1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* This module contains code for extracting addresses from a forwarding list
9 (from an alias or forward file) or by running the filter interpreter. It may do
10 this in a sub-process if a uid/gid are supplied. */
15 enum { FILE_EXIST, FILE_NOT_EXIST, FILE_EXIST_UNCLEAR };
17 #define REPLY_EXISTS 0x01
18 #define REPLY_EXPAND 0x02
19 #define REPLY_RETURN 0x04
22 /*************************************************
23 * Check string for filter program *
24 *************************************************/
26 /* This function checks whether a string is actually a filter program. The rule
27 is that it must start with "# Exim filter ..." (any capitalization, spaces
28 optional). It is envisaged that in future, other kinds of filter may be
29 implemented. That's why it is implemented the way it is. The function is global
30 because it is also called from filter.c when checking filters.
34 Returns: FILTER_EXIM if it starts with "# Exim filter"
35 FILTER_SIEVE if it starts with "# Sieve filter"
36 FILTER_FORWARD otherwise
39 /* This is an auxiliary function for matching a tag. */
42 match_tag(const uschar *s, const uschar *tag)
44 for (; *tag != 0; s++, tag++)
47 while (*s == ' ' || *s == '\t') s++;
51 if (tolower(*s) != tolower(*tag)) break;
56 /* This is the real function. It should be easy to add checking different
57 tags for other types of filter. */
60 rda_is_filter(const uschar *s)
62 while (isspace(*s)) s++; /* Skips initial blank lines */
63 if (match_tag(s, CUS"# exim filter")) return FILTER_EXIM;
64 else if (match_tag(s, CUS"# sieve filter")) return FILTER_SIEVE;
65 else return FILTER_FORWARD;
71 /*************************************************
72 * Check for existence of file *
73 *************************************************/
75 /* First of all, we stat the file. If this fails, we try to stat the enclosing
76 directory, because a file in an unmounted NFS directory will look the same as a
77 non-existent file. It seems that in Solaris 2.6, statting an entry in an
78 indirect map that is currently unmounted does not cause the mount to happen.
79 Instead, dummy data is returned, which defeats the whole point of this test.
80 However, if a stat() is done on some object inside the directory, such as the
81 "." back reference to itself, then the mount does occur. If an NFS host is
82 taken offline, it is possible for the stat() to get stuck until it comes back.
83 To guard against this, stick a timer round it. If we can't access the "."
84 inside the directory, try the plain directory, just in case that helps.
87 filename the file name
88 error for message on error
90 Returns: FILE_EXIST the file exists
91 FILE_NOT_EXIST the file does not exist
92 FILE_EXIST_UNCLEAR cannot determine existence
96 rda_exists(uschar *filename, uschar **error)
102 if ((rc = Ustat(filename, &statbuf)) >= 0) return FILE_EXIST;
105 Ustrncpy(big_buffer, filename, big_buffer_size - 3);
106 sigalrm_seen = FALSE;
108 if (saved_errno == ENOENT)
110 slash = Ustrrchr(big_buffer, '/');
111 Ustrcpy(slash+1, ".");
114 rc = Ustat(big_buffer, &statbuf);
115 if (rc != 0 && errno == EACCES && !sigalrm_seen)
118 rc = Ustat(big_buffer, &statbuf);
123 DEBUG(D_route) debug_printf("stat(%s)=%d\n", big_buffer, rc);
126 if (sigalrm_seen || rc != 0)
128 *error = string_sprintf("failed to stat %s (%s)", big_buffer,
129 sigalrm_seen? "timeout" : strerror(saved_errno));
130 return FILE_EXIST_UNCLEAR;
133 *error = string_sprintf("%s does not exist", filename);
134 DEBUG(D_route) debug_printf("%s\n", *error);
135 return FILE_NOT_EXIST;
140 /*************************************************
141 * Get forwarding list from a file *
142 *************************************************/
144 /* Open a file and read its entire contents into a block of memory. Certain
145 opening errors are optionally treated the same as "file does not exist".
147 ENOTDIR means that something along the line is not a directory: there are
148 installations that set home directories to be /dev/null for non-login accounts
149 but in normal circumstances this indicates some kind of configuration error.
151 EACCES means there's a permissions failure. Some users turn off read permission
152 on a .forward file to suspend forwarding, but this is probably an error in any
153 kind of mailing list processing.
