1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
13 #ifdef HAVE_SETCLASSRESOURCES
14 #include <login_cap.h>
19 /* Options specific to the pipe transport. They must be in alphabetic
20 order (note that "_" comes before the lower case letters). Those starting
21 with "*" are not settable by the user but are used by the option-reading
22 software for alternative value types. Some options are stored in the transport
23 instance block so as to be publicly visible; these are flagged with opt_public.
25 #define LOFF(field) OPT_OFF(pipe_transport_options_block, field)
27 optionlist pipe_transport_options[] = {
28 { "allow_commands", opt_stringptr, LOFF(allow_commands) },
29 { "batch_id", opt_stringptr | opt_public,
30 OPT_OFF(transport_instance, batch_id) },
31 { "batch_max", opt_int | opt_public,
32 OPT_OFF(transport_instance, batch_max) },
33 { "check_string", opt_stringptr, LOFF(check_string) },
34 { "command", opt_stringptr, LOFF(cmd) },
35 { "environment", opt_stringptr, LOFF(environment) },
36 { "escape_string", opt_stringptr, LOFF(escape_string) },
37 { "force_command", opt_bool, LOFF(force_command) },
38 { "freeze_exec_fail", opt_bool, LOFF(freeze_exec_fail) },
39 { "freeze_signal", opt_bool, LOFF(freeze_signal) },
40 { "ignore_status", opt_bool, LOFF(ignore_status) },
41 { "log_defer_output", opt_bool | opt_public,
42 OPT_OFF(transport_instance, log_defer_output) },
43 { "log_fail_output", opt_bool | opt_public,
44 OPT_OFF(transport_instance, log_fail_output) },
45 { "log_output", opt_bool | opt_public,
46 OPT_OFF(transport_instance, log_output) },
47 { "max_output", opt_mkint, LOFF(max_output) },
48 { "message_prefix", opt_stringptr, LOFF(message_prefix) },
49 { "message_suffix", opt_stringptr, LOFF(message_suffix) },
50 { "path", opt_stringptr, LOFF(path) },
51 { "permit_coredump", opt_bool, LOFF(permit_coredump) },
52 { "pipe_as_creator", opt_bool | opt_public,
53 OPT_OFF(transport_instance, deliver_as_creator) },
54 { "restrict_to_path", opt_bool, LOFF(restrict_to_path) },
55 { "return_fail_output",opt_bool | opt_public,
56 OPT_OFF(transport_instance, return_fail_output) },
57 { "return_output", opt_bool | opt_public,
58 OPT_OFF(transport_instance, return_output) },
59 { "temp_errors", opt_stringptr, LOFF(temp_errors) },
60 { "timeout", opt_time, LOFF(timeout) },
61 { "timeout_defer", opt_bool, LOFF(timeout_defer) },
62 { "umask", opt_octint, LOFF(umask) },
63 { "use_bsmtp", opt_bool, LOFF(use_bsmtp) },
64 #ifdef HAVE_SETCLASSRESOURCES
65 { "use_classresources", opt_bool, LOFF(use_classresources) },
67 { "use_crlf", opt_bool, LOFF(use_crlf) },
68 { "use_shell", opt_bool, LOFF(use_shell) },
71 /* Size of the options list. An extern variable has to be used so that its
72 address can appear in the tables drtables.c. */
74 int pipe_transport_options_count =
75 sizeof(pipe_transport_options)/sizeof(optionlist);
81 pipe_transport_options_block pipe_transport_option_defaults = {0};
82 void pipe_transport_init(transport_instance *tblock) {}
83 BOOL pipe_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
85 #else /*!MACRO_PREDEF*/
88 /* Default private options block for the pipe transport. */
90 pipe_transport_options_block pipe_transport_option_defaults = {
92 NULL, /* allow_commands */
93 NULL, /* environment */
94 US"/bin:/usr/bin", /* path */
95 NULL, /* message_prefix (reset in init if not bsmtp) */
96 NULL, /* message_suffix (ditto) */
97 US mac_expanded_string(EX_TEMPFAIL) ":" /* temp_errors */
98 mac_expanded_string(EX_CANTCREAT),
99 NULL, /* check_string */
100 NULL, /* escape_string */
102 20480, /* max_output */
105 FALSE, /* force_command */
106 FALSE, /* freeze_exec_fail */
107 FALSE, /* freeze_signal */
108 FALSE, /* ignore_status */
109 FALSE, /* permit_coredump */
110 FALSE, /* restrict_to_path */
111 FALSE, /* timeout_defer */
112 FALSE, /* use_shell */
113 FALSE, /* use_bsmtp */
114 FALSE, /* use_classresources */
120 /*************************************************
121 * Setup entry point *
122 *************************************************/
124 /* Called for each delivery in the privileged state, just before the uid/gid
125 are changed and the main entry point is called. In a system that supports the
126 login_cap facilities, this function is used to set the class resource limits
127 for the user. It may also re-enable coredumps.
