1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
8
9 /* Functions concerned with routing, and the list of generic router options. */
10
11
12 #include "exim.h"
13
14
15
16 /* Generic options for routers, all of which live inside router_instance
17 data blocks and which therefore have the opt_public flag set. */
18 #define LOFF(field) OPT_OFF(router_instance, field)
19
20 optionlist optionlist_routers[] = {
21 { "*expand_group", opt_stringptr | opt_hidden | opt_public,
22 LOFF(expand_gid) },
23 { "*expand_more", opt_stringptr | opt_hidden | opt_public,
24 LOFF(expand_more) },
25 { "*expand_unseen", opt_stringptr | opt_hidden | opt_public,
26 LOFF(expand_unseen) },
27 { "*expand_user", opt_stringptr | opt_hidden | opt_public,
28 LOFF(expand_uid) },
29 { "*set_group", opt_bool | opt_hidden | opt_public,
30 LOFF(gid_set) },
31 { "*set_user", opt_bool | opt_hidden | opt_public,
32 LOFF(uid_set) },
33 { "address_data", opt_stringptr|opt_public,
34 LOFF(address_data) },
35 { "address_test", opt_bool|opt_public,
36 LOFF(address_test) },
37 #ifdef EXPERIMENTAL_BRIGHTMAIL
38 { "bmi_deliver_alternate", opt_bool | opt_public,
39 LOFF(bmi_deliver_alternate) },
40 { "bmi_deliver_default", opt_bool | opt_public,
41 LOFF(bmi_deliver_default) },
42 { "bmi_dont_deliver", opt_bool | opt_public,
43 LOFF(bmi_dont_deliver) },
44 { "bmi_rule", opt_stringptr|opt_public,
45 LOFF(bmi_rule) },
46 #endif
47 { "cannot_route_message", opt_stringptr | opt_public,
48 LOFF(cannot_route_message) },
49 { "caseful_local_part", opt_bool | opt_public,
50 LOFF(caseful_local_part) },
51 { "check_local_user", opt_bool | opt_public,
52 LOFF(check_local_user) },
53 { "condition", opt_stringptr|opt_public|opt_rep_con,
54 LOFF(condition) },
55 { "debug_print", opt_stringptr | opt_public,
56 LOFF(debug_string) },
57 { "disable_logging", opt_bool | opt_public,
58 LOFF(disable_logging) },
59 { "dnssec_request_domains", opt_stringptr|opt_public,
60 LOFF(dnssec.request) },
61 { "dnssec_require_domains", opt_stringptr|opt_public,
62 LOFF(dnssec.require) },
63 { "domains", opt_stringptr|opt_public,
64 LOFF(domains) },
65 { "driver", opt_stringptr|opt_public,
66 LOFF(driver_name) },
67 { "dsn_lasthop", opt_bool|opt_public,
68 LOFF(dsn_lasthop) },
69 { "errors_to", opt_stringptr|opt_public,
70 LOFF(errors_to) },
71 { "expn", opt_bool|opt_public,
72 LOFF(expn) },
73 { "fail_verify", opt_bool_verify|opt_hidden|opt_public,
74 LOFF(fail_verify_sender) },
75 { "fail_verify_recipient", opt_bool|opt_public,
76 LOFF(fail_verify_recipient) },
77 { "fail_verify_sender", opt_bool|opt_public,
78 LOFF(fail_verify_sender) },
79 { "fallback_hosts", opt_stringptr|opt_public,
80 LOFF(fallback_hosts) },
81 { "group", opt_expand_gid | opt_public,
82 LOFF(gid) },
83 { "headers_add", opt_stringptr|opt_public|opt_rep_str,
84 LOFF(extra_headers) },
85 { "headers_remove", opt_stringptr|opt_public|opt_rep_str,
86 LOFF(remove_headers) },
87 { "ignore_target_hosts",opt_stringptr|opt_public,
88 LOFF(ignore_target_hosts) },
89 { "initgroups", opt_bool | opt_public,
90 LOFF(initgroups) },
91 { "local_part_prefix", opt_stringptr|opt_public,
92 LOFF(prefix) },
93 { "local_part_prefix_optional",opt_bool|opt_public,
94 LOFF(prefix_optional) },
95 { "local_part_suffix", opt_stringptr|opt_public,
96 LOFF(suffix) },
97 { "local_part_suffix_optional",opt_bool|opt_public,
98 LOFF(suffix_optional) },
99 { "local_parts", opt_stringptr|opt_public,
100 LOFF(local_parts) },
101 { "log_as_local", opt_bool|opt_public,
102 LOFF(log_as_local) },
103 { "more", opt_expand_bool|opt_public,
104 LOFF(more) },
105 { "pass_on_timeout", opt_bool|opt_public,
106 LOFF(pass_on_timeout) },
107 { "pass_router", opt_stringptr|opt_public,
108 LOFF(pass_router_name) },
109 { "redirect_router", opt_stringptr|opt_public,
110 LOFF(redirect_router_name) },
111 { "require_files", opt_stringptr|opt_public,
112 LOFF(require_files) },
113 { "retry_use_local_part", opt_bool|opt_public,
114 LOFF(retry_use_local_part) },
115 { "router_home_directory", opt_stringptr|opt_public,
116 LOFF(router_home_directory) },
117 { "self", opt_stringptr|opt_public,
118 LOFF(self) },
119 { "senders", opt_stringptr|opt_public,
120 LOFF(senders) },
121 { "set", opt_stringptr|opt_public|opt_rep_str,
122 LOFF(set) },
123 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
124 { "translate_ip_address", opt_stringptr|opt_public,
125 LOFF(translate_ip_address) },
126 #endif
127 { "transport", opt_stringptr|opt_public,
128 LOFF(transport_name) },
129 { "transport_current_directory", opt_stringptr|opt_public,
130 LOFF(current_directory) },
131 { "transport_home_directory", opt_stringptr|opt_public,
132 LOFF(home_directory) },
133 { "unseen", opt_expand_bool|opt_public,
134 LOFF(unseen) },
135 { "user", opt_expand_uid | opt_public,
136 LOFF(uid) },
137 { "verify", opt_bool_verify|opt_hidden|opt_public,
138 LOFF(verify_sender) },
139 { "verify_only", opt_bool|opt_public,
140 LOFF(verify_only) },
141 { "verify_recipient", opt_bool|opt_public,
142 LOFF(verify_recipient) },
143 { "verify_sender", opt_bool|opt_public,
144 LOFF(verify_sender) }
145 };
146
147 int optionlist_routers_size = nelem(optionlist_routers);
148
149
150 #ifdef MACRO_PREDEF
151
152 # include "macro_predef.h"
153
154 void
options_routers(void)155 options_routers(void)
156 {
157 uschar buf[64];
158
159 options_from_list(optionlist_routers, nelem(optionlist_routers), US"ROUTERS", NULL);
160
161 for (router_info * ri = routers_available; ri->driver_name[0]; ri++)
162 {
163 spf(buf, sizeof(buf), US"_DRIVER_ROUTER_%T", ri->driver_name);
164 builtin_macro_create(buf);
165 options_from_list(ri->options, (unsigned)*ri->options_count, US"ROUTER", ri->driver_name);
166 }
167 }
168
169 #else /*!MACRO_PREDEF*/
170
171 /*************************************************
172 * Set router pointer from name *
173 *************************************************/
174
175 /* This function is used for the redirect_router and pass_router options and
176 called from route_init() below.
