1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2024 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
10 /* Functions concerned with routing, and the list of generic router options. */
17 /* Generic options for routers, all of which live inside router_instance
18 data blocks and which therefore have the opt_public flag set. */
19 #define LOFF(field) OPT_OFF(router_instance, field)
21 optionlist optionlist_routers[] = {
22 { "*expand_group", opt_stringptr | opt_hidden | opt_public,
24 { "*expand_more", opt_stringptr | opt_hidden | opt_public,
26 { "*expand_unseen", opt_stringptr | opt_hidden | opt_public,
27 LOFF(expand_unseen) },
28 { "*expand_user", opt_stringptr | opt_hidden | opt_public,
30 { "*set_group", opt_bool | opt_hidden | opt_public,
32 { "*set_user", opt_bool | opt_hidden | opt_public,
34 { "address_data", opt_stringptr|opt_public,
36 { "address_test", opt_bool|opt_public,
38 #ifdef EXPERIMENTAL_BRIGHTMAIL
39 { "bmi_deliver_alternate", opt_bool | opt_public,
40 LOFF(bmi_deliver_alternate) },
41 { "bmi_deliver_default", opt_bool | opt_public,
42 LOFF(bmi_deliver_default) },
43 { "bmi_dont_deliver", opt_bool | opt_public,
44 LOFF(bmi_dont_deliver) },
45 { "bmi_rule", opt_stringptr|opt_public,
48 { "cannot_route_message", opt_stringptr | opt_public,
49 LOFF(cannot_route_message) },
50 { "caseful_local_part", opt_bool | opt_public,
51 LOFF(caseful_local_part) },
52 { "check_local_user", opt_bool | opt_public,
53 LOFF(check_local_user) },
54 { "condition", opt_stringptr|opt_public|opt_rep_con,
56 { "debug_print", opt_stringptr | opt_public,
58 { "disable_logging", opt_bool | opt_public,
59 LOFF(disable_logging) },
60 { "dnssec_request_domains", opt_stringptr|opt_public,
61 LOFF(dnssec.request) },
62 { "dnssec_require_domains", opt_stringptr|opt_public,
63 LOFF(dnssec.require) },
64 { "domains", opt_stringptr|opt_public,
66 { "driver", opt_stringptr|opt_public,
67 LOFF(drinst.driver_name) },
68 { "dsn_lasthop", opt_bool|opt_public,
70 { "errors_to", opt_stringptr|opt_public,
72 { "expn", opt_bool|opt_public,
74 { "fail_verify", opt_bool_verify|opt_hidden|opt_public,
75 LOFF(fail_verify_sender) },
76 { "fail_verify_recipient", opt_bool|opt_public,
77 LOFF(fail_verify_recipient) },
78 { "fail_verify_sender", opt_bool|opt_public,
79 LOFF(fail_verify_sender) },
80 { "fallback_hosts", opt_stringptr|opt_public,
81 LOFF(fallback_hosts) },
82 { "group", opt_expand_gid | opt_public,
84 { "headers_add", opt_stringptr|opt_public|opt_rep_str,
85 LOFF(extra_headers) },
86 { "headers_remove", opt_stringptr|opt_public|opt_rep_str,
87 LOFF(remove_headers) },
88 { "ignore_target_hosts",opt_stringptr|opt_public,
89 LOFF(ignore_target_hosts) },
90 { "initgroups", opt_bool | opt_public,
92 { "local_part_prefix", opt_stringptr|opt_public,
94 { "local_part_prefix_optional",opt_bool|opt_public,
95 LOFF(prefix_optional) },
96 { "local_part_suffix", opt_stringptr|opt_public,
98 { "local_part_suffix_optional",opt_bool|opt_public,
99 LOFF(suffix_optional) },
100 { "local_parts", opt_stringptr|opt_public,
102 { "log_as_local", opt_bool|opt_public,
103 LOFF(log_as_local) },
104 { "more", opt_expand_bool|opt_public,
106 { "pass_on_timeout", opt_bool|opt_public,
107 LOFF(pass_on_timeout) },
108 { "pass_router", opt_stringptr|opt_public,
109 LOFF(pass_router_name) },
110 { "redirect_router", opt_stringptr|opt_public,
111 LOFF(redirect_router_name) },
112 { "require_files", opt_stringptr|opt_public,
113 LOFF(require_files) },
114 { "retry_use_local_part", opt_bool|opt_public,
115 LOFF(retry_use_local_part) },
116 { "router_home_directory", opt_stringptr|opt_public,
117 LOFF(router_home_directory) },
118 { "self", opt_stringptr|opt_public,
120 { "senders", opt_stringptr|opt_public,
122 { "set", opt_stringptr|opt_public|opt_rep_str,
124 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
125 { "translate_ip_address", opt_stringptr|opt_public,
126 LOFF(translate_ip_address) },
128 { "transport", opt_stringptr|opt_public,
129 LOFF(transport_name) },
130 { "transport_current_directory", opt_stringptr|opt_public,
131 LOFF(current_directory) },
132 { "transport_home_directory", opt_stringptr|opt_public,
133 LOFF(home_directory) },
134 { "unseen", opt_expand_bool|opt_public,
136 { "user", opt_expand_uid | opt_public,
138 { "verify", opt_bool_verify|opt_hidden|opt_public,
139 LOFF(verify_sender) },
140 { "verify_only", opt_bool|opt_public,
142 { "verify_recipient", opt_bool|opt_public,
143 LOFF(verify_recipient) },
144 { "verify_sender", opt_bool|opt_public,
145 LOFF(verify_sender) }
148 int optionlist_routers_size = nelem(optionlist_routers);
153 # include "macro_predef.h"
156 options_routers(void)
160 options_from_list(optionlist_routers, nelem(optionlist_routers), US"ROUTERS", NULL);
162 for (driver_info * di = (driver_info *)routers_available; di; di = di->next)
164 spf(buf, sizeof(buf), US"_DRIVER_ROUTER_%T", di->driver_name);
165 builtin_macro_create(buf);
166 options_from_list(di->options, (unsigned)*di->options_count,
167 US"ROUTER", di->driver_name);
171 #else /*!MACRO_PREDEF*/
173 /*************************************************
174 * Set router pointer from name *
175 *************************************************/
177 /* This function is used for the redirect_router and pass_router options and
178 called from route_init() below.
