~ubuntu-branches/ubuntu/vivid/exim4/vivid
» Revision
59
: .pc/77_close-the-server-side-of-TLS.diff/src/exim.c
« back to all changes in this revision
Viewing changes to .pc/77_close-the-server-side-of-TLS.diff/src/exim.c
- browse files at revision 59
- compare with another revision
- download diff
- download tarball
- view history from revision 59
- Committer: Package Import Robot
- Author(s): Corey Bryant
- Date: 2014-08-04 11:48:39 UTC
- mfrom: (56.1.2 utopic)
- Revision ID: package-import@ubuntu.com-20140804114839-xoulpcx9nxi5m72u
Tags: 4.84~RC1-3ubuntu1
* Merge from Debian unstable (LP: #1351470). Remaining changes:
- Show Ubuntu distribution on smtp:
+ debian/patches/fix_smtp_banner.patch: updated SMTP banner
with Ubuntu distribution
+ debian/control: added lsb-release build dependency
- Don't provide default-mta; in Ubuntu, we want postfix to be the
default.
- Show Ubuntu distribution on smtp:
+ debian/patches/fix_smtp_banner.patch: updated SMTP banner
with Ubuntu distribution
+ debian/control: added lsb-release build dependency
- Don't provide default-mta; in Ubuntu, we want postfix to be the
default.
- files added:
- README.DSN
- files removed:
- .pc/75_unbind-ldap-connection.diff
- .pc/75_unbind-ldap-connection.diff/src
- .pc/75_unbind-ldap-connection.diff/src/lookups
- .pc/76_fix_ldap_option_setting.diff
- .pc/76_fix_ldap_option_setting.diff/src
- .pc/76_fix_ldap_option_setting.diff/src/lookups
- .pc/77_close-the-server-side-of-TLS.diff
- .pc/77_close-the-server-side-of-TLS.diff/src
- .pc/80_fix_ftbfs_hurd.diff
- .pc/80_fix_ftbfs_hurd.diff/src
- .pc/87_double_expansion.diff
- .pc/87_double_expansion.diff/src
- files modified:
- .gitignore
added
removed
.pc/77_close-the-server-side-of-TLS.diff/src/exim.c
1
/*************************************************
2
* Exim - an Internet mail transport agent *
3
*************************************************/
4
5
/* Copyright (c) University of Cambridge 1995 - 2012 */
6
/* See the file NOTICE for conditions of use and distribution. */
7
8
9
/* The main function: entry point, initialization, and high-level control.
10
Also a few functions that don't naturally fit elsewhere. */
11
12
13
#include "exim.h"
14
15
extern void init_lookup_list(void);
16
17
18
19
/*************************************************
20
* Function interface to store functions *
21
*************************************************/
22
23
/* We need some real functions to pass to the PCRE regular expression library
24
for store allocation via Exim's store manager. The normal calls are actually
25
macros that pass over location information to make tracing easier. These
26
functions just interface to the standard macro calls. A good compiler will
27
optimize out the tail recursion and so not make them too expensive. There
28
are two sets of functions; one for use when we want to retain the compiled
29
regular expression for a long time; the other for short-term use. */
30
31
static void *
32
function_store_get(size_t size)
33
{
34
return store_get((int)size);
35
}
36
37
static void
38
function_dummy_free(void *block) { block = block; }
39
40
static void *
41
function_store_malloc(size_t size)
42
{
43
return store_malloc((int)size);
44
}
45
46
static void
47
function_store_free(void *block)
48
{
49
store_free(block);
50
}
51
52
53
54
55
/*************************************************
56
* Enums for cmdline interface *
57
*************************************************/
58
59
enum commandline_info { CMDINFO_NONE=0,
60
CMDINFO_HELP, CMDINFO_SIEVE, CMDINFO_DSCP };
61
62
63
64
65
/*************************************************
66
* Compile regular expression and panic on fail *
67
*************************************************/
68
69
/* This function is called when failure to compile a regular expression leads
70
to a panic exit. In other cases, pcre_compile() is called directly. In many
71
cases where this function is used, the results of the compilation are to be
72
placed in long-lived store, so we temporarily reset the store management
73
functions that PCRE uses if the use_malloc flag is set.
74
75
Argument:
76
pattern the pattern to compile
77
caseless TRUE if caseless matching is required
78
use_malloc TRUE if compile into malloc store
79
80
Returns: pointer to the compiled pattern
81
*/
82
83
const pcre *
84
regex_must_compile(uschar *pattern, BOOL caseless, BOOL use_malloc)
85
{
86
int offset;
87
int options = PCRE_COPT;
88
const pcre *yield;
89
const uschar *error;
90
if (use_malloc)
91
{
92
pcre_malloc = function_store_malloc;
93
pcre_free = function_store_free;
94
}
95
if (caseless) options |= PCRE_CASELESS;
96
yield = pcre_compile(CS pattern, options, (const char **)&error, &offset, NULL);
97
pcre_malloc = function_store_get;
98
pcre_free = function_dummy_free;
99
if (yield == NULL)
100
log_write(0, LOG_MAIN|LOG_PANIC_DIE, "regular expression error: "
101
"%s at offset %d while compiling %s", error, offset, pattern);
102
return yield;
103
}
104
105
106
107
108
/*************************************************
109
* Execute regular expression and set strings *
110
*************************************************/
111
112
/* This function runs a regular expression match, and sets up the pointers to
113
the matched substrings.
114
115
Arguments:
116
re the compiled expression
117
subject the subject string
118
options additional PCRE options
119
setup if < 0 do full setup
120
if >= 0 setup from setup+1 onwards,
121
excluding the full matched string
122
123
Returns: TRUE or FALSE
124
*/
125
126
BOOL
127
regex_match_and_setup(const pcre *re, uschar *subject, int options, int setup)
128
{
129
int ovector[3*(EXPAND_MAXN+1)];
130
int n = pcre_exec(re, NULL, CS subject, Ustrlen(subject), 0,
131
PCRE_EOPT | options, ovector, sizeof(ovector)/sizeof(int));
132
BOOL yield = n >= 0;
133
if (n == 0) n = EXPAND_MAXN + 1;
134
if (yield)
135
{
136
int nn;
137
expand_nmax = (setup < 0)? 0 : setup + 1;
138
for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
139
{
140
expand_nstring[expand_nmax] = subject + ovector[nn];
141
expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
142
}
143
expand_nmax--;
144
}
145
return yield;
146
}
147
148
149
150
151
/*************************************************
152
* Set up processing details *
153
*************************************************/
154
155
/* Save a text string for dumping when SIGUSR1 is received.
156
Do checks for overruns.
157
158
Arguments: format and arguments, as for printf()
159
Returns: nothing
160
*/
161
162
void
163
set_process_info(const char *format, ...)
