsequently to update the spool file +in order to record the delivery. */ + +if (!shadowing) + { + for (addr2 = addr; addr2; addr2 = addr2->next) + if (addr2->transport_return == OK) + { + if (testflag(addr2, af_homonym)) + sprintf(CS big_buffer, "%.500s/%s\n", addr2->unique + 3, tp->name); + else + sprintf(CS big_buffer, "%.500s\n", addr2->unique); + + /* In the test harness, wait just a bit to let the subprocess finish off + any debug output etc first. */ + + testharness_pause_ms(300); + + DEBUG(D_deliver) debug_printf("journalling %s", big_buffer); + len = Ustrlen(big_buffer); + if (write(journal_fd, big_buffer, len) != len) + log_write(0, LOG_MAIN|LOG_PANIC, "failed to update journal for %s: %s", + big_buffer, strerror(errno)); + } + + /* Ensure the journal file is pushed out to disk. */ + + if (EXIMfsync(journal_fd) < 0) + log_write(0, LOG_MAIN|LOG_PANIC, "failed to fsync journal: %s", + strerror(errno)); + } + +/* Wait for the process to finish. If it terminates with a non-zero code, +freeze the message (except for SIGTERM, SIGKILL and SIGQUIT), but leave the +status values of all the addresses as they are. Take care to handle the case +when the subprocess doesn't seem to exist. This has been seen on one system +when Exim was called from an MUA that set SIGCHLD to SIG_IGN. When that +happens, wait() doesn't recognize the termination of child processes. Exim now +resets SIGCHLD to SIG_DFL, but this code should still be robust. */ + +while ((rc = wait(&status)) != pid) + if (rc < 0 && errno == ECHILD) /* Process has vanished */ + { + log_write(0, LOG_MAIN, "%s transport process vanished unexpectedly", + addr->transport->driver_name); + status = 0; + break; + } + +if ((status & 0xffff) != 0) + { + int msb = (status >> 8) & 255; + int lsb = status & 255; + int code = (msb == 0)? (lsb & 0x7f) : msb; + if (msb != 0 || (code != SIGTERM && code != SIGKILL && code != SIGQUIT)) + addr->special_action = SPECIAL_FREEZE; + log_write(0, LOG_MAIN|LOG_PANIC, "%s transport process returned non-zero " + "status 0x%04x: %s %d", + addr->transport->driver_name, + status, + msb == 0 ? "terminated by signal" : "exit code", + code); + } + +/* If SPECIAL_WARN is set in the top address, send a warning message. */ + +if (addr->special_action == SPECIAL_WARN && addr->transport->warn_message) + { + int fd; + uschar *warn_message; + pid_t pid; + + DEBUG(D_deliver) debug_printf("Warning message requested by transport\n"); + + if (!(warn_message = expand_string(addr->transport->warn_message))) + log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand \"%s\" (warning " + "message for %s transport): %s", addr->transport->warn_message, + addr->transport->name, expand_string_message); + + else if ((pid = child_open_exim(&fd, US"tpt-warning-message")) > 0) + { + FILE *f = fdopen(fd, "wb"); + if (errors_reply_to && !contains_header(US"Reply-To", warn_message)) + fprintf(f, "Reply-To: %s\n", errors_reply_to); + fprintf(f, "Auto-Submitted: auto-replied\n"); + if (!contains_header(US"From", warn_message)) + moan_write_from(f); + fprintf(f, "%s", CS warn_message); + + /* Close and wait for child process to complete, without a timeout. */ + + (void)fclose(f); + (void)child_close(pid, 0); + } + + addr->special_action = SPECIAL_NONE; + } +} + + + + +/* Check transport for the given concurrency limit. Return TRUE if over +the limit (or an expansion failure), else FALSE and if there was a limit, +the key for the hints database used for the concurrency count. */ + +static BOOL +tpt_parallel_check(transport_instance * tp, address_item * addr, uschar ** key) +{ +unsigned max_parallel; + +if (!tp->max_parallel) return FALSE; + +max_parallel = (unsigned) expand_string_integer(tp->max_parallel, TRUE); +if (expand_string_message) + { + log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand max_parallel option " + "in %s transport (%s): %s", tp->name, addr->address, + expand_string_message); + return TRUE; + } + +if (max_parallel > 0) + { + uschar * serialize_key = string_sprintf("tpt-serialize-%s", tp->name); + if (!enq_start(serialize_key, max_parallel)) + { + address_item * next; + DEBUG(D_transport) + debug_printf("skipping tpt %s because concurrency limit %u reached\n", + tp->name, max_parallel); + do + { + next = addr->next; + addr->message = US"concurrency limit reached for transport"; + addr->basic_errno = ERRNO_TRETRY; + post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_TRANSPORT, 0); + } while ((addr = next)); + return TRUE; + } + *key = serialize_key; + } +return FALSE; +} + + + +/************************************************* +* Do local deliveries * +*************************************************/ + +/* This function processes the list of addresses in addr_local. True local +deliveries are always done one address at a time. However, local deliveries can +be batched up in some cases. Typically this is when writing batched SMTP output +files for use by some external transport mechanism, or when running local +deliveries over LMTP. + +Arguments: None +Returns: Nothing +*/ + +static void +do_local_deliveries(void) +{ +open_db dbblock; +open_db *dbm_file = NULL; +time_t now = time(NULL); + +/* Loop until we have exhausted the supply of local deliveries */ + +while (addr_local) + { + struct timeval delivery_start; + struct timeval deliver_time; + address_item *addr2, *addr3, *nextaddr; + int logflags = LOG_MAIN; + int logchar = f.dont_deliver? '*' : '='; + transport_instance *tp; + uschar * serialize_key = NULL; + + /* Pick the first undelivered address off the chain */ + + address_item *addr = addr_local; + addr_local = addr->next; + addr->next = NULL; + + DEBUG(D_deliver|D_transport) + debug_printf("--------> %s <--------\n", addr->address); + + /* An internal disaster if there is no transport. Should not occur! */ + + if (!(tp = addr->transport)) + { + logflags |= LOG_PANIC; + f.disable_logging = FALSE; /* Jic */ + addr->message = addr->router + ? string_sprintf("No transport set by %s router", addr->router->name) + : US"No transport set by system filter"; + post_process_one(addr, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0); + continue; + } + + /* Check that this base address hasn't previously been delivered to this + transport. The check is necessary at this point to handle homonymic addresses + correctly in cases where the pattern of redirection changes between delivery + attempts. Non-homonymic previous delivery is detected earlier, at routing + time. */ + + if (previously_transported(addr, FALSE)) continue; + + /* There are weird cases where logging is disabled */ + + f.disable_logging = tp->disable_logging; + + /* Check for batched addresses and possible amalgamation. Skip all the work + if either batch_max <= 1 or there aren't any other addresses for local + delivery. */ + + if (tp->batch_max > 1 && addr_local) + { + int batch_count = 1; + BOOL uses_dom = readconf_depends((driver_instance *)tp, US"domain"); + BOOL uses_lp = ( testflag(addr, af_pfr) + && (testflag(addr, af_file) || addr->local_part[0] == '|') + ) + || readconf_depends((driver_instance *)tp, US"local_part"); + uschar *batch_id = NULL; + address_item **anchor = &addr_local; + address_item *last = addr; + address_item *next; + + /* Expand the batch_id string for comparison with other addresses. + Expansion failure suppresses batching. */ + + if (tp->batch_id) + { + deliver_set_expansions(addr); + batch_id = expand_string(tp->batch_id); + deliver_set_expansions(NULL); + if (!batch_id) + { + log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option " + "in %s transport (%s): %s", tp->name, addr->address, + expand_string_message); + batch_count = tp->batch_max; + } + } + + /* Until we reach the batch_max limit, pick off addresses which have the + same characteristics. These are: + + same transport + not previously delivered (see comment about 50 lines above) + same local part if the transport's configuration contains $local_part + or if this is a file or pipe delivery from a redirection + same domain if the transport's configuration contains $domain + same errors address + same additional headers + same headers to be removed + same uid/gid for running the transport + same first host if a host list is set + */ + + while ((next = *anchor) && batch_count < tp->batch_max) + { + BOOL ok = + tp == next->transport + && !previously_transported(next, TRUE) + && testflag(addr, af_pfr) == testflag(next, af_pfr) + && testflag(addr, af_file) == testflag(next, af_file) + && (!uses_lp || Ustrcmp(next->local_part, addr->local_part) == 0) + && (!uses_dom || Ustrcmp(next->domain, addr->domain) == 0) + && same_strings(next->prop.errors_address, addr->prop.errors_address) + && same_headers(next->prop.extra_headers, addr->prop.extra_headers) + && same_strings(next->prop.remove_headers, addr->prop.remove_headers) + && same_ugid(tp, addr, next) + && ( !addr->host_list && !next->host_list + || addr->host_list + && next->host_list + && Ustrcmp(addr->host_list->name, next->host_list->name) == 0 + ); + + /* If the transport has a batch_id setting, batch_id will be non-NULL + from the expansion outside the loop. Expand for this address and compare. + Expansion failure makes this address ineligible for batching. */ + + if (ok && batch_id) + { + uschar *bid; + address_item *save_nextnext = next->next; + next->next = NULL; /* Expansion for a single address */ + deliver_set_expansions(next); + next->next = save_nextnext; + bid = expand_string(tp->batch_id); + deliver_set_expansions(NULL); + if (!bid) + { + log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option " + "in %s transport (%s): %s", tp->name, next->address, + expand_string_message); + ok = FALSE; + } + else ok = (Ustrcmp(batch_id, bid) == 0); + } + + /* Take address into batch if OK. */ + + if (ok) + { + *anchor = next->next; /* Include the address */ + next->next = NULL; + last->next = next; + last = next; + batch_count++; + } + else anchor = &next->next; /* Skip the address */ + } + } + + /* We now have one or more addresses that can be delivered in a batch. Check + whether the transport is prepared to accept a message of this size. If not, + fail them all forthwith. If the expansion fails, or does not yield an + integer, defer delivery. */ + + if (tp->message_size_limit) + { + int rc = check_message_size(tp, addr); + if (rc != OK) + { + replicate_status(addr); + while (addr) + { + addr2 = addr->next; + post_process_one(addr, rc, logflags, EXIM_DTYPE_TRANSPORT, 0); + addr = addr2; + } + continue; /* With next batch of addresses */ + } + } + + /* If we are not running the queue, or if forcing, all deliveries will be + attempted. Otherwise, we must respect the retry times for each address. Even + when not doing this, we need to set up the retry key string, and determine + whether a retry record exists, because after a successful delivery, a delete + retry item must be set up. Keep the retry database open only for the duration + of these checks, rather than for all local deliveries, because some local + deliveries (e.g. to pipes) can take a substantial time. */ + + if (!(dbm_file = dbfn_open(US"retry", O_RDONLY, &dbblock, FALSE, TRUE))) + { + DEBUG(D_deliver|D_retry|D_hints_lookup) + debug_printf("no retry data available\n"); + } + + addr2 = addr; + addr3 = NULL; + while (addr2) + { + BOOL ok = TRUE; /* to deliver this address */ + uschar *retry_key; + + /* Set up the retry key to include the domain or not, and change its + leading character from "R" to "T". Must make a copy before doing this, + because the old key may be pointed to from a "delete" retry item after + a routing delay. */ + + retry_key = string_copy( + tp->retry_use_local_part ? addr2->address_retry_key : + addr2->domain_retry_key); + *retry_key = 'T'; + + /* Inspect the retry data. If there is no hints file, delivery happens. */ + + if (dbm_file) + { + dbdata_retry *retry_record = dbfn_read(dbm_file, retry_key); + + /* If there is no retry record, delivery happens. If there is, + remember it exists so it can be deleted after a successful delivery. */ + + if (retry_record) + { + setflag(addr2, af_lt_retry_exists); + + /* A retry record exists for this address. If queue running and not + forcing, inspect its contents. If the record is too old, or if its + retry time has come, or if it has passed its cutoff time, delivery + will go ahead. */ + + DEBUG(D_retry) + { + debug_printf("retry record exists: age=%s ", + readconf_printtime(now - retry_record->time_stamp)); + debug_printf("(max %s)\n", readconf_printtime(retry_data_expire)); + debug_printf(" time to retry = %s expired = %d\n", + readconf_printtime(retry_record->next_try - now), + retry_record->expired); + } + + if (f.queue_running && !f.deliver_force) + { + ok = (now - retry_record->time_stamp > retry_data_expire) + || (now >= retry_record->next_try) + || retry_record->expired; + + /* If we haven't reached the retry time, there is one more check + to do, which is for the ultimate address timeout. */ + + if (!ok) + ok = retry_ultimate_address_timeout(retry_key, addr2->domain, + retry_record, now); + } + } + else DEBUG(D_retry) debug_printf("no retry record exists\n"); + } + + /* This address is to be delivered. Leave it on the chain. */ + + if (ok) + { + addr3 = addr2; + addr2 = addr2->next; + } + + /* This address is to be deferred. Take it out of the chain, and + post-process it as complete. Must take it out of the chain first, + because post processing puts it on another chain. */ + + else + { + address_item *this = addr2; + this->message = US"Retry time not yet reached"; + this->basic_errno = ERRNO_LRETRY; + addr2 = addr3 ? (addr3->next = addr2->next) + : (addr = addr2->next); + post_process_one(this, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0); + } + } + + if (dbm_file) dbfn_close(dbm_file); + + /* If there are no addresses left on the chain, they all deferred. Loop + for the next set of addresses. */ + + if (!addr) continue; + + /* If the transport is limited for parallellism, enforce that here. + We use a hints DB entry, incremented here and decremented after + the transport (and any shadow transport) completes. */ + + if (tpt_parallel_check(tp, addr, &serialize_key)) + { + if (expand_string_message) + { + logflags |= LOG_PANIC; + do + { + addr = addr->next; + post_process_one(addr, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0); + } while ((addr = addr2)); + } + continue; /* Loop for the next set of addresses. */ + } + + + /* So, finally, we do have some addresses that can be passed to the + transport. Before doing so, set up variables that are relevant to a + single delivery. */ + + deliver_set_expansions(addr); + + gettimeofday(&delivery_start, NULL); + deliver_local(addr, FALSE); + timesince(&deliver_time, &delivery_start); + + /* If a shadow transport (which must perforce be another local transport), is + defined, and its condition is met, we must pass the message to the shadow + too, but only those addresses that succeeded. We do this by making a new + chain of addresses - also to keep the original chain uncontaminated. We must + use a chain rather than doing it one by one, because the shadow transport may + batch. + + NOTE: if the condition fails because of a lookup defer, there is nothing we + can do! */ + + if ( tp->shadow + && ( !tp->shadow_condition + || expand_check_condition(tp->shadow_condition, tp->name, US"transport") + ) ) + { + transport_instance *stp; + address_item *shadow_addr = NULL; + address_item **last = &shadow_addr; + + for (stp = transports; stp; stp = stp->next) + if (Ustrcmp(stp->name, tp->shadow) == 0) break; + + if (!stp) + log_write(0, LOG_MAIN|LOG_PANIC, "shadow transport \"%s\" not found ", + tp->shadow); + + /* Pick off the addresses that have succeeded, and make clones. Put into + the shadow_message field a pointer to the shadow_message field of the real + address. */ + + else for (addr2 = addr; addr2; addr2 = addr2->next) + if (addr2->transport_return == OK) + { + addr3 = store_get(sizeof(address_item), FALSE); + *addr3 = *addr2; + addr3->next = NULL; + addr3->shadow_message = US &addr2->shadow_message; + addr3->transport = stp; + addr3->transport_return = DEFER; + addr3->return_filename = NULL; + addr3->return_file = -1; + *last = addr3; + last = &addr3->next; + } + + /* If we found any addresses to shadow, run the delivery, and stick any + message back into the shadow_message field in the original. */ + + if (shadow_addr) + { + int save_count = transport_count; + + DEBUG(D_deliver|D_transport) + debug_printf(">>>>>>>>>>>>>>>> Shadow delivery >>>>>>>>>>>>>>>>\n"); + deliver_local(shadow_addr, TRUE); + + for(; shadow_addr; shadow_addr = shadow_addr->next) + { + int sresult = shadow_addr->transport_return; + *(uschar **)shadow_addr->shadow_message = + sresult == OK + ? string_sprintf(" ST=%s", stp->name) + : string_sprintf(" ST=%s (%s%s%s)", stp->name, + shadow_addr->basic_errno <= 0 + ? US"" + : US strerror(shadow_addr->basic_errno), + shadow_addr->basic_errno <= 0 || !shadow_addr->message + ? US"" + : US": ", + shadow_addr->message + ? shadow_addr->message + : shadow_addr->basic_errno <= 0 + ? US"unknown error" + : US""); + + DEBUG(D_deliver|D_transport) + debug_printf("%s shadow transport returned %s for %s\n", + stp->name, rc_to_string(sresult), shadow_addr->address); + } + + DEBUG(D_deliver|D_transport) + debug_printf(">>>>>>>>>>>>>>>> End shadow delivery >>>>>>>>>>>>>>>>\n"); + + transport_count = save_count; /* Restore original transport count */ + } + } + + /* Cancel the expansions that were set up for the delivery. */ + + deliver_set_expansions(NULL); + + /* If the transport was parallelism-limited, decrement the hints DB record. */ + + if (serialize_key) enq_end(serialize_key); + + /* Now we can process the results of the real transport. We must take each + address off the chain first, because post_process_one() puts it on another + chain. */ + + for (addr2 = addr; addr2; addr2 = nextaddr) + { + int result = addr2->transport_return; + nextaddr = addr2->next; + + DEBUG(D_deliver|D_transport) + debug_printf("%s transport returned %s for %s\n", + tp->name, rc_to_string(result), addr2->address); + + /* If there is a retry_record, or if delivery is deferred, build a retry + item for setting a new retry time or deleting the old retry record from + the database. These items are handled all together after all addresses + have been handled (so the database is open just for a short time for + updating). */ + + if (result == DEFER || testflag(addr2, af_lt_retry_exists)) + { + int flags = result == DEFER ? 0 : rf_delete; + uschar *retry_key = string_copy(tp->retry_use_local_part + ? addr2->address_retry_key : addr2->domain_retry_key); + *retry_key = 'T'; + retry_add_item(addr2, retry_key, flags); + } + + /* Done with this address */ + + addr2->delivery_time = deliver_time; + post_process_one(addr2, result, logflags, EXIM_DTYPE_TRANSPORT, logchar); + + /* If a pipe delivery generated text to be sent back, the result may be + changed to FAIL, and we must copy this for subsequent addresses in the + batch. */ + + if (addr2->transport_return != result) + { + for (addr3 = nextaddr; addr3; addr3 = addr3->next) + { + addr3->transport_return = addr2->transport_return; + addr3->basic_errno = addr2->basic_errno; + addr3->message = addr2->message; + } + result = addr2->transport_return; + } + + /* Whether or not the result was changed to FAIL, we need to copy the + return_file value from the first address into all the addresses of the + batch, so they are all listed in the error message. */ + + addr2->return_file = addr->return_file; + + /* Change log character for recording successful deliveries. */ + + if (result == OK) logchar = '-'; + } + } /* Loop back for next batch of addresses */ +} + + + + +/************************************************* +* Sort remote deliveries * +*************************************************/ + +/* This function is called if remote_sort_domains is set. It arranges that the +chain of addresses for remote deliveries is ordered according to the strings +specified. Try to make this shuffling reasonably efficient by handling +sequences of addresses rather than just single ones. + +Arguments: None +Returns: Nothing +*/ + +static void +sort_remote_deliveries(void) +{ +int sep = 0; +address_item **aptr = &addr_remote; +const uschar *listptr = remote_sort_domains; +uschar *pattern; +uschar patbuf[256]; + +while ( *aptr + && (pattern = string_nextinlist(&listptr, &sep, patbuf, sizeof(patbuf))) + ) + { + address_item *moved = NULL; + address_item **bptr = &moved; + + while (*aptr) + { + address_item **next; + deliver_domain = (*aptr)->domain; /* set $domain */ + if (match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1, + &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK) + { + aptr = &(*aptr)->next; + continue; + } + + next = &(*aptr)->next; + while ( *next + && (deliver_domain = (*next)->domain, /* Set $domain */ + match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1, + &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL)) != OK + ) + next = &(*next)->next; + + /* If the batch of non-matchers is at the end, add on any that were + extracted further up the chain, and end this iteration. Otherwise, + extract them from the chain and hang on the moved chain. */ + + if (!*next) + { + *next = moved; + break; + } + + *bptr = *aptr; + *aptr = *next; + *next = NULL; + bptr = next; + aptr = &(*aptr)->next; + } + + /* If the loop ended because the final address matched, *aptr will + be NULL. Add on to the end any extracted non-matching addresses. If + *aptr is not NULL, the loop ended via "break" when *next is null, that + is, there was a string of non-matching addresses at the end. In this + case the extracted addresses have already been added on the end. */ + + if (!