183 ptr where to put the pointer
184 after TRUE if router must follow this one
190 set_router(router_instance *r, uschar *name, router_instance **ptr, BOOL after)
192 BOOL afterthis = FALSE;
195 for (rr = routers; rr; rr = rr->drinst.next)
197 if (Ustrcmp(name, rr->drinst.name) == 0)
202 if (rr == r) afterthis = TRUE;
206 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
207 "new_router \"%s\" not found for \"%s\" router", name, r->drinst.name);
209 if (after && !afterthis)
210 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
211 "new_router \"%s\" does not follow \"%s\" router", name, r->drinst.name);
216 /*************************************************
217 * Initialize router list *
218 *************************************************/
220 /* Read the routers section of the configuration file, and set up a chain of
221 router instances according to its contents. Each router has generic options and
222 may also have its own private options. This function is only ever called when
223 routers == NULL. We use generic code in readconf to do the work. It will set
224 values from the configuration file, and then call the driver's initialization
230 int old_pool = store_pool;
231 store_pool = POOL_PERM;
233 driver_info ** anchor = (driver_info **) &routers_available;
234 extern router_info accept_router_info;
235 extern router_info dnslookup_router_info;
236 extern router_info ipliteral_router_info;
237 extern router_info iplookup_router_info;
238 extern router_info manualroute_router_info;
239 extern router_info redirect_router_info;
240 extern router_info queryprogram_router_info;
242 /* Add the router drivers that are built for static linkage to the
243 list of availables. */
245 #if defined(ROUTER_ACCEPT) && ROUTER_ACCEPT!=2
246 add_driver_info(anchor, &accept_router_info.drinfo, sizeof(router_info));
248 #if defined(ROUTER_DNSLOOKUP) && ROUTER_DNSLOOKUP!=2
249 add_driver_info(anchor, &dnslookup_router_info.drinfo, sizeof(router_info));
251 # if defined(ROUTER_IPLITERAL) && ROUTER_IPLITERAL!=2
252 add_driver_info(anchor, &ipliteral_router_info.drinfo, sizeof(router_info));
254 #if defined(ROUTER_IPLOOKUP) && ROUTER_IPLOOKUP!=2
255 add_driver_info(anchor, &iplookup_router_info.drinfo, sizeof(router_info));
257 #if defined(ROUTER_MANUALROUTE) && ROUTER_MANUALROUTE!=2
258 add_driver_info(anchor, &manualroute_router_info.drinfo, sizeof(router_info));
260 #if defined(ROUTER_REDIRECT) && ROUTER_REDIRECT!=2
261 add_driver_info(anchor, &redirect_router_info.drinfo, sizeof(router_info));
263 #if defined(ROUTER_QUERYPROGRAM) && ROUTER_QUERYPROGRAM!=2
264 add_driver_info(anchor, &queryprogram_router_info.drinfo, sizeof(router_info));
267 store_pool = old_pool;
270 /* Read the config file "routers" section, creating a routers instance list.
271 For any yet-undiscovered driver, check for a loadable module and add it to
274 readconf_driver_init((driver_instance **)&routers, /* chain anchor */
275 (driver_info **)&routers_available, /* available drivers */
276 sizeof(router_info), /* size of info blocks */
277 &router_defaults, /* default values for generic options */
278 sizeof(router_instance), /* size of instance block */
279 optionlist_routers, /* generic options */
280 optionlist_routers_size,
283 for (router_instance * r = routers; r; r = r->drinst.next)
285 uschar * s = r->self;
286 router_info * ri = r->drinst.info;
288 /* If log_as_local is unset, its overall default is FALSE. (The accept
289 router defaults it to TRUE.) */
291 if (r->log_as_local == TRUE_UNSET) r->log_as_local = FALSE;
293 /* Check for transport or no transport on certain routers */
295 if (ri->ri_flags & ri_yestransport && !r->transport_name && !r->verify_only)
296 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
297 "a transport is required for this router", r->drinst.name);
299 if (ri->ri_flags & ri_notransport && r->transport_name)
300 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
301 "a transport must not be defined for this router", r->drinst.name);
303 /* The "self" option needs to be decoded into a code value and possibly a
304 new domain string and a rewrite boolean. */
306 if (Ustrcmp(s, "freeze") == 0) r->self_code = self_freeze;
307 else if (Ustrcmp(s, "defer") == 0) r->self_code = self_defer;
308 else if (Ustrcmp(s, "send") == 0) r->self_code = self_send;
309 else if (Ustrcmp(s, "pass") == 0) r->self_code = self_pass;
310 else if (Ustrcmp(s, "fail") == 0) r->self_code = self_fail;
311 else if (Ustrncmp(s, "reroute:", 8) == 0)
314 Uskip_whitespace(&s);
315 if (Ustrncmp(s, "rewrite:", 8) == 0)
317 r->self_rewrite = TRUE;
319 Uskip_whitespace(&s);
322 r->self_code = self_reroute;
325 else log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s router:\n "
326 "%s is not valid for the self option", r->drinst.name, s);
328 /* If any router has check_local_user set, default retry_use_local_part
329 TRUE; otherwise its default is FALSE. */
331 if (r->retry_use_local_part == TRUE_UNSET)
332 r->retry_use_local_part =
333 r->check_local_user || r->local_parts || r->condition || r->prefix || r->suffix || r->senders || r->require_files;
335 /* Build a host list if fallback hosts is set. */
338 int old_pool = store_pool;
339 store_pool = POOL_PERM;
340 host_build_hostlist(&r->fallback_hostlist, r->fallback_hosts, FALSE);
341 store_pool = old_pool;
344 /* Check redirect_router and pass_router are valid */
346 if (r->redirect_router_name)
347 set_router(r, r->redirect_router_name, &(r->redirect_router), FALSE);
349 if (r->pass_router_name)
350 set_router(r, r->pass_router_name, &(r->pass_router), TRUE);
353 DEBUG(D_route) debug_printf("DSN: %s %s\n", r->name,
354 r->dsn_lasthop ? "lasthop set" : "propagating DSN");
361 /*************************************************
362 * Tidy up after routing *
363 *************************************************/
365 /* Routers are entitled to keep hold of certain resources in their instance
366 blocks so as to save setting them up each time. An example is an open file.
367 Such routers must provide a tidyup entry point which is called when all routing
368 is finished, via this function. */
373 for (router_instance * r = routers; r; r = r->drinst.next)
375 router_info * ri = r->drinst.info;
376 if (ri->tidyup) (ri->tidyup)(r);
382 /*************************************************
383 * Check local part for prefix *
384 *************************************************/
386 /* This function is handed a local part and a list of possible prefixes; if any
387 one matches, return the prefix length. A prefix beginning with '*' is a
391 local_part the local part to check
392 prefixes the list of prefixes
393 vp if set, pointer to place for size of wildcard portion
395 Returns: length of matching prefix or zero
399 route_check_prefix(const uschar * local_part, const uschar * prefixes,
404 const uschar *listptr = prefixes;
406 while ((prefix = string_nextinlist(&listptr, &sep, NULL, 0)))
408 int plen = Ustrlen(prefix);
409 if (prefix[0] == '*')
412 for (const uschar * p = local_part + Ustrlen(local_part) - (--plen);
413 p >= local_part; p--)
414 if (strncmpic(prefix, p, plen) == 0)
416 unsigned vlen = p - local_part;
422 if (strncmpic(prefix, local_part, plen) == 0)
434 /*************************************************
435 * Check local part for suffix *
436 *************************************************/
438 /* This function is handed a local part and a list of possible suffixes;
439 if any one matches, return the suffix length. A suffix ending with '*'
443 local_part the local part to check
444 suffixes the list of suffixes
445 vp if set, pointer to place for size of wildcard portion
447 Returns: length of matching suffix or zero
451 route_check_suffix(const uschar * local_part, const uschar * suffixes,
455 int alen = Ustrlen(local_part);
457 const uschar *listptr = suffixes;
459 while ((suffix = string_nextinlist(&listptr, &sep, NULL, 0)))
461 int slen = Ustrlen(suffix);
462 if (suffix[slen-1] == '*')
464 const uschar * pend = local_part + alen - (--slen) + 1;
465 for (const uschar * p = local_part; p < pend; p++)
466 if (strncmpic(suffix, p, slen) == 0)
468 int tlen = alen - (p - local_part);
469 if (vp) *vp = tlen - slen;
474 if (alen > slen && strncmpic(suffix, local_part + alen - slen, slen) == 0)
487 /*************************************************
488 * Check local part, domain, or sender *
489 *************************************************/
491 /* The checks in check_router_conditions() require similar code, so we use
492 this function to save repetition.