164
{
165
int len;
166
va_list ap;
167
sprintf(CS process_info, "%5d ", (int)getpid());
168
len = Ustrlen(process_info);
169
va_start(ap, format);
170
if (!string_vformat(process_info + len, PROCESS_INFO_SIZE - len - 2, format, ap))
171
Ustrcpy(process_info + len, "**** string overflowed buffer ****");
172
len = Ustrlen(process_info);
173
process_info[len+0] = '\n';
174
process_info[len+1] = '\0';
175
process_info_len = len + 1;
176
DEBUG(D_process_info) debug_printf("set_process_info: %s", process_info);
177
va_end(ap);
178
}
179
180
181
182
183
/*************************************************
184
* Handler for SIGUSR1 *
185
*************************************************/
186
187
/* SIGUSR1 causes any exim process to write to the process log details of
188
what it is currently doing. It will only be used if the OS is capable of
189
setting up a handler that causes automatic restarting of any system call
190
that is in progress at the time.
191
192
This function takes care to be signal-safe.
193
194
Argument: the signal number (SIGUSR1)
195
Returns: nothing
196
*/
197
198
static void
199
usr1_handler(int sig)
200
{
201
int fd;
202
203
os_restarting_signal(sig, usr1_handler);
204
205
fd = Uopen(process_log_path, O_APPEND|O_WRONLY, LOG_MODE);
206
if (fd < 0)
207
{
208
/* If we are already running as the Exim user, try to create it in the
209
current process (assuming spool_directory exists). Otherwise, if we are
210
root, do the creation in an exim:exim subprocess. */
211
212
int euid = geteuid();
213
if (euid == exim_uid)
214
fd = Uopen(process_log_path, O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
215
else if (euid == root_uid)
216
fd = log_create_as_exim(process_log_path);
217
}
218
219
/* If we are neither exim nor root, or if we failed to create the log file,
220
give up. There is not much useful we can do with errors, since we don't want
221
to disrupt whatever is going on outside the signal handler. */
222
223
if (fd < 0) return;
224
225
{int dummy = write(fd, process_info, process_info_len); dummy = dummy; }
226
(void)close(fd);
227
}
228
229
230
231
/*************************************************
232
* Timeout handler *
233
*************************************************/
234
235
/* This handler is enabled most of the time that Exim is running. The handler
236
doesn't actually get used unless alarm() has been called to set a timer, to
237
place a time limit on a system call of some kind. When the handler is run, it
238
re-enables itself.
239
240
There are some other SIGALRM handlers that are used in special cases when more
241
than just a flag setting is required; for example, when reading a message's
242
input. These are normally set up in the code module that uses them, and the
243
SIGALRM handler is reset to this one afterwards.
244
245
Argument: the signal value (SIGALRM)
246
Returns: nothing
247
*/
248
249
void
250
sigalrm_handler(int sig)
251
{
252
sig = sig; /* Keep picky compilers happy */
253
sigalrm_seen = TRUE;
254
os_non_restarting_signal(SIGALRM, sigalrm_handler);
255
}
256
257
258
259
/*************************************************
260
* Sleep for a fractional time interval *
261
*************************************************/
262
263
/* This function is called by millisleep() and exim_wait_tick() to wait for a
264
period of time that may include a fraction of a second. The coding is somewhat
265
tedious. We do not expect setitimer() ever to fail, but if it does, the process
266
will wait for ever, so we panic in this instance. (There was a case of this
267
when a bug in a function that calls milliwait() caused it to pass invalid data.
268
That's when I added the check. :-)
269
270
Argument: an itimerval structure containing the interval
271
Returns: nothing
272
*/
273
274
static void
275
milliwait(struct itimerval *itval)
276
{
277
sigset_t sigmask;
278
sigset_t old_sigmask;
279
(void)sigemptyset(&sigmask); /* Empty mask */
280
(void)sigaddset(&sigmask, SIGALRM); /* Add SIGALRM */
281
(void)sigprocmask(SIG_BLOCK, &sigmask, &old_sigmask); /* Block SIGALRM */
282
if (setitimer(ITIMER_REAL, itval, NULL) < 0) /* Start timer */
283
log_write(0, LOG_MAIN|LOG_PANIC_DIE,
284
"setitimer() failed: %s", strerror(errno));
285
(void)sigfillset(&sigmask); /* All signals */
286
(void)sigdelset(&sigmask, SIGALRM); /* Remove SIGALRM */
287
(void)sigsuspend(&sigmask); /* Until SIGALRM */
288
(void)sigprocmask(SIG_SETMASK, &old_sigmask, NULL); /* Restore mask */
289
}
290
291
292
293
294
/*************************************************
295
* Millisecond sleep function *
296
*************************************************/
297
298
/* The basic sleep() function has a granularity of 1 second, which is too rough
299
in some cases - for example, when using an increasing delay to slow down
300
spammers.
301
302
Argument: number of millseconds
303
Returns: nothing
304
*/
305
306
void
307
millisleep(int msec)
308
{
309
struct itimerval itval;
310
itval.it_interval.tv_sec = 0;
311
itval.it_interval.tv_usec = 0;
312
itval.it_value.tv_sec = msec/1000;
313
itval.it_value.tv_usec = (msec % 1000) * 1000;
314
milliwait(&itval);
315
}
316
317
318
319
/*************************************************
320
* Compare microsecond times *
321
*************************************************/
322
323
/*
324
Arguments:
325
tv1 the first time
326
tv2 the second time
327
328
Returns: -1, 0, or +1
329
*/
330
331
int
332
exim_tvcmp(struct timeval *t1, struct timeval *t2)
333
{
334
if (t1->tv_sec > t2->tv_sec) return +1;
335
if (t1->tv_sec < t2->tv_sec) return -1;
336
if (t1->tv_usec > t2->tv_usec) return +1;
337
if (t1->tv_usec < t2->tv_usec) return -1;
338
return 0;
339
}
340
341
342
343
344
/*************************************************
345
* Clock tick wait function *
346
*************************************************/
347
348
/* Exim uses a time + a pid to generate a unique identifier in two places: its
349
message IDs, and in file names for maildir deliveries. Because some OS now
350
re-use pids within the same second, sub-second times are now being used.
351
However, for absolute certaintly, we must ensure the clock has ticked before
352
allowing the relevant process to complete. At the time of implementation of
353
this code (February 2003), the speed of processors is such that the clock will
354
invariably have ticked already by the time a process has done its job. This
355
function prepares for the time when things are faster - and it also copes with
356
clocks that go backwards.
357
358
Arguments:
359
then_tv A timeval which was used to create uniqueness; its usec field
360
has been rounded down to the value of the resolution.
361
We want to be sure the current time is greater than this.
