Skip to content

Enforce the pipe capability in Exim, not just in the web UI #300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kaluang wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Enforce the pipe capability in Exim, not just in the web UI #300

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 23 additions & 1 deletion docs/debian-conf.d/router/250_vexim_virtual_domains
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,25 @@ virtual_forward:
and users.on_forward = '1' \
and users.domain_id=domains.domain_id}}}{1} }} {yes}{no} }

virtual_piped:
driver = redirect
domains = +local_domains
allow_fail
data = ${lookup mysql{select smtp from users,domains \
where localpart = '${quote_mysql:$local_part}' \
and domain = '${quote_mysql:$domain}' \
and users.on_piped = '1' \
and domains.pipe = '1' \
and domains.enabled = '1' \
and users.enabled = '1' \
and users.domain_id = domains.domain_id}}
.ifdef VEXIM_LOCALPART_SUFFIX
local_part_suffix = VEXIM_LOCALPART_SUFFIX
local_part_suffix_optional
.endif
retry_use_local_part
pipe_transport = address_pipe

@rimas-kudelis rimas-kudelis Jun 10, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I noticed you haven't added file_transport and reply_transport here. Do non-piped emails get ignored by this router?

@kaluang kaluang Jun 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The lookup in virtual_piped only returns something for on_piped users (on a pipe-enabled domain) and that is handled by the address_pipe transport. For everyone else it matches nothing, so the router simply declines and the message falls through to virtual_domains as usual.

That is also why there's no file_transport/reply_transport, this router only ever hands off a |command, never a mailbox file or a reply. The one thing it would not cover is a misconfigured piped account when smtp is not actually a pipe, which would just defer. But I could add a file_transport or an on_piped condition if you prefer.

@rimas-kudelis rimas-kudelis Jun 10, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess I was wondering about a misconfigured account, yeah. Will such case not fall through to the next router? If not, perhaps a maybe it would make sense to check that the smtp field has the | character as well?


virtual_domains:
driver = redirect
domains = +local_domains
Expand Down Expand Up @@ -67,7 +86,10 @@ virtual_domains:
retry_use_local_part
file_transport = virtual_delivery
reply_transport = address_reply
pipe_transport = address_pipe
# Piped delivery is handled by the virtual_piped router, which checks that
# the user is on_piped and the domain allows pipe. Refuse pipes here so a
# stray "|command" in the smtp field can never be executed by this router.
forbid_pipe

# A group is a list of users
#
Expand Down