155 The redirect block that contains the file name also contains constraints such
156 as who may own the file, and mode bits that must not be set. This function is
159 rdata rdirect block, containing file name and constraints
160 options for the RDO_ENOTDIR and RDO_EACCES options
161 error where to put an error message
162 yield what to return from rda_interpret on error
164 Returns: pointer to string in store; NULL on error
168 rda_get_file_contents(redirect_block *rdata, int options, uschar **error,
173 uschar *filename = rdata->string;
174 BOOL uid_ok = !rdata->check_owner;
175 BOOL gid_ok = !rdata->check_group;
178 /* Attempt to open the file. If it appears not to exist, check up on the
179 containing directory by statting it. If the directory does not exist, we treat
180 this situation as an error (which will cause delivery to defer); otherwise we
181 pass back FF_NONEXIST, which causes the redirect router to decline.
183 However, if the ignore_enotdir option is set (to ignore "something on the
184 path is not a directory" errors), the right behaviour seems to be not to do the
187 fwd = Ufopen(filename, "rb");
192 case ENOENT: /* File does not exist */
193 DEBUG(D_route) debug_printf("%s does not exist\n%schecking parent directory\n",
195 ((options & RDO_ENOTDIR) != 0)? "ignore_enotdir set => skip " : "");
196 *yield = (((options & RDO_ENOTDIR) != 0) ||
197 rda_exists(filename, error) == FILE_NOT_EXIST)?
198 FF_NONEXIST : FF_ERROR;
201 case ENOTDIR: /* Something on the path isn't a directory */
202 if ((options & RDO_ENOTDIR) == 0) goto DEFAULT_ERROR;
203 DEBUG(D_route) debug_printf("non-directory on path %s: file assumed not to "
204 "exist\n", filename);
205 *yield = FF_NONEXIST;
208 case EACCES: /* Permission denied */
209 if ((options & RDO_EACCES) == 0) goto DEFAULT_ERROR;
210 DEBUG(D_route) debug_printf("permission denied for %s: file assumed not to "
211 "exist\n", filename);
212 *yield = FF_NONEXIST;
217 *error = string_open_failed(errno, "%s", filename);
223 /* Check that we have a regular file. */
225 if (fstat(fileno(fwd), &statbuf) != 0)
227 *error = string_sprintf("failed to stat %s: %s", filename, strerror(errno));
231 if ((statbuf.st_mode & S_IFMT) != S_IFREG)
233 *error = string_sprintf("%s is not a regular file", filename);
237 /* Check for unwanted mode bits */
239 if ((statbuf.st_mode & rdata->modemask) != 0)
241 *error = string_sprintf("bad mode (0%o) for %s: 0%o bit(s) unexpected",
242 statbuf.st_mode, filename, statbuf.st_mode & rdata->modemask);
246 /* Check the file owner and file group if required to do so. */
250 if (rdata->pw != NULL && statbuf.st_uid == rdata->pw->pw_uid)
252 else if (rdata->owners != NULL)
253 for (int i = 1; i <= (int)(rdata->owners[0]); i++)
254 if (rdata->owners[i] == statbuf.st_uid) { uid_ok = TRUE; break; }
259 if (rdata->pw != NULL && statbuf.st_gid == rdata->pw->pw_gid)
261 else if (rdata->owngroups != NULL)
262 for (int i = 1; i <= (int)(rdata->owngroups[0]); i++)
263 if (rdata->owngroups[i] == statbuf.st_gid) { gid_ok = TRUE; break; }
266 if (!uid_ok || !gid_ok)
268 *error = string_sprintf("bad %s for %s", uid_ok? "group" : "owner", filename);
272 /* Put an upper limit on the size of the file, just to stop silly people
273 feeding in ridiculously large files, which can easily be created by making
274 files that have holes in them. */
276 if (statbuf.st_size > MAX_FILTER_SIZE)
278 *error = string_sprintf("%s is too big (max %d)", filename, MAX_FILTER_SIZE);
282 /* Read the file in one go in order to minimize the time we have it open. */
284 filebuf = store_get(statbuf.st_size + 1);
286 if (fread(filebuf, 1, statbuf.st_size, fwd) != statbuf.st_size)
288 *error = string_sprintf("error while reading %s: %s",
289 filename, strerror(errno));
292 filebuf[statbuf.st_size] = 0;
295 debug_printf(OFF_T_FMT " bytes read from %s\n", statbuf.st_size, filename);
300 /* Return an error: the string is already set up. */
310 /*************************************************
311 * Extract info from list or filter *
312 *************************************************/
314 /* This function calls the appropriate function to extract addresses from a
315 forwarding list, or to run a filter file and get addresses from there.