495 rname router name for error messages
496 type type of check, for error message
497 list domains, local_parts, or senders list
498 anchorptr -> tree for possibly cached items (domains)
499 cache_bits cached bits pointer
500 listtype MCL_DOMAIN for domain check
501 MCL_LOCALPART for local part check
502 MCL_ADDRESS for sender check
503 domloc current domain, current local part, or NULL for sender check
504 ldata where to put lookup data
505 caseless passed on to match_isinlist()
506 perror where to put an error message
508 Returns: OK item is in list
509 SKIP item is not in list, router is to be skipped
510 DEFER lookup or other defer
514 route_check_dls(const uschar * rname, const uschar * type, const uschar * list,
515 tree_node ** anchorptr, unsigned int * cache_bits, int listtype,
516 const uschar * domloc, const uschar ** ldata, BOOL caseless, uschar ** perror)
518 if (!list) return OK; /* Empty list always succeeds */
520 DEBUG(D_route) debug_printf("checking %s\n", type);
522 /* The domain and local part use the same matching function, whereas sender
526 ? match_isinlist(domloc, &list, 0, anchorptr, cache_bits, listtype,
528 : match_address_list(sender_address ? sender_address : US"",
529 TRUE, TRUE, &list, cache_bits, -1, 0, CUSS &sender_data)
536 *perror = string_sprintf("%s router skipped: %s mismatch", rname, type);
537 DEBUG(D_route) debug_printf("%s\n", *perror);
540 default: /* Paranoia, and keeps compilers happy */
542 *perror = string_sprintf("%s check lookup or other defer", type);
543 DEBUG(D_route) debug_printf("%s\n", *perror);
550 /*************************************************
551 * Check access by a given uid/gid *
552 *************************************************/
554 /* This function checks whether a given uid/gid has access to a given file or
555 directory. It is called only from check_files() below. This is hopefully a
556 cheapish check that does the job most of the time. Exim does *not* rely on this
557 test when actually accessing any file. The test is used when routing to make it
558 possible to take actions such as "if user x can access file y then run this
561 During routing, Exim is normally running as root, and so the test will work
562 except for NFS non-root mounts. When verifying during message reception, Exim
563 is running as "exim", so the test may not work. This is a limitation of the
566 Code in check_files() below detects the case when it cannot stat() the file (as
567 root), and in that situation it uses a setuid subprocess in which to run this
571 path the path to check
574 bits the bits required in the final component
577 FALSE errno=EACCES or ENOENT (or others from realpath or stat)
581 route_check_access(uschar *path, uid_t uid, gid_t gid, int bits)
585 uschar *rp = US realpath(CS path, CS big_buffer);
588 DEBUG(D_route) debug_printf("route_check_access(%s,%d,%d,%o)\n", path,
589 (int)uid, (int)gid, bits);
591 if (!rp) return FALSE;
593 while ((slash = Ustrchr(sp, '/')))
596 DEBUG(D_route) debug_printf("stat %s\n", rp);
597 if (Ustat(rp, &statbuf) < 0) return FALSE;
598 if ((statbuf.st_mode &
599 ((statbuf.st_uid == uid)? 0100 : (statbuf.st_gid == gid)? 0010 : 001)
609 /* Down to the final component */
611 DEBUG(D_route) debug_printf("stat %s\n", rp);
613 if (Ustat(rp, &statbuf) < 0) return FALSE;
615 if (statbuf.st_uid == uid) bits = bits << 6;
616 else if (statbuf.st_gid == gid) bits = bits << 3;
617 if ((statbuf.st_mode & bits) != bits)
623 DEBUG(D_route) debug_printf("route_check_access() succeeded\n");
629 /*************************************************
630 * Do file existence tests *
631 *************************************************/
633 /* This function is given a colon-separated list of file tests, each of which
634 is expanded before use. A test consists of a file name, optionally preceded by
635 ! (require non-existence) and/or + for handling permission denied (+ means
636 treat as non-existing).
638 An item that contains no slashes is interpreted as a username or id, with an
639 optional group id, for checking access to the file. This cannot be done
640 "perfectly", but it is good enough for a number of applications.
643 s a colon-separated list of file tests or NULL
644 perror a pointer to an anchor for an error text in the case of a DEFER
646 Returns: OK if s == NULL or all tests are as required
647 DEFER if the existence of at least one of the files is
648 unclear (an error other than non-existence occurred);
649 DEFER if an expansion failed
650 DEFER if a name is not absolute
651 DEFER if problems with user/group
656 check_files(const uschar *s, uschar **perror)
658 int sep = 0; /* List has default separators */
659 uid_t uid = 0; /* For picky compilers */
660 gid_t gid = 0; /* For picky compilers */
661 BOOL ugid_set = FALSE;
662 const uschar *listptr;
667 DEBUG(D_route|D_expand) debug_printf("checking require_files\n");
670 while ((check = string_nextinlist(&listptr, &sep, NULL, 0)))
676 uschar *ss = expand_string(check);
680 if (f.expand_string_forcedfail) continue;
681 *perror = string_sprintf("failed to expand \"%s\" for require_files: %s",
682 check, expand_string_message);
686 /* Empty items are just skipped */
690 /* If there are no slashes in the string, we have a user name or uid, with
691 optional group/gid. */
693 if (Ustrchr(ss, '/') == NULL)
697 uschar *comma = Ustrchr(ss, ',');
699 /* If there's a comma, temporarily terminate the user name/number
700 at that point. Then set the uid. */
702 if (comma) *comma = 0;
703 ok = route_finduser(ss, &pw, &uid);
704 if (comma) *comma = ',';
708 *perror = string_sprintf("user \"%s\" for require_files not found", ss);
712 /* If there was no comma, the gid is that associated with the user. */
719 *perror = string_sprintf("group missing after numerical uid %d for "
720 "require_files", (int)uid);
724 if (!route_findgroup(comma + 1, &gid))
726 *perror = string_sprintf("group \"%s\" for require_files not found\n",
731 /* Note that we have values set, and proceed to next item */
734 debug_printf("check subsequent files for access by %s\n", ss);
739 /* Path, possibly preceded by + and ! */
744 while (isspace(*++ss));
750 while (isspace(*++ss));
755 *perror = string_sprintf("require_files: \"%s\" is not absolute", ss);
759 /* Stat the file, either as root (while routing) or as exim (while verifying
760 during message reception). */
762 rc = Ustat(ss, &statbuf);
766 debug_printf("file check: %s\n", check);
767 if (ss != check) debug_printf("expanded file: %s\n", ss);
768 debug_printf("stat() yielded %d\n", rc);
771 /* If permission is denied, and we are running as root (i.e. routing for
772 delivery rather than verifying), and the requirement is to test for access by
773 a particular uid/gid, it must mean that the file is on a non-root-mounted NFS
774 system. In this case, we have to use a subprocess that runs as the relevant
775 uid in order to do the test. */
777 if (rc != 0 && errno == EACCES && ugid_set && getuid() == root_uid)
781 void (*oldsignal)(int);
783 DEBUG(D_route) debug_printf("root is denied access: forking to check "
786 /* Before forking, ensure that SIGCHLD is set to SIG_DFL before forking, so
787 that the child process can be waited for, just in case get here with it set
788 otherwise. Save the old state for resetting on the wait. */
790 oldsignal = signal(SIGCHLD, SIG_DFL);
791 pid = exim_fork(US"require-files");
793 /* If fork() fails, reinstate the original error and behave as if
794 this block of code were not present. This is the same behaviour as happens
795 when Exim is not running as root at this point. */
800 debug_printf("require_files: fork failed: %s\n", strerror(errno));
805 /* In the child process, change uid and gid, and then do the check using
806 the route_check_access() function. This does more than just stat the file;
807 it tests permissions as well. Return 0 for OK and 1 for failure. */
811 exim_setugid(uid, gid, TRUE,
812 string_sprintf("require_files check, file=%s", ss));
813 if (route_check_access(ss, uid, gid, 4))
814 exim_underbar_exit(EXIT_SUCCESS);
815 DEBUG(D_route) debug_printf("route_check_access() failed\n");
816 exim_underbar_exit(EXIT_FAILURE);
819 /* In the parent, wait for the child to finish */
821 while (waitpid(pid, &status, 0) < 0)
822 if (errno != EINTR) /* unexpected error, interpret as failure */
828 signal(SIGCHLD, oldsignal); /* restore */
829 if ((status == 0) == invert) return SKIP;
830 continue; /* to test the next file */
833 /* Control reaches here if the initial stat() succeeds, or fails with an
834 error other than EACCES, or no uid/gid is set, or we are not running as root.