130 tblock points to the transport instance
131 addrlist addresses about to be delivered (not used)
132 dummy not used (doesn't pass back data)
133 uid the uid that will be set (not used)
134 gid the gid that will be set (not used)
135 errmsg where to put an error message
137 Returns: OK, FAIL, or DEFER
141 pipe_transport_setup(transport_instance *tblock, address_item *addrlist,
142 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
144 pipe_transport_options_block *ob =
145 (pipe_transport_options_block *)(tblock->options_block);
147 addrlist = addrlist; /* Keep compiler happy */
154 #ifdef HAVE_SETCLASSRESOURCES
155 if (ob->use_classresources)
157 struct passwd *pw = getpwuid(uid);
160 login_cap_t *lc = login_getpwclass(pw);
163 setclassresources(lc);
171 if (ob->permit_coredump)
174 rl.rlim_cur = RLIM_INFINITY;
175 rl.rlim_max = RLIM_INFINITY;
176 if (setrlimit(RLIMIT_CORE, &rl) < 0)
178 #ifdef SETRLIMIT_NOT_SUPPORTED
179 if (errno != ENOSYS && errno != ENOTSUP)
181 log_write(0, LOG_MAIN,
182 "delivery setrlimit(RLIMIT_CORE, RLIM_INFINITY) failed: %s",
193 /*************************************************
194 * Initialization entry point *
195 *************************************************/
197 /* Called for each instance, after its options have been read, to
198 enable consistency checks to be done, or anything else that needs
202 pipe_transport_init(transport_instance *tblock)
204 pipe_transport_options_block *ob =
205 (pipe_transport_options_block *)(tblock->options_block);
207 /* Set up the setup entry point, to be called in the privileged state */
209 tblock->setup = pipe_transport_setup;
211 /* If pipe_as_creator is set, then uid/gid should not be set. */
213 if (tblock->deliver_as_creator && (tblock->uid_set || tblock->gid_set ||
214 tblock->expand_uid != NULL || tblock->expand_gid != NULL))
215 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
216 "both pipe_as_creator and an explicit uid/gid are set for the %s "
217 "transport", tblock->name);
219 /* If a fixed uid field is set, then a gid field must also be set. */
221 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
222 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
223 "user set without group for the %s transport", tblock->name);
225 /* Temp_errors must consist only of digits and colons, but there can be
226 spaces round the colons, so allow them too. */
228 if (ob->temp_errors != NULL && Ustrcmp(ob->temp_errors, "*") != 0)
230 size_t p = Ustrspn(ob->temp_errors, "0123456789: ");
231 if (ob->temp_errors[p] != 0)
232 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
233 "temp_errors must be a list of numbers or an asterisk for the %s "
234 "transport", tblock->name);
237 /* Only one of return_output/return_fail_output or log_output/log_fail_output
240 if (tblock->return_output && tblock->return_fail_output)
241 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
242 "both return_output and return_fail_output set for %s transport",
245 if (tblock->log_output && tblock->log_fail_output)
246 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
247 "both log_output and log_fail_output set for the %s transport",
250 /* If batch SMTP is set, force the check and escape strings, and arrange that
251 headers are also escaped. */
255 ob->check_string = US".";
256 ob->escape_string = US"..";
257 ob->options |= topt_escape_headers;
260 /* If not batch SMTP, and message_prefix or message_suffix are unset, insert
261 default values for them. */
265 if (ob->message_prefix == NULL) ob->message_prefix =
266 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
267 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
270 /* The restrict_to_path and use_shell options are incompatible */
272 if (ob->restrict_to_path && ob->use_shell)
273 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
274 "both restrict_to_path and use_shell set for %s transport",
277 /* The allow_commands and use_shell options are incompatible */
279 if (ob->allow_commands && ob->use_shell)
280 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
281 "both allow_commands and use_shell set for %s transport",
284 /* Set up the bitwise options for transport_write_message from the various
285 driver options. Only one of body_only and headers_only can be set. */
288 (tblock->body_only? topt_no_headers : 0) |
289 (tblock->headers_only? topt_no_body : 0) |
290 (tblock->return_path_add? topt_add_return_path : 0) |
291 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
292 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
293 (ob->use_crlf? topt_use_crlf : 0);
298 /*************************************************
299 * Set up direct (non-shell) command *
300 *************************************************/
302 /* This function is called when a command line is to be parsed by the transport
303 and executed directly, without the use of /bin/sh.