*aptr) *aptr = moved; + } + +DEBUG(D_deliver) + { + debug_printf("remote addresses after sorting:\n"); + for (address_item * addr = addr_remote; addr; addr = addr->next) + debug_printf(" %s\n", addr->address); + } +} + + + +/************************************************* +* Read from pipe for remote delivery subprocess * +*************************************************/ + +/* This function is called when the subprocess is complete, but can also be +called before it is complete, in order to empty a pipe that is full (to prevent +deadlock). It must therefore keep track of its progress in the parlist data +block. + +We read the pipe to get the delivery status codes and a possible error message +for each address, optionally preceded by unusability data for the hosts and +also by optional retry data. + +Read in large chunks into the big buffer and then scan through, interpreting +the data therein. In most cases, only a single read will be necessary. No +individual item will ever be anywhere near 2500 bytes in length, so by ensuring +that we read the next chunk when there is less than 2500 bytes left in the +non-final chunk, we can assume each item is complete in the buffer before +handling it. Each item is written using a single write(), which is atomic for +small items (less than PIPE_BUF, which seems to be at least 512 in any Unix and +often bigger) so even if we are reading while the subprocess is still going, we +should never have only a partial item in the buffer. + +hs12: This assumption is not true anymore, since we get quite large items (certificate +information and such). + +Argument: + poffset the offset of the parlist item + eop TRUE if the process has completed + +Returns: TRUE if the terminating 'Z' item has been read, + or there has been a disaster (i.e. no more data needed); + FALSE otherwise +*/ + +static BOOL +par_read_pipe(int poffset, BOOL eop) +{ +host_item *h; +pardata *p = parlist + poffset; +address_item *addrlist = p->addrlist; +address_item *addr = p->addr; +pid_t pid = p->pid; +int fd = p->fd; + +uschar *msg = p->msg; +BOOL done = p->done; + +/* Loop through all items, reading from the pipe when necessary. The pipe +used to be non-blocking. But I do not see a reason for using non-blocking I/O +here, as the preceding select() tells us, if data is available for reading. + +A read() on a "selected" handle should never block, but(!) it may return +less data then we expected. (The buffer size we pass to read() shouldn't be +understood as a "request", but as a "limit".) + +Each separate item is written to the pipe in a timely manner. But, especially for +larger items, the read(2) may already return partial data from the write(2). + +The write is atomic mostly (depending on the amount written), but atomic does +not imply "all or noting", it just is "not intermixed" with other writes on the +same channel (pipe). + +*/ + +DEBUG(D_deliver) debug_printf("reading pipe for subprocess %d (%s)\n", + (int)p->pid, eop? "ended" : "not ended yet"); + +while (!done) + { + retry_item *r, **rp; + uschar pipeheader[PIPE_HEADER_SIZE+1]; + uschar *id = &pipeheader[0]; + uschar *subid = &pipeheader[1]; + uschar *ptr = big_buffer; + size_t required = PIPE_HEADER_SIZE; /* first the pipehaeder, later the data */ + ssize_t got; + + DEBUG(D_deliver) debug_printf( + "expect %lu bytes (pipeheader) from tpt process %d\n", (u_long)required, pid); + + /* We require(!) all the PIPE_HEADER_SIZE bytes here, as we know, + they're written in a timely manner, so waiting for the write shouldn't hurt a lot. + If we get less, we can assume the subprocess do be done and do not expect any further + information from it. */ + + if ((got = readn(fd, pipeheader, required)) != required) + { + msg = string_sprintf("got " SSIZE_T_FMT " of %d bytes (pipeheader) " + "from transport process %d for transport %s", + got, PIPE_HEADER_SIZE, pid, addr->transport->driver_name); + done = TRUE; + break; + } + + pipeheader[PIPE_HEADER_SIZE] = '\0'; + DEBUG(D_deliver) + debug_printf("got %ld bytes (pipeheader) from transport process %d\n", + (long) got, pid); + + { + /* If we can't decode the pipeheader, the subprocess seems to have a + problem, we do not expect any furher information from it. */ + char *endc; + required = Ustrtol(pipeheader+2, &endc, 10); + if (*endc) + { + msg = string_sprintf("failed to read pipe " + "from transport process %d for transport %s: error decoding size from header", + pid, addr->transport->driver_name); + done = TRUE; + break; + } + } + + DEBUG(D_deliver) + debug_printf("expect %lu bytes (pipedata) from transport process %d\n", + (u_long)required, pid); + + /* Same as above, the transport process will write the bytes announced + in a timely manner, so we can just wait for the bytes, getting less than expected + is considered a problem of the subprocess, we do not expect anything else from it. */ + if ((got = readn(fd, big_buffer, required)) != required) + { + msg = string_sprintf("got only " SSIZE_T_FMT " of " SIZE_T_FMT + " bytes (pipedata) from transport process %d for transport %s", + got, required, pid, addr->transport->driver_name); + done = TRUE; + break; + } + + /* Handle each possible type of item, assuming the complete item is + available in store. */ + + switch (*id) + { + /* Host items exist only if any hosts were marked unusable. Match + up by checking the IP address. */ + + case 'H': + for (h = addrlist->host_list; h; h = h->next) + { + if (!h->address || Ustrcmp(h->address, ptr+2) != 0) continue; + h->status = ptr[0]; + h->why = ptr[1]; + } + ptr += 2; + while (*ptr++); + break; + + /* Retry items are sent in a preceding R item for each address. This is + kept separate to keep each message short enough to guarantee it won't + be split in the pipe. Hopefully, in the majority of cases, there won't in + fact be any retry items at all. + + The complete set of retry items might include an item to delete a + routing retry if there was a previous routing delay. However, routing + retries are also used when a remote transport identifies an address error. + In that case, there may also be an "add" item for the same key. Arrange + that a "delete" item is dropped in favour of an "add" item. */ + + case 'R': + if (!addr) goto ADDR_MISMATCH; + + DEBUG(D_deliver|D_retry) + debug_printf("reading retry information for %s from subprocess\n", + ptr+1); + + /* Cut out any "delete" items on the list. */ + + for (rp = &addr->retries; (r = *rp); rp = &r->next) + if (Ustrcmp(r->key, ptr+1) == 0) /* Found item with same key */ + { + if (!(r->flags & rf_delete)) break; /* It was not "delete" */ + *rp = r->next; /* Excise a delete item */ + DEBUG(D_deliver|D_retry) + debug_printf(" existing delete item dropped\n"); + } + + /* We want to add a delete item only if there is no non-delete item; + however we still have to step ptr through the data. */ + + if (!r || !(*ptr & rf_delete)) + { + r = store_get(sizeof(retry_item), FALSE); + r->next = addr->retries; + addr->retries = r; + r->flags = *ptr++; + r->key = string_copy(ptr); + while (*ptr++); + memcpy(&r->basic_errno, ptr, sizeof(r->basic_errno)); + ptr += sizeof(r->basic_errno); + memcpy(&r->more_errno, ptr, sizeof(r->more_errno)); + ptr += sizeof(r->more_errno); + r->message = *ptr ? string_copy(ptr) : NULL; + DEBUG(D_deliver|D_retry) debug_printf(" added %s item\n", + r->flags & rf_delete ? "delete" : "retry"); + } + + else + { + DEBUG(D_deliver|D_retry) + debug_printf(" delete item not added: non-delete item exists\n"); + ptr++; + while(*ptr++); + ptr += sizeof(r->basic_errno) + sizeof(r->more_errno); + } + + while(*ptr++); + break; + + /* Put the amount of data written into the parlist block */ + + case 'S': + memcpy(&(p->transport_count), ptr, sizeof(transport_count)); + ptr += sizeof(transport_count); + break; + + /* Address items are in the order of items on the address chain. We + remember the current address value in case this function is called + several times to empty the pipe in stages. Information about delivery + over TLS is sent in a preceding X item for each address. We don't put + it in with the other info, in order to keep each message short enough to + guarantee it won't be split in the pipe. */ + +#ifndef DISABLE_TLS + case 'X': + if (!addr) goto ADDR_MISMATCH; /* Below, in 'A' handler */ + switch (*subid) + { + case '1': + addr->tlsver = addr->cipher = addr->peerdn = NULL; + + if (*ptr) + { + addr->cipher = string_copy(ptr); + addr->tlsver = string_copyn(ptr, Ustrchr(ptr, ':') - ptr); + } + while (*ptr++); + if (*ptr) + addr->peerdn = string_copy(ptr); + break; + + case '2': + if (*ptr) + (void) tls_import_cert(ptr, &addr->peercert); + else + addr->peercert = NULL; + break; + + case '3': + if (*ptr) + (void) tls_import_cert(ptr, &addr->ourcert); + else + addr->ourcert = NULL; + break; + +# ifndef DISABLE_OCSP + case '4': + addr->ocsp = *ptr ? *ptr - '0' : OCSP_NOT_REQ; + break; +# endif + } + while (*ptr++); + break; +#endif /*DISABLE_TLS*/ + + case 'C': /* client authenticator information */ + switch (*subid) + { + case '1': addr->authenticator = *ptr ? string_copy(ptr) : NULL; break; + case '2': addr->auth_id = *ptr ? string_copy(ptr) : NULL; break; + case '3': addr->auth_sndr = *ptr ? string_copy(ptr) : NULL; break; + } + while (*ptr++); + break; + +#ifndef DISABLE_PRDR + case 'P': + setflag(addr, af_prdr_used); + break; +#endif + + case 'L': + switch (*subid) + { +#ifndef DISABLE_PIPE_CONNECT + case 2: setflag(addr, af_early_pipe); /*FALLTHROUGH*/ +#endif + case 1: setflag(addr, af_pipelining); break; + } + break; + + case 'K': + setflag(addr, af_chunking_used); + break; + + case 'T': + setflag(addr, af_tcp_fastopen_conn); + if (*subid > '0') setflag(addr, af_tcp_fastopen); + if (*subid > '1') setflag(addr, af_tcp_fastopen_data); + break; + + case 'D': + if (!addr) goto ADDR_MISMATCH; + memcpy(&(addr->dsn_aware), ptr, sizeof(addr->dsn_aware)); + ptr += sizeof(addr->dsn_aware); + DEBUG(D_deliver) debug_printf("DSN read: addr->dsn_aware = %d\n", addr->dsn_aware); + break; + + case 'A': + if (!addr) + { + ADDR_MISMATCH: + msg = string_sprintf("address count mismatch for data read from pipe " + "for transport process %d for transport %s", pid, + addrlist->transport->driver_name); + done = TRUE; + break; + } + + switch (*subid) + { + #ifdef SUPPORT_SOCKS + case '2': /* proxy information; must arrive before A0 and applies to that addr XXX oops*/ + proxy_session = TRUE; /*XXX should this be cleared somewhere? */ + if (*ptr == 0) + ptr++; + else + { + proxy_local_address = string_copy(ptr); + while(*ptr++); + memcpy(&proxy_local_port, ptr, sizeof(proxy_local_port)); + ptr += sizeof(proxy_local_port); + } + break; + #endif + + #ifdef EXPERIMENTAL_DSN_INFO + case '1': /* must arrive before A0, and applies to that addr */ + /* Two strings: smtp_greeting and helo_response */ + addr->smtp_greeting = string_copy(ptr); + while(*ptr++); + addr->helo_response = string_copy(ptr); + while(*ptr++); + break; + #endif + + case '0': + DEBUG(D_deliver) debug_printf("A0 %s tret %d\n", addr->address, *ptr); + addr->transport_return = *ptr++; + addr->special_action = *ptr++; + memcpy(&addr->basic_errno, ptr, sizeof(addr->basic_errno)); + ptr += sizeof(addr->basic_errno); + memcpy(&addr->more_errno, ptr, sizeof(addr->more_errno)); + ptr += sizeof(addr->more_errno); + memcpy(&addr->delivery_time, ptr, sizeof(addr->delivery_time)); + ptr += sizeof(addr->delivery_time); + memcpy(&addr->flags, ptr, sizeof(addr->flags)); + ptr += sizeof(addr->flags); + addr->message = *ptr ? string_copy(ptr) : NULL; + while(*ptr++); + addr->user_message = *ptr ? string_copy(ptr) : NULL; + while(*ptr++); + + /* Always two strings for host information, followed by the port number and DNSSEC mark */ + + if (*ptr) + { + h = store_get(sizeof(host_item), FALSE); + h->name = string_copy(ptr); + while (*ptr++); + h->address = string_copy(ptr); + while(*ptr++); + memcpy(&h->port, ptr, sizeof(h->port)); + ptr += sizeof(h->port); + h->dnssec = *ptr == '2' ? DS_YES + : *ptr == '1' ? DS_NO + : DS_UNK; + ptr++; + addr->host_used = h; + } + else ptr++; + + /* Finished with this address */ + + addr = addr->next; + break; + } + break; + + /* Local interface address/port */ + case 'I': + if (*ptr) sending_ip_address = string_copy(ptr); + while (*ptr++) ; + if (*ptr) sending_port = atoi(CS ptr); + while (*ptr++) ; + break; + + /* Z marks the logical end of the data. It is followed by '0' if + continue_transport was NULL at the end of transporting, otherwise '1'. + We need to know when it becomes NULL during a delivery down a passed SMTP + channel so that we don't try to pass anything more down it. Of course, for + most normal messages it will remain NULL all the time. */ + + case 'Z': + if (*ptr == '0') + { + continue_transport = NULL; + continue_hostname = NULL; + } + done = TRUE; + DEBUG(D_deliver) debug_printf("Z0%c item read\n", *ptr); + break; + + /* Anything else is a disaster. */ + + default: + msg = string_sprintf("malformed data (%d) read from pipe for transport " + "process %d for transport %s", ptr[-1], pid, + addr->transport->driver_name); + done = TRUE; + break; + } + } + +/* The done flag is inspected externally, to determine whether or not to +call the function again when the process finishes. */ + +p->done = done; + +/* If the process hadn't finished, and we haven't seen the end of the data +or if we suffered a disaster, update the rest of the state, and return FALSE to +indicate "not finished". */ + +if (!eop && !done) + { + p->addr = addr; + p->msg = msg; + return FALSE; + } + +/* Close our end of the pipe, to prevent deadlock if the far end is still +pushing stuff into it. */ + +(void)close(fd); +p->fd = -1; + +/* If we have finished without error, but haven't had data for every address, +something is wrong. */ + +if (!msg && addr) + msg = string_sprintf("insufficient address data read from pipe " + "for transport process %d for transport %s", pid, + addr->transport->driver_name); + +/* If an error message is set, something has gone wrong in getting back +the delivery data. Put the message into each address and freeze it. */ + +if (msg) + for (addr = addrlist; addr; addr = addr->next) + { + addr->transport_return = DEFER; + addr->special_action = SPECIAL_FREEZE; + addr->message = msg; + log_write(0, LOG_MAIN|LOG_PANIC, "Delivery status for %s: %s\n", addr->address, addr->message); + } + +/* Return TRUE to indicate we have got all we need from this process, even +if it hasn't actually finished yet. */ + +return TRUE; +} + + + +/************************************************* +* Post-process a set of remote addresses * +*************************************************/ + +/* Do what has to be done immediately after a remote delivery for each set of +addresses, then re-write the spool if necessary. Note that post_process_one +puts the address on an appropriate queue; hence we must fish off the next +one first. This function is also called if there is a problem with setting +up a subprocess to do a remote delivery in parallel. In this case, the final +argument contains a message, and the action must be forced to DEFER. + +Argument: + addr pointer to chain of address items + logflags flags for logging + msg NULL for normal cases; -> error message for unexpected problems + fallback TRUE if processing fallback hosts + +Returns: nothing +*/ + +static void +remote_post_process(address_item *addr, int logflags, uschar *msg, + BOOL fallback) +{ +/* If any host addresses were found to be unusable, add them to the unusable +tree so that subsequent deliveries don't try them. */ + +for (host_item * h = addr->host_list; h; h = h->next) + if (h->address) + if (h->status >= hstatus_unusable) tree_add_unusable(h); + +/* Now handle each address on the chain. The transport has placed '=' or '-' +into the special_action field for each successful delivery. */ + +while (addr) + { + address_item *next = addr->next; + + /* If msg == NULL (normal processing) and the result is DEFER and we are + processing the main hosts and there are fallback hosts available, put the + address on the list for fallback delivery. */ + + if ( addr->transport_return == DEFER + && addr->fallback_hosts + && !fallback + && !msg + ) + { + addr->host_list = addr->fallback_hosts; + addr->next = addr_fallback; + addr_fallback = addr; + DEBUG(D_deliver) debug_printf("%s queued for fallback host(s)\n", addr->address); + } + + /* If msg is set (=> unexpected problem), set it in the address before + doing the ordinary post processing. */ + + else + { + if (msg) + { + addr->message = msg; + addr->transport_return = DEFER; + } + (void)post_process_one(addr, addr->transport_return, logflags, + EXIM_DTYPE_TRANSPORT, addr->special_action); + } + + /* Next address */ + + addr = next; + } + +/* If we have just delivered down a passed SMTP channel, and that was +the last address, the channel will have been closed down. Now that +we have logged that delivery, set continue_sequence to 1 so that +any subsequent deliveries don't get "*" incorrectly logged. */ + +if (!continue_transport) continue_sequence = 1; +} + + + +/************************************************* +* Wait for one remote delivery subprocess * +*************************************************/ + +/* This function is called while doing remote deliveries when either the +maximum number of processes exist and we need one to complete so that another +can be created, or when waiting for the last ones to complete. It must wait for +the completion of one subprocess, empty the control block slot, and return a +pointer to the address chain. + +Arguments: none +Returns: pointer to the chain of addresses handled by the process; + NULL if no subprocess found - this is an unexpected error +*/ + +static address_item * +par_wait(void) +{ +int poffset, status; +address_item *addr, *addrlist; +pid_t pid; + +set_process_info("delivering %s: waiting for a remote delivery subprocess " + "to finish", message_id); + +/* Loop until either a subprocess completes, or there are no subprocesses in +existence - in which case give an error return. We cannot proceed just by +waiting for a completion, because a subprocess may have filled up its pipe, and +be waiting for it to be emptied. Therefore, if no processes have finished, we +wait for one of the pipes to acquire some data by calling select(), with a +timeout just in case. + +The simple approach is just to iterate after reading data from a ready pipe. +This leads to non-ideal behaviour when the subprocess has written its final Z +item, closed the pipe, and is in the process of exiting (the common case). A +call to waitpid() yields nothing completed, but select() shows the pipe ready - +reading it yields EOF, so you end up with busy-waiting until the subprocess has +actually finished. + +To avoid this, if all the data that is needed has been read from a subprocess +after select(), an explicit wait() for it is done. We know that all it is doing +is writing to the pipe and then exiting, so the wait should not be long. + +The non-blocking waitpid() is to some extent just insurance; if we could +reliably detect end-of-file on the pipe, we could always know when to do a +blocking wait() for a completed process. However, because some systems use +NDELAY, which doesn't distinguish between EOF and pipe empty, it is easier to +use code that functions without the need to recognize EOF. + +There's a double loop here just in case we end up with a process that is not in +the list of remote delivery processes. Something has obviously gone wrong if +this is the case. (For example, a process that is incorrectly left over from +routing or local deliveries might be found.) The damage can be minimized by +looping back and looking for another process. If there aren't any, the error +return will happen. */ + +for (;;) /* Normally we do not repeat this loop */ + { + while ((pid = waitpid(-1, &status, WNOHANG)) <= 0) + { + struct timeval tv; + fd_set select_pipes; + int maxpipe, readycount; + + /* A return value of -1 can mean several things. If errno != ECHILD, it + either means invalid options (which we discount), or that this process was + interrupted by a signal. Just loop to try the waitpid() again. + + If errno == ECHILD, waitpid() is telling us that there are no subprocesses + in existence. This should never happen, and is an unexpected error. + However, there is a nasty complication when running under Linux. If "strace + -f" is being used under Linux to trace this process and its children, + subprocesses are "stolen" from their parents and become the children of the + tracing process. A general wait such as the one we've just obeyed returns + as if there are no children while subprocesses are running. Once a + subprocess completes, it is restored to the parent, and waitpid(-1) finds + it. Thanks to Joachim Wieland for finding all this out and suggesting a + palliative. + + This does not happen using "truss" on Solaris, nor (I think) with other + tracing facilities on other OS. It seems to be specific to Linux. + + What we do to get round this is to use kill() to see if any of our + subprocesses are still in existence. If kill() gives an OK return, we know + it must be for one of our processes - it can't be for a re-use of the pid, + because if our process had finished, waitpid() would have found it. If any + of our subprocesses are in existence, we proceed to use select() as if + waitpid() had returned zero. I think this is safe. */ + + if (pid < 0) + { + if (errno != ECHILD) continue; /* Repeats the waitpid() */ + + DEBUG(D_deliver) + debug_printf("waitpid() returned -1/ECHILD: checking explicitly " + "for process existence\n"); + + for (poffset = 0; poffset < remote_max_parallel; poffset++) + { + if ((pid = parlist[poffset].pid) != 0 && kill(pid, 0) == 0) + { + DEBUG(D_deliver) debug_printf("process %d still exists: assume " + "stolen by strace\n", (int)pid); + break; /* With poffset set */ + } + } + + if (poffset >= remote_max_parallel) + { + DEBUG(D_deliver) debug_printf("*** no delivery children found\n"); + return NULL; /* This is the error return */ + } + } + + /* A pid value greater than 0 breaks the "while" loop. A negative value has + been handled above. A return value of zero means that there is at least one + subprocess, but there are no completed subprocesses. See if any pipes are + ready with any data for reading. */ + + DEBUG(D_deliver) debug_printf("selecting on subprocess pipes\n"); + + maxpipe = 0; + FD_ZERO(&select_pipes); + for (poffset = 0; poffset < remote_max_parallel; poffset++) + if (parlist[poffset].pid != 0) + { + int fd = parlist[poffset].fd; + FD_SET(fd, &select_pipes); + if (fd > maxpipe) maxpipe = fd; + } + + /* Stick in a 60-second timeout, just in case. */ + + tv.tv_sec = 60; + tv.tv_usec = 0; + + readycount = select(maxpipe + 1, (SELECT_ARG2_TYPE *)&select_pipes, + NULL, NULL, &tv); + + /* Scan through the pipes and read any that are ready; use the count + returned by select() to stop when there are no more. Select() can return + with no processes (e.g. if interrupted). This shouldn't matter. + + If par_read_pipe() returns TRUE, it means that either the terminating Z was + read, or there was a disaster. In either case, we are finished with this + process. Do an explicit wait() for the process and break the main loop if + it succeeds. + + It turns out that we have to deal with the case of an interrupted system + call, which can happen on some operating systems if the signal handling is + set up to do that by default. */ + + for (poffset = 0; + readycount > 0 && poffset < remote_max_parallel; + poffset++) + { + if ( (pid = parlist[poffset].pid) != 0 + && FD_ISSET(parlist[poffset].fd, &select_pipes) + ) + { + readycount--; + if (par_read_pipe(poffset, FALSE)) /* Finished with this pipe */ + for (;;) /* Loop for signals */ + { + pid_t endedpid = waitpid(pid, &status, 0); + if (endedpid == pid) goto PROCESS_DONE; + if (endedpid != (pid_t)(-1) || errno != EINTR) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Unexpected error return " + "%d (errno = %d) from waitpid() for process %d", + (int)endedpid, errno, (int)pid); + } + } + } + + /* Now go back and look for a completed subprocess again. */ + } + + /* A completed process was detected by the non-blocking waitpid(). Find the + data block that corresponds to this subprocess. */ + + for (poffset = 0; poffset < remote_max_parallel; poffset++) + if (pid == parlist[poffset].pid) break; + + /* Found the data block; this is a known remote delivery process. We don't + need to repeat the outer loop. This should be what normally happens. */ + + if (poffset < remote_max_parallel) break; + + /* This situation is an error, but it's probably better to carry on looking + for another process than to give up (as we used to do). */ + + log_write(0, LOG_MAIN|LOG_PANIC, "Process %d finished: not found in remote " + "transport process list", pid); + } /* End of the "for" loop */ + +/* Come here when all the data was completely read after a select(), and +the process in pid has been wait()ed for. */ + +PROCESS_DONE: + +DEBUG(D_deliver) + { + if (status == 0) + debug_printf("remote delivery process %d ended\n", (int)pid); + else + debug_printf("remote delivery process %d ended: status=%04x\n", (int)pid, + status); + } + +set_process_info("delivering %s", message_id); + +/* Get the chain of processed addresses */ + +addrlist = parlist[poffset].addrlist; + +/* If the process did not finish cleanly, record an error and freeze (except +for SIGTERM, SIGKILL and SIGQUIT), and also ensure the journal is not removed, +in case the delivery did actually happen. */ + +if ((status & 0xffff) != 0) + { + uschar *msg; + int msb = (status >> 8) & 255; + int lsb = status & 255; + int code = (msb == 0)? (lsb & 0x7f) : msb; + + msg = string_sprintf("%s transport process returned non-zero status 0x%04x: " + "%s %d", + addrlist->transport->driver_name, + status, + (msb == 0)? "terminated by signal" : "exit code", + code); + + if (msb != 0 || (code != SIGTERM && code != SIGKILL && code != SIGQUIT)) + addrlist->special_action = SPECIAL_FREEZE; + + for (addr = addrlist; addr; addr = addr->next) + { + addr->transport_return = DEFER; + addr->message = msg; + } + + remove_journal = FALSE; + } + +/* Else complete reading the pipe to get the result of the delivery, if all +the data has not yet been obtained. */ + +else if (!parlist[poffset].done) (void)par_read_pipe(poffset, TRUE); + +/* Put the data count and return path into globals, mark the data slot unused, +decrement the count of subprocesses, and return the address chain. */ + +transport_count = parlist[poffset].transport_count; +used_return_path = parlist[poffset].return_path; +parlist[poffset].pid = 0; +parcount--; +return addrlist; +} + + + +/************************************************* +* Wait for subprocesses and post-process * +*************************************************/ + +/* This function waits for subprocesses until the number that are still running +is below a given threshold. For each complete subprocess, the addresses are +post-processed. If we can't find a running process, there is some shambles. +Better not bomb out, as that might lead to multiple copies of the message. Just +log and proceed as if all done. + +Arguments: + max maximum number of subprocesses to leave running + fallback TRUE if processing fallback hosts + +Returns: nothing +*/ + +static void +par_reduce(int max, BOOL fallback) +{ +while (parcount > max) + { + address_item *doneaddr = par_wait(); + if (!doneaddr) + { + log_write(0, LOG_MAIN|LOG_PANIC, + "remote delivery process count got out of step"); + parcount = 0; + } + else + { + transport_instance * tp = doneaddr->transport; + if (tp->max_parallel) + enq_end(string_sprintf("tpt-serialize-%s", tp->name)); + + remote_post_process(doneaddr, LOG_MAIN, NULL, fallback); + } + } +} + +static void +rmt_dlv_checked_write(int fd, char id, char subid, void * buf, ssize_t size) +{ +uschar pipe_header[PIPE_HEADER_SIZE+1]; +size_t total_len = PIPE_HEADER_SIZE + size; + +struct iovec iov[2] = { + { pipe_header, PIPE_HEADER_SIZE }, /* indication about the data to expect */ + { buf, size } /* *the* data */ +}; + +ssize_t ret; + +/* we assume that size can't get larger then BIG_BUFFER_SIZE which currently is set to 16k */ +/* complain to log if someone tries with buffer sizes we can't handle*/ + +if (size > BIG_BUFFER_SIZE-1) + { + log_write(0, LOG_MAIN|LOG_PANIC_DIE, + "Failed writing transport result to pipe: can't handle buffers > %d bytes. truncating!