1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
10 /* Functions concerned with routing, and the list of generic router options. */
17 /* Generic options for routers, all of which live inside router_instance
18 data blocks and which therefore have the opt_public flag set. */
19 #define LOFF(field) OPT_OFF(router_instance, field)
21 optionlist optionlist_routers[] = {
22 { "*expand_group", opt_stringptr | opt_hidden | opt_public,
24 { "*expand_more", opt_stringptr | opt_hidden | opt_public,
26 { "*expand_unseen", opt_stringptr | opt_hidden | opt_public,
27 LOFF(expand_unseen) },
28 { "*expand_user", opt_stringptr | opt_hidden | opt_public,
30 { "*set_group", opt_bool | opt_hidden | opt_public,
32 { "*set_user", opt_bool | opt_hidden | opt_public,
34 { "address_data", opt_stringptr|opt_public,
36 { "address_test", opt_bool|opt_public,
38 #ifdef EXPERIMENTAL_BRIGHTMAIL
39 { "bmi_deliver_alternate", opt_bool | opt_public,
40 LOFF(bmi_deliver_alternate) },
41 { "bmi_deliver_default", opt_bool | opt_public,
42 LOFF(bmi_deliver_default) },
43 { "bmi_dont_deliver", opt_bool | opt_public,
44 LOFF(bmi_dont_deliver) },
45 { "bmi_rule", opt_stringptr|opt_public,
48 { "cannot_route_message", opt_stringptr | opt_public,
49 LOFF(cannot_route_message) },
50 { "caseful_local_part", opt_bool | opt_public,
51 LOFF(caseful_local_part) },
52 { "check_local_user", opt_bool | opt_public,
53 LOFF(check_local_user) },
54 { "condition", opt_stringptr|opt_public|opt_rep_con,
56 { "debug_print", opt_stringptr | opt_public,
58 { "disable_logging", opt_bool | opt_public,
59 LOFF(disable_logging) },
60 { "dnssec_request_domains", opt_stringptr|opt_public,
61 LOFF(dnssec.request) },
62 { "dnssec_require_domains", opt_stringptr|opt_public,
63 LOFF(dnssec.require) },
64 { "domains", opt_stringptr|opt_public,
66 { "driver", opt_stringptr|opt_public,
68 { "dsn_lasthop", opt_bool|opt_public,
70 { "errors_to", opt_stringptr|opt_public,
72 { "expn", opt_bool|opt_public,
74 { "fail_verify", opt_bool_verify|opt_hidden|opt_public,
75 LOFF(fail_verify_sender) },
76 { "fail_verify_recipient", opt_bool|opt_public,
77 LOFF(fail_verify_recipient) },
78 { "fail_verify_sender", opt_bool|opt_public,
79 LOFF(fail_verify_sender) },
80 { "fallback_hosts", opt_stringptr|opt_public,
81 LOFF(fallback_hosts) },
82 { "group", opt_expand_gid | opt_public,
84 { "headers_add", opt_stringptr|opt_public|opt_rep_str,
85 LOFF(extra_headers) },
86 { "headers_remove", opt_stringptr|opt_public|opt_rep_str,
87 LOFF(remove_headers) },
88 { "ignore_target_hosts",opt_stringptr|opt_public,
89 LOFF(ignore_target_hosts) },
90 { "initgroups", opt_bool | opt_public,
92 { "local_part_prefix", opt_stringptr|opt_public,
94 { "local_part_prefix_optional",opt_bool|opt_public,
95 LOFF(prefix_optional) },
96 { "local_part_suffix", opt_stringptr|opt_public,
98 { "local_part_suffix_optional",opt_bool|opt_public,
99 LOFF(suffix_optional) },
100 { "local_parts", opt_stringptr|opt_public,
102 { "log_as_local", opt_bool|opt_public,
103 LOFF(log_as_local) },
104 { "more", opt_expand_bool|opt_public,
106 { "pass_on_timeout", opt_bool|opt_public,
107 LOFF(pass_on_timeout) },
108 { "pass_router", opt_stringptr|opt_public,
109 LOFF(pass_router_name) },
110 { "redirect_router", opt_stringptr|opt_public,
111 LOFF(redirect_router_name) },
112 { "require_files", opt_stringptr|opt_public,
113 LOFF(require_files) },
114 { "retry_use_local_part", opt_bool|opt_public,
115 LOFF(retry_use_local_part) },
116 { "router_home_directory", opt_stringptr|opt_public,
117 LOFF(router_home_directory) },
118 { "self", opt_stringptr|opt_public,
120 { "senders", opt_stringptr|opt_public,
122 { "set", opt_stringptr|opt_public|opt_rep_str,
124 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
125 { "translate_ip_address", opt_stringptr|opt_public,
126 LOFF(translate_ip_address) },
128 { "transport", opt_stringptr|opt_public,
129 LOFF(transport_name) },
130 { "transport_current_directory", opt_stringptr|opt_public,
131 LOFF(current_directory) },
132 { "transport_home_directory", opt_stringptr|opt_public,
133 LOFF(home_directory) },
134 { "unseen", opt_expand_bool|opt_public,
136 { "user", opt_expand_uid | opt_public,
138 { "verify", opt_bool_verify|opt_hidden|opt_public,
139 LOFF(verify_sender) },
140 { "verify_only", opt_bool|opt_public,
142 { "verify_recipient", opt_bool|opt_public,
143 LOFF(verify_recipient) },
144 { "verify_sender", opt_bool|opt_public,
145 LOFF(verify_sender) }
148 int optionlist_routers_size = nelem(optionlist_routers);
153 # include "macro_predef.h"
156 options_routers(void)
160 options_from_list(optionlist_routers, nelem(optionlist_routers), US"ROUTERS", NULL);
162 for (router_info * ri = routers_available; ri->driver_name[0]; ri++)
164 spf(buf, sizeof(buf), US"_DRIVER_ROUTER_%T", ri->driver_name);
165 builtin_macro_create(buf);
166 options_from_list(ri->options, (unsigned)*ri->options_count, US"ROUTER", ri->driver_name);
170 #else /*!MACRO_PREDEF*/
172 /*************************************************
173 * Set router pointer from name *
174 *************************************************/
176 /* This function is used for the redirect_router and pass_router options and
177 called from route_init() below.
