1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim maintainers 2020 - 2021 */
7 /* See the file NOTICE for conditions of use and distribution. */
13 #ifdef HAVE_SETCLASSRESOURCES
14 #include <login_cap.h>
19 /* Options specific to the pipe transport. They must be in alphabetic
20 order (note that "_" comes before the lower case letters). Those starting
21 with "*" are not settable by the user but are used by the option-reading
22 software for alternative value types. Some options are stored in the transport
23 instance block so as to be publicly visible; these are flagged with opt_public.
25 #define LOFF(field) OPT_OFF(pipe_transport_options_block, field)
27 optionlist pipe_transport_options[] = {
28 { "allow_commands", opt_stringptr, LOFF(allow_commands) },
29 { "batch_id", opt_stringptr | opt_public,
30 OPT_OFF(transport_instance, batch_id) },
31 { "batch_max", opt_int | opt_public,
32 OPT_OFF(transport_instance, batch_max) },
33 { "check_string", opt_stringptr, LOFF(check_string) },
34 { "command", opt_stringptr, LOFF(cmd) },
35 { "environment", opt_stringptr, LOFF(environment) },
36 { "escape_string", opt_stringptr, LOFF(escape_string) },
37 { "force_command", opt_bool, LOFF(force_command) },
38 { "freeze_exec_fail", opt_bool, LOFF(freeze_exec_fail) },
39 { "freeze_signal", opt_bool, LOFF(freeze_signal) },
40 { "ignore_status", opt_bool, LOFF(ignore_status) },
41 { "log_defer_output", opt_bool | opt_public,
42 OPT_OFF(transport_instance, log_defer_output) },
43 { "log_fail_output", opt_bool | opt_public,
44 OPT_OFF(transport_instance, log_fail_output) },
45 { "log_output", opt_bool | opt_public,
46 OPT_OFF(transport_instance, log_output) },
47 { "max_output", opt_mkint, LOFF(max_output) },
48 { "message_prefix", opt_stringptr, LOFF(message_prefix) },
49 { "message_suffix", opt_stringptr, LOFF(message_suffix) },
50 { "path", opt_stringptr, LOFF(path) },
51 { "permit_coredump", opt_bool, LOFF(permit_coredump) },
52 { "pipe_as_creator", opt_bool | opt_public,
53 OPT_OFF(transport_instance, deliver_as_creator) },
54 { "restrict_to_path", opt_bool, LOFF(restrict_to_path) },
55 { "return_fail_output",opt_bool | opt_public,
56 OPT_OFF(transport_instance, return_fail_output) },
57 { "return_output", opt_bool | opt_public,
58 OPT_OFF(transport_instance, return_output) },
59 { "temp_errors", opt_stringptr, LOFF(temp_errors) },
60 { "timeout", opt_time, LOFF(timeout) },
61 { "timeout_defer", opt_bool, LOFF(timeout_defer) },
62 { "umask", opt_octint, LOFF(umask) },
63 { "use_bsmtp", opt_bool, LOFF(use_bsmtp) },
64 #ifdef HAVE_SETCLASSRESOURCES
65 { "use_classresources", opt_bool, LOFF(use_classresources) },
67 { "use_crlf", opt_bool, LOFF(use_crlf) },
68 { "use_shell", opt_bool, LOFF(use_shell) },
71 /* Size of the options list. An extern variable has to be used so that its
72 address can appear in the tables drtables.c. */
74 int pipe_transport_options_count =
75 sizeof(pipe_transport_options)/sizeof(optionlist);
81 pipe_transport_options_block pipe_transport_option_defaults = {0};
82 void pipe_transport_init(transport_instance *tblock) {}
83 BOOL pipe_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
85 #else /*!MACRO_PREDEF*/
88 /* Default private options block for the pipe transport. */
90 pipe_transport_options_block pipe_transport_option_defaults = {
91 .path = US"/bin:/usr/bin",
92 .temp_errors = US mac_expanded_string(EX_TEMPFAIL) ":"
93 mac_expanded_string(EX_CANTCREAT),
97 /* all others null/zero/false */
102 /*************************************************
103 * Setup entry point *
104 *************************************************/
106 /* Called for each delivery in the privileged state, just before the uid/gid
107 are changed and the main entry point is called. In a system that supports the
108 login_cap facilities, this function is used to set the class resource limits
109 for the user. It may also re-enable coredumps.