177
178 Arguments:
179 r the current router
180 name new router name
181 ptr where to put the pointer
182 after TRUE if router must follow this one
183
184 Returns: nothing.
185 */
186
187 static void
set_router(router_instance * r,uschar * name,router_instance ** ptr,BOOL after)188 set_router(router_instance *r, uschar *name, router_instance **ptr, BOOL after)
189 {
190 BOOL afterthis = FALSE;
191 router_instance *rr;
192
193 for (rr = routers; rr; rr = rr->next)
194 {
195 if (Ustrcmp(name, rr->name) == 0)
196 {
197 *ptr = rr;
198 break;
199 }
200 if (rr == r) afterthis = TRUE;
201 }
202
203 if (!rr)
204 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
205 "new_router \"%s\" not found for \"%s\" router", name, r->name);
206
207 if (after && !afterthis)
208 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
209 "new_router \"%s\" does not follow \"%s\" router", name, r->name);
210 }
211
212
213
214 /*************************************************
215 * Initialize router list *
216 *************************************************/
217
218 /* Read the routers section of the configuration file, and set up a chain of
219 router instances according to its contents. Each router has generic options and
220 may also have its own private options. This function is only ever called when
221 routers == NULL. We use generic code in readconf to do the work. It will set
222 values from the configuration file, and then call the driver's initialization
223 function. */
224
225 void
route_init(void)226 route_init(void)
227 {
228 readconf_driver_init(US"router",
229 (driver_instance **)(&routers), /* chain anchor */
230 (driver_info *)routers_available, /* available drivers */
231 sizeof(router_info), /* size of info blocks */
232 &router_defaults, /* default values for generic options */
233 sizeof(router_instance), /* size of instance block */
234 optionlist_routers, /* generic options */
235 optionlist_routers_size);
236
237 for (router_instance * r = routers; r; r = r->next)
238 {
239 uschar *s = r->self;
240
241 /* If log_as_local is unset, its overall default is FALSE. (The accept
242 router defaults it to TRUE.) */
243
244 if (r->log_as_local == TRUE_UNSET) r->log_as_local = FALSE;
245
246 /* Check for transport or no transport on certain routers */
247
248 if ( (r->info->ri_flags & ri_yestransport)
249 && !r->transport_name && !r->verify_only)
250 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
251 "a transport is required for this router", r->name);
252
253 if ((r->info->ri_flags & ri_notransport) && r->transport_name)
254 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
255 "a transport must not be defined for this router", r->name);
256
257 /* The "self" option needs to be decoded into a code value and possibly a
258 new domain string and a rewrite boolean. */
259
260 if (Ustrcmp(s, "freeze") == 0) r->self_code = self_freeze;
261 else if (Ustrcmp(s, "defer") == 0) r->self_code = self_defer;
262 else if (Ustrcmp(s, "send") == 0) r->self_code = self_send;
263 else if (Ustrcmp(s, "pass") == 0) r->self_code = self_pass;
264 else if (Ustrcmp(s, "fail") == 0) r->self_code = self_fail;
265 else if (Ustrncmp(s, "reroute:", 8) == 0)
266 {
267 s += 8;
268 while (isspace(*s)) s++;
269 if (Ustrncmp(s, "rewrite:", 8) == 0)
270 {
271 r->self_rewrite = TRUE;
272 s += 8;
273 while (isspace(*s)) s++;
274 }
275 r->self = s;
276 r->self_code = self_reroute;
277 }
278
279 else log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s router:\n "
280 "%s is not valid for the self option", r->name, s);
281
282 /* If any router has check_local_user set, default retry_use_local_part
283 TRUE; otherwise its default is FALSE. */
284
285 if (r->retry_use_local_part == TRUE_UNSET)
286 r->retry_use_local_part =
287 r->check_local_user || r->local_parts || r->condition || r->prefix || r->suffix || r->senders || r->require_files;
288
289 /* Build a host list if fallback hosts is set. */
290
291 {
292 int old_pool = store_pool;
293 store_pool = POOL_PERM;
294 host_build_hostlist(&r->fallback_hostlist, r->fallback_hosts, FALSE);
295 store_pool = old_pool;
296 }
297
298 /* Check redirect_router and pass_router are valid */
299
300 if (r->redirect_router_name)
301 set_router(r, r->redirect_router_name, &(r->redirect_router), FALSE);
302
303 if (r->pass_router_name)
304 set_router(r, r->pass_router_name, &(r->pass_router), TRUE);
305
306 #ifdef notdef
307 DEBUG(D_route) debug_printf("DSN: %s %s\n", r->name,
308 r->dsn_lasthop ? "lasthop set" : "propagating DSN");
309 #endif
310 }
311 }
312
313
314
315 /*************************************************
316 * Tidy up after routing *
317 *************************************************/
318
319 /* Routers are entitled to keep hold of certain resources in their instance
320 blocks so as to save setting them up each time. An example is an open file.
321 Such routers must provide a tidyup entry point which is called when all routing
322 is finished, via this function. */
323
324 void
route_tidyup(void)325 route_tidyup(void)
326 {
327 for (router_instance * r = routers; r; r = r->next)
328 if (r->info->tidyup) (r->info->tidyup)(r);
329 }
330
331
332
333 /*************************************************
334 * Check local part for prefix *
335 *************************************************/
336
337 /* This function is handed a local part and a list of possible prefixes; if any
338 one matches, return the prefix length. A prefix beginning with '*' is a
339 wildcard.
340
341 Arguments:
342 local_part the local part to check
343 prefixes the list of prefixes
344 vp if set, pointer to place for size of wildcard portion
345
346 Returns: length of matching prefix or zero
347 */
348
349 int
route_check_prefix(const uschar * local_part,const uschar * prefixes,unsigned * vp)350 route_check_prefix(const uschar * local_part, const uschar * prefixes,
351 unsigned * vp)
352 {
353 int sep = 0;
354 uschar *prefix;
355 const uschar *listptr = prefixes;
356
357 while ((prefix = string_nextinlist(&listptr, &sep, NULL, 0)))
358 {
359 int plen = Ustrlen(prefix);
360 if (prefix[0] == '*')
361 {
362 prefix++;
363 for (const uschar * p = local_part + Ustrlen(local_part) - (--plen);
364 p >= local_part; p--)
365 if (strncmpic(prefix, p, plen) == 0)
366 {
367 unsigned vlen = p - local_part;
368 if (vp) *vp = vlen;
369 return plen + vlen;
370 }
371 }
372 else
373 if (strncmpic(prefix, local_part, plen) == 0)
374 {
375 if (vp) *vp = 0;
376 return plen;
377 }
378 }
379
380 return 0;
381 }
382
383
384
385 /*************************************************
386 * Check local part for suffix *
387 *************************************************/
388
389 /* This function is handed a local part and a list of possible suffixes;
390 if any one matches, return the suffix length. A suffix ending with '*'
391 is a wildcard.
392
393 Arguments:
394 local_part the local part to check
395 suffixes the list of suffixes
396 vp if set, pointer to place for size of wildcard portion
397
398 Returns: length of matching suffix or zero
399 */
400
401 int
route_check_suffix(const uschar * local_part,const uschar * suffixes,unsigned * vp)402 route_check_suffix(const uschar * local_part, const uschar * suffixes,
403 unsigned * vp)
404 {
405 int sep = 0;
406 int alen = Ustrlen(local_part);
407 uschar *suffix;
408 const uschar *listptr = suffixes;
409
410 while ((suffix = string_nextinlist(&listptr, &sep, NULL, 0)))
411 {
412 int slen = Ustrlen(suffix);
413 if (suffix[slen-1] == '*')
414 {
415 const uschar * pend = local_part + alen - (--slen) + 1;
416 for (const uschar * p = local_part; p < pend; p++)
417 if (strncmpic(suffix, p, slen) == 0)
418 {
419 int tlen = alen - (p - local_part);
420 if (vp) *vp = tlen - slen;
421 return tlen;
422 }
423 }
424 else
425 if (alen > slen && strncmpic(suffix, local_part + alen - slen, slen) == 0)
426 {
427 if (vp) *vp = 0;
428 return slen;
429 }
430 }
431
432 return 0;
433 }
434
435
436
437
438 /*************************************************
439 * Check local part, domain, or sender *
440 *************************************************/
441
442 /* The checks in check_router_conditions() require similar code, so we use
443 this function to save repetition.
444
445 Arguments:
446 rname router name for error messages
447 type type of check, for error message
448 list domains, local_parts, or senders list
449 anchorptr -> tree for possibly cached items (domains)
450 cache_bits cached bits pointer
451 listtype MCL_DOMAIN for domain check
452 MCL_LOCALPART for local part check
453 MCL_ADDRESS for sender check
454 domloc current domain, current local part, or NULL for sender check
455 ldata where to put lookup data
456 caseless passed on to match_isinlist()
457 perror where to put an error message
458
459 Returns: OK item is in list
460 SKIP item is not in list, router is to be skipped
461 DEFER lookup or other defer
462 */
463
464 static int
route_check_dls(uschar * rname,uschar * type,const uschar * list,tree_node ** anchorptr,unsigned int * cache_bits,int listtype,const uschar * domloc,const uschar ** ldata,BOOL caseless,uschar ** perror)465 route_check_dls(uschar *rname, uschar *type, const uschar *list,
466 tree_node **anchorptr, unsigned int *cache_bits, int listtype,
467 const uschar *domloc, const uschar **ldata, BOOL caseless, uschar **perror)
468 {
469 if (!list) return OK; /* Empty list always succeeds */
470
471 DEBUG(D_route) debug_printf("checking %s\n", type);
472
473 /* The domain and local part use the same matching function, whereas sender
474 has its own code. */
475
476 switch(domloc
477 ? match_isinlist(domloc, &list, 0, anchorptr, cache_bits, listtype,
478 caseless, ldata)
479 : match_address_list(sender_address ? sender_address : US"",
480 TRUE, TRUE, &list, cache_bits, -1, 0, CUSS &sender_data)
481 )
482 {
483 case OK:
484 return OK;
485
486 case FAIL:
487 *perror = string_sprintf("%s router skipped: %s mismatch", rname, type);
488 DEBUG(D_route) debug_printf("%s\n", *perror);
489 return SKIP;
490
491 default: /* Paranoia, and keeps compilers happy */
492 case DEFER:
493 *perror = string_sprintf("%s check lookup or other defer", type);
494 DEBUG(D_route) debug_printf("%s\n", *perror);
495 return DEFER;
496 }
497 }
498
499
500
501 /*************************************************
502 * Check access by a given uid/gid *
503 *************************************************/
504
505 /* This function checks whether a given uid/gid has access to a given file or
506 directory. It is called only from check_files() below. This is hopefully a
507 cheapish check that does the job most of the time. Exim does *not* rely on this
508 test when actually accessing any file. The test is used when routing to make it
509 possible to take actions such as "if user x can access file y then run this
510 router".
511
512 During routing, Exim is normally running as root, and so the test will work
513 except for NFS non-root mounts. When verifying during message reception, Exim
514 is running as "exim", so the test may not work. This is a limitation of the
515 Exim design.
516
517 Code in check_files() below detects the case when it cannot stat() the file (as
518 root), and in that situation it uses a setuid subprocess in which to run this
519 test.