318 rdata the redirection block
319 options the options bits
320 include_directory restrain to this directory
321 sieve_vacation_directory passed to sieve_interpret
322 sieve_enotify_mailto_owner passed to sieve_interpret
323 sieve_useraddress passed to sieve_interpret
324 sieve_subaddress passed to sieve_interpret
325 generated where to hang generated addresses
326 error for error messages
327 eblockp for details of skipped syntax errors
329 filtertype set to the filter type:
330 FILTER_FORWARD => a traditional .forward file
331 FILTER_EXIM => an Exim filter file
332 FILTER_SIEVE => a Sieve filter file
333 a system filter is always forced to be FILTER_EXIM
335 Returns: a suitable return for rda_interpret()
339 rda_extract(redirect_block *rdata, int options, uschar *include_directory,
340 uschar *sieve_vacation_directory, uschar *sieve_enotify_mailto_owner,
341 uschar *sieve_useraddress, uschar *sieve_subaddress,
342 address_item **generated, uschar **error, error_block **eblockp,
350 data = rda_get_file_contents(rdata, options, error, &yield);
351 if (data == NULL) return yield;
353 else data = rdata->string;
355 *filtertype = f.system_filtering ? FILTER_EXIM : rda_is_filter(data);
357 /* Filter interpretation is done by a general function that is also called from
358 the filter testing option (-bf). There are two versions: one for Exim filtering
359 and one for Sieve filtering. Several features of string expansion may be locked
360 out at sites that don't trust users. This is done by setting flags in
361 expand_forbid that the expander inspects. */
363 if (*filtertype != FILTER_FORWARD)
366 int old_expand_forbid = expand_forbid;
368 DEBUG(D_route) debug_printf("data is %s filter program\n",
369 (*filtertype == FILTER_EXIM)? "an Exim" : "a Sieve");
371 /* RDO_FILTER is an "allow" bit */
373 if ((options & RDO_FILTER) == 0)
375 *error = US"filtering not enabled";
380 (expand_forbid & ~RDO_FILTER_EXPANSIONS) |
381 (options & RDO_FILTER_EXPANSIONS);
383 /* RDO_{EXIM,SIEVE}_FILTER are forbid bits */
385 if (*filtertype == FILTER_EXIM)
387 if ((options & RDO_EXIM_FILTER) != 0)
389 *error = US"Exim filtering not enabled";
392 frc = filter_interpret(data, options, generated, error);
396 if ((options & RDO_SIEVE_FILTER) != 0)
398 *error = US"Sieve filtering not enabled";
401 frc = sieve_interpret(data, options, sieve_vacation_directory,
402 sieve_enotify_mailto_owner, sieve_useraddress, sieve_subaddress,
406 expand_forbid = old_expand_forbid;
410 /* Not a filter script */
412 DEBUG(D_route) debug_printf("file is not a filter file\n");
414 return parse_forward_list(data,
415 options, /* specials that are allowed */
416 generated, /* where to hang them */
417 error, /* for errors */
418 deliver_domain, /* to qualify \name */
419 include_directory, /* restrain to directory */
420 eblockp); /* for skipped syntax errors */
426 /*************************************************
427 * Write string down pipe *
428 *************************************************/
430 /* This function is used for transferring a string down a pipe between
431 processes. If the pointer is NULL, a length of zero is written.
437 Returns: -1 on error, else 0
441 rda_write_string(int fd, const uschar *s)
443 int len = (s == NULL)? 0 : Ustrlen(s) + 1;
444 return ( write(fd, &len, sizeof(int)) != sizeof(int)
445 || (s != NULL && write(fd, s, len) != len)
452 /*************************************************
453 * Read string from pipe *
454 *************************************************/
456 /* This function is used for receiving a string from a pipe.