835 If we know the file exists and uid/gid are set, try to check read access for
836 that uid/gid as best we can. */
838 if (rc == 0 && ugid_set && !route_check_access(ss, uid, gid, 4))
840 DEBUG(D_route) debug_printf("route_check_access() failed\n");
844 /* Handle error returns from stat() or route_check_access(). The EACCES error
845 is handled specially. At present, we can force it to be treated as
846 non-existence. Write the code so that it will be easy to add forcing for
847 existence if required later. */
852 DEBUG(D_route) debug_printf("errno = %d\n", errno);
855 if (eacces_code == 1)
857 DEBUG(D_route) debug_printf("EACCES => ENOENT\n");
858 errno = ENOENT; /* Treat as non-existent */
863 *perror = string_sprintf("require_files: error for %s: %s", ss,
869 /* At this point, rc < 0 => non-existence; rc >= 0 => existence */
871 if ((rc >= 0) == invert) return SKIP;
876 /* Come here on any of the errors that return DEFER. */
879 DEBUG(D_route) debug_printf("%s\n", *perror);
887 /*************************************************
888 * Check for router skipping *
889 *************************************************/
891 /* This function performs various checks to see whether a router should be
892 skipped. The order in which they are performed is important.
895 r pointer to router instance block
896 addr address that is being handled
897 verify the verification type
898 pw ptr to ptr to passwd structure for local user
899 perror for lookup errors
901 Returns: OK if all the tests succeed
902 SKIP if router is to be skipped
903 DEFER for a lookup defer
904 FAIL for address to be failed
908 check_router_conditions(router_instance * r, address_item * addr, int verify,
909 struct passwd ** pw, uschar ** perror)
912 uschar * check_local_part;
913 unsigned int * localpart_cache;
914 const uschar * rname = r->drinst.name;
916 /* Reset variables to hold a home directory and data from lookup of a domain or
917 local part, and ensure search_find_defer is unset, in case there aren't any
921 deliver_domain_data = NULL;
922 deliver_localpart_data = NULL;
924 local_user_gid = (gid_t)(-1);
925 local_user_uid = (uid_t)(-1);
926 f.search_find_defer = FALSE;
928 /* Skip this router if not verifying and it has verify_only set */
930 if ((verify == v_none || verify == v_expn) && r->verify_only)
932 DEBUG(D_route) debug_printf("%s router skipped: verify_only set\n", rname);
936 /* Skip this router if testing an address (-bt) and address_test is not set */
938 if (f.address_test_mode && !r->address_test)
940 DEBUG(D_route) debug_printf("%s router skipped: address_test is unset\n",
945 /* Skip this router if verifying and it hasn't got the appropriate verify flag
948 if ((verify == v_sender && !r->verify_sender) ||
949 (verify == v_recipient && !r->verify_recipient))
951 DEBUG(D_route) debug_printf("%s router skipped: verify %d %d %d\n",
952 rname, verify, r->verify_sender, r->verify_recipient);
956 /* Skip this router if processing EXPN and it doesn't have expn set */
958 if (verify == v_expn && !r->expn)
960 DEBUG(D_route) debug_printf("%s router skipped: no_expn set\n", rname);
964 /* Skip this router if there's a domain mismatch. */
966 if ((rc = route_check_dls(rname, US"domains", r->domains, &domainlist_anchor,
967 addr->domain_cache, TRUE, addr->domain, CUSS &deliver_domain_data,
968 MCL_DOMAIN, perror)) != OK)
971 /* Skip this router if there's a local part mismatch. We want to pass over the
972 caseful local part, so that +caseful can restore it, even if this router is
973 handling local parts caselessly. However, we can't just pass cc_local_part,
974 because that doesn't have the prefix or suffix stripped. A bit of massaging is
975 required. Also, we only use the match cache for local parts that have not had
976 a prefix or suffix stripped. */
978 check_local_part = string_copy(addr->cc_local_part);
979 if (!addr->prefix && !addr->suffix)
980 localpart_cache = addr->localpart_cache;
983 localpart_cache = NULL;
985 check_local_part += Ustrlen(addr->prefix);
987 check_local_part[Ustrlen(check_local_part) - Ustrlen(addr->suffix)] = 0;
990 if ((rc = route_check_dls(rname, US"local_parts", r->local_parts,
991 &localpartlist_anchor, localpart_cache, MCL_LOCALPART,
992 check_local_part, CUSS &deliver_localpart_data,
993 !r->caseful_local_part, perror)) != OK)
996 /* If the check_local_user option is set, check that the local_part is the
997 login of a local user. Note: the third argument to route_finduser() must be
998 NULL here, to prevent a numeric string being taken as a numeric uid. If the
999 user is found, set deliver_home to the home directory, and also set
1000 local_user_{uid,gid} and local_part_data. */
1002 if (r->check_local_user)
1004 DEBUG(D_route) debug_printf("checking for local user\n");
1005 if (!route_finduser(addr->local_part, pw, NULL))
1007 DEBUG(D_route) debug_printf("%s router skipped: %s is not a local user\n",
1008 rname, addr->local_part);
1011 addr->prop.localpart_data =
1012 deliver_localpart_data = string_copy(US (*pw)->pw_name);
1013 deliver_home = string_copy(US (*pw)->pw_dir);
1014 local_user_gid = (*pw)->pw_gid;
1015 local_user_uid = (*pw)->pw_uid;
1018 /* Set (or override in the case of check_local_user) the home directory if
1019 router_home_directory is set. This is done here so that it overrides $home from
1020 check_local_user before any subsequent expansions are done. Otherwise, $home
1021 could mean different things for different options, which would be extremely
1024 GET_OPTION("router_home_directory");
1025 if (r->router_home_directory)
1027 uschar * router_home = expand_string(r->router_home_directory);
1030 setflag(addr, af_home_expanded); /* Note set from router_home_directory */
1031 deliver_home = router_home;
1033 else if (!f.expand_string_forcedfail)
1035 *perror = string_sprintf("failed to expand \"%s\" for "
1036 "router_home_directory: %s", r->router_home_directory,
1037 expand_string_message);
1042 /* Skip if the sender condition is not met. We leave this one till after the
1043 local user check so that $home is set - enabling the possibility of letting
1044 individual recipients specify lists of acceptable/unacceptable senders. */
1046 if ((rc = route_check_dls(rname, US"senders", r->senders, NULL,
1047 sender_address_cache, MCL_ADDRESS, NULL, NULL, FALSE, perror)) != OK)
1050 /* This is the point at which we print out the router's debugging string if it
1051 is set. We wait till here so as to have $home available for local users (and
1052 anyway, we don't want too much stuff for skipped routers). */
1054 debug_print_string(r->debug_string);
1056 /* Perform file existence tests. */
1058 if ((rc = check_files(r->require_files, perror)) != OK)
1060 DEBUG(D_route) debug_printf("%s router %s: file check\n", rname,
1061 (rc == SKIP)? "skipped" : "deferred");
1065 /* Now the general condition test. */
1069 DEBUG(D_route|D_expand)
1070 debug_printf("checking \"condition\" \"%.80s\"...\n", r->condition);
1071 if (!expand_check_condition(r->condition, rname, US"router"))
1073 if (f.search_find_defer)
1075 *perror = US"condition check lookup defer";
1076 DEBUG(D_route) debug_printf("%s\n", *perror);
1080 debug_printf("%s router skipped: condition failure\n", rname);
1085 #ifdef EXPERIMENTAL_BRIGHTMAIL
1086 /* check if a specific Brightmail AntiSpam rule fired on the message */
1089 DEBUG(D_route) debug_printf("checking bmi_rule\n");
1090 if (bmi_check_rule(bmi_base64_verdict, r->bmi_rule) == 0)
1091 { /* none of the rules fired */
1093 debug_printf("%s router skipped: none of bmi_rule rules fired\n", rname);
1098 /* check if message should not be delivered */
1099 if (r->bmi_dont_deliver && bmi_deliver == 1)
1102 debug_printf("%s router skipped: bmi_dont_deliver is FALSE\n", rname);
1106 /* check if message should go to an alternate location */
1107 if ( r->bmi_deliver_alternate
1108 && (bmi_deliver == 0 || !bmi_alt_location)
1112 debug_printf("%s router skipped: bmi_deliver_alternate is FALSE\n", rname);
1116 /* check if message should go to default location */
1117 if ( r->bmi_deliver_default
1118 && (bmi_deliver == 0 || bmi_alt_location)
1122 debug_printf("%s router skipped: bmi_deliver_default is FALSE\n", rname);
1127 /* All the checks passed. */
1135 /*************************************************
1136 * Find a local user *
1137 *************************************************/
1139 /* Try several times (if configured) to find a local user, in case delays in
1140 NIS or NFS whatever cause an incorrect refusal. It's a pity that getpwnam()
1141 doesn't have some kind of indication as to why it has failed. If the string
1142 given consists entirely of digits, and the third argument is not NULL, assume
1143 the string is the numerical value of the uid. Otherwise it is looked up using
1144 getpwnam(). The uid is passed back via return_uid, if not NULL, and the
1145 pointer to a passwd structure, if found, is passed back via pw, if not NULL.