112 tblock points to the transport instance
113 addrlist addresses about to be delivered (not used)
114 dummy not used (doesn't pass back data)
115 uid the uid that will be set (not used)
116 gid the gid that will be set (not used)
117 errmsg where to put an error message
119 Returns: OK, FAIL, or DEFER
123 pipe_transport_setup(transport_instance *tblock, address_item *addrlist,
124 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
126 pipe_transport_options_block *ob =
127 (pipe_transport_options_block *)(tblock->options_block);
129 #ifdef HAVE_SETCLASSRESOURCES
130 if (ob->use_classresources)
132 struct passwd *pw = getpwuid(uid);
135 login_cap_t *lc = login_getpwclass(pw);
138 setclassresources(lc);
146 if (ob->permit_coredump)
149 rl.rlim_cur = RLIM_INFINITY;
150 rl.rlim_max = RLIM_INFINITY;
151 if (setrlimit(RLIMIT_CORE, &rl) < 0)
153 #ifdef SETRLIMIT_NOT_SUPPORTED
154 if (errno != ENOSYS && errno != ENOTSUP)
156 log_write(0, LOG_MAIN,
157 "delivery setrlimit(RLIMIT_CORE, RLIM_INFINITY) failed: %s",
168 /*************************************************
169 * Initialization entry point *
170 *************************************************/
172 /* Called for each instance, after its options have been read, to
173 enable consistency checks to be done, or anything else that needs
177 pipe_transport_init(transport_instance *tblock)
179 pipe_transport_options_block *ob =
180 (pipe_transport_options_block *)(tblock->options_block);
182 /* Set up the setup entry point, to be called in the privileged state */
184 tblock->setup = pipe_transport_setup;
186 /* If pipe_as_creator is set, then uid/gid should not be set. */
188 if (tblock->deliver_as_creator && (tblock->uid_set || tblock->gid_set ||
189 tblock->expand_uid != NULL || tblock->expand_gid != NULL))
190 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
191 "both pipe_as_creator and an explicit uid/gid are set for the %s "
192 "transport", tblock->name);
194 /* If a fixed uid field is set, then a gid field must also be set. */
196 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
197 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
198 "user set without group for the %s transport", tblock->name);
200 /* Temp_errors must consist only of digits and colons, but there can be
201 spaces round the colons, so allow them too. */
203 if (ob->temp_errors != NULL && Ustrcmp(ob->temp_errors, "*") != 0)
205 size_t p = Ustrspn(ob->temp_errors, "0123456789: ");
206 if (ob->temp_errors[p] != 0)
207 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
208 "temp_errors must be a list of numbers or an asterisk for the %s "
209 "transport", tblock->name);
212 /* Only one of return_output/return_fail_output or log_output/log_fail_output
215 if (tblock->return_output && tblock->return_fail_output)
216 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
217 "both return_output and return_fail_output set for %s transport",
220 if (tblock->log_output && tblock->log_fail_output)
221 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
222 "both log_output and log_fail_output set for the %s transport",
225 /* If batch SMTP is set, force the check and escape strings, and arrange that
226 headers are also escaped. */
230 ob->check_string = US".";
231 ob->escape_string = US"..";
232 ob->options |= topt_escape_headers;
235 /* If not batch SMTP, and message_prefix or message_suffix are unset, insert
236 default values for them. */
240 if (ob->message_prefix == NULL) ob->message_prefix =
241 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
242 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
245 /* The restrict_to_path and use_shell options are incompatible */
247 if (ob->restrict_to_path && ob->use_shell)
248 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
249 "both restrict_to_path and use_shell set for %s transport",
252 /* The allow_commands and use_shell options are incompatible */
254 if (ob->allow_commands && ob->use_shell)
255 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
256 "both allow_commands and use_shell set for %s transport",
259 /* Set up the bitwise options for transport_write_message from the various
260 driver options. Only one of body_only and headers_only can be set. */
263 (tblock->body_only ? topt_no_headers : 0)
264 | (tblock->headers_only ? topt_no_body : 0)
265 | (tblock->return_path_add ? topt_add_return_path : 0)
266 | (tblock->delivery_date_add ? topt_add_delivery_date : 0)
267 | (tblock->envelope_to_add ? topt_add_envelope_to : 0)
268 | (ob->use_crlf ? topt_use_crlf : 0);
273 /*************************************************
274 * Set up direct (non-shell) command *
275 *************************************************/
277 /* This function is called when a command line is to be parsed by the transport
278 and executed directly, without the use of /bin/sh.