520
521 Arguments:
522 path the path to check
523 uid the user
524 gid the group
525 bits the bits required in the final component
526
527 Returns: TRUE
528 FALSE errno=EACCES or ENOENT (or others from realpath or stat)
529 */
530
531 static BOOL
route_check_access(uschar * path,uid_t uid,gid_t gid,int bits)532 route_check_access(uschar *path, uid_t uid, gid_t gid, int bits)
533 {
534 struct stat statbuf;
535 uschar *slash;
536 uschar *rp = US realpath(CS path, CS big_buffer);
537 uschar *sp = rp + 1;
538
539 DEBUG(D_route) debug_printf("route_check_access(%s,%d,%d,%o)\n", path,
540 (int)uid, (int)gid, bits);
541
542 if (!rp) return FALSE;
543
544 while ((slash = Ustrchr(sp, '/')))
545 {
546 *slash = 0;
547 DEBUG(D_route) debug_printf("stat %s\n", rp);
548 if (Ustat(rp, &statbuf) < 0) return FALSE;
549 if ((statbuf.st_mode &
550 ((statbuf.st_uid == uid)? 0100 : (statbuf.st_gid == gid)? 0010 : 001)
551 ) == 0)
552 {
553 errno = EACCES;
554 return FALSE;
555 }
556 *slash = '/';
557 sp = slash + 1;
558 }
559
560 /* Down to the final component */
561
562 DEBUG(D_route) debug_printf("stat %s\n", rp);
563
564 if (Ustat(rp, &statbuf) < 0) return FALSE;
565
566 if (statbuf.st_uid == uid) bits = bits << 6;
567 else if (statbuf.st_gid == gid) bits = bits << 3;
568 if ((statbuf.st_mode & bits) != bits)
569 {
570 errno = EACCES;
571 return FALSE;
572 }
573
574 DEBUG(D_route) debug_printf("route_check_access() succeeded\n");
575 return TRUE;
576 }
577
578
579
580 /*************************************************
581 * Do file existence tests *
582 *************************************************/
583
584 /* This function is given a colon-separated list of file tests, each of which
585 is expanded before use. A test consists of a file name, optionally preceded by
586 ! (require non-existence) and/or + for handling permission denied (+ means
587 treat as non-existing).
588
589 An item that contains no slashes is interpreted as a username or id, with an
590 optional group id, for checking access to the file. This cannot be done
591 "perfectly", but it is good enough for a number of applications.
592
593 Arguments:
594 s a colon-separated list of file tests or NULL
595 perror a pointer to an anchor for an error text in the case of a DEFER
596
597 Returns: OK if s == NULL or all tests are as required
598 DEFER if the existence of at least one of the files is
599 unclear (an error other than non-existence occurred);
600 DEFER if an expansion failed
601 DEFER if a name is not absolute
602 DEFER if problems with user/group
603 SKIP otherwise
604 */
605
606 static int
check_files(const uschar * s,uschar ** perror)607 check_files(const uschar *s, uschar **perror)
608 {
609 int sep = 0; /* List has default separators */
610 uid_t uid = 0; /* For picky compilers */
611 gid_t gid = 0; /* For picky compilers */
612 BOOL ugid_set = FALSE;
613 const uschar *listptr;
614 uschar *check;
615
616 if (!s) return OK;
617
618 DEBUG(D_route) debug_printf("checking require_files\n");
619
620 listptr = s;
621 while ((check = string_nextinlist(&listptr, &sep, NULL, 0)))
622 {
623 int rc;
624 int eacces_code = 0;
625 BOOL invert = FALSE;
626 struct stat statbuf;
627 uschar *ss = expand_string(check);
628
629 if (!ss)
630 {
631 if (f.expand_string_forcedfail) continue;
632 *perror = string_sprintf("failed to expand \"%s\" for require_files: %s",
633 check, expand_string_message);
634 goto RETURN_DEFER;
635 }
636
637 /* Empty items are just skipped */
638
639 if (*ss == 0) continue;
640
641 /* If there are no slashes in the string, we have a user name or uid, with
642 optional group/gid. */
643
644 if (Ustrchr(ss, '/') == NULL)
645 {
646 BOOL ok;
647 struct passwd *pw;
648 uschar *comma = Ustrchr(ss, ',');
649
650 /* If there's a comma, temporarily terminate the user name/number
651 at that point. Then set the uid. */
652
653 if (comma != NULL) *comma = 0;
654 ok = route_finduser(ss, &pw, &uid);
655 if (comma != NULL) *comma = ',';
656
657 if (!ok)
658 {
659 *perror = string_sprintf("user \"%s\" for require_files not found", ss);
660 goto RETURN_DEFER;
661 }
662
663 /* If there was no comma, the gid is that associated with the user. */
664
665 if (comma == NULL)
666 {
667 if (pw != NULL) gid = pw->pw_gid; else
668 {
669 *perror = string_sprintf("group missing after numerical uid %d for "
670 "require_files", (int)uid);
671 goto RETURN_DEFER;
672 }
673 }
674 else
675 {
676 if (!route_findgroup(comma + 1, &gid))
677 {
678 *perror = string_sprintf("group \"%s\" for require_files not found\n",
679 comma + 1);
680 goto RETURN_DEFER;
681 }
682 }
683
684 /* Note that we have values set, and proceed to next item */
685
686 DEBUG(D_route)
687 debug_printf("check subsequent files for access by %s\n", ss);
688 ugid_set = TRUE;
689 continue;
690 }
691
692 /* Path, possibly preceded by + and ! */
693
694 if (*ss == '+')
695 {
696 eacces_code = 1;
697 while (isspace((*(++ss))));
698 }
699
700 if (*ss == '!')
701 {
702 invert = TRUE;
703 while (isspace((*(++ss))));
704 }
705
706 if (*ss != '/')
707 {
708 *perror = string_sprintf("require_files: \"%s\" is not absolute", ss);
709 goto RETURN_DEFER;
710 }
711
712 /* Stat the file, either as root (while routing) or as exim (while verifying
713 during message reception). */
714
715 rc = Ustat(ss, &statbuf);
716
717 DEBUG(D_route)
718 {
719 debug_printf("file check: %s\n", check);
720 if (ss != check) debug_printf("expanded file: %s\n", ss);
721 debug_printf("stat() yielded %d\n", rc);
722 }
723
724 /* If permission is denied, and we are running as root (i.e. routing for
725 delivery rather than verifying), and the requirement is to test for access by
726 a particular uid/gid, it must mean that the file is on a non-root-mounted NFS
727 system. In this case, we have to use a subprocess that runs as the relevant
728 uid in order to do the test. */
729
730 if (rc != 0 && errno == EACCES && ugid_set && getuid() == root_uid)
731 {
732 int status;
733 pid_t pid;
734 void (*oldsignal)(int);
735
736 DEBUG(D_route) debug_printf("root is denied access: forking to check "
737 "in subprocess\n");
738
739 /* Before forking, ensure that SIGCHLD is set to SIG_DFL before forking, so
740 that the child process can be waited for, just in case get here with it set
741 otherwise. Save the old state for resetting on the wait. */
742
743 oldsignal = signal(SIGCHLD, SIG_DFL);
744 pid = exim_fork(US"require-files");
745
746 /* If fork() fails, reinstate the original error and behave as if
747 this block of code were not present. This is the same behaviour as happens
748 when Exim is not running as root at this point. */
749
750 if (pid < 0)
751 {
752 DEBUG(D_route)
753 debug_printf("require_files: fork failed: %s\n", strerror(errno));
754 errno = EACCES;
755 goto HANDLE_ERROR;
756 }
757
758 /* In the child process, change uid and gid, and then do the check using
759 the route_check_access() function. This does more than just stat the file;
760 it tests permissions as well. Return 0 for OK and 1 for failure. */
761
762 if (pid == 0)
763 {
764 exim_setugid(uid, gid, TRUE,
765 string_sprintf("require_files check, file=%s", ss));
766 if (route_check_access(ss, uid, gid, 4))
767 exim_underbar_exit(EXIT_SUCCESS);
768 DEBUG(D_route) debug_printf("route_check_access() failed\n");
769 exim_underbar_exit(EXIT_FAILURE);
770 }
771
772 /* In the parent, wait for the child to finish */
773
774 while (waitpid(pid, &status, 0) < 0)
775 if (errno != EINTR) /* unexpected error, interpret as failure */
776 {
777 status = 1;
778 break;
779 }
780
781 signal(SIGCHLD, oldsignal); /* restore */
782 if ((status == 0) == invert) return SKIP;
783 continue; /* to test the next file */
784 }
785
786 /* Control reaches here if the initial stat() succeeds, or fails with an
787 error other than EACCES, or no uid/gid is set, or we are not running as root.