\n", + BIG_BUFFER_SIZE-1); + size = BIG_BUFFER_SIZE; + } + +/* Should we check that we do not write more than PIPE_BUF? What would +that help? */ + +/* convert size to human readable string prepended by id and subid */ +if (PIPE_HEADER_SIZE != snprintf(CS pipe_header, PIPE_HEADER_SIZE+1, "%c%c%05ld", + id, subid, (long)size)) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "header snprintf failed\n"); + +DEBUG(D_deliver) debug_printf("header write id:%c,subid:%c,size:%ld,final:%s\n", + id, subid, (long)size, pipe_header); + +if ((ret = writev(fd, iov, 2)) != total_len) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, + "Failed writing transport result to pipe (%ld of %ld bytes): %s", + (long)ret, (long)total_len, ret == -1 ? strerror(errno) : "short write"); +} + +/************************************************* +* Do remote deliveries * +*************************************************/ + +/* This function is called to process the addresses in addr_remote. We must +pick off the queue all addresses that have the same transport, remote +destination, and errors address, and hand them to the transport in one go, +subject to some configured limitations. If this is a run to continue delivering +to an existing delivery channel, skip all but those addresses that can go to +that channel. The skipped addresses just get deferred. + +If mua_wrapper is set, all addresses must be able to be sent in a single +transaction. If not, this function yields FALSE. + +In Exim 4, remote deliveries are always done in separate processes, even +if remote_max_parallel = 1 or if there's only one delivery to do. The reason +is so that the base process can retain privilege. This makes the +implementation of fallback transports feasible (though not initially done.) + +We create up to the configured number of subprocesses, each of which passes +back the delivery state via a pipe. (However, when sending down an existing +connection, remote_max_parallel is forced to 1.) + +Arguments: + fallback TRUE if processing fallback hosts + +Returns: TRUE normally + FALSE if mua_wrapper is set and the addresses cannot all be sent + in one transaction +*/ + +static BOOL +do_remote_deliveries(BOOL fallback) +{ +int parmax; +int poffset; + +parcount = 0; /* Number of executing subprocesses */ + +/* When sending down an existing channel, only do one delivery at a time. +We use a local variable (parmax) to hold the maximum number of processes; +this gets reduced from remote_max_parallel if we can't create enough pipes. */ + +if (continue_transport) remote_max_parallel = 1; +parmax = remote_max_parallel; + +/* If the data for keeping a list of processes hasn't yet been +set up, do so. */ + +if (!parlist) + { + parlist = store_get(remote_max_parallel * sizeof(pardata), FALSE); + for (poffset = 0; poffset < remote_max_parallel; poffset++) + parlist[poffset].pid = 0; + } + +/* Now loop for each remote delivery */ + +for (int delivery_count = 0; addr_remote; delivery_count++) + { + pid_t pid; + uid_t uid; + gid_t gid; + int pfd[2]; + int address_count = 1; + int address_count_max; + BOOL multi_domain; + BOOL use_initgroups; + BOOL pipe_done = FALSE; + transport_instance *tp; + address_item **anchor = &addr_remote; + address_item *addr = addr_remote; + address_item *last = addr; + address_item *next; + uschar * panicmsg; + uschar * serialize_key = NULL; + + /* Pull the first address right off the list. */ + + addr_remote = addr->next; + addr->next = NULL; + + DEBUG(D_deliver|D_transport) + debug_printf("--------> %s <--------\n", addr->address); + + /* If no transport has been set, there has been a big screw-up somewhere. */ + + if (!(tp = addr->transport)) + { + f.disable_logging = FALSE; /* Jic */ + panicmsg = US"No transport set by router"; + goto panic_continue; + } + + /* Check that this base address hasn't previously been delivered to this + transport. The check is necessary at this point to handle homonymic addresses + correctly in cases where the pattern of redirection changes between delivery + attempts. Non-homonymic previous delivery is detected earlier, at routing + time. */ + + if (previously_transported(addr, FALSE)) continue; + + /* Force failure if the message is too big. */ + + if (tp->message_size_limit) + { + int rc = check_message_size(tp, addr); + if (rc != OK) + { + addr->transport_return = rc; + remote_post_process(addr, LOG_MAIN, NULL, fallback); + continue; + } + } + +/*XXX need to defeat this when DANE is used - but we don't know that yet. +So look out for the place it gets used. +*/ + + /* Get the flag which specifies whether the transport can handle different + domains that nevertheless resolve to the same set of hosts. If it needs + expanding, get variables set: $address_data, $domain_data, $localpart_data, + $host, $host_address, $host_port. */ + if (tp->expand_multi_domain) + deliver_set_expansions(addr); + + if (exp_bool(addr, US"transport", tp->name, D_transport, + US"multi_domain", tp->multi_domain, tp->expand_multi_domain, + &multi_domain) != OK) + { + deliver_set_expansions(NULL); + panicmsg = addr->message; + goto panic_continue; + } + + /* Get the maximum it can handle in one envelope, with zero meaning + unlimited, which is forced for the MUA wrapper case. */ + + address_count_max = tp->max_addresses; + if (address_count_max == 0 || mua_wrapper) address_count_max = 999999; + + + /************************************************************************/ + /***** This is slightly experimental code, but should be safe. *****/ + + /* The address_count_max value is the maximum number of addresses that the + transport can send in one envelope. However, the transport must be capable of + dealing with any number of addresses. If the number it gets exceeds its + envelope limitation, it must send multiple copies of the message. This can be + done over a single connection for SMTP, so uses less resources than making + multiple connections. On the other hand, if remote_max_parallel is greater + than one, it is perhaps a good idea to use parallel processing to move the + message faster, even if that results in multiple simultaneous connections to + the same host. + + How can we come to some compromise between these two ideals? What we do is to + limit the number of addresses passed to a single instance of a transport to + the greater of (a) its address limit (rcpt_max for SMTP) and (b) the total + number of addresses routed to remote transports divided by + remote_max_parallel. For example, if the message has 100 remote recipients, + remote max parallel is 2, and rcpt_max is 10, we'd never send more than 50 at + once. But if rcpt_max is 100, we could send up to 100. + + Of course, not all the remotely addresses in a message are going to go to the + same set of hosts (except in smarthost configurations), so this is just a + heuristic way of dividing up the work. + + Furthermore (1), because this may not be wanted in some cases, and also to + cope with really pathological cases, there is also a limit to the number of + messages that are sent over one connection. This is the same limit that is + used when sending several different messages over the same connection. + Continue_sequence is set when in this situation, to the number sent so + far, including this message. + + Furthermore (2), when somebody explicitly sets the maximum value to 1, it + is probably because they are using VERP, in which case they want to pass only + one address at a time to the transport, in order to be able to use + $local_part and $domain in constructing a new return path. We could test for + the use of these variables, but as it is so likely they will be used when the + maximum is 1, we don't bother. Just leave the value alone. */ + + if ( address_count_max != 1 + && address_count_max < remote_delivery_count/remote_max_parallel + ) + { + int new_max = remote_delivery_count/remote_max_parallel; + int message_max = tp->connection_max_messages; + if (connection_max_messages >= 0) message_max = connection_max_messages; + message_max -= continue_sequence - 1; + if (message_max > 0 && new_max > address_count_max * message_max) + new_max = address_count_max * message_max; + address_count_max = new_max; + } + + /************************************************************************/ + + +/*XXX don't know yet if DANE will be used. So tpt will have to +check at the point if gets next addr from list, and skip/defer any +nonmatch domains +*/ + + /* Pick off all addresses which have the same transport, errors address, + destination, and extra headers. In some cases they point to the same host + list, but we also need to check for identical host lists generated from + entirely different domains. The host list pointers can be NULL in the case + where the hosts are defined in the transport. There is also a configured + maximum limit of addresses that can be handled at once (see comments above + for how it is computed). + If the transport does not handle multiple domains, enforce that also, + and if it might need a per-address check for this, re-evaluate it. + */ + + while ((next = *anchor) && address_count < address_count_max) + { + BOOL md; + if ( (multi_domain || Ustrcmp(next->domain, addr->domain) == 0) + && tp == next->transport + && same_hosts(next->host_list, addr->host_list) + && same_strings(next->prop.errors_address, addr->prop.errors_address) + && same_headers(next->prop.extra_headers, addr->prop.extra_headers) + && same_ugid(tp, next, addr) + && ( next->prop.remove_headers == addr->prop.remove_headers + || ( next->prop.remove_headers + && addr->prop.remove_headers + && Ustrcmp(next->prop.remove_headers, addr->prop.remove_headers) == 0 + ) ) + && ( !multi_domain + || ( ( + (void)(!tp->expand_multi_domain || ((void)deliver_set_expansions(next), 1)), + exp_bool(addr, + US"transport", next->transport->name, D_transport, + US"multi_domain", next->transport->multi_domain, + next->transport->expand_multi_domain, &md) == OK + ) + && md + ) ) ) + { + *anchor = next->next; + next->next = NULL; + next->first = addr; /* remember top one (for retry processing) */ + last->next = next; + last = next; + address_count++; + } + else anchor = &(next->next); + deliver_set_expansions(NULL); + } + + /* If we are acting as an MUA wrapper, all addresses must go in a single + transaction. If not, put them back on the chain and yield FALSE. */ + + if (mua_wrapper && addr_remote) + { + last->next = addr_remote; + addr_remote = addr; + return FALSE; + } + + /* If the transport is limited for parallellism, enforce that here. + The hints DB entry is decremented in par_reduce(), when we reap the + transport process. */ + + if (tpt_parallel_check(tp, addr, &serialize_key)) + if ((panicmsg = expand_string_message)) + goto panic_continue; + else + continue; /* Loop for the next set of addresses. */ + + /* Set up the expansion variables for this set of addresses */ + + deliver_set_expansions(addr); + + /* Ensure any transport-set auth info is fresh */ + addr->authenticator = addr->auth_id = addr->auth_sndr = NULL; + + /* Compute the return path, expanding a new one if required. The old one + must be set first, as it might be referred to in the expansion. */ + + if(addr->prop.errors_address) + return_path = addr->prop.errors_address; +#ifdef EXPERIMENTAL_SRS + else if(addr->prop.srs_sender) + return_path = addr->prop.srs_sender; +#endif + else + return_path = sender_address; + + if (tp->return_path) + { + uschar *new_return_path = expand_string(tp->return_path); + if (new_return_path) + return_path = new_return_path; + else if (!f.expand_string_forcedfail) + { + panicmsg = string_sprintf("Failed to expand return path \"%s\": %s", + tp->return_path, expand_string_message); + goto enq_continue; + } + } + + /* Find the uid, gid, and use_initgroups setting for this transport. Failure + logs and sets up error messages, so we just post-process and continue with + the next address. */ + + if (!findugid(addr, tp, &uid, &gid, &use_initgroups)) + { + panicmsg = NULL; + goto enq_continue; + } + + /* If this transport has a setup function, call it now so that it gets + run in this process and not in any subprocess. That way, the results of + any setup that are retained by the transport can be reusable. One of the + things the setup does is to set the fallback host lists in the addresses. + That is why it is called at this point, before the continue delivery + processing, because that might use the fallback hosts. */ + + if (tp->setup) + (void)((tp->setup)(addr->transport, addr, NULL, uid, gid, NULL)); + + /* If we have a connection still open from a verify stage (lazy-close) + treat it as if it is a continued connection (apart from the counter used + for the log line mark). */ + + if (cutthrough.cctx.sock >= 0 && cutthrough.callout_hold_only) + { + DEBUG(D_deliver) + debug_printf("lazy-callout-close: have conn still open from verification\n"); + continue_transport = cutthrough.transport; + continue_hostname = string_copy(cutthrough.host.name); + continue_host_address = string_copy(cutthrough.host.address); + continue_sequence = 1; + sending_ip_address = cutthrough.snd_ip; + sending_port = cutthrough.snd_port; + smtp_peer_options = cutthrough.peer_options; + } + + /* If this is a run to continue delivery down an already-established + channel, check that this set of addresses matches the transport and + the channel. If it does not, defer the addresses. If a host list exists, + we must check that the continue host is on the list. Otherwise, the + host is set in the transport. */ + + f.continue_more = FALSE; /* In case got set for the last lot */ + if (continue_transport) + { + BOOL ok = Ustrcmp(continue_transport, tp->name) == 0; +/*XXX do we need to check for a DANEd conn vs. a change of domain? */ + + /* If the transport is about to override the host list do not check + it here but take the cost of running the transport process to discover + if the continued_hostname connection is suitable. This is a layering + violation which is unfortunate as it requires we haul in the smtp + include file. */ + + if (ok) + { + smtp_transport_options_block * ob; + + if ( !( Ustrcmp(tp->info->driver_name, "smtp") == 0 + && (ob = (smtp_transport_options_block *)tp->options_block) + && ob->hosts_override && ob->hosts + ) + && addr->host_list + ) + { + ok = FALSE; + for (host_item * h = addr->host_list; h; h = h->next) + if (Ustrcmp(h->name, continue_hostname) == 0) + /*XXX should also check port here */ + { ok = TRUE; break; } + } + } + + /* Addresses not suitable; defer or queue for fallback hosts (which + might be the continue host) and skip to next address. */ + + if (!ok) + { + DEBUG(D_deliver) debug_printf("not suitable for continue_transport (%s)\n", + Ustrcmp(continue_transport, tp->name) != 0 + ? string_sprintf("tpt %s vs %s", continue_transport, tp->name) + : string_sprintf("no host matching %s", continue_hostname)); + if (serialize_key) enq_end(serialize_key); + + if (addr->fallback_hosts && !fallback) + { + for (next = addr; ; next = next->next) + { + next->host_list = next->fallback_hosts; + DEBUG(D_deliver) debug_printf("%s queued for fallback host(s)\n", next->address); + if (!next->next) break; + } + next->next = addr_fallback; + addr_fallback = addr; + } + + else + { + for (next = addr; ; next = next->next) + { + DEBUG(D_deliver) debug_printf(" %s to def list\n", next->address); + if (!next->next) break; + } + next->next = addr_defer; + addr_defer = addr; + } + + continue; + } + + /* Set a flag indicating whether there are further addresses that list + the continued host. This tells the transport to leave the channel open, + but not to pass it to another delivery process. We'd like to do that + for non-continue_transport cases too but the knowlege of which host is + connected to is too hard to manage. Perhaps we need a finer-grain + interface to the transport. */ + + for (next = addr_remote; next && !f.continue_more; next = next->next) + for (host_item * h = next->host_list; h; h = h->next) + if (Ustrcmp(h->name, continue_hostname) == 0) + { f.continue_more = TRUE; break; } + } + + /* The transports set up the process info themselves as they may connect + to more than one remote machine. They also have to set up the filter + arguments, if required, so that the host name and address are available + for expansion. */ + + transport_filter_argv = NULL; + + /* Create the pipe for inter-process communication. If pipe creation + fails, it is probably because the value of remote_max_parallel is so + large that too many file descriptors for pipes have been created. Arrange + to wait for a process to finish, and then try again. If we still can't + create a pipe when all processes have finished, break the retry loop. */ + + while (!pipe_done) + { + if (pipe(pfd) == 0) pipe_done = TRUE; + else if (parcount > 0) parmax = parcount; + else break; + + /* We need to make the reading end of the pipe non-blocking. There are + two different options for this. Exim is cunningly (I hope!) coded so + that it can use either of them, though it prefers O_NONBLOCK, which + distinguishes between EOF and no-more-data. */ + +/* The data appears in a timely manner and we already did a select on +all pipes, so I do not see a reason to use non-blocking IO here + +#ifdef O_NONBLOCK + (void)fcntl(pfd[pipe_read], F_SETFL, O_NONBLOCK); +#else + (void)fcntl(pfd[pipe_read], F_SETFL, O_NDELAY); +#endif +*/ + + /* If the maximum number of subprocesses already exist, wait for a process + to finish. If we ran out of file descriptors, parmax will have been reduced + from its initial value of remote_max_parallel. */ + + par_reduce(parmax - 1, fallback); + } + + /* If we failed to create a pipe and there were no processes to wait + for, we have to give up on this one. Do this outside the above loop + so that we can continue the main loop. */ + + if (!pipe_done) + { + panicmsg = string_sprintf("unable to create pipe: %s", strerror(errno)); + goto enq_continue; + } + + /* Find a free slot in the pardata list. Must do this after the possible + waiting for processes to finish, because a terminating process will free + up a slot. */ + + for (poffset = 0; poffset < remote_max_parallel; poffset++) + if (parlist[poffset].pid == 0) + break; + + /* If there isn't one, there has been a horrible disaster. */ + + if (poffset >= remote_max_parallel) + { + (void)close(pfd[pipe_write]); + (void)close(pfd[pipe_read]); + panicmsg = US"Unexpectedly no free subprocess slot"; + goto enq_continue; + } + + /* Now fork a subprocess to do the remote delivery, but before doing so, + ensure that any cached resources are released so as not to interfere with + what happens in the subprocess. */ + + search_tidyup(); + + if ((pid = exim_fork(US"transport")) == 0) + { + int fd = pfd[pipe_write]; + host_item *h; + + /* Setting this global in the subprocess means we need never clear it */ + transport_name = tp->name; + + /* There are weird circumstances in which logging is disabled */ + f.disable_logging = tp->disable_logging; + + /* Show pids on debug output if parallelism possible */ + + if (parmax > 1 && (parcount > 0 || addr_remote)) + DEBUG(D_any|D_v) debug_selector |= D_pid; + + /* Reset the random number generator, so different processes don't all + have the same sequence. In the test harness we want different, but + predictable settings for each delivery process, so do something explicit + here rather they rely on the fixed reset in the random number function. */ + + random_seed = f.running_in_test_harness ? 42 + 2*delivery_count : 0; + + /* Set close-on-exec on the pipe so that it doesn't get passed on to + a new process that may be forked to do another delivery down the same + SMTP connection. */ + + (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC); + + /* Close open file descriptors for the pipes of other processes + that are running in parallel. */ + + for (poffset = 0; poffset < remote_max_parallel; poffset++) + if (parlist[poffset].pid != 0) (void)close(parlist[poffset].fd); + + /* This process has inherited a copy of the file descriptor + for the data file, but its file pointer is shared with all the + other processes running in parallel. Therefore, we have to re-open + the file in order to get a new file descriptor with its own + file pointer. We don't need to lock it, as the lock is held by + the parent process. There doesn't seem to be any way of doing + a dup-with-new-file-pointer. */ + + (void)close(deliver_datafile); + { + uschar * fname = spool_fname(US"input", message_subdir, message_id, US"-D"); + + if ((deliver_datafile = Uopen(fname, +#ifdef O_CLOEXEC + O_CLOEXEC | +#endif + O_RDWR | O_APPEND, 0)) < 0) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Failed to reopen %s for remote " + "parallel delivery: %s", fname, strerror(errno)); + } + + /* Set the close-on-exec flag */ +#ifndef O_CLOEXEC + (void)fcntl(deliver_datafile, F_SETFD, fcntl(deliver_datafile, F_GETFD) | + FD_CLOEXEC); +#endif + + /* Set the uid/gid of this process; bombs out on failure. */ + + exim_setugid(uid, gid, use_initgroups, + string_sprintf("remote delivery to %s with transport=%s", + addr->address, tp->name)); + + /* Close the unwanted half of this process' pipe, set the process state, + and run the transport. Afterwards, transport_count will contain the number + of bytes written. */ + + (void)close(pfd[pipe_read]); + set_process_info("delivering %s using %s", message_id, tp->name); + debug_print_string(tp->debug_string); + if (!