362
resolution The resolution that was used to divide the microseconds
363
(1 for maildir, larger for message ids)
364
365
Returns: nothing
366
*/
367
368
void
369
exim_wait_tick(struct timeval *then_tv, int resolution)
370
{
371
struct timeval now_tv;
372
long int now_true_usec;
373
374
(void)gettimeofday(&now_tv, NULL);
375
now_true_usec = now_tv.tv_usec;
376
now_tv.tv_usec = (now_true_usec/resolution) * resolution;
377
378
if (exim_tvcmp(&now_tv, then_tv) <= 0)
379
{
380
struct itimerval itval;
381
itval.it_interval.tv_sec = 0;
382
itval.it_interval.tv_usec = 0;
383
itval.it_value.tv_sec = then_tv->tv_sec - now_tv.tv_sec;
384
itval.it_value.tv_usec = then_tv->tv_usec + resolution - now_true_usec;
385
386
/* We know that, overall, "now" is less than or equal to "then". Therefore, a
387
negative value for the microseconds is possible only in the case when "now"
388
is more than a second less than "then". That means that itval.it_value.tv_sec
389
is greater than zero. The following correction is therefore safe. */
390
391
if (itval.it_value.tv_usec < 0)
392
{
393
itval.it_value.tv_usec += 1000000;
394
itval.it_value.tv_sec -= 1;
395
}
396
397
DEBUG(D_transport|D_receive)
398
{
399
if (!running_in_test_harness)
400
{
401
debug_printf("tick check: %lu.%06lu %lu.%06lu\n",
402
then_tv->tv_sec, then_tv->tv_usec, now_tv.tv_sec, now_tv.tv_usec);
403
debug_printf("waiting %lu.%06lu\n", itval.it_value.tv_sec,
404
itval.it_value.tv_usec);
405
}
406
}
407
408
milliwait(&itval);
409
}
410
}
411
412
413
414
415
/*************************************************
416
* Call fopen() with umask 777 and adjust mode *
417
*************************************************/
418
419
/* Exim runs with umask(0) so that files created with open() have the mode that
420
is specified in the open() call. However, there are some files, typically in
421
the spool directory, that are created with fopen(). They end up world-writeable
422
if no precautions are taken. Although the spool directory is not accessible to
423
the world, this is an untidiness. So this is a wrapper function for fopen()
424
that sorts out the mode of the created file.
425
426
Arguments:
427
filename the file name
428
options the fopen() options
429
mode the required mode
430
431
Returns: the fopened FILE or NULL
432
*/
433
434
FILE *
435
modefopen(const uschar *filename, const char *options, mode_t mode)
436
{
437
mode_t saved_umask = umask(0777);
438
FILE *f = Ufopen(filename, options);
439
(void)umask(saved_umask);
440
if (f != NULL) (void)fchmod(fileno(f), mode);
441
return f;
442
}
443
444
445
446
447
/*************************************************
448
* Ensure stdin, stdout, and stderr exist *
449
*************************************************/
450
451
/* Some operating systems grumble if an exec() happens without a standard
452
input, output, and error (fds 0, 1, 2) being defined. The worry is that some
453
file will be opened and will use these fd values, and then some other bit of
454
code will assume, for example, that it can write error messages to stderr.
455
This function ensures that fds 0, 1, and 2 are open if they do not already
456
exist, by connecting them to /dev/null.
457
458
This function is also used to ensure that std{in,out,err} exist at all times,
459
so that if any library that Exim calls tries to use them, it doesn't crash.
460
461
Arguments: None
462
Returns: Nothing
463
*/
464
465
void
466
exim_nullstd(void)
467
{
468
int i;
469
int devnull = -1;
470
struct stat statbuf;
471
for (i = 0; i <= 2; i++)
472
{
473
if (fstat(i, &statbuf) < 0 && errno == EBADF)
474
{
475
if (devnull < 0) devnull = open("/dev/null", O_RDWR);
476
if (devnull < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
477
string_open_failed(errno, "/dev/null"));
478
if (devnull != i) (void)dup2(devnull, i);
479
}
480
}
481
if (devnull > 2) (void)close(devnull);
482
}
483
484
485
486
487
/*************************************************
488
* Close unwanted file descriptors for delivery *
489
*************************************************/
490
491
/* This function is called from a new process that has been forked to deliver
492
an incoming message, either directly, or using exec.
493
494
We want any smtp input streams to be closed in this new process. However, it
495
has been observed that using fclose() here causes trouble. When reading in -bS
496
input, duplicate copies of messages have been seen. The files will be sharing a
497
file pointer with the parent process, and it seems that fclose() (at least on
498
some systems - I saw this on Solaris 2.5.1) messes with that file pointer, at
499
least sometimes. Hence we go for closing the underlying file descriptors.
500
501
If TLS is active, we want to shut down the TLS library, but without molesting
502
the parent's SSL connection.
503
504
For delivery of a non-SMTP message, we want to close stdin and stdout (and
505
stderr unless debugging) because the calling process might have set them up as
506
pipes and be waiting for them to close before it waits for the submission
507
process to terminate. If they aren't closed, they hold up the calling process
508
until the initial delivery process finishes, which is not what we want.
509
510
Exception: We do want it for synchronous delivery!
511
512
And notwithstanding all the above, if D_resolver is set, implying resolver
513
debugging, leave stdout open, because that's where the resolver writes its
514
debugging output.
515
516
When we close stderr (which implies we've also closed stdout), we also get rid
517
of any controlling terminal.
518
519
Arguments: None
520
Returns: Nothing
521
*/
522
523
static void
524
close_unwanted(void)
525
{
526
if (smtp_input)
527
{
528
#ifdef SUPPORT_TLS
529
tls_close(FALSE, FALSE); /* Shut down the TLS library */
530
#endif
531
(void)close(fileno(smtp_in));
532
(void)close(fileno(smtp_out));
533
smtp_in = NULL;
534
}
535
else
536
{
537
(void)close(0); /* stdin */
538
if ((debug_selector & D_resolver) == 0) (void)close(1); /* stdout */
539
if (debug_selector == 0) /* stderr */
540
{
541
if (!synchronous_delivery)
542
{
543
(void)close(2);
544
log_stderr = NULL;
545
}
546
(void)setsid();
547
}
548
}
549
}
550
551
552
553
554
/*************************************************
555
* Set uid and gid *
556
*************************************************/
557
558
/* This function sets a new uid and gid permanently, optionally calling
559
initgroups() to set auxiliary groups. There are some special cases when running
560
Exim in unprivileged modes. In these situations the effective uid will not be
561
root; if we already have the right effective uid/gid, and don't need to
562
initialize any groups, leave things as they are.
563
564
Arguments:
565
uid the uid
566
gid the gid
567
igflag TRUE if initgroups() wanted
568
msg text to use in debugging output and failure log
569
570
Returns: nothing; bombs out on failure
571
*/
572
573
void
574
exim_setugid(uid_t uid, gid_t gid, BOOL igflag, uschar *msg)
575
{
576
uid_t euid = geteuid();
577
gid_t egid = getegid();
578
579
if (euid == root_uid || euid != uid || egid != gid || igflag)
580
{
581
/* At least one OS returns +1 for initgroups failure, so just check for
582
non-zero. */
583
584
if (igflag)
585
{
586
struct passwd *pw = getpwuid(uid);
587
if (pw != NULL)
588
{
589
if (initgroups(pw->pw_name, gid) != 0)
590
log_write(0,LOG_MAIN|LOG_PANIC_DIE,"initgroups failed for uid=%ld: %s",
591
(long int)uid, strerror(errno));
592
}
593
else log_write(0, LOG_MAIN|LOG_PANIC_DIE, "cannot run initgroups(): "
594
"no passwd entry for uid=%ld", (long int)uid);
595
}
596
597
if (setgid(gid) < 0 || setuid(uid) < 0)
598
{
599
log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to set gid=%ld or uid=%ld "
600
"(euid=%ld): %s", (long int)gid, (long int)uid, (long int)euid, msg);
601
}
602
}
603
604
/* Debugging output included uid/gid and all groups */
605
606
DEBUG(D_uid)
607
{
608
int group_count, save_errno;
609
gid_t group_list[NGROUPS_MAX];
610
debug_printf("changed uid/gid: %s\n uid=%ld gid=%ld pid=%ld\n", msg,
611
(long int)geteuid(), (long int)getegid(), (long int)getpid());
612
group_count = getgroups(NGROUPS_MAX, group_list);
613
save_errno = errno;
614
debug_printf(" auxiliary group list:");
615
if (group_count > 0)
616
{
617
int i;
618
for (i = 0; i < group_count; i++) debug_printf(" %d", (int)group_list[i]);
619
}
620
else if (group_count < 0)
621
debug_printf(" <error: %s>", strerror(save_errno));
622
else debug_printf(" <none>");
623
debug_printf("\n");
624
}
625
}
626
627
628
629
630
/*************************************************
631
* Exit point *
632
*************************************************/
633
634
/* Exim exits via this function so that it always clears up any open
635
databases.