281 argvptr pointer to anchor for argv vector
282 cmd points to the command string
283 expand_arguments true if expansion is to occur
284 expand_fail error if expansion fails
285 addr chain of addresses
286 tname the transport name
287 ob the transport options block
289 Returns: TRUE if all went well; otherwise an error will be
290 set in the first address and FALSE returned
294 set_up_direct_command(const uschar ***argvptr, uschar *cmd,
295 BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname,
296 pipe_transport_options_block *ob)
298 BOOL permitted = FALSE;
301 /* Set up "transport <name>" to be put in any error messages, and then
302 call the common function for creating an argument list and expanding
303 the items if necessary. If it fails, this function fails (error information
304 is in the addresses). */
306 if (!transport_set_up_command(argvptr, cmd, expand_arguments, expand_fail,
307 addr, FALSE, string_sprintf("%.50s transport", tname), NULL))
310 /* Point to the set-up arguments. */
314 /* If allow_commands is set, see if the command is in the permitted list. */
316 if (ob->allow_commands)
322 if (!(s = expand_string(ob->allow_commands)))
324 addr->transport_return = DEFER;
325 addr->message = string_sprintf("failed to expand string \"%s\" "
326 "for %s transport: %s", ob->allow_commands, tname, expand_string_message);
330 while ((p = string_nextinlist(&s, &sep, NULL, 0)))
331 if (Ustrcmp(p, argv[0]) == 0) { permitted = TRUE; break; }
334 /* If permitted is TRUE it means the command was found in the allowed list, and
335 no further checks are done. If permitted = FALSE, it either means
336 allow_commands wasn't set, or that the command didn't match anything in the
337 list. In both cases, if restrict_to_path is set, we fail if the command
338 contains any slashes, but if restrict_to_path is not set, we must fail the
339 command only if allow_commands is set. */
343 if (ob->restrict_to_path)
345 if (Ustrchr(argv[0], '/') != NULL)
347 addr->transport_return = FAIL;
348 addr->message = string_sprintf("\"/\" found in \"%s\" (command for %s "
349 "transport) - failed for security reasons", cmd, tname);
354 else if (ob->allow_commands)
356 addr->transport_return = FAIL;
357 addr->message = string_sprintf("\"%s\" command not permitted by %s "
358 "transport", argv[0], tname);
363 /* If the command is not an absolute path, search the PATH directories
366 if (argv[0][0] != '/')
370 const uschar *listptr = expand_string(ob->path);
372 while ((p = string_nextinlist(&listptr, &sep, NULL, 0)))
375 sprintf(CS big_buffer, "%.256s/%.256s", p, argv[0]);
376 if (Ustat(big_buffer, &statbuf) == 0)
378 argv[0] = string_copy(big_buffer);
384 addr->transport_return = FAIL;
385 addr->message = string_sprintf("\"%s\" command not found for %s transport",
395 /*************************************************
396 * Set up shell command *
397 *************************************************/
399 /* This function is called when a command line is to be passed to /bin/sh
400 without parsing inside the transport.