182 ptr where to put the pointer
183 after TRUE if router must follow this one
189 set_router(router_instance *r, uschar *name, router_instance **ptr, BOOL after)
191 BOOL afterthis = FALSE;
194 for (rr = routers; rr; rr = rr->next)
196 if (Ustrcmp(name, rr->name) == 0)
201 if (rr == r) afterthis = TRUE;
205 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
206 "new_router \"%s\" not found for \"%s\" router", name, r->name);
208 if (after && !afterthis)
209 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
210 "new_router \"%s\" does not follow \"%s\" router", name, r->name);
215 /*************************************************
216 * Initialize router list *
217 *************************************************/
219 /* Read the routers section of the configuration file, and set up a chain of
220 router instances according to its contents. Each router has generic options and
221 may also have its own private options. This function is only ever called when
222 routers == NULL. We use generic code in readconf to do the work. It will set
223 values from the configuration file, and then call the driver's initialization
229 readconf_driver_init(US"router",
230 (driver_instance **)(&routers), /* chain anchor */
231 (driver_info *)routers_available, /* available drivers */
232 sizeof(router_info), /* size of info blocks */
233 &router_defaults, /* default values for generic options */
234 sizeof(router_instance), /* size of instance block */
235 optionlist_routers, /* generic options */
236 optionlist_routers_size);
238 for (router_instance * r = routers; r; r = r->next)
242 /* If log_as_local is unset, its overall default is FALSE. (The accept
243 router defaults it to TRUE.) */
245 if (r->log_as_local == TRUE_UNSET) r->log_as_local = FALSE;
247 /* Check for transport or no transport on certain routers */
249 if ( (r->info->ri_flags & ri_yestransport)
250 && !r->transport_name && !r->verify_only)
251 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
252 "a transport is required for this router", r->name);
254 if ((r->info->ri_flags & ri_notransport) && r->transport_name)
255 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
256 "a transport must not be defined for this router", r->name);
258 /* The "self" option needs to be decoded into a code value and possibly a
259 new domain string and a rewrite boolean. */
261 if (Ustrcmp(s, "freeze") == 0) r->self_code = self_freeze;
262 else if (Ustrcmp(s, "defer") == 0) r->self_code = self_defer;
263 else if (Ustrcmp(s, "send") == 0) r->self_code = self_send;
264 else if (Ustrcmp(s, "pass") == 0) r->self_code = self_pass;
265 else if (Ustrcmp(s, "fail") == 0) r->self_code = self_fail;
266 else if (Ustrncmp(s, "reroute:", 8) == 0)
269 while (isspace(*s)) s++;
270 if (Ustrncmp(s, "rewrite:", 8) == 0)
272 r->self_rewrite = TRUE;
274 while (isspace(*s)) s++;
277 r->self_code = self_reroute;
280 else log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s router:\n "
281 "%s is not valid for the self option", r->name, s);
283 /* If any router has check_local_user set, default retry_use_local_part
284 TRUE; otherwise its default is FALSE. */
286 if (r->retry_use_local_part == TRUE_UNSET)
287 r->retry_use_local_part =
288 r->check_local_user || r->local_parts || r->condition || r->prefix || r->suffix || r->senders || r->require_files;
290 /* Build a host list if fallback hosts is set. */
293 int old_pool = store_pool;
294 store_pool = POOL_PERM;
295 host_build_hostlist(&r->fallback_hostlist, r->fallback_hosts, FALSE);
296 store_pool = old_pool;
299 /* Check redirect_router and pass_router are valid */
301 if (r->redirect_router_name)
302 set_router(r, r->redirect_router_name, &(r->redirect_router), FALSE);
304 if (r->pass_router_name)
305 set_router(r, r->pass_router_name, &(r->pass_router), TRUE);
308 DEBUG(D_route) debug_printf("DSN: %s %s\n", r->name,
309 r->dsn_lasthop ? "lasthop set" : "propagating DSN");
316 /*************************************************
317 * Tidy up after routing *
318 *************************************************/
320 /* Routers are entitled to keep hold of certain resources in their instance
321 blocks so as to save setting them up each time. An example is an open file.
322 Such routers must provide a tidyup entry point which is called when all routing
323 is finished, via this function. */
328 for (router_instance * r = routers; r; r = r->next)
329 if (r->info->tidyup) (r->info->tidyup)(r);
334 /*************************************************
335 * Check local part for prefix *
336 *************************************************/
338 /* This function is handed a local part and a list of possible prefixes; if any
339 one matches, return the prefix length. A prefix beginning with '*' is a
343 local_part the local part to check
344 prefixes the list of prefixes
345 vp if set, pointer to place for size of wildcard portion
347 Returns: length of matching prefix or zero
351 route_check_prefix(const uschar * local_part, const uschar * prefixes,
356 const uschar *listptr = prefixes;
358 while ((prefix = string_nextinlist(&listptr, &sep, NULL, 0)))
360 int plen = Ustrlen(prefix);
361 if (prefix[0] == '*')
364 for (const uschar * p = local_part + Ustrlen(local_part) - (--plen);
365 p >= local_part; p--)
366 if (strncmpic(prefix, p, plen) == 0)
368 unsigned vlen = p - local_part;
374 if (strncmpic(prefix, local_part, plen) == 0)
386 /*************************************************
387 * Check local part for suffix *
388 *************************************************/
390 /* This function is handed a local part and a list of possible suffixes;
391 if any one matches, return the suffix length. A suffix ending with '*'
395 local_part the local part to check
396 suffixes the list of suffixes
397 vp if set, pointer to place for size of wildcard portion
399 Returns: length of matching suffix or zero
403 route_check_suffix(const uschar * local_part, const uschar * suffixes,
407 int alen = Ustrlen(local_part);
409 const uschar *listptr = suffixes;
411 while ((suffix = string_nextinlist(&listptr, &sep, NULL, 0)))
413 int slen = Ustrlen(suffix);
414 if (suffix[slen-1] == '*')
416 const uschar * pend = local_part + alen - (--slen) + 1;
417 for (const uschar * p = local_part; p < pend; p++)
418 if (strncmpic(suffix, p, slen) == 0)
420 int tlen = alen - (p - local_part);
421 if (vp) *vp = tlen - slen;
426 if (alen > slen && strncmpic(suffix, local_part + alen - slen, slen) == 0)
439 /*************************************************
440 * Check local part, domain, or sender *
441 *************************************************/
443 /* The checks in check_router_conditions() require similar code, so we use
444 this function to save repetition.
447 rname router name for error messages
448 type type of check, for error message
449 list domains, local_parts, or senders list
450 anchorptr -> tree for possibly cached items (domains)
451 cache_bits cached bits pointer
452 listtype MCL_DOMAIN for domain check
453 MCL_LOCALPART for local part check
454 MCL_ADDRESS for sender check
455 domloc current domain, current local part, or NULL for sender check
456 ldata where to put lookup data
457 caseless passed on to match_isinlist()
458 perror where to put an error message
460 Returns: OK item is in list
461 SKIP item is not in list, router is to be skipped
462 DEFER lookup or other defer
466 route_check_dls(uschar *rname, uschar *type, const uschar *list,
467 tree_node **anchorptr, unsigned int *cache_bits, int listtype,
468 const uschar *domloc, const uschar **ldata, BOOL caseless, uschar **perror)
470 if (!list) return OK; /* Empty list always succeeds */
472 DEBUG(D_route) debug_printf("checking %s\n", type);
474 /* The domain and local part use the same matching function, whereas sender
478 ? match_isinlist(domloc, &list, 0, anchorptr, cache_bits, listtype,
480 : match_address_list(sender_address ? sender_address : US"",
481 TRUE, TRUE, &list, cache_bits, -1, 0, CUSS &sender_data)
488 *perror = string_sprintf("%s router skipped: %s mismatch", rname, type);
489 DEBUG(D_route) debug_printf("%s\n", *perror);
492 default: /* Paranoia, and keeps compilers happy */
494 *perror = string_sprintf("%s check lookup or other defer", type);
495 DEBUG(D_route) debug_printf("%s\n", *perror);
502 /*************************************************
503 * Check access by a given uid/gid *
504 *************************************************/
506 /* This function checks whether a given uid/gid has access to a given file or
507 directory. It is called only from check_files() below. This is hopefully a
508 cheapish check that does the job most of the time. Exim does *not* rely on this
509 test when actually accessing any file. The test is used when routing to make it
510 possible to take actions such as "if user x can access file y then run this
513 During routing, Exim is normally running as root, and so the test will work
514 except for NFS non-root mounts. When verifying during message reception, Exim
515 is running as "exim", so the test may not work. This is a limitation of the
518 Code in check_files() below detects the case when it cannot stat() the file (as
519 root), and in that situation it uses a setuid subprocess in which to run this
523 path the path to check
526 bits the bits required in the final component
529 FALSE errno=EACCES or ENOENT (or others from realpath or stat)
533 route_check_access(uschar *path, uid_t uid, gid_t gid, int bits)
537 uschar *rp = US realpath(CS path, CS big_buffer);
540 DEBUG(D_route) debug_printf("route_check_access(%s,%d,%d,%o)\n", path,
541 (int)uid, (int)gid, bits);
543 if (!rp) return FALSE;
545 while ((slash = Ustrchr(sp, '/')))
548 DEBUG(D_route) debug_printf("stat %s\n", rp);
549 if (Ustat(rp, &statbuf) < 0) return FALSE;
550 if ((statbuf.st_mode &
551 ((statbuf.st_uid == uid)? 0100 : (statbuf.st_gid == gid)? 0010 : 001)
561 /* Down to the final component */
563 DEBUG(D_route) debug_printf("stat %s\n", rp);
565 if (Ustat(rp, &statbuf) < 0) return FALSE;
567 if (statbuf.st_uid == uid) bits = bits << 6;
568 else if (statbuf.st_gid == gid) bits = bits << 3;
569 if ((statbuf.st_mode & bits) != bits)
575 DEBUG(D_route) debug_printf("route_check_access() succeeded\n");
581 /*************************************************
582 * Do file existence tests *
583 *************************************************/
585 /* This function is given a colon-separated list of file tests, each of which
586 is expanded before use. A test consists of a file name, optionally preceded by
587 ! (require non-existence) and/or + for handling permission denied (+ means
588 treat as non-existing).
