summaryrefslogtreecommitdiffstats
path: root/src/deliver.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/deliver.c8678
1 files changed, 8678 insertions, 0 deletions
diff --git a/src/deliver.c b/src/deliver.c
new file mode 100644
index 0000000..f5f065e
--- /dev/null
+++ b/src/deliver.c
@@ -0,0 +1,8678 @@
+/*************************************************
+* Exim - an Internet mail transport agent *
+*************************************************/
+
+/* Copyright (c) University of Cambridge 1995 - 2018 */
+/* Copyright (c) The Exim Maintainers 2020 */
+/* See the file NOTICE for conditions of use and distribution. */
+
+/* The main code for delivering a message. */
+
+
+#include "exim.h"
+#include "transports/smtp.h"
+#include <sys/uio.h>
+#include <assert.h>
+
+
+/* Data block for keeping track of subprocesses for parallel remote
+delivery. */
+
+typedef struct pardata {
+ address_item *addrlist; /* chain of addresses */
+ address_item *addr; /* next address data expected for */
+ pid_t pid; /* subprocess pid */
+ int fd; /* pipe fd for getting result from subprocess */
+ int transport_count; /* returned transport count value */
+ BOOL done; /* no more data needed */
+ uschar *msg; /* error message */
+ uschar *return_path; /* return_path for these addresses */
+} pardata;
+
+/* Values for the process_recipients variable */
+
+enum { RECIP_ACCEPT, RECIP_IGNORE, RECIP_DEFER,
+ RECIP_FAIL, RECIP_FAIL_FILTER, RECIP_FAIL_TIMEOUT,
+ RECIP_FAIL_LOOP};
+
+/* Mutually recursive functions for marking addresses done. */
+
+static void child_done(address_item *, uschar *);
+static void address_done(address_item *, uschar *);
+
+/* Table for turning base-62 numbers into binary */
+
+static uschar tab62[] =
+ {0,1,2,3,4,5,6,7,8,9,0,0,0,0,0,0, /* 0-9 */
+ 0,10,11,12,13,14,15,16,17,18,19,20, /* A-K */
+ 21,22,23,24,25,26,27,28,29,30,31,32, /* L-W */
+ 33,34,35, 0, 0, 0, 0, 0, /* X-Z */
+ 0,36,37,38,39,40,41,42,43,44,45,46, /* a-k */
+ 47,48,49,50,51,52,53,54,55,56,57,58, /* l-w */
+ 59,60,61}; /* x-z */
+
+
+/*************************************************
+* Local static variables *
+*************************************************/
+
+/* addr_duplicate is global because it needs to be seen from the Envelope-To
+writing code. */
+
+static address_item *addr_defer = NULL;
+static address_item *addr_failed = NULL;
+static address_item *addr_fallback = NULL;
+static address_item *addr_local = NULL;
+static address_item *addr_new = NULL;
+static address_item *addr_remote = NULL;
+static address_item *addr_route = NULL;
+static address_item *addr_succeed = NULL;
+static address_item *addr_senddsn = NULL;
+
+static FILE *message_log = NULL;
+static BOOL update_spool;
+static BOOL remove_journal;
+static int parcount = 0;
+static pardata *parlist = NULL;
+static int return_count;
+static uschar *frozen_info = US"";
+static uschar *used_return_path = NULL;
+
+
+
+/*************************************************
+* read as much as requested *
+*************************************************/
+
+/* The syscall read(2) doesn't always returns as much as we want. For
+several reasons it might get less. (Not talking about signals, as syscalls
+are restartable). When reading from a network or pipe connection the sender
+might send in smaller chunks, with delays between these chunks. The read(2)
+may return such a chunk.
+
+The more the writer writes and the smaller the pipe between write and read is,
+the more we get the chance of reading leass than requested. (See bug 2130)
+
+This function read(2)s until we got all the data we *requested*.
+
+Note: This function may block. Use it only if you're sure about the
+amount of data you will get.
+
+Argument:
+ fd the file descriptor to read from
+ buffer pointer to a buffer of size len
+ len the requested(!) amount of bytes
+
+Returns: the amount of bytes read
+*/
+static ssize_t
+readn(int fd, void * buffer, size_t len)
+{
+uschar * next = buffer;
+uschar * end = next + len;
+
+while (next < end)
+ {
+ ssize_t got = read(fd, next, end - next);
+
+ /* I'm not sure if there are signals that can interrupt us,
+ for now I assume the worst */
+ if (got == -1 && errno == EINTR) continue;
+ if (got <= 0) return next - US buffer;
+ next += got;
+ }
+
+return len;
+}
+
+
+/*************************************************
+* Make a new address item *
+*************************************************/
+
+/* This function gets the store and initializes with default values. The
+transport_return value defaults to DEFER, so that any unexpected failure to
+deliver does not wipe out the message. The default unique string is set to a
+copy of the address, so that its domain can be lowercased.
+
+Argument:
+ address the RFC822 address string
+ copy force a copy of the address
+
+Returns: a pointer to an initialized address_item
+*/
+
+address_item *
+deliver_make_addr(uschar *address, BOOL copy)
+{
+address_item *addr = store_get(sizeof(address_item), FALSE);
+*addr = address_defaults;
+if (copy) address = string_copy(address);
+addr->address = address;
+addr->unique = string_copy(address);
+return addr;
+}
+
+
+
+
+/*************************************************
+* Set expansion values for an address *
+*************************************************/
+
+/* Certain expansion variables are valid only when handling an address or
+address list. This function sets them up or clears the values, according to its
+argument.
+
+Arguments:
+ addr the address in question, or NULL to clear values
+Returns: nothing
+*/
+
+void
+deliver_set_expansions(address_item *addr)
+{
+if (!addr)
+ {
+ const uschar ***p = address_expansions;
+ while (*p) **p++ = NULL;
+ return;
+ }
+
+/* Exactly what gets set depends on whether there is one or more addresses, and
+what they contain. These first ones are always set, taking their values from
+the first address. */
+
+if (!addr->host_list)
+ {
+ deliver_host = deliver_host_address = US"";
+ deliver_host_port = 0;
+ }
+else
+ {
+ deliver_host = addr->host_list->name;
+ deliver_host_address = addr->host_list->address;
+ deliver_host_port = addr->host_list->port;
+ }
+
+deliver_recipients = addr;
+deliver_address_data = addr->prop.address_data;
+deliver_domain_data = addr->prop.domain_data;
+deliver_localpart_data = addr->prop.localpart_data;
+router_var = addr->prop.variables;
+
+/* These may be unset for multiple addresses */
+
+deliver_domain = addr->domain;
+self_hostname = addr->self_hostname;
+
+#ifdef EXPERIMENTAL_BRIGHTMAIL
+bmi_deliver = 1; /* deliver by default */
+bmi_alt_location = NULL;
+bmi_base64_verdict = NULL;
+bmi_base64_tracker_verdict = NULL;
+#endif
+
+/* If there's only one address we can set everything. */
+
+if (!addr->next)
+ {
+ address_item *addr_orig;
+
+ deliver_localpart = addr->local_part;
+ deliver_localpart_prefix = addr->prefix;
+ deliver_localpart_prefix_v = addr->prefix_v;
+ deliver_localpart_suffix = addr->suffix;
+ deliver_localpart_suffix_v = addr->suffix_v;
+
+ for (addr_orig = addr; addr_orig->parent; addr_orig = addr_orig->parent) ;
+ deliver_domain_orig = addr_orig->domain;
+
+ /* Re-instate any prefix and suffix in the original local part. In all
+ normal cases, the address will have a router associated with it, and we can
+ choose the caseful or caseless version accordingly. However, when a system
+ filter sets up a pipe, file, or autoreply delivery, no router is involved.
+ In this case, though, there won't be any prefix or suffix to worry about. */
+
+ deliver_localpart_orig = !addr_orig->router
+ ? addr_orig->local_part
+ : addr_orig->router->caseful_local_part
+ ? addr_orig->cc_local_part
+ : addr_orig->lc_local_part;
+
+ /* If there's a parent, make its domain and local part available, and if
+ delivering to a pipe or file, or sending an autoreply, get the local
+ part from the parent. For pipes and files, put the pipe or file string
+ into address_pipe and address_file. */
+
+ if (addr->parent)
+ {
+ deliver_domain_parent = addr->parent->domain;
+ deliver_localpart_parent = !addr->parent->router
+ ? addr->parent->local_part
+ : addr->parent->router->caseful_local_part
+ ? addr->parent->cc_local_part
+ : addr->parent->lc_local_part;
+
+ /* File deliveries have their own flag because they need to be picked out
+ as special more often. */
+
+ if (testflag(addr, af_pfr))
+ {
+ if (testflag(addr, af_file)) address_file = addr->local_part;
+ else if (deliver_localpart[0] == '|') address_pipe = addr->local_part;
+ deliver_localpart = addr->parent->local_part;
+ deliver_localpart_prefix = addr->parent->prefix;
+ deliver_localpart_prefix_v = addr->parent->prefix_v;
+ deliver_localpart_suffix = addr->parent->suffix;
+ deliver_localpart_suffix_v = addr->parent->suffix_v;
+ }
+ }
+
+#ifdef EXPERIMENTAL_BRIGHTMAIL
+ /* Set expansion variables related to Brightmail AntiSpam */
+ bmi_base64_verdict = bmi_get_base64_verdict(deliver_localpart_orig, deliver_domain_orig);
+ bmi_base64_tracker_verdict = bmi_get_base64_tracker_verdict(bmi_base64_verdict);
+ /* get message delivery status (0 - don't deliver | 1 - deliver) */
+ bmi_deliver = bmi_get_delivery_status(bmi_base64_verdict);
+ /* if message is to be delivered, get eventual alternate location */
+ if (bmi_deliver == 1)
+ bmi_alt_location = bmi_get_alt_location(bmi_base64_verdict);
+#endif
+
+ }
+
+/* For multiple addresses, don't set local part, and leave the domain and
+self_hostname set only if it is the same for all of them. It is possible to
+have multiple pipe and file addresses, but only when all addresses have routed
+to the same pipe or file. */
+
+else
+ {
+ if (testflag(addr, af_pfr))
+ {
+ if (testflag(addr, af_file)) address_file = addr->local_part;
+ else if (addr->local_part[0] == '|') address_pipe = addr->local_part;
+ }
+ for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next)
+ {
+ if (deliver_domain && Ustrcmp(deliver_domain, addr2->domain) != 0)
+ deliver_domain = NULL;
+ if ( self_hostname
+ && ( !addr2->self_hostname
+ || Ustrcmp(self_hostname, addr2->self_hostname) != 0
+ ) )
+ self_hostname = NULL;
+ if (!deliver_domain && !self_hostname) break;
+ }
+ }
+}
+
+
+
+
+/*************************************************
+* Open a msglog file *
+*************************************************/
+
+/* This function is used both for normal message logs, and for files in the
+msglog directory that are used to catch output from pipes. Try to create the
+directory if it does not exist. From release 4.21, normal message logs should
+be created when the message is received.
+
+Called from deliver_message(), can be operating as root.
+
+Argument:
+ filename the file name
+ mode the mode required
+ error used for saying what failed
+
+Returns: a file descriptor, or -1 (with errno set)
+*/
+
+static int
+open_msglog_file(uschar *filename, int mode, uschar **error)
+{
+if (Ustrstr(filename, US"/../"))
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE,
+ "Attempt to open msglog file path with upward-traversal: '%s'\n", filename);
+
+for (int i = 2; i > 0; i--)
+ {
+ int fd = Uopen(filename,
+#ifdef O_CLOEXEC
+ O_CLOEXEC |
+#endif
+#ifdef O_NOFOLLOW
+ O_NOFOLLOW |
+#endif
+ O_WRONLY|O_APPEND|O_CREAT, mode);
+ if (fd >= 0)
+ {
+ /* Set the close-on-exec flag and change the owner to the exim uid/gid (this
+ function is called as root). Double check the mode, because the group setting
+ doesn't always get set automatically. */
+
+#ifndef O_CLOEXEC
+ (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+#endif
+ if (exim_fchown(fd, exim_uid, exim_gid, filename) < 0)
+ {
+ *error = US"chown";
+ return -1;
+ }
+ if (fchmod(fd, mode) < 0)
+ {
+ *error = US"chmod";
+ return -1;
+ }
+ return fd;
+ }
+ if (errno != ENOENT)
+ break;
+
+ (void)directory_make(spool_directory,
+ spool_sname(US"msglog", message_subdir),
+ MSGLOG_DIRECTORY_MODE, TRUE);
+ }
+
+*error = US"create or open";
+return -1;
+}
+
+
+
+
+/*************************************************
+* Write to msglog if required *
+*************************************************/
+
+/* Write to the message log, if configured. This function may also be called
+from transports.
+
+Arguments:
+ format a string format
+
+Returns: nothing
+*/
+
+void
+deliver_msglog(const char *format, ...)
+{
+va_list ap;
+if (!message_logs) return;
+va_start(ap, format);
+vfprintf(message_log, format, ap);
+fflush(message_log);
+va_end(ap);
+}
+
+
+
+
+/*************************************************
+* Replicate status for batch *
+*************************************************/
+
+/* When a transport handles a batch of addresses, it may treat them
+individually, or it may just put the status in the first one, and return FALSE,
+requesting that the status be copied to all the others externally. This is the
+replication function. As well as the status, it copies the transport pointer,
+which may have changed if appendfile passed the addresses on to a different
+transport.
+
+Argument: pointer to the first address in a chain
+Returns: nothing
+*/
+
+static void
+replicate_status(address_item *addr)
+{
+for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next)
+ {
+ addr2->transport = addr->transport;
+ addr2->transport_return = addr->transport_return;
+ addr2->basic_errno = addr->basic_errno;
+ addr2->more_errno = addr->more_errno;
+ addr2->delivery_time = addr->delivery_time;
+ addr2->special_action = addr->special_action;
+ addr2->message = addr->message;
+ addr2->user_message = addr->user_message;
+ }
+}
+
+
+
+/*************************************************
+* Compare lists of hosts *
+*************************************************/
+
+/* This function is given two pointers to chains of host items, and it yields
+TRUE if the lists refer to the same hosts in the same order, except that
+
+(1) Multiple hosts with the same non-negative MX values are permitted to appear
+ in different orders. Round-robinning nameservers can cause this to happen.
+
+(2) Multiple hosts with the same negative MX values less than MX_NONE are also
+ permitted to appear in different orders. This is caused by randomizing
+ hosts lists.
+
+This enables Exim to use a single SMTP transaction for sending to two entirely
+different domains that happen to end up pointing at the same hosts.
+
+We do not try to batch up different A-record host names that refer to the
+same IP.
+
+Arguments:
+ one points to the first host list
+ two points to the second host list
+
+Returns: TRUE if the lists refer to the same host set
+*/
+
+static BOOL
+same_hosts(host_item *one, host_item *two)
+{
+while (one && two)
+ {
+ if (Ustrcmp(one->name, two->name) != 0)
+ {
+ int mx = one->mx;
+ host_item *end_one = one;
+ host_item *end_two = two;
+
+ /* Batch up only if there was no MX and the list was not randomized */
+
+ if (mx == MX_NONE) return FALSE;
+
+ /* Find the ends of the shortest sequence of identical MX values */
+
+ while ( end_one->next && end_one->next->mx == mx
+ && end_two->next && end_two->next->mx == mx)
+ {
+ end_one = end_one->next;
+ end_two = end_two->next;
+ }
+
+ /* If there aren't any duplicates, there's no match. */
+
+ if (end_one == one) return FALSE;
+
+ /* For each host in the 'one' sequence, check that it appears in the 'two'
+ sequence, returning FALSE if not. */
+
+ for (;;)
+ {
+ host_item *hi;
+ for (hi = two; hi != end_two->next; hi = hi->next)
+ if (Ustrcmp(one->name, hi->name) == 0) break;
+ if (hi == end_two->next) return FALSE;
+ if (one == end_one) break;
+ one = one->next;
+ }
+
+ /* All the hosts in the 'one' sequence were found in the 'two' sequence.
+ Ensure both are pointing at the last host, and carry on as for equality. */
+
+ two = end_two;
+ }
+
+ /* if the names matched but ports do not, mismatch */
+ else if (one->port != two->port)
+ return FALSE;
+
+ /* Hosts matched */
+
+ one = one->next;
+ two = two->next;
+ }
+
+/* True if both are NULL */
+
+return (one == two);
+}
+
+
+
+/*************************************************
+* Compare header lines *
+*************************************************/
+
+/* This function is given two pointers to chains of header items, and it yields
+TRUE if they are the same header texts in the same order.
+
+Arguments:
+ one points to the first header list
+ two points to the second header list
+
+Returns: TRUE if the lists refer to the same header set
+*/
+
+static BOOL
+same_headers(header_line *one, header_line *two)
+{
+for (;; one = one->next, two = two->next)
+ {
+ if (one == two) return TRUE; /* Includes the case where both NULL */
+ if (!one || !two) return FALSE;
+ if (Ustrcmp(one->text, two->text) != 0) return FALSE;
+ }
+}
+
+
+
+/*************************************************
+* Compare string settings *
+*************************************************/
+
+/* This function is given two pointers to strings, and it returns
+TRUE if they are the same pointer, or if the two strings are the same.
+
+Arguments:
+ one points to the first string
+ two points to the second string
+
+Returns: TRUE or FALSE
+*/
+
+static BOOL
+same_strings(uschar *one, uschar *two)
+{
+if (one == two) return TRUE; /* Includes the case where both NULL */
+if (!one || !two) return FALSE;
+return (Ustrcmp(one, two) == 0);
+}
+
+
+
+/*************************************************
+* Compare uid/gid for addresses *
+*************************************************/
+
+/* This function is given a transport and two addresses. It yields TRUE if the
+uid/gid/initgroups settings for the two addresses are going to be the same when
+they are delivered.
+
+Arguments:
+ tp the transort
+ addr1 the first address
+ addr2 the second address
+
+Returns: TRUE or FALSE
+*/
+
+static BOOL
+same_ugid(transport_instance *tp, address_item *addr1, address_item *addr2)
+{
+if ( !tp->uid_set && !tp->expand_uid
+ && !tp->deliver_as_creator
+ && ( testflag(addr1, af_uid_set) != testflag(addr2, af_gid_set)
+ || ( testflag(addr1, af_uid_set)
+ && ( addr1->uid != addr2->uid
+ || testflag(addr1, af_initgroups) != testflag(addr2, af_initgroups)
+ ) ) ) )
+ return FALSE;
+
+if ( !tp->gid_set && !tp->expand_gid
+ && ( testflag(addr1, af_gid_set) != testflag(addr2, af_gid_set)
+ || ( testflag(addr1, af_gid_set)
+ && addr1->gid != addr2->gid
+ ) ) )
+ return FALSE;
+
+return TRUE;
+}
+
+
+
+
+/*************************************************
+* Record that an address is complete *
+*************************************************/
+
+/* This function records that an address is complete. This is straightforward
+for most addresses, where the unique address is just the full address with the
+domain lower cased. For homonyms (addresses that are the same as one of their
+ancestors) their are complications. Their unique addresses have \x\ prepended
+(where x = 0, 1, 2...), so that de-duplication works correctly for siblings and
+cousins.
+
+Exim used to record the unique addresses of homonyms as "complete". This,
+however, fails when the pattern of redirection varies over time (e.g. if taking
+unseen copies at only some times of day) because the prepended numbers may vary
+from one delivery run to the next. This problem is solved by never recording
+prepended unique addresses as complete. Instead, when a homonymic address has
+actually been delivered via a transport, we record its basic unique address
+followed by the name of the transport. This is checked in subsequent delivery
+runs whenever an address is routed to a transport.
+
+If the completed address is a top-level one (has no parent, which means it
+cannot be homonymic) we also add the original address to the non-recipients
+tree, so that it gets recorded in the spool file and therefore appears as
+"done" in any spool listings. The original address may differ from the unique
+address in the case of the domain.
+
+Finally, this function scans the list of duplicates, marks as done any that
+match this address, and calls child_done() for their ancestors.
+
+Arguments:
+ addr address item that has been completed
+ now current time as a string
+
+Returns: nothing
+*/
+
+static void
+address_done(address_item *addr, uschar *now)
+{
+update_spool = TRUE; /* Ensure spool gets updated */
+
+/* Top-level address */
+
+if (!addr->parent)
+ {
+ tree_add_nonrecipient(addr->unique);
+ tree_add_nonrecipient(addr->address);
+ }
+
+/* Homonymous child address */
+
+else if (testflag(addr, af_homonym))
+ {
+ if (addr->transport)
+ tree_add_nonrecipient(
+ string_sprintf("%s/%s", addr->unique + 3, addr->transport->name));
+ }
+
+/* Non-homonymous child address */
+
+else tree_add_nonrecipient(addr->unique);
+
+/* Check the list of duplicate addresses and ensure they are now marked
+done as well. */
+
+for (address_item * dup = addr_duplicate; dup; dup = dup->next)
+ if (Ustrcmp(addr->unique, dup->unique) == 0)
+ {
+ tree_add_nonrecipient(dup->unique);
+ child_done(dup, now);
+ }
+}
+
+
+
+
+/*************************************************
+* Decrease counts in parents and mark done *
+*************************************************/
+
+/* This function is called when an address is complete. If there is a parent
+address, its count of children is decremented. If there are still other
+children outstanding, the function exits. Otherwise, if the count has become
+zero, address_done() is called to mark the parent and its duplicates complete.
+Then loop for any earlier ancestors.
+
+Arguments:
+ addr points to the completed address item
+ now the current time as a string, for writing to the message log
+
+Returns: nothing
+*/
+
+static void
+child_done(address_item *addr, uschar *now)
+{
+while (addr->parent)
+ {
+ address_item *aa;
+
+ addr = addr->parent;
+ if (--addr->child_count > 0) return; /* Incomplete parent */
+ address_done(addr, now);
+
+ /* Log the completion of all descendents only when there is no ancestor with
+ the same original address. */
+
+ for (aa = addr->parent; aa; aa = aa->parent)
+ if (Ustrcmp(aa->address, addr->address) == 0) break;
+ if (aa) continue;
+
+ deliver_msglog("%s %s: children all complete\n", now, addr->address);
+ DEBUG(D_deliver) debug_printf("%s: children all complete\n", addr->address);
+ }
+}
+
+
+
+/*************************************************
+* Delivery logging support functions *
+*************************************************/
+
+/* The LOGGING() checks in d_log_interface() are complicated for backwards
+compatibility. When outgoing interface logging was originally added, it was
+conditional on just incoming_interface (which is off by default). The
+outgoing_interface option is on by default to preserve this behaviour, but
+you can enable incoming_interface and disable outgoing_interface to get I=
+fields on incoming lines only.
+
+Arguments:
+ g The log line
+ addr The address to be logged
+
+Returns: New value for s
+*/
+
+static gstring *
+d_log_interface(gstring * g)
+{
+if (LOGGING(incoming_interface) && LOGGING(outgoing_interface)
+ && sending_ip_address)
+ {
+ g = string_fmt_append(g, " I=[%s]", sending_ip_address);
+ if (LOGGING(outgoing_port))
+ g = string_fmt_append(g, ":%d", sending_port);
+ }
+return g;
+}
+
+
+
+static gstring *
+d_hostlog(gstring * g, address_item * addr)
+{
+host_item * h = addr->host_used;
+
+g = string_append(g, 2, US" H=", h->name);
+
+if (LOGGING(dnssec) && h->dnssec == DS_YES)
+ g = string_catn(g, US" DS", 3);
+
+g = string_append(g, 3, US" [", h->address, US"]");
+
+if (LOGGING(outgoing_port))
+ g = string_fmt_append(g, ":%d", h->port);
+
+#ifdef SUPPORT_SOCKS
+if (LOGGING(proxy) && proxy_local_address)
+ {
+ g = string_append(g, 3, US" PRX=[", proxy_local_address, US"]");
+ if (LOGGING(outgoing_port))
+ g = string_fmt_append(g, ":%d", proxy_local_port);
+ }
+#endif
+
+g = d_log_interface(g);
+
+if (testflag(addr, af_tcp_fastopen))
+ g = string_catn(g, US" TFO*", testflag(addr, af_tcp_fastopen_data) ? 5 : 4);
+
+return g;
+}
+
+
+
+
+
+#ifndef DISABLE_TLS
+static gstring *
+d_tlslog(gstring * g, address_item * addr)
+{
+if (LOGGING(tls_cipher) && addr->cipher)
+ {
+ g = string_append(g, 2, US" X=", addr->cipher);
+#ifdef EXPERIMENTAL_TLS_RESUME
+ if (LOGGING(tls_resumption) && testflag(addr, af_tls_resume))
+ g = string_catn(g, US"*", 1);
+#endif
+ }
+if (LOGGING(tls_certificate_verified) && addr->cipher)
+ g = string_append(g, 2, US" CV=",
+ testflag(addr, af_cert_verified)
+ ?
+#ifdef SUPPORT_DANE
+ testflag(addr, af_dane_verified)
+ ? "dane"
+ :
+#endif
+ "yes"
+ : "no");
+if (LOGGING(tls_peerdn) && addr->peerdn)
+ g = string_append(g, 3, US" DN=\"", string_printing(addr->peerdn), US"\"");
+return g;
+}
+#endif
+
+
+
+
+#ifndef DISABLE_EVENT
+uschar *
+event_raise(uschar * action, const uschar * event, uschar * ev_data)
+{
+uschar * s;
+if (action)
+ {
+ DEBUG(D_deliver)
+ debug_printf("Event(%s): event_action=|%s| delivery_IP=%s\n",
+ event,
+ action, deliver_host_address);
+
+ event_name = event;
+ event_data = ev_data;
+
+ if (!(s = expand_string(action)) && *expand_string_message)
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "failed to expand event_action %s in %s: %s\n",
+ event, transport_name ? transport_name : US"main", expand_string_message);
+
+ event_name = event_data = NULL;
+
+ /* If the expansion returns anything but an empty string, flag for
+ the caller to modify his normal processing
+ */
+ if (s && *s)
+ {
+ DEBUG(D_deliver)
+ debug_printf("Event(%s): event_action returned \"%s\"\n", event, s);
+ errno = ERRNO_EVENT;
+ return s;
+ }
+ }
+return NULL;
+}
+
+void
+msg_event_raise(const uschar * event, const address_item * addr)
+{
+const uschar * save_domain = deliver_domain;
+uschar * save_local = deliver_localpart;
+const uschar * save_host = deliver_host;
+const uschar * save_address = deliver_host_address;
+const int save_port = deliver_host_port;
+
+router_name = addr->router ? addr->router->name : NULL;
+deliver_domain = addr->domain;
+deliver_localpart = addr->local_part;
+deliver_host = addr->host_used ? addr->host_used->name : NULL;
+
+if (!addr->transport)
+ {
+ if (Ustrcmp(event, "msg:fail:delivery") == 0)
+ {
+ /* An address failed with no transport involved. This happens when
+ a filter was used which triggered a fail command (in such a case
+ a transport isn't needed). Convert it to an internal fail event. */
+
+ (void) event_raise(event_action, US"msg:fail:internal", addr->message);
+ }
+ }
+else
+ {
+ transport_name = addr->transport->name;
+
+ (void) event_raise(addr->transport->event_action, event,
+ addr->host_used
+ || Ustrcmp(addr->transport->driver_name, "smtp") == 0
+ || Ustrcmp(addr->transport->driver_name, "lmtp") == 0
+ || Ustrcmp(addr->transport->driver_name, "autoreply") == 0
+ ? addr->message : NULL);
+ }
+
+deliver_host_port = save_port;
+deliver_host_address = save_address;
+deliver_host = save_host;
+deliver_localpart = save_local;
+deliver_domain = save_domain;
+router_name = transport_name = NULL;
+}
+#endif /*DISABLE_EVENT*/
+
+
+
+/******************************************************************************/
+
+
+/*************************************************
+* Generate local prt for logging *
+*************************************************/
+
+/* This function is a subroutine for use in string_log_address() below.
+
+Arguments:
+ addr the address being logged
+ yield the current dynamic buffer pointer
+
+Returns: the new value of the buffer pointer
+*/
+
+static gstring *
+string_get_localpart(address_item * addr, gstring * yield)
+{
+uschar * s;
+
+s = addr->prefix;
+if (testflag(addr, af_include_affixes) && s)
+ {
+#ifdef SUPPORT_I18N
+ if (testflag(addr, af_utf8_downcvt))
+ s = string_localpart_utf8_to_alabel(s, NULL);
+#endif
+ yield = string_cat(yield, s);
+ }
+
+s = addr->local_part;
+#ifdef SUPPORT_I18N
+if (testflag(addr, af_utf8_downcvt))
+ s = string_localpart_utf8_to_alabel(s, NULL);
+#endif
+yield = string_cat(yield, s);
+
+s = addr->suffix;
+if (testflag(addr, af_include_affixes) && s)
+ {
+#ifdef SUPPORT_I18N
+ if (testflag(addr, af_utf8_downcvt))
+ s = string_localpart_utf8_to_alabel(s, NULL);
+#endif
+ yield = string_cat(yield, s);
+ }
+
+return yield;
+}
+
+
+/*************************************************
+* Generate log address list *
+*************************************************/
+
+/* This function generates a list consisting of an address and its parents, for
+use in logging lines. For saved onetime aliased addresses, the onetime parent
+field is used. If the address was delivered by a transport with rcpt_include_
+affixes set, the af_include_affixes bit will be set in the address. In that
+case, we include the affixes here too.
+
+Arguments:
+ g points to growing-string struct
+ addr bottom (ultimate) address
+ all_parents if TRUE, include all parents
+ success TRUE for successful delivery
+
+Returns: a growable string in dynamic store
+*/
+
+static gstring *
+string_log_address(gstring * g,
+ address_item *addr, BOOL all_parents, BOOL success)
+{
+BOOL add_topaddr = TRUE;
+address_item *topaddr;
+
+/* Find the ultimate parent */
+
+for (topaddr = addr; topaddr->parent; topaddr = topaddr->parent) ;
+
+/* We start with just the local part for pipe, file, and reply deliveries, and
+for successful local deliveries from routers that have the log_as_local flag
+set. File deliveries from filters can be specified as non-absolute paths in
+cases where the transport is going to complete the path. If there is an error
+before this happens (expansion failure) the local part will not be updated, and
+so won't necessarily look like a path. Add extra text for this case. */
+
+if ( testflag(addr, af_pfr)
+ || ( success
+ && addr->router && addr->router->log_as_local
+ && addr->transport && addr->transport->info->local
+ ) )
+ {
+ if (testflag(addr, af_file) && addr->local_part[0] != '/')
+ g = string_catn(g, CUS"save ", 5);
+ g = string_get_localpart(addr, g);
+ }
+
+/* Other deliveries start with the full address. It we have split it into local
+part and domain, use those fields. Some early failures can happen before the
+splitting is done; in those cases use the original field. */
+
+else
+ {
+ uschar * cmp;
+ int off = g->ptr; /* start of the "full address" */
+
+ if (addr->local_part)
+ {
+ const uschar * s;
+ g = string_get_localpart(addr, g);
+ g = string_catn(g, US"@", 1);
+ s = addr->domain;
+#ifdef SUPPORT_I18N
+ if (testflag(addr, af_utf8_downcvt))
+ s = string_localpart_utf8_to_alabel(s, NULL);
+#endif
+ g = string_cat(g, s);
+ }
+ else
+ g = string_cat(g, addr->address);
+
+ /* If the address we are going to print is the same as the top address,
+ and all parents are not being included, don't add on the top address. First
+ of all, do a caseless comparison; if this succeeds, do a caseful comparison
+ on the local parts. */
+
+ cmp = g->s + off; /* only now, as rebuffer likely done */
+ string_from_gstring(g); /* ensure nul-terminated */
+ if ( strcmpic(cmp, topaddr->address) == 0
+ && Ustrncmp(cmp, topaddr->address, Ustrchr(cmp, '@') - cmp) == 0
+ && !addr->onetime_parent
+ && (!all_parents || !addr->parent || addr->parent == topaddr)
+ )
+ add_topaddr = FALSE;
+ }
+
+/* If all parents are requested, or this is a local pipe/file/reply, and
+there is at least one intermediate parent, show it in brackets, and continue
+with all of them if all are wanted. */
+
+if ( (all_parents || testflag(addr, af_pfr))
+ && addr->parent
+ && addr->parent != topaddr)
+ {
+ uschar *s = US" (";
+ for (address_item * addr2 = addr->parent; addr2 != topaddr; addr2 = addr2->parent)
+ {
+ g = string_catn(g, s, 2);
+ g = string_cat (g, addr2->address);
+ if (!all_parents) break;
+ s = US", ";
+ }
+ g = string_catn(g, US")", 1);
+ }
+
+/* Add the top address if it is required */
+
+if (add_topaddr)
+ g = string_append(g, 3,
+ US" <",
+ addr->onetime_parent ? addr->onetime_parent : topaddr->address,
+ US">");
+
+return g;
+}
+
+
+
+/******************************************************************************/
+
+
+
+/* If msg is NULL this is a delivery log and logchar is used. Otherwise
+this is a nonstandard call; no two-character delivery flag is written
+but sender-host and sender are prefixed and "msg" is inserted in the log line.