403 argvptr pointer to anchor for argv vector
404 cmd points to the command string
405 expand_arguments true if expansion is to occur
406 expand_fail error if expansion fails
407 addr chain of addresses
408 tname the transport name
410 Returns: TRUE if all went well; otherwise an error will be
411 set in the first address and FALSE returned
415 set_up_shell_command(const uschar ***argvptr, uschar *cmd,
416 BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname)
420 *argvptr = argv = store_get((4)*sizeof(uschar *), GET_UNTAINTED);
422 argv[0] = US"/bin/sh";
425 /* We have to take special action to handle the special "variable" called
426 $pipe_addresses, which is not recognized by the normal expansion function. */
428 if (expand_arguments)
430 uschar * p = Ustrstr(cmd, "pipe_addresses");
434 debug_printf("shell pipe command before expansion:\n %s\n", cmd);
436 /* Allow $recipients in the expansion iff it comes from a system filter */
438 f.enable_dollar_recipients = addr && addr->parent &&
439 Ustrcmp(addr->parent->address, "system-filter") == 0;
442 (p > cmd && p[-1] == '$') ||
443 (p > cmd + 1 && p[-2] == '$' && p[-1] == '{' && p[14] == '}')))
447 if (p[-1] == '{') { q++; p--; }
449 g = string_get(Ustrlen(cmd) + 64);
450 g = string_catn(g, cmd, p - cmd - 1);
452 for (address_item * ad = addr; ad; ad = ad->next)
454 DEBUG(D_transport) if (is_tainted(ad->address))
455 debug_printf("tainted element '%s' from $pipe_addresses\n", ad->address);
457 /*XXX string_append_listele() ? */
458 if (ad != addr) g = string_catn(g, US" ", 1);
459 g = string_cat(g, ad->address);
462 g = string_cat(g, q);
463 argv[2] = (cmd = string_from_gstring(g)) ? expand_string(cmd) : NULL;
466 argv[2] = expand_string(cmd);
468 f.enable_dollar_recipients = FALSE;
472 addr->transport_return = f.search_find_defer ? DEFER : expand_fail;
473 addr->message = string_sprintf("Expansion of command \"%s\" "
474 "in %s transport failed: %s",
475 cmd, tname, expand_string_message);
480 debug_printf("shell pipe command after expansion:\n %s\n", argv[2]);
485 debug_printf("shell pipe command (no expansion):\n %s\n", cmd);
496 /*************************************************
498 *************************************************/
500 /* See local README for interface details. This transport always returns FALSE,
501 indicating that the status in the first address is the status for all addresses
505 pipe_transport_entry(
506 transport_instance *tblock, /* data for this instantiation */
507 address_item *addr) /* address(es) we are working on */
510 int fd_in, fd_out, rc;
514 pipe_transport_options_block *ob =
515 (pipe_transport_options_block *)(tblock->options_block);
516 int timeout = ob->timeout;
517 BOOL written_ok = FALSE;
518 BOOL expand_arguments;
521 const uschar *envlist = ob->environment;
523 uschar *eol = ob->use_crlf ? US"\r\n" : US"\n";
524 transport_ctx tctx = {
527 .check_string = ob->check_string,
528 .escape_string = ob->escape_string,
529 ob->options | topt_not_socket /* set at initialization time */
532 DEBUG(D_transport) debug_printf("%s transport entered\n", tblock->name);
534 /* Set up for the good case */
536 addr->transport_return = OK;
537 addr->basic_errno = 0;
539 /* Pipes are not accepted as general addresses, but they can be generated from
540 .forward files or alias files. In those cases, the pfr flag is set, and the
541 command to be obeyed is pointed to by addr->local_part; it starts with the pipe
542 symbol. In other cases, the command is supplied as one of the pipe transport's
545 if (testflag(addr, af_pfr) && addr->local_part[0] == '|')
546 if (ob->force_command)
548 /* Enables expansion of $address_pipe into separate arguments */
549 setflag(addr, af_force_command);
551 expand_arguments = TRUE;
556 cmd = addr->local_part + 1;
557 while (isspace(*cmd)) cmd++;
558 expand_arguments = testflag(addr, af_expand_pipe);
564 expand_arguments = TRUE;
568 /* If no command has been supplied, we are in trouble.