306 argvptr pointer to anchor for argv vector
307 cmd points to the command string
308 expand_arguments true if expansion is to occur
309 expand_fail error if expansion fails
310 addr chain of addresses
311 tname the transport name
312 ob the transport options block
314 Returns: TRUE if all went well; otherwise an error will be
315 set in the first address and FALSE returned
319 set_up_direct_command(const uschar ***argvptr, uschar *cmd,
320 BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname,
321 pipe_transport_options_block *ob)
323 BOOL permitted = FALSE;
326 /* Set up "transport <name>" to be put in any error messages, and then
327 call the common function for creating an argument list and expanding
328 the items if necessary. If it fails, this function fails (error information
329 is in the addresses). */
331 if (!transport_set_up_command(argvptr, cmd, expand_arguments, expand_fail,
332 addr, string_sprintf("%.50s transport", tname), NULL))
335 /* Point to the set-up arguments. */
339 /* If allow_commands is set, see if the command is in the permitted list. */
341 if (ob->allow_commands)
347 if (!(s = expand_string(ob->allow_commands)))
349 addr->transport_return = DEFER;
350 addr->message = string_sprintf("failed to expand string \"%s\" "
351 "for %s transport: %s", ob->allow_commands, tname, expand_string_message);
355 while ((p = string_nextinlist(&s, &sep, NULL, 0)))
356 if (Ustrcmp(p, argv[0]) == 0) { permitted = TRUE; break; }
359 /* If permitted is TRUE it means the command was found in the allowed list, and
360 no further checks are done. If permitted = FALSE, it either means
361 allow_commands wasn't set, or that the command didn't match anything in the
362 list. In both cases, if restrict_to_path is set, we fail if the command
363 contains any slashes, but if restrict_to_path is not set, we must fail the
364 command only if allow_commands is set. */
368 if (ob->restrict_to_path)
370 if (Ustrchr(argv[0], '/') != NULL)
372 addr->transport_return = FAIL;
373 addr->message = string_sprintf("\"/\" found in \"%s\" (command for %s "
374 "transport) - failed for security reasons", cmd, tname);
379 else if (ob->allow_commands)
381 addr->transport_return = FAIL;
382 addr->message = string_sprintf("\"%s\" command not permitted by %s "
383 "transport", argv[0], tname);
388 /* If the command is not an absolute path, search the PATH directories
391 if (argv[0][0] != '/')
395 const uschar *listptr = expand_string(ob->path);
397 while ((p = string_nextinlist(&listptr, &sep, NULL, 0)))
400 sprintf(CS big_buffer, "%.256s/%.256s", p, argv[0]);
401 if (Ustat(big_buffer, &statbuf) == 0)
403 argv[0] = string_copy(big_buffer);
409 addr->transport_return = FAIL;
410 addr->message = string_sprintf("\"%s\" command not found for %s transport",
420 /*************************************************
421 * Set up shell command *
422 *************************************************/
424 /* This function is called when a command line is to be passed to /bin/sh
425 without parsing inside the transport.