460 sp where to put the string
462 Returns: FALSE if data missing
466 rda_read_string(int fd, uschar **sp)
470 if (read(fd, &len, sizeof(int)) != sizeof(int)) return FALSE;
474 /* We know we have enough memory so disable the error on "len" */
475 /* coverity[tainted_data] */
476 if (read(fd, *sp = store_get(len), len) != len) return FALSE;
482 /*************************************************
483 * Interpret forward list or filter *
484 *************************************************/
486 /* This function is passed a forward list string (unexpanded) or the name of a
487 file (unexpanded) whose contents are the forwarding list. The list may in fact
488 be a filter program if it starts with "#Exim filter" or "#Sieve filter". Other
489 types of filter, with different inital tag strings, may be introduced in due
492 The job of the function is to process the forwarding list or filter. It is
493 pulled out into this separate function, because it is used for system filter
494 files as well as from the redirect router.
496 If the function is given a uid/gid, it runs a subprocess that passes the
497 results back via a pipe. This provides security for things like :include:s in
498 users' .forward files, and "logwrite" calls in users' filter files. A
499 sub-process is NOT used when:
501 . No uid/gid is provided
502 . The input is a string which is not a filter string, and does not contain
504 . The input is a file whose non-existence can be detected in the main
505 process (which is usually running as root).
508 rdata redirect data (file + constraints, or data string)
509 options options to pass to the extraction functions,
510 plus ENOTDIR and EACCES handling bits
511 include_directory restrain :include: to this directory
512 sieve_vacation_directory directory passed to sieve_interpret
513 sieve_enotify_mailto_owner passed to sieve_interpret
514 sieve_useraddress passed to sieve_interpret
515 sieve_subaddress passed to sieve_interpret
516 ugid uid/gid to run under - if NULL, no change
517 generated where to hang generated addresses, initially NULL
518 error pointer for error message
519 eblockp for skipped syntax errors; NULL if no skipping
520 filtertype set to the type of file:
521 FILTER_FORWARD => traditional .forward file
522 FILTER_EXIM => an Exim filter file
523 FILTER_SIEVE => a Sieve filter file
524 a system filter is always forced to be FILTER_EXIM
525 rname router name for error messages in the format
526 "xxx router" or "system filter"
528 Returns: values from extraction function, or FF_NONEXIST:
529 FF_DELIVERED success, a significant action was taken
530 FF_NOTDELIVERED success, no significant action
531 FF_BLACKHOLE :blackhole:
532 FF_DEFER defer requested
533 FF_FAIL fail requested
534 FF_INCLUDEFAIL some problem with :include:
535 FF_FREEZE freeze requested
536 FF_ERROR there was a problem
537 FF_NONEXIST the file does not exist
541 rda_interpret(redirect_block *rdata, int options, uschar *include_directory,
542 uschar *sieve_vacation_directory, uschar *sieve_enotify_mailto_owner,
543 uschar *sieve_useraddress, uschar *sieve_subaddress, ugid_block *ugid,
544 address_item **generated, uschar **error, error_block **eblockp,
545 int *filtertype, uschar *rname)
549 BOOL had_disaster = FALSE;
552 uschar *readerror = US"";
553 void (*oldsignal)(int);
555 DEBUG(D_route) debug_printf("rda_interpret (%s): %s\n",
556 (rdata->isfile)? "file" : "string", rdata->string);
558 /* Do the expansions of the file name or data first, while still privileged. */
560 data = expand_string(rdata->string);
563 if (f.expand_string_forcedfail) return FF_NOTDELIVERED;
564 *error = string_sprintf("failed to expand \"%s\": %s", rdata->string,
565 expand_string_message);
568 rdata->string = data;
570 DEBUG(D_route) debug_printf("expanded: %s\n", data);
572 if (rdata->isfile && data[0] != '/')
574 *error = string_sprintf("\"%s\" is not an absolute path", data);