590 An item that contains no slashes is interpreted as a username or id, with an
591 optional group id, for checking access to the file. This cannot be done
592 "perfectly", but it is good enough for a number of applications.
595 s a colon-separated list of file tests or NULL
596 perror a pointer to an anchor for an error text in the case of a DEFER
598 Returns: OK if s == NULL or all tests are as required
599 DEFER if the existence of at least one of the files is
600 unclear (an error other than non-existence occurred);
601 DEFER if an expansion failed
602 DEFER if a name is not absolute
603 DEFER if problems with user/group
608 check_files(const uschar *s, uschar **perror)
610 int sep = 0; /* List has default separators */
611 uid_t uid = 0; /* For picky compilers */
612 gid_t gid = 0; /* For picky compilers */
613 BOOL ugid_set = FALSE;
614 const uschar *listptr;
619 DEBUG(D_route) debug_printf("checking require_files\n");
622 while ((check = string_nextinlist(&listptr, &sep, NULL, 0)))
628 uschar *ss = expand_string(check);
632 if (f.expand_string_forcedfail) continue;
633 *perror = string_sprintf("failed to expand \"%s\" for require_files: %s",
634 check, expand_string_message);
638 /* Empty items are just skipped */
640 if (*ss == 0) continue;
642 /* If there are no slashes in the string, we have a user name or uid, with
643 optional group/gid. */
645 if (Ustrchr(ss, '/') == NULL)
649 uschar *comma = Ustrchr(ss, ',');
651 /* If there's a comma, temporarily terminate the user name/number
652 at that point. Then set the uid. */
654 if (comma != NULL) *comma = 0;
655 ok = route_finduser(ss, &pw, &uid);
656 if (comma != NULL) *comma = ',';
660 *perror = string_sprintf("user \"%s\" for require_files not found", ss);
664 /* If there was no comma, the gid is that associated with the user. */
668 if (pw != NULL) gid = pw->pw_gid; else
670 *perror = string_sprintf("group missing after numerical uid %d for "
671 "require_files", (int)uid);
677 if (!route_findgroup(comma + 1, &gid))
679 *perror = string_sprintf("group \"%s\" for require_files not found\n",
685 /* Note that we have values set, and proceed to next item */
688 debug_printf("check subsequent files for access by %s\n", ss);
693 /* Path, possibly preceded by + and ! */
698 while (isspace((*(++ss))));
704 while (isspace((*(++ss))));
709 *perror = string_sprintf("require_files: \"%s\" is not absolute", ss);
713 /* Stat the file, either as root (while routing) or as exim (while verifying
714 during message reception). */
716 rc = Ustat(ss, &statbuf);
720 debug_printf("file check: %s\n", check);
721 if (ss != check) debug_printf("expanded file: %s\n", ss);
722 debug_printf("stat() yielded %d\n", rc);
725 /* If permission is denied, and we are running as root (i.e. routing for
726 delivery rather than verifying), and the requirement is to test for access by
727 a particular uid/gid, it must mean that the file is on a non-root-mounted NFS
728 system. In this case, we have to use a subprocess that runs as the relevant
729 uid in order to do the test. */
731 if (rc != 0 && errno == EACCES && ugid_set && getuid() == root_uid)
735 void (*oldsignal)(int);
737 DEBUG(D_route) debug_printf("root is denied access: forking to check "
740 /* Before forking, ensure that SIGCHLD is set to SIG_DFL before forking, so
741 that the child process can be waited for, just in case get here with it set
742 otherwise. Save the old state for resetting on the wait. */
744 oldsignal = signal(SIGCHLD, SIG_DFL);
745 pid = exim_fork(US"require-files");
747 /* If fork() fails, reinstate the original error and behave as if
748 this block of code were not present. This is the same behaviour as happens
749 when Exim is not running as root at this point. */
754 debug_printf("require_files: fork failed: %s\n", strerror(errno));
759 /* In the child process, change uid and gid, and then do the check using
760 the route_check_access() function. This does more than just stat the file;
761 it tests permissions as well. Return 0 for OK and 1 for failure. */
765 exim_setugid(uid, gid, TRUE,
766 string_sprintf("require_files check, file=%s", ss));
767 if (route_check_access(ss, uid, gid, 4))
768 exim_underbar_exit(EXIT_SUCCESS);
769 DEBUG(D_route) debug_printf("route_check_access() failed\n");
770 exim_underbar_exit(EXIT_FAILURE);
773 /* In the parent, wait for the child to finish */
775 while (waitpid(pid, &status, 0) < 0)
776 if (errno != EINTR) /* unexpected error, interpret as failure */
782 signal(SIGCHLD, oldsignal); /* restore */
783 if ((status == 0) == invert) return SKIP;
784 continue; /* to test the next file */
787 /* Control reaches here if the initial stat() succeeds, or fails with an
788 error other than EACCES, or no uid/gid is set, or we are not running as root.
789 If we know the file exists and uid/gid are set, try to check read access for
790 that uid/gid as best we can. */
792 if (rc == 0 && ugid_set && !route_check_access(ss, uid, gid, 4))
794 DEBUG(D_route) debug_printf("route_check_access() failed\n");
798 /* Handle error returns from stat() or route_check_access(). The EACCES error
799 is handled specially. At present, we can force it to be treated as
800 non-existence. Write the code so that it will be easy to add forcing for
801 existence if required later. */
806 DEBUG(D_route) debug_printf("errno = %d\n", errno);
809 if (eacces_code == 1)
811 DEBUG(D_route) debug_printf("EACCES => ENOENT\n");
812 errno = ENOENT; /* Treat as non-existent */
817 *perror = string_sprintf("require_files: error for %s: %s", ss,
823 /* At this point, rc < 0 => non-existence; rc >= 0 => existence */
825 if ((rc >= 0) == invert) return SKIP;
830 /* Come here on any of the errors that return DEFER. */
833 DEBUG(D_route) debug_printf("%s\n", *perror);
841 /*************************************************
842 * Check for router skipping *
843 *************************************************/
845 /* This function performs various checks to see whether a router should be
846 skipped. The order in which they are performed is important.