428 argvptr pointer to anchor for argv vector
429 cmd points to the command string
430 expand_arguments true if expansion is to occur
431 expand_fail error if expansion fails
432 addr chain of addresses
433 tname the transport name
435 Returns: TRUE if all went well; otherwise an error will be
436 set in the first address and FALSE returned
440 set_up_shell_command(const uschar ***argvptr, uschar *cmd,
441 BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname)
445 *argvptr = argv = store_get((4)*sizeof(uschar *), FALSE);
447 argv[0] = US"/bin/sh";
450 /* We have to take special action to handle the special "variable" called
451 $pipe_addresses, which is not recognized by the normal expansion function. */
453 if (expand_arguments)
455 uschar * p = Ustrstr(cmd, "pipe_addresses");
459 debug_printf("shell pipe command before expansion:\n %s\n", cmd);
461 /* Allow $recipients in the expansion iff it comes from a system filter */
463 f.enable_dollar_recipients = addr && addr->parent &&
464 Ustrcmp(addr->parent->address, "system-filter") == 0;
467 (p > cmd && p[-1] == '$') ||
468 (p > cmd + 1 && p[-2] == '$' && p[-1] == '{' && p[14] == '}')))
472 if (p[-1] == '{') { q++; p--; }
474 g = string_get(Ustrlen(cmd) + 64);
475 g = string_catn(g, cmd, p - cmd - 1);
477 for (address_item * ad = addr; ad; ad = ad->next)
479 /*XXX string_append_listele() ? */
480 if (ad != addr) g = string_catn(g, US" ", 1);
481 g = string_cat(g, ad->address);
484 g = string_cat(g, q);
485 argv[2] = (cmd = string_from_gstring(g)) ? expand_string(cmd) : NULL;
488 argv[2] = expand_string(cmd);
490 f.enable_dollar_recipients = FALSE;
494 addr->transport_return = f.search_find_defer ? DEFER : expand_fail;
495 addr->message = string_sprintf("Expansion of command \"%s\" "
496 "in %s transport failed: %s",
497 cmd, tname, expand_string_message);
502 debug_printf("shell pipe command after expansion:\n %s\n", argv[2]);
507 debug_printf("shell pipe command (no expansion):\n %s\n", cmd);
518 /*************************************************
520 *************************************************/
522 /* See local README for interface details. This transport always returns FALSE,
523 indicating that the status in the first address is the status for all addresses
527 pipe_transport_entry(
528 transport_instance *tblock, /* data for this instantiation */
529 address_item *addr) /* address(es) we are working on */
532 int fd_in, fd_out, rc;
536 pipe_transport_options_block *ob =
537 (pipe_transport_options_block *)(tblock->options_block);
538 int timeout = ob->timeout;
539 BOOL written_ok = FALSE;
540 BOOL expand_arguments;
543 const uschar *envlist = ob->environment;
545 uschar *eol = ob->use_crlf ? US"\r\n" : US"\n";
546 transport_ctx tctx = {
549 .check_string = ob->check_string,
550 .escape_string = ob->escape_string,
551 ob->options | topt_not_socket /* set at initialization time */
554 DEBUG(D_transport) debug_printf("%s transport entered\n", tblock->name);
556 /* Set up for the good case */
558 addr->transport_return = OK;
559 addr->basic_errno = 0;
561 /* Pipes are not accepted as general addresses, but they can be generated from
562 .forward files or alias files. In those cases, the pfr flag is set, and the
563 command to be obeyed is pointed to by addr->local_part; it starts with the pipe
564 symbol. In other cases, the command is supplied as one of the pipe transport's
567 if (testflag(addr, af_pfr) && addr->local_part[0] == '|')
568 if (ob->force_command)
570 /* Enables expansion of $address_pipe into separate arguments */
571 setflag(addr, af_force_command);
573 expand_arguments = TRUE;
578 cmd = addr->local_part + 1;
579 while (isspace(*cmd)) cmd++;
580 expand_arguments = testflag(addr, af_expand_pipe);
586 expand_arguments = TRUE;
590 /* If no command has been supplied, we are in trouble.