+
+Arguments:
+ flags passed to log_write()
+*/
+void
+delivery_log(int flags, address_item * addr, int logchar, uschar * msg)
+{
+gstring * g; /* Used for a temporary, expanding buffer, for building log lines */
+rmark reset_point;
+
+/* Log the delivery on the main log. We use an extensible string to build up
+the log line, and reset the store afterwards. Remote deliveries should always
+have a pointer to the host item that succeeded; local deliveries can have a
+pointer to a single host item in their host list, for use by the transport. */
+
+#ifndef DISABLE_EVENT
+ /* presume no successful remote delivery */
+ lookup_dnssec_authenticated = NULL;
+#endif
+
+reset_point = store_mark();
+g = string_get_tainted(256, TRUE); /* addrs will be tainted, so avoid copy */
+
+if (msg)
+ g = string_append(g, 2, host_and_ident(TRUE), US" ");
+else
+ {
+ g->s[0] = logchar; g->ptr = 1;
+ g = string_catn(g, US"> ", 2);
+ }
+g = string_log_address(g, addr, LOGGING(all_parents), TRUE);
+
+if (LOGGING(sender_on_delivery) || msg)
+ g = string_append(g, 3, US" F=<",
+#ifdef SUPPORT_I18N
+ testflag(addr, af_utf8_downcvt)
+ ? string_address_utf8_to_alabel(sender_address, NULL)
+ :
+#endif
+ sender_address,
+ US">");
+
+if (*queue_name)
+ g = string_append(g, 2, US" Q=", queue_name);
+
+#ifdef EXPERIMENTAL_SRS
+if(addr->prop.srs_sender)
+ g = string_append(g, 3, US" SRS=<", addr->prop.srs_sender, US">");
+#endif
+
+/* You might think that the return path must always be set for a successful
+delivery; indeed, I did for some time, until this statement crashed. The case
+when it is not set is for a delivery to /dev/null which is optimised by not
+being run at all. */
+
+if (used_return_path && LOGGING(return_path_on_delivery))
+ g = string_append(g, 3, US" P=<", used_return_path, US">");
+
+if (msg)
+ g = string_append(g, 2, US" ", msg);
+
+/* For a delivery from a system filter, there may not be a router */
+if (addr->router)
+ g = string_append(g, 2, US" R=", addr->router->name);
+
+g = string_append(g, 2, US" T=", addr->transport->name);
+
+if (LOGGING(delivery_size))
+ g = string_fmt_append(g, " S=%d", transport_count);
+
+/* Local delivery */
+
+if (addr->transport->info->local)
+ {
+ if (addr->host_list)
+ g = string_append(g, 2, US" H=", addr->host_list->name);
+ g = d_log_interface(g);
+ if (addr->shadow_message)
+ g = string_cat(g, addr->shadow_message);
+ }
+
+/* Remote delivery */
+
+else
+ {
+ if (addr->host_used)
+ {
+ g = d_hostlog(g, addr);
+ if (continue_sequence > 1) /*XXX this is wrong for a dropped proxyconn. Would have to pass back from transport */
+ g = string_catn(g, US"*", 1);
+
+#ifndef DISABLE_EVENT
+ deliver_host_address = addr->host_used->address;
+ deliver_host_port = addr->host_used->port;
+ deliver_host = addr->host_used->name;
+
+ /* DNS lookup status */
+ lookup_dnssec_authenticated = addr->host_used->dnssec==DS_YES ? US"yes"
+ : addr->host_used->dnssec==DS_NO ? US"no"
+ : NULL;
+#endif
+ }
+
+#ifndef DISABLE_TLS
+ g = d_tlslog(g, addr);
+#endif
+
+ if (addr->authenticator)
+ {
+ g = string_append(g, 2, US" A=", addr->authenticator);
+ if (addr->auth_id)
+ {
+ g = string_append(g, 2, US":", addr->auth_id);
+ if (LOGGING(smtp_mailauth) && addr->auth_sndr)
+ g = string_append(g, 2, US":", addr->auth_sndr);
+ }
+ }
+
+ if (LOGGING(pipelining))
+ {
+ if (testflag(addr, af_pipelining))
+ g = string_catn(g, US" L", 2);
+#ifndef DISABLE_PIPE_CONNECT
+ if (testflag(addr, af_early_pipe))
+ g = string_catn(g, US"*", 1);
+#endif
+ }
+
+#ifndef DISABLE_PRDR
+ if (testflag(addr, af_prdr_used))
+ g = string_catn(g, US" PRDR", 5);
+#endif
+
+ if (testflag(addr, af_chunking_used))
+ g = string_catn(g, US" K", 2);
+ }
+
+/* confirmation message (SMTP (host_used) and LMTP (driver_name)) */
+
+if ( LOGGING(smtp_confirmation)
+ && addr->message
+ && (addr->host_used || Ustrcmp(addr->transport->driver_name, "lmtp") == 0)
+ )
+ {
+ unsigned lim = big_buffer_size < 1024 ? big_buffer_size : 1024;
+ uschar *p = big_buffer;
+ uschar *ss = addr->message;
+ *p++ = '\"';
+ for (int i = 0; i < lim && ss[i] != 0; i++) /* limit logged amount */
+ {
+ if (ss[i] == '\"' || ss[i] == '\\') *p++ = '\\'; /* quote \ and " */
+ *p++ = ss[i];
+ }
+ *p++ = '\"';
+ *p = 0;
+ g = string_append(g, 2, US" C=", big_buffer);
+ }
+
+/* Time on queue and actual time taken to deliver */
+
+if (LOGGING(queue_time))
+ g = string_append(g, 2, US" QT=",
+ string_timesince(&received_time));
+
+if (LOGGING(deliver_time))
+ g = string_append(g, 2, US" DT=", string_timediff(&addr->delivery_time));
+
+/* string_cat() always leaves room for the terminator. Release the
+store we used to build the line after writing it. */
+
+log_write(0, flags, "%s", string_from_gstring(g));
+
+#ifndef DISABLE_EVENT
+if (!msg) msg_event_raise(US"msg:delivery", addr);
+#endif
+
+store_reset(reset_point);
+return;
+}
+
+
+
+static void
+deferral_log(address_item * addr, uschar * now,
+ int logflags, uschar * driver_name, uschar * driver_kind)
+{
+rmark reset_point = store_mark();
+gstring * g = string_get(256);
+
+/* Build up the line that is used for both the message log and the main
+log. */
+
+/* Create the address string for logging. Must not do this earlier, because
+an OK result may be changed to FAIL when a pipe returns text. */
+
+g = string_log_address(g, addr, LOGGING(all_parents), FALSE);
+
+if (*queue_name)
+ g = string_append(g, 2, US" Q=", queue_name);
+
+/* Either driver_name contains something and driver_kind contains
+" router" or " transport" (note the leading space), or driver_name is
+a null string and driver_kind contains "routing" without the leading
+space, if all routing has been deferred. When a domain has been held,
+so nothing has been done at all, both variables contain null strings. */
+
+if (driver_name)
+ {
+ if (driver_kind[1] == 't' && addr->router)
+ g = string_append(g, 2, US" R=", addr->router->name);
+ g = string_fmt_append(g, " %c=%s", toupper(driver_kind[1]), driver_name);
+ }
+else if (driver_kind)
+ g = string_append(g, 2, US" ", driver_kind);
+
+g = string_fmt_append(g, " defer (%d)", addr->basic_errno);
+
+if (addr->basic_errno > 0)
+ g = string_append(g, 2, US": ",
+ US strerror(addr->basic_errno));
+
+if (addr->host_used)
+ {
+ g = string_append(g, 5,
+ US" H=", addr->host_used->name,
+ US" [", addr->host_used->address, US"]");
+ if (LOGGING(outgoing_port))
+ {
+ int port = addr->host_used->port;
+ g = string_fmt_append(g, ":%d", port == PORT_NONE ? 25 : port);
+ }
+ }
+
+if (LOGGING(deliver_time))
+ g = string_append(g, 2, US" DT=", string_timediff(&addr->delivery_time));
+
+if (addr->message)
+ g = string_append(g, 2, US": ", addr->message);
+
+(void) string_from_gstring(g);
+
+/* Log the deferment in the message log, but don't clutter it
+up with retry-time defers after the first delivery attempt. */
+
+if (f.deliver_firsttime || addr->basic_errno > ERRNO_RETRY_BASE)
+ deliver_msglog("%s %s\n", now, g->s);
+
+/* Write the main log and reset the store.
+For errors of the type "retry time not reached" (also remotes skipped
+on queue run), logging is controlled by L_retry_defer. Note that this kind
+of error number is negative, and all the retry ones are less than any
+others. */
+
+
+log_write(addr->basic_errno <= ERRNO_RETRY_BASE ? L_retry_defer : 0, logflags,
+ "== %s", g->s);
+
+store_reset(reset_point);
+return;
+}
+
+
+
+static void
+failure_log(address_item * addr, uschar * driver_kind, uschar * now)
+{
+rmark reset_point = store_mark();
+gstring * g = string_get(256);
+
+#ifndef DISABLE_EVENT
+/* Message failures for which we will send a DSN get their event raised
+later so avoid doing it here. */
+
+if ( !addr->prop.ignore_error
+ && !(addr->dsn_flags & (rf_dsnflags & ~rf_notify_failure))
+ )
+ msg_event_raise(US"msg:fail:delivery", addr);
+#endif
+
+/* Build up the log line for the message and main logs */
+
+/* Create the address string for logging. Must not do this earlier, because
+an OK result may be changed to FAIL when a pipe returns text. */
+
+g = string_log_address(g, addr, LOGGING(all_parents), FALSE);
+
+if (LOGGING(sender_on_delivery))
+ g = string_append(g, 3, US" F=<", sender_address, US">");
+
+if (*queue_name)
+ g = string_append(g, 2, US" Q=", queue_name);
+
+/* Return path may not be set if no delivery actually happened */
+
+if (used_return_path && LOGGING(return_path_on_delivery))
+ g = string_append(g, 3, US" P=<", used_return_path, US">");
+
+if (addr->router)
+ g = string_append(g, 2, US" R=", addr->router->name);
+if (addr->transport)
+ g = string_append(g, 2, US" T=", addr->transport->name);
+
+if (addr->host_used)
+ g = d_hostlog(g, addr);
+
+#ifndef DISABLE_TLS
+g = d_tlslog(g, addr);
+#endif
+
+if (addr->basic_errno > 0)
+ g = string_append(g, 2, US": ", US strerror(addr->basic_errno));
+
+if (addr->message)
+ g = string_append(g, 2, US": ", addr->message);
+
+if (LOGGING(deliver_time))
+ g = string_append(g, 2, US" DT=", string_timediff(&addr->delivery_time));
+
+(void) string_from_gstring(g);
+
+/* Do the logging. For the message log, "routing failed" for those cases,
+just to make it clearer. */
+
+if (driver_kind)
+ deliver_msglog("%s %s failed for %s\n", now, driver_kind, g->s);
+else
+ deliver_msglog("%s %s\n", now, g->s);
+
+log_write(0, LOG_MAIN, "** %s", g->s);
+
+store_reset(reset_point);
+return;
+}
+
+
+
+/*************************************************
+* Actions at the end of handling an address *
+*************************************************/
+
+/* This is a function for processing a single address when all that can be done
+with it has been done.
+
+Arguments:
+ addr points to the address block
+ result the result of the delivery attempt
+ logflags flags for log_write() (LOG_MAIN and/or LOG_PANIC)
+ driver_type indicates which type of driver (transport, or router) was last
+ to process the address
+ logchar '=' or '-' for use when logging deliveries with => or ->
+
+Returns: nothing
+*/
+
+static void
+post_process_one(address_item *addr, int result, int logflags, int driver_type,
+ int logchar)
+{
+uschar *now = tod_stamp(tod_log);
+uschar *driver_kind = NULL;
+uschar *driver_name = NULL;
+
+DEBUG(D_deliver) debug_printf("post-process %s (%d)\n", addr->address, result);
+
+/* Set up driver kind and name for logging. Disable logging if the router or
+transport has disabled it. */
+
+if (driver_type == EXIM_DTYPE_TRANSPORT)
+ {
+ if (addr->transport)
+ {
+ driver_name = addr->transport->name;
+ driver_kind = US" transport";
+ f.disable_logging = addr->transport->disable_logging;
+ }
+ else driver_kind = US"transporting";
+ }
+else if (driver_type == EXIM_DTYPE_ROUTER)
+ {
+ if (addr->router)
+ {
+ driver_name = addr->router->name;
+ driver_kind = US" router";
+ f.disable_logging = addr->router->disable_logging;
+ }
+ else driver_kind = US"routing";
+ }
+
+/* If there's an error message set, ensure that it contains only printing
+characters - it should, but occasionally things slip in and this at least
+stops the log format from getting wrecked. We also scan the message for an LDAP
+expansion item that has a password setting, and flatten the password. This is a
+fudge, but I don't know a cleaner way of doing this. (If the item is badly
+malformed, it won't ever have gone near LDAP.) */
+
+if (addr->message)
+ {
+ const uschar * s = string_printing(addr->message);
+
+ /* deconst cast ok as string_printing known to have alloc'n'copied */
+ addr->message = expand_hide_passwords(US s);
+ }
+
+/* If we used a transport that has one of the "return_output" options set, and
+if it did in fact generate some output, then for return_output we treat the
+message as failed if it was not already set that way, so that the output gets
+returned to the sender, provided there is a sender to send it to. For
+return_fail_output, do this only if the delivery failed. Otherwise we just
+unlink the file, and remove the name so that if the delivery failed, we don't
+try to send back an empty or unwanted file. The log_output options operate only
+on a non-empty file.
+
+In any case, we close the message file, because we cannot afford to leave a
+file-descriptor for one address while processing (maybe very many) others. */
+
+if (addr->return_file >= 0 && addr->return_filename)
+ {
+ BOOL return_output = FALSE;
+ struct stat statbuf;
+ (void)EXIMfsync(addr->return_file);
+
+ /* If there is no output, do nothing. */
+
+ if (fstat(addr->return_file, &statbuf) == 0 && statbuf.st_size > 0)
+ {
+ transport_instance *tb = addr->transport;
+
+ /* Handle logging options */
+
+ if ( tb->log_output
+ || result == FAIL && tb->log_fail_output
+ || result == DEFER && tb->log_defer_output
+ )
+ {
+ uschar *s;
+ FILE *f = Ufopen(addr->return_filename, "rb");
+ if (!f)
+ log_write(0, LOG_MAIN|LOG_PANIC, "failed to open %s to log output "
+ "from %s transport: %s", addr->return_filename, tb->name,
+ strerror(errno));
+ else
+ if ((s = US Ufgets(big_buffer, big_buffer_size, f)))
+ {
+ uschar *p = big_buffer + Ustrlen(big_buffer);
+ const uschar * sp;
+ while (p > big_buffer && isspace(p[-1])) p--;
+ *p = 0;
+ sp = string_printing(big_buffer);
+ log_write(0, LOG_MAIN, "<%s>: %s transport output: %s",
+ addr->address, tb->name, sp);
+ }
+ (void)fclose(f);
+ }
+
+ /* Handle returning options, but only if there is an address to return
+ the text to. */
+
+ if (sender_address[0] != 0 || addr->prop.errors_address)
+ if (tb->return_output)
+ {
+ addr->transport_return = result = FAIL;
+ if (addr->basic_errno == 0 && !addr->message)
+ addr->message = US"return message generated";
+ return_output = TRUE;
+ }
+ else
+ if (tb->return_fail_output && result == FAIL) return_output = TRUE;
+ }
+
+ /* Get rid of the file unless it might be returned, but close it in
+ all cases. */
+
+ if (!return_output)
+ {
+ Uunlink(addr->return_filename);
+ addr->return_filename = NULL;
+ addr->return_file = -1;
+ }
+
+ (void)close(addr->return_file);
+ }
+
+/* The success case happens only after delivery by a transport. */
+
+if (result == OK)
+ {
+ addr->next = addr_succeed;
+ addr_succeed = addr;
+
+ /* Call address_done() to ensure that we don't deliver to this address again,
+ and write appropriate things to the message log. If it is a child address, we
+ call child_done() to scan the ancestors and mark them complete if this is the
+ last child to complete. */
+
+ address_done(addr, now);
+ DEBUG(D_deliver) debug_printf("%s delivered\n", addr->address);
+
+ if (!addr->parent)
+ deliver_msglog("%s %s: %s%s succeeded\n", now, addr->address,
+ driver_name, driver_kind);
+ else
+ {
+ deliver_msglog("%s %s <%s>: %s%s succeeded\n", now, addr->address,
+ addr->parent->address, driver_name, driver_kind);
+ child_done(addr, now);
+ }
+
+ /* Certificates for logging (via events) */
+#ifndef DISABLE_TLS
+ tls_out.ourcert = addr->ourcert;
+ addr->ourcert = NULL;
+ tls_out.peercert = addr->peercert;
+ addr->peercert = NULL;
+
+ tls_out.ver = addr->tlsver;
+ tls_out.cipher = addr->cipher;
+ tls_out.peerdn = addr->peerdn;
+ tls_out.ocsp = addr->ocsp;
+# ifdef SUPPORT_DANE
+ tls_out.dane_verified = testflag(addr, af_dane_verified);
+# endif
+#endif
+
+ delivery_log(LOG_MAIN, addr, logchar, NULL);
+
+#ifndef DISABLE_TLS
+ tls_free_cert(&tls_out.ourcert);
+ tls_free_cert(&tls_out.peercert);
+ tls_out.ver = NULL;
+ tls_out.cipher = NULL;
+ tls_out.peerdn = NULL;
+ tls_out.ocsp = OCSP_NOT_REQ;
+# ifdef SUPPORT_DANE
+ tls_out.dane_verified = FALSE;
+# endif
+#endif
+ }
+
+
+/* Soft failure, or local delivery process failed; freezing may be
+requested. */
+
+else if (result == DEFER || result == PANIC)
+ {
+ if (result == PANIC) logflags |= LOG_PANIC;
+
+ /* This puts them on the chain in reverse order. Do not change this, because
+ the code for handling retries assumes that the one with the retry
+ information is last. */
+
+ addr->next = addr_defer;
+ addr_defer = addr;
+
+ /* The only currently implemented special action is to freeze the
+ message. Logging of this is done later, just before the -H file is
+ updated. */
+
+ if (addr->special_action == SPECIAL_FREEZE)
+ {
+ f.deliver_freeze = TRUE;
+ deliver_frozen_at = time(NULL);
+ update_spool = TRUE;
+ }
+
+ /* If doing a 2-stage queue run, we skip writing to either the message
+ log or the main log for SMTP defers. */
+
+ if (!f.queue_2stage || addr->basic_errno != 0)
+ deferral_log(addr, now, logflags, driver_name, driver_kind);
+ }
+
+
+/* Hard failure. If there is an address to which an error message can be sent,
+put this address on the failed list. If not, put it on the deferred list and
+freeze the mail message for human attention. The latter action can also be
+explicitly requested by a router or transport. */
+
+else
+ {
+ /* If this is a delivery error, or a message for which no replies are
+ wanted, and the message's age is greater than ignore_bounce_errors_after,
+ force the af_ignore_error flag. This will cause the address to be discarded
+ later (with a log entry). */
+
+ if (!*sender_address && message_age >= ignore_bounce_errors_after)
+ addr->prop.ignore_error = TRUE;
+
+ /* Freeze the message if requested, or if this is a bounce message (or other
+ message with null sender) and this address does not have its own errors
+ address. However, don't freeze if errors are being ignored. The actual code
+ to ignore occurs later, instead of sending a message. Logging of freezing
+ occurs later, just before writing the -H file. */
+
+ if ( !addr->prop.ignore_error
+ && ( addr->special_action == SPECIAL_FREEZE
+ || (sender_address[0] == 0 && !addr->prop.errors_address)
+ ) )
+ {
+ frozen_info = addr->special_action == SPECIAL_FREEZE
+ ? US""
+ : f.sender_local && !f.local_error_message
+ ? US" (message created with -f <>)"
+ : US" (delivery error message)";
+ f.deliver_freeze = TRUE;
+ deliver_frozen_at = time(NULL);
+ update_spool = TRUE;
+
+ /* The address is put on the defer rather than the failed queue, because
+ the message is being retained. */
+
+ addr->next = addr_defer;
+ addr_defer = addr;
+ }
+
+ /* Don't put the address on the nonrecipients tree yet; wait until an
+ error message has been successfully sent. */
+
+ else
+ {
+ addr->next = addr_failed;
+ addr_failed = addr;
+ }
+
+ failure_log(addr, driver_name ? NULL : driver_kind, now);
+ }
+
+/* Ensure logging is turned on again in all cases */
+
+f.disable_logging = FALSE;
+}
+
+
+
+
+/*************************************************
+* Address-independent error *
+*************************************************/
+
+/* This function is called when there's an error that is not dependent on a
+particular address, such as an expansion string failure. It puts the error into
+all the addresses in a batch, logs the incident on the main and panic logs, and
+clears the expansions. It is mostly called from local_deliver(), but can be
+called for a remote delivery via findugid().
+
+Arguments:
+ logit TRUE if (MAIN+PANIC) logging required
+ addr the first of the chain of addresses
+ code the error code
+ format format string for error message, or NULL if already set in addr
+ ... arguments for the format
+
+Returns: nothing
+*/
+
+static void
+common_error(BOOL logit, address_item *addr, int code, uschar *format, ...)
+{
+addr->basic_errno = code;
+
+if (format)
+ {
+ va_list ap;
+ gstring * g;
+
+ va_start(ap, format);
+ g = string_vformat(NULL, SVFMT_EXTEND|SVFMT_REBUFFER, CS format, ap);
+ va_end(ap);
+ addr->message = string_from_gstring(g);
+ }
+
+for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next)
+ {
+ addr2->basic_errno = code;
+ addr2->message = addr->message;
+ }
+
+if (logit) log_write(0, LOG_MAIN|LOG_PANIC, "%s", addr->message);
+deliver_set_expansions(NULL);
+}
+
+
+
+
+/*************************************************
+* Check a "never users" list *
+*************************************************/
+
+/* This function is called to check whether a uid is on one of the two "never
+users" lists.
+
+Arguments:
+ uid the uid to be checked
+ nusers the list to be scanned; the first item in the list is the count
+
+Returns: TRUE if the uid is on the list
+*/
+
+static BOOL
+check_never_users(uid_t uid, uid_t *nusers)
+{
+if (!nusers) return FALSE;
+for (int i = 1; i <= (int)(nusers[0]); i++) if (nusers[i] == uid) return TRUE;
+return FALSE;
+}
+
+
+
+/*************************************************
+* Find uid and gid for a transport *
+*************************************************/
+
+/* This function is called for both local and remote deliveries, to find the
+uid/gid under which to run the delivery. The values are taken preferentially
+from the transport (either explicit or deliver_as_creator), then from the
+address (i.e. the router), and if nothing is set, the exim uid/gid are used. If
+the resulting uid is on the "never_users" or the "fixed_never_users" list, a
+panic error is logged, and the function fails (which normally leads to delivery
+deferral).
+
+Arguments:
+ addr the address (possibly a chain)
+ tp the transport
+ uidp pointer to uid field
+ gidp pointer to gid field
+ igfp pointer to the use_initgroups field
+
+Returns: FALSE if failed - error has been set in address(es)
+*/
+
+static BOOL
+findugid(address_item *addr, transport_instance *tp, uid_t *uidp, gid_t *gidp,
+ BOOL *igfp)
+{
+uschar *nuname;
+BOOL gid_set = FALSE;
+
+/* Default initgroups flag comes from the transport */
+
+*igfp = tp->initgroups;
+
+/* First see if there's a gid on the transport, either fixed or expandable.
+The expanding function always logs failure itself. */
+
+if (tp->gid_set)
+ {
+ *gidp = tp->gid;
+ gid_set = TRUE;
+ }
+else if (tp->expand_gid)
+ {
+ if (!route_find_expanded_group(tp->expand_gid, tp->name, US"transport", gidp,
+ &(addr->message)))
+ {
+ common_error(FALSE, addr, ERRNO_GIDFAIL, NULL);
+ return FALSE;
+ }
+ gid_set = TRUE;
+ }
+
+/* If the transport did not set a group, see if the router did. */
+
+if (!gid_set && testflag(addr, af_gid_set))
+ {
+ *gidp = addr->gid;
+ gid_set = TRUE;
+ }
+
+/* Pick up a uid from the transport if one is set. */
+
+if (tp->uid_set) *uidp = tp->uid;
+
+/* Otherwise, try for an expandable uid field. If it ends up as a numeric id,
+it does not provide a passwd value from which a gid can be taken. */
+
+else if (tp->expand_uid)
+ {
+ struct passwd *pw;
+ if (!route_find_expanded_user(tp->expand_uid, tp->name, US"transport", &pw,
+ uidp, &(addr->message)))
+ {
+ common_error(FALSE, addr, ERRNO_UIDFAIL, NULL);
+ return FALSE;
+ }
+ if (!gid_set && pw)
+ {
+ *gidp = pw->pw_gid;
+ gid_set = TRUE;
+ }
+ }
+
+/* If the transport doesn't set the uid, test the deliver_as_creator flag. */
+
+else if (tp->deliver_as_creator)
+ {
+ *uidp = originator_uid;
+ if (!gid_set)
+ {
+ *gidp = originator_gid;
+ gid_set = TRUE;
+ }
+ }
+
+/* Otherwise see if the address specifies the uid and if so, take it and its
+initgroups flag. */
+
+else if (testflag(addr, af_uid_set))
+ {
+ *uidp = addr->uid;
+ *igfp = testflag(addr, af_initgroups);
+ }
+
+/* Nothing has specified the uid - default to the Exim user, and group if the
+gid is not set. */
+
+else
+ {
+ *uidp = exim_uid;
+ if (!gid_set)
+ {
+ *gidp = exim_gid;
+ gid_set = TRUE;
+ }
+ }
+
+/* If no gid is set, it is a disaster. We default to the Exim gid only if
+defaulting to the Exim uid. In other words, if the configuration has specified
+a uid, it must also provide a gid. */
+
+if (!gid_set)
+ {
+ common_error(TRUE, addr, ERRNO_GIDFAIL, US"User set without group for "
+ "%s transport", tp->name);
+ return FALSE;
+ }
+
+/* Check that the uid is not on the lists of banned uids that may not be used
+for delivery processes. */
+
+nuname = check_never_users(*uidp, never_users)
+ ? US"never_users"
+ : check_never_users(*uidp, fixed_never_users)
+ ? US"fixed_never_users"
+ : NULL;
+if (nuname)
+ {
+ common_error(TRUE, addr, ERRNO_UIDFAIL, US"User %ld set for %s transport "
+ "is on the %s list", (long int)(*uidp), tp->name, nuname);
+ return FALSE;
+ }
+
+/* All is well */
+
+return TRUE;
+}
+
+
+
+
+/*************************************************
+* Check the size of a message for a transport *
+*************************************************/
+
+/* Checks that the message isn't too big for the selected transport.
+This is called only when it is known that the limit is set.
+
+Arguments:
+ tp the transport
+ addr the (first) address being delivered
+
+Returns: OK
+ DEFER expansion failed or did not yield an integer
+ FAIL message too big
+*/
+
+int
+check_message_size(transport_instance *tp, address_item *addr)
+{
+int rc = OK;
+int size_limit;
+
+deliver_set_expansions(addr);
+size_limit = expand_string_integer(tp->message_size_limit, TRUE);
+deliver_set_expansions(NULL);
+
+if (expand_string_message)
+ {
+ rc = DEFER;
+ addr->message = size_limit == -1
+ ? string_sprintf("failed to expand message_size_limit "
+ "in %s transport: %s", tp->name, expand_string_message)
+ : string_sprintf("invalid message_size_limit "
+ "in %s transport: %s", tp->name, expand_string_message);
+ }
+else if (size_limit > 0 && message_size > size_limit)
+ {
+ rc = FAIL;
+ addr->message =
+ string_sprintf("message is too big (transport limit = %d)",
+ size_limit);
+ }
+
+return rc;
+}
+
+
+
+/*************************************************
+* Transport-time check for a previous delivery *
+*************************************************/
+
+/* Check that this base address hasn't previously been delivered to its routed
+transport. If it has been delivered, mark it done. The check is necessary at
+delivery time in order to handle homonymic addresses correctly in cases where
+the pattern of redirection changes between delivery attempts (so the unique
+fields change). Non-homonymic previous delivery is detected earlier, at routing
+time (which saves unnecessary routing).
+
+Arguments:
+ addr the address item
+ testing TRUE if testing wanted only, without side effects
+
+Returns: TRUE if previously delivered by the transport
+*/
+
+static BOOL
+previously_transported(address_item *addr, BOOL testing)
+{
+uschar * s = string_sprintf("%s/%s",
+ addr->unique + (testflag(addr, af_homonym)? 3:0), addr->transport->name);
+
+if (tree_search(tree_nonrecipients, s) != 0)
+ {
+ DEBUG(D_deliver|D_route|D_transport)
+ debug_printf("%s was previously delivered (%s transport): discarded\n",
+ addr->address, addr->transport->name);
+ if (!testing) child_done(addr, tod_stamp(tod_log));
+ return TRUE;
+ }
+
+return FALSE;
+}
+
+
+
+/******************************************************
+* Check for a given header in a header string *
+******************************************************/
+
+/* This function is used when generating quota warnings. The configuration may
+specify any header lines it likes in quota_warn_message. If certain of them are
+missing, defaults are inserted, so we need to be able to test for the presence
+of a given header.
+
+Arguments:
+ hdr the required header name
+ hstring the header string
+
+Returns: TRUE the header is in the string
+ FALSE the header is not in the string
+*/
+
+static BOOL
+contains_header(uschar *hdr, uschar *hstring)
+{
+int len = Ustrlen(hdr);
+uschar *p = hstring;
+while (*p != 0)
+ {
+ if (strncmpic(p, hdr, len) == 0)
+ {
+ p += len;
+ while (*p == ' ' || *p == '\t') p++;
+ if (*p == ':') return TRUE;
+ }
+ while (*p != 0 && *p != '\n') p++;
+ if (*p == '\n') p++;
+ }
+return FALSE;
+}
+
+
+
+
+/*************************************************
+* Perform a local delivery *
+*************************************************/
+
+/* Each local delivery is performed in a separate process which sets its
+uid and gid as specified. This is a safer way than simply changing and
+restoring using seteuid(); there is a body of opinion that seteuid()
+cannot be used safely. From release 4, Exim no longer makes any use of
+it for delivery. Besides, not all systems have seteuid().
+
+If the uid/gid are specified in the transport_instance, they are used; the
+transport initialization must ensure that either both or neither are set.
+Otherwise, the values associated with the address are used. If neither are set,
+it is a configuration error.
+
+The transport or the address may specify a home directory (transport over-
+rides), and if they do, this is set as $home. If neither have set a working
+directory, this value is used for that as well. Otherwise $home is left unset
+and the cwd is set to "/" - a directory that should be accessible to all users.
+
+Using a separate process makes it more complicated to get error information
+back. We use a pipe to pass the return code and also an error code and error
+text string back to the parent process.
+
+Arguments:
+ addr points to an address block for this delivery; for "normal" local
+ deliveries this is the only address to be delivered, but for
+ pseudo-remote deliveries (e.g. by batch SMTP to a file or pipe)
+ a number of addresses can be handled simultaneously, and in this
+ case addr will point to a chain of addresses with the same
+ characteristics.
+
+ shadowing TRUE if running a shadow transport; this causes output from pipes
+ to be ignored.
+
+Returns: nothing
+*/
+
+static void
+deliver_local(address_item *addr, BOOL shadowing)
+{
+BOOL use_initgroups;
+uid_t uid;
+gid_t gid;
+int status, len, rc;
+int pfd[2];
+pid_t pid;
+uschar *working_directory;
+address_item *addr2;
+transport_instance *tp = addr->transport;
+
+/* Set up the return path from the errors or sender address. If the transport
+has its own return path setting, expand it and replace the existing value. */
+
+if(addr->prop.errors_address)
+ return_path = addr->prop.errors_address;
+#ifdef EXPERIMENTAL_SRS
+else if (addr->prop.srs_sender)
+ return_path = addr->prop.srs_sender;
+#endif
+else
+ return_path = sender_address;
+
+if (tp->return_path)
+ {
+ uschar *new_return_path = expand_string(tp->return_path);
+ if (!new_return_path)
+ {
+ if (!f.expand_string_forcedfail)
+ {
+ common_error(TRUE, addr, ERRNO_EXPANDFAIL,
+ US"Failed to expand return path \"%s\" in %s transport: %s",
+ tp->return_path, tp->name, expand_string_message);
+ return;
+ }
+ }
+ else return_path = new_return_path;
+ }
+
+/* For local deliveries, one at a time, the value used for logging can just be
+set directly, once and for all. */
+
+used_return_path = return_path;
+
+/* Sort out the uid, gid, and initgroups flag. If an error occurs, the message
+gets put into the address(es), and the expansions are unset, so we can just
+return. */
+
+if (!findugid(addr, tp, &uid, &gid, &use_initgroups)) return;
+
+/* See if either the transport or the address specifies a home directory. A
+home directory set in the address may already be expanded; a flag is set to
+indicate that. In other cases we must expand it. */
+
+if ( (deliver_home = tp->home_dir) /* Set in transport, or */
+ || ( (deliver_home = addr->home_dir) /* Set in address and */
+ && !testflag(addr, af_home_expanded) /* not expanded */
+ ) )
+ {
+ uschar *rawhome = deliver_home;
+ deliver_home = NULL; /* in case it contains $home */
+ if (!(deliver_home = expand_string(rawhome)))
+ {
+ common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"home directory \"%s\" failed "
+ "to expand for %s transport: %s", rawhome, tp->name,
+ expand_string_message);
+ return;
+ }
+ if (*deliver_home != '/')
+ {
+ common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"home directory path \"%s\" "
+ "is not absolute for %s transport", deliver_home, tp->name);
+ return;
+ }
+ }
+
+/* See if either the transport or the address specifies a current directory,
+and if so, expand it. If nothing is set, use the home directory, unless it is
+also unset in which case use "/", which is assumed to be a directory to which
+all users have access. It is necessary to be in a visible directory for some
+operating systems when running pipes, as some commands (e.g. "rm" under Solaris
+2.5) require this. */
+
+working_directory = tp->current_dir ? tp->current_dir : addr->current_dir;
+if (working_directory)
+ {
+ uschar *raw = working_directory;
+ if (!(working_directory = expand_string(raw)))
+ {
+ common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"current directory \"%s\" "
+ "failed to expand for %s transport: %s", raw, tp->name,
+ expand_string_message);
+ return;
+ }
+ if (*working_directory != '/')
+ {
+ common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"current directory path "
+ "\"%s\" is not absolute for %s transport", working_directory, tp->name);
+ return;
+ }
+ }
+else working_directory = deliver_home ? deliver_home : US"/";
+
+/* If one of the return_output flags is set on the transport, create and open a
+file in the message log directory for the transport to write its output onto.
+This is mainly used by pipe transports. The file needs to be unique to the
+address. This feature is not available for shadow transports. */
+
+if ( !shadowing
+ && ( tp->return_output || tp->return_fail_output
+ || tp->log_output || tp->log_fail_output || tp->log_defer_output
+ ) )
+ {
+ uschar * error;
+
+ addr->return_filename =
+ spool_fname(US"msglog", message_subdir, message_id,
+ string_sprintf("-%d-%d", getpid(), return_count++));
+
+ if ((addr->return_file = open_msglog_file(addr->return_filename, 0400, &error)) < 0)
+ {
+ common_error(TRUE, addr, errno, US"Unable to %s file for %s transport "
+ "to return message: %s", error, tp->name, strerror(errno));
+ return;
+ }
+ }
+
+/* Create the pipe for inter-process communication. */
+
+if (pipe(pfd) != 0)
+ {
+ common_error(TRUE, addr, ERRNO_PIPEFAIL, US"Creation of pipe failed: %s",
+ strerror(errno));
+ return;
+ }
+
+/* Now fork the process to do the real work in the subprocess, but first
+ensure that all cached resources are freed so that the subprocess starts with
+a clean slate and doesn't interfere with the parent process. */
+
+search_tidyup();
+
+if ((pid = exim_fork(US"delivery-local")) == 0)
+ {
+ BOOL replicate = TRUE;
+
+ /* Prevent core dumps, as we don't want them in users' home directories.
+ HP-UX doesn't have RLIMIT_CORE; I don't know how to do this in that
+ system. Some experimental/developing systems (e.g. GNU/Hurd) may define
+ RLIMIT_CORE but not support it in setrlimit(). For such systems, do not
+ complain if the error is "not supported".
+
+ There are two scenarios where changing the max limit has an effect. In one,
+ the user is using a .forward and invoking a command of their choice via pipe;
+ for these, we do need the max limit to be 0 unless the admin chooses to
+ permit an increased limit. In the other, the command is invoked directly by
+ the transport and is under administrator control, thus being able to raise
+ the limit aids in debugging. So there's no general always-right answer.
+
+ Thus we inhibit core-dumps completely but let individual transports, while
+ still root, re-raise the limits back up to aid debugging. We make the
+ default be no core-dumps -- few enough people can use core dumps in
+ diagnosis that it's reasonable to make them something that has to be explicitly requested.
+ */
+
+#ifdef RLIMIT_CORE
+ struct rlimit rl;
+ rl.rlim_cur = 0;
+ rl.rlim_max = 0;
+ if (setrlimit(RLIMIT_CORE, &rl) < 0)
+ {
+# ifdef SETRLIMIT_NOT_SUPPORTED
+ if (errno != ENOSYS && errno != ENOTSUP)
+# endif
+ log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_CORE) failed: %s",
+ strerror(errno));
+ }
+#endif
+
+ /* Reset the random number generator, so different processes don't all
+ have the same sequence. */
+
+ random_seed = 0;
+
+ /* If the transport has a setup entry, call this first, while still
+ privileged. (Appendfile uses this to expand quota, for example, while
+ able to read private files.) */
+
+ if (addr->transport->setup)
+ switch((addr->transport->setup)(addr->transport, addr, NULL, uid, gid,
+ &(addr->message)))
+ {
+ case DEFER:
+ addr->transport_return = DEFER;
+ goto PASS_BACK;
+
+ case FAIL:
+ addr->transport_return = PANIC;
+ goto PASS_BACK;
+ }
+
+ /* Ignore SIGINT and SIGTERM during delivery. Also ignore SIGUSR1, as
+ when the process becomes unprivileged, it won't be able to write to the
+ process log. SIGHUP is ignored throughout exim, except when it is being
+ run as a daemon. */
+
+ signal(SIGINT, SIG_IGN);
+ signal(SIGTERM, SIG_IGN);
+ signal(SIGUSR1, SIG_IGN);
+
+ /* Close the unwanted half of the pipe, and set close-on-exec for the other
+ half - for transports that exec things (e.g. pipe). Then set the required
+ gid/uid. */
+
+ (void)close(pfd[pipe_read]);
+ (void)fcntl(pfd[pipe_write], F_SETFD, fcntl(pfd[pipe_write], F_GETFD) |
+ FD_CLOEXEC);
+ exim_setugid(uid, gid, use_initgroups,
+ string_sprintf("local delivery to %s <%s> transport=%s", addr->local_part,
+ addr->address, addr->transport->name));
+
+ DEBUG(D_deliver)
+ {
+ debug_printf(" home=%s current=%s\n", deliver_home, working_directory);
+ for (address_item * batched = addr->next; batched; batched = batched->next)
+ debug_printf("additional batched address: %s\n", batched->address);
+ }
+
+ /* Set an appropriate working directory. */
+
+ if (Uchdir(working_directory) < 0)
+ {
+ addr->transport_return = DEFER;
+ addr->basic_errno = errno;
+ addr->message = string_sprintf("failed to chdir to %s", working_directory);
+ }
+
+ /* If successful, call the transport */
+
+ else
+ {
+ BOOL ok = TRUE;
+ set_process_info("delivering %s to %s using %s", message_id,
+ addr->local_part, addr->transport->name);
+
+ /* Setting this global in the subprocess means we need never clear it */
+ transport_name = addr->transport->name;
+
+ /* If a transport filter has been specified, set up its argument list.