578 /* If no uid/gid are supplied, or if we have a data string which does not start
579 with #Exim filter or #Sieve filter, and does not contain :include:, do all the
580 work in this process. Note that for a system filter, we always have a file, so
581 the work is done in this process only if no user is supplied. */
583 if (!ugid->uid_set || /* Either there's no uid, or */
584 (!rdata->isfile && /* We've got the data, and */
585 rda_is_filter(data) == FILTER_FORWARD && /* It's not a filter script, */
586 Ustrstr(data, ":include:") == NULL)) /* and there's no :include: */
588 return rda_extract(rdata, options, include_directory,
589 sieve_vacation_directory, sieve_enotify_mailto_owner, sieve_useraddress,
590 sieve_subaddress, generated, error, eblockp, filtertype);
593 /* We need to run the processing code in a sub-process. However, if we can
594 determine the non-existence of a file first, we can decline without having to
595 create the sub-process. */
597 if (rdata->isfile && rda_exists(data, error) == FILE_NOT_EXIST)
600 /* If the file does exist, or we can't tell (non-root mounted NFS directory)
601 we have to create the subprocess to do everything as the given user. The
602 results of processing are passed back via a pipe. */
605 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "creation of pipe for filter or "
606 ":include: failed for %s: %s", rname, strerror(errno));
608 /* Ensure that SIGCHLD is set to SIG_DFL before forking, so that the child
609 process can be waited for. We sometimes get here with it set otherwise. Save
610 the old state for resetting on the wait. Ensure that all cached resources are
611 freed so that the subprocess starts with a clean slate and doesn't interfere
612 with the parent process. */
614 oldsignal = signal(SIGCHLD, SIG_DFL);
617 if ((pid = fork()) == 0)
619 header_line *waslast = header_last; /* Save last header */
621 fd = pfd[pipe_write];
622 (void)close(pfd[pipe_read]);
623 exim_setugid(ugid->uid, ugid->gid, FALSE, rname);
625 /* Addresses can get rewritten in filters; if we are not root or the exim
626 user (and we probably are not), turn off rewrite logging, because we cannot
627 write to the log now. */
629 if (ugid->uid != root_uid && ugid->uid != exim_uid)
631 DEBUG(D_rewrite) debug_printf("turned off address rewrite logging (not "
632 "root or exim in this process)\n");
633 BIT_CLEAR(log_selector, log_selector_size, Li_address_rewrite);
636 /* Now do the business */
638 yield = rda_extract(rdata, options, include_directory,
639 sieve_vacation_directory, sieve_enotify_mailto_owner, sieve_useraddress,
640 sieve_subaddress, generated, error, eblockp, filtertype);
642 /* Pass back whether it was a filter, and the return code and any overall
643 error text via the pipe. */
645 if ( write(fd, filtertype, sizeof(int)) != sizeof(int)
646 || write(fd, &yield, sizeof(int)) != sizeof(int)
647 || rda_write_string(fd, *error) != 0
651 /* Pass back the contents of any syntax error blocks if we have a pointer */
655 for (error_block * ep = *eblockp; ep; ep = ep->next)
656 if ( rda_write_string(fd, ep->text1) != 0
657 || rda_write_string(fd, ep->text2) != 0
660 if (rda_write_string(fd, NULL) != 0) /* Indicates end of eblocks */
664 /* If this is a system filter, we have to pass back the numbers of any
665 original header lines that were removed, and then any header lines that were
666 added but not subsequently removed. */
668 if (f.system_filtering)
671 for (header_line * h = header_list; h != waslast->next; i++, h = h->next)
672 if ( h->type == htype_old
673 && write(fd, &i, sizeof(i)) != sizeof(i)
678 if (write(fd, &i, sizeof(i)) != sizeof(i))
681 while (waslast != header_last)
683 waslast = waslast->next;
684 if (waslast->type != htype_old)
685 if ( rda_write_string(fd, waslast->text) != 0
686 || write(fd, &(waslast->type), sizeof(waslast->type))
687 != sizeof(waslast->type)
691 if (rda_write_string(fd, NULL) != 0) /* Indicates end of added headers */