(tp->info->code)(addr->transport, addr)) replicate_status(addr); + + set_process_info("delivering %s (just run %s for %s%s in subprocess)", + message_id, tp->name, addr->address, addr->next ? ", ..." : ""); + + /* Ensure any cached resources that we used are now released */ + + search_tidyup(); + + /* Pass the result back down the pipe. This is a lot more information + than is needed for a local delivery. We have to send back the error + status for each address, the usability status for each host that is + flagged as unusable, and all the retry items. When TLS is in use, we + send also the cipher and peerdn information. Each type of information + is flagged by an identifying byte, and is then in a fixed format (with + strings terminated by zeros), and there is a final terminator at the + end. The host information and retry information is all attached to + the first address, so that gets sent at the start. */ + + /* Host unusability information: for most success cases this will + be null. */ + + for (h = addr->host_list; h; h = h->next) + { + if (!h->address || h->status < hstatus_unusable) continue; + sprintf(CS big_buffer, "%c%c%s", h->status, h->why, h->address); + rmt_dlv_checked_write(fd, 'H', '0', big_buffer, Ustrlen(big_buffer+2) + 3); + } + + /* The number of bytes written. This is the same for each address. Even + if we sent several copies of the message down the same connection, the + size of each one is the same, and it's that value we have got because + transport_count gets reset before calling transport_write_message(). */ + + memcpy(big_buffer, &transport_count, sizeof(transport_count)); + rmt_dlv_checked_write(fd, 'S', '0', big_buffer, sizeof(transport_count)); + + /* Information about what happened to each address. Four item types are + used: an optional 'X' item first, for TLS information, then an optional "C" + item for any client-auth info followed by 'R' items for any retry settings, + and finally an 'A' item for the remaining data. */ + + for(; addr; addr = addr->next) + { + uschar *ptr; + + /* The certificate verification status goes into the flags */ + if (tls_out.certificate_verified) setflag(addr, af_cert_verified); +#ifdef SUPPORT_DANE + if (tls_out.dane_verified) setflag(addr, af_dane_verified); +#endif +# ifdef EXPERIMENTAL_TLS_RESUME + if (tls_out.resumption & RESUME_USED) setflag(addr, af_tls_resume); +# endif + + /* Use an X item only if there's something to send */ +#ifndef DISABLE_TLS + if (addr->cipher) + { + ptr = big_buffer + sprintf(CS big_buffer, "%.128s", addr->cipher) + 1; + if (!addr->peerdn) + *ptr++ = 0; + else + ptr += sprintf(CS ptr, "%.512s", addr->peerdn) + 1; + + rmt_dlv_checked_write(fd, 'X', '1', big_buffer, ptr - big_buffer); + } + else if (continue_proxy_cipher) + { + ptr = big_buffer + sprintf(CS big_buffer, "%.128s", continue_proxy_cipher) + 1; + *ptr++ = 0; + rmt_dlv_checked_write(fd, 'X', '1', big_buffer, ptr - big_buffer); + } + + if (addr->peercert) + { + ptr = big_buffer; + if (tls_export_cert(ptr, big_buffer_size-2, addr->peercert)) + while(*ptr++); + else + *ptr++ = 0; + rmt_dlv_checked_write(fd, 'X', '2', big_buffer, ptr - big_buffer); + } + if (addr->ourcert) + { + ptr = big_buffer; + if (tls_export_cert(ptr, big_buffer_size-2, addr->ourcert)) + while(*ptr++); + else + *ptr++ = 0; + rmt_dlv_checked_write(fd, 'X', '3', big_buffer, ptr - big_buffer); + } +# ifndef DISABLE_OCSP + if (addr->ocsp > OCSP_NOT_REQ) + { + ptr = big_buffer + sprintf(CS big_buffer, "%c", addr->ocsp + '0') + 1; + rmt_dlv_checked_write(fd, 'X', '4', big_buffer, ptr - big_buffer); + } +# endif +#endif /*DISABLE_TLS*/ + + if (client_authenticator) + { + ptr = big_buffer + sprintf(CS big_buffer, "%.64s", client_authenticator) + 1; + rmt_dlv_checked_write(fd, 'C', '1', big_buffer, ptr - big_buffer); + } + if (client_authenticated_id) + { + ptr = big_buffer + sprintf(CS big_buffer, "%.64s", client_authenticated_id) + 1; + rmt_dlv_checked_write(fd, 'C', '2', big_buffer, ptr - big_buffer); + } + if (client_authenticated_sender) + { + ptr = big_buffer + sprintf(CS big_buffer, "%.64s", client_authenticated_sender) + 1; + rmt_dlv_checked_write(fd, 'C', '3', big_buffer, ptr - big_buffer); + } + +#ifndef DISABLE_PRDR + if (testflag(addr, af_prdr_used)) + rmt_dlv_checked_write(fd, 'P', '0', NULL, 0); +#endif + + if (testflag(addr, af_pipelining)) +#ifndef DISABLE_PIPE_CONNECT + if (testflag(addr, af_early_pipe)) + rmt_dlv_checked_write(fd, 'L', '2', NULL, 0); + else +#endif + rmt_dlv_checked_write(fd, 'L', '1', NULL, 0); + + if (testflag(addr, af_chunking_used)) + rmt_dlv_checked_write(fd, 'K', '0', NULL, 0); + + if (testflag(addr, af_tcp_fastopen_conn)) + rmt_dlv_checked_write(fd, 'T', + testflag(addr, af_tcp_fastopen) ? testflag(addr, af_tcp_fastopen_data) + ? '2' : '1' : '0', + NULL, 0); + + memcpy(big_buffer, &addr->dsn_aware, sizeof(addr->dsn_aware)); + rmt_dlv_checked_write(fd, 'D', '0', big_buffer, sizeof(addr->dsn_aware)); + + /* Retry information: for most success cases this will be null. */ + + for (retry_item * r = addr->retries; r; r = r->next) + { + sprintf(CS big_buffer, "%c%.500s", r->flags, r->key); + ptr = big_buffer + Ustrlen(big_buffer+2) + 3; + memcpy(ptr, &r->basic_errno, sizeof(r->basic_errno)); + ptr += sizeof(r->basic_errno); + memcpy(ptr, &r->more_errno, sizeof(r->more_errno)); + ptr += sizeof(r->more_errno); + if (!r->message) *ptr++ = 0; else + { + sprintf(CS ptr, "%.512s", r->message); + while(*ptr++); + } + rmt_dlv_checked_write(fd, 'R', '0', big_buffer, ptr - big_buffer); + } + +#ifdef SUPPORT_SOCKS + if (LOGGING(proxy) && proxy_session) + { + ptr = big_buffer; + if (proxy_local_address) + { + DEBUG(D_deliver) debug_printf("proxy_local_address '%s'\n", proxy_local_address); + ptr = big_buffer + sprintf(CS ptr, "%.128s", proxy_local_address) + 1; + DEBUG(D_deliver) debug_printf("proxy_local_port %d\n", proxy_local_port); + memcpy(ptr, &proxy_local_port, sizeof(proxy_local_port)); + ptr += sizeof(proxy_local_port); + } + else + *ptr++ = '\0'; + rmt_dlv_checked_write(fd, 'A', '2', big_buffer, ptr - big_buffer); + } +#endif + +#ifdef EXPERIMENTAL_DSN_INFO +/*um, are they really per-addr? Other per-conn stuff is not (auth, tls). But host_used is! */ + if (addr->smtp_greeting) + { + DEBUG(D_deliver) debug_printf("smtp_greeting '%s'\n", addr->smtp_greeting); + ptr = big_buffer + sprintf(CS big_buffer, "%.128s", addr->smtp_greeting) + 1; + if (addr->helo_response) + { + DEBUG(D_deliver) debug_printf("helo_response '%s'\n", addr->helo_response); + ptr += sprintf(CS ptr, "%.128s", addr->helo_response) + 1; + } + else + *ptr++ = '\0'; + rmt_dlv_checked_write(fd, 'A', '1', big_buffer, ptr - big_buffer); + } +#endif + + /* The rest of the information goes in an 'A0' item. */ + + sprintf(CS big_buffer, "%c%c", addr->transport_return, addr->special_action); + ptr = big_buffer + 2; + memcpy(ptr, &addr->basic_errno, sizeof(addr->basic_errno)); + ptr += sizeof(addr->basic_errno); + memcpy(ptr, &addr->more_errno, sizeof(addr->more_errno)); + ptr += sizeof(addr->more_errno); + memcpy(ptr, &addr->delivery_time, sizeof(addr->delivery_time)); + ptr += sizeof(addr->delivery_time); + memcpy(ptr, &addr->flags, sizeof(addr->flags)); + ptr += sizeof(addr->flags); + + if (!addr->message) *ptr++ = 0; else + ptr += sprintf(CS ptr, "%.1024s", addr->message) + 1; + + if (!addr->user_message) *ptr++ = 0; else + ptr += sprintf(CS ptr, "%.1024s", addr->user_message) + 1; + + if (!addr->host_used) *ptr++ = 0; else + { + ptr += sprintf(CS ptr, "%.256s", addr->host_used->name) + 1; + ptr += sprintf(CS ptr, "%.64s", addr->host_used->address) + 1; + memcpy(ptr, &addr->host_used->port, sizeof(addr->host_used->port)); + ptr += sizeof(addr->host_used->port); + + /* DNS lookup status */ + *ptr++ = addr->host_used->dnssec==DS_YES ? '2' + : addr->host_used->dnssec==DS_NO ? '1' : '0'; + + } + rmt_dlv_checked_write(fd, 'A', '0', big_buffer, ptr - big_buffer); + } + + /* Local interface address/port */ +#ifdef EXPERIMENTAL_DSN_INFO + if (sending_ip_address) +#else + if (LOGGING(incoming_interface) && sending_ip_address) +#endif + { + uschar * ptr; + ptr = big_buffer + sprintf(CS big_buffer, "%.128s", sending_ip_address) + 1; + ptr += sprintf(CS ptr, "%d", sending_port) + 1; + rmt_dlv_checked_write(fd, 'I', '0', big_buffer, ptr - big_buffer); + } + + /* Add termination flag, close the pipe, and that's it. The character + after 'Z' indicates whether continue_transport is now NULL or not. + A change from non-NULL to NULL indicates a problem with a continuing + connection. */ + + big_buffer[0] = continue_transport ? '1' : '0'; + rmt_dlv_checked_write(fd, 'Z', '0', big_buffer, 1); + (void)close(fd); + exit(EXIT_SUCCESS); + } + + /* Back in the mainline: close the unwanted half of the pipe. */ + + (void)close(pfd[pipe_write]); + + /* If we have a connection still open from a verify stage (lazy-close) + release its TLS library context (if any) as responsibility was passed to + the delivery child process. */ + + if (cutthrough.cctx.sock >= 0 && cutthrough.callout_hold_only) + { +#ifndef DISABLE_TLS + if (cutthrough.is_tls) + tls_close(cutthrough.cctx.tls_ctx, TLS_NO_SHUTDOWN); +#endif + (void) close(cutthrough.cctx.sock); + release_cutthrough_connection(US"passed to transport proc"); + } + + /* Fork failed; defer with error message */ + + if (pid == -1) + { + (void)close(pfd[pipe_read]); + panicmsg = string_sprintf("fork failed for remote delivery to %s: %s", + addr->domain, strerror(errno)); + goto enq_continue; + } + + /* Fork succeeded; increment the count, and remember relevant data for + when the process finishes. */ + + parcount++; + parlist[poffset].addrlist = parlist[poffset].addr = addr; + parlist[poffset].pid = pid; + parlist[poffset].fd = pfd[pipe_read]; + parlist[poffset].done = FALSE; + parlist[poffset].msg = NULL; + parlist[poffset].return_path = return_path; + + /* If the process we've just started is sending a message down an existing + channel, wait for it now. This ensures that only one such process runs at + once, whatever the value of remote_max parallel. Otherwise, we might try to + send two or more messages simultaneously down the same channel. This could + happen if there are different domains that include the same host in otherwise + different host lists. + + Also, if the transport closes down the channel, this information gets back + (continue_transport gets set to NULL) before we consider any other addresses + in this message. */ + + if (continue_transport) par_reduce(0, fallback); + + /* Otherwise, if we are running in the test harness, wait a bit, to let the + newly created process get going before we create another process. This should + ensure repeatability in the tests. Wait long enough for most cases to complete + the transport. */ + + else testharness_pause_ms(600); + + continue; + +enq_continue: + if (serialize_key) enq_end(serialize_key); +panic_continue: + remote_post_process(addr, LOG_MAIN|LOG_PANIC, panicmsg, fallback); + continue; + } + +/* Reached the end of the list of addresses. Wait for all the subprocesses that +are still running and post-process their addresses. */ + +par_reduce(0, fallback); +return TRUE; +} + + + + +/************************************************* +* Split an address into local part and domain * +*************************************************/ + +/* This function initializes an address for routing by splitting it up into a +local part and a domain. The local part is set up twice - once in its original +casing, and once in lower case, and it is dequoted. We also do the "percent +hack" for configured domains. This may lead to a DEFER result if a lookup +defers. When a percent-hacking takes place, we insert a copy of the original +address as a new parent of this address, as if we have had a redirection. + +Argument: + addr points to an addr_item block containing the address + +Returns: OK + DEFER - could not determine if domain is %-hackable +*/ + +int +deliver_split_address(address_item * addr) +{ +uschar * address = addr->address; +uschar * domain; +uschar * t; +int len; + +if (!(domain = Ustrrchr(address, '@'))) + return DEFER; /* should always have a domain, but just in case... */ + +len = domain - address; +addr->domain = string_copylc(domain+1); /* Domains are always caseless */ + +/* The implication in the RFCs (though I can't say I've seen it spelled out +explicitly) is that quoting should be removed from local parts at the point +where they are locally interpreted. [The new draft "821" is more explicit on +this, Jan 1999.] We know the syntax is valid, so this can be done by simply +removing quoting backslashes and any unquoted doublequotes. */ + +t = addr->cc_local_part = store_get(len+1, is_tainted(address)); +while(len-- > 0) + { + int c = *address++; + if (c == '\"') continue; + if (c == '\\') + { + *t++ = *address++; + len--; + } + else *t++ = c; + } +*t = 0; + +/* We do the percent hack only for those domains that are listed in +percent_hack_domains. A loop is required, to copy with multiple %-hacks. */ + +if (percent_hack_domains) + { + int rc; + uschar *new_address = NULL; + uschar *local_part = addr->cc_local_part; + + deliver_domain = addr->domain; /* set $domain */ + + while ( (rc = match_isinlist(deliver_domain, (const uschar **)&percent_hack_domains, 0, + &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL)) + == OK + && (t = Ustrrchr(local_part, '%')) != NULL + ) + { + new_address = string_copy(local_part); + new_address[t - local_part] = '@'; + deliver_domain = string_copylc(t+1); + local_part = string_copyn(local_part, t - local_part); + } + + if (rc == DEFER) return DEFER; /* lookup deferred */ + + /* If hackery happened, set up new parent and alter the current address. */ + + if (new_address) + { + address_item *new_parent = store_get(sizeof(address_item), FALSE); + *new_parent = *addr; + addr->parent = new_parent; + new_parent->child_count = 1; + addr->address = new_address; + addr->unique = string_copy(new_address); + addr->domain = deliver_domain; + addr->cc_local_part = local_part; + DEBUG(D_deliver) debug_printf("%%-hack changed address to: %s\n", + addr->address); + } + } + +/* Create the lowercased version of the final local part, and make that the +default one to be used. */ + +addr->local_part = addr->lc_local_part = string_copylc(addr->cc_local_part); +return OK; +} + + + + +/************************************************* +* Get next error message text * +*************************************************/ + +/* If f is not NULL, read the next "paragraph", from a customized error message +text file, terminated by a line containing ****, and expand it. + +Arguments: + f NULL or a file to read from + which string indicating which string (for errors) + +Returns: NULL or an expanded string +*/ + +static uschar * +next_emf(FILE *f, uschar *which) +{ +uschar *yield; +gstring * para; +uschar buffer[256]; + +if (!f) return NULL; + +if (!Ufgets(buffer, sizeof(buffer), f) || Ustrcmp(buffer, "****\n") == 0) + return NULL; + +para = string_get(256); +for (;;) + { + para = string_cat(para, buffer); + if (!Ufgets(buffer, sizeof(buffer), f) || Ustrcmp(buffer, "****\n") == 0) + break; + } +if ((yield = expand_string(string_from_gstring(para)))) + return yield; + +log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand string from " + "bounce_message_file or warn_message_file (%s): %s", which, + expand_string_message); +return NULL; +} + + + + +/************************************************* +* Close down a passed transport channel * +*************************************************/ + +/* This function is called when a passed transport channel cannot be used. +It attempts to close it down tidily. The yield is always DELIVER_NOT_ATTEMPTED +so that the function call can be the argument of a "return" statement. + +Arguments: None +Returns: DELIVER_NOT_ATTEMPTED +*/ + +static int +continue_closedown(void) +{ +if (continue_transport) + for (transport_instance * t = transports; t; t = t->next) + if (Ustrcmp(t->name, continue_transport) == 0) + { + if (t->info->closedown) (t->info->closedown)(t); + break; + } +return DELIVER_NOT_ATTEMPTED; +} + + + + +/************************************************* +* Print address information * +*************************************************/ + +/* This function is called to output an address, or information about an +address, for bounce or defer messages. If the hide_child flag is set, all we +output is the original ancestor address. + +Arguments: + addr points to the address + f the FILE to print to + si an initial string + sc a continuation string for before "generated" + se an end string + +Returns: TRUE if the address is not hidden +*/ + +static BOOL +print_address_information(address_item *addr, FILE *f, uschar *si, uschar *sc, + uschar *se) +{ +BOOL yield = TRUE; +uschar *printed = US""; +address_item *ancestor = addr; +while (ancestor->parent) ancestor = ancestor->parent; + +fprintf(f, "%s", CS si); + +if (addr->parent && testflag(addr, af_hide_child)) + { + printed = US"an undisclosed address"; + yield = FALSE; + } +else if (!testflag(addr, af_pfr) || !addr->parent) + printed = addr->address; + +else + { + uschar *s = addr->address; + uschar *ss; + + if (addr->address[0] == '>') { ss = US"mail"; s++; } + else if (addr->address[0] == '|') ss = US"pipe"; + else ss = US"save"; + + fprintf(f, "%s to %s%sgenerated by ", ss, s, sc); + printed = addr->parent->address; + } + +fprintf(f, "%s", CS string_printing(printed)); + +if (ancestor != addr) + { + uschar *original = ancestor->onetime_parent; + if (!original) original= ancestor->address; + if (strcmpic(original, printed) != 0) + fprintf(f, "%s(%sgenerated from %s)", sc, + ancestor != addr->parent ? "ultimately " : "", + string_printing(original)); + } + +if (addr->host_used) + fprintf(f, "\n host %s [%s]", + addr->host_used->name, addr->host_used->address); + +fprintf(f, "%s", CS se); +return yield; +} + + + + + +/************************************************* +* Print error for an address * +*************************************************/ + +/* This function is called to print the error information out of an address for +a bounce or a warning message. It tries to format the message reasonably by +introducing newlines. All lines are indented by 4; the initial printing +position must be set before calling. + +This function used always to print the error. Nowadays we want to restrict it +to cases such as LMTP/SMTP errors from a remote host, and errors from :fail: +and filter "fail". We no longer pass other information willy-nilly in bounce +and warning messages. Text in user_message is always output; text in message +only if the af_pass_message flag is set. + +Arguments: + addr the address + f the FILE to print on + t some leading text + +Returns: nothing +*/ + +static void +print_address_error(address_item *addr, FILE *f, uschar *t) +{ +int count = Ustrlen(t); +uschar *s = testflag(addr, af_pass_message) ? addr->message : NULL; + +if (!s && !(s = addr->user_message)) + return; + +fprintf(f, "\n %s", t); + +while (*s) + if (*s == '\\' && s[1] == 'n') + { + fprintf(f, "\n "); + s += 2; + count = 0; + } + else + { + fputc(*s, f); + count++; + if (*s++ == ':' && isspace(*s) && count > 45) + { + fprintf(f, "\n "); /* sic (because space follows) */ + count = 0; + } + } +} + + +/*********************************************************** +* Print Diagnostic-Code for an address * +************************************************************/ + +/* This function is called to print the error information out of an address for +a bounce or a warning message. It tries to format the message reasonably as +required by RFC 3461 by adding a space after each newline + +it uses the same logic as print_address_error() above. if af_pass_message is true +and addr->message is set it uses the remote host answer. if not addr->user_message +is used instead if available. + +Arguments: + addr the address + f the FILE to print on + +Returns: nothing +*/ + +static void +print_dsn_diagnostic_code(const address_item *addr, FILE *f) +{ +uschar * s = testflag(addr, af_pass_message) ? addr->message : NULL; +unsigned cnt; + +/* af_pass_message and addr->message set ? print remote host answer */ +if (s) + { + DEBUG(D_deliver) + debug_printf("DSN Diagnostic-Code: addr->message = %s\n", addr->message); + + /* search first ": ". we assume to find the remote-MTA answer there */ + if (!(s = Ustrstr(addr->message, ": "))) + return; /* not found, bail out */ + s += 2; /* skip ": " */ + cnt = fprintf(f, "Diagnostic-Code: smtp; "); + } +/* no message available. do nothing */ +else return; + +while (*s) + { + if (cnt > 950) /* RFC line length limit: 998 */ + { + DEBUG(D_deliver) debug_printf("print_dsn_diagnostic_code() truncated line\n"); + fputs("[truncated]", f); + break; + } + + if (*s == '\\' && s[1] == 'n') + { + fputs("\n ", f); /* as defined in RFC 3461 */ + s += 2; + cnt += 2; + } + else + { + fputc(*s++, f); + cnt++; + } + } + +fputc('\n', f); +} + + +/************************************************* +* Check list of addresses for duplication * +*************************************************/ + +/* This function was introduced when the test for duplicate addresses that are +not pipes, files, or autoreplies was moved from the middle of routing to when +routing was complete. That was to fix obscure cases when the routing history +affects the subsequent routing of identical addresses. This function is called +after routing, to check that the final routed addresses are not duplicates. + +If we detect a duplicate, we remember what it is a duplicate of. Note that +pipe, file, and autoreply de-duplication is handled during routing, so we must +leave such "addresses" alone here, as otherwise they will incorrectly be +discarded. + +Argument: address of list anchor +Returns: nothing +*/ + +static void +do_duplicate_check(address_item **anchor) +{ +address_item *addr; +while ((addr = *anchor)) + { + tree_node *tnode; + if (testflag(addr, af_pfr)) + { + anchor = &(addr->next); + } + else if ((tnode = tree_search(tree_duplicates, addr->unique))) + { + DEBUG(D_deliver|D_route) + debug_printf("%s is a duplicate address: discarded\n", addr->unique); + *anchor = addr->next; + addr->dupof = tnode->data.ptr; + addr->next = addr_duplicate; + addr_duplicate = addr; + } + else + { + tree_add_duplicate(addr->unique, addr); + anchor = &(addr->next); + } + } +} + + + + +/************************************************/ + +static void +print_dsn_addr_action(FILE * f, address_item * addr, + uschar * action, uschar * status) +{ +address_item * pa; + +if (addr->dsn_orcpt) + fprintf(f,"Original-Recipient: %s\n", addr->dsn_orcpt); + +for (pa = addr; pa->parent; ) pa = pa->parent; +fprintf(f, "Action: %s\n" + "Final-Recipient: rfc822;%s\n" + "Status: %s\n", + action, pa->address, status); +} + + + +/* When running in the test harness, there's an option that allows us to +fudge this time so as to get repeatability of the tests. Take the first +time off the list. In queue runs, the list pointer gets updated in the +calling process. */ + +int +test_harness_fudged_queue_time(int actual_time) +{ +int qt; +if ( f.running_in_test_harness && *fudged_queue_times + && (qt = readconf_readtime(fudged_queue_times, '/', FALSE)) >= 0) + { + DEBUG(D_deliver) debug_printf("fudged queue_times = %s\n", + fudged_queue_times); + return qt; + } +return actual_time; +} + +/************************************************/ + +static FILE * +expand_open(const uschar * filename, + const uschar * varname, const uschar * reason) +{ +const uschar * s = expand_cstring(filename); +FILE * fp = NULL; + +if (!s || !*s) + log_write(0, LOG_MAIN|LOG_PANIC, + "Failed to expand %s: '%s'\n", varname, filename); +else if (*s != '/' || is_tainted(s)) + log_write(0, LOG_MAIN|LOG_PANIC, + "%s is not %s after expansion: '%s'\n", + varname, *s == '/' ? "untainted" : "absolute", s); +else if (!(fp = Ufopen(s, "rb"))) + log_write(0, LOG_MAIN|LOG_PANIC, "Failed to open %s for %s " + "message texts: %s", s, reason, strerror(errno)); +return fp; +} + +/************************************************* +* Deliver one message * +*************************************************/ + +/* This is the function which is called when a message is to be delivered. It +is passed the id of the message. It is possible that the message no longer +exists, if some other process has delivered it, and it is also possible that +the message is being worked on by another process, in which case the data file +will be locked. + +If no delivery is attempted for any of the above reasons, the function returns +DELIVER_NOT_ATTEMPTED. + +If the give_up flag is set true, do not attempt any deliveries, but instead +fail all outstanding addresses and return the message to the sender (or +whoever). + +A delivery operation has a process all to itself; we never deliver more than +one message in the same process. Therefore we needn't worry too much about +store leakage. + +Liable to be called as root. + +Arguments: + id the id of the message to be delivered + forced TRUE if delivery was forced by an administrator; this overrides + retry delays and causes a delivery to be tried regardless + give_up TRUE if an administrator has requested that delivery attempts + be abandoned + +Returns: When the global variable mua_wrapper is FALSE: + DELIVER_ATTEMPTED_NORMAL if a delivery attempt was made + DELIVER_NOT_ATTEMPTED otherwise (see comment above) + When the global variable mua_wrapper is TRUE: + DELIVER_MUA_SUCCEEDED if delivery succeeded + DELIVER_MUA_FAILED if delivery failed + DELIVER_NOT_ATTEMPTED if not attempted (should not occur) +*/ + +int +deliver_message(uschar *id, BOOL forced, BOOL give_up) +{ +int i, rc; +int final_yield = DELIVER_ATTEMPTED_NORMAL; +time_t now = time(NULL); +address_item *addr_last = NULL; +uschar *filter_message = NULL; +int process_recipients = RECIP_ACCEPT; +open_db dbblock; +open_db *dbm_file; +extern int acl_where; +uschar *info; + +#ifdef MEASURE_TIMING +report_time_since(×tamp_startup, US"delivery start"); /* testcase 0022, 2100 */ +#endif + +info = queue_run_pid == (pid_t)0 + ? string_sprintf("delivering %s", id) + : string_sprintf("delivering %s (queue run pid %d)", id, queue_run_pid); + +/* If the D_process_info bit is on, set_process_info() will output debugging +information. If not, we want to show this initial information if D_deliver or +D_queue_run is set or in verbose mode. */ + +set_process_info("%s", info); + +if ( !