569 We also check for an empty string since it may be
570 coming from addr->local_part[0] == '|' */
574 addr->transport_return = DEFER;
575 addr->message = string_sprintf("no command specified for %s transport",
581 DEBUG(D_transport) debug_printf("cmd '%s' is tainted\n", cmd);
582 addr->message = string_sprintf("Tainted '%s' (command "
583 "for %s transport) not permitted", cmd, tblock->name);
584 addr->transport_return = PANIC;
588 /* When a pipe is set up by a filter file, there may be values for $thisaddress
589 and numerical the variables in existence. These are passed in
590 addr->pipe_expandn for use here. */
592 if (expand_arguments && addr->pipe_expandn)
594 uschar **ss = addr->pipe_expandn;
596 if (*ss) filter_thisaddress = *ss++;
599 expand_nstring[++expand_nmax] = *ss;
600 expand_nlength[expand_nmax] = Ustrlen(*ss++);
604 /* The default way of processing the command is to split it up into arguments
605 here, and run it directly. This offers some security advantages. However, there
606 are installations that want by default to run commands under /bin/sh always, so
607 there is an option to do that. */
611 if (!set_up_shell_command(&argv, cmd, expand_arguments, expand_fail, addr,
612 tblock->name)) return FALSE;
614 else if (!set_up_direct_command(&argv, cmd, expand_arguments, expand_fail, addr,
615 tblock->name, ob)) return FALSE;
617 expand_nmax = -1; /* Reset */
618 filter_thisaddress = NULL;
620 /* Set up the environment for the command. */
622 envp[envcount++] = string_sprintf("LOCAL_PART=%s", deliver_localpart);
623 envp[envcount++] = string_sprintf("LOGNAME=%s", deliver_localpart);
624 envp[envcount++] = string_sprintf("USER=%s", deliver_localpart);
625 envp[envcount++] = string_sprintf("LOCAL_PART_PREFIX=%#s",
626 deliver_localpart_prefix);
627 envp[envcount++] = string_sprintf("LOCAL_PART_SUFFIX=%#s",
628 deliver_localpart_suffix);
629 envp[envcount++] = string_sprintf("DOMAIN=%s", deliver_domain);
630 envp[envcount++] = string_sprintf("HOME=%#s", deliver_home);
631 envp[envcount++] = string_sprintf("MESSAGE_ID=%s", message_id);
632 envp[envcount++] = string_sprintf("PATH=%s", expand_string(ob->path));
633 envp[envcount++] = string_sprintf("RECIPIENT=%#s%#s%#s@%#s",
634 deliver_localpart_prefix, deliver_localpart, deliver_localpart_suffix,
636 envp[envcount++] = string_sprintf("QUALIFY_DOMAIN=%s", qualify_domain_sender);
637 envp[envcount++] = string_sprintf("SENDER=%s", sender_address);
638 envp[envcount++] = US"SHELL=/bin/sh";
641 envp[envcount++] = string_sprintf("HOST=%s", addr->host_list->name);
643 if (f.timestamps_utc)
644 envp[envcount++] = US"TZ=UTC";
645 else if (timezone_string && timezone_string[0])
646 envp[envcount++] = string_sprintf("TZ=%s", timezone_string);
648 /* Add any requested items */
651 if (!(envlist = expand_cstring(envlist)))
653 addr->transport_return = DEFER;
654 addr->message = string_sprintf("failed to expand string \"%s\" "
655 "for %s transport: %s", ob->environment, tblock->name,
656 expand_string_message);
660 while ((ss = string_nextinlist(&envlist, &envsep, NULL, 0)))
662 if (envcount > nelem(envp) - 2)
664 addr->transport_return = DEFER;
665 addr->basic_errno = E2BIG;
666 addr->message = string_sprintf("too many environment settings for "
667 "%s transport", tblock->name);
670 envp[envcount++] = string_copy(ss);
673 envp[envcount] = NULL;
675 /* If the -N option is set, can't do any more. */
680 debug_printf("*** delivery by %s transport bypassed by -N option",
686 /* Handling the output from the pipe is tricky. If a file for catching this
687 output is provided, we could in theory just hand that fd over to the process,
688 but this isn't very safe because it might loop and carry on writing for
689 ever (which is exactly what happened in early versions of Exim). Therefore we
690 use the standard child_open() function, which creates pipes. We can then read
691 our end of the output pipe and count the number of bytes that come through,
692 chopping the sub-process if it exceeds some limit.