591 * We also check for an empty string since it may be
592 * coming from addr->local_part[0] == '|'
597 addr->transport_return = DEFER;
598 addr->message = string_sprintf("no command specified for %s transport",
604 if (m = is_tainted2(cmd, 0, "Tainted '%s' (command "
605 "for %s transport) not permitted", cmd, tblock->name))
607 addr->transport_return = PANIC;
613 /* When a pipe is set up by a filter file, there may be values for $thisaddress
614 and numerical the variables in existence. These are passed in
615 addr->pipe_expandn for use here. */
617 if (expand_arguments && addr->pipe_expandn)
619 uschar **ss = addr->pipe_expandn;
621 if (*ss) filter_thisaddress = *ss++;
624 expand_nstring[++expand_nmax] = *ss;
625 expand_nlength[expand_nmax] = Ustrlen(*ss++);
629 /* The default way of processing the command is to split it up into arguments
630 here, and run it directly. This offers some security advantages. However, there
631 are installations that want by default to run commands under /bin/sh always, so
632 there is an option to do that. */
636 if (!set_up_shell_command(&argv, cmd, expand_arguments, expand_fail, addr,
637 tblock->name)) return FALSE;
639 else if (!set_up_direct_command(&argv, cmd, expand_arguments, expand_fail, addr,
640 tblock->name, ob)) return FALSE;
642 expand_nmax = -1; /* Reset */
643 filter_thisaddress = NULL;
645 /* Set up the environment for the command. */
647 envp[envcount++] = string_sprintf("LOCAL_PART=%s", deliver_localpart);
648 envp[envcount++] = string_sprintf("LOGNAME=%s", deliver_localpart);
649 envp[envcount++] = string_sprintf("USER=%s", deliver_localpart);
650 envp[envcount++] = string_sprintf("LOCAL_PART_PREFIX=%#s",
651 deliver_localpart_prefix);
652 envp[envcount++] = string_sprintf("LOCAL_PART_SUFFIX=%#s",
653 deliver_localpart_suffix);
654 envp[envcount++] = string_sprintf("DOMAIN=%s", deliver_domain);
655 envp[envcount++] = string_sprintf("HOME=%#s", deliver_home);
656 envp[envcount++] = string_sprintf("MESSAGE_ID=%s", message_id);
657 envp[envcount++] = string_sprintf("PATH=%s", expand_string(ob->path));
658 envp[envcount++] = string_sprintf("RECIPIENT=%#s%#s%#s@%#s",
659 deliver_localpart_prefix, deliver_localpart, deliver_localpart_suffix,
661 envp[envcount++] = string_sprintf("QUALIFY_DOMAIN=%s", qualify_domain_sender);
662 envp[envcount++] = string_sprintf("SENDER=%s", sender_address);
663 envp[envcount++] = US"SHELL=/bin/sh";
665 if (addr->host_list != NULL)
666 envp[envcount++] = string_sprintf("HOST=%s", addr->host_list->name);
668 if (f.timestamps_utc) envp[envcount++] = US"TZ=UTC";
669 else if (timezone_string != NULL && timezone_string[0] != 0)
670 envp[envcount++] = string_sprintf("TZ=%s", timezone_string);
672 /* Add any requested items */
675 if (!(envlist = expand_cstring(envlist)))
677 addr->transport_return = DEFER;
678 addr->message = string_sprintf("failed to expand string \"%s\" "
679 "for %s transport: %s", ob->environment, tblock->name,
680 expand_string_message);
684 while ((ss = string_nextinlist(&envlist, &envsep, NULL, 0)))
686 if (envcount > nelem(envp) - 2)
688 addr->transport_return = DEFER;
689 addr->basic_errno = E2BIG;
690 addr->message = string_sprintf("too many environment settings for "
691 "%s transport", tblock->name);
694 envp[envcount++] = string_copy(ss);
697 envp[envcount] = NULL;
699 /* If the -N option is set, can't do any more. */
704 debug_printf("*** delivery by %s transport bypassed by -N option",
710 /* Handling the output from the pipe is tricky. If a file for catching this
711 output is provided, we could in theory just hand that fd over to the process,
712 but this isn't very safe because it might loop and carry on writing for
713 ever (which is exactly what happened in early versions of Exim). Therefore we
714 use the standard child_open() function, which creates pipes. We can then read
715 our end of the output pipe and count the number of bytes that come through,
716 chopping the sub-process if it exceeds some limit.