1147 Because this may be called several times in succession for the same user for
1148 different routers, cache the result of the previous getpwnam call so that it
1149 can be re-used. Note that we can't just copy the structure, as the store it
1150 points to can get trashed.
1153 s the login name or textual form of the numerical uid of the user
1154 pw if not NULL, return the result of getpwnam here, or set NULL
1155 if no call to getpwnam is made (s numeric, return_uid != NULL)
1156 return_uid if not NULL, return the uid via this address
1158 Returns: TRUE if s is numerical or was looked up successfully
1162 static struct passwd pwcopy;
1163 static struct passwd *lastpw = NULL;
1164 static uschar lastname[48] = { 0 };
1165 static uschar lastdir[128];
1166 static uschar lastgecos[128];
1167 static uschar lastshell[128];
1170 route_finduser(const uschar *s, struct passwd **pw, uid_t *return_uid)
1172 BOOL cache_set = (Ustrcmp(lastname, s) == 0);
1174 DEBUG(D_uid) debug_printf("seeking password data for user \"%s\": %s\n", s,
1175 cache_set ? "using cached result" : "cache not available");
1181 if (return_uid && (isdigit(*s) || *s == '-') &&
1182 s[Ustrspn(s+1, "0123456789")+1] == 0)
1184 *return_uid = (uid_t)Uatoi(s);
1189 string_format_nt(lastname, sizeof(lastname), "%s", s);
1191 /* Force failure if string length is greater than given maximum */
1193 if (max_username_length > 0 && Ustrlen(lastname) > max_username_length)
1195 DEBUG(D_uid) debug_printf("forced failure of finduser(): string "
1196 "length of %s is greater than %d\n", lastname, max_username_length);
1200 /* Try a few times if so configured; this handles delays in NIS etc. */
1205 if ((lastpw = getpwnam(CS s))) break;
1206 if (++i > finduser_retries) break;
1212 pwcopy.pw_uid = lastpw->pw_uid;
1213 pwcopy.pw_gid = lastpw->pw_gid;
1214 (void)string_format(lastdir, sizeof(lastdir), "%s", lastpw->pw_dir);
1215 (void)string_format(lastgecos, sizeof(lastgecos), "%s", lastpw->pw_gecos);
1216 (void)string_format(lastshell, sizeof(lastshell), "%s", lastpw->pw_shell);
1217 pwcopy.pw_name = CS lastname;
1218 pwcopy.pw_dir = CS lastdir;
1219 pwcopy.pw_gecos = CS lastgecos;
1220 pwcopy.pw_shell = CS lastshell;
1224 else DEBUG(D_uid) if (errno != 0)
1225 debug_printf("getpwnam(%s) failed: %s\n", s, strerror(errno));
1230 DEBUG(D_uid) debug_printf("getpwnam() returned NULL (user not found)\n");
1234 DEBUG(D_uid) debug_printf("getpwnam() succeeded uid=%d gid=%d\n",
1235 lastpw->pw_uid, lastpw->pw_gid);
1237 if (return_uid) *return_uid = lastpw->pw_uid;
1238 if (pw) *pw = lastpw;
1246 /*************************************************
1247 * Find a local group *
1248 *************************************************/
1250 /* Try several times (if configured) to find a local group, in case delays in
1251 NIS or NFS whatever cause an incorrect refusal. It's a pity that getgrnam()
1252 doesn't have some kind of indication as to why it has failed.
1255 s the group name or textual form of the numerical gid
1256 return_gid return the gid via this address
1258 Returns: TRUE if the group was found; FALSE otherwise
1263 route_findgroup(uschar *s, gid_t *return_gid)
1268 if ((isdigit(*s) || *s == '-') && s[Ustrspn(s+1, "0123456789")+1] == 0)
1270 *return_gid = (gid_t)Uatoi(s);
1276 if ((gr = getgrnam(CS s)))
1278 *return_gid = gr->gr_gid;
1281 if (++i > finduser_retries) break;
1291 /*************************************************
1292 * Find user by expanding string *
1293 *************************************************/
1295 /* Expands a string, and then looks up the result in the passwd file.
1298 string the string to be expanded, yielding a login name or a numerical
1299 uid value (to be passed to route_finduser())
1300 driver_name caller name for panic error message (only)
1301 driver_type caller type for panic error message (only)
1302 pw return passwd entry via this pointer
1303 uid return uid via this pointer
1304 errmsg where to point a message on failure
1306 Returns: TRUE if user found, FALSE otherwise
1310 route_find_expanded_user(uschar *string, uschar *driver_name,
1311 uschar *driver_type, struct passwd **pw, uid_t *uid, uschar **errmsg)
1313 uschar *user = expand_string(string);
1317 *errmsg = string_sprintf("Failed to expand user string \"%s\" for the "
1318 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1319 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1323 if (route_finduser(user, pw, uid)) return TRUE;
1325 *errmsg = string_sprintf("Failed to find user \"%s\" from expanded string "
1326 "\"%s\" for the %s %s", user, string, driver_name, driver_type);
1327 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1333 /*************************************************
1334 * Find group by expanding string *
1335 *************************************************/
1337 /* Expands a string and then looks up the result in the group file.
1340 string the string to be expanded, yielding a group name or a numerical
1341 gid value (to be passed to route_findgroup())
1342 driver_name caller name for panic error message (only)
1343 driver_type caller type for panic error message (only)
1344 gid return gid via this pointer
1345 errmsg return error message via this pointer
1347 Returns: TRUE if found group, FALSE otherwise
1351 route_find_expanded_group(uschar *string, uschar *driver_name, uschar *driver_type,
1352 gid_t *gid, uschar **errmsg)
1355 uschar *group = expand_string(string);
1359 *errmsg = string_sprintf("Failed to expand group string \"%s\" for the "
1360 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1361 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1365 if (!route_findgroup(group, gid))
1367 *errmsg = string_sprintf("Failed to find group \"%s\" from expanded string "
1368 "\"%s\" for the %s %s", group, string, driver_name, driver_type);
1369 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1378 /*************************************************
1379 * Handle an unseen routing *
1380 *************************************************/
1382 /* This function is called when an address is routed by a router with "unseen"
1383 set. It must make a clone of the address, for handling by subsequent drivers.