788 If we know the file exists and uid/gid are set, try to check read access for
789 that uid/gid as best we can. */
790
791 if (rc == 0 && ugid_set && !route_check_access(ss, uid, gid, 4))
792 {
793 DEBUG(D_route) debug_printf("route_check_access() failed\n");
794 rc = -1;
795 }
796
797 /* Handle error returns from stat() or route_check_access(). The EACCES error
798 is handled specially. At present, we can force it to be treated as
799 non-existence. Write the code so that it will be easy to add forcing for
800 existence if required later. */
801
802 HANDLE_ERROR:
803 if (rc < 0)
804 {
805 DEBUG(D_route) debug_printf("errno = %d\n", errno);
806 if (errno == EACCES)
807 {
808 if (eacces_code == 1)
809 {
810 DEBUG(D_route) debug_printf("EACCES => ENOENT\n");
811 errno = ENOENT; /* Treat as non-existent */
812 }
813 }
814 if (errno != ENOENT)
815 {
816 *perror = string_sprintf("require_files: error for %s: %s", ss,
817 strerror(errno));
818 goto RETURN_DEFER;
819 }
820 }
821
822 /* At this point, rc < 0 => non-existence; rc >= 0 => existence */
823
824 if ((rc >= 0) == invert) return SKIP;
825 }
826
827 return OK;
828
829 /* Come here on any of the errors that return DEFER. */
830
831 RETURN_DEFER:
832 DEBUG(D_route) debug_printf("%s\n", *perror);
833 return DEFER;
834 }
835
836
837
838
839
840 /*************************************************
841 * Check for router skipping *
842 *************************************************/
843
844 /* This function performs various checks to see whether a router should be
845 skipped. The order in which they are performed is important.
846
847 Arguments:
848 r pointer to router instance block
849 addr address that is being handled
850 verify the verification type
851 pw ptr to ptr to passwd structure for local user
852 perror for lookup errors
853
854 Returns: OK if all the tests succeed
855 SKIP if router is to be skipped
856 DEFER for a lookup defer
857 FAIL for address to be failed
858 */
859
860 static BOOL
check_router_conditions(router_instance * r,address_item * addr,int verify,struct passwd ** pw,uschar ** perror)861 check_router_conditions(router_instance *r, address_item *addr, int verify,
862 struct passwd **pw, uschar **perror)
863 {
864 int rc;
865 uschar *check_local_part;
866 unsigned int *localpart_cache;
867
868 /* Reset variables to hold a home directory and data from lookup of a domain or
869 local part, and ensure search_find_defer is unset, in case there aren't any
870 actual lookups. */
871
872 deliver_home = NULL;
873 deliver_domain_data = NULL;
874 deliver_localpart_data = NULL;
875 sender_data = NULL;
876 local_user_gid = (gid_t)(-1);
877 local_user_uid = (uid_t)(-1);
878 f.search_find_defer = FALSE;
879
880 /* Skip this router if not verifying and it has verify_only set */
881
882 if ((verify == v_none || verify == v_expn) && r->verify_only)
883 {
884 DEBUG(D_route) debug_printf("%s router skipped: verify_only set\n", r->name);
885 return SKIP;
886 }
887
888 /* Skip this router if testing an address (-bt) and address_test is not set */
889
890 if (f.address_test_mode && !r->address_test)
891 {
892 DEBUG(D_route) debug_printf("%s router skipped: address_test is unset\n",
893 r->name);
894 return SKIP;
895 }
896
897 /* Skip this router if verifying and it hasn't got the appropriate verify flag
898 set. */
899
900 if ((verify == v_sender && !r->verify_sender) ||
901 (verify == v_recipient && !r->verify_recipient))
902 {
903 DEBUG(D_route) debug_printf("%s router skipped: verify %d %d %d\n",
904 r->name, verify, r->verify_sender, r->verify_recipient);
905 return SKIP;
906 }
907
908 /* Skip this router if processing EXPN and it doesn't have expn set */
909
910 if (verify == v_expn && !r->expn)
911 {
912 DEBUG(D_route) debug_printf("%s router skipped: no_expn set\n", r->name);
913 return SKIP;
914 }
915
916 /* Skip this router if there's a domain mismatch. */
917
918 if ((rc = route_check_dls(r->name, US"domains", r->domains, &domainlist_anchor,
919 addr->domain_cache, TRUE, addr->domain, CUSS &deliver_domain_data,
920 MCL_DOMAIN, perror)) != OK)
921 return rc;
922
923 /* Skip this router if there's a local part mismatch. We want to pass over the
924 caseful local part, so that +caseful can restore it, even if this router is
925 handling local parts caselessly. However, we can't just pass cc_local_part,
926 because that doesn't have the prefix or suffix stripped. A bit of massaging is
927 required. Also, we only use the match cache for local parts that have not had
928 a prefix or suffix stripped. */
929
930 if (!addr->prefix && !addr->suffix)
931 {
932 localpart_cache = addr->localpart_cache;
933 check_local_part = addr->cc_local_part;
934 }
935 else
936 {
937 localpart_cache = NULL;
938 check_local_part = string_copy(addr->cc_local_part);
939 if (addr->prefix)
940 check_local_part += Ustrlen(addr->prefix);
941 if (addr->suffix)
942 check_local_part[Ustrlen(check_local_part) - Ustrlen(addr->suffix)] = 0;
943 }
944
945 if ((rc = route_check_dls(r->name, US"local_parts", r->local_parts,
946 &localpartlist_anchor, localpart_cache, MCL_LOCALPART,
947 check_local_part, CUSS &deliver_localpart_data,
948 !r->caseful_local_part, perror)) != OK)
949 return rc;
950
951 /* If the check_local_user option is set, check that the local_part is the
952 login of a local user. Note: the third argument to route_finduser() must be
953 NULL here, to prevent a numeric string being taken as a numeric uid. If the
954 user is found, set deliver_home to the home directory, and also set
955 local_user_{uid,gid} and local_part_data. */
956
957 if (r->check_local_user)
958 {
959 DEBUG(D_route) debug_printf("checking for local user\n");
960 if (!route_finduser(addr->local_part, pw, NULL))
961 {
962 DEBUG(D_route) debug_printf("%s router skipped: %s is not a local user\n",
963 r->name, addr->local_part);
964 return SKIP;
965 }
966 addr->prop.localpart_data =
967 deliver_localpart_data = string_copy(US (*pw)->pw_name);
968 deliver_home = string_copy(US (*pw)->pw_dir);
969 local_user_gid = (*pw)->pw_gid;
970 local_user_uid = (*pw)->pw_uid;
971 }
972
973 /* Set (or override in the case of check_local_user) the home directory if
974 router_home_directory is set. This is done here so that it overrides $home from
975 check_local_user before any subsequent expansions are done. Otherwise, $home
976 could mean different things for different options, which would be extremely
977 confusing. */
978
979 if (r->router_home_directory)
980 {
981 uschar * router_home = expand_string(r->router_home_directory);
982 if (router_home)
983 {
984 setflag(addr, af_home_expanded); /* Note set from router_home_directory */
985 deliver_home = router_home;
986 }
987 else if (!f.expand_string_forcedfail)
988 {
989 *perror = string_sprintf("failed to expand \"%s\" for "
990 "router_home_directory: %s", r->router_home_directory,
991 expand_string_message);
992 return DEFER;
993 }
994 }
995
996 /* Skip if the sender condition is not met. We leave this one till after the
997 local user check so that $home is set - enabling the possibility of letting
998 individual recipients specify lists of acceptable/unacceptable senders. */
999
1000 if ((rc = route_check_dls(r->name, US"senders", r->senders, NULL,
1001 sender_address_cache, MCL_ADDRESS, NULL, NULL, FALSE, perror)) != OK)
1002 return rc;
1003
1004 /* This is the point at which we print out the router's debugging string if it
1005 is set. We wait till here so as to have $home available for local users (and
1006 anyway, we don't want too much stuff for skipped routers). */
1007
1008 debug_print_string(r->debug_string);
1009
1010 /* Perform file existence tests. */
1011
1012 if ((rc = check_files(r->require_files, perror)) != OK)
1013 {
1014 DEBUG(D_route) debug_printf("%s router %s: file check\n", r->name,
1015 (rc == SKIP)? "skipped" : "deferred");
1016 return rc;
1017 }
1018
1019 /* Now the general condition test. */
1020
1021 if (r->condition)
1022 {
1023 DEBUG(D_route) debug_printf("checking \"condition\" \"%.80s\"...\n", r->condition);
1024 if (!expand_check_condition(r->condition, r->name, US"router"))
1025 {
1026 if (f.search_find_defer)
1027 {
1028 *perror = US"condition check lookup defer";
1029 DEBUG(D_route) debug_printf("%s\n", *perror);
1030 return DEFER;
1031 }
1032 DEBUG(D_route)
1033 debug_printf("%s router skipped: condition failure\n", r->name);
1034 return SKIP;
1035 }
1036 }
1037
1038 #ifdef EXPERIMENTAL_BRIGHTMAIL
1039 /* check if a specific Brightmail AntiSpam rule fired on the message */
1040 if (r->bmi_rule)
1041 {
1042 DEBUG(D_route) debug_printf("checking bmi_rule\n");
1043 if (bmi_check_rule(bmi_base64_verdict, r->bmi_rule) == 0)
1044 { /* none of the rules fired */
1045 DEBUG(D_route)
1046 debug_printf("%s router skipped: none of bmi_rule rules fired\n", r->name);
1047 return SKIP;
1048 }
1049 }
1050
1051 /* check if message should not be delivered */
1052 if (r->bmi_dont_deliver && bmi_deliver == 1)
1053 {
1054 DEBUG(D_route)
1055 debug_printf("%s router skipped: bmi_dont_deliver is FALSE\n", r->name);
1056 return SKIP;
1057 }
1058
1059 /* check if message should go to an alternate location */
1060 if ( r->bmi_deliver_alternate
1061 && (bmi_deliver == 0 || !bmi_alt_location)
1062 )
1063 {
1064 DEBUG(D_route)
1065 debug_printf("%s router skipped: bmi_deliver_alternate is FALSE\n", r->name);
1066 return SKIP;
1067 }
1068
1069 /* check if message should go to default location */
1070 if ( r->bmi_deliver_default
1071 && (bmi_deliver == 0 || bmi_alt_location)
1072 )
1073 {
1074 DEBUG(D_route)
1075 debug_printf("%s router skipped: bmi_deliver_default is FALSE\n", r->name);
1076 return SKIP;
1077 }
1078 #endif
1079
1080 /* All the checks passed. */
1081
1082 return OK;
1083 }
1084
1085
1086
1087
1088 /*************************************************
1089 * Find a local user *
1090 *************************************************/
1091
1092 /* Try several times (if configured) to find a local user, in case delays in
1093 NIS or NFS whatever cause an incorrect refusal. It's a pity that getpwnam()
1094 doesn't have some kind of indication as to why it has failed. If the string
1095 given consists entirely of digits, and the third argument is not NULL, assume
1096 the string is the numerical value of the uid. Otherwise it is looked up using
1097 getpwnam(). The uid is passed back via return_uid, if not NULL, and the
1098 pointer to a passwd structure, if found, is passed back via pw, if not NULL.