849 r pointer to router instance block
850 addr address that is being handled
851 verify the verification type
852 pw ptr to ptr to passwd structure for local user
853 perror for lookup errors
855 Returns: OK if all the tests succeed
856 SKIP if router is to be skipped
857 DEFER for a lookup defer
858 FAIL for address to be failed
862 check_router_conditions(router_instance * r, address_item * addr, int verify,
863 struct passwd ** pw, uschar ** perror)
866 uschar * check_local_part;
867 unsigned int * localpart_cache;
869 /* Reset variables to hold a home directory and data from lookup of a domain or
870 local part, and ensure search_find_defer is unset, in case there aren't any
874 deliver_domain_data = NULL;
875 deliver_localpart_data = NULL;
877 local_user_gid = (gid_t)(-1);
878 local_user_uid = (uid_t)(-1);
879 f.search_find_defer = FALSE;
881 /* Skip this router if not verifying and it has verify_only set */
883 if ((verify == v_none || verify == v_expn) && r->verify_only)
885 DEBUG(D_route) debug_printf("%s router skipped: verify_only set\n", r->name);
889 /* Skip this router if testing an address (-bt) and address_test is not set */
891 if (f.address_test_mode && !r->address_test)
893 DEBUG(D_route) debug_printf("%s router skipped: address_test is unset\n",
898 /* Skip this router if verifying and it hasn't got the appropriate verify flag
901 if ((verify == v_sender && !r->verify_sender) ||
902 (verify == v_recipient && !r->verify_recipient))
904 DEBUG(D_route) debug_printf("%s router skipped: verify %d %d %d\n",
905 r->name, verify, r->verify_sender, r->verify_recipient);
909 /* Skip this router if processing EXPN and it doesn't have expn set */
911 if (verify == v_expn && !r->expn)
913 DEBUG(D_route) debug_printf("%s router skipped: no_expn set\n", r->name);
917 /* Skip this router if there's a domain mismatch. */
919 if ((rc = route_check_dls(r->name, US"domains", r->domains, &domainlist_anchor,
920 addr->domain_cache, TRUE, addr->domain, CUSS &deliver_domain_data,
921 MCL_DOMAIN, perror)) != OK)
924 /* Skip this router if there's a local part mismatch. We want to pass over the
925 caseful local part, so that +caseful can restore it, even if this router is
926 handling local parts caselessly. However, we can't just pass cc_local_part,
927 because that doesn't have the prefix or suffix stripped. A bit of massaging is
928 required. Also, we only use the match cache for local parts that have not had
929 a prefix or suffix stripped. */
931 check_local_part = string_copy(addr->cc_local_part);
932 if (!addr->prefix && !addr->suffix)
933 localpart_cache = addr->localpart_cache;
936 localpart_cache = NULL;
938 check_local_part += Ustrlen(addr->prefix);
940 check_local_part[Ustrlen(check_local_part) - Ustrlen(addr->suffix)] = 0;
943 if ((rc = route_check_dls(r->name, US"local_parts", r->local_parts,
944 &localpartlist_anchor, localpart_cache, MCL_LOCALPART,
945 check_local_part, CUSS &deliver_localpart_data,
946 !r->caseful_local_part, perror)) != OK)
949 /* If the check_local_user option is set, check that the local_part is the
950 login of a local user. Note: the third argument to route_finduser() must be
951 NULL here, to prevent a numeric string being taken as a numeric uid. If the
952 user is found, set deliver_home to the home directory, and also set
953 local_user_{uid,gid} and local_part_data. */
955 if (r->check_local_user)
957 DEBUG(D_route) debug_printf("checking for local user\n");
958 if (!route_finduser(addr->local_part, pw, NULL))
960 DEBUG(D_route) debug_printf("%s router skipped: %s is not a local user\n",
961 r->name, addr->local_part);
964 addr->prop.localpart_data =
965 deliver_localpart_data = string_copy(US (*pw)->pw_name);
966 deliver_home = string_copy(US (*pw)->pw_dir);
967 local_user_gid = (*pw)->pw_gid;
968 local_user_uid = (*pw)->pw_uid;
971 /* Set (or override in the case of check_local_user) the home directory if
972 router_home_directory is set. This is done here so that it overrides $home from
973 check_local_user before any subsequent expansions are done. Otherwise, $home
974 could mean different things for different options, which would be extremely
977 if (r->router_home_directory)
979 uschar * router_home = expand_string(r->router_home_directory);
982 setflag(addr, af_home_expanded); /* Note set from router_home_directory */
983 deliver_home = router_home;
985 else if (!f.expand_string_forcedfail)
987 *perror = string_sprintf("failed to expand \"%s\" for "
988 "router_home_directory: %s", r->router_home_directory,
989 expand_string_message);
994 /* Skip if the sender condition is not met. We leave this one till after the
995 local user check so that $home is set - enabling the possibility of letting
996 individual recipients specify lists of acceptable/unacceptable senders. */
998 if ((rc = route_check_dls(r->name, US"senders", r->senders, NULL,
999 sender_address_cache, MCL_ADDRESS, NULL, NULL, FALSE, perror)) != OK)
1002 /* This is the point at which we print out the router's debugging string if it
1003 is set. We wait till here so as to have $home available for local users (and
1004 anyway, we don't want too much stuff for skipped routers). */
1006 debug_print_string(r->debug_string);
1008 /* Perform file existence tests. */
1010 if ((rc = check_files(r->require_files, perror)) != OK)
1012 DEBUG(D_route) debug_printf("%s router %s: file check\n", r->name,
1013 (rc == SKIP)? "skipped" : "deferred");
1017 /* Now the general condition test. */
1021 DEBUG(D_route) debug_printf("checking \"condition\" \"%.80s\"...\n", r->condition);
1022 if (!expand_check_condition(r->condition, r->name, US"router"))
1024 if (f.search_find_defer)
1026 *perror = US"condition check lookup defer";
1027 DEBUG(D_route) debug_printf("%s\n", *perror);
1031 debug_printf("%s router skipped: condition failure\n", r->name);
1036 #ifdef EXPERIMENTAL_BRIGHTMAIL
1037 /* check if a specific Brightmail AntiSpam rule fired on the message */
1040 DEBUG(D_route) debug_printf("checking bmi_rule\n");
1041 if (bmi_check_rule(bmi_base64_verdict, r->bmi_rule) == 0)
1042 { /* none of the rules fired */
1044 debug_printf("%s router skipped: none of bmi_rule rules fired\n", r->name);
1049 /* check if message should not be delivered */
1050 if (r->bmi_dont_deliver && bmi_deliver == 1)
1053 debug_printf("%s router skipped: bmi_dont_deliver is FALSE\n", r->name);
1057 /* check if message should go to an alternate location */
1058 if ( r->bmi_deliver_alternate
1059 && (bmi_deliver == 0 || !bmi_alt_location)
1063 debug_printf("%s router skipped: bmi_deliver_alternate is FALSE\n", r->name);
1067 /* check if message should go to default location */
1068 if ( r->bmi_deliver_default
1069 && (bmi_deliver == 0 || bmi_alt_location)
1073 debug_printf("%s router skipped: bmi_deliver_default is FALSE\n", r->name);
1078 /* All the checks passed. */
1086 /*************************************************
1087 * Find a local user *
1088 *************************************************/
1090 /* Try several times (if configured) to find a local user, in case delays in
1091 NIS or NFS whatever cause an incorrect refusal. It's a pity that getpwnam()
1092 doesn't have some kind of indication as to why it has failed. If the string
1093 given consists entirely of digits, and the third argument is not NULL, assume
1094 the string is the numerical value of the uid. Otherwise it is looked up using
1095 getpwnam(). The uid is passed back via return_uid, if not NULL, and the
1096 pointer to a passwd structure, if found, is passed back via pw, if not NULL.
