Mailing List Archive

detainting a sender address in a router/transport
Hello all,
I've now spent several hours to read through all kind of Exim
documentation and mailing list postings, to find-out how to fix my
specific router/transport configuration to get rid of tainted data,
without success.
I understood that a tainted value needs to be converted to an untained
one by running a lookup function. Unfortunately, I haven't found a way
to untained the $sender_address yet so that it is available in
$sender_address_data. I hope you will be able to point me to a working
solution.

I'm using a router/transport to send email to a print by parsing it to a
script. Email should be accepted from local domains and in addition from
a list of external addresses, which are stored in a separate file.

Here is my configuration which worked in the past without any issues:

print_route:
driver = manualroute
local_part_prefix = print/
route_list = domain.de
senders = *@+local_domains : lsearch*@;/var/mail2print/senderaddresses
transport = print_transport

print_transport:
driver = pipe
command = /usr/bin/mail2print -sender "$sender_address" -queue
"$local_part"
home_directory = /tmp
user = exim

I have expected that the following router should work, because the
senders verification in the router succeeds and that
$sender_address_data then contains the untainted address, but the
variable always stays empty.

print_transport:
driver = pipe
command = /usr/bin/mail2print -sender "$sender_address_data" -queue
"$local_part_data"
home_directory = /tmp
user = exim

Thank you in advance for your help!

Regards
Juergen

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: detainting a sender address in a router/transport [ In reply to ]
Hello J?rgen!

On Fri, 29 Dec 2023, J?rgen Edner via Exim-users wrote:

> I've now spent several hours to read through all kind of Exim documentation
> and mailing list postings, to find-out how to fix my specific
> router/transport configuration to get rid of tainted data, without success.

> print_transport:
> driver = pipe
> command = /usr/bin/mail2print -sender "$sender_address" -queue
> "$local_part"

Since you're already running a script you could drop the arguments and use
the environment variables set by exim in your script. Please see the
exim specs document, chapter 'The pipe transport', section 'Environment
variables'.

ciao
Markus
--
/ Markus Reschke \
\ madires@theca-tabellaria.de /

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: detainting a sender address in a router/transport [ In reply to ]
Hello Markus,

>> I've now spent several hours to read through all kind of Exim documentation
>> and mailing list postings, to find-out how to fix my specific
>> router/transport configuration to get rid of tainted data, without success.
>
>> print_transport:
>> driver = pipe
>> command = /usr/bin/mail2print -sender "$sender_address" -queue
>> "$local_part"
>
> Since you're already running a script you could drop the arguments and use
> the environment variables set by exim in your script. Please see the
> exim specs document, chapter 'The pipe transport', section 'Environment
> variables'.

thank for your reply. To be honest I've found that solution already and
it is defintely working, but I
- was afraid that it might be impacted by some kind of tainted checks in
the future.
- was curious if there would be any solution I might have missed. I
found many other recommendations how to fix tainting issue but non seem
to have covered the sender address itself.

Regards
Juergen

--
Mail: juergen.edner@telejeck.de
GPG Key available


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: detainting a sender address in a router/transport [ In reply to ]
On 12/29/23 10:18, Jürgen Edner via Exim-users wrote:
> print_route:
>   driver     = manualroute
>   local_part_prefix = print/
>   route_list = domain.de
>   senders    = *@+local_domains : lsearch*@;/var/mail2print/senderaddresses
>   transport  = print_transport

> print_transport:
> driver = pipe
> command = /usr/bin/mail2print -sender "$sender_address_data" -queue "$local_part_data"
> home_directory = /tmp
> user = exim


So, that "senders=" option should be a good candidate for
filling in $sender_data. Note: not $sender_address_data.

If adjusting the transport doesn't work at first, test using
"-d+all -bt".
--
Cheers,
Jeremy


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: detainting a sender address in a router/transport [ In reply to ]
Hello Jeremy,

On 12/29/23 10:18, Jürgen Edner via Exim-users wrote:

>> print_route:
>> driver = manualroute
>> local_part_prefix = print/
>> route_list = domain.de
>> senders = *@+local_domains :
lsearch*@;/var/mail2print/senderaddresses
>> transport = print_transport

>> print_transport:
>> driver = pipe
>> command = /usr/bin/mail2print -sender "$sender_data" -queue
"$local_part_data"
>> home_directory = /tmp
> user = exim

> So, that "senders=" option should be a good candidate for
> filling in $sender_data. Note: not $sender_address_data.

Thank you for the hint. I gave it a try and checked what happed in
detail. Unfortunately, $sender_data doesn't contain the correct sender
address after the senders check has been succeeded, instead a part of
the matching check is returned.

13668 stripped prefix print/
13668 checking senders
13668 address match test: subject=juergen@domain.de pattern=*@+local_domains
13668 domain.de in "/etc/exim-localdomains"? yes (matched ...
13668 domain.de in "+local_domains"? yes (matched "+local_domains")
13668 juergen@domain.de in "*@+local_domains :
lsearch*@;/var/mail2print/senderaddresses"? yes (matched "*@+local_domains")
13668 sender_address=juergen@domain.de /
sender_data=*@+local_doma@domain.de <<<< !!!!

Regards
Juergen

--
Mail: juergen.edner@telejeck.de
GPG Key available


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: detainting a sender address in a router/transport [ In reply to ]
On 12/30/23 12:50, Jürgen Edner via Exim-users wrote:
> 13668 juergen@domain.de in "*@+local_domains : lsearch*@;/var/mail2print/senderaddresses"? yes (matched "*@+local_domains")

Oh, so you're not actually using a lookup.

Could you?
--
Cheers,
Jeremy


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@lists.exim.org
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/