1099
1100 Because this may be called several times in succession for the same user for
1101 different routers, cache the result of the previous getpwnam call so that it
1102 can be re-used. Note that we can't just copy the structure, as the store it
1103 points to can get trashed.
1104
1105 Arguments:
1106 s the login name or textual form of the numerical uid of the user
1107 pw if not NULL, return the result of getpwnam here, or set NULL
1108 if no call to getpwnam is made (s numeric, return_uid != NULL)
1109 return_uid if not NULL, return the uid via this address
1110
1111 Returns: TRUE if s is numerical or was looked up successfully
1112
1113 */
1114
1115 static struct passwd pwcopy;
1116 static struct passwd *lastpw = NULL;
1117 static uschar lastname[48] = { 0 };
1118 static uschar lastdir[128];
1119 static uschar lastgecos[128];
1120 static uschar lastshell[128];
1121
1122 BOOL
route_finduser(const uschar * s,struct passwd ** pw,uid_t * return_uid)1123 route_finduser(const uschar *s, struct passwd **pw, uid_t *return_uid)
1124 {
1125 BOOL cache_set = (Ustrcmp(lastname, s) == 0);
1126
1127 DEBUG(D_uid) debug_printf("seeking password data for user \"%s\": %s\n", s,
1128 cache_set ? "using cached result" : "cache not available");
1129
1130 if (!cache_set)
1131 {
1132 int i = 0;
1133
1134 if (return_uid && (isdigit(*s) || *s == '-') &&
1135 s[Ustrspn(s+1, "0123456789")+1] == 0)
1136 {
1137 *return_uid = (uid_t)Uatoi(s);
1138 if (pw) *pw = NULL;
1139 return TRUE;
1140 }
1141
1142 string_format_nt(lastname, sizeof(lastname), "%s", s);
1143
1144 /* Force failure if string length is greater than given maximum */
1145
1146 if (max_username_length > 0 && Ustrlen(lastname) > max_username_length)
1147 {
1148 DEBUG(D_uid) debug_printf("forced failure of finduser(): string "
1149 "length of %s is greater than %d\n", lastname, max_username_length);
1150 lastpw = NULL;
1151 }
1152
1153 /* Try a few times if so configured; this handles delays in NIS etc. */
1154
1155 else for (;;)
1156 {
1157 errno = 0;
1158 if ((lastpw = getpwnam(CS s))) break;
1159 if (++i > finduser_retries) break;
1160 sleep(1);
1161 }
1162
1163 if (lastpw)
1164 {
1165 pwcopy.pw_uid = lastpw->pw_uid;
1166 pwcopy.pw_gid = lastpw->pw_gid;
1167 (void)string_format(lastdir, sizeof(lastdir), "%s", lastpw->pw_dir);
1168 (void)string_format(lastgecos, sizeof(lastgecos), "%s", lastpw->pw_gecos);
1169 (void)string_format(lastshell, sizeof(lastshell), "%s", lastpw->pw_shell);
1170 pwcopy.pw_name = CS lastname;
1171 pwcopy.pw_dir = CS lastdir;
1172 pwcopy.pw_gecos = CS lastgecos;
1173 pwcopy.pw_shell = CS lastshell;
1174 lastpw = &pwcopy;
1175 }
1176
1177 else DEBUG(D_uid) if (errno != 0)
1178 debug_printf("getpwnam(%s) failed: %s\n", s, strerror(errno));
1179 }
1180
1181 if (!lastpw)
1182 {
1183 DEBUG(D_uid) debug_printf("getpwnam() returned NULL (user not found)\n");
1184 return FALSE;
1185 }
1186
1187 DEBUG(D_uid) debug_printf("getpwnam() succeeded uid=%d gid=%d\n",
1188 lastpw->pw_uid, lastpw->pw_gid);
1189
1190 if (return_uid) *return_uid = lastpw->pw_uid;
1191 if (pw) *pw = lastpw;
1192
1193 return TRUE;
1194 }
1195
1196
1197
1198
1199 /*************************************************
1200 * Find a local group *
1201 *************************************************/
1202
1203 /* Try several times (if configured) to find a local group, in case delays in
1204 NIS or NFS whatever cause an incorrect refusal. It's a pity that getgrnam()
1205 doesn't have some kind of indication as to why it has failed.
1206
1207 Arguments:
1208 s the group name or textual form of the numerical gid
1209 return_gid return the gid via this address
1210
1211 Returns: TRUE if the group was found; FALSE otherwise
1212
1213 */
1214
1215 BOOL
route_findgroup(uschar * s,gid_t * return_gid)1216 route_findgroup(uschar *s, gid_t *return_gid)
1217 {
1218 int i = 0;
1219 struct group *gr;
1220
1221 if ((isdigit(*s) || *s == '-') && s[Ustrspn(s+1, "0123456789")+1] == 0)
1222 {
1223 *return_gid = (gid_t)Uatoi(s);
1224 return TRUE;
1225 }
1226
1227 for (;;)
1228 {
1229 if ((gr = getgrnam(CS s)))
1230 {
1231 *return_gid = gr->gr_gid;
1232 return TRUE;
1233 }
1234 if (++i > finduser_retries) break;
1235 sleep(1);
1236 }
1237
1238 return FALSE;
1239 }
1240
1241
1242
1243
1244 /*************************************************
1245 * Find user by expanding string *
1246 *************************************************/
1247
1248 /* Expands a string, and then looks up the result in the passwd file.
1249
1250 Arguments:
1251 string the string to be expanded, yielding a login name or a numerical
1252 uid value (to be passed to route_finduser())
1253 driver_name caller name for panic error message (only)
1254 driver_type caller type for panic error message (only)
1255 pw return passwd entry via this pointer
1256 uid return uid via this pointer
1257 errmsg where to point a message on failure
1258
1259 Returns: TRUE if user found, FALSE otherwise
1260 */
1261
1262 BOOL
route_find_expanded_user(uschar * string,uschar * driver_name,uschar * driver_type,struct passwd ** pw,uid_t * uid,uschar ** errmsg)1263 route_find_expanded_user(uschar *string, uschar *driver_name,
1264 uschar *driver_type, struct passwd **pw, uid_t *uid, uschar **errmsg)
1265 {
1266 uschar *user = expand_string(string);
1267
1268 if (!user)
1269 {
1270 *errmsg = string_sprintf("Failed to expand user string \"%s\" for the "
1271 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1272 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1273 return FALSE;
1274 }
1275
1276 if (route_finduser(user, pw, uid)) return TRUE;
1277
1278 *errmsg = string_sprintf("Failed to find user \"%s\" from expanded string "
1279 "\"%s\" for the %s %s", user, string, driver_name, driver_type);
1280 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1281 return FALSE;
1282 }
1283
1284
1285
1286 /*************************************************
1287 * Find group by expanding string *
1288 *************************************************/
1289
1290 /* Expands a string and then looks up the result in the group file.
1291
1292 Arguments:
1293 string the string to be expanded, yielding a group name or a numerical
1294 gid value (to be passed to route_findgroup())
1295 driver_name caller name for panic error message (only)
1296 driver_type caller type for panic error message (only)
1297 gid return gid via this pointer
1298 errmsg return error message via this pointer
1299
1300 Returns: TRUE if found group, FALSE otherwise
1301 */
1302
1303 BOOL
route_find_expanded_group(uschar * string,uschar * driver_name,uschar * driver_type,gid_t * gid,uschar ** errmsg)1304 route_find_expanded_group(uschar *string, uschar *driver_name, uschar *driver_type,
1305 gid_t *gid, uschar **errmsg)
1306 {
1307 BOOL yield = TRUE;
1308 uschar *group = expand_string(string);
1309
1310 if (!group)
1311 {
1312 *errmsg = string_sprintf("Failed to expand group string \"%s\" for the "
1313 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1314 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1315 return FALSE;
1316 }
1317
1318 if (!route_findgroup(group, gid))
1319 {
1320 *errmsg = string_sprintf("Failed to find group \"%s\" from expanded string "
1321 "\"%s\" for the %s %s", group, string, driver_name, driver_type);
1322 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1323 yield = FALSE;
1324 }
1325
1326 return yield;
1327 }
1328
1329
1330
1331 /*************************************************
1332 * Handle an unseen routing *
1333 *************************************************/
1334
1335 /* This function is called when an address is routed by a router with "unseen"
1336 set. It must make a clone of the address, for handling by subsequent drivers.