+ Any errors will get put into the address, and FALSE yielded. */
+
+ if (addr->transport->filter_command)
+ {
+ ok = transport_set_up_command(&transport_filter_argv,
+ addr->transport->filter_command,
+ TRUE, PANIC, addr, US"transport filter", NULL);
+ transport_filter_timeout = addr->transport->filter_timeout;
+ }
+ else transport_filter_argv = NULL;
+
+ if (ok)
+ {
+ debug_print_string(addr->transport->debug_string);
+ replicate = !(addr->transport->info->code)(addr->transport, addr);
+ }
+ }
+
+ /* Pass the results back down the pipe. If necessary, first replicate the
+ status in the top address to the others in the batch. The label is the
+ subject of a goto when a call to the transport's setup function fails. We
+ pass the pointer to the transport back in case it got changed as a result of
+ file_format in appendfile. */
+
+ PASS_BACK:
+
+ if (replicate) replicate_status(addr);
+ for (addr2 = addr; addr2; addr2 = addr2->next)
+ {
+ int i;
+ int local_part_length = Ustrlen(addr2->local_part);
+ uschar *s;
+ int ret;
+
+ if( (ret = write(pfd[pipe_write], &addr2->transport_return, sizeof(int))) != sizeof(int)
+ || (ret = write(pfd[pipe_write], &transport_count, sizeof(transport_count))) != sizeof(transport_count)
+ || (ret = write(pfd[pipe_write], &addr2->flags, sizeof(addr2->flags))) != sizeof(addr2->flags)
+ || (ret = write(pfd[pipe_write], &addr2->basic_errno, sizeof(int))) != sizeof(int)
+ || (ret = write(pfd[pipe_write], &addr2->more_errno, sizeof(int))) != sizeof(int)
+ || (ret = write(pfd[pipe_write], &addr2->delivery_time, sizeof(struct timeval))) != sizeof(struct timeval)
+ || (ret = write(pfd[pipe_write], &addr2->special_action, sizeof(int))) != sizeof(int)
+ || (ret = write(pfd[pipe_write], &addr2->transport,
+ sizeof(transport_instance *))) != sizeof(transport_instance *)
+
+ /* For a file delivery, pass back the local part, in case the original
+ was only part of the final delivery path. This gives more complete
+ logging. */
+
+ || (testflag(addr2, af_file)
+ && ( (ret = write(pfd[pipe_write], &local_part_length, sizeof(int))) != sizeof(int)
+ || (ret = write(pfd[pipe_write], addr2->local_part, local_part_length)) != local_part_length
+ )
+ )
+ )
+ log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s",
+ ret == -1 ? strerror(errno) : "short write");
+
+ /* Now any messages */
+
+ for (i = 0, s = addr2->message; i < 2; i++, s = addr2->user_message)
+ {
+ int message_length = s ? Ustrlen(s) + 1 : 0;
+ if( (ret = write(pfd[pipe_write], &message_length, sizeof(int))) != sizeof(int)
+ || message_length > 0 && (ret = write(pfd[pipe_write], s, message_length)) != message_length
+ )
+ log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s",
+ ret == -1 ? strerror(errno) : "short write");
+ }
+ }
+
+ /* OK, this process is now done. Free any cached resources that it opened,
+ and close the pipe we were writing down before exiting. */
+
+ (void)close(pfd[pipe_write]);
+ search_tidyup();
+ exit(EXIT_SUCCESS);
+ }
+
+/* Back in the main process: panic if the fork did not succeed. This seems
+better than returning an error - if forking is failing it is probably best
+not to try other deliveries for this message. */
+
+if (pid < 0)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Fork failed for local delivery to %s",
+ addr->address);
+
+/* Read the pipe to get the delivery status codes and error messages. Our copy
+of the writing end must be closed first, as otherwise read() won't return zero
+on an empty pipe. We check that a status exists for each address before
+overwriting the address structure. If data is missing, the default DEFER status
+will remain. Afterwards, close the reading end. */
+
+(void)close(pfd[pipe_write]);
+
+for (addr2 = addr; addr2; addr2 = addr2->next)
+ {
+ if ((len = read(pfd[pipe_read], &status, sizeof(int))) > 0)
+ {
+ int i;
+ uschar **sptr;
+
+ addr2->transport_return = status;
+ len = read(pfd[pipe_read], &transport_count,
+ sizeof(transport_count));
+ len = read(pfd[pipe_read], &addr2->flags, sizeof(addr2->flags));
+ len = read(pfd[pipe_read], &addr2->basic_errno, sizeof(int));
+ len = read(pfd[pipe_read], &addr2->more_errno, sizeof(int));
+ len = read(pfd[pipe_read], &addr2->delivery_time, sizeof(struct timeval));
+ len = read(pfd[pipe_read], &addr2->special_action, sizeof(int));
+ len = read(pfd[pipe_read], &addr2->transport,
+ sizeof(transport_instance *));
+
+ if (testflag(addr2, af_file))
+ {
+ int llen;
+ if ( read(pfd[pipe_read], &llen, sizeof(int)) != sizeof(int)
+ || llen > 64*4 /* limit from rfc 5821, times I18N factor */
+ )
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC, "bad local_part length read"
+ " from delivery subprocess");
+ break;
+ }
+ /* sanity-checked llen so disable the Coverity error */
+ /* coverity[tainted_data] */
+ if (read(pfd[pipe_read], big_buffer, llen) != llen)
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC, "bad local_part read"
+ " from delivery subprocess");
+ break;
+ }
+ big_buffer[llen] = 0;
+ addr2->local_part = string_copy(big_buffer);
+ }
+
+ for (i = 0, sptr = &addr2->message; i < 2; i++, sptr = &addr2->user_message)
+ {
+ int message_length;
+ len = read(pfd[pipe_read], &message_length, sizeof(int));
+ if (message_length > 0)
+ {
+ len = read(pfd[pipe_read], big_buffer, message_length);
+ big_buffer[big_buffer_size-1] = '\0'; /* guard byte */
+ if (len > 0) *sptr = string_copy(big_buffer);
+ }
+ }
+ }
+
+ else
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC, "failed to read delivery status for %s "
+ "from delivery subprocess", addr2->unique);
+ break;
+ }
+ }
+
+(void)close(pfd[pipe_read]);
+
+/* Unless shadowing, write all successful addresses immediately to the journal
+file, to ensure they are recorded asap. For homonymic addresses, use the base
+address plus the transport name. Failure to write the journal is panic-worthy,
+but don't stop, as it may prove possible subsequently to update the spool file
+in order to record the delivery. */
+
+if (!shadowing)
+ {
+ for (addr2 = addr; addr2; addr2 = addr2->next)
+ if (addr2->transport_return == OK)
+ {
+ if (testflag(addr2, af_homonym))
+ sprintf(CS big_buffer, "%.500s/%s\n", addr2->unique + 3, tp->name);
+ else
+ sprintf(CS big_buffer, "%.500s\n", addr2->unique);
+
+ /* In the test harness, wait just a bit to let the subprocess finish off
+ any debug output etc first. */
+
+ testharness_pause_ms(300);
+
+ DEBUG(D_deliver) debug_printf("journalling %s", big_buffer);
+ len = Ustrlen(big_buffer);
+ if (write(journal_fd, big_buffer, len) != len)
+ log_write(0, LOG_MAIN|LOG_PANIC, "failed to update journal for %s: %s",
+ big_buffer, strerror(errno));
+ }
+
+ /* Ensure the journal file is pushed out to disk. */
+
+ if (EXIMfsync(journal_fd) < 0)
+ log_write(0, LOG_MAIN|LOG_PANIC, "failed to fsync journal: %s",
+ strerror(errno));
+ }
+
+/* Wait for the process to finish. If it terminates with a non-zero code,
+freeze the message (except for SIGTERM, SIGKILL and SIGQUIT), but leave the
+status values of all the addresses as they are. Take care to handle the case
+when the subprocess doesn't seem to exist. This has been seen on one system
+when Exim was called from an MUA that set SIGCHLD to SIG_IGN. When that
+happens, wait() doesn't recognize the termination of child processes. Exim now
+resets SIGCHLD to SIG_DFL, but this code should still be robust. */
+
+while ((rc = wait(&status)) != pid)
+ if (rc < 0 && errno == ECHILD) /* Process has vanished */
+ {
+ log_write(0, LOG_MAIN, "%s transport process vanished unexpectedly",
+ addr->transport->driver_name);
+ status = 0;
+ break;
+ }
+
+if ((status & 0xffff) != 0)
+ {
+ int msb = (status >> 8) & 255;
+ int lsb = status & 255;
+ int code = (msb == 0)? (lsb & 0x7f) : msb;
+ if (msb != 0 || (code != SIGTERM && code != SIGKILL && code != SIGQUIT))
+ addr->special_action = SPECIAL_FREEZE;
+ log_write(0, LOG_MAIN|LOG_PANIC, "%s transport process returned non-zero "
+ "status 0x%04x: %s %d",
+ addr->transport->driver_name,
+ status,
+ msb == 0 ? "terminated by signal" : "exit code",
+ code);
+ }
+
+/* If SPECIAL_WARN is set in the top address, send a warning message. */
+
+if (addr->special_action == SPECIAL_WARN && addr->transport->warn_message)
+ {
+ int fd;
+ uschar *warn_message;
+ pid_t pid;
+
+ DEBUG(D_deliver) debug_printf("Warning message requested by transport\n");
+
+ if (!(warn_message = expand_string(addr->transport->warn_message)))
+ log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand \"%s\" (warning "
+ "message for %s transport): %s", addr->transport->warn_message,
+ addr->transport->name, expand_string_message);
+
+ else if ((pid = child_open_exim(&fd, US"tpt-warning-message")) > 0)
+ {
+ FILE *f = fdopen(fd, "wb");
+ if (errors_reply_to && !contains_header(US"Reply-To", warn_message))
+ fprintf(f, "Reply-To: %s\n", errors_reply_to);
+ fprintf(f, "Auto-Submitted: auto-replied\n");
+ if (!contains_header(US"From", warn_message))
+ moan_write_from(f);
+ fprintf(f, "%s", CS warn_message);
+
+ /* Close and wait for child process to complete, without a timeout. */
+
+ (void)fclose(f);
+ (void)child_close(pid, 0);
+ }
+
+ addr->special_action = SPECIAL_NONE;
+ }
+}
+
+
+
+
+/* Check transport for the given concurrency limit. Return TRUE if over
+the limit (or an expansion failure), else FALSE and if there was a limit,
+the key for the hints database used for the concurrency count. */
+
+static BOOL
+tpt_parallel_check(transport_instance * tp, address_item * addr, uschar ** key)
+{
+unsigned max_parallel;
+
+if (!tp->max_parallel) return FALSE;
+
+max_parallel = (unsigned) expand_string_integer(tp->max_parallel, TRUE);
+if (expand_string_message)
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand max_parallel option "
+ "in %s transport (%s): %s", tp->name, addr->address,
+ expand_string_message);
+ return TRUE;
+ }
+
+if (max_parallel > 0)
+ {
+ uschar * serialize_key = string_sprintf("tpt-serialize-%s", tp->name);
+ if (!enq_start(serialize_key, max_parallel))
+ {
+ address_item * next;
+ DEBUG(D_transport)
+ debug_printf("skipping tpt %s because concurrency limit %u reached\n",
+ tp->name, max_parallel);
+ do
+ {
+ next = addr->next;
+ addr->message = US"concurrency limit reached for transport";
+ addr->basic_errno = ERRNO_TRETRY;
+ post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_TRANSPORT, 0);
+ } while ((addr = next));
+ return TRUE;
+ }
+ *key = serialize_key;
+ }
+return FALSE;
+}
+
+
+
+/*************************************************
+* Do local deliveries *
+*************************************************/
+
+/* This function processes the list of addresses in addr_local. True local
+deliveries are always done one address at a time. However, local deliveries can
+be batched up in some cases. Typically this is when writing batched SMTP output
+files for use by some external transport mechanism, or when running local
+deliveries over LMTP.
+
+Arguments: None
+Returns: Nothing
+*/
+
+static void
+do_local_deliveries(void)
+{
+open_db dbblock;
+open_db *dbm_file = NULL;
+time_t now = time(NULL);
+
+/* Loop until we have exhausted the supply of local deliveries */
+
+while (addr_local)
+ {
+ struct timeval delivery_start;
+ struct timeval deliver_time;
+ address_item *addr2, *addr3, *nextaddr;
+ int logflags = LOG_MAIN;
+ int logchar = f.dont_deliver? '*' : '=';
+ transport_instance *tp;
+ uschar * serialize_key = NULL;
+
+ /* Pick the first undelivered address off the chain */
+
+ address_item *addr = addr_local;
+ addr_local = addr->next;
+ addr->next = NULL;
+
+ DEBUG(D_deliver|D_transport)
+ debug_printf("--------> %s <--------\n", addr->address);
+
+ /* An internal disaster if there is no transport. Should not occur! */
+
+ if (!(tp = addr->transport))
+ {
+ logflags |= LOG_PANIC;
+ f.disable_logging = FALSE; /* Jic */
+ addr->message = addr->router
+ ? string_sprintf("No transport set by %s router", addr->router->name)
+ : US"No transport set by system filter";
+ post_process_one(addr, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0);
+ continue;
+ }
+
+ /* Check that this base address hasn't previously been delivered to this
+ transport. The check is necessary at this point to handle homonymic addresses
+ correctly in cases where the pattern of redirection changes between delivery
+ attempts. Non-homonymic previous delivery is detected earlier, at routing
+ time. */
+
+ if (previously_transported(addr, FALSE)) continue;
+
+ /* There are weird cases where logging is disabled */
+
+ f.disable_logging = tp->disable_logging;
+
+ /* Check for batched addresses and possible amalgamation. Skip all the work
+ if either batch_max <= 1 or there aren't any other addresses for local
+ delivery. */
+
+ if (tp->batch_max > 1 && addr_local)
+ {
+ int batch_count = 1;
+ BOOL uses_dom = readconf_depends((driver_instance *)tp, US"domain");
+ BOOL uses_lp = ( testflag(addr, af_pfr)
+ && (testflag(addr, af_file) || addr->local_part[0] == '|')
+ )
+ || readconf_depends((driver_instance *)tp, US"local_part");
+ uschar *batch_id = NULL;
+ address_item **anchor = &addr_local;
+ address_item *last = addr;
+ address_item *next;
+
+ /* Expand the batch_id string for comparison with other addresses.
+ Expansion failure suppresses batching. */
+
+ if (tp->batch_id)
+ {
+ deliver_set_expansions(addr);
+ batch_id = expand_string(tp->batch_id);
+ deliver_set_expansions(NULL);
+ if (!batch_id)
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
+ "in %s transport (%s): %s", tp->name, addr->address,
+ expand_string_message);
+ batch_count = tp->batch_max;
+ }
+ }
+
+ /* Until we reach the batch_max limit, pick off addresses which have the
+ same characteristics. These are:
+
+ same transport
+ not previously delivered (see comment about 50 lines above)
+ same local part if the transport's configuration contains $local_part
+ or if this is a file or pipe delivery from a redirection
+ same domain if the transport's configuration contains $domain
+ same errors address
+ same additional headers
+ same headers to be removed
+ same uid/gid for running the transport
+ same first host if a host list is set
+ */
+
+ while ((next = *anchor) && batch_count < tp->batch_max)
+ {
+ BOOL ok =
+ tp == next->transport
+ && !previously_transported(next, TRUE)
+ && testflag(addr, af_pfr) == testflag(next, af_pfr)
+ && testflag(addr, af_file) == testflag(next, af_file)
+ && (!uses_lp || Ustrcmp(next->local_part, addr->local_part) == 0)
+ && (!uses_dom || Ustrcmp(next->domain, addr->domain) == 0)
+ && same_strings(next->prop.errors_address, addr->prop.errors_address)
+ && same_headers(next->prop.extra_headers, addr->prop.extra_headers)
+ && same_strings(next->prop.remove_headers, addr->prop.remove_headers)
+ && same_ugid(tp, addr, next)
+ && ( !addr->host_list && !next->host_list
+ || addr->host_list
+ && next->host_list
+ && Ustrcmp(addr->host_list->name, next->host_list->name) == 0
+ );
+
+ /* If the transport has a batch_id setting, batch_id will be non-NULL
+ from the expansion outside the loop. Expand for this address and compare.
+ Expansion failure makes this address ineligible for batching. */
+
+ if (ok && batch_id)
+ {
+ uschar *bid;
+ address_item *save_nextnext = next->next;
+ next->next = NULL; /* Expansion for a single address */
+ deliver_set_expansions(next);
+ next->next = save_nextnext;
+ bid = expand_string(tp->batch_id);
+ deliver_set_expansions(NULL);
+ if (!bid)
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
+ "in %s transport (%s): %s", tp->name, next->address,
+ expand_string_message);
+ ok = FALSE;
+ }
+ else ok = (Ustrcmp(batch_id, bid) == 0);
+ }
+
+ /* Take address into batch if OK. */
+
+ if (ok)
+ {
+ *anchor = next->next; /* Include the address */
+ next->next = NULL;
+ last->next = next;
+ last = next;
+ batch_count++;
+ }
+ else anchor = &next->next; /* Skip the address */
+ }
+ }
+
+ /* We now have one or more addresses that can be delivered in a batch. Check
+ whether the transport is prepared to accept a message of this size. If not,
+ fail them all forthwith. If the expansion fails, or does not yield an
+ integer, defer delivery. */
+
+ if (tp->message_size_limit)
+ {
+ int rc = check_message_size(tp, addr);
+ if (rc != OK)
+ {
+ replicate_status(addr);
+ while (addr)
+ {
+ addr2 = addr->next;
+ post_process_one(addr, rc, logflags, EXIM_DTYPE_TRANSPORT, 0);
+ addr = addr2;
+ }
+ continue; /* With next batch of addresses */
+ }
+ }
+
+ /* If we are not running the queue, or if forcing, all deliveries will be
+ attempted. Otherwise, we must respect the retry times for each address. Even
+ when not doing this, we need to set up the retry key string, and determine
+ whether a retry record exists, because after a successful delivery, a delete
+ retry item must be set up. Keep the retry database open only for the duration
+ of these checks, rather than for all local deliveries, because some local
+ deliveries (e.g. to pipes) can take a substantial time. */
+
+ if (!(dbm_file = dbfn_open(US"retry", O_RDONLY, &dbblock, FALSE, TRUE)))
+ {
+ DEBUG(D_deliver|D_retry|D_hints_lookup)
+ debug_printf("no retry data available\n");
+ }
+
+ addr2 = addr;
+ addr3 = NULL;
+ while (addr2)
+ {
+ BOOL ok = TRUE; /* to deliver this address */
+ uschar *retry_key;
+
+ /* Set up the retry key to include the domain or not, and change its
+ leading character from "R" to "T". Must make a copy before doing this,
+ because the old key may be pointed to from a "delete" retry item after
+ a routing delay. */
+
+ retry_key = string_copy(
+ tp->retry_use_local_part ? addr2->address_retry_key :
+ addr2->domain_retry_key);
+ *retry_key = 'T';
+
+ /* Inspect the retry data. If there is no hints file, delivery happens. */
+
+ if (dbm_file)
+ {
+ dbdata_retry *retry_record = dbfn_read(dbm_file, retry_key);
+
+ /* If there is no retry record, delivery happens. If there is,
+ remember it exists so it can be deleted after a successful delivery. */
+
+ if (retry_record)
+ {
+ setflag(addr2, af_lt_retry_exists);
+
+ /* A retry record exists for this address. If queue running and not
+ forcing, inspect its contents. If the record is too old, or if its
+ retry time has come, or if it has passed its cutoff time, delivery
+ will go ahead. */
+
+ DEBUG(D_retry)
+ {
+ debug_printf("retry record exists: age=%s ",
+ readconf_printtime(now - retry_record->time_stamp));
+ debug_printf("(max %s)\n", readconf_printtime(retry_data_expire));
+ debug_printf(" time to retry = %s expired = %d\n",
+ readconf_printtime(retry_record->next_try - now),
+ retry_record->expired);
+ }
+
+ if (f.queue_running && !f.deliver_force)
+ {
+ ok = (now - retry_record->time_stamp > retry_data_expire)
+ || (now >= retry_record->next_try)
+ || retry_record->expired;
+
+ /* If we haven't reached the retry time, there is one more check
+ to do, which is for the ultimate address timeout. */
+
+ if (!ok)
+ ok = retry_ultimate_address_timeout(retry_key, addr2->domain,
+ retry_record, now);
+ }
+ }
+ else DEBUG(D_retry) debug_printf("no retry record exists\n");
+ }
+
+ /* This address is to be delivered. Leave it on the chain. */
+
+ if (ok)
+ {
+ addr3 = addr2;
+ addr2 = addr2->next;
+ }
+
+ /* This address is to be deferred. Take it out of the chain, and
+ post-process it as complete. Must take it out of the chain first,
+ because post processing puts it on another chain. */
+
+ else
+ {
+ address_item *this = addr2;
+ this->message = US"Retry time not yet reached";
+ this->basic_errno = ERRNO_LRETRY;
+ addr2 = addr3 ? (addr3->next = addr2->next)
+ : (addr = addr2->next);
+ post_process_one(this, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0);
+ }
+ }
+
+ if (dbm_file) dbfn_close(dbm_file);
+
+ /* If there are no addresses left on the chain, they all deferred. Loop
+ for the next set of addresses. */
+
+ if (!addr) continue;
+
+ /* If the transport is limited for parallellism, enforce that here.
+ We use a hints DB entry, incremented here and decremented after
+ the transport (and any shadow transport) completes. */
+
+ if (tpt_parallel_check(tp, addr, &serialize_key))
+ {
+ if (expand_string_message)
+ {
+ logflags |= LOG_PANIC;
+ do
+ {
+ addr = addr->next;
+ post_process_one(addr, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0);
+ } while ((addr = addr2));
+ }
+ continue; /* Loop for the next set of addresses. */
+ }
+
+
+ /* So, finally, we do have some addresses that can be passed to the
+ transport. Before doing so, set up variables that are relevant to a
+ single delivery. */
+
+ deliver_set_expansions(addr);
+
+ gettimeofday(&delivery_start, NULL);
+ deliver_local(addr, FALSE);
+ timesince(&deliver_time, &delivery_start);
+
+ /* If a shadow transport (which must perforce be another local transport), is
+ defined, and its condition is met, we must pass the message to the shadow
+ too, but only those addresses that succeeded. We do this by making a new
+ chain of addresses - also to keep the original chain uncontaminated. We must
+ use a chain rather than doing it one by one, because the shadow transport may
+ batch.
+
+ NOTE: if the condition fails because of a lookup defer, there is nothing we
+ can do! */
+
+ if ( tp->shadow
+ && ( !tp->shadow_condition
+ || expand_check_condition(tp->shadow_condition, tp->name, US"transport")
+ ) )
+ {
+ transport_instance *stp;
+ address_item *shadow_addr = NULL;
+ address_item **last = &shadow_addr;
+
+ for (stp = transports; stp; stp = stp->next)
+ if (Ustrcmp(stp->name, tp->shadow) == 0) break;
+
+ if (!stp)
+ log_write(0, LOG_MAIN|LOG_PANIC, "shadow transport \"%s\" not found ",
+ tp->shadow);
+
+ /* Pick off the addresses that have succeeded, and make clones. Put into
+ the shadow_message field a pointer to the shadow_message field of the real
+ address. */
+
+ else for (addr2 = addr; addr2; addr2 = addr2->next)
+ if (addr2->transport_return == OK)
+ {
+ addr3 = store_get(sizeof(address_item), FALSE);
+ *addr3 = *addr2;
+ addr3->next = NULL;
+ addr3->shadow_message = US &addr2->shadow_message;
+ addr3->transport = stp;
+ addr3->transport_return = DEFER;
+ addr3->return_filename = NULL;
+ addr3->return_file = -1;
+ *last = addr3;
+ last = &addr3->next;
+ }
+
+ /* If we found any addresses to shadow, run the delivery, and stick any
+ message back into the shadow_message field in the original. */
+
+ if (shadow_addr)
+ {
+ int save_count = transport_count;
+
+ DEBUG(D_deliver|D_transport)
+ debug_printf(">>>>>>>>>>>>>>>> Shadow delivery >>>>>>>>>>>>>>>>\n");
+ deliver_local(shadow_addr, TRUE);
+
+ for(; shadow_addr; shadow_addr = shadow_addr->next)
+ {
+ int sresult = shadow_addr->transport_return;
+ *(uschar **)shadow_addr->shadow_message =
+ sresult == OK
+ ? string_sprintf(" ST=%s", stp->name)
+ : string_sprintf(" ST=%s (%s%s%s)", stp->name,
+ shadow_addr->basic_errno <= 0
+ ? US""
+ : US strerror(shadow_addr->basic_errno),
+ shadow_addr->basic_errno <= 0 || !shadow_addr->message
+ ? US""
+ : US": ",
+ shadow_addr->message
+ ? shadow_addr->message
+ : shadow_addr->basic_errno <= 0
+ ? US"unknown error"
+ : US"");
+
+ DEBUG(D_deliver|D_transport)
+ debug_printf("%s shadow transport returned %s for %s\n",
+ stp->name, rc_to_string(sresult), shadow_addr->address);
+ }
+
+ DEBUG(D_deliver|D_transport)
+ debug_printf(">>>>>>>>>>>>>>>> End shadow delivery >>>>>>>>>>>>>>>>\n");
+
+ transport_count = save_count; /* Restore original transport count */
+ }
+ }
+
+ /* Cancel the expansions that were set up for the delivery. */
+
+ deliver_set_expansions(NULL);
+
+ /* If the transport was parallelism-limited, decrement the hints DB record. */
+
+ if (serialize_key) enq_end(serialize_key);
+
+ /* Now we can process the results of the real transport. We must take each
+ address off the chain first, because post_process_one() puts it on another
+ chain. */
+
+ for (addr2 = addr; addr2; addr2 = nextaddr)
+ {
+ int result = addr2->transport_return;
+ nextaddr = addr2->next;
+
+ DEBUG(D_deliver|D_transport)
+ debug_printf("%s transport returned %s for %s\n",
+ tp->name, rc_to_string(result), addr2->address);
+
+ /* If there is a retry_record, or if delivery is deferred, build a retry
+ item for setting a new retry time or deleting the old retry record from
+ the database. These items are handled all together after all addresses
+ have been handled (so the database is open just for a short time for
+ updating). */
+
+ if (result == DEFER || testflag(addr2, af_lt_retry_exists))
+ {
+ int flags = result == DEFER ? 0 : rf_delete;
+ uschar *retry_key = string_copy(tp->retry_use_local_part
+ ? addr2->address_retry_key : addr2->domain_retry_key);
+ *retry_key = 'T';
+ retry_add_item(addr2, retry_key, flags);
+ }
+
+ /* Done with this address */
+
+ addr2->delivery_time = deliver_time;
+ post_process_one(addr2, result, logflags, EXIM_DTYPE_TRANSPORT, logchar);
+
+ /* If a pipe delivery generated text to be sent back, the result may be
+ changed to FAIL, and we must copy this for subsequent addresses in the
+ batch. */
+
+ if (addr2->transport_return != result)
+ {
+ for (addr3 = nextaddr; addr3; addr3 = addr3->next)
+ {
+ addr3->transport_return = addr2->transport_return;
+ addr3->basic_errno = addr2->basic_errno;
+ addr3->message = addr2->message;
+ }
+ result = addr2->transport_return;
+ }
+
+ /* Whether or not the result was changed to FAIL, we need to copy the
+ return_file value from the first address into all the addresses of the
+ batch, so they are all listed in the error message. */
+
+ addr2->return_file = addr->return_file;
+
+ /* Change log character for recording successful deliveries. */
+
+ if (result == OK) logchar = '-';
+ }
+ } /* Loop back for next batch of addresses */
+}
+
+
+
+
+/*************************************************
+* Sort remote deliveries *
+*************************************************/
+
+/* This function is called if remote_sort_domains is set. It arranges that the
+chain of addresses for remote deliveries is ordered according to the strings
+specified. Try to make this shuffling reasonably efficient by handling
+sequences of addresses rather than just single ones.
+
+Arguments: None
+Returns: Nothing
+*/
+
+static void
+sort_remote_deliveries(void)
+{
+int sep = 0;
+address_item **aptr = &addr_remote;
+const uschar *listptr = remote_sort_domains;
+uschar *pattern;
+uschar patbuf[256];
+
+while ( *aptr
+ && (pattern = string_nextinlist(&listptr, &sep, patbuf, sizeof(patbuf)))
+ )
+ {
+ address_item *moved = NULL;
+ address_item **bptr = &moved;
+
+ while (*aptr)
+ {
+ address_item **next;
+ deliver_domain = (*aptr)->domain; /* set $domain */
+ if (match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
+ &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK)
+ {
+ aptr = &(*aptr)->next;
+ continue;
+ }
+
+ next = &(*aptr)->next;
+ while ( *next
+ && (deliver_domain = (*next)->domain, /* Set $domain */
+ match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
+ &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL)) != OK
+ )
+ next = &(*next)->next;
+
+ /* If the batch of non-matchers is at the end, add on any that were
+ extracted further up the chain, and end this iteration. Otherwise,
+ extract them from the chain and hang on the moved chain. */
+
+ if (!*next)
+ {
+ *next = moved;
+ break;
+ }
+
+ *bptr = *aptr;
+ *aptr = *next;
+ *next = NULL;
+ bptr = next;
+ aptr = &(*aptr)->next;
+ }
+
+ /* If the loop ended because the final address matched, *aptr will
+ be NULL. Add on to the end any extracted non-matching addresses. If
+ *aptr is not NULL, the loop ended via "break" when *next is null, that
+ is, there was a string of non-matching addresses at the end. In this
+ case the extracted addresses have already been added on the end. */
+
+ if (!*aptr) *aptr = moved;
+ }
+
+DEBUG(D_deliver)
+ {
+ debug_printf("remote addresses after sorting:\n");
+ for (address_item * addr = addr_remote; addr; addr = addr->next)
+ debug_printf(" %s\n", addr->address);
+ }
+}
+
+
+
+/*************************************************
+* Read from pipe for remote delivery subprocess *
+*************************************************/
+
+/* This function is called when the subprocess is complete, but can also be
+called before it is complete, in order to empty a pipe that is full (to prevent
+deadlock). It must therefore keep track of its progress in the parlist data
+block.
+
+We read the pipe to get the delivery status codes and a possible error message
+for each address, optionally preceded by unusability data for the hosts and
+also by optional retry data.
+
+Read in large chunks into the big buffer and then scan through, interpreting
+the data therein. In most cases, only a single read will be necessary. No
+individual item will ever be anywhere near 2500 bytes in length, so by ensuring
+that we read the next chunk when there is less than 2500 bytes left in the
+non-final chunk, we can assume each item is complete in the buffer before
+handling it. Each item is written using a single write(), which is atomic for
+small items (less than PIPE_BUF, which seems to be at least 512 in any Unix and
+often bigger) so even if we are reading while the subprocess is still going, we
+should never have only a partial item in the buffer.
+
+hs12: This assumption is not true anymore, since we get quite large items (certificate
+information and such).
+
+Argument:
+ poffset the offset of the parlist item
+ eop TRUE if the process has completed
+
+Returns: TRUE if the terminating 'Z' item has been read,
+ or there has been a disaster (i.e. no more data needed);
+ FALSE otherwise
+*/
+
+static BOOL
+par_read_pipe(int poffset, BOOL eop)
+{
+host_item *h;
+pardata *p = parlist + poffset;
+address_item *addrlist = p->addrlist;
+address_item *addr = p->addr;
+pid_t pid = p->pid;
+int fd = p->fd;
+
+uschar *msg = p->msg;
+BOOL done = p->done;
+
+/* Loop through all items, reading from the pipe when necessary. The pipe
+used to be non-blocking. But I do not see a reason for using non-blocking I/O
+here, as the preceding select() tells us, if data is available for reading.
+
+A read() on a "selected" handle should never block, but(!) it may return
+less data then we expected. (The buffer size we pass to read() shouldn't be
+understood as a "request", but as a "limit".)
+
+Each separate item is written to the pipe in a timely manner. But, especially for
+larger items, the read(2) may already return partial data from the write(2).
+
+The write is atomic mostly (depending on the amount written), but atomic does
+not imply "all or noting", it just is "not intermixed" with other writes on the
+same channel (pipe).
+
+*/
+
+DEBUG(D_deliver) debug_printf("reading pipe for subprocess %d (%s)\n",
+ (int)p->pid, eop? "ended" : "not ended yet");
+
+while (!done)
+ {
+ retry_item *r, **rp;
+ uschar pipeheader[PIPE_HEADER_SIZE+1];
+ uschar *id = &pipeheader[0];
+ uschar *subid = &pipeheader[1];
+ uschar *ptr = big_buffer;
+ size_t required = PIPE_HEADER_SIZE; /* first the pipehaeder, later the data */
+ ssize_t got;
+
+ DEBUG(D_deliver) debug_printf(
+ "expect %lu bytes (pipeheader) from tpt process %d\n", (u_long)required, pid);
+
+ /* We require(!) all the PIPE_HEADER_SIZE bytes here, as we know,
+ they're written in a timely manner, so waiting for the write shouldn't hurt a lot.
+ If we get less, we can assume the subprocess do be done and do not expect any further
+ information from it. */
+
+ if ((got = readn(fd, pipeheader, required)) != required)
+ {
+ msg = string_sprintf("got " SSIZE_T_FMT " of %d bytes (pipeheader) "
+ "from transport process %d for transport %s",
+ got, PIPE_HEADER_SIZE, pid, addr->transport->driver_name);
+ done = TRUE;
+ break;
+ }
+
+ pipeheader[PIPE_HEADER_SIZE] = '\0';
+ DEBUG(D_deliver)
+ debug_printf("got %ld bytes (pipeheader) from transport process %d\n",
+ (long) got, pid);
+
+ {
+ /* If we can't decode the pipeheader, the subprocess seems to have a
+ problem, we do not expect any furher information from it. */
+ char *endc;
+ required = Ustrtol(pipeheader+2, &endc, 10);
+ if (*endc)
+ {
+ msg = string_sprintf("failed to read pipe "
+ "from transport process %d for transport %s: error decoding size from header",
+ pid, addr->transport->driver_name);
+ done = TRUE;
+ break;
+ }
+ }
+
+ DEBUG(D_deliver)
+ debug_printf("expect %lu bytes (pipedata) from transport process %d\n",
+ (u_long)required, pid);
+
+ /* Same as above, the transport process will write the bytes announced
+ in a timely manner, so we can just wait for the bytes, getting less than expected
+ is considered a problem of the subprocess, we do not expect anything else from it. */
+ if ((got = readn(fd, big_buffer, required)) != required)
+ {
+ msg = string_sprintf("got only " SSIZE_T_FMT " of " SIZE_T_FMT
+ " bytes (pipedata) from transport process %d for transport %s",
+ got, required, pid, addr->transport->driver_name);
+ done = TRUE;
+ break;
+ }
+
+ /* Handle each possible type of item, assuming the complete item is
+ available in store. */
+
+ switch (*id)
+ {
+ /* Host items exist only if any hosts were marked unusable. Match
+ up by checking the IP address. */
+
+ case 'H':
+ for (h = addrlist->host_list; h; h = h->next)
+ {
+ if (!h->address || Ustrcmp(h->address, ptr+2) != 0) continue;
+ h->status = ptr[0];
+ h->why = ptr[1];
+ }
+ ptr += 2;
+ while (*ptr++);
+ break;
+
+ /* Retry items are sent in a preceding R item for each address. This is
+ kept separate to keep each message short enough to guarantee it won't
+ be split in the pipe. Hopefully, in the majority of cases, there won't in
+ fact be any retry items at all.
+
+ The complete set of retry items might include an item to delete a
+ routing retry if there was a previous routing delay. However, routing
+ retries are also used when a remote transport identifies an address error.