695 /* Write the contents of the $n variables */
697 if (write(fd, filter_n, sizeof(filter_n)) != sizeof(filter_n))
700 /* If the result was DELIVERED or NOTDELIVERED, we pass back the generated
701 addresses, and their associated information, through the pipe. This is
702 just tedious, but it seems to be the only safe way. We do this also for
703 FAIL and FREEZE, because a filter is allowed to set up deliveries that
704 are honoured before freezing or failing. */
706 if (yield == FF_DELIVERED || yield == FF_NOTDELIVERED ||
707 yield == FF_FAIL || yield == FF_FREEZE)
709 for (address_item * addr = *generated; addr; addr = addr->next)
711 int reply_options = 0;
712 int ig_err = addr->prop.ignore_error ? 1 : 0;
714 if ( rda_write_string(fd, addr->address) != 0
715 || write(fd, &addr->mode, sizeof(addr->mode)) != sizeof(addr->mode)
716 || write(fd, &addr->flags, sizeof(addr->flags)) != sizeof(addr->flags)
717 || rda_write_string(fd, addr->prop.errors_address) != 0
718 || write(fd, &ig_err, sizeof(ig_err)) != sizeof(ig_err)
722 if (addr->pipe_expandn)
723 for (uschar ** pp = addr->pipe_expandn; *pp; pp++)
724 if (rda_write_string(fd, *pp) != 0)
726 if (rda_write_string(fd, NULL) != 0)
731 if (write(fd, &reply_options, sizeof(int)) != sizeof(int)) /* 0 means no reply */
736 reply_options |= REPLY_EXISTS;
737 if (addr->reply->file_expand) reply_options |= REPLY_EXPAND;
738 if (addr->reply->return_message) reply_options |= REPLY_RETURN;
739 if ( write(fd, &reply_options, sizeof(int)) != sizeof(int)
740 || write(fd, &(addr->reply->expand_forbid), sizeof(int))
742 || write(fd, &(addr->reply->once_repeat), sizeof(time_t))
744 || rda_write_string(fd, addr->reply->to) != 0
745 || rda_write_string(fd, addr->reply->cc) != 0
746 || rda_write_string(fd, addr->reply->bcc) != 0
747 || rda_write_string(fd, addr->reply->from) != 0
748 || rda_write_string(fd, addr->reply->reply_to) != 0
749 || rda_write_string(fd, addr->reply->subject) != 0
750 || rda_write_string(fd, addr->reply->headers) != 0
751 || rda_write_string(fd, addr->reply->text) != 0
752 || rda_write_string(fd, addr->reply->file) != 0
753 || rda_write_string(fd, addr->reply->logfile) != 0
754 || rda_write_string(fd, addr->reply->oncelog) != 0
760 if (rda_write_string(fd, NULL) != 0) /* Marks end of addresses */
764 /* OK, this process is now done. Free any cached resources. Must use _exit()
773 DEBUG(D_rewrite) debug_printf("rda_interpret: failed write to pipe\n");
777 /* Back in the main process: panic if the fork did not succeed. */
780 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "fork failed for %s", rname);
782 /* Read the pipe to get the data from the filter/forward. Our copy of the
783 writing end must be closed first, as otherwise read() won't return zero on an
784 empty pipe. Afterwards, close the reading end. */
786 (void)close(pfd[pipe_write]);
788 /* Read initial data, including yield and contents of *error */
791 if (read(fd, filtertype, sizeof(int)) != sizeof(int) ||
792 read(fd, &yield, sizeof(int)) != sizeof(int) ||
793 !rda_read_string(fd, error)) goto DISASTER;
795 /* Read the contents of any syntax error blocks if we have a pointer */
800 for (error_block ** p = eblockp; ; p = &e->next)
803 if (!rda_read_string(fd, &s)) goto DISASTER;
805 e = store_get(sizeof(error_block));
808 if (!rda_read_string(fd, &s)) goto DISASTER;
814 /* If this is a system filter, read the identify of any original header lines
815 that were removed, and then read data for any new ones that were added. */
817 if (f.system_filtering)
820 header_line *h = header_list;
825 if (read(fd, &n, sizeof(int)) != sizeof(int)) goto DISASTER;
830 if (!(h = h->next)) goto DISASTER_NO_HEADER;
839 if (!rda_read_string(fd, &s)) goto DISASTER;
841 if (read(fd, &type, sizeof(type)) != sizeof(type)) goto DISASTER;
842 header_add(type, "%s", s);
846 /* Read the values of the $n variables */