636
637
Arguments:
638
rc return code
639
640
Returns: does not return
641
*/
642
643
void
644
exim_exit(int rc)
645
{
646
search_tidyup();
647
DEBUG(D_any)
648
debug_printf(">>>>>>>>>>>>>>>> Exim pid=%d terminating with rc=%d "
649
">>>>>>>>>>>>>>>>\n", (int)getpid(), rc);
650
exit(rc);
651
}
652
653
654
655
656
/*************************************************
657
* Extract port from host address *
658
*************************************************/
659
660
/* Called to extract the port from the values given to -oMa and -oMi.
661
It also checks the syntax of the address, and terminates it before the
662
port data when a port is extracted.
663
664
Argument:
665
address the address, with possible port on the end
666
667
Returns: the port, or zero if there isn't one
668
bombs out on a syntax error
669
*/
670
671
static int
672
check_port(uschar *address)
673
{
674
int port = host_address_extract_port(address);
675
if (string_is_ip_address(address, NULL) == 0)
676
{
677
fprintf(stderr, "exim abandoned: \"%s\" is not an IP address\n", address);
678
exit(EXIT_FAILURE);
679
}
680
return port;
681
}
682
683
684
685
/*************************************************
686
* Test/verify an address *
687
*************************************************/
688
689
/* This function is called by the -bv and -bt code. It extracts a working
690
address from a full RFC 822 address. This isn't really necessary per se, but it
691
has the effect of collapsing source routes.
692
693
Arguments:
694
s the address string
695
flags flag bits for verify_address()
696
exit_value to be set for failures
697
698
Returns: nothing
699
*/
700
701
static void
702
test_address(uschar *s, int flags, int *exit_value)
703
{
704
int start, end, domain;
705
uschar *parse_error = NULL;
706
uschar *address = parse_extract_address(s, &parse_error, &start, &end, &domain,
707
FALSE);
708
if (address == NULL)
709
{
710
fprintf(stdout, "syntax error: %s\n", parse_error);
711
*exit_value = 2;
712
}
713
else
714
{
715
int rc = verify_address(deliver_make_addr(address,TRUE), stdout, flags, -1,
716
-1, -1, NULL, NULL, NULL);
717
if (rc == FAIL) *exit_value = 2;
718
else if (rc == DEFER && *exit_value == 0) *exit_value = 1;
719
}
720
}
721
722
723
724
/*************************************************
725
* Show supported features *
726
*************************************************/
727
728
/* This function is called for -bV/--version and for -d to output the optional
729
features of the current Exim binary.
730
731
Arguments: a FILE for printing
732
Returns: nothing
733
*/
734
735
static void
736
show_whats_supported(FILE *f)
737
{
738
auth_info *authi;
739
740
#ifdef DB_VERSION_STRING
741
fprintf(f, "Berkeley DB: %s\n", DB_VERSION_STRING);
742
#elif defined(BTREEVERSION) && defined(HASHVERSION)
743
#ifdef USE_DB
744
fprintf(f, "Probably Berkeley DB version 1.8x (native mode)\n");
745
#else
746
fprintf(f, "Probably Berkeley DB version 1.8x (compatibility mode)\n");
747
#endif
748
#elif defined(_DBM_RDONLY) || defined(dbm_dirfno)
749
fprintf(f, "Probably ndbm\n");
750
#elif defined(USE_TDB)
751
fprintf(f, "Using tdb\n");
752
#else
753
#ifdef USE_GDBM
754
fprintf(f, "Probably GDBM (native mode)\n");
755
#else
756
fprintf(f, "Probably GDBM (compatibility mode)\n");
757
#endif
758
#endif
759
760
fprintf(f, "Support for:");
761
#ifdef SUPPORT_CRYPTEQ
762
fprintf(f, " crypteq");
763
#endif
764
#if HAVE_ICONV
765
fprintf(f, " iconv()");
766
#endif
767
#if HAVE_IPV6
768
fprintf(f, " IPv6");
769
#endif
770
#ifdef HAVE_SETCLASSRESOURCES
771
fprintf(f, " use_setclassresources");
772
#endif
773
#ifdef SUPPORT_PAM
774
fprintf(f, " PAM");
775
#endif
776
#ifdef EXIM_PERL
777
fprintf(f, " Perl");
778
#endif
779
#ifdef EXPAND_DLFUNC
780
fprintf(f, " Expand_dlfunc");
781
#endif
782
#ifdef USE_TCP_WRAPPERS
783
fprintf(f, " TCPwrappers");
784
#endif
785
#ifdef SUPPORT_TLS
786
#ifdef USE_GNUTLS
787
fprintf(f, " GnuTLS");
788
#else
789
fprintf(f, " OpenSSL");
790
#endif
791
#endif
792
#ifdef SUPPORT_TRANSLATE_IP_ADDRESS
793
fprintf(f, " translate_ip_address");
794
#endif
795
#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
796
fprintf(f, " move_frozen_messages");
797
#endif
798
#ifdef WITH_CONTENT_SCAN
799
fprintf(f, " Content_Scanning");
800
#endif
801
#ifndef DISABLE_DKIM
802
fprintf(f, " DKIM");
803
#endif
804
#ifdef WITH_OLD_DEMIME
805
fprintf(f, " Old_Demime");
806
#endif
807
#ifdef EXPERIMENTAL_SPF
808
fprintf(f, " Experimental_SPF");
809
#endif
810
#ifdef EXPERIMENTAL_SRS
811
fprintf(f, " Experimental_SRS");
812
#endif
813