1098 Because this may be called several times in succession for the same user for
1099 different routers, cache the result of the previous getpwnam call so that it
1100 can be re-used. Note that we can't just copy the structure, as the store it
1101 points to can get trashed.
1104 s the login name or textual form of the numerical uid of the user
1105 pw if not NULL, return the result of getpwnam here, or set NULL
1106 if no call to getpwnam is made (s numeric, return_uid != NULL)
1107 return_uid if not NULL, return the uid via this address
1109 Returns: TRUE if s is numerical or was looked up successfully
1113 static struct passwd pwcopy;
1114 static struct passwd *lastpw = NULL;
1115 static uschar lastname[48] = { 0 };
1116 static uschar lastdir[128];
1117 static uschar lastgecos[128];
1118 static uschar lastshell[128];
1121 route_finduser(const uschar *s, struct passwd **pw, uid_t *return_uid)
1123 BOOL cache_set = (Ustrcmp(lastname, s) == 0);
1125 DEBUG(D_uid) debug_printf("seeking password data for user \"%s\": %s\n", s,
1126 cache_set ? "using cached result" : "cache not available");
1132 if (return_uid && (isdigit(*s) || *s == '-') &&
1133 s[Ustrspn(s+1, "0123456789")+1] == 0)
1135 *return_uid = (uid_t)Uatoi(s);
1140 string_format_nt(lastname, sizeof(lastname), "%s", s);
1142 /* Force failure if string length is greater than given maximum */
1144 if (max_username_length > 0 && Ustrlen(lastname) > max_username_length)
1146 DEBUG(D_uid) debug_printf("forced failure of finduser(): string "
1147 "length of %s is greater than %d\n", lastname, max_username_length);
1151 /* Try a few times if so configured; this handles delays in NIS etc. */
1156 if ((lastpw = getpwnam(CS s))) break;
1157 if (++i > finduser_retries) break;
1163 pwcopy.pw_uid = lastpw->pw_uid;
1164 pwcopy.pw_gid = lastpw->pw_gid;
1165 (void)string_format(lastdir, sizeof(lastdir), "%s", lastpw->pw_dir);
1166 (void)string_format(lastgecos, sizeof(lastgecos), "%s", lastpw->pw_gecos);
1167 (void)string_format(lastshell, sizeof(lastshell), "%s", lastpw->pw_shell);
1168 pwcopy.pw_name = CS lastname;
1169 pwcopy.pw_dir = CS lastdir;
1170 pwcopy.pw_gecos = CS lastgecos;
1171 pwcopy.pw_shell = CS lastshell;
1175 else DEBUG(D_uid) if (errno != 0)
1176 debug_printf("getpwnam(%s) failed: %s\n", s, strerror(errno));
1181 DEBUG(D_uid) debug_printf("getpwnam() returned NULL (user not found)\n");
1185 DEBUG(D_uid) debug_printf("getpwnam() succeeded uid=%d gid=%d\n",
1186 lastpw->pw_uid, lastpw->pw_gid);
1188 if (return_uid) *return_uid = lastpw->pw_uid;
1189 if (pw) *pw = lastpw;
1197 /*************************************************
1198 * Find a local group *
1199 *************************************************/
1201 /* Try several times (if configured) to find a local group, in case delays in
1202 NIS or NFS whatever cause an incorrect refusal. It's a pity that getgrnam()
1203 doesn't have some kind of indication as to why it has failed.
1206 s the group name or textual form of the numerical gid
1207 return_gid return the gid via this address
1209 Returns: TRUE if the group was found; FALSE otherwise
1214 route_findgroup(uschar *s, gid_t *return_gid)
1219 if ((isdigit(*s) || *s == '-') && s[Ustrspn(s+1, "0123456789")+1] == 0)
1221 *return_gid = (gid_t)Uatoi(s);
1227 if ((gr = getgrnam(CS s)))
1229 *return_gid = gr->gr_gid;
1232 if (++i > finduser_retries) break;
1242 /*************************************************
1243 * Find user by expanding string *
1244 *************************************************/
1246 /* Expands a string, and then looks up the result in the passwd file.
1249 string the string to be expanded, yielding a login name or a numerical
1250 uid value (to be passed to route_finduser())
1251 driver_name caller name for panic error message (only)
1252 driver_type caller type for panic error message (only)
1253 pw return passwd entry via this pointer
1254 uid return uid via this pointer
1255 errmsg where to point a message on failure
1257 Returns: TRUE if user found, FALSE otherwise
1261 route_find_expanded_user(uschar *string, uschar *driver_name,
1262 uschar *driver_type, struct passwd **pw, uid_t *uid, uschar **errmsg)
1264 uschar *user = expand_string(string);
1268 *errmsg = string_sprintf("Failed to expand user string \"%s\" for the "
1269 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1270 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1274 if (route_finduser(user, pw, uid)) return TRUE;
1276 *errmsg = string_sprintf("Failed to find user \"%s\" from expanded string "
1277 "\"%s\" for the %s %s", user, string, driver_name, driver_type);
1278 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1284 /*************************************************
1285 * Find group by expanding string *
1286 *************************************************/
1288 /* Expands a string and then looks up the result in the group file.
1291 string the string to be expanded, yielding a group name or a numerical
1292 gid value (to be passed to route_findgroup())
1293 driver_name caller name for panic error message (only)
1294 driver_type caller type for panic error message (only)
1295 gid return gid via this pointer
1296 errmsg return error message via this pointer
1298 Returns: TRUE if found group, FALSE otherwise
1302 route_find_expanded_group(uschar *string, uschar *driver_name, uschar *driver_type,
1303 gid_t *gid, uschar **errmsg)
1306 uschar *group = expand_string(string);
1310 *errmsg = string_sprintf("Failed to expand group string \"%s\" for the "
1311 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1312 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1316 if (!route_findgroup(group, gid))
1318 *errmsg = string_sprintf("Failed to find group \"%s\" from expanded string "
1319 "\"%s\" for the %s %s", group, string, driver_name, driver_type);
1320 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1329 /*************************************************
1330 * Handle an unseen routing *
1331 *************************************************/
1333 /* This function is called when an address is routed by a router with "unseen"
1334 set. It must make a clone of the address, for handling by subsequent drivers.