(debug_selector & D_process_info) + && (debug_selector & (D_deliver|D_queue_run|D_v)) + ) + debug_printf("%s\n", info); + +/* Ensure that we catch any subprocesses that are created. Although Exim +sets SIG_DFL as its initial default, some routes through the code end up +here with it set to SIG_IGN - cases where a non-synchronous delivery process +has been forked, but no re-exec has been done. We use sigaction rather than +plain signal() on those OS where SA_NOCLDWAIT exists, because we want to be +sure it is turned off. (There was a problem on AIX with this.) */ + +#ifdef SA_NOCLDWAIT + { + struct sigaction act; + act.sa_handler = SIG_DFL; + sigemptyset(&(act.sa_mask)); + act.sa_flags = 0; + sigaction(SIGCHLD, &act, NULL); + } +#else +signal(SIGCHLD, SIG_DFL); +#endif + +/* Make the forcing flag available for routers and transports, set up the +global message id field, and initialize the count for returned files and the +message size. This use of strcpy() is OK because the length id is checked when +it is obtained from a command line (the -M or -q options), and otherwise it is +known to be a valid message id. */ + +if (id != message_id) + Ustrcpy(message_id, id); +f.deliver_force = forced; +return_count = 0; +message_size = 0; + +/* Initialize some flags */ + +update_spool = FALSE; +remove_journal = TRUE; + +/* Set a known context for any ACLs we call via expansions */ +acl_where = ACL_WHERE_DELIVERY; + +/* Reset the random number generator, so that if several delivery processes are +started from a queue runner that has already used random numbers (for sorting), +they don't all get the same sequence. */ + +random_seed = 0; + +/* Open and lock the message's data file. Exim locks on this one because the +header file may get replaced as it is re-written during the delivery process. +Any failures cause messages to be written to the log, except for missing files +while queue running - another process probably completed delivery. As part of +opening the data file, message_subdir gets set. */ + +if ((deliver_datafile = spool_open_datafile(id)) < 0) + return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */ + +/* The value of message_size at this point has been set to the data length, +plus one for the blank line that notionally precedes the data. */ + +/* Now read the contents of the header file, which will set up the headers in +store, and also the list of recipients and the tree of non-recipients and +assorted flags. It updates message_size. If there is a reading or format error, +give up; if the message has been around for sufficiently long, remove it. */ + + { + uschar * spoolname = string_sprintf("%s-H", id); + if ((rc = spool_read_header(spoolname, TRUE, TRUE)) != spool_read_OK) + { + if (errno == ERRNO_SPOOLFORMAT) + { + struct stat statbuf; + if (Ustat(spool_fname(US"input", message_subdir, spoolname, US""), + &statbuf) == 0) + log_write(0, LOG_MAIN, "Format error in spool file %s: " + "size=" OFF_T_FMT, spoolname, statbuf.st_size); + else + log_write(0, LOG_MAIN, "Format error in spool file %s", spoolname); + } + else + log_write(0, LOG_MAIN, "Error reading spool file %s: %s", spoolname, + strerror(errno)); + + /* If we managed to read the envelope data, received_time contains the + time the message was received. Otherwise, we can calculate it from the + message id. */ + + if (rc != spool_read_hdrerror) + { + received_time.tv_sec = received_time.tv_usec = 0; + /*XXX subsec precision?*/ + for (i = 0; i < 6; i++) + received_time.tv_sec = received_time.tv_sec * BASE_62 + tab62[id[i] - '0']; + } + + /* If we've had this malformed message too long, sling it. */ + + if (now - received_time.tv_sec > keep_malformed) + { + Uunlink(spool_fname(US"msglog", message_subdir, id, US"")); + Uunlink(spool_fname(US"input", message_subdir, id, US"-D")); + Uunlink(spool_fname(US"input", message_subdir, id, US"-H")); + Uunlink(spool_fname(US"input", message_subdir, id, US"-J")); + log_write(0, LOG_MAIN, "Message removed because older than %s", + readconf_printtime(keep_malformed)); + } + + (void)close(deliver_datafile); + deliver_datafile = -1; + return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */ + } + } + +/* The spool header file has been read. Look to see if there is an existing +journal file for this message. If there is, it means that a previous delivery +attempt crashed (program or host) before it could update the spool header file. +Read the list of delivered addresses from the journal and add them to the +nonrecipients tree. Then update the spool file. We can leave the journal in +existence, as it will get further successful deliveries added to it in this +run, and it will be deleted if this function gets to its end successfully. +Otherwise it might be needed again. */ + + { + uschar * fname = spool_fname(US"input", message_subdir, id, US"-J"); + FILE * jread; + + if ( (journal_fd = Uopen(fname, O_RDWR|O_APPEND +#ifdef O_CLOEXEC + | O_CLOEXEC +#endif +#ifdef O_NOFOLLOW + | O_NOFOLLOW +#endif + , SPOOL_MODE)) >= 0 + && lseek(journal_fd, 0, SEEK_SET) == 0 + && (jread = fdopen(journal_fd, "rb")) + ) + { + while (Ufgets(big_buffer, big_buffer_size, jread)) + { + int n = Ustrlen(big_buffer); + big_buffer[n-1] = 0; + tree_add_nonrecipient(big_buffer); + DEBUG(D_deliver) debug_printf("Previously delivered address %s taken from " + "journal file\n", big_buffer); + } + rewind(jread); + if ((journal_fd = dup(fileno(jread))) < 0) + journal_fd = fileno(jread); + else + (void) fclose(jread); /* Try to not leak the FILE resource */ + + /* Panic-dies on error */ + (void)spool_write_header(message_id, SW_DELIVERING, NULL); + } + else if (errno != ENOENT) + { + log_write(0, LOG_MAIN|LOG_PANIC, "attempt to open journal for reading gave: " + "%s", strerror(errno)); + return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */ + } + + /* A null recipients list indicates some kind of disaster. */ + + if (!recipients_list) + { + (void)close(deliver_datafile); + deliver_datafile = -1; + log_write(0, LOG_MAIN, "Spool error: no recipients for %s", fname); + return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */ + } + } + + +/* Handle a message that is frozen. There are a number of different things that +can happen, but in the default situation, unless forced, no delivery is +attempted. */ + +if (f.deliver_freeze) + { +#ifdef SUPPORT_MOVE_FROZEN_MESSAGES + /* Moving to another directory removes the message from Exim's view. Other + tools must be used to deal with it. Logging of this action happens in + spool_move_message() and its subfunctions. */ + + if ( move_frozen_messages + && spool_move_message(id, message_subdir, US"", US"F") + ) + return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */ +#endif + + /* For all frozen messages (bounces or not), timeout_frozen_after sets the + maximum time to keep messages that are frozen. Thaw if we reach it, with a + flag causing all recipients to be failed. The time is the age of the + message, not the time since freezing. */ + + if (timeout_frozen_after > 0 && message_age >= timeout_frozen_after) + { + log_write(0, LOG_MAIN, "cancelled by timeout_frozen_after"); + process_recipients = RECIP_FAIL_TIMEOUT; + } + + /* For bounce messages (and others with no sender), thaw if the error message + ignore timer is exceeded. The message will be discarded if this delivery + fails. */ + + else if (!*sender_address && message_age >= ignore_bounce_errors_after) + log_write(0, LOG_MAIN, "Unfrozen by errmsg timer"); + + /* If this is a bounce message, or there's no auto thaw, or we haven't + reached the auto thaw time yet, and this delivery is not forced by an admin + user, do not attempt delivery of this message. Note that forced is set for + continuing messages down the same channel, in order to skip load checking and + ignore hold domains, but we don't want unfreezing in that case. */ + + else + { + if ( ( sender_address[0] == 0 + || auto_thaw <= 0 + || now <= deliver_frozen_at + auto_thaw + ) + && ( !forced || !f.deliver_force_thaw + || !f.admin_user || continue_hostname + ) ) + { + (void)close(deliver_datafile); + deliver_datafile = -1; + log_write(L_skip_delivery, LOG_MAIN, "Message is frozen"); + return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */ + } + + /* If delivery was forced (by an admin user), assume a manual thaw. + Otherwise it's an auto thaw. */ + + if (forced) + { + f.deliver_manual_thaw = TRUE; + log_write(0, LOG_MAIN, "Unfrozen by forced delivery"); + } + else log_write(0, LOG_MAIN, "Unfrozen by auto-thaw"); + } + + /* We get here if any of the rules for unfreezing have triggered. */ + + f.deliver_freeze = FALSE; + update_spool = TRUE; + } + + +/* Open the message log file if we are using them. This records details of +deliveries, deferments, and failures for the benefit of the mail administrator. +The log is not used by exim itself to track the progress of a message; that is +done by rewriting the header spool file. */ + +if (message_logs) + { + uschar * fname = spool_fname(US"msglog", message_subdir, id, US""); + uschar * error; + int fd; + + if ((fd = open_msglog_file(fname, SPOOL_MODE, &error)) < 0) + { + log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't %s message log %s: %s", error, + fname, strerror(errno)); + return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */ + } + + /* Make a C stream out of it. */ + + if (!(message_log = fdopen(fd, "a"))) + { + log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't fdopen message log %s: %s", + fname, strerror(errno)); + return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */ + } + } + + +/* If asked to give up on a message, log who did it, and set the action for all +the addresses. */ + +if (give_up) + { + struct passwd *pw = getpwuid(real_uid); + log_write(0, LOG_MAIN, "cancelled by %s", + pw ? US pw->pw_name : string_sprintf("uid %ld", (long int)real_uid)); + process_recipients = RECIP_FAIL; + } + +/* Otherwise, if there are too many Received: headers, fail all recipients. */ + +else if (received_count > received_headers_max) + process_recipients = RECIP_FAIL_LOOP; + +/* Otherwise, if a system-wide, address-independent message filter is +specified, run it now, except in the case when we are failing all recipients as +a result of timeout_frozen_after. If the system filter yields "delivered", then +ignore the true recipients of the message. Failure of the filter file is +logged, and the delivery attempt fails. */ + +else if (system_filter && process_recipients != RECIP_FAIL_TIMEOUT) + { + int rc; + int filtertype; + ugid_block ugid; + redirect_block redirect; + + if (system_filter_uid_set) + { + ugid.uid = system_filter_uid; + ugid.gid = system_filter_gid; + ugid.uid_set = ugid.gid_set = TRUE; + } + else + ugid.uid_set = ugid.gid_set = FALSE; + + return_path = sender_address; + f.enable_dollar_recipients = TRUE; /* Permit $recipients in system filter */ + f.system_filtering = TRUE; + + /* Any error in the filter file causes a delivery to be abandoned. */ + + redirect.string = system_filter; + redirect.isfile = TRUE; + redirect.check_owner = redirect.check_group = FALSE; + redirect.owners = NULL; + redirect.owngroups = NULL; + redirect.pw = NULL; + redirect.modemask = 0; + + DEBUG(D_deliver|D_filter) debug_printf("running system filter\n"); + + rc = rda_interpret( + &redirect, /* Where the data is */ + RDO_DEFER | /* Turn on all the enabling options */ + RDO_FAIL | /* Leave off all the disabling options */ + RDO_FILTER | + RDO_FREEZE | + RDO_REALLOG | + RDO_REWRITE, + NULL, /* No :include: restriction (not used in filter) */ + NULL, /* No sieve vacation directory (not sieve!) */ + NULL, /* No sieve enotify mailto owner (not sieve!) */ + NULL, /* No sieve user address (not sieve!) */ + NULL, /* No sieve subaddress (not sieve!) */ + &ugid, /* uid/gid data */ + &addr_new, /* Where to hang generated addresses */ + &filter_message, /* Where to put error message */ + NULL, /* Don't skip syntax errors */ + &filtertype, /* Will always be set to FILTER_EXIM for this call */ + US"system filter"); /* For error messages */ + + DEBUG(D_deliver|D_filter) debug_printf("system filter returned %d\n", rc); + + if (rc == FF_ERROR || rc == FF_NONEXIST) + { + (void)close(deliver_datafile); + deliver_datafile = -1; + log_write(0, LOG_MAIN|LOG_PANIC, "Error in system filter: %s", + string_printing(filter_message)); + return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */ + } + + /* Reset things. If the filter message is an empty string, which can happen + for a filter "fail" or "freeze" command with no text, reset it to NULL. */ + + f.system_filtering = FALSE; + f.enable_dollar_recipients = FALSE; + if (filter_message && filter_message[0] == 0) filter_message = NULL; + + /* Save the values of the system filter variables so that user filters + can use them. */ + + memcpy(filter_sn, filter_n, sizeof(filter_sn)); + + /* The filter can request that delivery of the original addresses be + deferred. */ + + if (rc == FF_DEFER) + { + process_recipients = RECIP_DEFER; + deliver_msglog("Delivery deferred by system filter\n"); + log_write(0, LOG_MAIN, "Delivery deferred by system filter"); + } + + /* The filter can request that a message be frozen, but this does not + take place if the message has been manually thawed. In that case, we must + unset "delivered", which is forced by the "freeze" command to make -bF + work properly. */ + + else if (rc == FF_FREEZE && !f.deliver_manual_thaw) + { + f.deliver_freeze = TRUE; + deliver_frozen_at = time(NULL); + process_recipients = RECIP_DEFER; + frozen_info = string_sprintf(" by the system filter%s%s", + filter_message ? US": " : US"", + filter_message ? filter_message : US""); + } + + /* The filter can request that a message be failed. The error message may be + quite long - it is sent back to the sender in the bounce - but we don't want + to fill up the log with repetitions of it. If it starts with << then the text + between << and >> is written to the log, with the rest left for the bounce + message. */ + + else if (rc == FF_FAIL) + { + uschar *colon = US""; + uschar *logmsg = US""; + int loglen = 0; + + process_recipients = RECIP_FAIL_FILTER; + + if (filter_message) + { + uschar *logend; + colon = US": "; + if ( filter_message[0] == '<' + && filter_message[1] == '<' + && (logend = Ustrstr(filter_message, ">>")) + ) + { + logmsg = filter_message + 2; + loglen = logend - logmsg; + filter_message = logend + 2; + if (filter_message[0] == 0) filter_message = NULL; + } + else + { + logmsg = filter_message; + loglen = Ustrlen(filter_message); + } + } + + log_write(0, LOG_MAIN, "cancelled by system filter%s%.*s", colon, loglen, + logmsg); + } + + /* Delivery can be restricted only to those recipients (if any) that the + filter specified. */ + + else if (rc == FF_DELIVERED) + { + process_recipients = RECIP_IGNORE; + if (addr_new) + log_write(0, LOG_MAIN, "original recipients ignored (system filter)"); + else + log_write(0, LOG_MAIN, "=> discarded (system filter)"); + } + + /* If any new addresses were created by the filter, fake up a "parent" + for them. This is necessary for pipes, etc., which are expected to have + parents, and it also gives some sensible logging for others. Allow + pipes, files, and autoreplies, and run them as the filter uid if set, + otherwise as the current uid. */ + + if (addr_new) + { + int uid = system_filter_uid_set ? system_filter_uid : geteuid(); + int gid = system_filter_gid_set ? system_filter_gid : getegid(); + + /* The text "system-filter" is tested in transport_set_up_command() and in + set_up_shell_command() in the pipe transport, to enable them to permit + $recipients, so don't change it here without also changing it there. */ + + address_item *p = addr_new; + address_item *parent = deliver_make_addr(US"system-filter", FALSE); + + parent->domain = string_copylc(qualify_domain_recipient); + parent->local_part = US"system-filter"; + + /* As part of this loop, we arrange for addr_last to end up pointing + at the final address. This is used if we go on to add addresses for the + original recipients. */ + + while (p) + { + if (parent->child_count == USHRT_MAX) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "system filter generated more " + "than %d delivery addresses", USHRT_MAX); + parent->child_count++; + p->parent = parent; + + if (testflag(p, af_pfr)) + { + uschar *tpname; + uschar *type; + p->uid = uid; + p->gid = gid; + setflag(p, af_uid_set); + setflag(p, af_gid_set); + setflag(p, af_allow_file); + setflag(p, af_allow_pipe); + setflag(p, af_allow_reply); + + /* Find the name of the system filter's appropriate pfr transport */ + + if (p->address[0] == '|') + { + type = US"pipe"; + tpname = system_filter_pipe_transport; + address_pipe = p->address; + } + else if (p->address[0] == '>') + { + type = US"reply"; + tpname = system_filter_reply_transport; + } + else + { + if (p->address[Ustrlen(p->address)-1] == '/') + { + type = US"directory"; + tpname = system_filter_directory_transport; + } + else + { + type = US"file"; + tpname = system_filter_file_transport; + } + address_file = p->address; + } + + /* Now find the actual transport, first expanding the name. We have + set address_file or address_pipe above. */ + + if (tpname) + { + uschar *tmp = expand_string(tpname); + address_file = address_pipe = NULL; + if (!tmp) + p->message = string_sprintf("failed to expand \"%s\" as a " + "system filter transport name", tpname); + if (is_tainted(tmp)) + p->message = string_sprintf("attempt to used tainted value '%s' for" + "transport '%s' as a system filter", tmp, tpname); + tpname = tmp; + } + else + p->message = string_sprintf("system_filter_%s_transport is unset", + type); + + if (tpname) + { + transport_instance *tp; + for (tp = transports; tp; tp = tp->next) + if (Ustrcmp(tp->name, tpname) == 0) + { + p->transport = tp; + break; + } + if (!tp) + p->message = string_sprintf("failed to find \"%s\" transport " + "for system filter delivery", tpname); + } + + /* If we couldn't set up a transport, defer the delivery, putting the + error on the panic log as well as the main log. */ + + if (!p->transport) + { + address_item *badp = p; + p = p->next; + if (!addr_last) addr_new = p; else addr_last->next = p; + badp->local_part = badp->address; /* Needed for log line */ + post_process_one(badp, DEFER, LOG_MAIN|LOG_PANIC, EXIM_DTYPE_ROUTER, 0); + continue; + } + } /* End of pfr handling */ + + /* Either a non-pfr delivery, or we found a transport */ + + DEBUG(D_deliver|D_filter) + debug_printf("system filter added %s\n", p->address); + + addr_last = p; + p = p->next; + } /* Loop through all addr_new addresses */ + } + } + + +/* Scan the recipients list, and for every one that is not in the non- +recipients tree, add an addr item to the chain of new addresses. If the pno +value is non-negative, we must set the onetime parent from it. This which +points to the relevant entry in the recipients list. + +This processing can be altered by the setting of the process_recipients +variable, which is changed if recipients are to be ignored, failed, or +deferred. This can happen as a result of system filter activity, or if the -Mg +option is used to fail all of them. + +Duplicate addresses are handled later by a different tree structure; we can't +just extend the non-recipients tree, because that will be re-written to the +spool if the message is deferred, and in any case there are casing +complications for local addresses. */ + +if (process_recipients != RECIP_IGNORE) + for (i = 0; i < recipients_count; i++) + if (!tree_search(tree_nonrecipients, recipients_list[i].address)) + { + recipient_item *r = recipients_list + i; + address_item *new = deliver_make_addr(r->address, FALSE); + new->prop.errors_address = r->errors_to; +#ifdef SUPPORT_I18N + if ((new->prop.utf8_msg = message_smtputf8)) + { + new->prop.utf8_downcvt = message_utf8_downconvert == 1; + new->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1; + DEBUG(D_deliver) debug_printf("utf8, downconvert %s\n", + new->prop.utf8_downcvt ? "yes" + : new->prop.utf8_downcvt_maybe ? "ifneeded" + : "no"); + } +#endif + + if (r->pno >= 0) + new->onetime_parent = recipients_list[r->pno].address; + + /* If DSN support is enabled, set the dsn flags and the original receipt + to be passed on to other DSN enabled MTAs */ + + new->dsn_flags = r->dsn_flags & rf_dsnflags; + new->dsn_orcpt = r->orcpt; + DEBUG(D_deliver) debug_printf("DSN: set orcpt: %s flags: 0x%x\n", + new->dsn_orcpt ? new->dsn_orcpt : US"", new->dsn_flags); + + switch (process_recipients) + { + /* RECIP_DEFER is set when a system filter freezes a message. */ + + case RECIP_DEFER: + new->next = addr_defer; + addr_defer = new; + break; + + + /* RECIP_FAIL_FILTER is set when a system filter has obeyed a "fail" + command. */ + + case RECIP_FAIL_FILTER: + new->message = + filter_message ? filter_message : US"delivery cancelled"; + setflag(new, af_pass_message); + goto RECIP_QUEUE_FAILED; /* below */ + + + /* RECIP_FAIL_TIMEOUT is set when a message is frozen, but is older + than the value in timeout_frozen_after. Treat non-bounce messages + similarly to -Mg; for bounce messages we just want to discard, so + don't put the address on the failed list. The timeout has already + been logged. */ + + case RECIP_FAIL_TIMEOUT: + new->message = US"delivery cancelled; message timed out"; + goto RECIP_QUEUE_FAILED; /* below */ + + + /* RECIP_FAIL is set when -Mg has been used. */ + + case RECIP_FAIL: + new->message = US"delivery cancelled by administrator"; + /* Fall through */ + + /* Common code for the failure cases above. If this is not a bounce + message, put the address on the failed list so that it is used to + create a bounce. Otherwise do nothing - this just discards the address. + The incident has already been logged. */ + + RECIP_QUEUE_FAILED: + if (sender_address[0]) + { + new->next = addr_failed; + addr_failed = new; + } + break; + + + /* RECIP_FAIL_LOOP is set when there are too many Received: headers + in the message. Process each address as a routing failure; if this + is a bounce message, it will get frozen. */ + + case RECIP_FAIL_LOOP: + new->message = US"Too many \"Received\" headers - suspected mail loop"; + post_process_one(new, FAIL, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + break; + + + /* Value should be RECIP_ACCEPT; take this as the safe default. */ + + default: + if (!addr_new) addr_new = new; else addr_last->next = new; + addr_last = new; + break; + } + +#ifndef DISABLE_EVENT + if (process_recipients != RECIP_ACCEPT && event_action) + { + uschar * save_local = deliver_localpart; + const uschar * save_domain = deliver_domain; + uschar * addr = new->address, * errmsg = NULL; + int start, end, dom; + + if (!parse_extract_address(addr, &errmsg, &start, &end, &dom, TRUE)) + log_write(0, LOG_MAIN|LOG_PANIC, + "failed to parse address '%.100s': %s\n", addr, errmsg); + else + { + deliver_localpart = + string_copyn(addr+start, dom ? (dom-1) - start : end - start); + deliver_domain = dom ? CUS string_copyn(addr+dom, end - dom) : CUS""; + + event_raise(event_action, US"msg:fail:internal", new->message); + + deliver_localpart = save_local; + deliver_domain = save_domain; + } + } +#endif + } + +DEBUG(D_deliver) + { + debug_printf("Delivery address list:\n"); + for (address_item * p = addr_new; p; p = p->next) + debug_printf(" %s %s\n", p->address, + p->onetime_parent ? p->onetime_parent : US""); + } + +/* Set up the buffers used for copying over the file when delivering. */ + +deliver_in_buffer = store_malloc(DELIVER_IN_BUFFER_SIZE); +deliver_out_buffer = store_malloc(DELIVER_OUT_BUFFER_SIZE); + + + +/* Until there are no more new addresses, handle each one as follows: + + . If this is a generated address (indicated by the presence of a parent + pointer) then check to see whether it is a pipe, file, or autoreply, and + if so, handle it directly here. The router that produced the address will + have set the allow flags into the address, and also set the uid/gid required. + Having the routers generate new addresses and then checking them here at + the outer level is tidier than making each router do the checking, and + means that routers don't need access to the failed address queue. + + . Break up the address into local part and domain, and make lowercased + versions of these strings. We also make unquoted versions of the local part. + + . Handle the percent hack for those domains for which it is valid. + + . For child addresses, determine if any of the parents have the same address. + If so, generate a different string for previous delivery checking. Without + this code, if the address spqr generates spqr via a forward or alias file, + delivery of the generated spqr stops further attempts at the top level spqr, + which is not what is wanted - it may have generated other addresses. + + . Check on the retry database to see if routing was previously deferred, but + only if in a queue run. Addresses that are to be routed are put on the + addr_route chain. Addresses that are to be deferred are put on the + addr_defer chain. We do all the checking first, so as not to keep the + retry database open any longer than necessary. + + . Now we run the addresses through the routers. A router may put the address + on either the addr_local or the addr_remote chain for local or remote + delivery, respectively, or put it on the addr_failed chain if it is + undeliveable, or it may generate child addresses and put them on the + addr_new chain, or it may defer an address. All the chain anchors are + passed as arguments so that the routers can be called for verification + purposes as well. + + . If new addresses have been generated by the routers, da capo. +*/ + +f.header_rewritten = FALSE; /* No headers rewritten yet */ +while (addr_new) /* Loop until all addresses dealt with */ + { + address_item *addr, *parent; + + /* Failure to open the retry database is treated the same as if it does + not exist. In both cases, dbm_file is NULL. */ + + if (!