+ In that case, there may also be an "add" item for the same key. Arrange
+ that a "delete" item is dropped in favour of an "add" item. */
+
+ case 'R':
+ if (!addr) goto ADDR_MISMATCH;
+
+ DEBUG(D_deliver|D_retry)
+ debug_printf("reading retry information for %s from subprocess\n",
+ ptr+1);
+
+ /* Cut out any "delete" items on the list. */
+
+ for (rp = &addr->retries; (r = *rp); rp = &r->next)
+ if (Ustrcmp(r->key, ptr+1) == 0) /* Found item with same key */
+ {
+ if (!(r->flags & rf_delete)) break; /* It was not "delete" */
+ *rp = r->next; /* Excise a delete item */
+ DEBUG(D_deliver|D_retry)
+ debug_printf(" existing delete item dropped\n");
+ }
+
+ /* We want to add a delete item only if there is no non-delete item;
+ however we still have to step ptr through the data. */
+
+ if (!r || !(*ptr & rf_delete))
+ {
+ r = store_get(sizeof(retry_item), FALSE);
+ r->next = addr->retries;
+ addr->retries = r;
+ r->flags = *ptr++;
+ r->key = string_copy(ptr);
+ while (*ptr++);
+ memcpy(&r->basic_errno, ptr, sizeof(r->basic_errno));
+ ptr += sizeof(r->basic_errno);
+ memcpy(&r->more_errno, ptr, sizeof(r->more_errno));
+ ptr += sizeof(r->more_errno);
+ r->message = *ptr ? string_copy(ptr) : NULL;
+ DEBUG(D_deliver|D_retry) debug_printf(" added %s item\n",
+ r->flags & rf_delete ? "delete" : "retry");
+ }
+
+ else
+ {
+ DEBUG(D_deliver|D_retry)
+ debug_printf(" delete item not added: non-delete item exists\n");
+ ptr++;
+ while(*ptr++);
+ ptr += sizeof(r->basic_errno) + sizeof(r->more_errno);
+ }
+
+ while(*ptr++);
+ break;
+
+ /* Put the amount of data written into the parlist block */
+
+ case 'S':
+ memcpy(&(p->transport_count), ptr, sizeof(transport_count));
+ ptr += sizeof(transport_count);
+ break;
+
+ /* Address items are in the order of items on the address chain. We
+ remember the current address value in case this function is called
+ several times to empty the pipe in stages. Information about delivery
+ over TLS is sent in a preceding X item for each address. We don't put
+ it in with the other info, in order to keep each message short enough to
+ guarantee it won't be split in the pipe. */
+
+#ifndef DISABLE_TLS
+ case 'X':
+ if (!addr) goto ADDR_MISMATCH; /* Below, in 'A' handler */
+ switch (*subid)
+ {
+ case '1':
+ addr->tlsver = addr->cipher = addr->peerdn = NULL;
+
+ if (*ptr)
+ {
+ addr->cipher = string_copy(ptr);
+ addr->tlsver = string_copyn(ptr, Ustrchr(ptr, ':') - ptr);
+ }
+ while (*ptr++);
+ if (*ptr)
+ addr->peerdn = string_copy(ptr);
+ break;
+
+ case '2':
+ if (*ptr)
+ (void) tls_import_cert(ptr, &addr->peercert);
+ else
+ addr->peercert = NULL;
+ break;
+
+ case '3':
+ if (*ptr)
+ (void) tls_import_cert(ptr, &addr->ourcert);
+ else
+ addr->ourcert = NULL;
+ break;
+
+# ifndef DISABLE_OCSP
+ case '4':
+ addr->ocsp = *ptr ? *ptr - '0' : OCSP_NOT_REQ;
+ break;
+# endif
+ }
+ while (*ptr++);
+ break;
+#endif /*DISABLE_TLS*/
+
+ case 'C': /* client authenticator information */
+ switch (*subid)
+ {
+ case '1': addr->authenticator = *ptr ? string_copy(ptr) : NULL; break;
+ case '2': addr->auth_id = *ptr ? string_copy(ptr) : NULL; break;
+ case '3': addr->auth_sndr = *ptr ? string_copy(ptr) : NULL; break;
+ }
+ while (*ptr++);
+ break;
+
+#ifndef DISABLE_PRDR
+ case 'P':
+ setflag(addr, af_prdr_used);
+ break;
+#endif
+
+ case 'L':
+ switch (*subid)
+ {
+#ifndef DISABLE_PIPE_CONNECT
+ case 2: setflag(addr, af_early_pipe); /*FALLTHROUGH*/
+#endif
+ case 1: setflag(addr, af_pipelining); break;
+ }
+ break;
+
+ case 'K':
+ setflag(addr, af_chunking_used);
+ break;
+
+ case 'T':
+ setflag(addr, af_tcp_fastopen_conn);
+ if (*subid > '0') setflag(addr, af_tcp_fastopen);
+ if (*subid > '1') setflag(addr, af_tcp_fastopen_data);
+ break;
+
+ case 'D':
+ if (!addr) goto ADDR_MISMATCH;
+ memcpy(&(addr->dsn_aware), ptr, sizeof(addr->dsn_aware));
+ ptr += sizeof(addr->dsn_aware);
+ DEBUG(D_deliver) debug_printf("DSN read: addr->dsn_aware = %d\n", addr->dsn_aware);
+ break;
+
+ case 'A':
+ if (!addr)
+ {
+ ADDR_MISMATCH:
+ msg = string_sprintf("address count mismatch for data read from pipe "
+ "for transport process %d for transport %s", pid,
+ addrlist->transport->driver_name);
+ done = TRUE;
+ break;
+ }
+
+ switch (*subid)
+ {
+ #ifdef SUPPORT_SOCKS
+ case '2': /* proxy information; must arrive before A0 and applies to that addr XXX oops*/
+ proxy_session = TRUE; /*XXX should this be cleared somewhere? */
+ if (*ptr == 0)
+ ptr++;
+ else
+ {
+ proxy_local_address = string_copy(ptr);
+ while(*ptr++);
+ memcpy(&proxy_local_port, ptr, sizeof(proxy_local_port));
+ ptr += sizeof(proxy_local_port);
+ }
+ break;
+ #endif
+
+ #ifdef EXPERIMENTAL_DSN_INFO
+ case '1': /* must arrive before A0, and applies to that addr */
+ /* Two strings: smtp_greeting and helo_response */
+ addr->smtp_greeting = string_copy(ptr);
+ while(*ptr++);
+ addr->helo_response = string_copy(ptr);
+ while(*ptr++);
+ break;
+ #endif
+
+ case '0':
+ DEBUG(D_deliver) debug_printf("A0 %s tret %d\n", addr->address, *ptr);
+ addr->transport_return = *ptr++;
+ addr->special_action = *ptr++;
+ memcpy(&addr->basic_errno, ptr, sizeof(addr->basic_errno));
+ ptr += sizeof(addr->basic_errno);
+ memcpy(&addr->more_errno, ptr, sizeof(addr->more_errno));
+ ptr += sizeof(addr->more_errno);
+ memcpy(&addr->delivery_time, ptr, sizeof(addr->delivery_time));
+ ptr += sizeof(addr->delivery_time);
+ memcpy(&addr->flags, ptr, sizeof(addr->flags));
+ ptr += sizeof(addr->flags);
+ addr->message = *ptr ? string_copy(ptr) : NULL;
+ while(*ptr++);
+ addr->user_message = *ptr ? string_copy(ptr) : NULL;
+ while(*ptr++);
+
+ /* Always two strings for host information, followed by the port number and DNSSEC mark */
+
+ if (*ptr)
+ {
+ h = store_get(sizeof(host_item), FALSE);
+ h->name = string_copy(ptr);
+ while (*ptr++);
+ h->address = string_copy(ptr);
+ while(*ptr++);
+ memcpy(&h->port, ptr, sizeof(h->port));
+ ptr += sizeof(h->port);
+ h->dnssec = *ptr == '2' ? DS_YES
+ : *ptr == '1' ? DS_NO
+ : DS_UNK;
+ ptr++;
+ addr->host_used = h;
+ }
+ else ptr++;
+
+ /* Finished with this address */
+
+ addr = addr->next;
+ break;
+ }
+ break;
+
+ /* Local interface address/port */
+ case 'I':
+ if (*ptr) sending_ip_address = string_copy(ptr);
+ while (*ptr++) ;
+ if (*ptr) sending_port = atoi(CS ptr);
+ while (*ptr++) ;
+ break;
+
+ /* Z marks the logical end of the data. It is followed by '0' if
+ continue_transport was NULL at the end of transporting, otherwise '1'.
+ We need to know when it becomes NULL during a delivery down a passed SMTP
+ channel so that we don't try to pass anything more down it. Of course, for
+ most normal messages it will remain NULL all the time. */
+
+ case 'Z':
+ if (*ptr == '0')
+ {
+ continue_transport = NULL;
+ continue_hostname = NULL;
+ }
+ done = TRUE;
+ DEBUG(D_deliver) debug_printf("Z0%c item read\n", *ptr);
+ break;
+
+ /* Anything else is a disaster. */
+
+ default:
+ msg = string_sprintf("malformed data (%d) read from pipe for transport "
+ "process %d for transport %s", ptr[-1], pid,
+ addr->transport->driver_name);
+ done = TRUE;
+ break;
+ }
+ }
+
+/* The done flag is inspected externally, to determine whether or not to
+call the function again when the process finishes. */
+
+p->done = done;
+
+/* If the process hadn't finished, and we haven't seen the end of the data
+or if we suffered a disaster, update the rest of the state, and return FALSE to
+indicate "not finished". */
+
+if (!eop && !done)
+ {
+ p->addr = addr;
+ p->msg = msg;
+ return FALSE;
+ }
+
+/* Close our end of the pipe, to prevent deadlock if the far end is still
+pushing stuff into it. */
+
+(void)close(fd);
+p->fd = -1;
+
+/* If we have finished without error, but haven't had data for every address,
+something is wrong. */
+
+if (!msg && addr)
+ msg = string_sprintf("insufficient address data read from pipe "
+ "for transport process %d for transport %s", pid,
+ addr->transport->driver_name);
+
+/* If an error message is set, something has gone wrong in getting back
+the delivery data. Put the message into each address and freeze it. */
+
+if (msg)
+ for (addr = addrlist; addr; addr = addr->next)
+ {
+ addr->transport_return = DEFER;
+ addr->special_action = SPECIAL_FREEZE;
+ addr->message = msg;
+ log_write(0, LOG_MAIN|LOG_PANIC, "Delivery status for %s: %s\n", addr->address, addr->message);
+ }
+
+/* Return TRUE to indicate we have got all we need from this process, even
+if it hasn't actually finished yet. */
+
+return TRUE;
+}
+
+
+
+/*************************************************
+* Post-process a set of remote addresses *
+*************************************************/
+
+/* Do what has to be done immediately after a remote delivery for each set of
+addresses, then re-write the spool if necessary. Note that post_process_one
+puts the address on an appropriate queue; hence we must fish off the next
+one first. This function is also called if there is a problem with setting
+up a subprocess to do a remote delivery in parallel. In this case, the final
+argument contains a message, and the action must be forced to DEFER.
+
+Argument:
+ addr pointer to chain of address items
+ logflags flags for logging
+ msg NULL for normal cases; -> error message for unexpected problems
+ fallback TRUE if processing fallback hosts
+
+Returns: nothing
+*/
+
+static void
+remote_post_process(address_item *addr, int logflags, uschar *msg,
+ BOOL fallback)
+{
+/* If any host addresses were found to be unusable, add them to the unusable
+tree so that subsequent deliveries don't try them. */
+
+for (host_item * h = addr->host_list; h; h = h->next)
+ if (h->address)
+ if (h->status >= hstatus_unusable) tree_add_unusable(h);
+
+/* Now handle each address on the chain. The transport has placed '=' or '-'
+into the special_action field for each successful delivery. */
+
+while (addr)
+ {
+ address_item *next = addr->next;
+
+ /* If msg == NULL (normal processing) and the result is DEFER and we are
+ processing the main hosts and there are fallback hosts available, put the
+ address on the list for fallback delivery. */
+
+ if ( addr->transport_return == DEFER
+ && addr->fallback_hosts
+ && !fallback
+ && !msg
+ )
+ {
+ addr->host_list = addr->fallback_hosts;
+ addr->next = addr_fallback;
+ addr_fallback = addr;
+ DEBUG(D_deliver) debug_printf("%s queued for fallback host(s)\n", addr->address);
+ }
+
+ /* If msg is set (=> unexpected problem), set it in the address before
+ doing the ordinary post processing. */
+
+ else
+ {
+ if (msg)
+ {
+ addr->message = msg;
+ addr->transport_return = DEFER;
+ }
+ (void)post_process_one(addr, addr->transport_return, logflags,
+ EXIM_DTYPE_TRANSPORT, addr->special_action);
+ }
+
+ /* Next address */
+
+ addr = next;
+ }
+
+/* If we have just delivered down a passed SMTP channel, and that was
+the last address, the channel will have been closed down. Now that
+we have logged that delivery, set continue_sequence to 1 so that
+any subsequent deliveries don't get "*" incorrectly logged. */
+
+if (!continue_transport) continue_sequence = 1;
+}
+
+
+
+/*************************************************
+* Wait for one remote delivery subprocess *
+*************************************************/
+
+/* This function is called while doing remote deliveries when either the
+maximum number of processes exist and we need one to complete so that another
+can be created, or when waiting for the last ones to complete. It must wait for
+the completion of one subprocess, empty the control block slot, and return a
+pointer to the address chain.
+
+Arguments: none
+Returns: pointer to the chain of addresses handled by the process;
+ NULL if no subprocess found - this is an unexpected error
+*/
+
+static address_item *
+par_wait(void)
+{
+int poffset, status;
+address_item *addr, *addrlist;
+pid_t pid;
+
+set_process_info("delivering %s: waiting for a remote delivery subprocess "
+ "to finish", message_id);
+
+/* Loop until either a subprocess completes, or there are no subprocesses in
+existence - in which case give an error return. We cannot proceed just by
+waiting for a completion, because a subprocess may have filled up its pipe, and
+be waiting for it to be emptied. Therefore, if no processes have finished, we
+wait for one of the pipes to acquire some data by calling select(), with a
+timeout just in case.
+
+The simple approach is just to iterate after reading data from a ready pipe.
+This leads to non-ideal behaviour when the subprocess has written its final Z
+item, closed the pipe, and is in the process of exiting (the common case). A
+call to waitpid() yields nothing completed, but select() shows the pipe ready -
+reading it yields EOF, so you end up with busy-waiting until the subprocess has
+actually finished.
+
+To avoid this, if all the data that is needed has been read from a subprocess
+after select(), an explicit wait() for it is done. We know that all it is doing
+is writing to the pipe and then exiting, so the wait should not be long.
+
+The non-blocking waitpid() is to some extent just insurance; if we could
+reliably detect end-of-file on the pipe, we could always know when to do a
+blocking wait() for a completed process. However, because some systems use
+NDELAY, which doesn't distinguish between EOF and pipe empty, it is easier to
+use code that functions without the need to recognize EOF.
+
+There's a double loop here just in case we end up with a process that is not in
+the list of remote delivery processes. Something has obviously gone wrong if
+this is the case. (For example, a process that is incorrectly left over from
+routing or local deliveries might be found.) The damage can be minimized by
+looping back and looking for another process. If there aren't any, the error
+return will happen. */
+
+for (;;) /* Normally we do not repeat this loop */
+ {
+ while ((pid = waitpid(-1, &status, WNOHANG)) <= 0)
+ {
+ struct timeval tv;
+ fd_set select_pipes;
+ int maxpipe, readycount;
+
+ /* A return value of -1 can mean several things. If errno != ECHILD, it
+ either means invalid options (which we discount), or that this process was
+ interrupted by a signal. Just loop to try the waitpid() again.
+
+ If errno == ECHILD, waitpid() is telling us that there are no subprocesses
+ in existence. This should never happen, and is an unexpected error.
+ However, there is a nasty complication when running under Linux. If "strace
+ -f" is being used under Linux to trace this process and its children,
+ subprocesses are "stolen" from their parents and become the children of the
+ tracing process. A general wait such as the one we've just obeyed returns
+ as if there are no children while subprocesses are running. Once a
+ subprocess completes, it is restored to the parent, and waitpid(-1) finds
+ it. Thanks to Joachim Wieland for finding all this out and suggesting a
+ palliative.
+
+ This does not happen using "truss" on Solaris, nor (I think) with other
+ tracing facilities on other OS. It seems to be specific to Linux.
+
+ What we do to get round this is to use kill() to see if any of our
+ subprocesses are still in existence. If kill() gives an OK return, we know
+ it must be for one of our processes - it can't be for a re-use of the pid,
+ because if our process had finished, waitpid() would have found it. If any
+ of our subprocesses are in existence, we proceed to use select() as if
+ waitpid() had returned zero. I think this is safe. */
+
+ if (pid < 0)
+ {
+ if (errno != ECHILD) continue; /* Repeats the waitpid() */
+
+ DEBUG(D_deliver)
+ debug_printf("waitpid() returned -1/ECHILD: checking explicitly "
+ "for process existence\n");
+
+ for (poffset = 0; poffset < remote_max_parallel; poffset++)
+ {
+ if ((pid = parlist[poffset].pid) != 0 && kill(pid, 0) == 0)
+ {
+ DEBUG(D_deliver) debug_printf("process %d still exists: assume "
+ "stolen by strace\n", (int)pid);
+ break; /* With poffset set */
+ }
+ }
+
+ if (poffset >= remote_max_parallel)
+ {
+ DEBUG(D_deliver) debug_printf("*** no delivery children found\n");
+ return NULL; /* This is the error return */
+ }
+ }
+
+ /* A pid value greater than 0 breaks the "while" loop. A negative value has
+ been handled above. A return value of zero means that there is at least one
+ subprocess, but there are no completed subprocesses. See if any pipes are
+ ready with any data for reading. */
+
+ DEBUG(D_deliver) debug_printf("selecting on subprocess pipes\n");
+
+ maxpipe = 0;
+ FD_ZERO(&select_pipes);
+ for (poffset = 0; poffset < remote_max_parallel; poffset++)
+ if (parlist[poffset].pid != 0)
+ {
+ int fd = parlist[poffset].fd;
+ FD_SET(fd, &select_pipes);
+ if (fd > maxpipe) maxpipe = fd;
+ }
+
+ /* Stick in a 60-second timeout, just in case. */
+
+ tv.tv_sec = 60;
+ tv.tv_usec = 0;
+
+ readycount = select(maxpipe + 1, (SELECT_ARG2_TYPE *)&select_pipes,
+ NULL, NULL, &tv);
+
+ /* Scan through the pipes and read any that are ready; use the count
+ returned by select() to stop when there are no more. Select() can return
+ with no processes (e.g. if interrupted). This shouldn't matter.
+
+ If par_read_pipe() returns TRUE, it means that either the terminating Z was
+ read, or there was a disaster. In either case, we are finished with this
+ process. Do an explicit wait() for the process and break the main loop if
+ it succeeds.
+
+ It turns out that we have to deal with the case of an interrupted system
+ call, which can happen on some operating systems if the signal handling is
+ set up to do that by default. */
+
+ for (poffset = 0;
+ readycount > 0 && poffset < remote_max_parallel;
+ poffset++)
+ {
+ if ( (pid = parlist[poffset].pid) != 0
+ && FD_ISSET(parlist[poffset].fd, &select_pipes)
+ )
+ {
+ readycount--;
+ if (par_read_pipe(poffset, FALSE)) /* Finished with this pipe */
+ for (;;) /* Loop for signals */
+ {
+ pid_t endedpid = waitpid(pid, &status, 0);
+ if (endedpid == pid) goto PROCESS_DONE;
+ if (endedpid != (pid_t)(-1) || errno != EINTR)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Unexpected error return "
+ "%d (errno = %d) from waitpid() for process %d",
+ (int)endedpid, errno, (int)pid);
+ }
+ }
+ }
+
+ /* Now go back and look for a completed subprocess again. */
+ }
+
+ /* A completed process was detected by the non-blocking waitpid(). Find the
+ data block that corresponds to this subprocess. */
+
+ for (poffset = 0; poffset < remote_max_parallel; poffset++)
+ if (pid == parlist[poffset].pid) break;
+
+ /* Found the data block; this is a known remote delivery process. We don't
+ need to repeat the outer loop. This should be what normally happens. */
+
+ if (poffset < remote_max_parallel) break;
+
+ /* This situation is an error, but it's probably better to carry on looking
+ for another process than to give up (as we used to do). */
+
+ log_write(0, LOG_MAIN|LOG_PANIC, "Process %d finished: not found in remote "
+ "transport process list", pid);
+ } /* End of the "for" loop */
+
+/* Come here when all the data was completely read after a select(), and
+the process in pid has been wait()ed for. */
+
+PROCESS_DONE:
+
+DEBUG(D_deliver)
+ {
+ if (status == 0)
+ debug_printf("remote delivery process %d ended\n", (int)pid);
+ else
+ debug_printf("remote delivery process %d ended: status=%04x\n", (int)pid,
+ status);
+ }
+
+set_process_info("delivering %s", message_id);
+
+/* Get the chain of processed addresses */
+
+addrlist = parlist[poffset].addrlist;
+
+/* If the process did not finish cleanly, record an error and freeze (except
+for SIGTERM, SIGKILL and SIGQUIT), and also ensure the journal is not removed,
+in case the delivery did actually happen. */
+
+if ((status & 0xffff) != 0)
+ {
+ uschar *msg;
+ int msb = (status >> 8) & 255;
+ int lsb = status & 255;
+ int code = (msb == 0)? (lsb & 0x7f) : msb;
+
+ msg = string_sprintf("%s transport process returned non-zero status 0x%04x: "
+ "%s %d",
+ addrlist->transport->driver_name,
+ status,
+ (msb == 0)? "terminated by signal" : "exit code",
+ code);
+
+ if (msb != 0 || (code != SIGTERM && code != SIGKILL && code != SIGQUIT))
+ addrlist->special_action = SPECIAL_FREEZE;
+
+ for (addr = addrlist; addr; addr = addr->next)
+ {
+ addr->transport_return = DEFER;
+ addr->message = msg;
+ }
+
+ remove_journal = FALSE;
+ }
+
+/* Else complete reading the pipe to get the result of the delivery, if all
+the data has not yet been obtained. */
+
+else if (!parlist[poffset].done) (void)par_read_pipe(poffset, TRUE);
+
+/* Put the data count and return path into globals, mark the data slot unused,
+decrement the count of subprocesses, and return the address chain. */
+
+transport_count = parlist[poffset].transport_count;
+used_return_path = parlist[poffset].return_path;
+parlist[poffset].pid = 0;
+parcount--;
+return addrlist;
+}
+
+
+
+/*************************************************
+* Wait for subprocesses and post-process *
+*************************************************/
+
+/* This function waits for subprocesses until the number that are still running
+is below a given threshold. For each complete subprocess, the addresses are
+post-processed. If we can't find a running process, there is some shambles.
+Better not bomb out, as that might lead to multiple copies of the message. Just
+log and proceed as if all done.
+
+Arguments:
+ max maximum number of subprocesses to leave running
+ fallback TRUE if processing fallback hosts
+
+Returns: nothing
+*/
+
+static void
+par_reduce(int max, BOOL fallback)
+{
+while (parcount > max)
+ {
+ address_item *doneaddr = par_wait();
+ if (!doneaddr)
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "remote delivery process count got out of step");
+ parcount = 0;
+ }
+ else
+ {
+ transport_instance * tp = doneaddr->transport;
+ if (tp->max_parallel)
+ enq_end(string_sprintf("tpt-serialize-%s", tp->name));
+
+ remote_post_process(doneaddr, LOG_MAIN, NULL, fallback);
+ }
+ }
+}
+
+static void
+rmt_dlv_checked_write(int fd, char id, char subid, void * buf, ssize_t size)
+{
+uschar pipe_header[PIPE_HEADER_SIZE+1];
+size_t total_len = PIPE_HEADER_SIZE + size;
+
+struct iovec iov[2] = {
+ { pipe_header, PIPE_HEADER_SIZE }, /* indication about the data to expect */
+ { buf, size } /* *the* data */
+};
+
+ssize_t ret;
+
+/* we assume that size can't get larger then BIG_BUFFER_SIZE which currently is set to 16k */
+/* complain to log if someone tries with buffer sizes we can't handle*/
+
+if (size > BIG_BUFFER_SIZE-1)
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE,
+ "Failed writing transport result to pipe: can't handle buffers > %d bytes. truncating!\n",
+ BIG_BUFFER_SIZE-1);
+ size = BIG_BUFFER_SIZE;
+ }
+
+/* Should we check that we do not write more than PIPE_BUF? What would
+that help? */
+
+/* convert size to human readable string prepended by id and subid */
+if (PIPE_HEADER_SIZE != snprintf(CS pipe_header, PIPE_HEADER_SIZE+1, "%c%c%05ld",
+ id, subid, (long)size))
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "header snprintf failed\n");
+
+DEBUG(D_deliver) debug_printf("header write id:%c,subid:%c,size:%ld,final:%s\n",
+ id, subid, (long)size, pipe_header);
+
+if ((ret = writev(fd, iov, 2)) != total_len)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE,
+ "Failed writing transport result to pipe (%ld of %ld bytes): %s",
+ (long)ret, (long)total_len, ret == -1 ? strerror(errno) : "short write");
+}
+
+/*************************************************
+* Do remote deliveries *
+*************************************************/
+
+/* This function is called to process the addresses in addr_remote. We must
+pick off the queue all addresses that have the same transport, remote
+destination, and errors address, and hand them to the transport in one go,
+subject to some configured limitations. If this is a run to continue delivering
+to an existing delivery channel, skip all but those addresses that can go to
+that channel. The skipped addresses just get deferred.
+
+If mua_wrapper is set, all addresses must be able to be sent in a single
+transaction. If not, this function yields FALSE.
+
+In Exim 4, remote deliveries are always done in separate processes, even
+if remote_max_parallel = 1 or if there's only one delivery to do. The reason
+is so that the base process can retain privilege. This makes the
+implementation of fallback transports feasible (though not initially done.)
+
+We create up to the configured number of subprocesses, each of which passes
+back the delivery state via a pipe. (However, when sending down an existing
+connection, remote_max_parallel is forced to 1.)
+
+Arguments:
+ fallback TRUE if processing fallback hosts
+
+Returns: TRUE normally
+ FALSE if mua_wrapper is set and the addresses cannot all be sent
+ in one transaction
+*/
+
+static BOOL
+do_remote_deliveries(BOOL fallback)
+{
+int parmax;
+int poffset;
+
+parcount = 0; /* Number of executing subprocesses */
+
+/* When sending down an existing channel, only do one delivery at a time.
+We use a local variable (parmax) to hold the maximum number of processes;
+this gets reduced from remote_max_parallel if we can't create enough pipes. */
+
+if (continue_transport) remote_max_parallel = 1;
+parmax = remote_max_parallel;
+
+/* If the data for keeping a list of processes hasn't yet been
+set up, do so. */
+
+if (!parlist)
+ {
+ parlist = store_get(remote_max_parallel * sizeof(pardata), FALSE);
+ for (poffset = 0; poffset < remote_max_parallel; poffset++)
+ parlist[poffset].pid = 0;
+ }
+
+/* Now loop for each remote delivery */
+
+for (int delivery_count = 0; addr_remote; delivery_count++)
+ {
+ pid_t pid;
+ uid_t uid;
+ gid_t gid;
+ int pfd[2];
+ int address_count = 1;
+ int address_count_max;
+ BOOL multi_domain;
+ BOOL use_initgroups;
+ BOOL pipe_done = FALSE;
+ transport_instance *tp;
+ address_item **anchor = &addr_remote;
+ address_item *addr = addr_remote;
+ address_item *last = addr;
+ address_item *next;
+ uschar * panicmsg;
+ uschar * serialize_key = NULL;
+
+ /* Pull the first address right off the list. */
+
+ addr_remote = addr->next;
+ addr->next = NULL;
+
+ DEBUG(D_deliver|D_transport)
+ debug_printf("--------> %s <--------\n", addr->address);
+
+ /* If no transport has been set, there has been a big screw-up somewhere. */
+
+ if (!(tp = addr->transport))
+ {
+ f.disable_logging = FALSE; /* Jic */
+ panicmsg = US"No transport set by router";
+ goto panic_continue;
+ }
+
+ /* Check that this base address hasn't previously been delivered to this
+ transport. The check is necessary at this point to handle homonymic addresses
+ correctly in cases where the pattern of redirection changes between delivery
+ attempts. Non-homonymic previous delivery is detected earlier, at routing
+ time. */
+
+ if (previously_transported(addr, FALSE)) continue;
+
+ /* Force failure if the message is too big. */
+
+ if (tp->message_size_limit)
+ {
+ int rc = check_message_size(tp, addr);
+ if (rc != OK)
+ {
+ addr->transport_return = rc;
+ remote_post_process(addr, LOG_MAIN, NULL, fallback);
+ continue;
+ }
+ }
+
+/*XXX need to defeat this when DANE is used - but we don't know that yet.
+So look out for the place it gets used.
+*/
+
+ /* Get the flag which specifies whether the transport can handle different
+ domains that nevertheless resolve to the same set of hosts. If it needs
+ expanding, get variables set: $address_data, $domain_data, $localpart_data,
+ $host, $host_address, $host_port. */
+ if (tp->expand_multi_domain)
+ deliver_set_expansions(addr);
+
+ if (exp_bool(addr, US"transport", tp->name, D_transport,
+ US"multi_domain", tp->multi_domain, tp->expand_multi_domain,
+ &multi_domain) != OK)
+ {
+ deliver_set_expansions(NULL);
+ panicmsg = addr->message;
+ goto panic_continue;
+ }
+
+ /* Get the maximum it can handle in one envelope, with zero meaning
+ unlimited, which is forced for the MUA wrapper case. */
+
+ address_count_max = tp->max_addresses;
+ if (address_count_max == 0 || mua_wrapper) address_count_max = 999999;
+
+
+ /************************************************************************/
+ /***** This is slightly experimental code, but should be safe. *****/
+
+ /* The address_count_max value is the maximum number of addresses that the
+ transport can send in one envelope. However, the transport must be capable of
+ dealing with any number of addresses. If the number it gets exceeds its
+ envelope limitation, it must send multiple copies of the message. This can be
+ done over a single connection for SMTP, so uses less resources than making
+ multiple connections. On the other hand, if remote_max_parallel is greater
+ than one, it is perhaps a good idea to use parallel processing to move the
+ message faster, even if that results in multiple simultaneous connections to
+ the same host.
+
+ How can we come to some compromise between these two ideals? What we do is to
+ limit the number of addresses passed to a single instance of a transport to
+ the greater of (a) its address limit (rcpt_max for SMTP) and (b) the total
+ number of addresses routed to remote transports divided by
+ remote_max_parallel. For example, if the message has 100 remote recipients,
+ remote max parallel is 2, and rcpt_max is 10, we'd never send more than 50 at
+ once. But if rcpt_max is 100, we could send up to 100.
+
+ Of course, not all the remotely addresses in a message are going to go to the
+ same set of hosts (except in smarthost configurations), so this is just a
+ heuristic way of dividing up the work.
+
+ Furthermore (1), because this may not be wanted in some cases, and also to
+ cope with really pathological cases, there is also a limit to the number of
+ messages that are sent over one connection. This is the same limit that is
+ used when sending several different messages over the same connection.
+ Continue_sequence is set when in this situation, to the number sent so
+ far, including this message.
+
+ Furthermore (2), when somebody explicitly sets the maximum value to 1, it
+ is probably because they are using VERP, in which case they want to pass only
+ one address at a time to the transport, in order to be able to use
+ $local_part and $domain in constructing a new return path. We could test for
+ the use of these variables, but as it is so likely they will be used when the
+ maximum is 1, we don't bother. Just leave the value alone. */
+
+ if ( address_count_max != 1
+ && address_count_max < remote_delivery_count/remote_max_parallel
+ )
+ {
+ int new_max = remote_delivery_count/remote_max_parallel;
+ int message_max = tp->connection_max_messages;
+ if (connection_max_messages >= 0) message_max = connection_max_messages;
+ message_max -= continue_sequence - 1;
+ if (message_max > 0 && new_max > address_count_max * message_max)
+ new_max = address_count_max * message_max;
+ address_count_max = new_max;
+ }
+
+ /************************************************************************/
+
+
+/*XXX don't know yet if DANE will be used. So tpt will have to
+check at the point if gets next addr from list, and skip/defer any
+nonmatch domains
+*/
+
+ /* Pick off all addresses which have the same transport, errors address,
+ destination, and extra headers. In some cases they point to the same host
+ list, but we also need to check for identical host lists generated from
+ entirely different domains. The host list pointers can be NULL in the case
+ where the hosts are defined in the transport. There is also a configured
+ maximum limit of addresses that can be handled at once (see comments above
+ for how it is computed).
+ If the transport does not handle multiple domains, enforce that also,
+ and if it might need a per-address check for this, re-evaluate it.
+ */
+
+ while ((next = *anchor) && address_count < address_count_max)
+ {
+ BOOL md;
+ if ( (multi_domain || Ustrcmp(next->domain, addr->domain) == 0)
+ && tp == next->transport
+ && same_hosts(next->host_list, addr->host_list)
+ && same_strings(next->prop.errors_address, addr->prop.errors_address)
+ && same_headers(next->prop.extra_headers, addr->prop.extra_headers)
+ && same_ugid(tp, next, addr)
+ && ( next->prop.remove_headers == addr->prop.remove_headers
+ || ( next->prop.remove_headers
+ && addr->prop.remove_headers
+ && Ustrcmp(next->prop.remove_headers, addr->prop.remove_headers) == 0
+ ) )
+ && ( !multi_domain
+ || ( (
+ (void)(!tp->expand_multi_domain || ((void)deliver_set_expansions(next), 1)),
+ exp_bool(addr,
+ US"transport", next->transport->name, D_transport,
+ US"multi_domain", next->transport->multi_domain,
+ next->transport->expand_multi_domain, &md) == OK
+ )
+ && md
+ ) ) )
+ {
+ *anchor = next->next;
+ next->next = NULL;
+ next->first = addr; /* remember top one (for retry processing) */
+ last->next = next;
+ last = next;
+ address_count++;
+ }
+ else anchor = &(next->next);
+ deliver_set_expansions(NULL);
+ }
+
+ /* If we are acting as an MUA wrapper, all addresses must go in a single
+ transaction. If not, put them back on the chain and yield FALSE. */
+
+ if (mua_wrapper && addr_remote)
+ {
+ last->next = addr_remote;
+ addr_remote = addr;
+ return FALSE;
+ }
+
+ /* If the transport is limited for parallellism, enforce that here.
+ The hints DB entry is decremented in par_reduce(), when we reap the
+ transport process. */
+
+ if (tpt_parallel_check(tp, addr, &serialize_key))
+ if ((panicmsg = expand_string_message))
+ goto panic_continue;
+ else
+ continue; /* Loop for the next set of addresses. */
+
+ /* Set up the expansion variables for this set of addresses */
+
+ deliver_set_expansions(addr);
+
+ /* Ensure any transport-set auth info is fresh */
+ addr->authenticator = addr->auth_id = addr->auth_sndr = NULL;
+
+ /* Compute the return path, expanding a new one if required. The old one
+ must be set first, as it might be referred to in the expansion. */
+
+ if(addr->prop.errors_address)
+ return_path = addr->prop.errors_address;
+#ifdef EXPERIMENTAL_SRS
+ else if(addr->prop.srs_sender)
+ return_path = addr->prop.srs_sender;
+#endif
+ else
+ return_path = sender_address;
+
+ if (tp->return_path)
+ {
+ uschar *new_return_path = expand_string(tp->return_path);
+ if (new_return_path)
+ return_path = new_return_path;
+ else if (!f.expand_string_forcedfail)
+ {
+ panicmsg = string_sprintf("Failed to expand return path \"%s\": %s",
+ tp->return_path, expand_string_message);
+ goto enq_continue;
+ }
+ }
+
+ /* Find the uid, gid, and use_initgroups setting for this transport. Failure
+ logs and sets up error messages, so we just post-process and continue with
+ the next address. */
+
+ if (!findugid(addr, tp, &uid, &gid, &use_initgroups))
+ {
+ panicmsg = NULL;
+ goto enq_continue;
+ }
+
+ /* If this transport has a setup function, call it now so that it gets
+ run in this process and not in any subprocess. That way, the results of
+ any setup that are retained by the transport can be reusable. One of the
+ things the setup does is to set the fallback host lists in the addresses.