694 However, this means we want to run a sub-process with both its input and output
695 attached to pipes. We can't handle that easily from a single parent process
696 using straightforward code such as the transport_write_message() function
697 because the subprocess might not be reading its input because it is trying to
698 write to a full output pipe. The complication of redesigning the world to
699 handle this is too great - simpler just to run another process to do the
700 reading of the output pipe. */
703 /* As this is a local transport, we are already running with the required
704 uid/gid and current directory. Request that the new process be a process group
705 leader, so we can kill it and all its children on a timeout. */
707 if ((pid = child_open(USS argv, envp, ob->umask, &fd_in, &fd_out, TRUE,
708 US"pipe-tpt-cmd")) < 0)
710 addr->transport_return = DEFER;
711 addr->message = string_sprintf(
712 "Failed to create child process for %s transport: %s", tblock->name,
718 /* Now fork a process to handle the output that comes down the pipe. */
720 if ((outpid = exim_fork(US"pipe-tpt-output")) < 0)
722 addr->basic_errno = errno;
723 addr->transport_return = DEFER;
724 addr->message = string_sprintf(
725 "Failed to create process for handling output in %s transport",
732 /* This is the code for the output-handling subprocess. Read from the pipe
733 in chunks, and write to the return file if one is provided. Keep track of
734 the number of bytes handled. If the limit is exceeded, try to kill the
735 subprocess group, and in any case close the pipe and exit, which should cause
736 the subprocess to fail. */
742 set_process_info("reading output from |%s", cmd);
743 while ((rc = read(fd_out, big_buffer, big_buffer_size)) > 0)
745 if (addr->return_file >= 0)
746 if(write(addr->return_file, big_buffer, rc) != rc)
747 DEBUG(D_transport) debug_printf("Problem writing to return_file\n");
749 if (count > ob->max_output)
751 DEBUG(D_transport) debug_printf("Too much output from pipe - killed\n");
752 if (addr->return_file >= 0)
754 uschar *message = US"\n\n*** Too much output - remainder discarded ***\n";
755 rc = Ustrlen(message);
756 if(write(addr->return_file, message, rc) != rc)
757 DEBUG(D_transport) debug_printf("Problem writing to return_file\n");
759 killpg(pid, SIGKILL);
767 (void)close(fd_out); /* Not used in this process */
770 /* Carrying on now with the main parent process. Attempt to write the message
771 to it down the pipe. It is a fallacy to think that you can detect write errors
772 when the sub-process fails to read the pipe. The parent process may complete
773 writing and close the pipe before the sub-process completes. We could sleep a
774 bit here to let the sub-process get going, but it may still not complete. So we
775 ignore all writing errors. (When in the test harness, we do do a short sleep so
776 any debugging output is likely to be in the same order.) */
778 testharness_pause_ms(500);
780 DEBUG(D_transport) debug_printf("Writing message to pipe\n");
782 /* Arrange to time out writes if there is a timeout set. */
786 sigalrm_seen = FALSE;
787 transport_write_timeout = timeout;
790 /* Reset the counter of bytes written */
794 /* First write any configured prefix information */
796 if (ob->message_prefix)
798 uschar *prefix = expand_string(ob->message_prefix);
801 addr->transport_return = f.search_find_defer? DEFER : PANIC;
802 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
803 "transport) failed: %s", ob->message_prefix, tblock->name,
804 expand_string_message);
807 if (!transport_write_block(&tctx, prefix, Ustrlen(prefix), FALSE))
811 /* If the use_bsmtp option is set, we need to write SMTP prefix information.
812 The various different values for batching are handled outside; if there is more
813 than one address available here, all must be included. Force SMTP dot-handling.
818 if (!transport_write_string(fd_in, "MAIL FROM:<%s>%s", return_path, eol))
821 for (address_item * a = addr; a; a = a->next)
822 if (!transport_write_string(fd_in,
824 transport_rcpt_address(a, tblock->rcpt_include_affixes),
828 if (!transport_write_string(fd_in, "DATA%s", eol)) goto END_WRITE;
831 /* Now the actual message */
833 if (!transport_write_message(&tctx, 0))
836 /* Now any configured suffix */
838 if (ob->message_suffix)
840 uschar *suffix = expand_string(ob->message_suffix);
843 addr->transport_return = f.search_find_defer? DEFER : PANIC;
844 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
845 "transport) failed: %s", ob->message_suffix, tblock->name,
846 expand_string_message);
849 if (!transport_write_block(&tctx, suffix, Ustrlen(suffix), FALSE))
853 /* If local_smtp, write the terminating dot. */
855 if (ob->use_bsmtp && !transport_write_string(fd_in, ".%s", eol))
858 /* Flag all writing completed successfully. */
862 /* Come here if there are errors during writing. */
866 /* OK, the writing is now all done. Close the pipe. */
870 /* Handle errors during writing. For timeouts, set the timeout for waiting for
871 the child process to 1 second. If the process at the far end of the pipe died
872 without reading all of it, we expect an EPIPE error, which should be ignored.