#ifdef EXPERIMENTAL_BRIGHTMAIL
814
fprintf(f, " Experimental_Brightmail");
815
#endif
816
#ifdef EXPERIMENTAL_DCC
817
fprintf(f, " Experimental_DCC");
818
#endif
819
#ifdef EXPERIMENTAL_DMARC
820
fprintf(f, " Experimental_DMARC");
821
#endif
822
#ifdef EXPERIMENTAL_OCSP
823
fprintf(f, " Experimental_OCSP");
824
#endif
825
#ifdef EXPERIMENTAL_PRDR
826
fprintf(f, " Experimental_PRDR");
827
#endif
828
#ifdef EXPERIMENTAL_TPDA
829
fprintf(f, " Experimental_TPDA");
830
#endif
831
#ifdef EXPERIMENTAL_REDIS
832
fprintf(f, " Experimental_Redis");
833
#endif
834
fprintf(f, "\n");
835
836
fprintf(f, "Lookups (built-in):");
837
#if defined(LOOKUP_LSEARCH) && LOOKUP_LSEARCH!=2
838
fprintf(f, " lsearch wildlsearch nwildlsearch iplsearch");
839
#endif
840
#if defined(LOOKUP_CDB) && LOOKUP_CDB!=2
841
fprintf(f, " cdb");
842
#endif
843
#if defined(LOOKUP_DBM) && LOOKUP_DBM!=2
844
fprintf(f, " dbm dbmjz dbmnz");
845
#endif
846
#if defined(LOOKUP_DNSDB) && LOOKUP_DNSDB!=2
847
fprintf(f, " dnsdb");
848
#endif
849
#if defined(LOOKUP_DSEARCH) && LOOKUP_DSEARCH!=2
850
fprintf(f, " dsearch");
851
#endif
852
#if defined(LOOKUP_IBASE) && LOOKUP_IBASE!=2
853
fprintf(f, " ibase");
854
#endif
855
#if defined(LOOKUP_LDAP) && LOOKUP_LDAP!=2
856
fprintf(f, " ldap ldapdn ldapm");
857
#endif
858
#if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
859
fprintf(f, " mysql");
860
#endif
861
#if defined(LOOKUP_NIS) && LOOKUP_NIS!=2
862
fprintf(f, " nis nis0");
863
#endif
864
#if defined(LOOKUP_NISPLUS) && LOOKUP_NISPLUS!=2
865
fprintf(f, " nisplus");
866
#endif
867
#if defined(LOOKUP_ORACLE) && LOOKUP_ORACLE!=2
868
fprintf(f, " oracle");
869
#endif
870
#if defined(LOOKUP_PASSWD) && LOOKUP_PASSWD!=2
871
fprintf(f, " passwd");
872
#endif
873
#if defined(LOOKUP_PGSQL) && LOOKUP_PGSQL!=2
874
fprintf(f, " pgsql");
875
#endif
876
#if defined(LOOKUP_SQLITE) && LOOKUP_SQLITE!=2
877
fprintf(f, " sqlite");
878
#endif
879
#if defined(LOOKUP_TESTDB) && LOOKUP_TESTDB!=2
880
fprintf(f, " testdb");
881
#endif
882
#if defined(LOOKUP_WHOSON) && LOOKUP_WHOSON!=2
883
fprintf(f, " whoson");
884
#endif
885
fprintf(f, "\n");
886
887
fprintf(f, "Authenticators:");
888
#ifdef AUTH_CRAM_MD5
889
fprintf(f, " cram_md5");
890
#endif
891
#ifdef AUTH_CYRUS_SASL
892
fprintf(f, " cyrus_sasl");
893
#endif
894
#ifdef AUTH_DOVECOT
895
fprintf(f, " dovecot");
896
#endif
897
#ifdef AUTH_GSASL
898
fprintf(f, " gsasl");
899
#endif
900
#ifdef AUTH_HEIMDAL_GSSAPI
901
fprintf(f, " heimdal_gssapi");
902
#endif
903
#ifdef AUTH_PLAINTEXT
904
fprintf(f, " plaintext");
905
#endif
906
#ifdef AUTH_SPA
907
fprintf(f, " spa");
908
#endif
909
fprintf(f, "\n");
910
911
fprintf(f, "Routers:");
912
#ifdef ROUTER_ACCEPT
913
fprintf(f, " accept");
914
#endif
915
#ifdef ROUTER_DNSLOOKUP
916
fprintf(f, " dnslookup");
917
#endif
918
#ifdef ROUTER_IPLITERAL
919
fprintf(f, " ipliteral");
920
#endif
921
#ifdef ROUTER_IPLOOKUP
922
fprintf(f, " iplookup");
923
#endif
924
#ifdef ROUTER_MANUALROUTE
925
fprintf(f, " manualroute");
926
#endif
927
#ifdef ROUTER_QUERYPROGRAM
928
fprintf(f, " queryprogram");
929
#endif
930
#ifdef ROUTER_REDIRECT
931
fprintf(f, " redirect");
932
#endif
933
fprintf(f, "\n");
934
935
fprintf(f, "Transports:");
936
#ifdef TRANSPORT_APPENDFILE
937
fprintf(f, " appendfile");
938
#ifdef SUPPORT_MAILDIR
939
fprintf(f, "/maildir");
940
#endif
941
#ifdef SUPPORT_MAILSTORE
942
fprintf(f, "/mailstore");
943
#endif
944
#ifdef SUPPORT_MBX
945
fprintf(f, "/mbx");
946
#endif
947
#endif
948
#ifdef TRANSPORT_AUTOREPLY
949
fprintf(f, " autoreply");
950
#endif
951
#ifdef TRANSPORT_LMTP
952
fprintf(f, " lmtp");
953
#endif
954
#ifdef TRANSPORT_PIPE
955
fprintf(f, " pipe");
956
#endif
957
#ifdef TRANSPORT_SMTP
958
fprintf(f, " smtp");
959
#endif
960
fprintf(f, "\n");
961
962
if (fixed_never_users[0] > 0)
963
{
964
int i;
965
fprintf(f, "Fixed never_users: ");
966
for (i = 1; i <= (int)fixed_never_users[0] - 1; i++)
967
fprintf(f, "%d:", (unsigned int)fixed_never_users[i]);
968
fprintf(f, "%d\n", (unsigned int)fixed_never_users[i]);
969
}
970
971
fprintf(f, "Size of off_t: " SIZE_T_FMT "\n", sizeof(off_t));
972
973
/* Everything else is details which are only worth reporting when debugging.
974
Perhaps the tls_version_report should move into this too. */
975
DEBUG(D_any) do {
976
977
int i;
978
979
/* clang defines __GNUC__ (at least, for me) so test for it first */
980
#if defined(__clang__)
981
fprintf(f, "Compiler: CLang [%s]\n", __clang_version__);
982
#elif defined(__GNUC__)
983
fprintf(f, "Compiler: GCC [%s]\n",
984
# ifdef __VERSION__
985
__VERSION__
986
# else
987
"? unknown version ?"