+ That is why it is called at this point, before the continue delivery
+ processing, because that might use the fallback hosts. */
+
+ if (tp->setup)
+ (void)((tp->setup)(addr->transport, addr, NULL, uid, gid, NULL));
+
+ /* If we have a connection still open from a verify stage (lazy-close)
+ treat it as if it is a continued connection (apart from the counter used
+ for the log line mark). */
+
+ if (cutthrough.cctx.sock >= 0 && cutthrough.callout_hold_only)
+ {
+ DEBUG(D_deliver)
+ debug_printf("lazy-callout-close: have conn still open from verification\n");
+ continue_transport = cutthrough.transport;
+ continue_hostname = string_copy(cutthrough.host.name);
+ continue_host_address = string_copy(cutthrough.host.address);
+ continue_sequence = 1;
+ sending_ip_address = cutthrough.snd_ip;
+ sending_port = cutthrough.snd_port;
+ smtp_peer_options = cutthrough.peer_options;
+ }
+
+ /* If this is a run to continue delivery down an already-established
+ channel, check that this set of addresses matches the transport and
+ the channel. If it does not, defer the addresses. If a host list exists,
+ we must check that the continue host is on the list. Otherwise, the
+ host is set in the transport. */
+
+ f.continue_more = FALSE; /* In case got set for the last lot */
+ if (continue_transport)
+ {
+ BOOL ok = Ustrcmp(continue_transport, tp->name) == 0;
+/*XXX do we need to check for a DANEd conn vs. a change of domain? */
+
+ /* If the transport is about to override the host list do not check
+ it here but take the cost of running the transport process to discover
+ if the continued_hostname connection is suitable. This is a layering
+ violation which is unfortunate as it requires we haul in the smtp
+ include file. */
+
+ if (ok)
+ {
+ smtp_transport_options_block * ob;
+
+ if ( !( Ustrcmp(tp->info->driver_name, "smtp") == 0
+ && (ob = (smtp_transport_options_block *)tp->options_block)
+ && ob->hosts_override && ob->hosts
+ )
+ && addr->host_list
+ )
+ {
+ ok = FALSE;
+ for (host_item * h = addr->host_list; h; h = h->next)
+ if (Ustrcmp(h->name, continue_hostname) == 0)
+ /*XXX should also check port here */
+ { ok = TRUE; break; }
+ }
+ }
+
+ /* Addresses not suitable; defer or queue for fallback hosts (which
+ might be the continue host) and skip to next address. */
+
+ if (!ok)
+ {
+ DEBUG(D_deliver) debug_printf("not suitable for continue_transport (%s)\n",
+ Ustrcmp(continue_transport, tp->name) != 0
+ ? string_sprintf("tpt %s vs %s", continue_transport, tp->name)
+ : string_sprintf("no host matching %s", continue_hostname));
+ if (serialize_key) enq_end(serialize_key);
+
+ if (addr->fallback_hosts && !fallback)
+ {
+ for (next = addr; ; next = next->next)
+ {
+ next->host_list = next->fallback_hosts;
+ DEBUG(D_deliver) debug_printf("%s queued for fallback host(s)\n", next->address);
+ if (!next->next) break;
+ }
+ next->next = addr_fallback;
+ addr_fallback = addr;
+ }
+
+ else
+ {
+ for (next = addr; ; next = next->next)
+ {
+ DEBUG(D_deliver) debug_printf(" %s to def list\n", next->address);
+ if (!next->next) break;
+ }
+ next->next = addr_defer;
+ addr_defer = addr;
+ }
+
+ continue;
+ }
+
+ /* Set a flag indicating whether there are further addresses that list
+ the continued host. This tells the transport to leave the channel open,
+ but not to pass it to another delivery process. We'd like to do that
+ for non-continue_transport cases too but the knowlege of which host is
+ connected to is too hard to manage. Perhaps we need a finer-grain
+ interface to the transport. */
+
+ for (next = addr_remote; next && !f.continue_more; next = next->next)
+ for (host_item * h = next->host_list; h; h = h->next)
+ if (Ustrcmp(h->name, continue_hostname) == 0)
+ { f.continue_more = TRUE; break; }
+ }
+
+ /* The transports set up the process info themselves as they may connect
+ to more than one remote machine. They also have to set up the filter
+ arguments, if required, so that the host name and address are available
+ for expansion. */
+
+ transport_filter_argv = NULL;
+
+ /* Create the pipe for inter-process communication. If pipe creation
+ fails, it is probably because the value of remote_max_parallel is so
+ large that too many file descriptors for pipes have been created. Arrange
+ to wait for a process to finish, and then try again. If we still can't
+ create a pipe when all processes have finished, break the retry loop. */
+
+ while (!pipe_done)
+ {
+ if (pipe(pfd) == 0) pipe_done = TRUE;
+ else if (parcount > 0) parmax = parcount;
+ else break;
+
+ /* We need to make the reading end of the pipe non-blocking. There are
+ two different options for this. Exim is cunningly (I hope!) coded so
+ that it can use either of them, though it prefers O_NONBLOCK, which
+ distinguishes between EOF and no-more-data. */
+
+/* The data appears in a timely manner and we already did a select on
+all pipes, so I do not see a reason to use non-blocking IO here
+
+#ifdef O_NONBLOCK
+ (void)fcntl(pfd[pipe_read], F_SETFL, O_NONBLOCK);
+#else
+ (void)fcntl(pfd[pipe_read], F_SETFL, O_NDELAY);
+#endif
+*/
+
+ /* If the maximum number of subprocesses already exist, wait for a process
+ to finish. If we ran out of file descriptors, parmax will have been reduced
+ from its initial value of remote_max_parallel. */
+
+ par_reduce(parmax - 1, fallback);
+ }
+
+ /* If we failed to create a pipe and there were no processes to wait
+ for, we have to give up on this one. Do this outside the above loop
+ so that we can continue the main loop. */
+
+ if (!pipe_done)
+ {
+ panicmsg = string_sprintf("unable to create pipe: %s", strerror(errno));
+ goto enq_continue;
+ }
+
+ /* Find a free slot in the pardata list. Must do this after the possible
+ waiting for processes to finish, because a terminating process will free
+ up a slot. */
+
+ for (poffset = 0; poffset < remote_max_parallel; poffset++)
+ if (parlist[poffset].pid == 0)
+ break;
+
+ /* If there isn't one, there has been a horrible disaster. */
+
+ if (poffset >= remote_max_parallel)
+ {
+ (void)close(pfd[pipe_write]);
+ (void)close(pfd[pipe_read]);
+ panicmsg = US"Unexpectedly no free subprocess slot";
+ goto enq_continue;
+ }
+
+ /* Now fork a subprocess to do the remote delivery, but before doing so,
+ ensure that any cached resources are released so as not to interfere with
+ what happens in the subprocess. */
+
+ search_tidyup();
+
+ if ((pid = exim_fork(US"transport")) == 0)
+ {
+ int fd = pfd[pipe_write];
+ host_item *h;
+
+ /* Setting this global in the subprocess means we need never clear it */
+ transport_name = tp->name;
+
+ /* There are weird circumstances in which logging is disabled */
+ f.disable_logging = tp->disable_logging;
+
+ /* Show pids on debug output if parallelism possible */
+
+ if (parmax > 1 && (parcount > 0 || addr_remote))
+ DEBUG(D_any|D_v) debug_selector |= D_pid;
+
+ /* Reset the random number generator, so different processes don't all
+ have the same sequence. In the test harness we want different, but
+ predictable settings for each delivery process, so do something explicit
+ here rather they rely on the fixed reset in the random number function. */
+
+ random_seed = f.running_in_test_harness ? 42 + 2*delivery_count : 0;
+
+ /* Set close-on-exec on the pipe so that it doesn't get passed on to
+ a new process that may be forked to do another delivery down the same
+ SMTP connection. */
+
+ (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+
+ /* Close open file descriptors for the pipes of other processes
+ that are running in parallel. */
+
+ for (poffset = 0; poffset < remote_max_parallel; poffset++)
+ if (parlist[poffset].pid != 0) (void)close(parlist[poffset].fd);
+
+ /* This process has inherited a copy of the file descriptor
+ for the data file, but its file pointer is shared with all the
+ other processes running in parallel. Therefore, we have to re-open
+ the file in order to get a new file descriptor with its own
+ file pointer. We don't need to lock it, as the lock is held by
+ the parent process. There doesn't seem to be any way of doing
+ a dup-with-new-file-pointer. */
+
+ (void)close(deliver_datafile);
+ {
+ uschar * fname = spool_fname(US"input", message_subdir, message_id, US"-D");
+
+ if ((deliver_datafile = Uopen(fname,
+#ifdef O_CLOEXEC
+ O_CLOEXEC |
+#endif
+ O_RDWR | O_APPEND, 0)) < 0)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Failed to reopen %s for remote "
+ "parallel delivery: %s", fname, strerror(errno));
+ }
+
+ /* Set the close-on-exec flag */
+#ifndef O_CLOEXEC
+ (void)fcntl(deliver_datafile, F_SETFD, fcntl(deliver_datafile, F_GETFD) |
+ FD_CLOEXEC);
+#endif
+
+ /* Set the uid/gid of this process; bombs out on failure. */
+
+ exim_setugid(uid, gid, use_initgroups,
+ string_sprintf("remote delivery to %s with transport=%s",
+ addr->address, tp->name));
+
+ /* Close the unwanted half of this process' pipe, set the process state,
+ and run the transport. Afterwards, transport_count will contain the number
+ of bytes written. */
+
+ (void)close(pfd[pipe_read]);
+ set_process_info("delivering %s using %s", message_id, tp->name);
+ debug_print_string(tp->debug_string);
+ if (!(tp->info->code)(addr->transport, addr)) replicate_status(addr);
+
+ set_process_info("delivering %s (just run %s for %s%s in subprocess)",
+ message_id, tp->name, addr->address, addr->next ? ", ..." : "");
+
+ /* Ensure any cached resources that we used are now released */
+
+ search_tidyup();
+
+ /* Pass the result back down the pipe. This is a lot more information
+ than is needed for a local delivery. We have to send back the error
+ status for each address, the usability status for each host that is
+ flagged as unusable, and all the retry items. When TLS is in use, we
+ send also the cipher and peerdn information. Each type of information
+ is flagged by an identifying byte, and is then in a fixed format (with
+ strings terminated by zeros), and there is a final terminator at the
+ end. The host information and retry information is all attached to
+ the first address, so that gets sent at the start. */
+
+ /* Host unusability information: for most success cases this will
+ be null. */
+
+ for (h = addr->host_list; h; h = h->next)
+ {
+ if (!h->address || h->status < hstatus_unusable) continue;
+ sprintf(CS big_buffer, "%c%c%s", h->status, h->why, h->address);
+ rmt_dlv_checked_write(fd, 'H', '0', big_buffer, Ustrlen(big_buffer+2) + 3);
+ }
+
+ /* The number of bytes written. This is the same for each address. Even
+ if we sent several copies of the message down the same connection, the
+ size of each one is the same, and it's that value we have got because
+ transport_count gets reset before calling transport_write_message(). */
+
+ memcpy(big_buffer, &transport_count, sizeof(transport_count));
+ rmt_dlv_checked_write(fd, 'S', '0', big_buffer, sizeof(transport_count));
+
+ /* Information about what happened to each address. Four item types are
+ used: an optional 'X' item first, for TLS information, then an optional "C"
+ item for any client-auth info followed by 'R' items for any retry settings,
+ and finally an 'A' item for the remaining data. */
+
+ for(; addr; addr = addr->next)
+ {
+ uschar *ptr;
+
+ /* The certificate verification status goes into the flags */
+ if (tls_out.certificate_verified) setflag(addr, af_cert_verified);
+#ifdef SUPPORT_DANE
+ if (tls_out.dane_verified) setflag(addr, af_dane_verified);
+#endif
+# ifdef EXPERIMENTAL_TLS_RESUME
+ if (tls_out.resumption & RESUME_USED) setflag(addr, af_tls_resume);
+# endif
+
+ /* Use an X item only if there's something to send */
+#ifndef DISABLE_TLS
+ if (addr->cipher)
+ {
+ ptr = big_buffer + sprintf(CS big_buffer, "%.128s", addr->cipher) + 1;
+ if (!addr->peerdn)
+ *ptr++ = 0;
+ else
+ ptr += sprintf(CS ptr, "%.512s", addr->peerdn) + 1;
+
+ rmt_dlv_checked_write(fd, 'X', '1', big_buffer, ptr - big_buffer);
+ }
+ else if (continue_proxy_cipher)
+ {
+ ptr = big_buffer + sprintf(CS big_buffer, "%.128s", continue_proxy_cipher) + 1;
+ *ptr++ = 0;
+ rmt_dlv_checked_write(fd, 'X', '1', big_buffer, ptr - big_buffer);
+ }
+
+ if (addr->peercert)
+ {
+ ptr = big_buffer;
+ if (tls_export_cert(ptr, big_buffer_size-2, addr->peercert))
+ while(*ptr++);
+ else
+ *ptr++ = 0;
+ rmt_dlv_checked_write(fd, 'X', '2', big_buffer, ptr - big_buffer);
+ }
+ if (addr->ourcert)
+ {
+ ptr = big_buffer;
+ if (tls_export_cert(ptr, big_buffer_size-2, addr->ourcert))
+ while(*ptr++);
+ else
+ *ptr++ = 0;
+ rmt_dlv_checked_write(fd, 'X', '3', big_buffer, ptr - big_buffer);
+ }
+# ifndef DISABLE_OCSP
+ if (addr->ocsp > OCSP_NOT_REQ)
+ {
+ ptr = big_buffer + sprintf(CS big_buffer, "%c", addr->ocsp + '0') + 1;
+ rmt_dlv_checked_write(fd, 'X', '4', big_buffer, ptr - big_buffer);
+ }
+# endif
+#endif /*DISABLE_TLS*/
+
+ if (client_authenticator)
+ {
+ ptr = big_buffer + sprintf(CS big_buffer, "%.64s", client_authenticator) + 1;
+ rmt_dlv_checked_write(fd, 'C', '1', big_buffer, ptr - big_buffer);
+ }
+ if (client_authenticated_id)
+ {
+ ptr = big_buffer + sprintf(CS big_buffer, "%.64s", client_authenticated_id) + 1;
+ rmt_dlv_checked_write(fd, 'C', '2', big_buffer, ptr - big_buffer);
+ }
+ if (client_authenticated_sender)
+ {
+ ptr = big_buffer + sprintf(CS big_buffer, "%.64s", client_authenticated_sender) + 1;
+ rmt_dlv_checked_write(fd, 'C', '3', big_buffer, ptr - big_buffer);
+ }
+
+#ifndef DISABLE_PRDR
+ if (testflag(addr, af_prdr_used))
+ rmt_dlv_checked_write(fd, 'P', '0', NULL, 0);
+#endif
+
+ if (testflag(addr, af_pipelining))
+#ifndef DISABLE_PIPE_CONNECT
+ if (testflag(addr, af_early_pipe))
+ rmt_dlv_checked_write(fd, 'L', '2', NULL, 0);
+ else
+#endif
+ rmt_dlv_checked_write(fd, 'L', '1', NULL, 0);
+
+ if (testflag(addr, af_chunking_used))
+ rmt_dlv_checked_write(fd, 'K', '0', NULL, 0);
+
+ if (testflag(addr, af_tcp_fastopen_conn))
+ rmt_dlv_checked_write(fd, 'T',
+ testflag(addr, af_tcp_fastopen) ? testflag(addr, af_tcp_fastopen_data)
+ ? '2' : '1' : '0',
+ NULL, 0);
+
+ memcpy(big_buffer, &addr->dsn_aware, sizeof(addr->dsn_aware));
+ rmt_dlv_checked_write(fd, 'D', '0', big_buffer, sizeof(addr->dsn_aware));
+
+ /* Retry information: for most success cases this will be null. */
+
+ for (retry_item * r = addr->retries; r; r = r->next)
+ {
+ sprintf(CS big_buffer, "%c%.500s", r->flags, r->key);
+ ptr = big_buffer + Ustrlen(big_buffer+2) + 3;
+ memcpy(ptr, &r->basic_errno, sizeof(r->basic_errno));
+ ptr += sizeof(r->basic_errno);
+ memcpy(ptr, &r->more_errno, sizeof(r->more_errno));
+ ptr += sizeof(r->more_errno);
+ if (!r->message) *ptr++ = 0; else
+ {
+ sprintf(CS ptr, "%.512s", r->message);
+ while(*ptr++);
+ }
+ rmt_dlv_checked_write(fd, 'R', '0', big_buffer, ptr - big_buffer);
+ }
+
+#ifdef SUPPORT_SOCKS
+ if (LOGGING(proxy) && proxy_session)
+ {
+ ptr = big_buffer;
+ if (proxy_local_address)
+ {
+ DEBUG(D_deliver) debug_printf("proxy_local_address '%s'\n", proxy_local_address);
+ ptr = big_buffer + sprintf(CS ptr, "%.128s", proxy_local_address) + 1;
+ DEBUG(D_deliver) debug_printf("proxy_local_port %d\n", proxy_local_port);
+ memcpy(ptr, &proxy_local_port, sizeof(proxy_local_port));
+ ptr += sizeof(proxy_local_port);
+ }
+ else
+ *ptr++ = '\0';
+ rmt_dlv_checked_write(fd, 'A', '2', big_buffer, ptr - big_buffer);
+ }
+#endif
+
+#ifdef EXPERIMENTAL_DSN_INFO
+/*um, are they really per-addr? Other per-conn stuff is not (auth, tls). But host_used is! */
+ if (addr->smtp_greeting)
+ {
+ DEBUG(D_deliver) debug_printf("smtp_greeting '%s'\n", addr->smtp_greeting);
+ ptr = big_buffer + sprintf(CS big_buffer, "%.128s", addr->smtp_greeting) + 1;
+ if (addr->helo_response)
+ {
+ DEBUG(D_deliver) debug_printf("helo_response '%s'\n", addr->helo_response);
+ ptr += sprintf(CS ptr, "%.128s", addr->helo_response) + 1;
+ }
+ else
+ *ptr++ = '\0';
+ rmt_dlv_checked_write(fd, 'A', '1', big_buffer, ptr - big_buffer);
+ }
+#endif
+
+ /* The rest of the information goes in an 'A0' item. */
+
+ sprintf(CS big_buffer, "%c%c", addr->transport_return, addr->special_action);
+ ptr = big_buffer + 2;
+ memcpy(ptr, &addr->basic_errno, sizeof(addr->basic_errno));
+ ptr += sizeof(addr->basic_errno);
+ memcpy(ptr, &addr->more_errno, sizeof(addr->more_errno));
+ ptr += sizeof(addr->more_errno);
+ memcpy(ptr, &addr->delivery_time, sizeof(addr->delivery_time));
+ ptr += sizeof(addr->delivery_time);
+ memcpy(ptr, &addr->flags, sizeof(addr->flags));
+ ptr += sizeof(addr->flags);
+
+ if (!addr->message) *ptr++ = 0; else
+ ptr += sprintf(CS ptr, "%.1024s", addr->message) + 1;
+
+ if (!addr->user_message) *ptr++ = 0; else
+ ptr += sprintf(CS ptr, "%.1024s", addr->user_message) + 1;
+
+ if (!addr->host_used) *ptr++ = 0; else
+ {
+ ptr += sprintf(CS ptr, "%.256s", addr->host_used->name) + 1;
+ ptr += sprintf(CS ptr, "%.64s", addr->host_used->address) + 1;
+ memcpy(ptr, &addr->host_used->port, sizeof(addr->host_used->port));
+ ptr += sizeof(addr->host_used->port);
+
+ /* DNS lookup status */
+ *ptr++ = addr->host_used->dnssec==DS_YES ? '2'
+ : addr->host_used->dnssec==DS_NO ? '1' : '0';
+
+ }
+ rmt_dlv_checked_write(fd, 'A', '0', big_buffer, ptr - big_buffer);
+ }
+
+ /* Local interface address/port */
+#ifdef EXPERIMENTAL_DSN_INFO
+ if (sending_ip_address)
+#else
+ if (LOGGING(incoming_interface) && sending_ip_address)
+#endif
+ {
+ uschar * ptr;
+ ptr = big_buffer + sprintf(CS big_buffer, "%.128s", sending_ip_address) + 1;
+ ptr += sprintf(CS ptr, "%d", sending_port) + 1;
+ rmt_dlv_checked_write(fd, 'I', '0', big_buffer, ptr - big_buffer);
+ }
+
+ /* Add termination flag, close the pipe, and that's it. The character
+ after 'Z' indicates whether continue_transport is now NULL or not.
+ A change from non-NULL to NULL indicates a problem with a continuing
+ connection. */
+
+ big_buffer[0] = continue_transport ? '1' : '0';
+ rmt_dlv_checked_write(fd, 'Z', '0', big_buffer, 1);
+ (void)close(fd);
+ exit(EXIT_SUCCESS);
+ }
+
+ /* Back in the mainline: close the unwanted half of the pipe. */
+
+ (void)close(pfd[pipe_write]);
+
+ /* If we have a connection still open from a verify stage (lazy-close)
+ release its TLS library context (if any) as responsibility was passed to
+ the delivery child process. */
+
+ if (cutthrough.cctx.sock >= 0 && cutthrough.callout_hold_only)
+ {
+#ifndef DISABLE_TLS
+ if (cutthrough.is_tls)
+ tls_close(cutthrough.cctx.tls_ctx, TLS_NO_SHUTDOWN);
+#endif
+ (void) close(cutthrough.cctx.sock);
+ release_cutthrough_connection(US"passed to transport proc");
+ }
+
+ /* Fork failed; defer with error message */
+
+ if (pid == -1)
+ {
+ (void)close(pfd[pipe_read]);
+ panicmsg = string_sprintf("fork failed for remote delivery to %s: %s",
+ addr->domain, strerror(errno));
+ goto enq_continue;
+ }
+
+ /* Fork succeeded; increment the count, and remember relevant data for
+ when the process finishes. */
+
+ parcount++;
+ parlist[poffset].addrlist = parlist[poffset].addr = addr;
+ parlist[poffset].pid = pid;
+ parlist[poffset].fd = pfd[pipe_read];
+ parlist[poffset].done = FALSE;
+ parlist[poffset].msg = NULL;
+ parlist[poffset].return_path = return_path;
+
+ /* If the process we've just started is sending a message down an existing
+ channel, wait for it now. This ensures that only one such process runs at
+ once, whatever the value of remote_max parallel. Otherwise, we might try to
+ send two or more messages simultaneously down the same channel. This could
+ happen if there are different domains that include the same host in otherwise
+ different host lists.
+
+ Also, if the transport closes down the channel, this information gets back
+ (continue_transport gets set to NULL) before we consider any other addresses
+ in this message. */
+
+ if (continue_transport) par_reduce(0, fallback);
+
+ /* Otherwise, if we are running in the test harness, wait a bit, to let the
+ newly created process get going before we create another process. This should
+ ensure repeatability in the tests. Wait long enough for most cases to complete
+ the transport. */
+
+ else testharness_pause_ms(600);
+
+ continue;
+
+enq_continue:
+ if (serialize_key) enq_end(serialize_key);
+panic_continue:
+ remote_post_process(addr, LOG_MAIN|LOG_PANIC, panicmsg, fallback);
+ continue;
+ }
+
+/* Reached the end of the list of addresses. Wait for all the subprocesses that
+are still running and post-process their addresses. */
+
+par_reduce(0, fallback);
+return TRUE;
+}
+
+
+
+
+/*************************************************
+* Split an address into local part and domain *
+*************************************************/
+
+/* This function initializes an address for routing by splitting it up into a
+local part and a domain. The local part is set up twice - once in its original
+casing, and once in lower case, and it is dequoted. We also do the "percent
+hack" for configured domains. This may lead to a DEFER result if a lookup
+defers. When a percent-hacking takes place, we insert a copy of the original
+address as a new parent of this address, as if we have had a redirection.
+
+Argument:
+ addr points to an addr_item block containing the address
+
+Returns: OK
+ DEFER - could not determine if domain is %-hackable
+*/
+
+int
+deliver_split_address(address_item * addr)
+{
+uschar * address = addr->address;
+uschar * domain;
+uschar * t;
+int len;
+
+if (!(domain = Ustrrchr(address, '@')))
+ return DEFER; /* should always have a domain, but just in case... */
+
+len = domain - address;
+addr->domain = string_copylc(domain+1); /* Domains are always caseless */
+
+/* The implication in the RFCs (though I can't say I've seen it spelled out
+explicitly) is that quoting should be removed from local parts at the point
+where they are locally interpreted. [The new draft "821" is more explicit on
+this, Jan 1999.] We know the syntax is valid, so this can be done by simply
+removing quoting backslashes and any unquoted doublequotes. */
+
+t = addr->cc_local_part = store_get(len+1, is_tainted(address));
+while(len-- > 0)
+ {
+ int c = *address++;
+ if (c == '\"') continue;
+ if (c == '\\')
+ {
+ *t++ = *address++;
+ len--;
+ }
+ else *t++ = c;
+ }
+*t = 0;
+
+/* We do the percent hack only for those domains that are listed in
+percent_hack_domains. A loop is required, to copy with multiple %-hacks. */
+
+if (percent_hack_domains)
+ {
+ int rc;
+ uschar *new_address = NULL;
+ uschar *local_part = addr->cc_local_part;
+
+ deliver_domain = addr->domain; /* set $domain */
+
+ while ( (rc = match_isinlist(deliver_domain, (const uschar **)&percent_hack_domains, 0,
+ &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
+ == OK
+ && (t = Ustrrchr(local_part, '%')) != NULL
+ )
+ {
+ new_address = string_copy(local_part);
+ new_address[t - local_part] = '@';
+ deliver_domain = string_copylc(t+1);
+ local_part = string_copyn(local_part, t - local_part);
+ }
+
+ if (rc == DEFER) return DEFER; /* lookup deferred */
+
+ /* If hackery happened, set up new parent and alter the current address. */
+
+ if (new_address)
+ {
+ address_item *new_parent = store_get(sizeof(address_item), FALSE);
+ *new_parent = *addr;
+ addr->parent = new_parent;
+ new_parent->child_count = 1;
+ addr->address = new_address;
+ addr->unique = string_copy(new_address);
+ addr->domain = deliver_domain;
+ addr->cc_local_part = local_part;
+ DEBUG(D_deliver) debug_printf("%%-hack changed address to: %s\n",
+ addr->address);
+ }
+ }
+
+/* Create the lowercased version of the final local part, and make that the
+default one to be used. */
+
+addr->local_part = addr->lc_local_part = string_copylc(addr->cc_local_part);
+return OK;
+}
+
+
+
+
+/*************************************************
+* Get next error message text *
+*************************************************/
+
+/* If f is not NULL, read the next "paragraph", from a customized error message
+text file, terminated by a line containing ****, and expand it.
+
+Arguments:
+ f NULL or a file to read from
+ which string indicating which string (for errors)
+
+Returns: NULL or an expanded string
+*/
+
+static uschar *
+next_emf(FILE *f, uschar *which)
+{
+uschar *yield;
+gstring * para;
+uschar buffer[256];
+
+if (!f) return NULL;
+
+if (!Ufgets(buffer, sizeof(buffer), f) || Ustrcmp(buffer, "****\n") == 0)
+ return NULL;
+
+para = string_get(256);
+for (;;)
+ {
+ para = string_cat(para, buffer);
+ if (!Ufgets(buffer, sizeof(buffer), f) || Ustrcmp(buffer, "****\n") == 0)
+ break;
+ }
+if ((yield = expand_string(string_from_gstring(para))))
+ return yield;
+
+log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand string from "
+ "bounce_message_file or warn_message_file (%s): %s", which,
+ expand_string_message);
+return NULL;
+}
+
+
+
+
+/*************************************************
+* Close down a passed transport channel *
+*************************************************/
+
+/* This function is called when a passed transport channel cannot be used.
+It attempts to close it down tidily. The yield is always DELIVER_NOT_ATTEMPTED
+so that the function call can be the argument of a "return" statement.
+
+Arguments: None
+Returns: DELIVER_NOT_ATTEMPTED
+*/
+
+static int
+continue_closedown(void)
+{
+if (continue_transport)
+ for (transport_instance * t = transports; t; t = t->next)
+ if (Ustrcmp(t->name, continue_transport) == 0)
+ {
+ if (t->info->closedown) (t->info->closedown)(t);
+ break;
+ }
+return DELIVER_NOT_ATTEMPTED;
+}
+
+
+
+
+/*************************************************
+* Print address information *
+*************************************************/
+
+/* This function is called to output an address, or information about an
+address, for bounce or defer messages. If the hide_child flag is set, all we
+output is the original ancestor address.
+
+Arguments:
+ addr points to the address
+ f the FILE to print to
+ si an initial string
+ sc a continuation string for before "generated"
+ se an end string
+
+Returns: TRUE if the address is not hidden
+*/
+
+static BOOL
+print_address_information(address_item *addr, FILE *f, uschar *si, uschar *sc,
+ uschar *se)
+{
+BOOL yield = TRUE;
+uschar *printed = US"";
+address_item *ancestor = addr;
+while (ancestor->parent) ancestor = ancestor->parent;
+
+fprintf(f, "%s", CS si);
+
+if (addr->parent && testflag(addr, af_hide_child))
+ {
+ printed = US"an undisclosed address";
+ yield = FALSE;
+ }
+else if (!testflag(addr, af_pfr) || !addr->parent)
+ printed = addr->address;
+
+else
+ {
+ uschar *s = addr->address;
+ uschar *ss;
+
+ if (addr->address[0] == '>') { ss = US"mail"; s++; }
+ else if (addr->address[0] == '|') ss = US"pipe";
+ else ss = US"save";
+
+ fprintf(f, "%s to %s%sgenerated by ", ss, s, sc);
+ printed = addr->parent->address;
+ }
+
+fprintf(f, "%s", CS string_printing(printed));
+
+if (ancestor != addr)
+ {
+ uschar *original = ancestor->onetime_parent;
+ if (!original) original= ancestor->address;
+ if (strcmpic(original, printed) != 0)
+ fprintf(f, "%s(%sgenerated from %s)", sc,
+ ancestor != addr->parent ? "ultimately " : "",
+ string_printing(original));
+ }
+
+if (addr->host_used)
+ fprintf(f, "\n host %s [%s]",
+ addr->host_used->name, addr->host_used->address);
+
+fprintf(f, "%s", CS se);
+return yield;
+}
+
+
+
+
+
+/*************************************************
+* Print error for an address *
+*************************************************/
+
+/* This function is called to print the error information out of an address for
+a bounce or a warning message. It tries to format the message reasonably by
+introducing newlines. All lines are indented by 4; the initial printing
+position must be set before calling.
+
+This function used always to print the error. Nowadays we want to restrict it
+to cases such as LMTP/SMTP errors from a remote host, and errors from :fail:
+and filter "fail". We no longer pass other information willy-nilly in bounce
+and warning messages. Text in user_message is always output; text in message
+only if the af_pass_message flag is set.
+
+Arguments:
+ addr the address
+ f the FILE to print on
+ t some leading text
+
+Returns: nothing
+*/
+
+static void
+print_address_error(address_item *addr, FILE *f, uschar *t)
+{
+int count = Ustrlen(t);
+uschar *s = testflag(addr, af_pass_message) ? addr->message : NULL;
+
+if (!s && !(s = addr->user_message))
+ return;
+
+fprintf(f, "\n %s", t);
+
+while (*s)
+ if (*s == '\\' && s[1] == 'n')
+ {
+ fprintf(f, "\n ");
+ s += 2;
+ count = 0;
+ }
+ else
+ {
+ fputc(*s, f);
+ count++;
+ if (*s++ == ':' && isspace(*s) && count > 45)
+ {
+ fprintf(f, "\n "); /* sic (because space follows) */
+ count = 0;
+ }
+ }
+}
+
+
+/***********************************************************
+* Print Diagnostic-Code for an address *
+************************************************************/
+
+/* This function is called to print the error information out of an address for
+a bounce or a warning message. It tries to format the message reasonably as
+required by RFC 3461 by adding a space after each newline
+
+it uses the same logic as print_address_error() above. if af_pass_message is true
+and addr->message is set it uses the remote host answer. if not addr->user_message
+is used instead if available.
+
+Arguments:
+ addr the address
+ f the FILE to print on
+
+Returns: nothing
+*/
+
+static void
+print_dsn_diagnostic_code(const address_item *addr, FILE *f)
+{
+uschar * s = testflag(addr, af_pass_message) ? addr->message : NULL;
+unsigned cnt;
+
+/* af_pass_message and addr->message set ? print remote host answer */
+if (s)
+ {
+ DEBUG(D_deliver)
+ debug_printf("DSN Diagnostic-Code: addr->message = %s\n", addr->message);
+
+ /* search first ": ". we assume to find the remote-MTA answer there */
+ if (!(s = Ustrstr(addr->message, ": ")))
+ return; /* not found, bail out */
+ s += 2; /* skip ": " */
+ cnt = fprintf(f, "Diagnostic-Code: smtp; ");
+ }
+/* no message available. do nothing */
+else return;
+
+while (*s)
+ {
+ if (cnt > 950) /* RFC line length limit: 998 */
+ {
+ DEBUG(D_deliver) debug_printf("print_dsn_diagnostic_code() truncated line\n");
+ fputs("[truncated]", f);
+ break;
+ }
+
+ if (*s == '\\' && s[1] == 'n')
+ {
+ fputs("\n ", f); /* as defined in RFC 3461 */
+ s += 2;
+ cnt += 2;
+ }
+ else
+ {
+ fputc(*s++, f);
+ cnt++;
+ }
+ }
+
+fputc('\n', f);
+}
+
+
+/*************************************************
+* Check list of addresses for duplication *
+*************************************************/
+
+/* This function was introduced when the test for duplicate addresses that are
+not pipes, files, or autoreplies was moved from the middle of routing to when
+routing was complete. That was to fix obscure cases when the routing history
+affects the subsequent routing of identical addresses. This function is called
+after routing, to check that the final routed addresses are not duplicates.
+
+If we detect a duplicate, we remember what it is a duplicate of. Note that
+pipe, file, and autoreply de-duplication is handled during routing, so we must
+leave such "addresses" alone here, as otherwise they will incorrectly be
+discarded.
+
+Argument: address of list anchor
+Returns: nothing
+*/
+
+static void
+do_duplicate_check(address_item **anchor)
+{
+address_item *addr;
+while ((addr = *anchor))
+ {
+ tree_node *tnode;
+ if (testflag(addr, af_pfr))
+ {
+ anchor = &(addr->next);
+ }
+ else if ((tnode = tree_search(tree_duplicates, addr->unique)))
+ {
+ DEBUG(D_deliver|D_route)
+ debug_printf("%s is a duplicate address: discarded\n", addr->unique);
+ *anchor = addr->next;
+ addr->dupof = tnode->data.ptr;
+ addr->next = addr_duplicate;
+ addr_duplicate = addr;
+ }
+ else
+ {
+ tree_add_duplicate(addr->unique, addr);
+ anchor = &(addr->next);
+ }
+ }
+}
+
+
+
+
+/************************************************/
+
+static void
+print_dsn_addr_action(FILE * f, address_item * addr,
+ uschar * action, uschar * status)
+{
+address_item * pa;
+
+if (addr->dsn_orcpt)
+ fprintf(f,"Original-Recipient: %s\n", addr->dsn_orcpt);
+
+for (pa = addr; pa->parent; ) pa = pa->parent;
+fprintf(f, "Action: %s\n"
+ "Final-Recipient: rfc822;%s\n"
+ "Status: %s\n",
+ action, pa->address, status);
+}
+
+
+
+/* When running in the test harness, there's an option that allows us to
+fudge this time so as to get repeatability of the tests. Take the first
+time off the list. In queue runs, the list pointer gets updated in the
+calling process. */
+
+int
+test_harness_fudged_queue_time(int actual_time)
+{
+int qt;
+if ( f.running_in_test_harness && *fudged_queue_times
+ && (qt = readconf_readtime(fudged_queue_times, '/', FALSE)) >= 0)
+ {
+ DEBUG(D_deliver) debug_printf("fudged queue_times = %s\n",
+ fudged_queue_times);
+ return qt;
+ }
+return actual_time;
+}
+
+/************************************************/
+
+static FILE *
+expand_open(const uschar * filename,
+ const uschar * varname, const uschar * reason)
+{
+const uschar * s = expand_cstring(filename);
+FILE * fp = NULL;
+
+if (!s || !*s)
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "Failed to expand %s: '%s'\n", varname, filename);
+else if (*s != '/' || is_tainted(s))
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "%s is not %s after expansion: '%s'\n",
+ varname, *s == '/' ? "untainted" : "absolute", s);
+else if (!(fp = Ufopen(s, "rb")))
+ log_write(0, LOG_MAIN|LOG_PANIC, "Failed to open %s for %s "
+ "message texts: %s", s, reason, strerror(errno));
+return fp;
+}
+
+/*************************************************
+* Deliver one message *
+*************************************************/
+
+/* This is the function which is called when a message is to be delivered. It
+is passed the id of the message. It is possible that the message no longer
+exists, if some other process has delivered it, and it is also possible that
+the message is being worked on by another process, in which case the data file
+will be locked.