718 However, this means we want to run a sub-process with both its input and output
719 attached to pipes. We can't handle that easily from a single parent process
720 using straightforward code such as the transport_write_message() function
721 because the subprocess might not be reading its input because it is trying to
722 write to a full output pipe. The complication of redesigning the world to
723 handle this is too great - simpler just to run another process to do the
724 reading of the output pipe. */
727 /* As this is a local transport, we are already running with the required
728 uid/gid and current directory. Request that the new process be a process group
729 leader, so we can kill it and all its children on a timeout. */
731 if ((pid = child_open(USS argv, envp, ob->umask, &fd_in, &fd_out, TRUE,
732 US"pipe-tpt-cmd")) < 0)
734 addr->transport_return = DEFER;
735 addr->message = string_sprintf(
736 "Failed to create child process for %s transport: %s", tblock->name,
742 /* Now fork a process to handle the output that comes down the pipe. */
744 if ((outpid = exim_fork(US"pipe-tpt-output")) < 0)
746 addr->basic_errno = errno;
747 addr->transport_return = DEFER;
748 addr->message = string_sprintf(
749 "Failed to create process for handling output in %s transport",
756 /* This is the code for the output-handling subprocess. Read from the pipe
757 in chunks, and write to the return file if one is provided. Keep track of
758 the number of bytes handled. If the limit is exceeded, try to kill the
759 subprocess group, and in any case close the pipe and exit, which should cause
760 the subprocess to fail. */
766 set_process_info("reading output from |%s", cmd);
767 while ((rc = read(fd_out, big_buffer, big_buffer_size)) > 0)
769 if (addr->return_file >= 0)
770 if(write(addr->return_file, big_buffer, rc) != rc)
771 DEBUG(D_transport) debug_printf("Problem writing to return_file\n");
773 if (count > ob->max_output)
775 DEBUG(D_transport) debug_printf("Too much output from pipe - killed\n");
776 if (addr->return_file >= 0)
778 uschar *message = US"\n\n*** Too much output - remainder discarded ***\n";
779 rc = Ustrlen(message);
780 if(write(addr->return_file, message, rc) != rc)
781 DEBUG(D_transport) debug_printf("Problem writing to return_file\n");
783 killpg(pid, SIGKILL);
791 (void)close(fd_out); /* Not used in this process */
794 /* Carrying on now with the main parent process. Attempt to write the message
795 to it down the pipe. It is a fallacy to think that you can detect write errors
796 when the sub-process fails to read the pipe. The parent process may complete
797 writing and close the pipe before the sub-process completes. We could sleep a
798 bit here to let the sub-process get going, but it may still not complete. So we
799 ignore all writing errors. (When in the test harness, we do do a short sleep so
800 any debugging output is likely to be in the same order.) */
802 testharness_pause_ms(500);
804 DEBUG(D_transport) debug_printf("Writing message to pipe\n");
806 /* Arrange to time out writes if there is a timeout set. */
810 sigalrm_seen = FALSE;
811 transport_write_timeout = timeout;
814 /* Reset the counter of bytes written */
818 /* First write any configured prefix information */
820 if (ob->message_prefix)
822 uschar *prefix = expand_string(ob->message_prefix);
825 addr->transport_return = f.search_find_defer? DEFER : PANIC;
826 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
827 "transport) failed: %s", ob->message_prefix, tblock->name,
828 expand_string_message);
831 if (!transport_write_block(&tctx, prefix, Ustrlen(prefix), FALSE))
835 /* If the use_bsmtp option is set, we need to write SMTP prefix information.
836 The various different values for batching are handled outside; if there is more
837 than one address available here, all must be included. Force SMTP dot-handling.
842 if (!transport_write_string(fd_in, "MAIL FROM:<%s>%s", return_path, eol))
845 for (address_item * a = addr; a; a = a->next)
846 if (!transport_write_string(fd_in,
848 transport_rcpt_address(a, tblock->rcpt_include_affixes),
852 if (!transport_write_string(fd_in, "DATA%s", eol)) goto END_WRITE;
855 /* Now the actual message */
857 if (!transport_write_message(&tctx, 0))
860 /* Now any configured suffix */
862 if (ob->message_suffix)
864 uschar *suffix = expand_string(ob->message_suffix);
867 addr->transport_return = f.search_find_defer? DEFER : PANIC;
868 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
869 "transport) failed: %s", ob->message_suffix, tblock->name,
870 expand_string_message);
873 if (!transport_write_block(&tctx, suffix, Ustrlen(suffix), FALSE))
877 /* If local_smtp, write the terminating dot. */
879 if (ob->use_bsmtp && !transport_write_string(fd_in, ".%s", eol))
882 /* Flag all writing completed successfully. */
886 /* Come here if there are errors during writing. */
890 /* OK, the writing is now all done. Close the pipe. */
894 /* Handle errors during writing. For timeouts, set the timeout for waiting for
895 the child process to 1 second. If the process at the far end of the pipe died
896 without reading all of it, we expect an EPIPE error, which should be ignored.