988
# endif
989
);
990
#else
991
fprintf(f, "Compiler: <unknown>\n");
992
#endif
993
994
#ifdef SUPPORT_TLS
995
tls_version_report(f);
996
#endif
997
998
for (authi = auths_available; *authi->driver_name != '\0'; ++authi) {
999
if (authi->version_report) {
1000
(*authi->version_report)(f);
1001
}
1002
}
1003
1004
/* PCRE_PRERELEASE is either defined and empty or a bare sequence of
1005
characters; unless it's an ancient version of PCRE in which case it
1006
is not defined. */
1007
#ifndef PCRE_PRERELEASE
1008
#define PCRE_PRERELEASE
1009
#endif
1010
#define QUOTE(X) #X
1011
#define EXPAND_AND_QUOTE(X) QUOTE(X)
1012
fprintf(f, "Library version: PCRE: Compile: %d.%d%s\n"
1013
" Runtime: %s\n",
1014
PCRE_MAJOR, PCRE_MINOR,
1015
EXPAND_AND_QUOTE(PCRE_PRERELEASE) "",
1016
pcre_version());
1017
#undef QUOTE
1018
#undef EXPAND_AND_QUOTE
1019
1020
init_lookup_list();
1021
for (i = 0; i < lookup_list_count; i++)
1022
{
1023
if (lookup_list[i]->version_report)
1024
lookup_list[i]->version_report(f);
1025
}
1026
1027
#ifdef WHITELIST_D_MACROS
1028
fprintf(f, "WHITELIST_D_MACROS: \"%s\"\n", WHITELIST_D_MACROS);
1029
#else
1030
fprintf(f, "WHITELIST_D_MACROS unset\n");
1031
#endif
1032
#ifdef TRUSTED_CONFIG_LIST
1033
fprintf(f, "TRUSTED_CONFIG_LIST: \"%s\"\n", TRUSTED_CONFIG_LIST);
1034
#else
1035
fprintf(f, "TRUSTED_CONFIG_LIST unset\n");
1036
#endif
1037
1038
} while (0);
1039
}
1040
1041
1042
/*************************************************
1043
* Show auxiliary information about Exim *
1044
*************************************************/
1045
1046
static void
1047
show_exim_information(enum commandline_info request, FILE *stream)
1048
{
1049
const uschar **pp;
1050
1051
switch(request)
1052
{
1053
case CMDINFO_NONE:
1054
fprintf(stream, "Oops, something went wrong.\n");
1055
return;
1056
case CMDINFO_HELP:
1057
fprintf(stream,
1058
"The -bI: flag takes a string indicating which information to provide.\n"
1059
"If the string is not recognised, you'll get this help (on stderr).\n"
1060
"\n"
1061
" exim -bI:help this information\n"
1062
" exim -bI:dscp dscp value keywords known\n"
1063
" exim -bI:sieve list of supported sieve extensions, one per line.\n"
1064
);
1065
return;
1066
case CMDINFO_SIEVE:
1067
for (pp = exim_sieve_extension_list; *pp; ++pp)
1068
fprintf(stream, "%s\n", *pp);
1069
return;
1070
case CMDINFO_DSCP:
1071
dscp_list_to_stream(stream);
1072
return;
1073
}
1074
}
1075
1076
1077
/*************************************************
1078
* Quote a local part *
1079
*************************************************/
1080
1081
/* This function is used when a sender address or a From: or Sender: header
1082
line is being created from the caller's login, or from an authenticated_id. It
1083
applies appropriate quoting rules for a local part.
1084
1085
Argument: the local part
1086
Returns: the local part, quoted if necessary
1087
*/
1088
1089
uschar *
1090
local_part_quote(uschar *lpart)
1091
{
1092
BOOL needs_quote = FALSE;
1093
int size, ptr;
1094
uschar *yield;
1095
uschar *t;
1096
1097
for (t = lpart; !needs_quote && *t != 0; t++)
1098
{
1099
needs_quote = !isalnum(*t) && strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
1100
(*t != '.' || t == lpart || t[1] == 0);
1101
}
1102
1103
if (!needs_quote) return lpart;
1104
1105
size = ptr = 0;
1106
yield = string_cat(NULL, &size, &ptr, US"\"", 1);
1107
1108
for (;;)
1109
{
1110
uschar *nq = US Ustrpbrk(lpart, "\\\"");
1111
if (nq == NULL)
1112
{
1113
yield = string_cat(yield, &size, &ptr, lpart, Ustrlen(lpart));
1114
break;
1115
}
1116
yield = string_cat(yield, &size, &ptr, lpart, nq - lpart);
1117
yield = string_cat(yield, &size, &ptr, US"\\", 1);
1118
yield = string_cat(yield, &size, &ptr, nq, 1);
1119
lpart = nq + 1;
1120
}
1121
1122
yield = string_cat(yield, &size, &ptr, US"\"", 1);
1123
yield[ptr] = 0;
1124
return yield;
1125
}
1126
1127
1128
1129
#ifdef USE_READLINE
1130
/*************************************************
1131
* Load readline() functions *
1132
*************************************************/
1133
1134
/* This function is called from testing executions that read data from stdin,
1135
but only when running as the calling user. Currently, only -be does this. The
1136
function loads the readline() function library and passes back the functions.
1137
On some systems, it needs the curses library, so load that too, but try without
1138
it if loading fails. All this functionality has to be requested at build time.
1139
1140
Arguments:
1141
fn_readline_ptr pointer to where to put the readline pointer
1142
fn_addhist_ptr pointer to where to put the addhistory function
1143
1144
Returns: the dlopen handle or NULL on failure
1145
*/
1146
1147
static void *
1148
set_readline(char * (**fn_readline_ptr)(const char *),
1149
void (**fn_addhist_ptr)(const char *))
1150
{
1151
void *dlhandle;
1152
void *dlhandle_curses = dlopen("libcurses." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_LAZY);
1153
1154
dlhandle = dlopen("libreadline." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_NOW);
1155
if (dlhandle_curses != NULL) dlclose(dlhandle_curses);
1156
1157
if (dlhandle != NULL)
1158
{
1159
/* Checked manual pages; at least in GNU Readline 6.1, the prototypes are:
1160
* char * readline (const char *prompt);
1161
* void add_history (const char *string);
1162
*/
1163
*fn_readline_ptr = (char *(*)(const char*))dlsym(dlhandle, "readline");
1164
*fn_addhist_ptr = (void(*)(const char*))dlsym(dlhandle, "add_history");
1165
}
1166
else
1167
{
1168
DEBUG(D_any) debug_printf("failed to load readline: %s\n", dlerror());
1169
}
1170
1171
return dlhandle;
1172
}
1173
#endif
1174
1175
1176
1177
/*************************************************
1178
* Get a line from stdin for testing things *
1179
*************************************************/
1180
1181
/* This function is called when running tests that can take a number of lines
1182
of input (for example, -be and -bt). It handles continuations and trailing
1183
spaces. And prompting and a blank line output on eof. If readline() is in use,
1184
the arguments are non-NULL and provide the relevant functions.