1337 The clone is set to start routing at the next router.
1338
1339 The original address must be replaced by an invented "parent" which has the
1340 routed address plus the clone as its children. This is necessary in case the
1341 address is at the top level - we don't want to mark it complete until both
1342 deliveries have been done.
1343
1344 A new unique field must be made, so that the record of the delivery isn't a
1345 record of the original address, and checking for already delivered has
1346 therefore to be done here. If the delivery has happened, then take the base
1347 address off whichever delivery queue it is on - it will always be the top item.
1348
1349 Arguments:
1350 name router name
1351 addr address that was routed
1352 paddr_local chain of local-delivery addresses
1353 paddr_remote chain of remote-delivery addresses
1354 addr_new chain for newly created addresses
1355
1356 Returns: nothing
1357 */
1358
1359 static void
route_unseen(uschar * name,address_item * addr,address_item ** paddr_local,address_item ** paddr_remote,address_item ** addr_new)1360 route_unseen(uschar *name, address_item *addr, address_item **paddr_local,
1361 address_item **paddr_remote, address_item **addr_new)
1362 {
1363 address_item *parent = deliver_make_addr(addr->address, TRUE);
1364 address_item *new = deliver_make_addr(addr->address, TRUE);
1365
1366 /* The invented parent is a copy that replaces the original; note that
1367 this copies its parent pointer. It has two children, and its errors_address is
1368 from the original address' parent, if present, otherwise unset. */
1369
1370 *parent = *addr;
1371 parent->child_count = 2;
1372 parent->prop.errors_address =
1373 addr->parent ? addr->parent->prop.errors_address : NULL;
1374
1375 /* The routed address gets a new parent. */
1376
1377 addr->parent = parent;
1378
1379 /* The clone has this parent too. Set its errors address from the parent. This
1380 was set from the original parent (or to NULL) - see above. We do NOT want to
1381 take the errors address from the unseen router. */
1382
1383 new->parent = parent;
1384 new->prop.errors_address = parent->prop.errors_address;
1385
1386 /* Copy the propagated flags and address_data from the original. */
1387
1388 new->prop.ignore_error = addr->prop.ignore_error;
1389 new->prop.address_data = addr->prop.address_data;
1390 new->prop.variables = NULL;
1391 tree_dup((tree_node **)&new->prop.variables, addr->prop.variables);
1392 new->dsn_flags = addr->dsn_flags;
1393 new->dsn_orcpt = addr->dsn_orcpt;
1394
1395
1396 /* As it has turned out, we haven't set headers_add or headers_remove for the
1397 * clone. Thinking about it, it isn't entirely clear whether they should be
1398 * copied from the original parent, like errors_address, or taken from the
1399 * unseen router, like address_data and the flags. Until somebody brings this
1400 * up, I propose to leave the code as it is.
1401 */
1402
1403
1404 /* Set the cloned address to start at the next router, and put it onto the
1405 chain of new addresses. */
1406
1407 new->start_router = addr->router->next;
1408 new->next = *addr_new;
1409 *addr_new = new;
1410
1411 DEBUG(D_route) debug_printf("\"unseen\" set: replicated %s\n", addr->address);
1412
1413 /* Make a new unique field, to distinguish from the normal one. */
1414
1415 addr->unique = string_sprintf("%s/%s", addr->unique, name);
1416
1417 /* If the address has been routed to a transport, see if it was previously
1418 delivered. If so, we take it off the relevant queue so that it isn't delivered
1419 again. Otherwise, it was an alias or something, and the addresses it generated
1420 are handled in the normal way. */
1421
1422 if (addr->transport && tree_search(tree_nonrecipients, addr->unique))
1423 {
1424 DEBUG(D_route)
1425 debug_printf("\"unseen\" delivery previously done - discarded\n");
1426 parent->child_count--;
1427 if (*paddr_remote == addr) *paddr_remote = addr->next;
1428 if (*paddr_local == addr) *paddr_local = addr->next;
1429 }
1430 }
1431
1432
1433
1434 /************************************************/
1435 /* Add router-assigned variables
1436 Return OK/DEFER/FAIL/PASS */
1437
1438 static int
set_router_vars(address_item * addr,const router_instance * r)1439 set_router_vars(address_item * addr, const router_instance * r)
1440 {
1441 const uschar * varlist = r->set;
1442 tree_node ** root = (tree_node **) &addr->prop.variables;
1443 int sep = ';';
1444
1445 if (!varlist) return OK;
1446
1447 /* Walk the varlist, creating variables */
1448
1449 for (uschar * ele; (ele = string_nextinlist(&varlist, &sep, NULL, 0)); )
1450 {
1451 const uschar * assignment = ele;
1452 int esep = '=';
1453 uschar * name = string_nextinlist(&assignment, &esep, NULL, 0);
1454 uschar * val;
1455 tree_node * node;
1456
1457 /* Variable name must exist and start "r_". */
1458
1459 if (!name || name[0] != 'r' || name[1] != '_' || !name[2])
1460 {
1461 log_write(0, LOG_MAIN|LOG_PANIC,
1462 "bad router variable name '%s' in router '%s'\n", name, r->name);
1463 return FAIL;
1464 }
1465 name += 2;
1466
1467 while (isspace(*assignment)) assignment++;
1468
1469 if (!(val = expand_string(US assignment)))
1470 if (f.expand_string_forcedfail)
1471 {
1472 int yield;
1473 BOOL more;
1474 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1475 "(router variable): decline action taken\n", ele);
1476
1477 /* Expand "more" if necessary; DEFER => an expansion failed */
1478
1479 yield = exp_bool(addr, US"router", r->name, D_route,
1480 US"more", r->more, r->expand_more, &more);
1481 if (yield != OK) return yield;
1482
1483 if (!more)
1484 {
1485 DEBUG(D_route)
1486 debug_printf("\"more\"=false: skipping remaining routers\n");
1487 router_name = NULL;
1488 r = NULL;
1489 return FAIL;
1490 }
1491 return PASS;
1492 }
1493 else
1494 {
1495 addr->message = string_sprintf("expansion of \"%s\" failed "
1496 "in %s router: %s", ele, r->name, expand_string_message);
1497 return DEFER;
1498 }
1499
1500 if (!(node = tree_search(*root, name)))
1501 { /* name should never be tainted */
1502 node = store_get(sizeof(tree_node) + Ustrlen(name), FALSE);
1503 Ustrcpy(node->name, name);
1504 (void)tree_insertnode(root, node);
1505 }
1506 node->data.ptr = US val;
1507 DEBUG(D_route) debug_printf("set r_%s%s = '%s'%s\n",
1508 name, is_tainted(name)?" (tainted)":"",
1509 val, is_tainted(val)?" (tainted)":"");
1510
1511 /* All expansions after this point need visibility of that variable */
1512 router_var = *root;
1513 }
1514 return OK;
1515 }
1516
1517
1518 /*************************************************
1519 * Route one address *
1520 *************************************************/
1521
1522 /* This function is passed in one address item, for processing by the routers.
1523 The verify flag is set if this is being called for verification rather than
1524 delivery. If the router doesn't have its "verify" flag set, it is skipped.
1525
1526 Arguments:
1527 addr address to route
1528 paddr_local chain of local-delivery addresses
1529 paddr_remote chain of remote-delivery addresses
1530 addr_new chain for newly created addresses
1531 addr_succeed chain for completed addresses
1532 verify v_none if not verifying
1533 v_sender if verifying a sender address
1534 v_recipient if verifying a recipient address
1535 v_expn if processing an EXPN address
1536
1537 Returns: OK => address successfully routed
1538 DISCARD => address was discarded
1539 FAIL => address could not be routed
1540 DEFER => some temporary problem
1541 ERROR => some major internal or configuration failure
1542 */
1543
1544 int
route_address(address_item * addr,address_item ** paddr_local,address_item ** paddr_remote,address_item ** addr_new,address_item ** addr_succeed,int verify)1545 route_address(address_item *addr, address_item **paddr_local,
1546 address_item **paddr_remote, address_item **addr_new,
1547 address_item **addr_succeed, int verify)
1548 {
1549 int yield = OK;
1550 BOOL unseen;
1551 router_instance *r, *nextr;
1552 const uschar *old_domain = addr->domain;
1553
1554 HDEBUG(D_route)
1555 {
1556 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1557 debug_printf("routing %s\n", addr->address);
1558 }
1559
1560 /* Loop through all router instances until a router succeeds, fails, defers, or
1561 encounters an error. If the address has start_router set, we begin from there
1562 instead of at the first router. */
1563
1564 for (r = addr->start_router ? addr->start_router : routers; r; r = nextr)
1565 {
1566 uschar *error;
1567 struct passwd *pw = NULL;
1568 struct passwd pwcopy;
1569 BOOL loop_detected = FALSE;
1570 BOOL more;
1571 int loopcount = 0;
1572 int rc;
1573
1574 DEBUG(D_route) debug_printf("--------> %s router <--------\n", r->name);
1575
1576 /* Reset any search error message from the previous router. */
1577
1578 search_error_message = NULL;
1579
1580 /* There are some weird cases where logging is disabled */
1581
1582 f.disable_logging = r->disable_logging;
1583
1584 /* Record the last router to handle the address, and set the default
1585 next router. */
1586
1587 addr->router = r;
1588 nextr = r->next;
1589
1590 /* Loop protection: If this address has an ancestor with the same address,
1591 and that ancestor was routed by this router, we skip this router. This
1592 prevents a variety of looping states when a new address is created by
1593 redirection or by the use of "unseen" on a router.