897 We used also to ignore WRITEINCOMPLETE but the writing function is now cleverer
898 at handling OS where the death of a pipe doesn't give EPIPE immediately. See
903 if (errno == ETIMEDOUT)
905 addr->message = string_sprintf("%stimeout while writing to pipe",
906 f.transport_filter_timed_out ? "transport filter " : "");
907 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
910 else if (errno == EPIPE)
912 debug_printf("transport error EPIPE ignored\n");
916 addr->transport_return = PANIC;
917 addr->basic_errno = errno;
918 if (errno == ERRNO_CHHEADER_FAIL)
920 string_sprintf("Failed to expand headers_add or headers_remove: %s",
921 expand_string_message);
922 else if (errno == ERRNO_FILTER_FAIL)
923 addr->message = string_sprintf("Transport filter process failed (%d)%s",
925 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
926 else if (errno == ERRNO_WRITEINCOMPLETE)
927 addr->message = US"Failed repeatedly to write data";
929 addr->message = string_sprintf("Error %d", errno);
934 /* Wait for the child process to complete and take action if the returned
935 status is nonzero. The timeout will be just 1 second if any of the writes
938 if ((rc = child_close(pid, timeout)) != 0)
940 uschar * tmsg = addr->message
941 ? string_sprintf(" (preceded by %s)", addr->message) : US"";
943 /* The process did not complete in time; kill its process group and fail
944 the delivery. It appears to be necessary to kill the output process too, as
945 otherwise it hangs on for some time if the actual pipe process is sleeping.
946 (At least, that's what I observed on Solaris 2.5.1.) Since we are failing
947 the delivery, that shouldn't cause any problem. */
951 killpg(pid, SIGKILL);
952 kill(outpid, SIGKILL);
953 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
954 addr->message = string_sprintf("pipe delivery process timed out%s", tmsg);
961 addr->transport_return = PANIC;
962 addr->message = string_sprintf("Wait() failed for child process of %s "
963 "transport: %s%s", tblock->name, strerror(errno), tmsg);
966 /* Since the transport_filter timed out we assume it has sent the child process
967 a malformed or incomplete data stream. Kill off the child process
968 and prevent checking its exit status as it will has probably exited in error.
969 This prevents the transport_filter timeout message from getting overwritten
970 by the exit error which is not the cause of the problem. */
972 else if (f.transport_filter_timed_out)
974 killpg(pid, SIGKILL);
975 kill(outpid, SIGKILL);
978 /* Either the process completed, but yielded a non-zero (necessarily
979 positive) status, or the process was terminated by a signal (rc will contain
980 the negation of the signal number). Treat killing by signal as failure unless
981 status is being ignored. By default, the message is bounced back, unless
982 freeze_signal is set, in which case it is frozen instead. */
986 if (ob->freeze_signal)
988 addr->transport_return = DEFER;
989 addr->special_action = SPECIAL_FREEZE;
990 addr->message = string_sprintf("Child process of %s transport (running "
991 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
992 -rc, os_strsignal(-rc), tmsg);
994 else if (!ob->ignore_status)
996 addr->transport_return = FAIL;
997 addr->message = string_sprintf("Child process of %s transport (running "
998 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
999 -rc, os_strsignal(-rc), tmsg);
1003 /* For positive values (process terminated with non-zero status), we need a
1004 status code to request deferral. A number of systems contain the following
1007 #define EX_TEMPFAIL 75
1009 with the description
1011 EX_TEMPFAIL -- temporary failure, indicating something that
1012 is not really an error. In sendmail, this means
1013 that a mailer (e.g.) could not create a connection,
1014 and the request should be reattempted later.
