Implement freeze_signal on pipe transport.

Patch from Jakob Hirsch.

fixes bug 1042

5 files changed, 38 insertions, 3 deletions

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 9dacb979c..b75e36ba4 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -21033,9 +21033,14 @@ later"&. In this case, delivery is deferred. Details of a permanent failure are
 logged, but are not included in the bounce message, which merely contains
 &"local delivery failed"&.
 
+If the command exits on a signal and the &%freeze_signal%& option is set then
+the message will be frozen in the queue. If that option is not set, a bounce
+will be sent as normal.
+
 If the return code is greater than 128 and the command being run is a shell
 script, it normally means that the script was terminated by a signal whose
-value is the return code minus 128.
+value is the return code minus 128. The &%freeze_signal%& option does not
+apply in this case.
 
 If Exim is unable to run the command (that is, if &[execve()]& fails), the
 return code is set to 127. This is the value that a shell returns if it is
@@ -21244,6 +21249,16 @@ is set, failure to exec is treated specially, and causes the message to be
 frozen, whatever the setting of &%ignore_status%&.
 
 
+.new
+.otion freeze_signal pipe boolean false
+.cindex "signal exit"
+.cidenx "&(pipe)& transport", "signal exit"
+Normally if the process run by a command in a pipe transport exits on a signal,
+a bounce message is sent. If &%freeze_signal%& is set, the message will be
+frozen in Exim's queue instead.
+.wen
+
+
 .option ignore_status pipe boolean false
 If this option is true, the status returned by the subprocess that is set up to
 run the command is ignored, and Exim behaves as if zero had been returned.
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 5d636a74d..7aeba3d3c 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -41,6 +41,9 @@ NM/04 Fixed exiqgrep to cope with mailq missing size issue
 PP/05 Bugzilla 1083: when lookup expansion defers, escape the output which
       is logged, to avoid truncation. Patch from John Horne.
 
+PP/06 Bugzilla 1042: implement freeze_signal on pipe transports.
+      Patch from Jakob Hirsch.
+
 
 Exim version 4.74
 -----------------
diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index 55bde992d..46fd6c4d8 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -18,6 +18,10 @@ Version 4.75
     this: ldap_ca_cert_dir, ldap_ca_cert_file, ldap_cert_file, ldap_cert_key,
     ldap_cipher_suite, ldap_require_cert, ldap_start_tls.
 
+ 2. The pipe transport now takes a boolean option, "freeze_signal", default
+    false.  When true, if the external delivery command exits on a signal then
+    Exim will freeze the message in the queue, instead of generating a bounce.
+
 
 Version 4.74
 ------------
diff --git a/src/src/transports/pipe.c b/src/src/transports/pipe.c
index 2464abd14..a681bc42d 100644
--- a/src/src/transports/pipe.c
+++ b/src/src/transports/pipe.c
@@ -41,6 +41,8 @@ optionlist pipe_transport_options[] = {
       (void *)offsetof(pipe_transport_options_block, escape_string) },
   { "freeze_exec_fail",  opt_bool,
       (void *)offsetof(pipe_transport_options_block, freeze_exec_fail) },
+  { "freeze_signal",     opt_bool,
+      (void *)offsetof(pipe_transport_options_block, freeze_signal) },
   { "ignore_status",     opt_bool,
       (void *)offsetof(pipe_transport_options_block, ignore_status) },
   { "log_defer_output",  opt_bool | opt_public,
@@ -111,6 +113,7 @@ pipe_transport_options_block pipe_transport_option_defaults = {
   60*60,          /* timeout */
   0,              /* options */
   FALSE,          /* freeze_exec_fail */
+  FALSE,          /* freeze_signal */
   FALSE,          /* ignore_status */
   FALSE,          /* permit_coredump */
   FALSE,          /* restrict_to_path */
@@ -960,11 +963,20 @@ if ((rc = child_close(pid, timeout)) != 0)
   /* Either the process completed, but yielded a non-zero (necessarily
   positive) status, or the process was terminated by a signal (rc will contain
   the negation of the signal number). Treat killing by signal as failure unless
-  status is being ignored. */
+  status is being ignored. By default, the message is bounced back, unless
+  freeze_signal is set, in which case it is frozen instead. */
 
   else if (rc < 0)
     {
-    if (!ob->ignore_status)
+    if (ob->freeze_signal)
+      {
+      addr->transport_return = DEFER;
+      addr->special_action = SPECIAL_FREEZE;
+      addr->message = string_sprintf("Child process of %s transport (running "
+        "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
+        -rc, os_strsignal(-rc), tmsg);
+      }
+    else if (!ob->ignore_status)
       {
       addr->transport_return = FAIL;
       addr->message = string_sprintf("Child process of %s transport (running "
diff --git a/src/src/transports/pipe.h b/src/src/transports/pipe.h
index da141c0d1..765c14092 100644
--- a/src/src/transports/pipe.h
+++ b/src/src/transports/pipe.h
@@ -24,6 +24,7 @@ typedef struct {
   int   timeout;
   int   options;
   BOOL  freeze_exec_fail;
+  BOOL  freeze_signal;
   BOOL  ignore_status;
   BOOL  permit_coredump;
   BOOL  restrict_to_path;