1594
1595 If no_repeat_use is set on the router, we skip if _any_ ancestor was routed
1596 by this router, even if it was different to the current address.
1597
1598 Just in case someone does put it into a loop (possible with redirection
1599 continually adding to an address, for example), put a long stop counter on
1600 the number of parents. */
1601
1602 for (address_item * parent = addr->parent; parent; parent = parent->parent)
1603 {
1604 if (parent->router == r)
1605 {
1606 BOOL break_loop = !r->repeat_use;
1607
1608 /* When repeat_use is set, first check the active addresses caselessly.
1609 If they match, we have to do a further caseful check of the local parts
1610 when caseful_local_part is set. This is assumed to be rare, which is why
1611 the code is written this way. */
1612
1613 if (!break_loop)
1614 {
1615 break_loop = strcmpic(parent->address, addr->address) == 0;
1616 if (break_loop && r->caseful_local_part)
1617 break_loop = Ustrncmp(parent->address, addr->address,
1618 Ustrrchr(addr->address, '@') - addr->address) == 0;
1619 }
1620
1621 if (break_loop)
1622 {
1623 DEBUG(D_route) debug_printf("%s router skipped: previously routed %s\n",
1624 r->name, parent->address);
1625 loop_detected = TRUE;
1626 break;
1627 }
1628 }
1629
1630 /* Continue with parents, limiting the size of the dynasty. */
1631
1632 if (loopcount++ > 100)
1633 {
1634 log_write(0, LOG_MAIN|LOG_PANIC, "routing loop for %s", addr->address);
1635 yield = DEFER;
1636 goto ROUTE_EXIT;
1637 }
1638 }
1639
1640 if (loop_detected) continue;
1641
1642 /* Default no affixes and select whether to use a caseful or caseless local
1643 part in this router. */
1644
1645 addr->prefix = addr->prefix_v = addr->suffix = addr->suffix_v = NULL;
1646 addr->local_part = r->caseful_local_part
1647 ? addr->cc_local_part : addr->lc_local_part;
1648
1649 DEBUG(D_route) debug_printf("local_part=%s domain=%s\n", addr->local_part,
1650 addr->domain);
1651
1652 /* Handle any configured prefix by replacing the local_part address,
1653 and setting the prefix. Skip the router if the prefix doesn't match,
1654 unless the prefix is optional. */
1655
1656 if (r->prefix)
1657 {
1658 unsigned vlen;
1659 int plen = route_check_prefix(addr->local_part, r->prefix, &vlen);
1660 if (plen > 0)
1661 {
1662 /* If the variable-part is zero-length then the prefix was not
1663 wildcarded and we can detaint-copy it since it matches the
1664 (non-expandable) router option. Otherwise copy the (likely) tainted match
1665 and the variable-part of the match from the local_part. */
1666
1667 if (vlen)
1668 {
1669 addr->prefix = string_copyn(addr->local_part, plen);
1670 addr->prefix_v = string_copyn(addr->local_part, vlen);
1671 }
1672 else
1673 addr->prefix = string_copyn_taint(addr->local_part, plen, FALSE);
1674 addr->local_part += plen;
1675 DEBUG(D_route) debug_printf("stripped prefix %s\n", addr->prefix);
1676 }
1677 else if (!r->prefix_optional)
1678 {
1679 DEBUG(D_route) debug_printf("%s router skipped: prefix mismatch\n",
1680 r->name);
1681 continue;
1682 }
1683 }
1684
1685 /* Handle any configured suffix likewise. */
1686
1687 if (r->suffix)
1688 {
1689 unsigned vlen;
1690 int slen = route_check_suffix(addr->local_part, r->suffix, &vlen);
1691 if (slen > 0)
1692 {
1693 int lplen = Ustrlen(addr->local_part) - slen;
1694 addr->suffix = vlen
1695 ? addr->local_part + lplen
1696 : string_copy_taint(addr->local_part + lplen, slen);
1697 addr->suffix_v = addr->suffix + Ustrlen(addr->suffix) - vlen;
1698 addr->local_part = string_copyn(addr->local_part, lplen);
1699 DEBUG(D_route) debug_printf("stripped suffix %s\n", addr->suffix);
1700 }
1701 else if (!r->suffix_optional)
1702 {
1703 DEBUG(D_route) debug_printf("%s router skipped: suffix mismatch\n",
1704 r->name);
1705 continue;
1706 }
1707 }
1708
1709 /* Set the expansion variables now that we have the affixes and the case of
1710 the local part sorted. */
1711
1712 router_name = r->name;
1713 deliver_set_expansions(addr);
1714
1715 /* For convenience, the pre-router checks are in a separate function, which
1716 returns OK, SKIP, FAIL, or DEFER. */
1717
1718 if ((rc = check_router_conditions(r, addr, verify, &pw, &error)) != OK)
1719 {
1720 router_name = NULL;
1721 if (rc == SKIP) continue;
1722 addr->message = error;
1723 yield = rc;
1724 goto ROUTE_EXIT;
1725 }
1726
1727 /* All pre-conditions have been met. Reset any search error message from
1728 pre-condition tests. These can arise in negated tests where the failure of
1729 the lookup leads to a TRUE pre-condition. */
1730
1731 search_error_message = NULL;
1732
1733 /* Add any variable-settings that are on the router, to the set on the
1734 addr. Expansion is done here and not later when the addr is used. There may
1735 be multiple settings, gathered during readconf; this code gathers them during
1736 router traversal. On the addr string they are held as a variable tree, so
1737 as to maintain the post-expansion taints separate. */
1738
1739 switch (set_router_vars(addr, r))
1740 {
1741 case OK: break;
1742 case PASS: continue; /* with next router */
1743 default: goto ROUTE_EXIT;
1744 }
1745
1746 /* Finally, expand the address_data field in the router. Forced failure
1747 behaves as if the router declined. Any other failure is more serious. On
1748 success, the string is attached to the address for all subsequent processing.