+
+If no delivery is attempted for any of the above reasons, the function returns
+DELIVER_NOT_ATTEMPTED.
+
+If the give_up flag is set true, do not attempt any deliveries, but instead
+fail all outstanding addresses and return the message to the sender (or
+whoever).
+
+A delivery operation has a process all to itself; we never deliver more than
+one message in the same process. Therefore we needn't worry too much about
+store leakage.
+
+Liable to be called as root.
+
+Arguments:
+ id the id of the message to be delivered
+ forced TRUE if delivery was forced by an administrator; this overrides
+ retry delays and causes a delivery to be tried regardless
+ give_up TRUE if an administrator has requested that delivery attempts
+ be abandoned
+
+Returns: When the global variable mua_wrapper is FALSE:
+ DELIVER_ATTEMPTED_NORMAL if a delivery attempt was made
+ DELIVER_NOT_ATTEMPTED otherwise (see comment above)
+ When the global variable mua_wrapper is TRUE:
+ DELIVER_MUA_SUCCEEDED if delivery succeeded
+ DELIVER_MUA_FAILED if delivery failed
+ DELIVER_NOT_ATTEMPTED if not attempted (should not occur)
+*/
+
+int
+deliver_message(uschar *id, BOOL forced, BOOL give_up)
+{
+int i, rc;
+int final_yield = DELIVER_ATTEMPTED_NORMAL;
+time_t now = time(NULL);
+address_item *addr_last = NULL;
+uschar *filter_message = NULL;
+int process_recipients = RECIP_ACCEPT;
+open_db dbblock;
+open_db *dbm_file;
+extern int acl_where;
+uschar *info;
+
+#ifdef MEASURE_TIMING
+report_time_since(&timestamp_startup, US"delivery start"); /* testcase 0022, 2100 */
+#endif
+
+info = queue_run_pid == (pid_t)0
+ ? string_sprintf("delivering %s", id)
+ : string_sprintf("delivering %s (queue run pid %d)", id, queue_run_pid);
+
+/* If the D_process_info bit is on, set_process_info() will output debugging
+information. If not, we want to show this initial information if D_deliver or
+D_queue_run is set or in verbose mode. */
+
+set_process_info("%s", info);
+
+if ( !(debug_selector & D_process_info)
+ && (debug_selector & (D_deliver|D_queue_run|D_v))
+ )
+ debug_printf("%s\n", info);
+
+/* Ensure that we catch any subprocesses that are created. Although Exim
+sets SIG_DFL as its initial default, some routes through the code end up
+here with it set to SIG_IGN - cases where a non-synchronous delivery process
+has been forked, but no re-exec has been done. We use sigaction rather than
+plain signal() on those OS where SA_NOCLDWAIT exists, because we want to be
+sure it is turned off. (There was a problem on AIX with this.) */
+
+#ifdef SA_NOCLDWAIT
+ {
+ struct sigaction act;
+ act.sa_handler = SIG_DFL;
+ sigemptyset(&(act.sa_mask));
+ act.sa_flags = 0;
+ sigaction(SIGCHLD, &act, NULL);
+ }
+#else
+signal(SIGCHLD, SIG_DFL);
+#endif
+
+/* Make the forcing flag available for routers and transports, set up the
+global message id field, and initialize the count for returned files and the
+message size. This use of strcpy() is OK because the length id is checked when
+it is obtained from a command line (the -M or -q options), and otherwise it is
+known to be a valid message id. */
+
+if (id != message_id)
+ Ustrcpy(message_id, id);
+f.deliver_force = forced;
+return_count = 0;
+message_size = 0;
+
+/* Initialize some flags */
+
+update_spool = FALSE;
+remove_journal = TRUE;
+
+/* Set a known context for any ACLs we call via expansions */
+acl_where = ACL_WHERE_DELIVERY;
+
+/* Reset the random number generator, so that if several delivery processes are
+started from a queue runner that has already used random numbers (for sorting),
+they don't all get the same sequence. */
+
+random_seed = 0;
+
+/* Open and lock the message's data file. Exim locks on this one because the
+header file may get replaced as it is re-written during the delivery process.
+Any failures cause messages to be written to the log, except for missing files
+while queue running - another process probably completed delivery. As part of
+opening the data file, message_subdir gets set. */
+
+if ((deliver_datafile = spool_open_datafile(id)) < 0)
+ return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */
+
+/* The value of message_size at this point has been set to the data length,
+plus one for the blank line that notionally precedes the data. */
+
+/* Now read the contents of the header file, which will set up the headers in
+store, and also the list of recipients and the tree of non-recipients and
+assorted flags. It updates message_size. If there is a reading or format error,
+give up; if the message has been around for sufficiently long, remove it. */
+
+ {
+ uschar * spoolname = string_sprintf("%s-H", id);
+ if ((rc = spool_read_header(spoolname, TRUE, TRUE)) != spool_read_OK)
+ {
+ if (errno == ERRNO_SPOOLFORMAT)
+ {
+ struct stat statbuf;
+ if (Ustat(spool_fname(US"input", message_subdir, spoolname, US""),
+ &statbuf) == 0)
+ log_write(0, LOG_MAIN, "Format error in spool file %s: "
+ "size=" OFF_T_FMT, spoolname, statbuf.st_size);
+ else
+ log_write(0, LOG_MAIN, "Format error in spool file %s", spoolname);
+ }
+ else
+ log_write(0, LOG_MAIN, "Error reading spool file %s: %s", spoolname,
+ strerror(errno));
+
+ /* If we managed to read the envelope data, received_time contains the
+ time the message was received. Otherwise, we can calculate it from the
+ message id. */
+
+ if (rc != spool_read_hdrerror)
+ {
+ received_time.tv_sec = received_time.tv_usec = 0;
+ /*XXX subsec precision?*/
+ for (i = 0; i < 6; i++)
+ received_time.tv_sec = received_time.tv_sec * BASE_62 + tab62[id[i] - '0'];
+ }
+
+ /* If we've had this malformed message too long, sling it. */
+
+ if (now - received_time.tv_sec > keep_malformed)
+ {
+ Uunlink(spool_fname(US"msglog", message_subdir, id, US""));
+ Uunlink(spool_fname(US"input", message_subdir, id, US"-D"));
+ Uunlink(spool_fname(US"input", message_subdir, id, US"-H"));
+ Uunlink(spool_fname(US"input", message_subdir, id, US"-J"));
+ log_write(0, LOG_MAIN, "Message removed because older than %s",
+ readconf_printtime(keep_malformed));
+ }
+
+ (void)close(deliver_datafile);
+ deliver_datafile = -1;
+ return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */
+ }
+ }
+
+/* The spool header file has been read. Look to see if there is an existing
+journal file for this message. If there is, it means that a previous delivery
+attempt crashed (program or host) before it could update the spool header file.
+Read the list of delivered addresses from the journal and add them to the
+nonrecipients tree. Then update the spool file. We can leave the journal in
+existence, as it will get further successful deliveries added to it in this
+run, and it will be deleted if this function gets to its end successfully.
+Otherwise it might be needed again. */
+
+ {
+ uschar * fname = spool_fname(US"input", message_subdir, id, US"-J");
+ FILE * jread;
+
+ if ( (journal_fd = Uopen(fname, O_RDWR|O_APPEND
+#ifdef O_CLOEXEC
+ | O_CLOEXEC
+#endif
+#ifdef O_NOFOLLOW
+ | O_NOFOLLOW
+#endif
+ , SPOOL_MODE)) >= 0
+ && lseek(journal_fd, 0, SEEK_SET) == 0
+ && (jread = fdopen(journal_fd, "rb"))
+ )
+ {
+ while (Ufgets(big_buffer, big_buffer_size, jread))
+ {
+ int n = Ustrlen(big_buffer);
+ big_buffer[n-1] = 0;
+ tree_add_nonrecipient(big_buffer);
+ DEBUG(D_deliver) debug_printf("Previously delivered address %s taken from "
+ "journal file\n", big_buffer);
+ }
+ rewind(jread);
+ if ((journal_fd = dup(fileno(jread))) < 0)
+ journal_fd = fileno(jread);
+ else
+ (void) fclose(jread); /* Try to not leak the FILE resource */
+
+ /* Panic-dies on error */
+ (void)spool_write_header(message_id, SW_DELIVERING, NULL);
+ }
+ else if (errno != ENOENT)
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC, "attempt to open journal for reading gave: "
+ "%s", strerror(errno));
+ return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */
+ }
+
+ /* A null recipients list indicates some kind of disaster. */
+
+ if (!recipients_list)
+ {
+ (void)close(deliver_datafile);
+ deliver_datafile = -1;
+ log_write(0, LOG_MAIN, "Spool error: no recipients for %s", fname);
+ return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */
+ }
+ }
+
+
+/* Handle a message that is frozen. There are a number of different things that
+can happen, but in the default situation, unless forced, no delivery is
+attempted. */
+
+if (f.deliver_freeze)
+ {
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+ /* Moving to another directory removes the message from Exim's view. Other
+ tools must be used to deal with it. Logging of this action happens in
+ spool_move_message() and its subfunctions. */
+
+ if ( move_frozen_messages
+ && spool_move_message(id, message_subdir, US"", US"F")
+ )
+ return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */
+#endif
+
+ /* For all frozen messages (bounces or not), timeout_frozen_after sets the
+ maximum time to keep messages that are frozen. Thaw if we reach it, with a
+ flag causing all recipients to be failed. The time is the age of the
+ message, not the time since freezing. */
+
+ if (timeout_frozen_after > 0 && message_age >= timeout_frozen_after)
+ {
+ log_write(0, LOG_MAIN, "cancelled by timeout_frozen_after");
+ process_recipients = RECIP_FAIL_TIMEOUT;
+ }
+
+ /* For bounce messages (and others with no sender), thaw if the error message
+ ignore timer is exceeded. The message will be discarded if this delivery
+ fails. */
+
+ else if (!*sender_address && message_age >= ignore_bounce_errors_after)
+ log_write(0, LOG_MAIN, "Unfrozen by errmsg timer");
+
+ /* If this is a bounce message, or there's no auto thaw, or we haven't
+ reached the auto thaw time yet, and this delivery is not forced by an admin
+ user, do not attempt delivery of this message. Note that forced is set for
+ continuing messages down the same channel, in order to skip load checking and
+ ignore hold domains, but we don't want unfreezing in that case. */
+
+ else
+ {
+ if ( ( sender_address[0] == 0
+ || auto_thaw <= 0
+ || now <= deliver_frozen_at + auto_thaw
+ )
+ && ( !forced || !f.deliver_force_thaw
+ || !f.admin_user || continue_hostname
+ ) )
+ {
+ (void)close(deliver_datafile);
+ deliver_datafile = -1;
+ log_write(L_skip_delivery, LOG_MAIN, "Message is frozen");
+ return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */
+ }
+
+ /* If delivery was forced (by an admin user), assume a manual thaw.
+ Otherwise it's an auto thaw. */
+
+ if (forced)
+ {
+ f.deliver_manual_thaw = TRUE;
+ log_write(0, LOG_MAIN, "Unfrozen by forced delivery");
+ }
+ else log_write(0, LOG_MAIN, "Unfrozen by auto-thaw");
+ }
+
+ /* We get here if any of the rules for unfreezing have triggered. */
+
+ f.deliver_freeze = FALSE;
+ update_spool = TRUE;
+ }
+
+
+/* Open the message log file if we are using them. This records details of
+deliveries, deferments, and failures for the benefit of the mail administrator.
+The log is not used by exim itself to track the progress of a message; that is
+done by rewriting the header spool file. */
+
+if (message_logs)
+ {
+ uschar * fname = spool_fname(US"msglog", message_subdir, id, US"");
+ uschar * error;
+ int fd;
+
+ if ((fd = open_msglog_file(fname, SPOOL_MODE, &error)) < 0)
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't %s message log %s: %s", error,
+ fname, strerror(errno));
+ return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */
+ }
+
+ /* Make a C stream out of it. */
+
+ if (!(message_log = fdopen(fd, "a")))
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't fdopen message log %s: %s",
+ fname, strerror(errno));
+ return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */
+ }
+ }
+
+
+/* If asked to give up on a message, log who did it, and set the action for all
+the addresses. */
+
+if (give_up)
+ {
+ struct passwd *pw = getpwuid(real_uid);
+ log_write(0, LOG_MAIN, "cancelled by %s",
+ pw ? US pw->pw_name : string_sprintf("uid %ld", (long int)real_uid));
+ process_recipients = RECIP_FAIL;
+ }
+
+/* Otherwise, if there are too many Received: headers, fail all recipients. */
+
+else if (received_count > received_headers_max)
+ process_recipients = RECIP_FAIL_LOOP;
+
+/* Otherwise, if a system-wide, address-independent message filter is
+specified, run it now, except in the case when we are failing all recipients as
+a result of timeout_frozen_after. If the system filter yields "delivered", then
+ignore the true recipients of the message. Failure of the filter file is
+logged, and the delivery attempt fails. */
+
+else if (system_filter && process_recipients != RECIP_FAIL_TIMEOUT)
+ {
+ int rc;
+ int filtertype;
+ ugid_block ugid;
+ redirect_block redirect;
+
+ if (system_filter_uid_set)
+ {
+ ugid.uid = system_filter_uid;
+ ugid.gid = system_filter_gid;
+ ugid.uid_set = ugid.gid_set = TRUE;
+ }
+ else
+ ugid.uid_set = ugid.gid_set = FALSE;
+
+ return_path = sender_address;
+ f.enable_dollar_recipients = TRUE; /* Permit $recipients in system filter */
+ f.system_filtering = TRUE;
+
+ /* Any error in the filter file causes a delivery to be abandoned. */
+
+ redirect.string = system_filter;
+ redirect.isfile = TRUE;
+ redirect.check_owner = redirect.check_group = FALSE;
+ redirect.owners = NULL;
+ redirect.owngroups = NULL;
+ redirect.pw = NULL;
+ redirect.modemask = 0;
+
+ DEBUG(D_deliver|D_filter) debug_printf("running system filter\n");
+
+ rc = rda_interpret(
+ &redirect, /* Where the data is */
+ RDO_DEFER | /* Turn on all the enabling options */
+ RDO_FAIL | /* Leave off all the disabling options */
+ RDO_FILTER |
+ RDO_FREEZE |
+ RDO_REALLOG |
+ RDO_REWRITE,
+ NULL, /* No :include: restriction (not used in filter) */
+ NULL, /* No sieve vacation directory (not sieve!) */
+ NULL, /* No sieve enotify mailto owner (not sieve!) */
+ NULL, /* No sieve user address (not sieve!) */
+ NULL, /* No sieve subaddress (not sieve!) */
+ &ugid, /* uid/gid data */
+ &addr_new, /* Where to hang generated addresses */
+ &filter_message, /* Where to put error message */
+ NULL, /* Don't skip syntax errors */
+ &filtertype, /* Will always be set to FILTER_EXIM for this call */
+ US"system filter"); /* For error messages */
+
+ DEBUG(D_deliver|D_filter) debug_printf("system filter returned %d\n", rc);
+
+ if (rc == FF_ERROR || rc == FF_NONEXIST)
+ {
+ (void)close(deliver_datafile);
+ deliver_datafile = -1;
+ log_write(0, LOG_MAIN|LOG_PANIC, "Error in system filter: %s",
+ string_printing(filter_message));
+ return continue_closedown(); /* yields DELIVER_NOT_ATTEMPTED */
+ }
+
+ /* Reset things. If the filter message is an empty string, which can happen
+ for a filter "fail" or "freeze" command with no text, reset it to NULL. */
+
+ f.system_filtering = FALSE;
+ f.enable_dollar_recipients = FALSE;
+ if (filter_message && filter_message[0] == 0) filter_message = NULL;
+
+ /* Save the values of the system filter variables so that user filters
+ can use them. */
+
+ memcpy(filter_sn, filter_n, sizeof(filter_sn));
+
+ /* The filter can request that delivery of the original addresses be
+ deferred. */
+
+ if (rc == FF_DEFER)
+ {
+ process_recipients = RECIP_DEFER;
+ deliver_msglog("Delivery deferred by system filter\n");
+ log_write(0, LOG_MAIN, "Delivery deferred by system filter");
+ }
+
+ /* The filter can request that a message be frozen, but this does not
+ take place if the message has been manually thawed. In that case, we must
+ unset "delivered", which is forced by the "freeze" command to make -bF
+ work properly. */
+
+ else if (rc == FF_FREEZE && !f.deliver_manual_thaw)
+ {
+ f.deliver_freeze = TRUE;
+ deliver_frozen_at = time(NULL);
+ process_recipients = RECIP_DEFER;
+ frozen_info = string_sprintf(" by the system filter%s%s",
+ filter_message ? US": " : US"",
+ filter_message ? filter_message : US"");
+ }
+
+ /* The filter can request that a message be failed. The error message may be
+ quite long - it is sent back to the sender in the bounce - but we don't want
+ to fill up the log with repetitions of it. If it starts with << then the text
+ between << and >> is written to the log, with the rest left for the bounce
+ message. */
+
+ else if (rc == FF_FAIL)
+ {
+ uschar *colon = US"";
+ uschar *logmsg = US"";
+ int loglen = 0;
+
+ process_recipients = RECIP_FAIL_FILTER;
+
+ if (filter_message)
+ {
+ uschar *logend;
+ colon = US": ";
+ if ( filter_message[0] == '<'
+ && filter_message[1] == '<'
+ && (logend = Ustrstr(filter_message, ">>"))
+ )
+ {
+ logmsg = filter_message + 2;
+ loglen = logend - logmsg;
+ filter_message = logend + 2;
+ if (filter_message[0] == 0) filter_message = NULL;
+ }
+ else
+ {
+ logmsg = filter_message;
+ loglen = Ustrlen(filter_message);
+ }
+ }
+
+ log_write(0, LOG_MAIN, "cancelled by system filter%s%.*s", colon, loglen,
+ logmsg);
+ }
+
+ /* Delivery can be restricted only to those recipients (if any) that the
+ filter specified. */
+
+ else if (rc == FF_DELIVERED)
+ {
+ process_recipients = RECIP_IGNORE;
+ if (addr_new)
+ log_write(0, LOG_MAIN, "original recipients ignored (system filter)");
+ else
+ log_write(0, LOG_MAIN, "=> discarded (system filter)");
+ }
+
+ /* If any new addresses were created by the filter, fake up a "parent"
+ for them. This is necessary for pipes, etc., which are expected to have
+ parents, and it also gives some sensible logging for others. Allow
+ pipes, files, and autoreplies, and run them as the filter uid if set,
+ otherwise as the current uid. */
+
+ if (addr_new)
+ {
+ int uid = system_filter_uid_set ? system_filter_uid : geteuid();
+ int gid = system_filter_gid_set ? system_filter_gid : getegid();
+
+ /* The text "system-filter" is tested in transport_set_up_command() and in
+ set_up_shell_command() in the pipe transport, to enable them to permit
+ $recipients, so don't change it here without also changing it there. */
+
+ address_item *p = addr_new;
+ address_item *parent = deliver_make_addr(US"system-filter", FALSE);
+
+ parent->domain = string_copylc(qualify_domain_recipient);
+ parent->local_part = US"system-filter";
+
+ /* As part of this loop, we arrange for addr_last to end up pointing
+ at the final address. This is used if we go on to add addresses for the
+ original recipients. */
+
+ while (p)
+ {
+ if (parent->child_count == USHRT_MAX)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "system filter generated more "
+ "than %d delivery addresses", USHRT_MAX);
+ parent->child_count++;
+ p->parent = parent;
+
+ if (testflag(p, af_pfr))
+ {
+ uschar *tpname;
+ uschar *type;
+ p->uid = uid;
+ p->gid = gid;
+ setflag(p, af_uid_set);
+ setflag(p, af_gid_set);
+ setflag(p, af_allow_file);
+ setflag(p, af_allow_pipe);
+ setflag(p, af_allow_reply);
+
+ /* Find the name of the system filter's appropriate pfr transport */
+
+ if (p->address[0] == '|')
+ {
+ type = US"pipe";
+ tpname = system_filter_pipe_transport;
+ address_pipe = p->address;
+ }
+ else if (p->address[0] == '>')
+ {
+ type = US"reply";
+ tpname = system_filter_reply_transport;
+ }
+ else
+ {
+ if (p->address[Ustrlen(p->address)-1] == '/')
+ {
+ type = US"directory";
+ tpname = system_filter_directory_transport;
+ }
+ else
+ {
+ type = US"file";
+ tpname = system_filter_file_transport;
+ }
+ address_file = p->address;
+ }
+
+ /* Now find the actual transport, first expanding the name. We have
+ set address_file or address_pipe above. */
+
+ if (tpname)
+ {
+ uschar *tmp = expand_string(tpname);
+ address_file = address_pipe = NULL;
+ if (!tmp)
+ p->message = string_sprintf("failed to expand \"%s\" as a "
+ "system filter transport name", tpname);
+ if (is_tainted(tmp))
+ p->message = string_sprintf("attempt to used tainted value '%s' for"
+ "transport '%s' as a system filter", tmp, tpname);
+ tpname = tmp;
+ }
+ else
+ p->message = string_sprintf("system_filter_%s_transport is unset",
+ type);
+
+ if (tpname)
+ {
+ transport_instance *tp;
+ for (tp = transports; tp; tp = tp->next)
+ if (Ustrcmp(tp->name, tpname) == 0)
+ {
+ p->transport = tp;
+ break;
+ }
+ if (!tp)
+ p->message = string_sprintf("failed to find \"%s\" transport "
+ "for system filter delivery", tpname);
+ }
+
+ /* If we couldn't set up a transport, defer the delivery, putting the
+ error on the panic log as well as the main log. */
+
+ if (!p->transport)
+ {
+ address_item *badp = p;
+ p = p->next;
+ if (!addr_last) addr_new = p; else addr_last->next = p;
+ badp->local_part = badp->address; /* Needed for log line */
+ post_process_one(badp, DEFER, LOG_MAIN|LOG_PANIC, EXIM_DTYPE_ROUTER, 0);
+ continue;
+ }
+ } /* End of pfr handling */
+
+ /* Either a non-pfr delivery, or we found a transport */
+
+ DEBUG(D_deliver|D_filter)
+ debug_printf("system filter added %s\n", p->address);
+
+ addr_last = p;
+ p = p->next;
+ } /* Loop through all addr_new addresses */
+ }
+ }
+
+
+/* Scan the recipients list, and for every one that is not in the non-
+recipients tree, add an addr item to the chain of new addresses. If the pno
+value is non-negative, we must set the onetime parent from it. This which
+points to the relevant entry in the recipients list.
+
+This processing can be altered by the setting of the process_recipients
+variable, which is changed if recipients are to be ignored, failed, or
+deferred. This can happen as a result of system filter activity, or if the -Mg
+option is used to fail all of them.
+
+Duplicate addresses are handled later by a different tree structure; we can't
+just extend the non-recipients tree, because that will be re-written to the
+spool if the message is deferred, and in any case there are casing
+complications for local addresses. */
+
+if (process_recipients != RECIP_IGNORE)
+ for (i = 0; i < recipients_count; i++)
+ if (!tree_search(tree_nonrecipients, recipients_list[i].address))
+ {
+ recipient_item *r = recipients_list + i;
+ address_item *new = deliver_make_addr(r->address, FALSE);
+ new->prop.errors_address = r->errors_to;
+#ifdef SUPPORT_I18N
+ if ((new->prop.utf8_msg = message_smtputf8))
+ {
+ new->prop.utf8_downcvt = message_utf8_downconvert == 1;
+ new->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
+ DEBUG(D_deliver) debug_printf("utf8, downconvert %s\n",
+ new->prop.utf8_downcvt ? "yes"
+ : new->prop.utf8_downcvt_maybe ? "ifneeded"
+ : "no");
+ }
+#endif
+
+ if (r->pno >= 0)
+ new->onetime_parent = recipients_list[r->pno].address;
+
+ /* If DSN support is enabled, set the dsn flags and the original receipt
+ to be passed on to other DSN enabled MTAs */
+
+ new->dsn_flags = r->dsn_flags & rf_dsnflags;
+ new->dsn_orcpt = r->orcpt;
+ DEBUG(D_deliver) debug_printf("DSN: set orcpt: %s flags: 0x%x\n",
+ new->dsn_orcpt ? new->dsn_orcpt : US"", new->dsn_flags);
+
+ switch (process_recipients)
+ {
+ /* RECIP_DEFER is set when a system filter freezes a message. */
+
+ case RECIP_DEFER:
+ new->next = addr_defer;
+ addr_defer = new;
+ break;
+
+
+ /* RECIP_FAIL_FILTER is set when a system filter has obeyed a "fail"
+ command. */
+
+ case RECIP_FAIL_FILTER:
+ new->message =
+ filter_message ? filter_message : US"delivery cancelled";
+ setflag(new, af_pass_message);
+ goto RECIP_QUEUE_FAILED; /* below */
+
+
+ /* RECIP_FAIL_TIMEOUT is set when a message is frozen, but is older
+ than the value in timeout_frozen_after. Treat non-bounce messages
+ similarly to -Mg; for bounce messages we just want to discard, so
+ don't put the address on the failed list. The timeout has already
+ been logged. */
+
+ case RECIP_FAIL_TIMEOUT:
+ new->message = US"delivery cancelled; message timed out";
+ goto RECIP_QUEUE_FAILED; /* below */
+
+
+ /* RECIP_FAIL is set when -Mg has been used. */
+
+ case RECIP_FAIL:
+ new->message = US"delivery cancelled by administrator";
+ /* Fall through */
+
+ /* Common code for the failure cases above. If this is not a bounce
+ message, put the address on the failed list so that it is used to
+ create a bounce. Otherwise do nothing - this just discards the address.
+ The incident has already been logged. */
+
+ RECIP_QUEUE_FAILED:
+ if (sender_address[0])
+ {
+ new->next = addr_failed;
+ addr_failed = new;
+ }
+ break;
+
+
+ /* RECIP_FAIL_LOOP is set when there are too many Received: headers
+ in the message. Process each address as a routing failure; if this
+ is a bounce message, it will get frozen. */
+
+ case RECIP_FAIL_LOOP:
+ new->message = US"Too many \"Received\" headers - suspected mail loop";
+ post_process_one(new, FAIL, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+ break;
+
+
+ /* Value should be RECIP_ACCEPT; take this as the safe default. */
+
+ default:
+ if (!addr_new) addr_new = new; else addr_last->next = new;
+ addr_last = new;
+ break;
+ }
+
+#ifndef DISABLE_EVENT
+ if (process_recipients != RECIP_ACCEPT && event_action)
+ {
+ uschar * save_local = deliver_localpart;
+ const uschar * save_domain = deliver_domain;
+ uschar * addr = new->address, * errmsg = NULL;
+ int start, end, dom;
+
+ if (!parse_extract_address(addr, &errmsg, &start, &end, &dom, TRUE))
+ log_write(0, LOG_MAIN|LOG_PANIC,
+ "failed to parse address '%.100s': %s\n", addr, errmsg);
+ else
+ {
+ deliver_localpart =
+ string_copyn(addr+start, dom ? (dom-1) - start : end - start);
+ deliver_domain = dom ? CUS string_copyn(addr+dom, end - dom) : CUS"";
+
+ event_raise(event_action, US"msg:fail:internal", new->message);
+
+ deliver_localpart = save_local;
+ deliver_domain = save_domain;
+ }
+ }
+#endif
+ }
+
+DEBUG(D_deliver)
+ {
+ debug_printf("Delivery address list:\n");
+ for (address_item * p = addr_new; p; p = p->next)
+ debug_printf(" %s %s\n", p->address,
+ p->onetime_parent ? p->onetime_parent : US"");
+ }
+
+/* Set up the buffers used for copying over the file when delivering. */
+
+deliver_in_buffer = store_malloc(DELIVER_IN_BUFFER_SIZE);
+deliver_out_buffer = store_malloc(DELIVER_OUT_BUFFER_SIZE);
+
+
+
+/* Until there are no more new addresses, handle each one as follows:
+
+ . If this is a generated address (indicated by the presence of a parent
+ pointer) then check to see whether it is a pipe, file, or autoreply, and
+ if so, handle it directly here. The router that produced the address will
+ have set the allow flags into the address, and also set the uid/gid required.
+ Having the routers generate new addresses and then checking them here at
+ the outer level is tidier than making each router do the checking, and
+ means that routers don't need access to the failed address queue.
+
+ . Break up the address into local part and domain, and make lowercased
+ versions of these strings. We also make unquoted versions of the local part.
+
+ . Handle the percent hack for those domains for which it is valid.
+
+ . For child addresses, determine if any of the parents have the same address.
+ If so, generate a different string for previous delivery checking. Without
+ this code, if the address spqr generates spqr via a forward or alias file,
+ delivery of the generated spqr stops further attempts at the top level spqr,
+ which is not what is wanted - it may have generated other addresses.
+
+ . Check on the retry database to see if routing was previously deferred, but
+ only if in a queue run. Addresses that are to be routed are put on the
+ addr_route chain. Addresses that are to be deferred are put on the
+ addr_defer chain. We do all the checking first, so as not to keep the
+ retry database open any longer than necessary.
+
+ . Now we run the addresses through the routers. A router may put the address
+ on either the addr_local or the addr_remote chain for local or remote
+ delivery, respectively, or put it on the addr_failed chain if it is
+ undeliveable, or it may generate child addresses and put them on the
+ addr_new chain, or it may defer an address. All the chain anchors are
+ passed as arguments so that the routers can be called for verification
+ purposes as well.
+
+ . If new addresses have been generated by the routers, da capo.
+*/
+
+f.header_rewritten = FALSE; /* No headers rewritten yet */
+while (addr_new) /* Loop until all addresses dealt with */
+ {
+ address_item *addr, *parent;
+
+ /* Failure to open the retry database is treated the same as if it does
+ not exist. In both cases, dbm_file is NULL. */
+
+ if (!(dbm_file = dbfn_open(US"retry", O_RDONLY, &dbblock, FALSE, TRUE)))
+ DEBUG(D_deliver|D_retry|D_route|D_hints_lookup)
+ debug_printf("no retry data available\n");
+
+ /* Scan the current batch of new addresses, to handle pipes, files and
+ autoreplies, and determine which others are ready for routing. */
+
+ while (addr_new)
+ {
+ int rc;
+ uschar *p;
+ tree_node *tnode;
+ dbdata_retry *domain_retry_record;
+ dbdata_retry *address_retry_record;
+
+ addr = addr_new;
+ addr_new = addr->next;
+
+ DEBUG(D_deliver|D_retry|D_route)
+ {
+ debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+ debug_printf("Considering: %s\n", addr->address);
+ }
+
+ /* Handle generated address that is a pipe or a file or an autoreply. */
+
+ if (testflag(addr, af_pfr))
+ {
+ /* If an autoreply in a filter could not generate a syntactically valid
+ address, give up forthwith. Set af_ignore_error so that we don't try to
+ generate a bounce. */
+
+ if (testflag(addr, af_bad_reply))
+ {
+ addr->basic_errno = ERRNO_BADADDRESS2;
+ addr->local_part = addr->address;
+ addr->message =
+ US"filter autoreply generated syntactically invalid recipient";
+ addr->prop.ignore_error = TRUE;
+ (void) post_process_one(addr, FAIL, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+ continue; /* with the next new address */
+ }
+
+ /* If two different users specify delivery to the same pipe or file or
+ autoreply, there should be two different deliveries, so build a unique
+ string that incorporates the original address, and use this for
+ duplicate testing and recording delivery, and also for retrying. */
+
+ addr->unique =
+ string_sprintf("%s:%s", addr->address, addr->parent->unique +
+ (testflag(addr->parent, af_homonym)? 3:0));
+
+ addr->address_retry_key = addr->domain_retry_key =
+ string_sprintf("T:%s", addr->unique);
+
+ /* If a filter file specifies two deliveries to the same pipe or file,
+ we want to de-duplicate, but this is probably not wanted for two mail
+ commands to the same address, where probably both should be delivered.
+ So, we have to invent a different unique string in that case. Just
+ keep piling '>' characters on the front. */
+
+ if (addr->address[0] == '>')
+ while (tree_search(tree_duplicates, addr->unique))
+ addr->unique = string_sprintf(">%s", addr->unique);
+
+ else if ((tnode = tree_search(tree_duplicates, addr->unique)))
+ {
+ DEBUG(D_deliver|D_route)
+ debug_printf("%s is a duplicate address: discarded\n", addr->address);
+ addr->dupof = tnode->data.ptr;
+ addr->next = addr_duplicate;
+ addr_duplicate = addr;
+ continue;
+ }
+
+ DEBUG(D_deliver|D_route) debug_printf("unique = %s\n", addr->unique);
+
+ /* Check for previous delivery */
+
+ if (tree_search(tree_nonrecipients, addr->unique))
+ {
+ DEBUG(D_deliver|D_route)
+ debug_printf("%s was previously delivered: discarded\n", addr->address);
+ child_done(addr, tod_stamp(tod_log));
+ continue;
+ }
+
+ /* Save for checking future duplicates */
+
+ tree_add_duplicate(addr->unique, addr);
+
+ /* Set local part and domain */
+
+ addr->local_part = addr->address;
+ addr->domain = addr->parent->domain;
+
+ /* Ensure that the delivery is permitted. */
+
+ if (testflag(addr, af_file))
+ {
+ if (!testflag(addr, af_allow_file))
+ {
+ addr->basic_errno = ERRNO_FORBIDFILE;
+ addr->message = US"delivery to file forbidden";
+ (void)post_process_one(addr, FAIL, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+ continue; /* with the next new address */
+ }
+ }
+ else if (addr->address[0] == '|')
+ {
+ if (!testflag(addr, af_allow_pipe))
+ {
+ addr->basic_errno = ERRNO_FORBIDPIPE;
+ addr->message = US"delivery to pipe forbidden";
+ (void)post_process_one(addr, FAIL, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+ continue; /* with the next new address */
+ }
+ }
+ else if (!testflag(addr, af_allow_reply))
+ {
+ addr->basic_errno = ERRNO_FORBIDREPLY;
+ addr->message = US"autoreply forbidden";
+ (void)post_process_one(addr, FAIL, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+ continue; /* with the next new address */
+ }
+
+ /* If the errno field is already set to BADTRANSPORT, it indicates
+ failure to expand a transport string, or find the associated transport,
+ or an unset transport when one is required. Leave this test till now so
+ that the forbid errors are given in preference. */
+
+ if (addr->basic_errno == ERRNO_BADTRANSPORT)
+ {
+ (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+ continue;
+ }
+
+ /* Treat /dev/null as a special case and abandon the delivery. This
+ avoids having to specify a uid on the transport just for this case.
+ Arrange for the transport name to be logged as "**bypassed**". */
+
+ if (Ustrcmp(addr->address, "/dev/null") == 0)
+ {
+ uschar *save = addr->transport->name;
+ addr->transport->name = US"**bypassed**";
+ (void)post_process_one(addr, OK, LOG_MAIN, EXIM_DTYPE_TRANSPORT, '=');
+ addr->transport->name = save;
+ continue; /* with the next new address */
+ }
+
+ /* Pipe, file, or autoreply delivery is to go ahead as a normal local
+ delivery. */
+
+ DEBUG(D_deliver|D_route)
+ debug_printf("queued for %s transport\n", addr->transport->name);
+ addr->next = addr_local;
+ addr_local = addr;
+ continue; /* with the next new address */
+ }
+
+ /* Handle normal addresses. First, split up into local part and domain,
+ handling the %-hack if necessary. There is the possibility of a defer from
+ a lookup in percent_hack_domains. */
+
+ if ((rc = deliver_split_address(addr)) == DEFER)
+ {
+ addr->message = US"cannot check percent_hack_domains";
+ addr->basic_errno = ERRNO_LISTDEFER;
+ (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_NONE, 0);
+ continue;
+ }
+
+ /* Check to see if the domain is held. If so, proceed only if the
+ delivery was forced by hand. */
+
+ deliver_domain = addr->domain; /* set $domain */
+ if ( !forced && hold_domains
+ && (rc = match_isinlist(addr->domain, (const uschar **)&hold_domains, 0,
+ &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE,
+ NULL)) != FAIL
+ )
+ {
+ if (rc == DEFER)
+ {
+ addr->message = US"hold_domains lookup deferred";
+ addr->basic_errno = ERRNO_LISTDEFER;
+ }
+ else
+ {
+ addr->message = US"domain is held";
+ addr->basic_errno = ERRNO_HELD;
+ }
+ (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_NONE, 0);
+ continue;
+ }
+
+ /* Now we can check for duplicates and previously delivered addresses. In
+ order to do this, we have to generate a "unique" value for each address,
+ because there may be identical actual addresses in a line of descendents.