(dbm_file = dbfn_open(US"retry", O_RDONLY, &dbblock, FALSE, TRUE))) + DEBUG(D_deliver|D_retry|D_route|D_hints_lookup) + debug_printf("no retry data available\n"); + + /* Scan the current batch of new addresses, to handle pipes, files and + autoreplies, and determine which others are ready for routing. */ + + while (addr_new) + { + int rc; + uschar *p; + tree_node *tnode; + dbdata_retry *domain_retry_record; + dbdata_retry *address_retry_record; + + addr = addr_new; + addr_new = addr->next; + + DEBUG(D_deliver|D_retry|D_route) + { + debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"); + debug_printf("Considering: %s\n", addr->address); + } + + /* Handle generated address that is a pipe or a file or an autoreply. */ + + if (testflag(addr, af_pfr)) + { + /* If an autoreply in a filter could not generate a syntactically valid + address, give up forthwith. Set af_ignore_error so that we don't try to + generate a bounce. */ + + if (testflag(addr, af_bad_reply)) + { + addr->basic_errno = ERRNO_BADADDRESS2; + addr->local_part = addr->address; + addr->message = + US"filter autoreply generated syntactically invalid recipient"; + addr->prop.ignore_error = TRUE; + (void) post_process_one(addr, FAIL, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + continue; /* with the next new address */ + } + + /* If two different users specify delivery to the same pipe or file or + autoreply, there should be two different deliveries, so build a unique + string that incorporates the original address, and use this for + duplicate testing and recording delivery, and also for retrying. */ + + addr->unique = + string_sprintf("%s:%s", addr->address, addr->parent->unique + + (testflag(addr->parent, af_homonym)? 3:0)); + + addr->address_retry_key = addr->domain_retry_key = + string_sprintf("T:%s", addr->unique); + + /* If a filter file specifies two deliveries to the same pipe or file, + we want to de-duplicate, but this is probably not wanted for two mail + commands to the same address, where probably both should be delivered. + So, we have to invent a different unique string in that case. Just + keep piling '>' characters on the front. */ + + if (addr->address[0] == '>') + while (tree_search(tree_duplicates, addr->unique)) + addr->unique = string_sprintf(">%s", addr->unique); + + else if ((tnode = tree_search(tree_duplicates, addr->unique))) + { + DEBUG(D_deliver|D_route) + debug_printf("%s is a duplicate address: discarded\n", addr->address); + addr->dupof = tnode->data.ptr; + addr->next = addr_duplicate; + addr_duplicate = addr; + continue; + } + + DEBUG(D_deliver|D_route) debug_printf("unique = %s\n", addr->unique); + + /* Check for previous delivery */ + + if (tree_search(tree_nonrecipients, addr->unique)) + { + DEBUG(D_deliver|D_route) + debug_printf("%s was previously delivered: discarded\n", addr->address); + child_done(addr, tod_stamp(tod_log)); + continue; + } + + /* Save for checking future duplicates */ + + tree_add_duplicate(addr->unique, addr); + + /* Set local part and domain */ + + addr->local_part = addr->address; + addr->domain = addr->parent->domain; + + /* Ensure that the delivery is permitted. */ + + if (testflag(addr, af_file)) + { + if (!testflag(addr, af_allow_file)) + { + addr->basic_errno = ERRNO_FORBIDFILE; + addr->message = US"delivery to file forbidden"; + (void)post_process_one(addr, FAIL, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + continue; /* with the next new address */ + } + } + else if (addr->address[0] == '|') + { + if (!testflag(addr, af_allow_pipe)) + { + addr->basic_errno = ERRNO_FORBIDPIPE; + addr->message = US"delivery to pipe forbidden"; + (void)post_process_one(addr, FAIL, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + continue; /* with the next new address */ + } + } + else if (!testflag(addr, af_allow_reply)) + { + addr->basic_errno = ERRNO_FORBIDREPLY; + addr->message = US"autoreply forbidden"; + (void)post_process_one(addr, FAIL, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + continue; /* with the next new address */ + } + + /* If the errno field is already set to BADTRANSPORT, it indicates + failure to expand a transport string, or find the associated transport, + or an unset transport when one is required. Leave this test till now so + that the forbid errors are given in preference. */ + + if (addr->basic_errno == ERRNO_BADTRANSPORT) + { + (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + continue; + } + + /* Treat /dev/null as a special case and abandon the delivery. This + avoids having to specify a uid on the transport just for this case. + Arrange for the transport name to be logged as "**bypassed**". */ + + if (Ustrcmp(addr->address, "/dev/null") == 0) + { + uschar *save = addr->transport->name; + addr->transport->name = US"**bypassed**"; + (void)post_process_one(addr, OK, LOG_MAIN, EXIM_DTYPE_TRANSPORT, '='); + addr->transport->name = save; + continue; /* with the next new address */ + } + + /* Pipe, file, or autoreply delivery is to go ahead as a normal local + delivery. */ + + DEBUG(D_deliver|D_route) + debug_printf("queued for %s transport\n", addr->transport->name); + addr->next = addr_local; + addr_local = addr; + continue; /* with the next new address */ + } + + /* Handle normal addresses. First, split up into local part and domain, + handling the %-hack if necessary. There is the possibility of a defer from + a lookup in percent_hack_domains. */ + + if ((rc = deliver_split_address(addr)) == DEFER) + { + addr->message = US"cannot check percent_hack_domains"; + addr->basic_errno = ERRNO_LISTDEFER; + (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_NONE, 0); + continue; + } + + /* Check to see if the domain is held. If so, proceed only if the + delivery was forced by hand. */ + + deliver_domain = addr->domain; /* set $domain */ + if ( !forced && hold_domains + && (rc = match_isinlist(addr->domain, (const uschar **)&hold_domains, 0, + &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, + NULL)) != FAIL + ) + { + if (rc == DEFER) + { + addr->message = US"hold_domains lookup deferred"; + addr->basic_errno = ERRNO_LISTDEFER; + } + else + { + addr->message = US"domain is held"; + addr->basic_errno = ERRNO_HELD; + } + (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_NONE, 0); + continue; + } + + /* Now we can check for duplicates and previously delivered addresses. In + order to do this, we have to generate a "unique" value for each address, + because there may be identical actual addresses in a line of descendents. + The "unique" field is initialized to the same value as the "address" field, + but gets changed here to cope with identically-named descendents. */ + + for (parent = addr->parent; parent; parent = parent->parent) + if (strcmpic(addr->address, parent->address) == 0) break; + + /* If there's an ancestor with the same name, set the homonym flag. This + influences how deliveries are recorded. Then add a prefix on the front of + the unique address. We use \n\ where n starts at 0 and increases each time. + It is unlikely to pass 9, but if it does, it may look odd but will still + work. This means that siblings or cousins with the same names are treated + as duplicates, which is what we want. */ + + if (parent) + { + setflag(addr, af_homonym); + if (parent->unique[0] != '\\') + addr->unique = string_sprintf("\\0\\%s", addr->address); + else + addr->unique = string_sprintf("\\%c\\%s", parent->unique[1] + 1, + addr->address); + } + + /* Ensure that the domain in the unique field is lower cased, because + domains are always handled caselessly. */ + + p = Ustrrchr(addr->unique, '@'); + while (*p != 0) { *p = tolower(*p); p++; } + + DEBUG(D_deliver|D_route) debug_printf("unique = %s\n", addr->unique); + + if (tree_search(tree_nonrecipients, addr->unique)) + { + DEBUG(D_deliver|D_route) + debug_printf("%s was previously delivered: discarded\n", addr->unique); + child_done(addr, tod_stamp(tod_log)); + continue; + } + + /* Get the routing retry status, saving the two retry keys (with and + without the local part) for subsequent use. If there is no retry record for + the standard address routing retry key, we look for the same key with the + sender attached, because this form is used by the smtp transport after a + 4xx response to RCPT when address_retry_include_sender is true. */ + + addr->domain_retry_key = string_sprintf("R:%s", addr->domain); + addr->address_retry_key = string_sprintf("R:%s@%s", addr->local_part, + addr->domain); + + if (dbm_file) + { + domain_retry_record = dbfn_read(dbm_file, addr->domain_retry_key); + if ( domain_retry_record + && now - domain_retry_record->time_stamp > retry_data_expire + ) + { + DEBUG(D_deliver|D_retry) + debug_printf("domain retry record present but expired\n"); + domain_retry_record = NULL; /* Ignore if too old */ + } + + address_retry_record = dbfn_read(dbm_file, addr->address_retry_key); + if ( address_retry_record + && now - address_retry_record->time_stamp > retry_data_expire + ) + { + DEBUG(D_deliver|D_retry) + debug_printf("address retry record present but expired\n"); + address_retry_record = NULL; /* Ignore if too old */ + } + + if (!address_retry_record) + { + uschar *altkey = string_sprintf("%s:<%s>", addr->address_retry_key, + sender_address); + address_retry_record = dbfn_read(dbm_file, altkey); + if ( address_retry_record + && now - address_retry_record->time_stamp > retry_data_expire) + { + DEBUG(D_deliver|D_retry) + debug_printf("address<sender> retry record present but expired\n"); + address_retry_record = NULL; /* Ignore if too old */ + } + } + } + else + domain_retry_record = address_retry_record = NULL; + + DEBUG(D_deliver|D_retry) + { + if (!domain_retry_record) + debug_printf("no domain retry record\n"); + else + debug_printf("have domain retry record; next_try = now%+d\n", + f.running_in_test_harness ? 0 : + (int)(domain_retry_record->next_try - now)); + + if (!address_retry_record) + debug_printf("no address retry record\n"); + else + debug_printf("have address retry record; next_try = now%+d\n", + f.running_in_test_harness ? 0 : + (int)(address_retry_record->next_try - now)); + } + + /* If we are sending a message down an existing SMTP connection, we must + assume that the message which created the connection managed to route + an address to that connection. We do not want to run the risk of taking + a long time over routing here, because if we do, the server at the other + end of the connection may time it out. This is especially true for messages + with lots of addresses. For this kind of delivery, queue_running is not + set, so we would normally route all addresses. We take a pragmatic approach + and defer routing any addresses that have any kind of domain retry record. + That is, we don't even look at their retry times. It doesn't matter if this + doesn't work occasionally. This is all just an optimization, after all. + + The reason for not doing the same for address retries is that they normally + arise from 4xx responses, not DNS timeouts. */ + + if (continue_hostname && domain_retry_record) + { + addr->message = US"reusing SMTP connection skips previous routing defer"; + addr->basic_errno = ERRNO_RRETRY; + (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + + addr->message = domain_retry_record->text; + setflag(addr, af_pass_message); + } + + /* If we are in a queue run, defer routing unless there is no retry data or + we've passed the next retry time, or this message is forced. In other + words, ignore retry data when not in a queue run. + + However, if the domain retry time has expired, always allow the routing + attempt. If it fails again, the address will be failed. This ensures that + each address is routed at least once, even after long-term routing + failures. + + If there is an address retry, check that too; just wait for the next + retry time. This helps with the case when the temporary error on the + address was really message-specific rather than address specific, since + it allows other messages through. + + We also wait for the next retry time if this is a message sent down an + existing SMTP connection (even though that will be forced). Otherwise there + will be far too many attempts for an address that gets a 4xx error. In + fact, after such an error, we should not get here because, the host should + not be remembered as one this message needs. However, there was a bug that + used to cause this to happen, so it is best to be on the safe side. + + Even if we haven't reached the retry time in the hints, there is one more + check to do, which is for the ultimate address timeout. We only do this + check if there is an address retry record and there is not a domain retry + record; this implies that previous attempts to handle the address had the + retry_use_local_parts option turned on. We use this as an approximation + for the destination being like a local delivery, for example delivery over + LMTP to an IMAP message store. In this situation users are liable to bump + into their quota and thereby have intermittently successful deliveries, + which keep the retry record fresh, which can lead to us perpetually + deferring messages. */ + + else if ( ( f.queue_running && !f.deliver_force + || continue_hostname + ) + && ( ( domain_retry_record + && now < domain_retry_record->next_try + && !domain_retry_record->expired + ) + || ( address_retry_record + && now < address_retry_record->next_try + ) ) + && ( domain_retry_record + || !address_retry_record + || !retry_ultimate_address_timeout(addr->address_retry_key, + addr->domain, address_retry_record, now) + ) ) + { + addr->message = US"retry time not reached"; + addr->basic_errno = ERRNO_RRETRY; + (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + + /* For remote-retry errors (here and just above) that we've not yet + hit the retry time, use the error recorded in the retry database + as info in the warning message. This lets us send a message even + when we're not failing on a fresh attempt. We assume that this + info is not sensitive. */ + + addr->message = domain_retry_record + ? domain_retry_record->text : address_retry_record->text; + setflag(addr, af_pass_message); + } + + /* The domain is OK for routing. Remember if retry data exists so it + can be cleaned up after a successful delivery. */ + + else + { + if (domain_retry_record || address_retry_record) + setflag(addr, af_dr_retry_exists); + addr->next = addr_route; + addr_route = addr; + DEBUG(D_deliver|D_route) + debug_printf("%s: queued for routing\n", addr->address); + } + } + + /* The database is closed while routing is actually happening. Requests to + update it are put on a chain and all processed together at the end. */ + + if (dbm_file) dbfn_close(dbm_file); + + /* If queue_domains is set, we don't even want to try routing addresses in + those domains. During queue runs, queue_domains is forced to be unset. + Optimize by skipping this pass through the addresses if nothing is set. */ + + if (!f.deliver_force && queue_domains) + { + address_item *okaddr = NULL; + while (addr_route) + { + address_item *addr = addr_route; + addr_route = addr->next; + + deliver_domain = addr->domain; /* set $domain */ + if ((rc = match_isinlist(addr->domain, (const uschar **)&queue_domains, 0, + &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL)) + != OK) + if (rc == DEFER) + { + addr->basic_errno = ERRNO_LISTDEFER; + addr->message = US"queue_domains lookup deferred"; + (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + } + else + { + addr->next = okaddr; + okaddr = addr; + } + else + { + addr->basic_errno = ERRNO_QUEUE_DOMAIN; + addr->message = US"domain is in queue_domains"; + (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + } + } + + addr_route = okaddr; + } + + /* Now route those addresses that are not deferred. */ + + while (addr_route) + { + int rc; + address_item *addr = addr_route; + const uschar *old_domain = addr->domain; + uschar *old_unique = addr->unique; + addr_route = addr->next; + addr->next = NULL; + + /* Just in case some router parameter refers to it. */ + + if (!(return_path = addr->prop.errors_address)) + return_path = sender_address; + + /* If a router defers an address, add a retry item. Whether or not to + use the local part in the key is a property of the router. */ + + if ((rc = route_address(addr, &addr_local, &addr_remote, &addr_new, + &addr_succeed, v_none)) == DEFER) + retry_add_item(addr, + addr->router->retry_use_local_part + ? string_sprintf("R:%s@%s", addr->local_part, addr->domain) + : string_sprintf("R:%s", addr->domain), + 0); + + /* Otherwise, if there is an existing retry record in the database, add + retry items to delete both forms. We must also allow for the possibility + of a routing retry that includes the sender address. Since the domain might + have been rewritten (expanded to fully qualified) as a result of routing, + ensure that the rewritten form is also deleted. */ + + else if (testflag(addr, af_dr_retry_exists)) + { + uschar *altkey = string_sprintf("%s:<%s>", addr->address_retry_key, + sender_address); + retry_add_item(addr, altkey, rf_delete); + retry_add_item(addr, addr->address_retry_key, rf_delete); + retry_add_item(addr, addr->domain_retry_key, rf_delete); + if (Ustrcmp(addr->domain, old_domain) != 0) + retry_add_item(addr, string_sprintf("R:%s", old_domain), rf_delete); + } + + /* DISCARD is given for :blackhole: and "seen finish". The event has been + logged, but we need to ensure the address (and maybe parents) is marked + done. */ + + if (rc == DISCARD) + { + address_done(addr, tod_stamp(tod_log)); + continue; /* route next address */ + } + + /* The address is finished with (failed or deferred). */ + + if (rc != OK) + { + (void)post_process_one(addr, rc, LOG_MAIN, EXIM_DTYPE_ROUTER, 0); + continue; /* route next address */ + } + + /* The address has been routed. If the router changed the domain, it will + also have changed the unique address. We have to test whether this address + has already been delivered, because it's the unique address that finally + gets recorded. */ + + if ( addr->unique != old_unique + && tree_search(tree_nonrecipients, addr->unique) != 0 + ) + { + DEBUG(D_deliver|D_route) debug_printf("%s was previously delivered: " + "discarded\n", addr->address); + if (addr_remote == addr) addr_remote = addr->next; + else if (addr_local == addr) addr_local = addr->next; + } + + /* If the router has same_domain_copy_routing set, we are permitted to copy + the routing for any other addresses with the same domain. This is an + optimisation to save repeated DNS lookups for "standard" remote domain + routing. The option is settable only on routers that generate host lists. + We play it very safe, and do the optimization only if the address is routed + to a remote transport, there are no header changes, and the domain was not + modified by the router. */ + + if ( addr_remote == addr + && addr->router->same_domain_copy_routing + && !addr->prop.extra_headers + && !addr->prop.remove_headers + && old_domain == addr->domain + ) + { + address_item **chain = &addr_route; + while (*chain) + { + address_item *addr2 = *chain; + if (Ustrcmp(addr2->domain, addr->domain) != 0) + { + chain = &(addr2->next); + continue; + } + + /* Found a suitable address; take it off the routing list and add it to + the remote delivery list. */ + + *chain = addr2->next; + addr2->next = addr_remote; + addr_remote = addr2; + + /* Copy the routing data */ + + addr2->domain = addr->domain; + addr2->router = addr->router; + addr2->transport = addr->transport; + addr2->host_list = addr->host_list; + addr2->fallback_hosts = addr->fallback_hosts; + addr2->prop.errors_address = addr->prop.errors_address; + copyflag(addr2, addr, af_hide_child); + copyflag(addr2, addr, af_local_host_removed); + + DEBUG(D_deliver|D_route) + debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n" + "routing %s\n" + "Routing for %s copied from %s\n", + addr2->address, addr2->address, addr->address); + } + } + } /* Continue with routing the next address. */ + } /* Loop to process any child addresses that the routers created, and + any rerouted addresses that got put back on the new chain. */ + + +/* Debugging: show the results of the routing */ + +DEBUG(D_deliver|D_retry|D_route) + { + debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"); + debug_printf("After routing:\n Local deliveries:\n"); + for (address_item * p = addr_local; p; p = p->next) + debug_printf(" %s\n", p->address); + + debug_printf(" Remote deliveries:\n"); + for (address_item * p = addr_remote; p; p = p->next) + debug_printf(" %s\n", p->address); + + debug_printf(" Failed addresses:\n"); + for (address_item * p = addr_failed; p; p = p->next) + debug_printf(" %s\n", p->address); + + debug_printf(" Deferred addresses:\n"); + for (address_item * p = addr_defer; p; p = p->next) + debug_printf(" %s\n", p->address); + } + +/* Free any resources that were cached during routing. */ + +search_tidyup(); +route_tidyup(); + +/* These two variables are set only during routing, after check_local_user. +Ensure they are not set in transports. */ + +local_user_gid = (gid_t)(-1); +local_user_uid = (uid_t)(-1); + +/* Check for any duplicate addresses. This check is delayed until after +routing, because the flexibility of the routing configuration means that +identical addresses with different parentage may end up being redirected to +different addresses. Checking for duplicates too early (as we previously used +to) makes this kind of thing not work. */ + +do_duplicate_check(&addr_local); +do_duplicate_check(&addr_remote); + +/* When acting as an MUA wrapper, we proceed only if all addresses route to a +remote transport. The check that they all end up in one transaction happens in +the do_remote_deliveries() function. */ + +if ( mua_wrapper + && (addr_local || addr_failed || addr_defer) + ) + { + address_item *addr; + uschar *which, *colon, *msg; + + if (addr_local) + { + addr = addr_local; + which = US"local"; + } + else if (addr_defer) + { + addr = addr_defer; + which = US"deferred"; + } + else + { + addr = addr_failed; + which = US"failed"; + } + + while (addr->parent) addr = addr->parent; + + if (addr->message) + { + colon = US": "; + msg = addr->message; + } + else colon = msg = US""; + + /* We don't need to log here for a forced failure as it will already + have been logged. Defer will also have been logged, but as a defer, so we do + need to do the failure logging. */ + + if (addr != addr_failed) + log_write(0, LOG_MAIN, "** %s routing yielded a %s delivery", + addr->address, which); + + /* Always write an error to the caller */ + + fprintf(stderr, "routing %s yielded a %s delivery%s%s\n", addr->address, + which, colon, msg); + + final_yield = DELIVER_MUA_FAILED; + addr_failed = addr_defer = NULL; /* So that we remove the message */ + goto DELIVERY_TIDYUP; + } + + +/* If this is a run to continue deliveries to an external channel that is +already set up, defer any local deliveries. + +jgh 2020/12/20: I don't see why; locals should be quick. +The defer goes back to version 1.62 in 1997. A local being still deliverable +during a continued run might result from something like a defer during the +original delivery, eg. in a DB lookup. Unlikely but possible. + +To avoid delaying a local when combined with a callout-hold for a remote +delivery, test continue_sequence rather than continue_transport. */ + +if (continue_sequence > 1 && addr_local) + { + DEBUG(D_deliver|D_retry|D_route) + debug_printf("deferring local deliveries due to continued-transport\n"); + if (addr_defer) + { + address_item *addr = addr_defer; + while (addr->next) addr = addr->next; + addr->next = addr_local; + } + else + addr_defer = addr_local; + addr_local = NULL; + } + + +/* Because address rewriting can happen in the routers, we should not really do +ANY deliveries until all addresses have been routed, so that all recipients of +the message get the same headers. However, this is in practice not always +possible, since sometimes remote addresses give DNS timeouts for days on end. +The pragmatic approach is to deliver what we can now, saving any rewritten +headers so that at least the next lot of recipients benefit from the rewriting +that has already been done. + +If any headers have been rewritten during routing, update the spool file to +remember them for all subsequent deliveries. This can be delayed till later if +there is only address to be delivered - if it succeeds the spool write need not +happen. */ + +if ( f.header_rewritten + && ( addr_local && (addr_local->next || addr_remote) + || addr_remote && addr_remote->next + ) ) + { + /* Panic-dies on error */ + (void)spool_write_header(message_id, SW_DELIVERING, NULL); + f.header_rewritten = FALSE; + } + + +/* If there are any deliveries to do and we do not already have the journal +file, create it. This is used to record successful deliveries as soon as +possible after each delivery is known to be complete. A file opened with +O_APPEND is used so that several processes can run simultaneously. + +The journal is just insurance against crashes. When the spool file is +ultimately updated at the end of processing, the journal is deleted. If a +journal is found to exist at the start of delivery, the addresses listed +therein are added to the non-recipients. */ + +if (addr_local || addr_remote) + { + if (journal_fd < 0) + { + uschar * fname = spool_fname(US"input", message_subdir, id, US"-J"); + + if ((journal_fd = Uopen(fname, +#ifdef O_CLOEXEC + O_CLOEXEC | +#endif + O_WRONLY|O_APPEND|O_CREAT|O_EXCL, SPOOL_MODE)) < 0) + { + log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't open journal file %s: %s", + fname, strerror(errno)); + return DELIVER_NOT_ATTEMPTED; + } + + /* Set the close-on-exec flag, make the file owned by Exim, and ensure + that the mode is correct - the group setting doesn't always seem to get + set automatically. */ + + if( exim_fchown(journal_fd, exim_uid, exim_gid, fname) + || fchmod(journal_fd, SPOOL_MODE) +#ifndef O_CLOEXEC + || fcntl(journal_fd, F_SETFD, fcntl(journal_fd, F_GETFD) | FD_CLOEXEC) +#endif + ) + { + int ret = Uunlink(fname); + log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't set perms on journal file %s: %s", + fname, strerror(errno)); + if(ret && errno != ENOENT) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", + fname, strerror(errno)); + return DELIVER_NOT_ATTEMPTED; + } + } + } +else if (journal_fd >= 0) + { + close(journal_fd); + journal_fd = -1; + } + + + +/* Now we can get down to the business of actually doing deliveries. Local +deliveries are done first, then remote ones. If ever the problems of how to +handle fallback transports are figured out, this section can be put into a loop +for handling fallbacks, though the uid switching will have to be revised. */ + +/* Precompile a regex that is used to recognize a parameter in response +to an LHLO command, if is isn't already compiled. This may be used on both +local and remote LMTP deliveries. */ + +if (!regex_IGNOREQUOTA) + regex_IGNOREQUOTA = + regex_must_compile(US"\\n250[\\s\\-]IGNOREQUOTA(\\s|\\n|$)", FALSE, TRUE); + +/* Handle local deliveries */ + +if (addr_local) + { + DEBUG(D_deliver|D_transport) + debug_printf(">>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>\n"); + do_local_deliveries(); + f.disable_logging = FALSE; + } + +/* If queue_run_local is set, we do not want to attempt any remote deliveries, +so just queue them all. */ + +if (f.queue_run_local) + while (addr_remote) + { + address_item *addr = addr_remote; + addr_remote = addr->next; + addr->next = NULL; + addr->basic_errno = ERRNO_LOCAL_ONLY; + addr->message = US"remote deliveries suppressed"; + (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_TRANSPORT, 0); + } + +/* Handle remote deliveries */ + +if (addr_remote) + { + DEBUG(D_deliver|D_transport) + debug_printf(">>>>>>>>>>>>>>>> Remote deliveries >>>>>>>>>>>>>>>>\n"); + + /* Precompile some regex that are used to recognize parameters in response + to an EHLO command, if they aren't already compiled. */ + + smtp_deliver_init(); + + /* Now sort the addresses if required, and do the deliveries. The yield of + do_remote_deliveries is FALSE when mua_wrapper is set and all addresses + cannot be delivered in one transaction. */ + + if (remote_sort_domains) sort_remote_deliveries(); + if (!do_remote_deliveries(FALSE)) + { + log_write(0, LOG_MAIN, "** mua_wrapper is set but recipients cannot all " + "be delivered in one transaction"); + fprintf(stderr, "delivery to smarthost failed (configuration problem)\n"); + + final_yield = DELIVER_MUA_FAILED; + addr_failed = addr_defer = NULL; /* So that we remove the message */ + goto DELIVERY_TIDYUP; + } + + /* See if any of the addresses that failed got put on the queue for delivery + to their fallback hosts. We do it this way because often the same fallback + host is used for many domains, so all can be sent in a single transaction + (if appropriately configured). */ + + if (addr_fallback && !mua_wrapper) + { + DEBUG(D_deliver) debug_printf("Delivering to fallback hosts\n"); + addr_remote = addr_fallback; + addr_fallback = NULL; + if (remote_sort_domains) sort_remote_deliveries(); + do_remote_deliveries(TRUE); + } + f.disable_logging = FALSE; + } + + +/* All deliveries are now complete. Ignore SIGTERM during this tidying up +phase, to minimize cases of half-done things. */ + +DEBUG(D_deliver) + debug_printf(">>>>>>>>>>>>>>>> deliveries are done >>>>>>>>>>>>>>>>\n"); +cancel_cutthrough_connection(TRUE, US"deliveries are done"); + +/* Root privilege is no longer needed */ + +exim_setugid(exim_uid, exim_gid, FALSE, US"post-delivery tidying"); + +set_process_info("tidying up after delivering %s", message_id); +signal(SIGTERM, SIG_IGN); + +/* When we are acting as an MUA wrapper, the smtp transport will either have +succeeded for all addresses, or failed them all in normal cases. However, there +are some setup situations (e.g. when a named port does not exist) that cause an +immediate exit with deferral of all addresses. Convert those into failures. We +do not ever want to retry, nor do we want to send a bounce message. */ + +if (mua_wrapper) + { + if (addr_defer) + { + address_item * nextaddr; + for (address_item * addr = addr_defer; addr; addr = nextaddr) + { + log_write(0, LOG_MAIN, "** %s mua_wrapper forced failure for deferred " + "delivery", addr->address); + nextaddr = addr->next; + addr->next = addr_failed; + addr_failed = addr; + } + addr_defer = NULL; + } + + /* Now all should either have succeeded or failed. */ + + if (!addr_failed) + final_yield = DELIVER_MUA_SUCCEEDED; + else + { + host_item * host; + uschar *s = addr_failed->user_message; + + if (!s) s = addr_failed->message; + + fprintf(stderr, "Delivery failed: "); + if (addr_failed->basic_errno > 0) + { + fprintf(stderr, "%s", strerror(addr_failed->basic_errno)); + if (s) fprintf(stderr, ": "); + } + if ((host = addr_failed->host_used)) + fprintf(stderr, "H=%s [%s]: ", host->name, host->address); + if (s) + fprintf(stderr, "%s", CS s); + else if (addr_failed->basic_errno <= 0) + fprintf(stderr, "unknown error"); + fprintf(stderr, "\n"); + + final_yield = DELIVER_MUA_FAILED; + addr_failed = NULL; + } + } + +/* In a normal configuration, we now update the retry database. This is done in +one fell swoop at the end in order not to keep opening and closing (and +locking) the database. The code for handling retries is hived off into a +separate module for convenience. We pass it the addresses of the various +chains, because deferred addresses can get moved onto the failed chain if the +retry cutoff time has expired for all alternative destinations. Bypass the +updating of the database if the -N flag is set, which is a debugging thing that +prevents actual delivery. */ + +else if (!f.dont_deliver) + retry_update(&addr_defer, &addr_failed, &addr_succeed); + +/* Send DSN for successful messages if requested */ +addr_senddsn = NULL; + +for (address_item * a = addr_succeed; a; a = a->next) + { + /* af_ignore_error not honored here. it's not an error */ + DEBUG(D_deliver) debug_printf("DSN: processing router : %s\n" + "DSN: processing successful delivery address: %s\n" + "DSN: Sender_address: %s\n" + "DSN: orcpt: %s flags: 0x%x\n" + "DSN: envid: %s ret: %d\n" + "DSN: Final recipient: %s\n" + "DSN: Remote SMTP server supports DSN: %d\n", + a->router ? a->router->name : US"(unknown)", + a->address, + sender_address, + a->dsn_orcpt ? a->dsn_orcpt : US"NULL", + a->dsn_flags, + dsn_envid ? dsn_envid : US"NULL", dsn_ret, + a->address, + a->dsn_aware + ); + + /* send report if next hop not DSN aware or a router flagged "last DSN hop" + and a report was requested */ + + if ( (a->dsn_aware != dsn_support_yes || a->dsn_flags & rf_dsnlasthop) + && a->dsn_flags & rf_notify_success + ) + { + /* copy and relink address_item and send report with all of them at once later */ + address_item * addr_next = addr_senddsn; + addr_senddsn = store_get(sizeof(address_item), FALSE); + *addr_senddsn = *a; + addr_senddsn->next = addr_next; + } + else + DEBUG(D_deliver) debug_printf("DSN: not sending DSN success message\n"); + } + +if (addr_senddsn) + { + pid_t pid; + int fd; + + /* create exim process to send message */ + pid = child_open_exim(&fd, US"DSN"); + + DEBUG(D_deliver) debug_printf("DSN: child_open_exim returns: %d\n", pid); + + if (pid < 0) /* Creation of child failed */ + { + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Process %d (parent %d) failed to " + "create child process to send success-dsn message: %s", getpid(), + getppid(), strerror(errno)); + + DEBUG(D_deliver) debug_printf("DSN: child_open_exim failed\n"); + } + else /* Creation of child succeeded */ + { + FILE * f = fdopen(fd, "wb"); + /* header only as required by RFC. only failure DSN needs to honor RET=FULL */ + uschar * bound; + transport_ctx tctx = {{0}}; + + DEBUG(D_deliver) + debug_printf("sending success-dsn to: %s\n", sender_address); + + /* build unique id for MIME boundary */ + bound = string_sprintf(TIME_T_FMT "-eximdsn-%d", time(NULL), rand()); + DEBUG(D_deliver) debug_printf("DSN: MIME boundary: %s\n", bound); + + if (errors_reply_to) + fprintf(f, "Reply-To: %s\n", errors_reply_to); + + moan_write_from(f); + fprintf(f, "Auto-Submitted: auto-generated\n" + "To: %s\n" + "Subject: Delivery Status Notification\n", + sender_address); + moan_write_references(f, NULL); + fprintf(f, "Content-Type: multipart/report;" + " report-type=delivery-status; boundary=%s\n" + "MIME-Version: 1.0\n\n" + + "--%s\n" + "Content-type: text/plain; charset=us-ascii\n\n" + + "This message was created automatically by mail delivery software.\n" + " ----- The following addresses had successful delivery notifications -----\n", + bound, bound); + + for (address_item * a = addr_senddsn; a; a = a->next) + fprintf(f, "<%s> (relayed %s)\n\n", + a->address, + a->dsn_flags & rf_dsnlasthop ? "via non DSN router" + : a->dsn_aware == dsn_support_no ? "to non-DSN-aware mailer" + : "via non \"Remote SMTP\" router" + ); + + fprintf(f, "--%s\n" + "Content-type: message/delivery-status\n\n" + "Reporting-MTA: dns; %s\n", + bound, smtp_active_hostname); + + if (dsn_envid) + { /* must be decoded from xtext: see RFC 3461:6.3a */ + uschar *xdec_envid; + if (auth_xtextdecode(dsn_envid, &xdec_envid) > 0) + fprintf(f, "Original-Envelope-ID: %s\n", dsn_envid); + else + fprintf(f, "X-Original-Envelope-ID: error decoding xtext formatted ENVID\n"); + } + fputc('\n', f); + + for (address_item * a = addr_senddsn; a; a = a->next) + { + host_item * hu; + + print_dsn_addr_action(f, a, US"delivered", US"2.0.0"); + + if ((hu = a->host_used) && hu->name) + fprintf(f, "Remote-MTA: dns; %s\nDiagnostic-Code: smtp; 250 Ok\n\n", + hu->name); + else + fprintf(f, "Diagnostic-Code: X-Exim; relayed via non %s router\n\n", + a->dsn_flags & rf_dsnlasthop ? "DSN" : "SMTP"); + } + + fprintf(f, "--%s\nContent-type: text/rfc822-headers\n\n", bound); + + fflush(f); + transport_filter_argv = NULL; /* Just in case */ + return_path = sender_address; /* In case not previously set */ + + /* Write the original email out */ + + tctx.u.fd = fd; + tctx.options = topt_add_return_path | topt_no_body; + /*XXX hmm, FALSE(fail) retval ignored. + Could error for any number of reasons, and they are not handled. */ + transport_write_message(&tctx, 0); + fflush(f); + + fprintf(f,"\n--%s--\n", bound); + + fflush(f); + fclose(f); + rc = child_close(pid, 0); /* Waits for child to close, no timeout */ + } + } + +/* If any addresses failed, we must send a message to somebody, unless +af_ignore_error is set, in which case no action is taken. It is possible for +several messages to get sent if there are addresses with different +requirements. */ + +while (addr_failed) + { + pid_t pid; + int fd; + uschar *logtod = tod_stamp(tod_log); + address_item *addr; + address_item *handled_addr = NULL; + address_item **paddr; + address_item *msgchain = NULL; + address_item **pmsgchain = &msgchain; + + /* There are weird cases when logging is disabled in the transport. However, + there may not be a transport (address failed by a router). */ + + f.disable_logging = FALSE; + if (addr_failed->transport) + f.disable_logging = addr_failed->transport->disable_logging; + + DEBUG(D_deliver) + debug_printf("processing failed address %s\n", addr_failed->address); + + /* There are only two ways an address in a bounce message can get here: + + (1) When delivery was initially deferred, but has now timed out (in the call + to retry_update() above). We can detect this by testing for + af_retry_timedout. If the address does not have its own errors address, + we arrange to ignore the error. + + (2) If delivery failures for bounce messages are being ignored. We can detect + this by testing for af_ignore_error. This will also be set if a bounce + message has been autothawed and the ignore_bounce_errors_after time has + passed. It might also be set if a router was explicitly configured to + ignore errors (errors_to = ""). + + If neither of these cases obtains, something has gone wrong. Log the + incident, but then ignore the error. */ + + if (sender_address[0] == 0 && !addr_failed->prop.errors_address) + { + if ( !testflag(addr_failed, af_retry_timedout) + && !addr_failed->prop.ignore_error) + log_write(0, LOG_MAIN|LOG_PANIC, "internal error: bounce message " + "failure is neither frozen nor ignored (it's been ignored)"); + + addr_failed->prop.ignore_error = TRUE; + } + + /* If the first address on the list has af_ignore_error set, just remove + it from the list, throw away any saved message file, log it, and + mark the recipient done. */ + + if ( addr_failed->prop.ignore_error + || addr_failed->dsn_flags & rf_dsnflags + && !(addr_failed->dsn_flags & rf_notify_failure) + ) + { + addr = addr_failed; + addr_failed = addr->next; + if (addr->return_filename) Uunlink(addr->return_filename); + +#ifndef DISABLE_EVENT + msg_event_raise(US"msg:fail:delivery", addr); +#endif + log_write(0, LOG_MAIN, "%s%s%s%s: error ignored%s", + addr->address, + !addr->parent ? US"" : US" <", + !addr->parent ? US"" : addr->parent->address, + !addr->parent ? US"" : US">", + addr->prop.ignore_error + ? US"" : US": RFC 3461 DSN, failure notify not requested"); + + address_done(addr, logtod); + child_done(addr, logtod); + /* Panic-dies on error */ + (void)spool_write_header(message_id, SW_DELIVERING, NULL); + } + + /* Otherwise, handle the sending of a message. Find the error address for + the first address, then send a message that includes all failed addresses + that have the same error address. Note the bounce_recipient is a global so + that it can be accessed by $bounce_recipient while creating a customized + error message. */ + + else + { + if (!(bounce_recipient = addr_failed->prop.errors_address)) + bounce_recipient = sender_address; + + /* Make a subprocess to send a message */ + + if ((pid = child_open_exim(&fd, US"bounce-message")) < 0) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Process %d (parent %d) failed to " + "create child process to send failure message: %s", getpid(), + getppid(), strerror(errno)); + + /* Creation of child succeeded */ + + else + { + int ch, rc; + int filecount = 0; + int rcount = 0; + uschar *bcc, *emf_text; + FILE * fp = fdopen(fd, "wb"); + FILE * emf = NULL; + BOOL to_sender = strcmpic(sender_address, bounce_recipient) == 0; + int max = (bounce_return_size_limit/DELIVER_IN_BUFFER_SIZE + 1) * + DELIVER_IN_BUFFER_SIZE; + uschar * bound; + uschar *dsnlimitmsg; + uschar *dsnnotifyhdr; + int topt; + + DEBUG(D_deliver) + debug_printf("sending error message to: %s\n", bounce_recipient); + + /* Scan the addresses for all that have the same errors address, removing + them from the addr_failed chain, and putting them on msgchain. */ + + paddr = &addr_failed; + for (addr = addr_failed; addr; addr = *paddr) + if (Ustrcmp(bounce_recipient, addr->prop.errors_address + ? addr->prop.errors_address : sender_address) == 0) + { /* The same - dechain */ + *paddr = addr->next; + *pmsgchain = addr; + addr->next = NULL; + pmsgchain = &(addr->next); + } + else + paddr = &addr->next; /* Not the same; skip */ + + /* Include X-Failed-Recipients: for automatic interpretation, but do + not let any one header line get too long. We do this by starting a + new header every 50 recipients. Omit any addresses for which the + "hide_child" flag is set. */ + + for (addr = msgchain; addr; addr = addr->next) + { + if (testflag(addr, af_hide_child)) continue; + if (rcount >= 50) + { + fprintf(fp, "\n"); + rcount = 0; + } + fprintf(fp, "%s%s", + rcount++ == 0 + ? "X-Failed-Recipients: " + : ",\n ", + testflag(addr, af_pfr) && addr->parent + ? string_printing(addr->parent->address) + : string_printing(addr->address)); + } + if (rcount > 0) fprintf(fp, "\n"); + + /* Output the standard headers */ + + if (errors_reply_to) + fprintf(fp, "Reply-To: %s\n", errors_reply_to); + fprintf(fp, "Auto-Submitted: auto-replied\n"); + moan_write_from(fp); + fprintf(fp, "To: %s\n", bounce_recipient); + moan_write_references(fp, NULL); + + /* generate boundary string and output MIME-Headers */ + bound = string_sprintf(TIME_T_FMT "-eximdsn-%d", time(NULL), rand()); + + fprintf(fp, "Content-Type: multipart/report;" + " report-type=delivery-status; boundary=%s\n" + "MIME-Version: 1.0\n", + bound); + + /* Open a template file if one is provided. Log failure to open, but + carry on - default texts will be used. */ + + if (bounce_message_file) + emf = expand_open(bounce_message_file, + US"bounce_message_file", US"error"); + + /* Quietly copy to configured additional addresses if required. */ + + if ((bcc = moan_check_errorcopy(bounce_recipient))) + fprintf(fp, "Bcc: %s\n", bcc); + + /* The texts for the message can be read from a template file; if there + isn't one, or if it is too short, built-in texts are used. The first + emf text is a Subject: and any other headers. */ + + if ((emf_text = next_emf(emf, US"header"))) + fprintf(fp, "%s\n", emf_text); + else + fprintf(fp, "Subject: Mail delivery failed%s\n\n", + to_sender? ": returning message to sender" : ""); + + /* output human readable part as text/plain section */ + fprintf(fp, "--%s\n" + "Content-type: text/plain; charset=us-ascii\n\n", + bound); + + if ((emf_text = next_emf(emf, US"intro"))) + fprintf(fp, "%s", CS emf_text); + else + { + fprintf(fp, +/* This message has been reworded several times. It seems to be confusing to +somebody, however it is worded. I have retreated to the original, simple +wording. */ +"This message was created automatically by mail delivery software.\n"); + + if (bounce_message_text) + fprintf(fp, "%s", CS bounce_message_text); + if (to_sender) + fprintf(fp, +"\nA message that you sent could not be delivered to one or more of its\n" +"recipients. This is a permanent error. The following address(es) failed:\n"); + else + fprintf(fp, +"\nA message sent by\n\n <%s>\n\n" +"could not be delivered to one or more of its recipients. The following\n" +"address(es) failed:\n", sender_address); + } + fputc('\n', fp); + + /* Process the addresses, leaving them on the msgchain if they have a + file name for a return message. (There has already been a check in + post_process_one() for the existence of data in the message file.) A TRUE + return from print_address_information() means that the address is not + hidden. */ + + paddr = &msgchain; + for (addr = msgchain; addr; addr = *paddr) + { + if (print_address_information(addr, fp, US" ", US"\n ", US"")) + print_address_error(addr, fp, US""); + + /* End the final line for the address */ + + fputc('\n', fp); + + /* Leave on msgchain if there's a return file. */ + + if (addr->return_file >= 0) + { + paddr = &(addr->next); + filecount++; + } + + /* Else save so that we can tick off the recipient when the + message is sent. */ + + else + { + *paddr = addr->next; + addr->next = handled_addr; + handled_addr = addr; + } + } + + fputc('\n', fp); + + /* Get the next text, whether we need it or not, so as to be + positioned for the one after. */ + + emf_text = next_emf(emf, US"generated text"); + + /* If there were any file messages passed by the local transports, + include them in the message. Then put the address on the handled chain. + In the case of a batch of addresses that were all sent to the same + transport, the return_file field in all of them will contain the same + fd, and the return_filename field in the *last* one will be set (to the + name of the file). */ + + if (msgchain) + { + address_item *nextaddr; + + if (emf_text) + fprintf(fp, "%s", CS emf_text); + else + fprintf(fp, + "The following text was generated during the delivery " + "attempt%s:\n", (filecount > 1)? "s" : ""); + + for (addr = msgchain; addr; addr = nextaddr) + { + FILE *fm; + address_item *topaddr = addr; + + /* List all the addresses that relate to this file */ + + fputc('\n', fp); + while(addr) /* Insurance */ + { + print_address_information(addr, fp, US"------ ", US"\n ", + US" ------\n"); + if (addr->return_filename) break; + addr = addr->next; + } + fputc('\n', fp); + + /* Now copy the file */ + + if (!