1016 Based on this, we use exit code EX_TEMPFAIL as a default to mean "defer" when
1017 not ignoring the returned status. However, there is now an option that
1018 contains a list of temporary codes, with TEMPFAIL and CANTCREAT as defaults.
1020 Another case that needs special treatment is if execve() failed (typically
1021 the command that was given is a non-existent path). By default this is
1022 treated as just another failure, but if freeze_exec_fail is set, the reaction
1023 is to freeze the message rather than bounce the address. Exim used to signal
1024 this failure with EX_UNAVAILABLE, which is defined in many systems as
1026 #define EX_UNAVAILABLE 69
1028 with the description
1030 EX_UNAVAILABLE -- A service is unavailable. This can occur
1031 if a support program or file does not exist. This
1032 can also be used as a catchall message when something
1033 you wanted to do doesn't work, but you don't know why.
1035 However, this can be confused with a command that actually returns 69 because
1036 something *it* wanted is unavailable. At release 4.21, Exim was changed to
1037 use return code 127 instead, because this is what the shell returns when it
1038 is unable to exec a command. We define it as EX_EXECFAILED, and use it in
1039 child.c to signal execve() failure and other unexpected failures such as
1040 setuid() not working - though that won't be the case here because we aren't
1045 /* Always handle execve() failure specially if requested to */
1047 if (ob->freeze_exec_fail && rc == EX_EXECFAILED)
1049 addr->transport_return = DEFER;
1050 addr->special_action = SPECIAL_FREEZE;
1051 addr->message = string_sprintf("pipe process failed to exec \"%s\"%s",
1055 /* Otherwise take action only if not ignoring status */
1057 else if (!ob->ignore_status)
1062 /* If temp_errors is "*" all codes are temporary. Initialization checks
1063 that it's either "*" or a list of numbers. If not "*", scan the list of
1064 temporary failure codes; if any match, the result is DEFER. */
1066 if (ob->temp_errors[0] == '*')
1067 addr->transport_return = DEFER;
1071 const uschar *s = ob->temp_errors;
1075 addr->transport_return = FAIL;
1076 while ((p = string_nextinlist(&s,&sep,NULL,0)))
1077 if (rc == Uatoi(p)) { addr->transport_return = DEFER; break; }
1080 /* Ensure the message contains the expanded command and arguments. This
1081 doesn't have to be brilliantly efficient - it is an error situation. */
1083 addr->message = string_sprintf("Child process of %s transport returned "
1084 "%d", tblock->name, rc);
1085 g = string_cat(NULL, addr->message);
1087 /* If the return code is > 128, it often means that a shell command
1088 was terminated by a signal. */
1091 string_sprintf("(could mean shell command ended by signal %d (%s))",
1092 rc-128, os_strsignal(rc-128)) :
1097 g = string_catn(g, US" ", 1);
1098 g = string_cat (g, ss);
1101 /* Now add the command and arguments */
1103 g = string_catn(g, US" from command:", 14);
1105 for (int i = 0; i < sizeof(argv)/sizeof(int *) && argv[i] != NULL; i++)
1108 g = string_catn(g, US" ", 1);
1109 if (Ustrpbrk(argv[i], " \t") != NULL)
1112 g = string_catn(g, US"\"", 1);
1114 g = string_cat(g, argv[i]);
1116 g = string_catn(g, US"\"", 1);
1119 /* Add previous filter timeout message, if present. */
1122 g = string_cat(g, tmsg);
1124 addr->message = string_from_gstring(g);
1129 /* Ensure all subprocesses (in particular, the output handling process)
1130 are complete before we pass this point. */
1132 while (wait(&rc) >= 0);
1134 DEBUG(D_transport) debug_printf("%s transport yielded %d\n", tblock->name,
1135 addr->transport_return);
1137 /* If there has been a problem, the message in addr->message contains details
1138 of the pipe command. We don't want to expose these to the world, so we set up
1139 something bland to return to the sender. */
1141 if (addr->transport_return != OK)
1142 addr->user_message = US"local delivery failed";
1147 #endif /*!MACRO_PREDEF*/
1148 /* End of transport/pipe.c */