+ The "unique" field is initialized to the same value as the "address" field,
+ but gets changed here to cope with identically-named descendents. */
+
+ for (parent = addr->parent; parent; parent = parent->parent)
+ if (strcmpic(addr->address, parent->address) == 0) break;
+
+ /* If there's an ancestor with the same name, set the homonym flag. This
+ influences how deliveries are recorded. Then add a prefix on the front of
+ the unique address. We use \n\ where n starts at 0 and increases each time.
+ It is unlikely to pass 9, but if it does, it may look odd but will still
+ work. This means that siblings or cousins with the same names are treated
+ as duplicates, which is what we want. */
+
+ if (parent)
+ {
+ setflag(addr, af_homonym);
+ if (parent->unique[0] != '\\')
+ addr->unique = string_sprintf("\\0\\%s", addr->address);
+ else
+ addr->unique = string_sprintf("\\%c\\%s", parent->unique[1] + 1,
+ addr->address);
+ }
+
+ /* Ensure that the domain in the unique field is lower cased, because
+ domains are always handled caselessly. */
+
+ p = Ustrrchr(addr->unique, '@');
+ while (*p != 0) { *p = tolower(*p); p++; }
+
+ DEBUG(D_deliver|D_route) debug_printf("unique = %s\n", addr->unique);
+
+ if (tree_search(tree_nonrecipients, addr->unique))
+ {
+ DEBUG(D_deliver|D_route)
+ debug_printf("%s was previously delivered: discarded\n", addr->unique);
+ child_done(addr, tod_stamp(tod_log));
+ continue;
+ }
+
+ /* Get the routing retry status, saving the two retry keys (with and
+ without the local part) for subsequent use. If there is no retry record for
+ the standard address routing retry key, we look for the same key with the
+ sender attached, because this form is used by the smtp transport after a
+ 4xx response to RCPT when address_retry_include_sender is true. */
+
+ addr->domain_retry_key = string_sprintf("R:%s", addr->domain);
+ addr->address_retry_key = string_sprintf("R:%s@%s", addr->local_part,
+ addr->domain);
+
+ if (dbm_file)
+ {
+ domain_retry_record = dbfn_read(dbm_file, addr->domain_retry_key);
+ if ( domain_retry_record
+ && now - domain_retry_record->time_stamp > retry_data_expire
+ )
+ {
+ DEBUG(D_deliver|D_retry)
+ debug_printf("domain retry record present but expired\n");
+ domain_retry_record = NULL; /* Ignore if too old */
+ }
+
+ address_retry_record = dbfn_read(dbm_file, addr->address_retry_key);
+ if ( address_retry_record
+ && now - address_retry_record->time_stamp > retry_data_expire
+ )
+ {
+ DEBUG(D_deliver|D_retry)
+ debug_printf("address retry record present but expired\n");
+ address_retry_record = NULL; /* Ignore if too old */
+ }
+
+ if (!address_retry_record)
+ {
+ uschar *altkey = string_sprintf("%s:<%s>", addr->address_retry_key,
+ sender_address);
+ address_retry_record = dbfn_read(dbm_file, altkey);
+ if ( address_retry_record
+ && now - address_retry_record->time_stamp > retry_data_expire)
+ {
+ DEBUG(D_deliver|D_retry)
+ debug_printf("address<sender> retry record present but expired\n");
+ address_retry_record = NULL; /* Ignore if too old */
+ }
+ }
+ }
+ else
+ domain_retry_record = address_retry_record = NULL;
+
+ DEBUG(D_deliver|D_retry)
+ {
+ if (!domain_retry_record)
+ debug_printf("no domain retry record\n");
+ else
+ debug_printf("have domain retry record; next_try = now%+d\n",
+ f.running_in_test_harness ? 0 :
+ (int)(domain_retry_record->next_try - now));
+
+ if (!address_retry_record)
+ debug_printf("no address retry record\n");
+ else
+ debug_printf("have address retry record; next_try = now%+d\n",
+ f.running_in_test_harness ? 0 :
+ (int)(address_retry_record->next_try - now));
+ }
+
+ /* If we are sending a message down an existing SMTP connection, we must
+ assume that the message which created the connection managed to route
+ an address to that connection. We do not want to run the risk of taking
+ a long time over routing here, because if we do, the server at the other
+ end of the connection may time it out. This is especially true for messages
+ with lots of addresses. For this kind of delivery, queue_running is not
+ set, so we would normally route all addresses. We take a pragmatic approach
+ and defer routing any addresses that have any kind of domain retry record.
+ That is, we don't even look at their retry times. It doesn't matter if this
+ doesn't work occasionally. This is all just an optimization, after all.
+
+ The reason for not doing the same for address retries is that they normally
+ arise from 4xx responses, not DNS timeouts. */
+
+ if (continue_hostname && domain_retry_record)
+ {
+ addr->message = US"reusing SMTP connection skips previous routing defer";
+ addr->basic_errno = ERRNO_RRETRY;
+ (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+
+ addr->message = domain_retry_record->text;
+ setflag(addr, af_pass_message);
+ }
+
+ /* If we are in a queue run, defer routing unless there is no retry data or
+ we've passed the next retry time, or this message is forced. In other
+ words, ignore retry data when not in a queue run.
+
+ However, if the domain retry time has expired, always allow the routing
+ attempt. If it fails again, the address will be failed. This ensures that
+ each address is routed at least once, even after long-term routing
+ failures.
+
+ If there is an address retry, check that too; just wait for the next
+ retry time. This helps with the case when the temporary error on the
+ address was really message-specific rather than address specific, since
+ it allows other messages through.
+
+ We also wait for the next retry time if this is a message sent down an
+ existing SMTP connection (even though that will be forced). Otherwise there
+ will be far too many attempts for an address that gets a 4xx error. In
+ fact, after such an error, we should not get here because, the host should
+ not be remembered as one this message needs. However, there was a bug that
+ used to cause this to happen, so it is best to be on the safe side.
+
+ Even if we haven't reached the retry time in the hints, there is one more
+ check to do, which is for the ultimate address timeout. We only do this
+ check if there is an address retry record and there is not a domain retry
+ record; this implies that previous attempts to handle the address had the
+ retry_use_local_parts option turned on. We use this as an approximation
+ for the destination being like a local delivery, for example delivery over
+ LMTP to an IMAP message store. In this situation users are liable to bump
+ into their quota and thereby have intermittently successful deliveries,
+ which keep the retry record fresh, which can lead to us perpetually
+ deferring messages. */
+
+ else if ( ( f.queue_running && !f.deliver_force
+ || continue_hostname
+ )
+ && ( ( domain_retry_record
+ && now < domain_retry_record->next_try
+ && !domain_retry_record->expired
+ )
+ || ( address_retry_record
+ && now < address_retry_record->next_try
+ ) )
+ && ( domain_retry_record
+ || !address_retry_record
+ || !retry_ultimate_address_timeout(addr->address_retry_key,
+ addr->domain, address_retry_record, now)
+ ) )
+ {
+ addr->message = US"retry time not reached";
+ addr->basic_errno = ERRNO_RRETRY;
+ (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+
+ /* For remote-retry errors (here and just above) that we've not yet
+ hit the retry time, use the error recorded in the retry database
+ as info in the warning message. This lets us send a message even
+ when we're not failing on a fresh attempt. We assume that this
+ info is not sensitive. */
+
+ addr->message = domain_retry_record
+ ? domain_retry_record->text : address_retry_record->text;
+ setflag(addr, af_pass_message);
+ }
+
+ /* The domain is OK for routing. Remember if retry data exists so it
+ can be cleaned up after a successful delivery. */
+
+ else
+ {
+ if (domain_retry_record || address_retry_record)
+ setflag(addr, af_dr_retry_exists);
+ addr->next = addr_route;
+ addr_route = addr;
+ DEBUG(D_deliver|D_route)
+ debug_printf("%s: queued for routing\n", addr->address);
+ }
+ }
+
+ /* The database is closed while routing is actually happening. Requests to
+ update it are put on a chain and all processed together at the end. */
+
+ if (dbm_file) dbfn_close(dbm_file);
+
+ /* If queue_domains is set, we don't even want to try routing addresses in
+ those domains. During queue runs, queue_domains is forced to be unset.
+ Optimize by skipping this pass through the addresses if nothing is set. */
+
+ if (!f.deliver_force && queue_domains)
+ {
+ address_item *okaddr = NULL;
+ while (addr_route)
+ {
+ address_item *addr = addr_route;
+ addr_route = addr->next;
+
+ deliver_domain = addr->domain; /* set $domain */
+ if ((rc = match_isinlist(addr->domain, (const uschar **)&queue_domains, 0,
+ &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
+ != OK)
+ if (rc == DEFER)
+ {
+ addr->basic_errno = ERRNO_LISTDEFER;
+ addr->message = US"queue_domains lookup deferred";
+ (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+ }
+ else
+ {
+ addr->next = okaddr;
+ okaddr = addr;
+ }
+ else
+ {
+ addr->basic_errno = ERRNO_QUEUE_DOMAIN;
+ addr->message = US"domain is in queue_domains";
+ (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+ }
+ }
+
+ addr_route = okaddr;
+ }
+
+ /* Now route those addresses that are not deferred. */
+
+ while (addr_route)
+ {
+ int rc;
+ address_item *addr = addr_route;
+ const uschar *old_domain = addr->domain;
+ uschar *old_unique = addr->unique;
+ addr_route = addr->next;
+ addr->next = NULL;
+
+ /* Just in case some router parameter refers to it. */
+
+ if (!(return_path = addr->prop.errors_address))
+ return_path = sender_address;
+
+ /* If a router defers an address, add a retry item. Whether or not to
+ use the local part in the key is a property of the router. */
+
+ if ((rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
+ &addr_succeed, v_none)) == DEFER)
+ retry_add_item(addr,
+ addr->router->retry_use_local_part
+ ? string_sprintf("R:%s@%s", addr->local_part, addr->domain)
+ : string_sprintf("R:%s", addr->domain),
+ 0);
+
+ /* Otherwise, if there is an existing retry record in the database, add
+ retry items to delete both forms. We must also allow for the possibility
+ of a routing retry that includes the sender address. Since the domain might
+ have been rewritten (expanded to fully qualified) as a result of routing,
+ ensure that the rewritten form is also deleted. */
+
+ else if (testflag(addr, af_dr_retry_exists))
+ {
+ uschar *altkey = string_sprintf("%s:<%s>", addr->address_retry_key,
+ sender_address);
+ retry_add_item(addr, altkey, rf_delete);
+ retry_add_item(addr, addr->address_retry_key, rf_delete);
+ retry_add_item(addr, addr->domain_retry_key, rf_delete);
+ if (Ustrcmp(addr->domain, old_domain) != 0)
+ retry_add_item(addr, string_sprintf("R:%s", old_domain), rf_delete);
+ }
+
+ /* DISCARD is given for :blackhole: and "seen finish". The event has been
+ logged, but we need to ensure the address (and maybe parents) is marked
+ done. */
+
+ if (rc == DISCARD)
+ {
+ address_done(addr, tod_stamp(tod_log));
+ continue; /* route next address */
+ }
+
+ /* The address is finished with (failed or deferred). */
+
+ if (rc != OK)
+ {
+ (void)post_process_one(addr, rc, LOG_MAIN, EXIM_DTYPE_ROUTER, 0);
+ continue; /* route next address */
+ }
+
+ /* The address has been routed. If the router changed the domain, it will
+ also have changed the unique address. We have to test whether this address
+ has already been delivered, because it's the unique address that finally
+ gets recorded. */
+
+ if ( addr->unique != old_unique
+ && tree_search(tree_nonrecipients, addr->unique) != 0
+ )
+ {
+ DEBUG(D_deliver|D_route) debug_printf("%s was previously delivered: "
+ "discarded\n", addr->address);
+ if (addr_remote == addr) addr_remote = addr->next;
+ else if (addr_local == addr) addr_local = addr->next;
+ }
+
+ /* If the router has same_domain_copy_routing set, we are permitted to copy
+ the routing for any other addresses with the same domain. This is an
+ optimisation to save repeated DNS lookups for "standard" remote domain
+ routing. The option is settable only on routers that generate host lists.
+ We play it very safe, and do the optimization only if the address is routed
+ to a remote transport, there are no header changes, and the domain was not
+ modified by the router. */
+
+ if ( addr_remote == addr
+ && addr->router->same_domain_copy_routing
+ && !addr->prop.extra_headers
+ && !addr->prop.remove_headers
+ && old_domain == addr->domain
+ )
+ {
+ address_item **chain = &addr_route;
+ while (*chain)
+ {
+ address_item *addr2 = *chain;
+ if (Ustrcmp(addr2->domain, addr->domain) != 0)
+ {
+ chain = &(addr2->next);
+ continue;
+ }
+
+ /* Found a suitable address; take it off the routing list and add it to
+ the remote delivery list. */
+
+ *chain = addr2->next;
+ addr2->next = addr_remote;
+ addr_remote = addr2;
+
+ /* Copy the routing data */
+
+ addr2->domain = addr->domain;
+ addr2->router = addr->router;
+ addr2->transport = addr->transport;
+ addr2->host_list = addr->host_list;
+ addr2->fallback_hosts = addr->fallback_hosts;
+ addr2->prop.errors_address = addr->prop.errors_address;
+ copyflag(addr2, addr, af_hide_child);
+ copyflag(addr2, addr, af_local_host_removed);
+
+ DEBUG(D_deliver|D_route)
+ debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n"
+ "routing %s\n"
+ "Routing for %s copied from %s\n",
+ addr2->address, addr2->address, addr->address);
+ }
+ }
+ } /* Continue with routing the next address. */
+ } /* Loop to process any child addresses that the routers created, and
+ any rerouted addresses that got put back on the new chain. */
+
+
+/* Debugging: show the results of the routing */
+
+DEBUG(D_deliver|D_retry|D_route)
+ {
+ debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+ debug_printf("After routing:\n Local deliveries:\n");
+ for (address_item * p = addr_local; p; p = p->next)
+ debug_printf(" %s\n", p->address);
+
+ debug_printf(" Remote deliveries:\n");
+ for (address_item * p = addr_remote; p; p = p->next)
+ debug_printf(" %s\n", p->address);
+
+ debug_printf(" Failed addresses:\n");
+ for (address_item * p = addr_failed; p; p = p->next)
+ debug_printf(" %s\n", p->address);
+
+ debug_printf(" Deferred addresses:\n");
+ for (address_item * p = addr_defer; p; p = p->next)
+ debug_printf(" %s\n", p->address);
+ }
+
+/* Free any resources that were cached during routing. */
+
+search_tidyup();
+route_tidyup();
+
+/* These two variables are set only during routing, after check_local_user.
+Ensure they are not set in transports. */
+
+local_user_gid = (gid_t)(-1);
+local_user_uid = (uid_t)(-1);
+
+/* Check for any duplicate addresses. This check is delayed until after
+routing, because the flexibility of the routing configuration means that
+identical addresses with different parentage may end up being redirected to
+different addresses. Checking for duplicates too early (as we previously used
+to) makes this kind of thing not work. */
+
+do_duplicate_check(&addr_local);
+do_duplicate_check(&addr_remote);
+
+/* When acting as an MUA wrapper, we proceed only if all addresses route to a
+remote transport. The check that they all end up in one transaction happens in
+the do_remote_deliveries() function. */
+
+if ( mua_wrapper
+ && (addr_local || addr_failed || addr_defer)
+ )
+ {
+ address_item *addr;
+ uschar *which, *colon, *msg;
+
+ if (addr_local)
+ {
+ addr = addr_local;
+ which = US"local";
+ }
+ else if (addr_defer)
+ {
+ addr = addr_defer;
+ which = US"deferred";
+ }
+ else
+ {
+ addr = addr_failed;
+ which = US"failed";
+ }
+
+ while (addr->parent) addr = addr->parent;
+
+ if (addr->message)
+ {
+ colon = US": ";
+ msg = addr->message;
+ }
+ else colon = msg = US"";
+
+ /* We don't need to log here for a forced failure as it will already
+ have been logged. Defer will also have been logged, but as a defer, so we do
+ need to do the failure logging. */
+
+ if (addr != addr_failed)
+ log_write(0, LOG_MAIN, "** %s routing yielded a %s delivery",
+ addr->address, which);
+
+ /* Always write an error to the caller */
+
+ fprintf(stderr, "routing %s yielded a %s delivery%s%s\n", addr->address,
+ which, colon, msg);
+
+ final_yield = DELIVER_MUA_FAILED;
+ addr_failed = addr_defer = NULL; /* So that we remove the message */
+ goto DELIVERY_TIDYUP;
+ }
+
+
+/* If this is a run to continue deliveries to an external channel that is
+already set up, defer any local deliveries.
+
+jgh 2020/12/20: I don't see why; locals should be quick.
+The defer goes back to version 1.62 in 1997. A local being still deliverable
+during a continued run might result from something like a defer during the
+original delivery, eg. in a DB lookup. Unlikely but possible.
+
+To avoid delaying a local when combined with a callout-hold for a remote
+delivery, test continue_sequence rather than continue_transport. */
+
+if (continue_sequence > 1 && addr_local)
+ {
+ DEBUG(D_deliver|D_retry|D_route)
+ debug_printf("deferring local deliveries due to continued-transport\n");
+ if (addr_defer)
+ {
+ address_item *addr = addr_defer;
+ while (addr->next) addr = addr->next;
+ addr->next = addr_local;
+ }
+ else
+ addr_defer = addr_local;
+ addr_local = NULL;
+ }
+
+
+/* Because address rewriting can happen in the routers, we should not really do
+ANY deliveries until all addresses have been routed, so that all recipients of
+the message get the same headers. However, this is in practice not always
+possible, since sometimes remote addresses give DNS timeouts for days on end.
+The pragmatic approach is to deliver what we can now, saving any rewritten
+headers so that at least the next lot of recipients benefit from the rewriting
+that has already been done.
+
+If any headers have been rewritten during routing, update the spool file to
+remember them for all subsequent deliveries. This can be delayed till later if
+there is only address to be delivered - if it succeeds the spool write need not
+happen. */
+
+if ( f.header_rewritten
+ && ( addr_local && (addr_local->next || addr_remote)
+ || addr_remote && addr_remote->next
+ ) )
+ {
+ /* Panic-dies on error */
+ (void)spool_write_header(message_id, SW_DELIVERING, NULL);
+ f.header_rewritten = FALSE;
+ }
+
+
+/* If there are any deliveries to do and we do not already have the journal
+file, create it. This is used to record successful deliveries as soon as
+possible after each delivery is known to be complete. A file opened with
+O_APPEND is used so that several processes can run simultaneously.
+
+The journal is just insurance against crashes. When the spool file is
+ultimately updated at the end of processing, the journal is deleted. If a
+journal is found to exist at the start of delivery, the addresses listed
+therein are added to the non-recipients. */
+
+if (addr_local || addr_remote)
+ {
+ if (journal_fd < 0)
+ {
+ uschar * fname = spool_fname(US"input", message_subdir, id, US"-J");
+
+ if ((journal_fd = Uopen(fname,
+#ifdef O_CLOEXEC
+ O_CLOEXEC |
+#endif
+ O_WRONLY|O_APPEND|O_CREAT|O_EXCL, SPOOL_MODE)) < 0)
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't open journal file %s: %s",
+ fname, strerror(errno));
+ return DELIVER_NOT_ATTEMPTED;
+ }
+
+ /* Set the close-on-exec flag, make the file owned by Exim, and ensure
+ that the mode is correct - the group setting doesn't always seem to get
+ set automatically. */
+
+ if( exim_fchown(journal_fd, exim_uid, exim_gid, fname)
+ || fchmod(journal_fd, SPOOL_MODE)
+#ifndef O_CLOEXEC
+ || fcntl(journal_fd, F_SETFD, fcntl(journal_fd, F_GETFD) | FD_CLOEXEC)
+#endif
+ )
+ {
+ int ret = Uunlink(fname);
+ log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't set perms on journal file %s: %s",
+ fname, strerror(errno));
+ if(ret && errno != ENOENT)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
+ fname, strerror(errno));
+ return DELIVER_NOT_ATTEMPTED;
+ }
+ }
+ }
+else if (journal_fd >= 0)
+ {
+ close(journal_fd);
+ journal_fd = -1;
+ }
+
+
+
+/* Now we can get down to the business of actually doing deliveries. Local
+deliveries are done first, then remote ones. If ever the problems of how to
+handle fallback transports are figured out, this section can be put into a loop
+for handling fallbacks, though the uid switching will have to be revised. */
+
+/* Precompile a regex that is used to recognize a parameter in response
+to an LHLO command, if is isn't already compiled. This may be used on both
+local and remote LMTP deliveries. */
+
+if (!regex_IGNOREQUOTA)
+ regex_IGNOREQUOTA =
+ regex_must_compile(US"\\n250[\\s\\-]IGNOREQUOTA(\\s|\\n|$)", FALSE, TRUE);
+
+/* Handle local deliveries */
+
+if (addr_local)
+ {
+ DEBUG(D_deliver|D_transport)
+ debug_printf(">>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>\n");
+ do_local_deliveries();
+ f.disable_logging = FALSE;
+ }
+
+/* If queue_run_local is set, we do not want to attempt any remote deliveries,
+so just queue them all. */
+
+if (f.queue_run_local)
+ while (addr_remote)
+ {
+ address_item *addr = addr_remote;
+ addr_remote = addr->next;
+ addr->next = NULL;
+ addr->basic_errno = ERRNO_LOCAL_ONLY;
+ addr->message = US"remote deliveries suppressed";
+ (void)post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_TRANSPORT, 0);
+ }
+
+/* Handle remote deliveries */
+
+if (addr_remote)
+ {
+ DEBUG(D_deliver|D_transport)
+ debug_printf(">>>>>>>>>>>>>>>> Remote deliveries >>>>>>>>>>>>>>>>\n");
+
+ /* Precompile some regex that are used to recognize parameters in response
+ to an EHLO command, if they aren't already compiled. */
+
+ smtp_deliver_init();
+
+ /* Now sort the addresses if required, and do the deliveries. The yield of
+ do_remote_deliveries is FALSE when mua_wrapper is set and all addresses
+ cannot be delivered in one transaction. */
+
+ if (remote_sort_domains) sort_remote_deliveries();
+ if (!do_remote_deliveries(FALSE))
+ {
+ log_write(0, LOG_MAIN, "** mua_wrapper is set but recipients cannot all "
+ "be delivered in one transaction");
+ fprintf(stderr, "delivery to smarthost failed (configuration problem)\n");
+
+ final_yield = DELIVER_MUA_FAILED;
+ addr_failed = addr_defer = NULL; /* So that we remove the message */
+ goto DELIVERY_TIDYUP;
+ }
+
+ /* See if any of the addresses that failed got put on the queue for delivery
+ to their fallback hosts. We do it this way because often the same fallback
+ host is used for many domains, so all can be sent in a single transaction
+ (if appropriately configured). */
+
+ if (addr_fallback && !mua_wrapper)
+ {
+ DEBUG(D_deliver) debug_printf("Delivering to fallback hosts\n");
+ addr_remote = addr_fallback;
+ addr_fallback = NULL;
+ if (remote_sort_domains) sort_remote_deliveries();
+ do_remote_deliveries(TRUE);
+ }
+ f.disable_logging = FALSE;
+ }
+
+
+/* All deliveries are now complete. Ignore SIGTERM during this tidying up
+phase, to minimize cases of half-done things. */
+
+DEBUG(D_deliver)
+ debug_printf(">>>>>>>>>>>>>>>> deliveries are done >>>>>>>>>>>>>>>>\n");
+cancel_cutthrough_connection(TRUE, US"deliveries are done");
+
+/* Root privilege is no longer needed */
+
+exim_setugid(exim_uid, exim_gid, FALSE, US"post-delivery tidying");
+
+set_process_info("tidying up after delivering %s", message_id);
+signal(SIGTERM, SIG_IGN);
+
+/* When we are acting as an MUA wrapper, the smtp transport will either have
+succeeded for all addresses, or failed them all in normal cases. However, there
+are some setup situations (e.g. when a named port does not exist) that cause an
+immediate exit with deferral of all addresses. Convert those into failures. We
+do not ever want to retry, nor do we want to send a bounce message. */
+
+if (mua_wrapper)
+ {
+ if (addr_defer)
+ {
+ address_item * nextaddr;
+ for (address_item * addr = addr_defer; addr; addr = nextaddr)
+ {
+ log_write(0, LOG_MAIN, "** %s mua_wrapper forced failure for deferred "
+ "delivery", addr->address);
+ nextaddr = addr->next;
+ addr->next = addr_failed;
+ addr_failed = addr;
+ }
+ addr_defer = NULL;
+ }
+
+ /* Now all should either have succeeded or failed. */
+
+ if (!addr_failed)
+ final_yield = DELIVER_MUA_SUCCEEDED;
+ else
+ {
+ host_item * host;
+ uschar *s = addr_failed->user_message;
+
+ if (!s) s = addr_failed->message;
+
+ fprintf(stderr, "Delivery failed: ");
+ if (addr_failed->basic_errno > 0)
+ {
+ fprintf(stderr, "%s", strerror(addr_failed->basic_errno));
+ if (s) fprintf(stderr, ": ");
+ }
+ if ((host = addr_failed->host_used))
+ fprintf(stderr, "H=%s [%s]: ", host->name, host->address);
+ if (s)
+ fprintf(stderr, "%s", CS s);
+ else if (addr_failed->basic_errno <= 0)
+ fprintf(stderr, "unknown error");
+ fprintf(stderr, "\n");
+
+ final_yield = DELIVER_MUA_FAILED;
+ addr_failed = NULL;
+ }
+ }
+
+/* In a normal configuration, we now update the retry database. This is done in
+one fell swoop at the end in order not to keep opening and closing (and
+locking) the database. The code for handling retries is hived off into a
+separate module for convenience. We pass it the addresses of the various
+chains, because deferred addresses can get moved onto the failed chain if the
+retry cutoff time has expired for all alternative destinations. Bypass the
+updating of the database if the -N flag is set, which is a debugging thing that
+prevents actual delivery. */
+
+else if (!f.dont_deliver)
+ retry_update(&addr_defer, &addr_failed, &addr_succeed);
+
+/* Send DSN for successful messages if requested */
+addr_senddsn = NULL;
+
+for (address_item * a = addr_succeed; a; a = a->next)
+ {
+ /* af_ignore_error not honored here. it's not an error */
+ DEBUG(D_deliver) debug_printf("DSN: processing router : %s\n"
+ "DSN: processing successful delivery address: %s\n"
+ "DSN: Sender_address: %s\n"
+ "DSN: orcpt: %s flags: 0x%x\n"
+ "DSN: envid: %s ret: %d\n"
+ "DSN: Final recipient: %s\n"
+ "DSN: Remote SMTP server supports DSN: %d\n",
+ a->router ? a->router->name : US"(unknown)",
+ a->address,
+ sender_address,
+ a->dsn_orcpt ? a->dsn_orcpt : US"NULL",
+ a->dsn_flags,
+ dsn_envid ? dsn_envid : US"NULL", dsn_ret,
+ a->address,
+ a->dsn_aware
+ );
+
+ /* send report if next hop not DSN aware or a router flagged "last DSN hop"
+ and a report was requested */
+
+ if ( (a->dsn_aware != dsn_support_yes || a->dsn_flags & rf_dsnlasthop)
+ && a->dsn_flags & rf_notify_success
+ )
+ {
+ /* copy and relink address_item and send report with all of them at once later */
+ address_item * addr_next = addr_senddsn;
+ addr_senddsn = store_get(sizeof(address_item), FALSE);
+ *addr_senddsn = *a;
+ addr_senddsn->next = addr_next;
+ }
+ else
+ DEBUG(D_deliver) debug_printf("DSN: not sending DSN success message\n");
+ }
+
+if (addr_senddsn)
+ {
+ pid_t pid;
+ int fd;
+
+ /* create exim process to send message */
+ pid = child_open_exim(&fd, US"DSN");
+
+ DEBUG(D_deliver) debug_printf("DSN: child_open_exim returns: %d\n", pid);
+
+ if (pid < 0) /* Creation of child failed */
+ {
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Process %d (parent %d) failed to "
+ "create child process to send success-dsn message: %s", getpid(),
+ getppid(), strerror(errno));
+
+ DEBUG(D_deliver) debug_printf("DSN: child_open_exim failed\n");
+ }
+ else /* Creation of child succeeded */
+ {
+ FILE * f = fdopen(fd, "wb");
+ /* header only as required by RFC. only failure DSN needs to honor RET=FULL */
+ uschar * bound;
+ transport_ctx tctx = {{0}};
+
+ DEBUG(D_deliver)
+ debug_printf("sending success-dsn to: %s\n", sender_address);
+
+ /* build unique id for MIME boundary */
+ bound = string_sprintf(TIME_T_FMT "-eximdsn-%d", time(NULL), rand());
+ DEBUG(D_deliver) debug_printf("DSN: MIME boundary: %s\n", bound);
+
+ if (errors_reply_to)
+ fprintf(f, "Reply-To: %s\n", errors_reply_to);
+
+ moan_write_from(f);
+ fprintf(f, "Auto-Submitted: auto-generated\n"
+ "To: %s\n"
+ "Subject: Delivery Status Notification\n",
+ sender_address);
+ moan_write_references(f, NULL);
+ fprintf(f, "Content-Type: multipart/report;"
+ " report-type=delivery-status; boundary=%s\n"
+ "MIME-Version: 1.0\n\n"
+
+ "--%s\n"
+ "Content-type: text/plain; charset=us-ascii\n\n"
+
+ "This message was created automatically by mail delivery software.\n"
+ " ----- The following addresses had successful delivery notifications -----\n",
+ bound, bound);
+
+ for (address_item * a = addr_senddsn; a; a = a->next)
+ fprintf(f, "<%s> (relayed %s)\n\n",
+ a->address,
+ a->dsn_flags & rf_dsnlasthop ? "via non DSN router"
+ : a->dsn_aware == dsn_support_no ? "to non-DSN-aware mailer"
+ : "via non \"Remote SMTP\" router"
+ );
+
+ fprintf(f, "--%s\n"
+ "Content-type: message/delivery-status\n\n"
+ "Reporting-MTA: dns; %s\n",
+ bound, smtp_active_hostname);
+
+ if (dsn_envid)
+ { /* must be decoded from xtext: see RFC 3461:6.3a */
+ uschar *xdec_envid;
+ if (auth_xtextdecode(dsn_envid, &xdec_envid) > 0)
+ fprintf(f, "Original-Envelope-ID: %s\n", dsn_envid);
+ else
+ fprintf(f, "X-Original-Envelope-ID: error decoding xtext formatted ENVID\n");
+ }
+ fputc('\n', f);
+
+ for (address_item * a = addr_senddsn; a; a = a->next)
+ {
+ host_item * hu;
+
+ print_dsn_addr_action(f, a, US"delivered", US"2.0.0");
+
+ if ((hu = a->host_used) && hu->name)
+ fprintf(f, "Remote-MTA: dns; %s\nDiagnostic-Code: smtp; 250 Ok\n\n",
+ hu->name);
+ else
+ fprintf(f, "Diagnostic-Code: X-Exim; relayed via non %s router\n\n",
+ a->dsn_flags & rf_dsnlasthop ? "DSN" : "SMTP");
+ }
+
+ fprintf(f, "--%s\nContent-type: text/rfc822-headers\n\n", bound);
+
+ fflush(f);
+ transport_filter_argv = NULL; /* Just in case */
+ return_path = sender_address; /* In case not previously set */
+
+ /* Write the original email out */
+
+ tctx.u.fd = fd;
+ tctx.options = topt_add_return_path | topt_no_body;
+ /*XXX hmm, FALSE(fail) retval ignored.
+ Could error for any number of reasons, and they are not handled. */
+ transport_write_message(&tctx, 0);
+ fflush(f);
+
+ fprintf(f,"\n--%s--\n", bound);
+
+ fflush(f);
+ fclose(f);
+ rc = child_close(pid, 0); /* Waits for child to close, no timeout */
+ }
+ }
+
+/* If any addresses failed, we must send a message to somebody, unless
+af_ignore_error is set, in which case no action is taken. It is possible for
+several messages to get sent if there are addresses with different
+requirements. */
+
+while (addr_failed)
+ {
+ pid_t pid;
+ int fd;
+ uschar *logtod = tod_stamp(tod_log);
+ address_item *addr;
+ address_item *handled_addr = NULL;
+ address_item **paddr;
+ address_item *msgchain = NULL;
+ address_item **pmsgchain = &msgchain;
+
+ /* There are weird cases when logging is disabled in the transport. However,
+ there may not be a transport (address failed by a router). */
+
+ f.disable_logging = FALSE;
+ if (addr_failed->transport)
+ f.disable_logging = addr_failed->transport->disable_logging;
+
+ DEBUG(D_deliver)
+ debug_printf("processing failed address %s\n", addr_failed->address);
+
+ /* There are only two ways an address in a bounce message can get here:
+
+ (1) When delivery was initially deferred, but has now timed out (in the call
+ to retry_update() above). We can detect this by testing for
+ af_retry_timedout. If the address does not have its own errors address,
+ we arrange to ignore the error.
+
+ (2) If delivery failures for bounce messages are being ignored. We can detect
+ this by testing for af_ignore_error. This will also be set if a bounce
+ message has been autothawed and the ignore_bounce_errors_after time has
+ passed. It might also be set if a router was explicitly configured to
+ ignore errors (errors_to = "").