1335 The clone is set to start routing at the next router.
1337 The original address must be replaced by an invented "parent" which has the
1338 routed address plus the clone as its children. This is necessary in case the
1339 address is at the top level - we don't want to mark it complete until both
1340 deliveries have been done.
1342 A new unique field must be made, so that the record of the delivery isn't a
1343 record of the original address, and checking for already delivered has
1344 therefore to be done here. If the delivery has happened, then take the base
1345 address off whichever delivery queue it is on - it will always be the top item.
1349 addr address that was routed
1350 paddr_local chain of local-delivery addresses
1351 paddr_remote chain of remote-delivery addresses
1352 addr_new chain for newly created addresses
1358 route_unseen(uschar *name, address_item *addr, address_item **paddr_local,
1359 address_item **paddr_remote, address_item **addr_new)
1361 address_item *parent = deliver_make_addr(addr->address, TRUE);
1362 address_item *new = deliver_make_addr(addr->address, TRUE);
1364 /* The invented parent is a copy that replaces the original; note that
1365 this copies its parent pointer. It has two children, and its errors_address is
1366 from the original address' parent, if present, otherwise unset. */
1369 parent->child_count = 2;
1370 parent->prop.errors_address =
1371 addr->parent ? addr->parent->prop.errors_address : NULL;
1373 /* The routed address gets a new parent. */
1375 addr->parent = parent;
1377 /* The clone has this parent too. Set its errors address from the parent. This
1378 was set from the original parent (or to NULL) - see above. We do NOT want to
1379 take the errors address from the unseen router. */
1381 new->parent = parent;
1382 new->prop.errors_address = parent->prop.errors_address;
1384 /* Copy the propagated flags and address_data from the original. */
1386 new->prop.ignore_error = addr->prop.ignore_error;
1387 new->prop.address_data = addr->prop.address_data;
1388 new->prop.variables = NULL;
1389 tree_dup((tree_node **)&new->prop.variables, addr->prop.variables);
1390 new->dsn_flags = addr->dsn_flags;
1391 new->dsn_orcpt = addr->dsn_orcpt;
1394 /* As it has turned out, we haven't set headers_add or headers_remove for the
1395 * clone. Thinking about it, it isn't entirely clear whether they should be
1396 * copied from the original parent, like errors_address, or taken from the
1397 * unseen router, like address_data and the flags. Until somebody brings this
1398 * up, I propose to leave the code as it is.
1402 /* Set the cloned address to start at the next router, and put it onto the
1403 chain of new addresses. */
1405 new->start_router = addr->router->next;
1406 new->next = *addr_new;
1409 DEBUG(D_route) debug_printf("\"unseen\" set: replicated %s\n", addr->address);
1411 /* Make a new unique field, to distinguish from the normal one. */
1413 addr->unique = string_sprintf("%s/%s", addr->unique, name);
1415 /* If the address has been routed to a transport, see if it was previously
1416 delivered. If so, we take it off the relevant queue so that it isn't delivered
1417 again. Otherwise, it was an alias or something, and the addresses it generated
1418 are handled in the normal way. */
1420 if (addr->transport && tree_search(tree_nonrecipients, addr->unique))
1423 debug_printf("\"unseen\" delivery previously done - discarded\n");
1424 parent->child_count--;
1425 if (*paddr_remote == addr) *paddr_remote = addr->next;
1426 if (*paddr_local == addr) *paddr_local = addr->next;
1432 /************************************************/
1433 /* Add router-assigned variables
1434 Return OK/DEFER/FAIL/PASS */
1437 set_router_vars(address_item * addr, const router_instance * r)
1439 const uschar * varlist = r->set;
1440 tree_node ** root = (tree_node **) &addr->prop.variables;
1443 if (!varlist) return OK;
1445 /* Walk the varlist, creating variables */
1447 for (uschar * ele; (ele = string_nextinlist(&varlist, &sep, NULL, 0)); )
1449 const uschar * assignment = ele;
1451 uschar * name = string_nextinlist(&assignment, &esep, NULL, 0);
1455 /* Variable name must exist and start "r_". */
1457 if (!name || name[0] != 'r' || name[1] != '_' || !name[2])
1459 log_write(0, LOG_MAIN|LOG_PANIC,
1460 "bad router variable name '%s' in router '%s'\n", name, r->name);
1465 while (isspace(*assignment)) assignment++;
1467 if (!(val = expand_string(US assignment)))
1468 if (f.expand_string_forcedfail)
1472 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1473 "(router variable): decline action taken\n", ele);
1475 /* Expand "more" if necessary; DEFER => an expansion failed */
1477 yield = exp_bool(addr, US"router", r->name, D_route,
1478 US"more", r->more, r->expand_more, &more);
1479 if (yield != OK) return yield;
1484 debug_printf("\"more\"=false: skipping remaining routers\n");
1493 addr->message = string_sprintf("expansion of \"%s\" failed "
1494 "in %s router: %s", ele, r->name, expand_string_message);
1498 if (!(node = tree_search(*root, name)))
1499 { /* name should never be tainted */
1500 node = store_get(sizeof(tree_node) + Ustrlen(name), GET_UNTAINTED);
1501 Ustrcpy(node->name, name);
1502 (void)tree_insertnode(root, node);
1504 node->data.ptr = US val;
1505 DEBUG(D_route) debug_printf("set r_%s%s = '%s'%s\n",
1506 name, is_tainted(name)?" (tainted)":"",
1507 val, is_tainted(val)?" (tainted)":"");
1509 /* All expansions after this point need visibility of that variable */
1516 /*************************************************
1517 * Route one address *
1518 *************************************************/
1520 /* This function is passed in one address item, for processing by the routers.
1521 The verify flag is set if this is being called for verification rather than
1522 delivery. If the router doesn't have its "verify" flag set, it is skipped.
1525 addr address to route
1526 paddr_local chain of local-delivery addresses
1527 paddr_remote chain of remote-delivery addresses
1528 addr_new chain for newly created addresses
1529 addr_succeed chain for completed addresses
1530 verify v_none if not verifying
1531 v_sender if verifying a sender address
1532 v_recipient if verifying a recipient address
1533 v_expn if processing an EXPN address
1535 Returns: OK => address successfully routed
1536 DISCARD => address was discarded
1537 FAIL => address could not be routed
1538 DEFER => some temporary problem
1539 ERROR => some major internal or configuration failure
1543 route_address(address_item *addr, address_item **paddr_local,
1544 address_item **paddr_remote, address_item **addr_new,
1545 address_item **addr_succeed, int verify)
1549 router_instance *r, *nextr;
1550 const uschar *old_domain = addr->domain;
1554 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1555 debug_printf("routing %s\n", addr->address);
1558 /* Loop through all router instances until a router succeeds, fails, defers, or
1559 encounters an error. If the address has start_router set, we begin from there
1560 instead of at the first router. */
1562 for (r = addr->start_router ? addr->start_router : routers; r; r = nextr)
1565 struct passwd *pw = NULL;
1566 struct passwd pwcopy;
1567 BOOL loop_detected = FALSE;
1572 DEBUG(D_route) debug_printf("--------> %s router <--------\n", r->name);
1574 /* Reset any search error message from the previous router. */
1576 search_error_message = NULL;
1578 /* There are some weird cases where logging is disabled */
1580 f.disable_logging = r->disable_logging;
1582 /* Record the last router to handle the address, and set the default
1588 /* Loop protection: If this address has an ancestor with the same address,
1589 and that ancestor was routed by this router, we skip this router. This
1590 prevents a variety of looping states when a new address is created by
1591 redirection or by the use of "unseen" on a router.