1749 */
1750
1751 if (r->address_data)
1752 {
1753 DEBUG(D_route) debug_printf("processing address_data\n");
1754 if (!(deliver_address_data = expand_string(r->address_data)))
1755 {
1756 if (f.expand_string_forcedfail)
1757 {
1758 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1759 "(address_data): decline action taken\n", r->address_data);
1760
1761 /* Expand "more" if necessary; DEFER => an expansion failed */
1762
1763 yield = exp_bool(addr, US"router", r->name, D_route,
1764 US"more", r->more, r->expand_more, &more);
1765 if (yield != OK) goto ROUTE_EXIT;
1766
1767 if (!more)
1768 {
1769 DEBUG(D_route)
1770 debug_printf("\"more\"=false: skipping remaining routers\n");
1771 router_name = NULL;
1772 r = NULL;
1773 break;
1774 }
1775 else continue; /* With next router */
1776 }
1777
1778 else
1779 {
1780 addr->message = string_sprintf("expansion of \"%s\" failed "
1781 "in %s router: %s", r->address_data, r->name, expand_string_message);
1782 yield = DEFER;
1783 goto ROUTE_EXIT;
1784 }
1785 }
1786 addr->prop.address_data = deliver_address_data;
1787 }
1788
1789 /* We are finally cleared for take-off with this router. Clear the the flag
1790 that records that a local host was removed from a routed host list. Make a
1791 copy of relevant fields in the password information from check_local_user,
1792 because it will be overwritten if check_local_user is invoked again while
1793 verifying an errors_address setting. */
1794
1795 clearflag(addr, af_local_host_removed);
1796
1797 if (pw)
1798 {
1799 pwcopy.pw_name = CS string_copy(US pw->pw_name);
1800 pwcopy.pw_uid = pw->pw_uid;
1801 pwcopy.pw_gid = pw->pw_gid;
1802 pwcopy.pw_gecos = CS string_copy(US pw->pw_gecos);
1803 pwcopy.pw_dir = CS string_copy(US pw->pw_dir);
1804 pwcopy.pw_shell = CS string_copy(US pw->pw_shell);
1805 pw = &pwcopy;
1806 }
1807
1808 /* If this should be the last hop for DSN flag the addr. */
1809
1810 if (r->dsn_lasthop && !(addr->dsn_flags & rf_dsnlasthop))
1811 {
1812 addr->dsn_flags |= rf_dsnlasthop;
1813 HDEBUG(D_route) debug_printf("DSN: last hop for %s\n", addr->address);
1814 }
1815
1816 /* Run the router, and handle the consequences. */
1817
1818 HDEBUG(D_route) debug_printf("calling %s router\n", r->name);
1819
1820 yield = (r->info->code)(r, addr, pw, verify, paddr_local, paddr_remote,
1821 addr_new, addr_succeed);
1822
1823 router_name = NULL;
1824
1825 if (yield == FAIL)
1826 {
1827 HDEBUG(D_route) debug_printf("%s router forced address failure\n", r->name);
1828 goto ROUTE_EXIT;
1829 }
1830
1831 /* If succeeded while verifying but fail_verify is set, convert into
1832 a failure, and take it off the local or remote delivery list. */
1833
1834 if ( ( verify == v_sender && r->fail_verify_sender
1835 || verify == v_recipient && r->fail_verify_recipient
1836 )
1837 && (yield == OK || yield == PASS))
1838 {
1839 addr->message = string_sprintf("%s router forced verify failure", r->name);
1840 if (*paddr_remote == addr) *paddr_remote = addr->next;
1841 if (*paddr_local == addr) *paddr_local = addr->next;
1842 yield = FAIL;
1843 goto ROUTE_EXIT;
1844 }
1845
1846 /* PASS and DECLINE are the only two cases where the loop continues. For all
1847 other returns, we break the loop and handle the result below. */
1848
1849 if (yield != PASS && yield != DECLINE) break;
1850
1851 HDEBUG(D_route)
1852 {
1853 debug_printf("%s router %s for %s\n", r->name,
1854 yield == PASS ? "passed" : "declined", addr->address);
1855 if (Ustrcmp(old_domain, addr->domain) != 0)
1856 debug_printf("domain %s rewritten\n", old_domain);
1857 }
1858
1859 /* PASS always continues to another router; DECLINE does so if "more"
1860 is true. Initialization insists that pass_router is always a following
1861 router. Otherwise, break the loop as if at the end of the routers. */
1862
1863 if (yield == PASS)
1864 {
1865 if (r->pass_router != NULL) nextr = r->pass_router;
1866 }
1867 else
1868 {
1869 /* Expand "more" if necessary */
1870
1871 yield = exp_bool(addr, US"router", r->name, D_route,
1872 US"more", r->more, r->expand_more, &more);
1873 if (yield != OK) goto ROUTE_EXIT;
1874
1875 if (!more)
1876 {
1877 HDEBUG(D_route)
1878 debug_printf("\"more\" is false: skipping remaining routers\n");
1879 r = NULL;
1880 break;
1881 }
1882 }
1883 } /* Loop for all routers */
1884
1885 /* On exit from the routers loop, if r == NULL we have run out of routers,
1886 either genuinely, or as a result of no_more. Otherwise, the loop ended
1887 prematurely, either because a router succeeded, or because of some special
1888 router response. Note that FAIL errors and errors detected before actually
1889 running a router go direct to ROUTE_EXIT from code above. */
1890
1891 if (!r)
1892 {
1893 HDEBUG(D_route) debug_printf("no more routers\n");
1894 if (!addr->message)
1895 {
1896 uschar *message = US"Unrouteable address";
1897 if (addr->router && addr->router->cannot_route_message)
1898 {
1899 uschar *expmessage = expand_string(addr->router->cannot_route_message);
1900 if (!expmessage)
1901 {
1902 if (!f.expand_string_forcedfail)
1903 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
1904 "cannot_route_message in %s router: %s", addr->router->name,
1905 expand_string_message);
1906 }
1907 else message = expmessage;
1908 }
1909 addr->user_message = addr->message = message;
1910 }
1911 addr->router = NULL; /* For logging */
1912 yield = FAIL;
1913 goto ROUTE_EXIT;
1914 }
1915
1916 if (yield == DEFER)
1917 {
1918 HDEBUG(D_route) debug_printf("%s router: defer for %s\n message: %s\n",
1919 r->name, addr->address, addr->message ? addr->message : US"<none>");
1920 goto ROUTE_EXIT;
1921 }
1922
1923 if (yield == DISCARD) goto ROUTE_EXIT;
1924
1925 /* The yield must be either OK or REROUTED. */
1926
1927 if (yield != OK && yield != REROUTED)
1928 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router returned unknown value %d",
1929 r->name, yield);
1930
1931 /* If the yield was REROUTED, the router put a child address on the new chain
1932 as a result of a domain change of some sort (widening, typically). */
1933
1934 if (yield == REROUTED)
1935 {
1936 HDEBUG(D_route) debug_printf("re-routed to %s\n", addr->address);
1937 yield = OK;
1938 goto ROUTE_EXIT;
1939 }
1940
1941 /* The only remaining possibility is that the router succeeded. If the
1942 translate_ip_address options is set and host addresses were associated with the
1943 address, run them through the translation. This feature is for weird and
1944 wonderful situations (the amateur packet radio people need it) or very broken
1945 networking, so it is included in the binary only if requested. */
1946
1947 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
1948
1949 if (r->translate_ip_address)
1950 {
1951 int rc;
1952 int old_pool = store_pool;
1953 for (host_item * h = addr->host_list; h; h = h->next)
1954 {
1955 uschar *newaddress;
1956 uschar *oldaddress, *oldname;
1957
1958 if (!h->address) continue;
1959
1960 deliver_host_address = h->address;
1961 newaddress = expand_string(r->translate_ip_address);
1962 deliver_host_address = NULL;
1963
1964 if (!newaddress)
1965 {
1966 if (f.expand_string_forcedfail) continue;
1967 addr->basic_errno = ERRNO_EXPANDFAIL;
1968 addr->message = string_sprintf("translate_ip_address expansion "
1969 "failed: %s", expand_string_message);
1970 yield = DEFER;
1971 goto ROUTE_EXIT;
1972 }
1973
1974 DEBUG(D_route) debug_printf("%s [%s] translated to %s\n",
1975 h->name, h->address, newaddress);
1976 if (string_is_ip_address(newaddress, NULL) != 0)
1977 {
1978 h->address = newaddress;
1979 continue;
1980 }
1981
1982 oldname = h->name;
1983 oldaddress = h->address;
1984 h->name = newaddress;
1985 h->address = NULL;
1986 h->mx = MX_NONE;
1987
1988 store_pool = POOL_PERM;
1989 rc = host_find_byname(h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, TRUE);
1990 store_pool = old_pool;
1991
1992 if (rc == HOST_FIND_FAILED || rc == HOST_FIND_AGAIN)
1993 {
1994 addr->basic_errno = ERRNO_UNKNOWNHOST;
1995 addr->message = string_sprintf("host %s not found when "
1996 "translating %s [%s]", h->name, oldname, oldaddress);
1997 yield = DEFER;
1998 goto ROUTE_EXIT;
1999 }
2000 }
2001 }
2002 #endif /* SUPPORT_TRANSLATE_IP_ADDRESS */
2003
2004 /* See if this is an unseen routing; first expand the option if necessary.
2005 DEFER can be given if the expansion fails */
2006
2007 yield = exp_bool(addr, US"router", r->name, D_route,
2008 US"unseen", r->unseen, r->expand_unseen, &unseen);
2009 if (yield != OK) goto ROUTE_EXIT;
2010
2011 /* Debugging output recording a successful routing */
2012
2013 HDEBUG(D_route) debug_printf("routed by %s router%s\n", r->name,
2014 unseen? " (unseen)" : "");
2015
2016 DEBUG(D_route)
2017 {
2018 debug_printf(" envelope to: %s\n", addr->address);
2019 debug_printf(" transport: %s\n", addr->transport
2020 ? addr->transport->name : US"<none>");
2021
2022 if (addr->prop.errors_address)
2023 debug_printf(" errors to %s\n", addr->prop.errors_address);
2024
2025 for (host_item * h = addr->host_list; h; h = h->next)
2026 {
2027 debug_printf(" host %s", h->name);
2028 if (h->address) debug_printf(" [%s]", h->address);
2029 if (h->mx >= 0) debug_printf(" MX=%d", h->mx);
2030 else if (h->mx != MX_NONE) debug_printf(" rgroup=%d", h->mx);
2031 if (h->port != PORT_NONE) debug_printf(" port=%d", h->port);
2032 if (h->dnssec != DS_UNK) debug_printf(" dnssec=%s", h->dnssec==DS_YES ? "yes" : "no");
2033 debug_printf("\n");
2034 }
2035 }
2036
2037 /* Clear any temporary error message set by a router that declined, and handle
2038 the "unseen" option (ignore if there are no further routers). */
2039
2040 addr->message = NULL;
2041 if (unseen && r->next)
2042 route_unseen(r->name, addr, paddr_local, paddr_remote, addr_new);
2043
2044 /* Unset the address expansions, and return the final result. */
2045
2046 ROUTE_EXIT:
2047 if (yield == DEFER && addr->message)
2048 addr->message = expand_hide_passwords(addr->message);
2049
2050 deliver_set_expansions(NULL);
2051 router_name = NULL;
2052 f.disable_logging = FALSE;
2053 return yield;
2054 }
2055
2056 #endif /*!MACRO_PREDEF*/
2057 /* End of route.c */
2058