1185
1186
Arguments:
1187
fn_readline readline function or NULL
1188
fn_addhist addhist function or NULL
1189
1190
Returns: pointer to dynamic memory, or NULL at end of file
1191
*/
1192
1193
static uschar *
1194
get_stdinput(char *(*fn_readline)(const char *), void(*fn_addhist)(const char *))
1195
{
1196
int i;
1197
int size = 0;
1198
int ptr = 0;
1199
uschar *yield = NULL;
1200
1201
if (fn_readline == NULL) { printf("> "); fflush(stdout); }
1202
1203
for (i = 0;; i++)
1204
{
1205
uschar buffer[1024];
1206
uschar *p, *ss;
1207
1208
#ifdef USE_READLINE
1209
char *readline_line = NULL;
1210
if (fn_readline != NULL)
1211
{
1212
if ((readline_line = fn_readline((i > 0)? "":"> ")) == NULL) break;
1213
if (*readline_line != 0 && fn_addhist != NULL) fn_addhist(readline_line);
1214
p = US readline_line;
1215
}
1216
else
1217
#endif
1218
1219
/* readline() not in use */
1220
1221
{
1222
if (Ufgets(buffer, sizeof(buffer), stdin) == NULL) break;
1223
p = buffer;
1224
}
1225
1226
/* Handle the line */
1227
1228
ss = p + (int)Ustrlen(p);
1229
while (ss > p && isspace(ss[-1])) ss--;
1230
1231
if (i > 0)
1232
{
1233
while (p < ss && isspace(*p)) p++; /* leading space after cont */
1234
}
1235
1236
yield = string_cat(yield, &size, &ptr, p, ss - p);
1237
1238
#ifdef USE_READLINE
1239
if (fn_readline != NULL) free(readline_line);
1240
#endif
1241
1242
if (ss == p || yield[ptr-1] != '\\')
1243
{
1244
yield[ptr] = 0;
1245
break;
1246
}
1247
yield[--ptr] = 0;
1248
}
1249
1250
if (yield == NULL) printf("\n");
1251
return yield;
1252
}
1253
1254
1255
1256
/*************************************************
1257
* Output usage information for the program *
1258
*************************************************/
1259
1260
/* This function is called when there are no recipients
1261
or a specific --help argument was added.
1262
1263
Arguments:
1264
progname information on what name we were called by
1265
1266
Returns: DOES NOT RETURN
1267
*/
1268
1269
static void
1270
exim_usage(uschar *progname)
1271
{
1272
1273
/* Handle specific program invocation varients */
1274
if (Ustrcmp(progname, US"-mailq") == 0)
1275
{
1276
fprintf(stderr,
1277
"mailq - list the contents of the mail queue\n\n"
1278
"For a list of options, see the Exim documentation.\n");
1279
exit(EXIT_FAILURE);
1280
}
1281
1282
/* Generic usage - we output this whatever happens */
1283
fprintf(stderr,
1284
"Exim is a Mail Transfer Agent. It is normally called by Mail User Agents,\n"
1285
"not directly from a shell command line. Options and/or arguments control\n"
1286
"what it does when called. For a list of options, see the Exim documentation.\n");
1287
1288
exit(EXIT_FAILURE);
1289
}
1290
1291
1292
1293
/*************************************************
1294
* Validate that the macros given are okay *
1295
*************************************************/
1296
1297
/* Typically, Exim will drop privileges if macros are supplied. In some
1298
cases, we want to not do so.
1299
1300
Arguments: none (macros is a global)
1301
Returns: true if trusted, false otherwise
1302
*/
1303
1304
static BOOL
1305
macros_trusted(void)
1306
{
1307
#ifdef WHITELIST_D_MACROS
1308
macro_item *m;
1309
uschar *whitelisted, *end, *p, **whites, **w;
1310
int white_count, i, n;
1311
size_t len;
1312
BOOL prev_char_item, found;
1313
#endif
1314
1315
if (macros == NULL)
1316
return TRUE;
1317
#ifndef WHITELIST_D_MACROS
1318
return FALSE;
1319
#else
1320
1321
/* We only trust -D overrides for some invoking users:
1322
root, the exim run-time user, the optional config owner user.
1323
I don't know why config-owner would be needed, but since they can own the
1324
config files anyway, there's no security risk to letting them override -D. */
1325
if ( ! ((real_uid == root_uid)
1326
|| (real_uid == exim_uid)
1327
#ifdef CONFIGURE_OWNER
1328
|| (real_uid == config_uid)
1329
#endif
1330
))
1331
{
1332
debug_printf("macros_trusted rejecting macros for uid %d\n", (int) real_uid);
1333
return FALSE;
1334
}
1335
1336
/* Get a list of macros which are whitelisted */
1337
whitelisted = string_copy_malloc(US WHITELIST_D_MACROS);
1338
prev_char_item = FALSE;
1339
white_count = 0;
1340
for (p = whitelisted; *p != '\0'; ++p)
1341
{
1342
if (*p == ':' || isspace(*p))
1343
{
1344
*p = '\0';
1345
if (prev_char_item)
1346
++white_count;
1347
prev_char_item = FALSE;
1348
continue;
1349
}
1350
if (!prev_char_item)
1351
prev_char_item = TRUE;
1352
}
1353
end = p;
1354
if (prev_char_item)
1355
++white_count;
1356
if (!white_count)
1357
return FALSE;
1358
whites = store_malloc(sizeof(uschar *) * (white_count+1));
1359
for (p = whitelisted, i = 0; (p != end) && (i < white_count); ++p)
1360
{
1361
if (*p != '\0')
1362
{
1363
whites[i++] = p;
1364
if (i == white_count)
1365
break;
1366
while (*p != '\0' && p < end)
1367
++p;
1368
}
1369
}
1370
whites[i] = NULL;
1371
1372
/* The list of macros should be very short. Accept the N*M complexity. */
1373
for (m = macros; m != NULL; m = m->next)
1374
{
1375
found = FALSE;
1376
for (w = whites; *w; ++w)
1377
if (Ustrcmp(*w, m->name) == 0)
1378
{
1379
found = TRUE;
1380
break;
1381
}
1382
if (!found)
1383
return FALSE;
1384
if (m->replacement == NULL)
1385
continue;
1386
len = Ustrlen(m->replacement);
1387
if (len == 0)
1388
continue;
1389
n = pcre_exec(regex_whitelisted_macro, NULL, CS m->replacement, len,
1390
0, PCRE_EOPT, NULL, 0);
1391
if (n < 0)
1392
{
1393
if (n != PCRE_ERROR_NOMATCH)
1394
debug_printf("macros_trusted checking %s returned %d\n", m->name, n);
1395
return FALSE;
1396
}
1397
}
1398
DEBUG(D_any) debug_printf("macros_trusted overridden to true by whitelisting\n");
1399
return TRUE;
1400
#endif
1401
}
1402
1403
1404
/*************************************************
1405
* Entry point and high-level code *
1406
*************************************************/
1407
1408
/* Entry point for the Exim mailer. Analyse the arguments and arrange to take
1409
the appropriate action. All the necessary functions are present in the one
1410
binary. I originally thought one should split it up, but it turns out that so
1411
much of the apparatus is needed in each chunk that one might as well just have
1412
it all available all the time, which then makes the coding easier as well.