1384 The clone is set to start routing at the next router.
1386 The original address must be replaced by an invented "parent" which has the
1387 routed address plus the clone as its children. This is necessary in case the
1388 address is at the top level - we don't want to mark it complete until both
1389 deliveries have been done.
1391 A new unique field must be made, so that the record of the delivery isn't a
1392 record of the original address, and checking for already delivered has
1393 therefore to be done here. If the delivery has happened, then take the base
1394 address off whichever delivery queue it is on - it will always be the top item.
1398 addr address that was routed
1399 paddr_local chain of local-delivery addresses
1400 paddr_remote chain of remote-delivery addresses
1401 addr_new chain for newly created addresses
1407 route_unseen(const uschar * name, address_item * addr,
1408 address_item **paddr_local, address_item ** paddr_remote,
1409 address_item ** addr_new)
1411 address_item *parent = deliver_make_addr(addr->address, TRUE);
1412 address_item *new = deliver_make_addr(addr->address, TRUE);
1414 /* The invented parent is a copy that replaces the original; note that
1415 this copies its parent pointer. It has two children, and its errors_address is
1416 from the original address' parent, if present, otherwise unset. */
1419 parent->child_count = 2;
1420 parent->prop.errors_address =
1421 addr->parent ? addr->parent->prop.errors_address : NULL;
1423 /* The routed address gets a new parent. */
1425 addr->parent = parent;
1427 /* The clone has this parent too. Set its errors address from the parent. This
1428 was set from the original parent (or to NULL) - see above. We do NOT want to
1429 take the errors address from the unseen router. */
1431 new->parent = parent;
1432 new->prop.errors_address = parent->prop.errors_address;
1434 /* Copy the propagated flags and address_data from the original. */
1436 new->prop.ignore_error = addr->prop.ignore_error;
1437 new->prop.address_data = addr->prop.address_data;
1438 new->prop.variables = NULL;
1439 tree_dup((tree_node **)&new->prop.variables, addr->prop.variables);
1440 new->dsn_flags = addr->dsn_flags;
1441 new->dsn_orcpt = addr->dsn_orcpt;
1444 /* As it has turned out, we haven't set headers_add or headers_remove for the
1445 clone. Thinking about it, it isn't entirely clear whether they should be
1446 copied from the original parent, like errors_address, or taken from the
1447 unseen router, like address_data and the flags. Until somebody brings this
1448 up, I propose to leave the code as it is. */
1451 /* Set the cloned address to start at the next router, and put it onto the
1452 chain of new addresses. */
1454 new->start_router = addr->router->drinst.next;
1455 new->next = *addr_new;
1458 DEBUG(D_route) debug_printf("\"unseen\" set: replicated %s\n", addr->address);
1460 /* Make a new unique field, to distinguish from the normal one. */
1462 addr->unique = string_sprintf("%s/%s", addr->unique, name);
1464 /* If the address has been routed to a transport, see if it was previously
1465 delivered. If so, we take it off the relevant queue so that it isn't delivered
1466 again. Otherwise, it was an alias or something, and the addresses it generated
1467 are handled in the normal way. */
1469 if (addr->transport && tree_search(tree_nonrecipients, addr->unique))
1472 debug_printf("\"unseen\" delivery previously done - discarded\n");
1473 parent->child_count--;
1474 if (*paddr_remote == addr) *paddr_remote = addr->next;
1475 if (*paddr_local == addr) *paddr_local = addr->next;
1481 /************************************************/
1482 /* Add router-assigned variables
1483 Return OK/DEFER/FAIL/PASS */
1486 set_router_vars(address_item * addr, const router_instance * r)
1488 const uschar * varlist = r->set;
1489 tree_node ** root = (tree_node **) &addr->prop.variables;
1491 const uschar * drname = r->drinst.name;
1494 if (!varlist) return OK;
1496 /* Walk the varlist, creating variables */
1498 for (uschar * ele; (ele = string_nextinlist(&varlist, &sep, NULL, 0)); )
1500 const uschar * assignment = ele;
1502 uschar * name = string_nextinlist(&assignment, &esep, NULL, 0);
1506 /* Variable name must exist and start "r_". */
1508 if (!name || name[0] != 'r' || name[1] != '_' || !name[2])
1510 log_write(0, LOG_MAIN|LOG_PANIC,
1511 "bad router variable name '%s' in router '%s'\n", name, drname);
1516 Uskip_whitespace(&assignment);
1518 if (!(val = expand_string(US assignment)))
1519 if (f.expand_string_forcedfail)
1523 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1524 "(router variable): decline action taken\n", ele);
1526 /* Expand "more" if necessary; DEFER => an expansion failed */
1529 yield = exp_bool(addr, US"router", drname, D_route,
1530 US"more", r->more, r->expand_more, &more);
1531 if (yield != OK) return yield;
1536 debug_printf("\"more\"=false: skipping remaining routers\n");
1545 addr->message = string_sprintf("expansion of \"%s\" failed "
1546 "in %s router: %s", ele, drname, expand_string_message);
1547 /* Caller will replace that for logging, if a DB lookup, to avoid exposing
1549 DEBUG(D_route) debug_printf("%s\n", addr->message);
1550 if (!f.search_find_defer)
1551 return f.search_find_defer ? DEFER : FAIL;
1554 if (!(node = tree_search(*root, name)))
1555 { /* name should never be tainted */
1556 node = store_get(sizeof(tree_node) + Ustrlen(name), GET_UNTAINTED);
1557 Ustrcpy(node->name, name);
1558 (void)tree_insertnode(root, node);
1560 node->data.ptr = US val;
1561 DEBUG(D_route) debug_printf("set r_%s%s = '%s'%s\n",
1562 name, is_tainted(name)?" (tainted)":"",
1563 val, is_tainted(val)?" (tainted)":"");
1565 /* All expansions after this point need visibility of that variable */
1572 /*************************************************
1573 * Route one address *
1574 *************************************************/
1576 /* This function is passed in one address item, for processing by the routers.
1577 The verify flag is set if this is being called for verification rather than
1578 delivery. If the router doesn't have its "verify" flag set, it is skipped.
1581 addr address to route
1582 paddr_local chain of local-delivery addresses
1583 paddr_remote chain of remote-delivery addresses
1584 addr_new chain for newly created addresses
1585 addr_succeed chain for completed addresses
1586 verify v_none if not verifying
1587 v_sender if verifying a sender address
1588 v_recipient if verifying a recipient address
1589 v_expn if processing an EXPN address
1591 Returns: OK => address successfully routed
1592 DISCARD => address was discarded
1593 FAIL => address could not be routed
1594 DEFER => some temporary problem
1595 ERROR => some major internal or configuration failure
1599 route_address(address_item *addr, address_item **paddr_local,
1600 address_item **paddr_remote, address_item **addr_new,
1601 address_item **addr_succeed, int verify)
1605 router_instance * r, * nextr;
1606 const uschar * old_domain = addr->domain;
1607 const uschar * rname_l;
1611 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1612 debug_printf("routing %s\n", addr->address);
1615 /* Loop through all router instances until a router succeeds, fails, defers, or
1616 encounters an error. If the address has start_router set, we begin from there
1617 instead of at the first router. */
1619 for (r = addr->start_router ? addr->start_router : routers; r; r = nextr)
1622 struct passwd * pw = NULL;
1623 struct passwd pwcopy;
1624 BOOL loop_detected = FALSE, more;
1625 int loopcount = 0, rc;
1627 rname_l = r->drinst.name;
1628 DEBUG(D_route) debug_printf("--------> %s router <--------\n", rname_l);
1630 /* Reset any search error message from the previous router. */
1632 search_error_message = NULL;
1634 /* There are some weird cases where logging is disabled */
1636 f.disable_logging = r->disable_logging;
1638 /* Record the last router to handle the address, and set the default
1642 nextr = r->drinst.next;
1644 /* Loop protection: If this address has an ancestor with the same address,
1645 and that ancestor was routed by this router, we skip this router. This
1646 prevents a variety of looping states when a new address is created by
1647 redirection or by the use of "unseen" on a router.