873 We used also to ignore WRITEINCOMPLETE but the writing function is now cleverer
874 at handling OS where the death of a pipe doesn't give EPIPE immediately. See
879 if (errno == ETIMEDOUT)
881 addr->message = string_sprintf("%stimeout while writing to pipe",
882 f.transport_filter_timed_out ? "transport filter " : "");
883 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
886 else if (errno == EPIPE)
888 debug_printf("transport error EPIPE ignored\n");
892 addr->transport_return = PANIC;
893 addr->basic_errno = errno;
894 if (errno == ERRNO_CHHEADER_FAIL)
896 string_sprintf("Failed to expand headers_add or headers_remove: %s",
897 expand_string_message);
898 else if (errno == ERRNO_FILTER_FAIL)
899 addr->message = string_sprintf("Transport filter process failed (%d)%s",
901 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
902 else if (errno == ERRNO_WRITEINCOMPLETE)
903 addr->message = US"Failed repeatedly to write data";
905 addr->message = string_sprintf("Error %d", errno);
910 /* Wait for the child process to complete and take action if the returned
911 status is nonzero. The timeout will be just 1 second if any of the writes
914 if ((rc = child_close(pid, timeout)) != 0)
916 uschar * tmsg = addr->message
917 ? string_sprintf(" (preceded by %s)", addr->message) : US"";
919 /* The process did not complete in time; kill its process group and fail
920 the delivery. It appears to be necessary to kill the output process too, as
921 otherwise it hangs on for some time if the actual pipe process is sleeping.
922 (At least, that's what I observed on Solaris 2.5.1.) Since we are failing
923 the delivery, that shouldn't cause any problem. */
927 killpg(pid, SIGKILL);
928 kill(outpid, SIGKILL);
929 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
930 addr->message = string_sprintf("pipe delivery process timed out%s", tmsg);
937 addr->transport_return = PANIC;
938 addr->message = string_sprintf("Wait() failed for child process of %s "
939 "transport: %s%s", tblock->name, strerror(errno), tmsg);
942 /* Since the transport_filter timed out we assume it has sent the child process
943 a malformed or incomplete data stream. Kill off the child process
944 and prevent checking its exit status as it will has probably exited in error.
945 This prevents the transport_filter timeout message from getting overwritten
946 by the exit error which is not the cause of the problem. */
948 else if (f.transport_filter_timed_out)
950 killpg(pid, SIGKILL);
951 kill(outpid, SIGKILL);
954 /* Either the process completed, but yielded a non-zero (necessarily
955 positive) status, or the process was terminated by a signal (rc will contain
956 the negation of the signal number). Treat killing by signal as failure unless
957 status is being ignored. By default, the message is bounced back, unless
958 freeze_signal is set, in which case it is frozen instead. */
962 if (ob->freeze_signal)
964 addr->transport_return = DEFER;
965 addr->special_action = SPECIAL_FREEZE;
966 addr->message = string_sprintf("Child process of %s transport (running "
967 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
968 -rc, os_strsignal(-rc), tmsg);
970 else if (!ob->ignore_status)
972 addr->transport_return = FAIL;
973 addr->message = string_sprintf("Child process of %s transport (running "
974 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
975 -rc, os_strsignal(-rc), tmsg);
979 /* For positive values (process terminated with non-zero status), we need a
980 status code to request deferral. A number of systems contain the following
983 #define EX_TEMPFAIL 75
987 EX_TEMPFAIL -- temporary failure, indicating something that
988 is not really an error. In sendmail, this means
989 that a mailer (e.g.) could not create a connection,
990 and the request should be reattempted later.