+
+ If neither of these cases obtains, something has gone wrong. Log the
+ incident, but then ignore the error. */
+
+ if (sender_address[0] == 0 && !addr_failed->prop.errors_address)
+ {
+ if ( !testflag(addr_failed, af_retry_timedout)
+ && !addr_failed->prop.ignore_error)
+ log_write(0, LOG_MAIN|LOG_PANIC, "internal error: bounce message "
+ "failure is neither frozen nor ignored (it's been ignored)");
+
+ addr_failed->prop.ignore_error = TRUE;
+ }
+
+ /* If the first address on the list has af_ignore_error set, just remove
+ it from the list, throw away any saved message file, log it, and
+ mark the recipient done. */
+
+ if ( addr_failed->prop.ignore_error
+ || addr_failed->dsn_flags & rf_dsnflags
+ && !(addr_failed->dsn_flags & rf_notify_failure)
+ )
+ {
+ addr = addr_failed;
+ addr_failed = addr->next;
+ if (addr->return_filename) Uunlink(addr->return_filename);
+
+#ifndef DISABLE_EVENT
+ msg_event_raise(US"msg:fail:delivery", addr);
+#endif
+ log_write(0, LOG_MAIN, "%s%s%s%s: error ignored%s",
+ addr->address,
+ !addr->parent ? US"" : US" <",
+ !addr->parent ? US"" : addr->parent->address,
+ !addr->parent ? US"" : US">",
+ addr->prop.ignore_error
+ ? US"" : US": RFC 3461 DSN, failure notify not requested");
+
+ address_done(addr, logtod);
+ child_done(addr, logtod);
+ /* Panic-dies on error */
+ (void)spool_write_header(message_id, SW_DELIVERING, NULL);
+ }
+
+ /* Otherwise, handle the sending of a message. Find the error address for
+ the first address, then send a message that includes all failed addresses
+ that have the same error address. Note the bounce_recipient is a global so
+ that it can be accessed by $bounce_recipient while creating a customized
+ error message. */
+
+ else
+ {
+ if (!(bounce_recipient = addr_failed->prop.errors_address))
+ bounce_recipient = sender_address;
+
+ /* Make a subprocess to send a message */
+
+ if ((pid = child_open_exim(&fd, US"bounce-message")) < 0)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Process %d (parent %d) failed to "
+ "create child process to send failure message: %s", getpid(),
+ getppid(), strerror(errno));
+
+ /* Creation of child succeeded */
+
+ else
+ {
+ int ch, rc;
+ int filecount = 0;
+ int rcount = 0;
+ uschar *bcc, *emf_text;
+ FILE * fp = fdopen(fd, "wb");
+ FILE * emf = NULL;
+ BOOL to_sender = strcmpic(sender_address, bounce_recipient) == 0;
+ int max = (bounce_return_size_limit/DELIVER_IN_BUFFER_SIZE + 1) *
+ DELIVER_IN_BUFFER_SIZE;
+ uschar * bound;
+ uschar *dsnlimitmsg;
+ uschar *dsnnotifyhdr;
+ int topt;
+
+ DEBUG(D_deliver)
+ debug_printf("sending error message to: %s\n", bounce_recipient);
+
+ /* Scan the addresses for all that have the same errors address, removing
+ them from the addr_failed chain, and putting them on msgchain. */
+
+ paddr = &addr_failed;
+ for (addr = addr_failed; addr; addr = *paddr)
+ if (Ustrcmp(bounce_recipient, addr->prop.errors_address
+ ? addr->prop.errors_address : sender_address) == 0)
+ { /* The same - dechain */
+ *paddr = addr->next;
+ *pmsgchain = addr;
+ addr->next = NULL;
+ pmsgchain = &(addr->next);
+ }
+ else
+ paddr = &addr->next; /* Not the same; skip */
+
+ /* Include X-Failed-Recipients: for automatic interpretation, but do
+ not let any one header line get too long. We do this by starting a
+ new header every 50 recipients. Omit any addresses for which the
+ "hide_child" flag is set. */
+
+ for (addr = msgchain; addr; addr = addr->next)
+ {
+ if (testflag(addr, af_hide_child)) continue;
+ if (rcount >= 50)
+ {
+ fprintf(fp, "\n");
+ rcount = 0;
+ }
+ fprintf(fp, "%s%s",
+ rcount++ == 0
+ ? "X-Failed-Recipients: "
+ : ",\n ",
+ testflag(addr, af_pfr) && addr->parent
+ ? string_printing(addr->parent->address)
+ : string_printing(addr->address));
+ }
+ if (rcount > 0) fprintf(fp, "\n");
+
+ /* Output the standard headers */
+
+ if (errors_reply_to)
+ fprintf(fp, "Reply-To: %s\n", errors_reply_to);
+ fprintf(fp, "Auto-Submitted: auto-replied\n");
+ moan_write_from(fp);
+ fprintf(fp, "To: %s\n", bounce_recipient);
+ moan_write_references(fp, NULL);
+
+ /* generate boundary string and output MIME-Headers */
+ bound = string_sprintf(TIME_T_FMT "-eximdsn-%d", time(NULL), rand());
+
+ fprintf(fp, "Content-Type: multipart/report;"
+ " report-type=delivery-status; boundary=%s\n"
+ "MIME-Version: 1.0\n",
+ bound);
+
+ /* Open a template file if one is provided. Log failure to open, but
+ carry on - default texts will be used. */
+
+ if (bounce_message_file)
+ emf = expand_open(bounce_message_file,
+ US"bounce_message_file", US"error");
+
+ /* Quietly copy to configured additional addresses if required. */
+
+ if ((bcc = moan_check_errorcopy(bounce_recipient)))
+ fprintf(fp, "Bcc: %s\n", bcc);
+
+ /* The texts for the message can be read from a template file; if there
+ isn't one, or if it is too short, built-in texts are used. The first
+ emf text is a Subject: and any other headers. */
+
+ if ((emf_text = next_emf(emf, US"header")))
+ fprintf(fp, "%s\n", emf_text);
+ else
+ fprintf(fp, "Subject: Mail delivery failed%s\n\n",
+ to_sender? ": returning message to sender" : "");
+
+ /* output human readable part as text/plain section */
+ fprintf(fp, "--%s\n"
+ "Content-type: text/plain; charset=us-ascii\n\n",
+ bound);
+
+ if ((emf_text = next_emf(emf, US"intro")))
+ fprintf(fp, "%s", CS emf_text);
+ else
+ {
+ fprintf(fp,
+/* This message has been reworded several times. It seems to be confusing to
+somebody, however it is worded. I have retreated to the original, simple
+wording. */
+"This message was created automatically by mail delivery software.\n");
+
+ if (bounce_message_text)
+ fprintf(fp, "%s", CS bounce_message_text);
+ if (to_sender)
+ fprintf(fp,
+"\nA message that you sent could not be delivered to one or more of its\n"
+"recipients. This is a permanent error. The following address(es) failed:\n");
+ else
+ fprintf(fp,
+"\nA message sent by\n\n <%s>\n\n"
+"could not be delivered to one or more of its recipients. The following\n"
+"address(es) failed:\n", sender_address);
+ }
+ fputc('\n', fp);
+
+ /* Process the addresses, leaving them on the msgchain if they have a
+ file name for a return message. (There has already been a check in
+ post_process_one() for the existence of data in the message file.) A TRUE
+ return from print_address_information() means that the address is not
+ hidden. */
+
+ paddr = &msgchain;
+ for (addr = msgchain; addr; addr = *paddr)
+ {
+ if (print_address_information(addr, fp, US" ", US"\n ", US""))
+ print_address_error(addr, fp, US"");
+
+ /* End the final line for the address */
+
+ fputc('\n', fp);
+
+ /* Leave on msgchain if there's a return file. */
+
+ if (addr->return_file >= 0)
+ {
+ paddr = &(addr->next);
+ filecount++;
+ }
+
+ /* Else save so that we can tick off the recipient when the
+ message is sent. */
+
+ else
+ {
+ *paddr = addr->next;
+ addr->next = handled_addr;
+ handled_addr = addr;
+ }
+ }
+
+ fputc('\n', fp);
+
+ /* Get the next text, whether we need it or not, so as to be
+ positioned for the one after. */
+
+ emf_text = next_emf(emf, US"generated text");
+
+ /* If there were any file messages passed by the local transports,
+ include them in the message. Then put the address on the handled chain.
+ In the case of a batch of addresses that were all sent to the same
+ transport, the return_file field in all of them will contain the same
+ fd, and the return_filename field in the *last* one will be set (to the
+ name of the file). */
+
+ if (msgchain)
+ {
+ address_item *nextaddr;
+
+ if (emf_text)
+ fprintf(fp, "%s", CS emf_text);
+ else
+ fprintf(fp,
+ "The following text was generated during the delivery "
+ "attempt%s:\n", (filecount > 1)? "s" : "");
+
+ for (addr = msgchain; addr; addr = nextaddr)
+ {
+ FILE *fm;
+ address_item *topaddr = addr;
+
+ /* List all the addresses that relate to this file */
+
+ fputc('\n', fp);
+ while(addr) /* Insurance */
+ {
+ print_address_information(addr, fp, US"------ ", US"\n ",
+ US" ------\n");
+ if (addr->return_filename) break;
+ addr = addr->next;
+ }
+ fputc('\n', fp);
+
+ /* Now copy the file */
+
+ if (!(fm = Ufopen(addr->return_filename, "rb")))
+ fprintf(fp, " +++ Exim error... failed to open text file: %s\n",
+ strerror(errno));
+ else
+ {
+ while ((ch = fgetc(fm)) != EOF) fputc(ch, fp);
+ (void)fclose(fm);
+ }
+ Uunlink(addr->return_filename);
+
+ /* Can now add to handled chain, first fishing off the next
+ address on the msgchain. */
+
+ nextaddr = addr->next;
+ addr->next = handled_addr;
+ handled_addr = topaddr;
+ }
+ fputc('\n', fp);
+ }
+
+ /* output machine readable part */
+#ifdef SUPPORT_I18N
+ if (message_smtputf8)
+ fprintf(fp, "--%s\n"
+ "Content-type: message/global-delivery-status\n\n"
+ "Reporting-MTA: dns; %s\n",
+ bound, smtp_active_hostname);
+ else
+#endif
+ fprintf(fp, "--%s\n"
+ "Content-type: message/delivery-status\n\n"
+ "Reporting-MTA: dns; %s\n",
+ bound, smtp_active_hostname);
+
+ if (dsn_envid)
+ {
+ /* must be decoded from xtext: see RFC 3461:6.3a */
+ uschar *xdec_envid;
+ if (auth_xtextdecode(dsn_envid, &xdec_envid) > 0)
+ fprintf(fp, "Original-Envelope-ID: %s\n", dsn_envid);
+ else
+ fprintf(fp, "X-Original-Envelope-ID: error decoding xtext formatted ENVID\n");
+ }
+ fputc('\n', fp);
+
+ for (addr = handled_addr; addr; addr = addr->next)
+ {
+ host_item * hu;
+
+ print_dsn_addr_action(fp, addr, US"failed", US"5.0.0");
+
+ if ((hu = addr->host_used) && hu->name)
+ {
+ fprintf(fp, "Remote-MTA: dns; %s\n", hu->name);
+#ifdef EXPERIMENTAL_DSN_INFO
+ {
+ const uschar * s;
+ if (hu->address)
+ {
+ uschar * p = hu->port == 25
+ ? US"" : string_sprintf(":%d", hu->port);
+ fprintf(fp, "Remote-MTA: X-ip; [%s]%s\n", hu->address, p);
+ }
+ if ((s = addr->smtp_greeting) && *s)
+ fprintf(fp, "X-Remote-MTA-smtp-greeting: X-str; %.900s\n", s);
+ if ((s = addr->helo_response) && *s)
+ fprintf(fp, "X-Remote-MTA-helo-response: X-str; %.900s\n", s);
+ if ((s = addr->message) && *s)
+ fprintf(fp, "X-Exim-Diagnostic: X-str; %.900s\n", s);
+ }
+#endif
+ print_dsn_diagnostic_code(addr, fp);
+ }
+ fputc('\n', fp);
+ }
+
+ /* Now copy the message, trying to give an intelligible comment if
+ it is too long for it all to be copied. The limit isn't strictly
+ applied because of the buffering. There is, however, an option
+ to suppress copying altogether. */
+
+ emf_text = next_emf(emf, US"copy");
+
+ /* add message body
+ we ignore the intro text from template and add
+ the text for bounce_return_size_limit at the end.
+
+ bounce_return_message is ignored
+ in case RET= is defined we honor these values
+ otherwise bounce_return_body is honored.
+
+ bounce_return_size_limit is always honored.
+ */
+
+ fprintf(fp, "--%s\n", bound);
+
+ dsnlimitmsg = US"X-Exim-DSN-Information: Due to administrative limits only headers are returned";
+ dsnnotifyhdr = NULL;
+ topt = topt_add_return_path;
+
+ /* RET=HDRS? top priority */
+ if (dsn_ret == dsn_ret_hdrs)
+ topt |= topt_no_body;
+ else
+ {
+ struct stat statbuf;
+
+ /* no full body return at all? */
+ if (!bounce_return_body)
+ {
+ topt |= topt_no_body;
+ /* add header if we overrule RET=FULL */
+ if (dsn_ret == dsn_ret_full)
+ dsnnotifyhdr = dsnlimitmsg;
+ }
+ /* line length limited... return headers only if oversize */
+ /* size limited ... return headers only if limit reached */
+ else if ( max_received_linelength > bounce_return_linesize_limit
+ || ( bounce_return_size_limit > 0
+ && fstat(deliver_datafile, &statbuf) == 0
+ && statbuf.st_size > max
+ ) )
+ {
+ topt |= topt_no_body;
+ dsnnotifyhdr = dsnlimitmsg;
+ }
+ }
+
+#ifdef SUPPORT_I18N
+ if (message_smtputf8)
+ fputs(topt & topt_no_body ? "Content-type: message/global-headers\n\n"
+ : "Content-type: message/global\n\n",
+ fp);
+ else
+#endif
+ fputs(topt & topt_no_body ? "Content-type: text/rfc822-headers\n\n"
+ : "Content-type: message/rfc822\n\n",
+ fp);
+
+ fflush(fp);
+ transport_filter_argv = NULL; /* Just in case */
+ return_path = sender_address; /* In case not previously set */
+ { /* Dummy transport for headers add */
+ transport_ctx tctx = {{0}};
+ transport_instance tb = {0};
+
+ tctx.u.fd = fileno(fp);
+ tctx.tblock = &tb;
+ tctx.options = topt;
+ tb.add_headers = dsnnotifyhdr;
+
+ /*XXX no checking for failure! buggy! */
+ transport_write_message(&tctx, 0);
+ }
+ fflush(fp);
+
+ /* we never add the final text. close the file */
+ if (emf)
+ (void)fclose(emf);
+
+ fprintf(fp, "\n--%s--\n", bound);
+
+ /* Close the file, which should send an EOF to the child process
+ that is receiving the message. Wait for it to finish. */
+
+ (void)fclose(fp);
+ rc = child_close(pid, 0); /* Waits for child to close, no timeout */
+
+ /* If the process failed, there was some disaster in setting up the
+ error message. Unless the message is very old, ensure that addr_defer
+ is non-null, which will have the effect of leaving the message on the
+ spool. The failed addresses will get tried again next time. However, we
+ don't really want this to happen too often, so freeze the message unless
+ there are some genuine deferred addresses to try. To do this we have
+ to call spool_write_header() here, because with no genuine deferred
+ addresses the normal code below doesn't get run. */
+
+ if (rc != 0)
+ {
+ uschar *s = US"";
+ if (now - received_time.tv_sec < retry_maximum_timeout && !addr_defer)
+ {
+ addr_defer = (address_item *)(+1);
+ f.deliver_freeze = TRUE;
+ deliver_frozen_at = time(NULL);
+ /* Panic-dies on error */
+ (void)spool_write_header(message_id, SW_DELIVERING, NULL);
+ s = US" (frozen)";
+ }
+ deliver_msglog("Process failed (%d) when writing error message "
+ "to %s%s", rc, bounce_recipient, s);
+ log_write(0, LOG_MAIN, "Process failed (%d) when writing error message "
+ "to %s%s", rc, bounce_recipient, s);
+ }
+
+ /* The message succeeded. Ensure that the recipients that failed are
+ now marked finished with on the spool and their parents updated. */
+
+ else
+ {
+ for (addr = handled_addr; addr; addr = addr->next)
+ {
+ address_done(addr, logtod);
+ child_done(addr, logtod);
+ }
+ /* Panic-dies on error */
+ (void)spool_write_header(message_id, SW_DELIVERING, NULL);
+ }
+ }
+ }
+ }
+
+f.disable_logging = FALSE; /* In case left set */
+
+/* Come here from the mua_wrapper case if routing goes wrong */
+
+DELIVERY_TIDYUP:
+
+/* If there are now no deferred addresses, we are done. Preserve the
+message log if so configured, and we are using them. Otherwise, sling it.
+Then delete the message itself. */
+
+if (!addr_defer)
+ {
+ uschar * fname;
+
+ if (message_logs)
+ {
+ fname = spool_fname(US"msglog", message_subdir, id, US"");
+ if (preserve_message_logs)
+ {
+ int rc;
+ uschar * moname = spool_fname(US"msglog.OLD", US"", id, US"");
+
+ if ((rc = Urename(fname, moname)) < 0)
+ {
+ (void)directory_make(spool_directory,
+ spool_sname(US"msglog.OLD", US""),
+ MSGLOG_DIRECTORY_MODE, TRUE);
+ rc = Urename(fname, moname);
+ }
+ if (rc < 0)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to move %s to the "
+ "msglog.OLD directory", fname);
+ }
+ else
+ if (Uunlink(fname) < 0)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
+ fname, strerror(errno));
+ }
+
+ /* Remove the two message files. */
+
+ fname = spool_fname(US"input", message_subdir, id, US"-D");
+ if (Uunlink(fname) < 0)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
+ fname, strerror(errno));
+ fname = spool_fname(US"input", message_subdir, id, US"-H");
+ if (Uunlink(fname) < 0)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
+ fname, strerror(errno));
+
+ /* Log the end of this message, with queue time if requested. */
+
+ if (LOGGING(queue_time_overall))
+ log_write(0, LOG_MAIN, "Completed QT=%s", string_timesince(&received_time));
+ else
+ log_write(0, LOG_MAIN, "Completed");
+
+ /* Unset deliver_freeze so that we won't try to move the spool files further down */
+ f.deliver_freeze = FALSE;
+
+#ifndef DISABLE_EVENT
+ (void) event_raise(event_action, US"msg:complete", NULL);
+#endif
+ }
+
+/* If there are deferred addresses, we are keeping this message because it is
+not yet completed. Lose any temporary files that were catching output from
+pipes for any of the deferred addresses, handle one-time aliases, and see if
+the message has been on the queue for so long that it is time to send a warning
+message to the sender, unless it is a mailer-daemon. If all deferred addresses
+have the same domain, we can set deliver_domain for the expansion of
+delay_warning_ condition - if any of them are pipes, files, or autoreplies, use
+the parent's domain.
+
+If all the deferred addresses have an error number that indicates "retry time
+not reached", skip sending the warning message, because it won't contain the
+reason for the delay. It will get sent at the next real delivery attempt.
+ Exception: for retries caused by a remote peer we use the error message
+ store in the retry DB as the reason.
+However, if at least one address has tried, we'd better include all of them in
+the message.
+
+If we can't make a process to send the message, don't worry.
+
+For mailing list expansions we want to send the warning message to the
+mailing list manager. We can't do a perfect job here, as some addresses may
+have different errors addresses, but if we take the errors address from
+each deferred address it will probably be right in most cases.
+
+If addr_defer == +1, it means there was a problem sending an error message
+for failed addresses, and there were no "real" deferred addresses. The value
+was set just to keep the message on the spool, so there is nothing to do here.
+*/
+
+else if (addr_defer != (address_item *)(+1))
+ {
+ uschar *recipients = US"";
+ BOOL want_warning_msg = FALSE;
+
+ deliver_domain = testflag(addr_defer, af_pfr)
+ ? addr_defer->parent->domain : addr_defer->domain;
+
+ for (address_item * addr = addr_defer; addr; addr = addr->next)
+ {
+ address_item *otaddr;
+
+ if (addr->basic_errno > ERRNO_WARN_BASE) want_warning_msg = TRUE;
+
+ if (deliver_domain)
+ {
+ const uschar *d = testflag(addr, af_pfr)
+ ? addr->parent->domain : addr->domain;
+
+ /* The domain may be unset for an address that has never been routed
+ because the system filter froze the message. */
+
+ if (!d || Ustrcmp(d, deliver_domain) != 0)
+ deliver_domain = NULL;
+ }
+
+ if (addr->return_filename) Uunlink(addr->return_filename);
+
+ /* Handle the case of one-time aliases. If any address in the ancestry
+ of this one is flagged, ensure it is in the recipients list, suitably
+ flagged, and that its parent is marked delivered. */
+
+ for (otaddr = addr; otaddr; otaddr = otaddr->parent)
+ if (otaddr->onetime_parent) break;
+
+ if (otaddr)
+ {
+ int i;
+ int t = recipients_count;
+
+ for (i = 0; i < recipients_count; i++)
+ {
+ uschar *r = recipients_list[i].address;
+ if (Ustrcmp(otaddr->onetime_parent, r) == 0) t = i;
+ if (Ustrcmp(otaddr->address, r) == 0) break;
+ }
+
+ /* Didn't find the address already in the list, and did find the
+ ultimate parent's address in the list, and they really are different
+ (i.e. not from an identity-redirect). After adding the recipient,
+ update the errors address in the recipients list. */
+
+ if ( i >= recipients_count && t < recipients_count
+ && Ustrcmp(otaddr->address, otaddr->parent->address) != 0)
+ {
+ DEBUG(D_deliver) debug_printf("one_time: adding %s in place of %s\n",
+ otaddr->address, otaddr->parent->address);
+ receive_add_recipient(otaddr->address, t);
+ recipients_list[recipients_count-1].errors_to = otaddr->prop.errors_address;
+ tree_add_nonrecipient(otaddr->parent->address);
+ update_spool = TRUE;
+ }
+ }
+
+ /* Except for error messages, ensure that either the errors address for
+ this deferred address or, if there is none, the sender address, is on the
+ list of recipients for a warning message. */
+
+ if (sender_address[0])
+ {
+ uschar * s = addr->prop.errors_address;
+ if (!s) s = sender_address;
+ if (Ustrstr(recipients, s) == NULL)
+ recipients = string_sprintf("%s%s%s", recipients,
+ recipients[0] ? "," : "", s);
+ }
+ }
+
+ /* Send a warning message if the conditions are right. If the condition check
+ fails because of a lookup defer, there is nothing we can do. The warning
+ is not sent. Another attempt will be made at the next delivery attempt (if
+ it also defers). */
+
+ if ( !f.queue_2stage
+ && want_warning_msg
+ && ( !(addr_defer->dsn_flags & rf_dsnflags)
+ || addr_defer->dsn_flags & rf_notify_delay
+ )
+ && delay_warning[1] > 0
+ && sender_address[0] != 0
+ && ( !delay_warning_condition
+ || expand_check_condition(delay_warning_condition,
+ US"delay_warning", US"option")
+ )
+ )
+ {
+ int count;
+ int show_time;
+ int queue_time = time(NULL) - received_time.tv_sec;
+
+ queue_time = test_harness_fudged_queue_time(queue_time);
+
+ /* See how many warnings we should have sent by now */
+
+ for (count = 0; count < delay_warning[1]; count++)
+ if (queue_time < delay_warning[count+2]) break;
+
+ show_time = delay_warning[count+1];
+
+ if (count >= delay_warning[1])
+ {
+ int extra;
+ int last_gap = show_time;
+ if (count > 1) last_gap -= delay_warning[count];
+ extra = (queue_time - delay_warning[count+1])/last_gap;
+ show_time += last_gap * extra;
+ count += extra;
+ }
+
+ DEBUG(D_deliver)
+ {
+ debug_printf("time on queue = %s id %s addr %s\n",
+ readconf_printtime(queue_time), message_id, addr_defer->address);
+ debug_printf("warning counts: required %d done %d\n", count,
+ warning_count);
+ }
+
+ /* We have computed the number of warnings there should have been by now.
+ If there haven't been enough, send one, and up the count to what it should
+ have been. */
+
+ if (warning_count < count)
+ {
+ header_line *h;
+ int fd;
+ pid_t pid = child_open_exim(&fd, US"delay-warning-message");
+
+ if (pid > 0)
+ {
+ uschar * wmf_text;
+ FILE * wmf = NULL;
+ FILE * f = fdopen(fd, "wb");
+ uschar * bound;
+ transport_ctx tctx = {{0}};
+
+ if (warn_message_file)
+ wmf = expand_open(warn_message_file,
+ US"warn_message_file", US"warning");
+
+ warnmsg_recipients = recipients;
+ warnmsg_delay = queue_time < 120*60
+ ? string_sprintf("%d minutes", show_time/60)
+ : string_sprintf("%d hours", show_time/3600);
+
+ if (errors_reply_to)
+ fprintf(f, "Reply-To: %s\n", errors_reply_to);
+ fprintf(f, "Auto-Submitted: auto-replied\n");
+ moan_write_from(f);
+ fprintf(f, "To: %s\n", recipients);
+ moan_write_references(f, NULL);
+
+ /* generated boundary string and output MIME-Headers */
+ bound = string_sprintf(TIME_T_FMT "-eximdsn-%d", time(NULL), rand());
+
+ fprintf(f, "Content-Type: multipart/report;"
+ " report-type=delivery-status; boundary=%s\n"
+ "MIME-Version: 1.0\n",
+ bound);
+
+ if ((wmf_text = next_emf(wmf, US"header")))
+ fprintf(f, "%s\n", wmf_text);
+ else
+ fprintf(f, "Subject: Warning: message %s delayed %s\n\n",
+ message_id, warnmsg_delay);
+
+ /* output human readable part as text/plain section */
+ fprintf(f, "--%s\n"
+ "Content-type: text/plain; charset=us-ascii\n\n",
+ bound);
+
+ if ((wmf_text = next_emf(wmf, US"intro")))
+ fprintf(f, "%s", CS wmf_text);
+ else
+ {
+ fprintf(f,
+"This message was created automatically by mail delivery software.\n");
+
+ if (Ustrcmp(recipients, sender_address) == 0)
+ fprintf(f,
+"A message that you sent has not yet been delivered to one or more of its\n"
+"recipients after more than ");
+
+ else
+ fprintf(f,
+"A message sent by\n\n <%s>\n\n"
+"has not yet been delivered to one or more of its recipients after more than \n",
+ sender_address);
+
+ fprintf(f, "%s on the queue on %s.\n\n"
+ "The message identifier is: %s\n",
+ warnmsg_delay, primary_hostname, message_id);
+
+ for (h = header_list; h; h = h->next)
+ if (strncmpic(h->text, US"Subject:", 8) == 0)
+ fprintf(f, "The subject of the message is: %s", h->text + 9);
+ else if (strncmpic(h->text, US"Date:", 5) == 0)
+ fprintf(f, "The date of the message is: %s", h->text + 6);
+ fputc('\n', f);
+
+ fprintf(f, "The address%s to which the message has not yet been "
+ "delivered %s:\n",
+ !addr_defer->next ? "" : "es",
+ !addr_defer->next ? "is": "are");
+ }
+
+ /* List the addresses, with error information if allowed */
+
+ fputc('\n', f);
+ for (address_item * addr = addr_defer; addr; addr = addr->next)
+ {
+ if (print_address_information(addr, f, US" ", US"\n ", US""))
+ print_address_error(addr, f, US"Delay reason: ");
+ fputc('\n', f);
+ }
+ fputc('\n', f);
+
+ /* Final text */
+
+ if (wmf)
+ {
+ if ((wmf_text = next_emf(wmf, US"final")))
+ fprintf(f, "%s", CS wmf_text);
+ (void)fclose(wmf);
+ }
+ else
+ {
+ fprintf(f,
+"No action is required on your part. Delivery attempts will continue for\n"
+"some time, and this warning may be repeated at intervals if the message\n"
+"remains undelivered. Eventually the mail delivery software will give up,\n"
+"and when that happens, the message will be returned to you.\n");
+ }
+
+ /* output machine readable part */
+ fprintf(f, "\n--%s\n"
+ "Content-type: message/delivery-status\n\n"
+ "Reporting-MTA: dns; %s\n",
+ bound,
+ smtp_active_hostname);
+
+
+ if (dsn_envid)
+ {
+ /* must be decoded from xtext: see RFC 3461:6.3a */
+ uschar *xdec_envid;
+ if (auth_xtextdecode(dsn_envid, &xdec_envid) > 0)
+ fprintf(f,"Original-Envelope-ID: %s\n", dsn_envid);
+ else
+ fprintf(f,"X-Original-Envelope-ID: error decoding xtext formatted ENVID\n");
+ }
+ fputc('\n', f);
+
+ for (address_item * addr = addr_defer; addr; addr = addr->next)
+ {
+ host_item * hu;
+
+ print_dsn_addr_action(f, addr, US"delayed", US"4.0.0");
+
+ if ((hu = addr->host_used) && hu->name)
+ {
+ fprintf(f, "Remote-MTA: dns; %s\n", hu->name);
+ print_dsn_diagnostic_code(addr, f);
+ }
+ fputc('\n', f);
+ }
+
+ fprintf(f, "--%s\n"
+ "Content-type: text/rfc822-headers\n\n",
+ bound);
+
+ fflush(f);
+ /* header only as required by RFC. only failure DSN needs to honor RET=FULL */
+ tctx.u.fd = fileno(f);
+ tctx.options = topt_add_return_path | topt_no_body;
+ transport_filter_argv = NULL; /* Just in case */
+ return_path = sender_address; /* In case not previously set */
+
+ /* Write the original email out */
+ /*XXX no checking for failure! buggy! */
+ transport_write_message(&tctx, 0);
+ fflush(f);
+
+ fprintf(f,"\n--%s--\n", bound);
+
+ fflush(f);
+
+ /* Close and wait for child process to complete, without a timeout.
+ If there's an error, don't update the count. */
+
+ (void)fclose(f);
+ if (child_close(pid, 0) == 0)
+ {
+ warning_count = count;
+ update_spool = TRUE; /* Ensure spool rewritten */
+ }
+ }
+ }
+ }
+
+ /* Clear deliver_domain */
+
+ deliver_domain = NULL;
+
+ /* If this was a first delivery attempt, unset the first time flag, and
+ ensure that the spool gets updated. */
+
+ if (f.deliver_firsttime)
+ {
+ f.deliver_firsttime = FALSE;
+ update_spool = TRUE;
+ }
+
+ /* If delivery was frozen and freeze_tell is set, generate an appropriate
+ message, unless the message is a local error message (to avoid loops). Then
+ log the freezing. If the text in "frozen_info" came from a system filter,
+ it has been escaped into printing characters so as not to mess up log lines.
+ For the "tell" message, we turn \n back into newline. Also, insert a newline
+ near the start instead of the ": " string. */
+
+ if (f.deliver_freeze)
+ {
+ if (freeze_tell && freeze_tell[0] != 0 && !f.local_error_message)
+ {
+ uschar *s = string_copy(frozen_info);
+ uschar *ss = Ustrstr(s, " by the system filter: ");
+
+ if (ss != NULL)
+ {
+ ss[21] = '.';
+ ss[22] = '\n';
+ }
+
+ ss = s;
+ while (*ss != 0)
+ {
+ if (*ss == '\\' && ss[1] == 'n')
+ {
+ *ss++ = ' ';
+ *ss++ = '\n';
+ }
+ else ss++;
+ }
+ moan_tell_someone(freeze_tell, addr_defer, US"Message frozen",
+ "Message %s has been frozen%s.\nThe sender is <%s>.\n", message_id,
+ s, sender_address);
+ }
+
+ /* Log freezing just before we update the -H file, to minimize the chance
+ of a race problem. */
+
+ deliver_msglog("*** Frozen%s\n", frozen_info);
+ log_write(0, LOG_MAIN, "Frozen%s", frozen_info);
+ }
+
+ /* If there have been any updates to the non-recipients list, or other things
+ that get written to the spool, we must now update the spool header file so
+ that it has the right information for the next delivery attempt. If there
+ was more than one address being delivered, the header_change update is done
+ earlier, in case one succeeds and then something crashes. */
+
+ DEBUG(D_deliver)
+ debug_printf("delivery deferred: update_spool=%d header_rewritten=%d\n",
+ update_spool, f.header_rewritten);
+
+ if (update_spool || f.header_rewritten)
+ /* Panic-dies on error */
+ (void)spool_write_header(message_id, SW_DELIVERING, NULL);
+ }
+
+/* Finished with the message log. If the message is complete, it will have
+been unlinked or renamed above. */
+
+if (message_logs) (void)fclose(message_log);
+
+/* Now we can close and remove the journal file. Its only purpose is to record
+successfully completed deliveries asap so that this information doesn't get
+lost if Exim (or the machine) crashes. Forgetting about a failed delivery is
+not serious, as trying it again is not harmful. The journal might not be open
+if all addresses were deferred at routing or directing. Nevertheless, we must
+remove it if it exists (may have been lying around from a crash during the
+previous delivery attempt). We don't remove the journal if a delivery
+subprocess failed to pass back delivery information; this is controlled by
+the remove_journal flag. When the journal is left, we also don't move the
+message off the main spool if frozen and the option is set. It should get moved
+at the next attempt, after the journal has been inspected. */
+
+if (journal_fd >= 0) (void)close(journal_fd);
+
+if (remove_journal)
+ {
+ uschar * fname = spool_fname(US"input", message_subdir, id, US"-J");
+
+ if (Uunlink(fname) < 0 && errno != ENOENT)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", fname,
+ strerror(errno));
+
+ /* Move the message off the spool if requested */
+
+#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
+ if (f.deliver_freeze && move_frozen_messages)
+ (void)spool_move_message(id, message_subdir, US"", US"F");
+#endif
+ }
+
+/* Closing the data file frees the lock; if the file has been unlinked it
+will go away. Otherwise the message becomes available for another process
+to try delivery. */
+
+(void)close(deliver_datafile);
+deliver_datafile = -1;
+DEBUG(D_deliver) debug_printf("end delivery of %s\n", id);
+#ifdef MEASURE_TIMING
+report_time_since(&timestamp_startup, US"delivery end"); /* testcase 0005 */
+#endif
+
+/* It is unlikely that there will be any cached resources, since they are
+released after routing, and in the delivery subprocesses. However, it's
+possible for an expansion for something afterwards (for example,
+expand_check_condition) to do a lookup. We must therefore be sure everything is
+released. */
+
+search_tidyup();
+acl_where = ACL_WHERE_UNKNOWN;
+return final_yield;
+}
+
+
+
+void
+tcp_init(void)
+{
+#ifdef EXIM_TFO_PROBE
+tfo_probe();
+#else
+f.tcp_fastopen_ok = TRUE;
+#endif
+}
+
+
+uschar *
+deliver_get_sender_address (uschar * id)
+{
+int rc;
+uschar * new_sender_address,
+ * save_sender_address;
+BOOL save_qr = f.queue_running;
+uschar * spoolname;
+
+/* make spool_open_datafile non-noisy on fail */
+
+f.queue_running = TRUE;
+
+/* Side effect: message_subdir is set for the (possibly split) spool directory */
+
+deliver_datafile = spool_open_datafile(id);
+f.queue_running = save_qr;
+if (deliver_datafile < 0)
+ return NULL;
+
+/* Save and restore the global sender_address. I'm not sure if we should
+not save/restore all the other global variables too, because
+spool_read_header() may change all of them. But OTOH, when this
+deliver_get_sender_address() gets called, the current message is done
+already and nobody needs the globals anymore. (HS12, 2015-08-21) */
+
+spoolname = string_sprintf("%s-H", id);
+save_sender_address = sender_address;
+
+rc = spool_read_header(spoolname, TRUE, TRUE);
+
+new_sender_address = sender_address;
+sender_address = save_sender_address;
+
+if (rc != spool_read_OK)
+ return NULL;
+
+assert(new_sender_address);
+
+(void)close(deliver_datafile);
+deliver_datafile = -1;
+
+return new_sender_address;
+}
+
+
+
+void
+delivery_re_exec(int exec_type)
+{
+uschar * where;
+
+if (cutthrough.cctx.sock >= 0 && cutthrough.callout_hold_only)
+ {
+ int channel_fd = cutthrough.cctx.sock;
+
+ smtp_peer_options = cutthrough.peer_options;
+ continue_sequence = 0;
+
+#ifndef DISABLE_TLS
+ if (cutthrough.is_tls)
+ {
+ int pfd[2], pid;
+
+ smtp_peer_options |= OPTION_TLS;
+ sending_ip_address = cutthrough.snd_ip;
+ sending_port = cutthrough.snd_port;
+
+ where = US"socketpair";
+ if (socketpair(AF_UNIX, SOCK_STREAM, 0, pfd) != 0)
+ goto fail;
+
+ where = US"fork";
+ testharness_pause_ms(150);
+ if ((pid = exim_fork(US"tls-proxy-interproc")) < 0)
+ goto fail;
+
+ if (pid == 0) /* child: will fork again to totally disconnect */
+ {
+ smtp_proxy_tls(cutthrough.cctx.tls_ctx, big_buffer, big_buffer_size,
+ pfd, 5*60);
+ /* does not return */
+ }
+
+ close(pfd[0]);
+ waitpid(pid, NULL, 0);
+ (void) close(channel_fd); /* release the client socket */
+ channel_fd = pfd[1];
+ }
+#endif
+
+ transport_do_pass_socket(cutthrough.transport, cutthrough.host.name,
+ cutthrough.host.address, message_id, channel_fd);
+ }
+else
+ {
+ cancel_cutthrough_connection(TRUE, US"non-continued delivery");
+ (void) child_exec_exim(exec_type, FALSE, NULL, FALSE, 2, US"-Mc", message_id);
+ }
+return; /* compiler quietening; control does not reach here. */
+
+#ifndef DISABLE_TLS
+fail:
+ log_write(0,
+ LOG_MAIN | (exec_type == CEE_EXEC_EXIT ? LOG_PANIC : LOG_PANIC_DIE),
+ "delivery re-exec %s failed: %s", where, strerror(errno));
+
+ /* Get here if exec_type == CEE_EXEC_EXIT.
+ Note: this must be _exit(), not exit(). */
+
+ _exit(EX_EXECFAILED);
+#endif
+}
+
+/* vi: aw ai sw=2
+*/
+/* End of deliver.c */