1649 If no_repeat_use is set on the router, we skip if _any_ ancestor was routed
1650 by this router, even if it was different to the current address.
1652 Just in case someone does put it into a loop (possible with redirection
1653 continually adding to an address, for example), put a long stop counter on
1654 the number of parents. */
1656 for (address_item * parent = addr->parent; parent; parent = parent->parent)
1658 if (parent->router == r)
1660 BOOL break_loop = !r->repeat_use;
1662 /* When repeat_use is set, first check the active addresses caselessly.
1663 If they match, we have to do a further caseful check of the local parts
1664 when caseful_local_part is set. This is assumed to be rare, which is why
1665 the code is written this way. */
1669 break_loop = strcmpic(parent->address, addr->address) == 0;
1670 if (break_loop && r->caseful_local_part)
1671 break_loop = Ustrncmp(parent->address, addr->address,
1672 Ustrrchr(addr->address, '@') - addr->address) == 0;
1677 DEBUG(D_route) debug_printf("%s router skipped: previously routed %s\n",
1678 rname_l, parent->address);
1679 loop_detected = TRUE;
1684 /* Continue with parents, limiting the size of the dynasty. */
1686 if (loopcount++ > 100)
1688 log_write(0, LOG_MAIN|LOG_PANIC, "routing loop for %s", addr->address);
1694 if (loop_detected) continue;
1696 /* Default no affixes and select whether to use a caseful or caseless local
1697 part in this router. */
1699 addr->prefix = addr->prefix_v = addr->suffix = addr->suffix_v = NULL;
1700 addr->local_part = r->caseful_local_part
1701 ? addr->cc_local_part : addr->lc_local_part;
1703 DEBUG(D_route) debug_printf("local_part=%s domain=%s\n", addr->local_part,
1706 /* Handle any configured prefix by replacing the local_part address,
1707 and setting the prefix. Skip the router if the prefix doesn't match,
1708 unless the prefix is optional. */
1713 int plen = route_check_prefix(addr->local_part, r->prefix, &vlen);
1716 /* If the variable-part is zero-length then the prefix was not
1717 wildcarded and we can detaint-copy it since it matches the
1718 (non-expandable) router option. Otherwise copy the (likely) tainted match
1719 and the variable-part of the match from the local_part. */
1723 addr->prefix = string_copyn(addr->local_part, plen);
1724 addr->prefix_v = string_copyn(addr->local_part, vlen);
1727 addr->prefix = string_copyn_taint(addr->local_part, plen, GET_UNTAINTED);
1728 addr->local_part += plen;
1729 DEBUG(D_route) debug_printf("stripped prefix %s\n", addr->prefix);
1731 else if (!r->prefix_optional)
1734 debug_printf("%s router skipped: prefix mismatch\n", rname_l);
1739 /* Handle any configured suffix likewise. */
1744 int slen = route_check_suffix(addr->local_part, r->suffix, &vlen);
1747 int lplen = Ustrlen(addr->local_part) - slen;
1749 ? addr->local_part + lplen
1750 : string_copy_taint(addr->local_part + lplen, GET_UNTAINTED);
1751 addr->suffix_v = addr->suffix + Ustrlen(addr->suffix) - vlen;
1752 addr->local_part = string_copyn(addr->local_part, lplen);
1753 DEBUG(D_route) debug_printf("stripped suffix %s\n", addr->suffix);
1755 else if (!r->suffix_optional)
1758 debug_printf("%s router skipped: suffix mismatch\n", rname_l);
1763 /* Set the expansion variables now that we have the affixes and the case of
1764 the local part sorted. */
1766 router_name = rname_l;
1767 driver_srcfile = r->drinst.srcfile;
1768 driver_srcline = r->drinst.srcline;
1769 deliver_set_expansions(addr);
1771 /* For convenience, the pre-router checks are in a separate function, which
1772 returns OK, SKIP, FAIL, or DEFER. */
1774 if ((rc = check_router_conditions(r, addr, verify, &pw, &error)) != OK)
1776 driver_srcfile = router_name = NULL; driver_srcline = 0;
1777 if (rc == SKIP) continue;
1778 addr->message = error;
1783 /* All pre-conditions have been met. Reset any search error message from
1784 pre-condition tests. These can arise in negated tests where the failure of
1785 the lookup leads to a TRUE pre-condition. */
1787 search_error_message = NULL;
1789 /* Add any variable-settings that are on the router, to the set on the
1790 addr. Expansion is done here and not later when the addr is used. There may
1791 be multiple settings, gathered during readconf; this code gathers them during
1792 router traversal. On the addr string they are held as a variable tree, so
1793 as to maintain the post-expansion taints separate. */
1795 switch (rc = set_router_vars(addr, r))
1798 case PASS: continue; /* with next router */
1799 default: yield = rc; goto ROUTE_EXIT;
1802 /* Finally, expand the address_data field in the router. Forced failure
1803 behaves as if the router declined. Any other failure is more serious. On
1804 success, the string is attached to the address for all subsequent processing.