(fm = Ufopen(addr->return_filename, "rb"))) + fprintf(fp, " +++ Exim error... failed to open text file: %s\n", + strerror(errno)); + else + { + while ((ch = fgetc(fm)) != EOF) fputc(ch, fp); + (void)fclose(fm); + } + Uunlink(addr->return_filename); + + /* Can now add to handled chain, first fishing off the next + address on the msgchain. */ + + nextaddr = addr->next; + addr->next = handled_addr; + handled_addr = topaddr; + } + fputc('\n', fp); + } + + /* output machine readable part */ +#ifdef SUPPORT_I18N + if (message_smtputf8) + fprintf(fp, "--%s\n" + "Content-type: message/global-delivery-status\n\n" + "Reporting-MTA: dns; %s\n", + bound, smtp_active_hostname); + else +#endif + fprintf(fp, "--%s\n" + "Content-type: message/delivery-status\n\n" + "Reporting-MTA: dns; %s\n", + bound, smtp_active_hostname); + + if (dsn_envid) + { + /* must be decoded from xtext: see RFC 3461:6.3a */ + uschar *xdec_envid; + if (auth_xtextdecode(dsn_envid, &xdec_envid) > 0) + fprintf(fp, "Original-Envelope-ID: %s\n", dsn_envid); + else + fprintf(fp, "X-Original-Envelope-ID: error decoding xtext formatted ENVID\n"); + } + fputc('\n', fp); + + for (addr = handled_addr; addr; addr = addr->next) + { + host_item * hu; + + print_dsn_addr_action(fp, addr, US"failed", US"5.0.0"); + + if ((hu = addr->host_used) && hu->name) + { + fprintf(fp, "Remote-MTA: dns; %s\n", hu->name); +#ifdef EXPERIMENTAL_DSN_INFO + { + const uschar * s; + if (hu->address) + { + uschar * p = hu->port == 25 + ? US"" : string_sprintf(":%d", hu->port); + fprintf(fp, "Remote-MTA: X-ip; [%s]%s\n", hu->address, p); + } + if ((s = addr->smtp_greeting) && *s) + fprintf(fp, "X-Remote-MTA-smtp-greeting: X-str; %.900s\n", s); + if ((s = addr->helo_response) && *s) + fprintf(fp, "X-Remote-MTA-helo-response: X-str; %.900s\n", s); + if ((s = addr->message) && *s) + fprintf(fp, "X-Exim-Diagnostic: X-str; %.900s\n", s); + } +#endif + print_dsn_diagnostic_code(addr, fp); + } + fputc('\n', fp); + } + + /* Now copy the message, trying to give an intelligible comment if + it is too long for it all to be copied. The limit isn't strictly + applied because of the buffering. There is, however, an option + to suppress copying altogether. */ + + emf_text = next_emf(emf, US"copy"); + + /* add message body + we ignore the intro text from template and add + the text for bounce_return_size_limit at the end. + + bounce_return_message is ignored + in case RET= is defined we honor these values + otherwise bounce_return_body is honored. + + bounce_return_size_limit is always honored. + */ + + fprintf(fp, "--%s\n", bound); + + dsnlimitmsg = US"X-Exim-DSN-Information: Due to administrative limits only headers are returned"; + dsnnotifyhdr = NULL; + topt = topt_add_return_path; + + /* RET=HDRS? top priority */ + if (dsn_ret == dsn_ret_hdrs) + topt |= topt_no_body; + else + { + struct stat statbuf; + + /* no full body return at all? */ + if (!bounce_return_body) + { + topt |= topt_no_body; + /* add header if we overrule RET=FULL */ + if (dsn_ret == dsn_ret_full) + dsnnotifyhdr = dsnlimitmsg; + } + /* line length limited... return headers only if oversize */ + /* size limited ... return headers only if limit reached */ + else if ( max_received_linelength > bounce_return_linesize_limit + || ( bounce_return_size_limit > 0 + && fstat(deliver_datafile, &statbuf) == 0 + && statbuf.st_size > max + ) ) + { + topt |= topt_no_body; + dsnnotifyhdr = dsnlimitmsg; + } + } + +#ifdef SUPPORT_I18N + if (message_smtputf8) + fputs(topt & topt_no_body ? "Content-type: message/global-headers\n\n" + : "Content-type: message/global\n\n", + fp); + else +#endif + fputs(topt & topt_no_body ? "Content-type: text/rfc822-headers\n\n" + : "Content-type: message/rfc822\n\n", + fp); + + fflush(fp); + transport_filter_argv = NULL; /* Just in case */ + return_path = sender_address; /* In case not previously set */ + { /* Dummy transport for headers add */ + transport_ctx tctx = {{0}}; + transport_instance tb = {0}; + + tctx.u.fd = fileno(fp); + tctx.tblock = &tb; + tctx.options = topt; + tb.add_headers = dsnnotifyhdr; + + /*XXX no checking for failure! buggy! */ + transport_write_message(&tctx, 0); + } + fflush(fp); + + /* we never add the final text. close the file */ + if (emf) + (void)fclose(emf); + + fprintf(fp, "\n--%s--\n", bound); + + /* Close the file, which should send an EOF to the child process + that is receiving the message. Wait for it to finish. */ + + (void)fclose(fp); + rc = child_close(pid, 0); /* Waits for child to close, no timeout */ + + /* If the process failed, there was some disaster in setting up the + error message. Unless the message is very old, ensure that addr_defer + is non-null, which will have the effect of leaving the message on the + spool. The failed addresses will get tried again next time. However, we + don't really want this to happen too often, so freeze the message unless + there are some genuine deferred addresses to try. To do this we have + to call spool_write_header() here, because with no genuine deferred + addresses the normal code below doesn't get run. */ + + if (rc != 0) + { + uschar *s = US""; + if (now - received_time.tv_sec < retry_maximum_timeout && !addr_defer) + { + addr_defer = (address_item *)(+1); + f.deliver_freeze = TRUE; + deliver_frozen_at = time(NULL); + /* Panic-dies on error */ + (void)spool_write_header(message_id, SW_DELIVERING, NULL); + s = US" (frozen)"; + } + deliver_msglog("Process failed (%d) when writing error message " + "to %s%s", rc, bounce_recipient, s); + log_write(0, LOG_MAIN, "Process failed (%d) when writing error message " + "to %s%s", rc, bounce_recipient, s); + } + + /* The message succeeded. Ensure that the recipients that failed are + now marked finished with on the spool and their parents updated. */ + + else + { + for (addr = handled_addr; addr; addr = addr->next) + { + address_done(addr, logtod); + child_done(addr, logtod); + } + /* Panic-dies on error */ + (void)spool_write_header(message_id, SW_DELIVERING, NULL); + } + } + } + } + +f.disable_logging = FALSE; /* In case left set */ + +/* Come here from the mua_wrapper case if routing goes wrong */ + +DELIVERY_TIDYUP: + +/* If there are now no deferred addresses, we are done. Preserve the +message log if so configured, and we are using them. Otherwise, sling it. +Then delete the message itself. */ + +if (!addr_defer) + { + uschar * fname; + + if (message_logs) + { + fname = spool_fname(US"msglog", message_subdir, id, US""); + if (preserve_message_logs) + { + int rc; + uschar * moname = spool_fname(US"msglog.OLD", US"", id, US""); + + if ((rc = Urename(fname, moname)) < 0) + { + (void)directory_make(spool_directory, + spool_sname(US"msglog.OLD", US""), + MSGLOG_DIRECTORY_MODE, TRUE); + rc = Urename(fname, moname); + } + if (rc < 0) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to move %s to the " + "msglog.OLD directory", fname); + } + else + if (Uunlink(fname) < 0) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", + fname, strerror(errno)); + } + + /* Remove the two message files. */ + + fname = spool_fname(US"input", message_subdir, id, US"-D"); + if (Uunlink(fname) < 0) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", + fname, strerror(errno)); + fname = spool_fname(US"input", message_subdir, id, US"-H"); + if (Uunlink(fname) < 0) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", + fname, strerror(errno)); + + /* Log the end of this message, with queue time if requested. */ + + if (LOGGING(queue_time_overall)) + log_write(0, LOG_MAIN, "Completed QT=%s", string_timesince(&received_time)); + else + log_write(0, LOG_MAIN, "Completed"); + + /* Unset deliver_freeze so that we won't try to move the spool files further down */ + f.deliver_freeze = FALSE; + +#ifndef DISABLE_EVENT + (void) event_raise(event_action, US"msg:complete", NULL); +#endif + } + +/* If there are deferred addresses, we are keeping this message because it is +not yet completed. Lose any temporary files that were catching output from +pipes for any of the deferred addresses, handle one-time aliases, and see if +the message has been on the queue for so long that it is time to send a warning +message to the sender, unless it is a mailer-daemon. If all deferred addresses +have the same domain, we can set deliver_domain for the expansion of +delay_warning_ condition - if any of them are pipes, files, or autoreplies, use +the parent's domain. + +If all the deferred addresses have an error number that indicates "retry time +not reached", skip sending the warning message, because it won't contain the +reason for the delay. It will get sent at the next real delivery attempt. + Exception: for retries caused by a remote peer we use the error message + store in the retry DB as the reason. +However, if at least one address has tried, we'd better include all of them in +the message. + +If we can't make a process to send the message, don't worry. + +For mailing list expansions we want to send the warning message to the +mailing list manager. We can't do a perfect job here, as some addresses may +have different errors addresses, but if we take the errors address from +each deferred address it will probably be right in most cases. + +If addr_defer == +1, it means there was a problem sending an error message +for failed addresses, and there were no "real" deferred addresses. The value +was set just to keep the message on the spool, so there is nothing to do here. +*/ + +else if (addr_defer != (address_item *)(+1)) + { + uschar *recipients = US""; + BOOL want_warning_msg = FALSE; + + deliver_domain = testflag(addr_defer, af_pfr) + ? addr_defer->parent->domain : addr_defer->domain; + + for (address_item * addr = addr_defer; addr; addr = addr->next) + { + address_item *otaddr; + + if (addr->basic_errno > ERRNO_WARN_BASE) want_warning_msg = TRUE; + + if (deliver_domain) + { + const uschar *d = testflag(addr, af_pfr) + ? addr->parent->domain : addr->domain; + + /* The domain may be unset for an address that has never been routed + because the system filter froze the message. */ + + if (!d || Ustrcmp(d, deliver_domain) != 0) + deliver_domain = NULL; + } + + if (addr->return_filename) Uunlink(addr->return_filename); + + /* Handle the case of one-time aliases. If any address in the ancestry + of this one is flagged, ensure it is in the recipients list, suitably + flagged, and that its parent is marked delivered. */ + + for (otaddr = addr; otaddr; otaddr = otaddr->parent) + if (otaddr->onetime_parent) break; + + if (otaddr) + { + int i; + int t = recipients_count; + + for (i = 0; i < recipients_count; i++) + { + uschar *r = recipients_list[i].address; + if (Ustrcmp(otaddr->onetime_parent, r) == 0) t = i; + if (Ustrcmp(otaddr->address, r) == 0) break; + } + + /* Didn't find the address already in the list, and did find the + ultimate parent's address in the list, and they really are different + (i.e. not from an identity-redirect). After adding the recipient, + update the errors address in the recipients list. */ + + if ( i >= recipients_count && t < recipients_count + && Ustrcmp(otaddr->address, otaddr->parent->address) != 0) + { + DEBUG(D_deliver) debug_printf("one_time: adding %s in place of %s\n", + otaddr->address, otaddr->parent->address); + receive_add_recipient(otaddr->address, t); + recipients_list[recipients_count-1].errors_to = otaddr->prop.errors_address; + tree_add_nonrecipient(otaddr->parent->address); + update_spool = TRUE; + } + } + + /* Except for error messages, ensure that either the errors address for + this deferred address or, if there is none, the sender address, is on the + list of recipients for a warning message. */ + + if (sender_address[0]) + { + uschar * s = addr->prop.errors_address; + if (!s) s = sender_address; + if (Ustrstr(recipients, s) == NULL) + recipients = string_sprintf("%s%s%s", recipients, + recipients[0] ? "," : "", s); + } + } + + /* Send a warning message if the conditions are right. If the condition check + fails because of a lookup defer, there is nothing we can do. The warning + is not sent. Another attempt will be made at the next delivery attempt (if + it also defers). */ + + if ( !f.queue_2stage + && want_warning_msg + && ( !(addr_defer->dsn_flags & rf_dsnflags) + || addr_defer->dsn_flags & rf_notify_delay + ) + && delay_warning[1] > 0 + && sender_address[0] != 0 + && ( !delay_warning_condition + || expand_check_condition(delay_warning_condition, + US"delay_warning", US"option") + ) + ) + { + int count; + int show_time; + int queue_time = time(NULL) - received_time.tv_sec; + + queue_time = test_harness_fudged_queue_time(queue_time); + + /* See how many warnings we should have sent by now */ + + for (count = 0; count < delay_warning[1]; count++) + if (queue_time < delay_warning[count+2]) break; + + show_time = delay_warning[count+1]; + + if (count >= delay_warning[1]) + { + int extra; + int last_gap = show_time; + if (count > 1) last_gap -= delay_warning[count]; + extra = (queue_time - delay_warning[count+1])/last_gap; + show_time += last_gap * extra; + count += extra; + } + + DEBUG(D_deliver) + { + debug_printf("time on queue = %s id %s addr %s\n", + readconf_printtime(queue_time), message_id, addr_defer->address); + debug_printf("warning counts: required %d done %d\n", count, + warning_count); + } + + /* We have computed the number of warnings there should have been by now. + If there haven't been enough, send one, and up the count to what it should + have been. */ + + if (warning_count < count) + { + header_line *h; + int fd; + pid_t pid = child_open_exim(&fd, US"delay-warning-message"); + + if (pid > 0) + { + uschar * wmf_text; + FILE * wmf = NULL; + FILE * f = fdopen(fd, "wb"); + uschar * bound; + transport_ctx tctx = {{0}}; + + if (warn_message_file) + wmf = expand_open(warn_message_file, + US"warn_message_file", US"warning"); + + warnmsg_recipients = recipients; + warnmsg_delay = queue_time < 120*60 + ? string_sprintf("%d minutes", show_time/60) + : string_sprintf("%d hours", show_time/3600); + + if (errors_reply_to) + fprintf(f, "Reply-To: %s\n", errors_reply_to); + fprintf(f, "Auto-Submitted: auto-replied\n"); + moan_write_from(f); + fprintf(f, "To: %s\n", recipients); + moan_write_references(f, NULL); + + /* generated boundary string and output MIME-Headers */ + bound = string_sprintf(TIME_T_FMT "-eximdsn-%d", time(NULL), rand()); + + fprintf(f, "Content-Type: multipart/report;" + " report-type=delivery-status; boundary=%s\n" + "MIME-Version: 1.0\n", + bound); + + if ((wmf_text = next_emf(wmf, US"header"))) + fprintf(f, "%s\n", wmf_text); + else + fprintf(f, "Subject: Warning: message %s delayed %s\n\n", + message_id, warnmsg_delay); + + /* output human readable part as text/plain section */ + fprintf(f, "--%s\n" + "Content-type: text/plain; charset=us-ascii\n\n", + bound); + + if ((wmf_text = next_emf(wmf, US"intro"))) + fprintf(f, "%s", CS wmf_text); + else + { + fprintf(f, +"This message was created automatically by mail delivery software.\n"); + + if (Ustrcmp(recipients, sender_address) == 0) + fprintf(f, +"A message that you sent has not yet been delivered to one or more of its\n" +"recipients after more than "); + + else + fprintf(f, +"A message sent by\n\n <%s>\n\n" +"has not yet been delivered to one or more of its recipients after more than \n", + sender_address); + + fprintf(f, "%s on the queue on %s.\n\n" + "The message identifier is: %s\n", + warnmsg_delay, primary_hostname, message_id); + + for (h = header_list; h; h = h->next) + if (strncmpic(h->text, US"Subject:", 8) == 0) + fprintf(f, "The subject of the message is: %s", h->text + 9); + else if (strncmpic(h->text, US"Date:", 5) == 0) + fprintf(f, "The date of the message is: %s", h->text + 6); + fputc('\n', f); + + fprintf(f, "The address%s to which the message has not yet been " + "delivered %s:\n", + !addr_defer->next ? "" : "es", + !addr_defer->next ? "is": "are"); + } + + /* List the addresses, with error information if allowed */ + + fputc('\n', f); + for (address_item * addr = addr_defer; addr; addr = addr->next) + { + if (print_address_information(addr, f, US" ", US"\n ", US"")) + print_address_error(addr, f, US"Delay reason: "); + fputc('\n', f); + } + fputc('\n', f); + + /* Final text */ + + if (wmf) + { + if ((wmf_text = next_emf(wmf, US"final"))) + fprintf(f, "%s", CS wmf_text); + (void)fclose(wmf); + } + else + { + fprintf(f, +"No action is required on your part. Delivery attempts will continue for\n" +"some time, and this warning may be repeated at intervals if the message\n" +"remains undelivered. Eventually the mail delivery software will give up,\n" +"and when that happens, the message will be returned to you.\n"); + } + + /* output machine readable part */ + fprintf(f, "\n--%s\n" + "Content-type: message/delivery-status\n\n" + "Reporting-MTA: dns; %s\n", + bound, + smtp_active_hostname); + + + if (dsn_envid) + { + /* must be decoded from xtext: see RFC 3461:6.3a */ + uschar *xdec_envid; + if (auth_xtextdecode(dsn_envid, &xdec_envid) > 0) + fprintf(f,"Original-Envelope-ID: %s\n", dsn_envid); + else + fprintf(f,"X-Original-Envelope-ID: error decoding xtext formatted ENVID\n"); + } + fputc('\n', f); + + for (address_item * addr = addr_defer; addr; addr = addr->next) + { + host_item * hu; + + print_dsn_addr_action(f, addr, US"delayed", US"4.0.0"); + + if ((hu = addr->host_used) && hu->name) + { + fprintf(f, "Remote-MTA: dns; %s\n", hu->name); + print_dsn_diagnostic_code(addr, f); + } + fputc('\n', f); + } + + fprintf(f, "--%s\n" + "Content-type: text/rfc822-headers\n\n", + bound); + + fflush(f); + /* header only as required by RFC. only failure DSN needs to honor RET=FULL */ + tctx.u.fd = fileno(f); + tctx.options = topt_add_return_path | topt_no_body; + transport_filter_argv = NULL; /* Just in case */ + return_path = sender_address; /* In case not previously set */ + + /* Write the original email out */ + /*XXX no checking for failure! buggy! */ + transport_write_message(&tctx, 0); + fflush(f); + + fprintf(f,"\n--%s--\n", bound); + + fflush(f); + + /* Close and wait for child process to complete, without a timeout. + If there's an error, don't update the count. */ + + (void)fclose(f); + if (child_close(pid, 0) == 0) + { + warning_count = count; + update_spool = TRUE; /* Ensure spool rewritten */ + } + } + } + } + + /* Clear deliver_domain */ + + deliver_domain = NULL; + + /* If this was a first delivery attempt, unset the first time flag, and + ensure that the spool gets updated. */ + + if (f.deliver_firsttime) + { + f.deliver_firsttime = FALSE; + update_spool = TRUE; + } + + /* If delivery was frozen and freeze_tell is set, generate an appropriate + message, unless the message is a local error message (to avoid loops). Then + log the freezing. If the text in "frozen_info" came from a system filter, + it has been escaped into printing characters so as not to mess up log lines. + For the "tell" message, we turn \n back into newline. Also, insert a newline + near the start instead of the ": " string. */ + + if (f.deliver_freeze) + { + if (freeze_tell && freeze_tell[0] != 0 && !f.local_error_message) + { + uschar *s = string_copy(frozen_info); + uschar *ss = Ustrstr(s, " by the system filter: "); + + if (ss != NULL) + { + ss[21] = '.'; + ss[22] = '\n'; + } + + ss = s; + while (*ss != 0) + { + if (*ss == '\\' && ss[1] == 'n') + { + *ss++ = ' '; + *ss++ = '\n'; + } + else ss++; + } + moan_tell_someone(freeze_tell, addr_defer, US"Message frozen", + "Message %s has been frozen%s.\nThe sender is <%s>.\n", message_id, + s, sender_address); + } + + /* Log freezing just before we update the -H file, to minimize the chance + of a race problem. */ + + deliver_msglog("*** Frozen%s\n", frozen_info); + log_write(0, LOG_MAIN, "Frozen%s", frozen_info); + } + + /* If there have been any updates to the non-recipients list, or other things + that get written to the spool, we must now update the spool header file so + that it has the right information for the next delivery attempt. If there + was more than one address being delivered, the header_change update is done + earlier, in case one succeeds and then something crashes. */ + + DEBUG(D_deliver) + debug_printf("delivery deferred: update_spool=%d header_rewritten=%d\n", + update_spool, f.header_rewritten); + + if (update_spool || f.header_rewritten) + /* Panic-dies on error */ + (void)spool_write_header(message_id, SW_DELIVERING, NULL); + } + +/* Finished with the message log. If the message is complete, it will have +been unlinked or renamed above. */ + +if (message_logs) (void)fclose(message_log); + +/* Now we can close and remove the journal file. Its only purpose is to record +successfully completed deliveries asap so that this information doesn't get +lost if Exim (or the machine) crashes. Forgetting about a failed delivery is +not serious, as trying it again is not harmful. The journal might not be open +if all addresses were deferred at routing or directing. Nevertheless, we must +remove it if it exists (may have been lying around from a crash during the +previous delivery attempt). We don't remove the journal if a delivery +subprocess failed to pass back delivery information; this is controlled by +the remove_journal flag. When the journal is left, we also don't move the +message off the main spool if frozen and the option is set. It should get moved +at the next attempt, after the journal has been inspected. */ + +if (journal_fd >= 0) (void)close(journal_fd); + +if (remove_journal) + { + uschar * fname = spool_fname(US"input", message_subdir, id, US"-J"); + + if (Uunlink(fname) < 0 && errno != ENOENT) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", fname, + strerror(errno)); + + /* Move the message off the spool if requested */ + +#ifdef SUPPORT_MOVE_FROZEN_MESSAGES + if (f.deliver_freeze && move_frozen_messages) + (void)spool_move_message(id, message_subdir, US"", US"F"); +#endif + } + +/* Closing the data file frees the lock; if the file has been unlinked it +will go away. Otherwise the message becomes available for another process +to try delivery. */ + +(void)close(deliver_datafile); +deliver_datafile = -1; +DEBUG(D_deliver) debug_printf("end delivery of %s\n", id); +#ifdef MEASURE_TIMING +report_time_since(×tamp_startup, US"delivery end"); /* testcase 0005 */ +#endif + +/* It is unlikely that there will be any cached resources, since they are +released after routing, and in the delivery subprocesses. However, it's +possible for an expansion for something afterwards (for example, +expand_check_condition) to do a lookup. We must therefore be sure everything is +released. */ + +search_tidyup(); +acl_where = ACL_WHERE_UNKNOWN; +return final_yield; +} + + + +void +tcp_init(void) +{ +#ifdef EXIM_TFO_PROBE +tfo_probe(); +#else +f.tcp_fastopen_ok = TRUE; +#endif +} + + +uschar * +deliver_get_sender_address (uschar * id) +{ +int rc; +uschar * new_sender_address, + * save_sender_address; +BOOL save_qr = f.queue_running; +uschar * spoolname; + +/* make spool_open_datafile non-noisy on fail */ + +f.queue_running = TRUE; + +/* Side effect: message_subdir is set for the (possibly split) spool directory */ + +deliver_datafile = spool_open_datafile(id); +f.queue_running = save_qr; +if (deliver_datafile < 0) + return NULL; + +/* Save and restore the global sender_address. I'm not sure if we should +not save/restore all the other global variables too, because +spool_read_header() may change all of them. But OTOH, when this +deliver_get_sender_address() gets called, the current message is done +already and nobody needs the globals anymore. (HS12, 2015-08-21) */ + +spoolname = string_sprintf("%s-H", id); +save_sender_address = sender_address; + +rc = spool_read_header(spoolname, TRUE, TRUE); + +new_sender_address = sender_address; +sender_address = save_sender_address; + +if (rc != spool_read_OK) + return NULL; + +assert(new_sender_address); + +(void)close(deliver_datafile); +deliver_datafile = -1; + +return new_sender_address; +} + + + +void +delivery_re_exec(int exec_type) +{ +uschar * where; + +if (cutthrough.cctx.sock >= 0 && cutthrough.callout_hold_only) + { + int channel_fd = cutthrough.cctx.sock; + + smtp_peer_options = cutthrough.peer_options; + continue_sequence = 0; + +#ifndef DISABLE_TLS + if (cutthrough.is_tls) + { + int pfd[2], pid; + + smtp_peer_options |= OPTION_TLS; + sending_ip_address = cutthrough.snd_ip; + sending_port = cutthrough.snd_port; + + where = US"socketpair"; + if (socketpair(AF_UNIX, SOCK_STREAM, 0, pfd) != 0) + goto fail; + + where = US"fork"; + testharness_pause_ms(150); + if ((pid = exim_fork(US"tls-proxy-interproc")) < 0) + goto fail; + + if (pid == 0) /* child: will fork again to totally disconnect */ + { + smtp_proxy_tls(cutthrough.cctx.tls_ctx, big_buffer, big_buffer_size, + pfd, 5*60); + /* does not return */ + } + + close(pfd[0]); + waitpid(pid, NULL, 0); + (void) close(channel_fd); /* release the client socket */ + channel_fd = pfd[1]; + } +#endif + + transport_do_pass_socket(cutthrough.transport, cutthrough.host.name, + cutthrough.host.address, message_id, channel_fd); + } +else + { + cancel_cutthrough_connection(TRUE, US"non-continued delivery"); + (void) child_exec_exim(exec_type, FALSE, NULL, FALSE, 2, US"-Mc", message_id); + } +return; /* compiler quietening; control does not reach here. */ + +#ifndef DISABLE_TLS +fail: + log_write(0, + LOG_MAIN | (exec_type == CEE_EXEC_EXIT ? LOG_PANIC : LOG_PANIC_DIE), + "delivery re-exec %s failed: %s", where, strerror(errno)); + + /* Get here if exec_type == CEE_EXEC_EXIT. + Note: this must be _exit(), not exit(). */ + + _exit(EX_EXECFAILED); +#endif +} + +/* vi: aw ai sw=2 +*/ +/* End of deliver.c */ |