1593 If no_repeat_use is set on the router, we skip if _any_ ancestor was routed
1594 by this router, even if it was different to the current address.
1596 Just in case someone does put it into a loop (possible with redirection
1597 continually adding to an address, for example), put a long stop counter on
1598 the number of parents. */
1600 for (address_item * parent = addr->parent; parent; parent = parent->parent)
1602 if (parent->router == r)
1604 BOOL break_loop = !r->repeat_use;
1606 /* When repeat_use is set, first check the active addresses caselessly.
1607 If they match, we have to do a further caseful check of the local parts
1608 when caseful_local_part is set. This is assumed to be rare, which is why
1609 the code is written this way. */
1613 break_loop = strcmpic(parent->address, addr->address) == 0;
1614 if (break_loop && r->caseful_local_part)
1615 break_loop = Ustrncmp(parent->address, addr->address,
1616 Ustrrchr(addr->address, '@') - addr->address) == 0;
1621 DEBUG(D_route) debug_printf("%s router skipped: previously routed %s\n",
1622 r->name, parent->address);
1623 loop_detected = TRUE;
1628 /* Continue with parents, limiting the size of the dynasty. */
1630 if (loopcount++ > 100)
1632 log_write(0, LOG_MAIN|LOG_PANIC, "routing loop for %s", addr->address);
1638 if (loop_detected) continue;
1640 /* Default no affixes and select whether to use a caseful or caseless local
1641 part in this router. */
1643 addr->prefix = addr->prefix_v = addr->suffix = addr->suffix_v = NULL;
1644 addr->local_part = r->caseful_local_part
1645 ? addr->cc_local_part : addr->lc_local_part;
1647 DEBUG(D_route) debug_printf("local_part=%s domain=%s\n", addr->local_part,
1650 /* Handle any configured prefix by replacing the local_part address,
1651 and setting the prefix. Skip the router if the prefix doesn't match,
1652 unless the prefix is optional. */
1657 int plen = route_check_prefix(addr->local_part, r->prefix, &vlen);
1660 /* If the variable-part is zero-length then the prefix was not
1661 wildcarded and we can detaint-copy it since it matches the
1662 (non-expandable) router option. Otherwise copy the (likely) tainted match
1663 and the variable-part of the match from the local_part. */
1667 addr->prefix = string_copyn(addr->local_part, plen);
1668 addr->prefix_v = string_copyn(addr->local_part, vlen);
1671 addr->prefix = string_copyn_taint(addr->local_part, plen, GET_UNTAINTED);
1672 addr->local_part += plen;
1673 DEBUG(D_route) debug_printf("stripped prefix %s\n", addr->prefix);
1675 else if (!r->prefix_optional)
1677 DEBUG(D_route) debug_printf("%s router skipped: prefix mismatch\n",
1683 /* Handle any configured suffix likewise. */
1688 int slen = route_check_suffix(addr->local_part, r->suffix, &vlen);
1691 int lplen = Ustrlen(addr->local_part) - slen;
1693 ? addr->local_part + lplen
1694 : string_copy_taint(addr->local_part + lplen, GET_UNTAINTED);
1695 addr->suffix_v = addr->suffix + Ustrlen(addr->suffix) - vlen;
1696 addr->local_part = string_copyn(addr->local_part, lplen);
1697 DEBUG(D_route) debug_printf("stripped suffix %s\n", addr->suffix);
1699 else if (!r->suffix_optional)
1701 DEBUG(D_route) debug_printf("%s router skipped: suffix mismatch\n",
1707 /* Set the expansion variables now that we have the affixes and the case of
1708 the local part sorted. */
1710 router_name = r->name;
1711 driver_srcfile = r->srcfile;
1712 driver_srcline = r->srcline;
1713 deliver_set_expansions(addr);
1715 /* For convenience, the pre-router checks are in a separate function, which
1716 returns OK, SKIP, FAIL, or DEFER. */
1718 if ((rc = check_router_conditions(r, addr, verify, &pw, &error)) != OK)
1720 driver_srcfile = router_name = NULL; driver_srcline = 0;
1721 if (rc == SKIP) continue;
1722 addr->message = error;
1727 /* All pre-conditions have been met. Reset any search error message from
1728 pre-condition tests. These can arise in negated tests where the failure of
1729 the lookup leads to a TRUE pre-condition. */
1731 search_error_message = NULL;
1733 /* Add any variable-settings that are on the router, to the set on the
1734 addr. Expansion is done here and not later when the addr is used. There may
1735 be multiple settings, gathered during readconf; this code gathers them during
1736 router traversal. On the addr string they are held as a variable tree, so
1737 as to maintain the post-expansion taints separate. */
1739 switch (set_router_vars(addr, r))
1742 case PASS: continue; /* with next router */
1743 default: goto ROUTE_EXIT;
1746 /* Finally, expand the address_data field in the router. Forced failure
1747 behaves as if the router declined. Any other failure is more serious. On
1748 success, the string is attached to the address for all subsequent processing.
1751 if (r->address_data)
1753 DEBUG(D_route) debug_printf("processing address_data\n");
1754 if (!(deliver_address_data = expand_string(r->address_data)))
1756 if (f.expand_string_forcedfail)
1758 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1759 "(address_data): decline action taken\n", r->address_data);
1761 /* Expand "more" if necessary; DEFER => an expansion failed */
1763 yield = exp_bool(addr, US"router", r->name, D_route,
1764 US"more", r->more, r->expand_more, &more);
1765 if (yield != OK) goto ROUTE_EXIT;
1770 debug_printf("\"more\"=false: skipping remaining routers\n");
1771 driver_srcfile = router_name = NULL; driver_srcline = 0;
1775 else continue; /* With next router */
1780 addr->message = string_sprintf("expansion of \"%s\" failed "
1781 "in %s router: %s", r->address_data, r->name, expand_string_message);
1786 addr->prop.address_data = deliver_address_data;
1789 /* We are finally cleared for take-off with this router. Clear the the flag
1790 that records that a local host was removed from a routed host list. Make a
1791 copy of relevant fields in the password information from check_local_user,
1792 because it will be overwritten if check_local_user is invoked again while
1793 verifying an errors_address setting. */
1795 clearflag(addr, af_local_host_removed);
1799 pwcopy.pw_name = CS string_copy(US pw->pw_name);
1800 pwcopy.pw_uid = pw->pw_uid;
1801 pwcopy.pw_gid = pw->pw_gid;
1802 pwcopy.pw_gecos = CS string_copy(US pw->pw_gecos);
1803 pwcopy.pw_dir = CS string_copy(US pw->pw_dir);
1804 pwcopy.pw_shell = CS string_copy(US pw->pw_shell);
1808 /* If this should be the last hop for DSN flag the addr. */
1810 if (r->dsn_lasthop && !(addr->dsn_flags & rf_dsnlasthop))
1812 addr->dsn_flags |= rf_dsnlasthop;
1813 HDEBUG(D_route) debug_printf("DSN: last hop for %s\n", addr->address);
1816 /* Run the router, and handle the consequences. */
1818 HDEBUG(D_route) debug_printf("calling %s router\n", r->name);
1820 yield = (r->info->code)(r, addr, pw, verify, paddr_local, paddr_remote,
1821 addr_new, addr_succeed);
1823 driver_srcfile = router_name = NULL; driver_srcline = 0;