1807 if (r->address_data)
1809 DEBUG(D_route|D_expand) debug_printf("processing address_data\n");
1810 if (!(deliver_address_data = expand_string(r->address_data)))
1812 if (f.expand_string_forcedfail)
1814 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1815 "(address_data): decline action taken\n", r->address_data);
1817 /* Expand "more" if necessary; DEFER => an expansion failed */
1820 yield = exp_bool(addr, US"router", rname_l, D_route,
1821 US"more", r->more, r->expand_more, &more);
1822 if (yield != OK) goto ROUTE_EXIT;
1827 debug_printf("\"more\"=false: skipping remaining routers\n");
1828 driver_srcfile = router_name = NULL; driver_srcline = 0;
1832 else continue; /* With next router */
1837 addr->message = string_sprintf("expansion of \"%s\" failed "
1838 "in %s router: %s", r->address_data, rname_l, expand_string_message);
1843 addr->prop.address_data = deliver_address_data;
1846 /* We are finally cleared for take-off with this router. Clear the the flag
1847 that records that a local host was removed from a routed host list. Make a
1848 copy of relevant fields in the password information from check_local_user,
1849 because it will be overwritten if check_local_user is invoked again while
1850 verifying an errors_address setting. */
1852 clearflag(addr, af_local_host_removed);
1856 pwcopy.pw_name = CS string_copy(US pw->pw_name);
1857 pwcopy.pw_uid = pw->pw_uid;
1858 pwcopy.pw_gid = pw->pw_gid;
1859 pwcopy.pw_gecos = CS string_copy(US pw->pw_gecos);
1860 pwcopy.pw_dir = CS string_copy(US pw->pw_dir);
1861 pwcopy.pw_shell = CS string_copy(US pw->pw_shell);
1865 /* If this should be the last hop for DSN flag the addr. */
1867 if (r->dsn_lasthop && !(addr->dsn_flags & rf_dsnlasthop))
1869 addr->dsn_flags |= rf_dsnlasthop;
1870 HDEBUG(D_route) debug_printf("DSN: last hop for %s\n", addr->address);
1873 /* Run the router, and handle the consequences. */
1875 HDEBUG(D_route) debug_printf("calling %s router\n", rname_l);
1878 router_info * ri = r->drinst.info;
1879 yield = (ri->code)(r, addr, pw, verify, paddr_local, paddr_remote,
1880 addr_new, addr_succeed);
1883 driver_srcfile = router_name = NULL; driver_srcline = 0;
1887 HDEBUG(D_route) debug_printf("%s router forced address failure\n", rname_l);
1891 /* If succeeded while verifying but fail_verify is set, convert into
1892 a failure, and take it off the local or remote delivery list. */
1894 if ( ( verify == v_sender && r->fail_verify_sender
1895 || verify == v_recipient && r->fail_verify_recipient
1897 && (yield == OK || yield == PASS))
1899 addr->message = string_sprintf("%s router forced verify failure", rname_l);
1900 if (*paddr_remote == addr) *paddr_remote = addr->next;
1901 if (*paddr_local == addr) *paddr_local = addr->next;
1906 /* PASS and DECLINE are the only two cases where the loop continues. For all
1907 other returns, we break the loop and handle the result below. */
1909 if (yield != PASS && yield != DECLINE) break;
1913 debug_printf("%s router %s for %s\n", rname_l,
1914 yield == PASS ? "passed" : "declined", addr->address);
1915 if (Ustrcmp(old_domain, addr->domain) != 0)
1916 debug_printf("domain %s rewritten\n", old_domain);
1919 /* PASS always continues to another router; DECLINE does so if "more"
1920 is true. Initialization insists that pass_router is always a following
1921 router. Otherwise, break the loop as if at the end of the routers. */
1925 if (r->pass_router) nextr = r->pass_router;
1929 /* Expand "more" if necessary */
1932 yield = exp_bool(addr, US"router", rname_l, D_route,
1933 US"more", r->more, r->expand_more, &more);
1934 if (yield != OK) goto ROUTE_EXIT;
1939 debug_printf("\"more\" is false: skipping remaining routers\n");
1944 } /* Loop for all routers */
1946 /* On exit from the routers loop, if r == NULL we have run out of routers,
1947 either genuinely, or as a result of no_more. Otherwise, the loop ended
1948 prematurely, either because a router succeeded, or because of some special
1949 router response. Note that FAIL errors and errors detected before actually
1950 running a router go direct to ROUTE_EXIT from code above. */
1954 HDEBUG(D_route) debug_printf("no more routers\n");
1957 uschar * message = US"Unrouteable address";
1960 uschar * s = addr->router->cannot_route_message;
1961 GET_OPTION("cannot_route_message");
1964 if ((s = expand_string(s)))
1967 if (!f.expand_string_forcedfail)
1968 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
1969 "cannot_route_message in %s router: %s",
1970 addr->router->drinst.name,
1971 expand_string_message);
1974 addr->user_message = addr->message = message;
1976 addr->router = NULL; /* For logging */
1983 HDEBUG(D_route) debug_printf("%s router: defer for %s\n message: %s\n",
1984 rname_l, addr->address, addr->message ? addr->message : US"<none>");
1988 if (yield == DISCARD) goto ROUTE_EXIT;
1990 /* The yield must be either OK or REROUTED. */
1992 if (yield != OK && yield != REROUTED)
1993 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router returned unknown value %d",
1996 /* If the yield was REROUTED, the router put a child address on the new chain
1997 as a result of a domain change of some sort (widening, typically). */
1999 if (yield == REROUTED)
2001 HDEBUG(D_route) debug_printf("re-routed to %s\n", addr->address);
2006 /* The only remaining possibility is that the router succeeded. If the
2007 translate_ip_address options is set and host addresses were associated with the
2008 address, run them through the translation. This feature is for weird and
2009 wonderful situations (the amateur packet radio people need it) or very broken
2010 networking, so it is included in the binary only if requested. */
2012 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
2014 GET_OPTION("translate_ip_address");
2015 if (r->translate_ip_address)
2018 int old_pool = store_pool;
2019 for (host_item * h = addr->host_list; h; h = h->next)
2022 uschar *oldaddress, *oldname;
2024 if (!h->address) continue;
2026 deliver_host_address = h->address;
2027 newaddress = expand_string(r->translate_ip_address);
2028 deliver_host_address = NULL;
2032 if (f.expand_string_forcedfail) continue;
2033 addr->basic_errno = ERRNO_EXPANDFAIL;
2034 addr->message = string_sprintf("translate_ip_address expansion "
2035 "failed: %s", expand_string_message);
2040 DEBUG(D_route) debug_printf("%s [%s] translated to %s\n",
2041 h->name, h->address, newaddress);
2042 if (string_is_ip_address(newaddress, NULL) != 0)
2044 h->address = newaddress;
2049 oldaddress = h->address;
2050 h->name = newaddress;
2054 store_pool = POOL_PERM;
2055 rc = host_find_byname(h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, TRUE);
2056 store_pool = old_pool;
2058 if (rc == HOST_FIND_FAILED || rc == HOST_FIND_AGAIN)
2060 addr->basic_errno = ERRNO_UNKNOWNHOST;
2061 addr->message = string_sprintf("host %s not found when "
2062 "translating %s [%s]", h->name, oldname, oldaddress);
2068 #endif /* SUPPORT_TRANSLATE_IP_ADDRESS */
2070 /* See if this is an unseen routing; first expand the option if necessary.
2071 DEFER can be given if the expansion fails */
2073 yield = exp_bool(addr, US"router", rname_l, D_route,
2074 US"unseen", r->unseen, r->expand_unseen, &unseen);
2075 if (yield != OK) goto ROUTE_EXIT;
2077 /* Debugging output recording a successful routing */
2079 HDEBUG(D_route) debug_printf("routed by %s router%s\n", rname_l,
2080 unseen ? " (unseen)" : "");
2084 debug_printf(" envelope to: %s\n", addr->address);
2085 debug_printf(" transport: %s\n", addr->transport
2086 ? addr->transport->drinst.name : US"<none>");
2088 if (addr->prop.errors_address)
2089 debug_printf(" errors to %s\n", addr->prop.errors_address);
2091 for (host_item * h = addr->host_list; h; h = h->next)
2093 debug_printf(" host %s", h->name);
2094 if (h->address) debug_printf(" [%s]", h->address);
2095 if (h->mx >= 0) debug_printf(" MX=%d", h->mx);
2096 else if (h->mx != MX_NONE) debug_printf(" rgroup=%d", h->mx);
2097 if (h->port != PORT_NONE) debug_printf(" port=%d", h->port);
2098 if (h->dnssec != DS_UNK) debug_printf(" dnssec=%s", h->dnssec==DS_YES ? "yes" : "no");
2103 /* Clear any temporary error message set by a router that declined, and handle
2104 the "unseen" option (ignore if there are no further routers). */
2106 addr->message = NULL;
2107 if (unseen && r->drinst.next)
2108 route_unseen(rname_l, addr, paddr_local, paddr_remote, addr_new);
2110 /* Unset the address expansions, and return the final result. */
2113 if (yield == DEFER && addr->message)
2114 addr->message = expand_hide_passwords(addr->message);
2116 deliver_set_expansions(NULL);
2117 driver_srcfile = router_name = NULL; driver_srcline = 0;
2118 f.disable_logging = FALSE;
2124 /* For error messages, a string describing the config location associated
2125 with current processing. NULL if we are not in a router. */
2126 /* Name only, for now */
2129 router_current_name(void)
2131 if (!router_name) return NULL;
2132 return string_sprintf(" (router %s, %s %d)", router_name, driver_srcfile, driver_srcline);
2135 #endif /*!MACRO_PREDEF*/
2136 /* End of route.c */