992 Based on this, we use exit code EX_TEMPFAIL as a default to mean "defer" when
993 not ignoring the returned status. However, there is now an option that
994 contains a list of temporary codes, with TEMPFAIL and CANTCREAT as defaults.
996 Another case that needs special treatment is if execve() failed (typically
997 the command that was given is a non-existent path). By default this is
998 treated as just another failure, but if freeze_exec_fail is set, the reaction
999 is to freeze the message rather than bounce the address. Exim used to signal
1000 this failure with EX_UNAVAILABLE, which is defined in many systems as
1002 #define EX_UNAVAILABLE 69
1004 with the description
1006 EX_UNAVAILABLE -- A service is unavailable. This can occur
1007 if a support program or file does not exist. This
1008 can also be used as a catchall message when something
1009 you wanted to do doesn't work, but you don't know why.
1011 However, this can be confused with a command that actually returns 69 because
1012 something *it* wanted is unavailable. At release 4.21, Exim was changed to
1013 use return code 127 instead, because this is what the shell returns when it
1014 is unable to exec a command. We define it as EX_EXECFAILED, and use it in
1015 child.c to signal execve() failure and other unexpected failures such as
1016 setuid() not working - though that won't be the case here because we aren't
1021 /* Always handle execve() failure specially if requested to */
1023 if (ob->freeze_exec_fail && rc == EX_EXECFAILED)
1025 addr->transport_return = DEFER;
1026 addr->special_action = SPECIAL_FREEZE;
1027 addr->message = string_sprintf("pipe process failed to exec \"%s\"%s",
1031 /* Otherwise take action only if not ignoring status */
1033 else if (!ob->ignore_status)
1038 /* If temp_errors is "*" all codes are temporary. Initialization checks
1039 that it's either "*" or a list of numbers. If not "*", scan the list of
1040 temporary failure codes; if any match, the result is DEFER. */
1042 if (ob->temp_errors[0] == '*')
1043 addr->transport_return = DEFER;
1047 const uschar *s = ob->temp_errors;
1051 addr->transport_return = FAIL;
1052 while ((p = string_nextinlist(&s,&sep,NULL,0)))
1053 if (rc == Uatoi(p)) { addr->transport_return = DEFER; break; }
1056 /* Ensure the message contains the expanded command and arguments. This
1057 doesn't have to be brilliantly efficient - it is an error situation. */
1059 addr->message = string_sprintf("Child process of %s transport returned "
1060 "%d", tblock->name, rc);
1061 g = string_cat(NULL, addr->message);
1063 /* If the return code is > 128, it often means that a shell command
1064 was terminated by a signal. */
1067 string_sprintf("(could mean shell command ended by signal %d (%s))",
1068 rc-128, os_strsignal(rc-128)) :
1073 g = string_catn(g, US" ", 1);
1074 g = string_cat (g, ss);
1077 /* Now add the command and arguments */
1079 g = string_catn(g, US" from command:", 14);
1081 for (int i = 0; i < sizeof(argv)/sizeof(int *) && argv[i] != NULL; i++)
1084 g = string_catn(g, US" ", 1);
1085 if (Ustrpbrk(argv[i], " \t") != NULL)
1088 g = string_catn(g, US"\"", 1);
1090 g = string_cat(g, argv[i]);
1092 g = string_catn(g, US"\"", 1);
1095 /* Add previous filter timeout message, if present. */
1098 g = string_cat(g, tmsg);
1100 addr->message = string_from_gstring(g);
1105 /* Ensure all subprocesses (in particular, the output handling process)
1106 are complete before we pass this point. */
1108 while (wait(&rc) >= 0);
1110 DEBUG(D_transport) debug_printf("%s transport yielded %d\n", tblock->name,
1111 addr->transport_return);
1113 /* If there has been a problem, the message in addr->message contains details
1114 of the pipe command. We don't want to expose these to the world, so we set up
1115 something bland to return to the sender. */
1117 if (addr->transport_return != OK)
1118 addr->user_message = US"local delivery failed";
1123 #endif /*!MACRO_PREDEF*/
1124 /* End of transport/pipe.c */