1827 HDEBUG(D_route) debug_printf("%s router forced address failure\n", r->name);
1831 /* If succeeded while verifying but fail_verify is set, convert into
1832 a failure, and take it off the local or remote delivery list. */
1834 if ( ( verify == v_sender && r->fail_verify_sender
1835 || verify == v_recipient && r->fail_verify_recipient
1837 && (yield == OK || yield == PASS))
1839 addr->message = string_sprintf("%s router forced verify failure", r->name);
1840 if (*paddr_remote == addr) *paddr_remote = addr->next;
1841 if (*paddr_local == addr) *paddr_local = addr->next;
1846 /* PASS and DECLINE are the only two cases where the loop continues. For all
1847 other returns, we break the loop and handle the result below. */
1849 if (yield != PASS && yield != DECLINE) break;
1853 debug_printf("%s router %s for %s\n", r->name,
1854 yield == PASS ? "passed" : "declined", addr->address);
1855 if (Ustrcmp(old_domain, addr->domain) != 0)
1856 debug_printf("domain %s rewritten\n", old_domain);
1859 /* PASS always continues to another router; DECLINE does so if "more"
1860 is true. Initialization insists that pass_router is always a following
1861 router. Otherwise, break the loop as if at the end of the routers. */
1865 if (r->pass_router != NULL) nextr = r->pass_router;
1869 /* Expand "more" if necessary */
1871 yield = exp_bool(addr, US"router", r->name, D_route,
1872 US"more", r->more, r->expand_more, &more);
1873 if (yield != OK) goto ROUTE_EXIT;
1878 debug_printf("\"more\" is false: skipping remaining routers\n");
1883 } /* Loop for all routers */
1885 /* On exit from the routers loop, if r == NULL we have run out of routers,
1886 either genuinely, or as a result of no_more. Otherwise, the loop ended
1887 prematurely, either because a router succeeded, or because of some special
1888 router response. Note that FAIL errors and errors detected before actually
1889 running a router go direct to ROUTE_EXIT from code above. */
1893 HDEBUG(D_route) debug_printf("no more routers\n");
1896 uschar *message = US"Unrouteable address";
1897 if (addr->router && addr->router->cannot_route_message)
1899 uschar *expmessage = expand_string(addr->router->cannot_route_message);
1902 if (!f.expand_string_forcedfail)
1903 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
1904 "cannot_route_message in %s router: %s", addr->router->name,
1905 expand_string_message);
1907 else message = expmessage;
1909 addr->user_message = addr->message = message;
1911 addr->router = NULL; /* For logging */
1918 HDEBUG(D_route) debug_printf("%s router: defer for %s\n message: %s\n",
1919 r->name, addr->address, addr->message ? addr->message : US"<none>");
1923 if (yield == DISCARD) goto ROUTE_EXIT;
1925 /* The yield must be either OK or REROUTED. */
1927 if (yield != OK && yield != REROUTED)
1928 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router returned unknown value %d",
1931 /* If the yield was REROUTED, the router put a child address on the new chain
1932 as a result of a domain change of some sort (widening, typically). */
1934 if (yield == REROUTED)
1936 HDEBUG(D_route) debug_printf("re-routed to %s\n", addr->address);
1941 /* The only remaining possibility is that the router succeeded. If the
1942 translate_ip_address options is set and host addresses were associated with the
1943 address, run them through the translation. This feature is for weird and
1944 wonderful situations (the amateur packet radio people need it) or very broken
1945 networking, so it is included in the binary only if requested. */
1947 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
1949 if (r->translate_ip_address)
1952 int old_pool = store_pool;
1953 for (host_item * h = addr->host_list; h; h = h->next)
1956 uschar *oldaddress, *oldname;
1958 if (!h->address) continue;
1960 deliver_host_address = h->address;
1961 newaddress = expand_string(r->translate_ip_address);
1962 deliver_host_address = NULL;
1966 if (f.expand_string_forcedfail) continue;
1967 addr->basic_errno = ERRNO_EXPANDFAIL;
1968 addr->message = string_sprintf("translate_ip_address expansion "
1969 "failed: %s", expand_string_message);
1974 DEBUG(D_route) debug_printf("%s [%s] translated to %s\n",
1975 h->name, h->address, newaddress);
1976 if (string_is_ip_address(newaddress, NULL) != 0)
1978 h->address = newaddress;
1983 oldaddress = h->address;
1984 h->name = newaddress;
1988 store_pool = POOL_PERM;
1989 rc = host_find_byname(h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, TRUE);
1990 store_pool = old_pool;
1992 if (rc == HOST_FIND_FAILED || rc == HOST_FIND_AGAIN)
1994 addr->basic_errno = ERRNO_UNKNOWNHOST;
1995 addr->message = string_sprintf("host %s not found when "
1996 "translating %s [%s]", h->name, oldname, oldaddress);
2002 #endif /* SUPPORT_TRANSLATE_IP_ADDRESS */
2004 /* See if this is an unseen routing; first expand the option if necessary.
2005 DEFER can be given if the expansion fails */
2007 yield = exp_bool(addr, US"router", r->name, D_route,
2008 US"unseen", r->unseen, r->expand_unseen, &unseen);
2009 if (yield != OK) goto ROUTE_EXIT;
2011 /* Debugging output recording a successful routing */
2013 HDEBUG(D_route) debug_printf("routed by %s router%s\n", r->name,
2014 unseen? " (unseen)" : "");
2018 debug_printf(" envelope to: %s\n", addr->address);
2019 debug_printf(" transport: %s\n", addr->transport
2020 ? addr->transport->name : US"<none>");
2022 if (addr->prop.errors_address)
2023 debug_printf(" errors to %s\n", addr->prop.errors_address);
2025 for (host_item * h = addr->host_list; h; h = h->next)
2027 debug_printf(" host %s", h->name);
2028 if (h->address) debug_printf(" [%s]", h->address);
2029 if (h->mx >= 0) debug_printf(" MX=%d", h->mx);
2030 else if (h->mx != MX_NONE) debug_printf(" rgroup=%d", h->mx);
2031 if (h->port != PORT_NONE) debug_printf(" port=%d", h->port);
2032 if (h->dnssec != DS_UNK) debug_printf(" dnssec=%s", h->dnssec==DS_YES ? "yes" : "no");
2037 /* Clear any temporary error message set by a router that declined, and handle
2038 the "unseen" option (ignore if there are no further routers). */
2040 addr->message = NULL;
2041 if (unseen && r->next)
2042 route_unseen(r->name, addr, paddr_local, paddr_remote, addr_new);
2044 /* Unset the address expansions, and return the final result. */
2047 if (yield == DEFER && addr->message)
2048 addr->message = expand_hide_passwords(addr->message);
2050 deliver_set_expansions(NULL);
2051 driver_srcfile = router_name = NULL; driver_srcline = 0;
2052 f.disable_logging = FALSE;
2058 /* For error messages, a string describing the config location associated
2059 with current processing. NULL if we are not in a router. */
2060 /* Name only, for now */
2063 router_current_name(void)
2065 if (!router_name) return NULL;
2066 return string_sprintf(" (router %s, %s %d)", router_name, driver_srcfile, driver_srcline);
2069 #endif /*!MACRO_PREDEF*/
2070 /* End of route.c */