848 if (read(fd, filter_n, sizeof(filter_n)) != sizeof(filter_n)) goto DISASTER;
850 /* If the yield is DELIVERED, NOTDELIVERED, FAIL, or FREEZE there may follow
851 addresses and data to go with them. Keep them in the same order in the
854 if (yield == FF_DELIVERED || yield == FF_NOTDELIVERED ||
855 yield == FF_FAIL || yield == FF_FREEZE)
857 address_item **nextp = generated;
861 int i, reply_options;
864 uschar *expandn[EXPAND_MAXN + 2];
866 /* First string is the address; NULL => end of addresses */
868 if (!rda_read_string(fd, &recipient)) goto DISASTER;
869 if (recipient == NULL) break;
871 /* Hang on the end of the chain */
873 addr = deliver_make_addr(recipient, FALSE);
875 nextp = &(addr->next);
877 /* Next comes the mode and the flags fields */
879 if ( read(fd, &addr->mode, sizeof(addr->mode)) != sizeof(addr->mode)
880 || read(fd, &addr->flags, sizeof(addr->flags)) != sizeof(addr->flags)
881 || !rda_read_string(fd, &addr->prop.errors_address)
882 || read(fd, &i, sizeof(i)) != sizeof(i)
885 addr->prop.ignore_error = (i != 0);
887 /* Next comes a possible setting for $thisaddress and any numerical
888 variables for pipe expansion, terminated by a NULL string. The maximum
889 number of numericals is EXPAND_MAXN. Note that we put filter_thisaddress
890 into the zeroth item in the vector - this is sorted out inside the pipe
893 for (i = 0; i < EXPAND_MAXN + 1; i++)
896 if (!rda_read_string(fd, &temp)) goto DISASTER;
897 if (i == 0) filter_thisaddress = temp; /* Just in case */
899 if (temp == NULL) break;
904 addr->pipe_expandn = store_get((i+1) * sizeof(uschar *));
905 addr->pipe_expandn[i] = NULL;
906 while (--i >= 0) addr->pipe_expandn[i] = expandn[i];
909 /* Then an int containing reply options; zero => no reply data. */
911 if (read(fd, &reply_options, sizeof(int)) != sizeof(int)) goto DISASTER;
912 if ((reply_options & REPLY_EXISTS) != 0)
914 addr->reply = store_get(sizeof(reply_item));
916 addr->reply->file_expand = (reply_options & REPLY_EXPAND) != 0;
917 addr->reply->return_message = (reply_options & REPLY_RETURN) != 0;
919 if (read(fd,&(addr->reply->expand_forbid),sizeof(int)) !=
921 read(fd,&(addr->reply->once_repeat),sizeof(time_t)) !=
923 !rda_read_string(fd, &(addr->reply->to)) ||
924 !rda_read_string(fd, &(addr->reply->cc)) ||
925 !rda_read_string(fd, &(addr->reply->bcc)) ||
926 !rda_read_string(fd, &(addr->reply->from)) ||
927 !rda_read_string(fd, &(addr->reply->reply_to)) ||
928 !rda_read_string(fd, &(addr->reply->subject)) ||
929 !rda_read_string(fd, &(addr->reply->headers)) ||
930 !rda_read_string(fd, &(addr->reply->text)) ||
931 !rda_read_string(fd, &(addr->reply->file)) ||
932 !rda_read_string(fd, &(addr->reply->logfile)) ||
933 !rda_read_string(fd, &(addr->reply->oncelog)))
939 /* All data has been transferred from the sub-process. Reap it, close the
940 reading end of the pipe, and we are done. */
943 while ((rc = wait(&status)) != pid)
945 if (rc < 0 && errno == ECHILD) /* Process has vanished */
947 log_write(0, LOG_MAIN, "redirection process %d vanished unexpectedly", pid);
953 debug_printf("rda_interpret: subprocess yield=%d error=%s\n", yield, *error);
957 *error = string_sprintf("internal problem in %s: failure to transfer "
958 "data from subprocess: status=%04x%s%s%s", rname,
960 (*error == NULL)? US"" : US": error=",
961 (*error == NULL)? US"" : *error);
962 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *error);
964 else if (status != 0)
966 log_write(0, LOG_MAIN|LOG_PANIC, "internal problem in %s: unexpected status "
967 "%04x from redirect subprocess (but data correctly received)", rname,
973 signal(SIGCHLD, oldsignal); /* restore */
977 /* Come here if the data indicates removal of a header that we can't find */
980 readerror = US" readerror=bad header identifier";
985 /* Come here is there's a shambles in transferring the data over the pipe. The
986 value of errno should still be set. */
989 readerror = string_sprintf(" readerror='%s'", strerror(errno));