1413
1414
Arguments:
1415
argc count of entries in argv
1416
argv argument strings, with argv[0] being the program name
1417
1418
Returns: EXIT_SUCCESS if terminated successfully
1419
EXIT_FAILURE otherwise, except when a message has been sent
1420
to the sender, and -oee was given
1421
*/
1422
1423
int
1424
main(int argc, char **cargv)
1425
{
1426
uschar **argv = USS cargv;
1427
int arg_receive_timeout = -1;
1428
int arg_smtp_receive_timeout = -1;
1429
int arg_error_handling = error_handling;
1430
int filter_sfd = -1;
1431
int filter_ufd = -1;
1432
int group_count;
1433
int i, rv;
1434
int list_queue_option = 0;
1435
int msg_action = 0;
1436
int msg_action_arg = -1;
1437
int namelen = (argv[0] == NULL)? 0 : Ustrlen(argv[0]);
1438
int queue_only_reason = 0;
1439
#ifdef EXIM_PERL
1440
int perl_start_option = 0;
1441
#endif
1442
int recipients_arg = argc;
1443
int sender_address_domain = 0;
1444
int test_retry_arg = -1;
1445
int test_rewrite_arg = -1;
1446
BOOL arg_queue_only = FALSE;
1447
BOOL bi_option = FALSE;
1448
BOOL checking = FALSE;
1449
BOOL count_queue = FALSE;
1450
BOOL expansion_test = FALSE;
1451
BOOL extract_recipients = FALSE;
1452
BOOL flag_G = FALSE;
1453
BOOL flag_n = FALSE;
1454
BOOL forced_delivery = FALSE;
1455
BOOL f_end_dot = FALSE;
1456
BOOL deliver_give_up = FALSE;
1457
BOOL list_queue = FALSE;
1458
BOOL list_options = FALSE;
1459
BOOL local_queue_only;
1460
BOOL more = TRUE;
1461
BOOL one_msg_action = FALSE;
1462
BOOL queue_only_set = FALSE;
1463
BOOL receiving_message = TRUE;
1464
BOOL sender_ident_set = FALSE;
1465
BOOL session_local_queue_only;
1466
BOOL unprivileged;
1467
BOOL removed_privilege = FALSE;
1468
BOOL usage_wanted = FALSE;
1469
BOOL verify_address_mode = FALSE;
1470
BOOL verify_as_sender = FALSE;
1471
BOOL version_printed = FALSE;
1472
uschar *alias_arg = NULL;
1473
uschar *called_as = US"";
1474
uschar *cmdline_syslog_name = NULL;
1475
uschar *start_queue_run_id = NULL;
1476
uschar *stop_queue_run_id = NULL;
1477
uschar *expansion_test_message = NULL;
1478
uschar *ftest_domain = NULL;
1479
uschar *ftest_localpart = NULL;
1480
uschar *ftest_prefix = NULL;
1481
uschar *ftest_suffix = NULL;
1482
uschar *malware_test_file = NULL;
1483
uschar *real_sender_address;
1484
uschar *originator_home = US"/";
1485
size_t sz;
1486
void *reset_point;
1487
1488
struct passwd *pw;
1489
struct stat statbuf;
1490
pid_t passed_qr_pid = (pid_t)0;
1491
int passed_qr_pipe = -1;
1492
gid_t group_list[NGROUPS_MAX];
1493
1494
/* For the -bI: flag */
1495
enum commandline_info info_flag = CMDINFO_NONE;
1496
BOOL info_stdout = FALSE;
1497
1498
/* Possible options for -R and -S */
1499
1500
static uschar *rsopts[] = { US"f", US"ff", US"r", US"rf", US"rff" };
1501
1502
/* Need to define this in case we need to change the environment in order
1503
to get rid of a bogus time zone. We have to make it char rather than uschar
1504
because some OS define it in /usr/include/unistd.h. */
1505
1506
extern char **environ;
1507
1508
/* If the Exim user and/or group and/or the configuration file owner/group were
1509
defined by ref:name at build time, we must now find the actual uid/gid values.
1510
This is a feature to make the lives of binary distributors easier. */
1511
1512
#ifdef EXIM_USERNAME
1513
if (route_finduser(US EXIM_USERNAME, &pw, &exim_uid))
1514
{
1515
if (exim_uid == 0)
1516
{
1517
fprintf(stderr, "exim: refusing to run with uid 0 for \"%s\"\n",
1518
EXIM_USERNAME);
1519
exit(EXIT_FAILURE);
1520
}
1521
/* If ref:name uses a number as the name, route_finduser() returns
1522
TRUE with exim_uid set and pw coerced to NULL. */
1523
if (pw)
1524
exim_gid = pw->pw_gid;
1525
#ifndef EXIM_GROUPNAME
1526
else
1527
{
1528
fprintf(stderr,
1529
"exim: ref:name should specify a usercode, not a group.\n"
1530
"exim: can't let you get away with it unless you also specify a group.\n");
1531
exit(EXIT_FAILURE);
1532
}
1533
#endif
1534
}
1535
else
1536
{
1537
fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1538
EXIM_USERNAME);
1539
exit(EXIT_FAILURE);
1540
}
1541
#endif
1542
1543
#ifdef EXIM_GROUPNAME
1544
if (!route_findgroup(US EXIM_GROUPNAME, &exim_gid))
1545
{
1546
fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1547
EXIM_GROUPNAME);
1548
exit(EXIT_FAILURE);
1549
}
1550
#endif
1551
1552
#ifdef CONFIGURE_OWNERNAME
1553
if (!route_finduser(US CONFIGURE_OWNERNAME, NULL, &config_uid))
1554
{
1555
fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1556
CONFIGURE_OWNERNAME);
1557
exit(EXIT_FAILURE);
1558
}
1559
#endif
1560
1561
/* We default the system_filter_user to be the Exim run-time user, as a
1562
sane non-root value. */
1563
system_filter_uid = exim_uid;
1564
1565
#ifdef CONFIGURE_GROUPNAME
1566
if (!route_findgroup(US CONFIGURE_GROUPNAME, &config_gid))
1567
{
1568
fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1569
CONFIGURE_GROUPNAME);
1570
exit(EXIT_FAILURE);
1571
}
1572
#endif
1573
1574
/* In the Cygwin environment, some initialization needs doing. It is fudged
1575
in by means of this macro. */
1576
1577
#ifdef OS_INIT
1578
OS_INIT
1579
#endif
1580
1581
/* Check a field which is patched when we are running Exim within its
1582
testing harness; do a fast initial check, and then the whole thing. */
1583
1584
running_in_test_harness =
1585
*running_status == '<' && Ustrcmp(running_status, "<<<testing>>>") == 0;
1586
1587
/* The C standard says that the equivalent of setlocale(LC_ALL, "C") is obeyed
1588
at the start of a program; however, it seems that some environments do not
1589
follow this. A "strange" locale can affect the formatting of timestamps, so we
1590
make quite sure. */
1591
1592
setlocale(LC_ALL, "C");
1593
1594
/* Set up the default handler for timing using alarm(). */
1595
1596
os_non_restarting_signal(SIGALRM, sigalrm_handler);
1597
1598
/* Ensure we have a buffer for constructing log entries. Use malloc directly,
1599
because store_malloc writes a log entry on failure. */
1600
1601
log_buffer = (uschar *)malloc(LOG_BUFFER_SIZE);
1602
if (log_buffer == NULL)
1603
{
1604
fprintf(stderr, "exim: failed to get store for log buffer\n");
1605
exit(EXIT_FAILURE);
1606
}
1607
1608
/* Set log_stderr to stderr, provided that stderr exists. This gets reset to
1609
NULL when the daemon is run and the file is closed. We have to use this
1610
indirection, because some systems don't allow writing to the variable "stderr".
1611
*/
1612
1613
if (fstat(fileno(stderr), &statbuf) >= 0) log_stderr = stderr;
1614
1615
/* Arrange for the PCRE regex library to use our store functions. Note that
1616
the normal calls are actually macros that add additional arguments for
1617
debugging purposes so we have to assign specially constructed functions here.
1618
The default is to use store in the stacking pool, but this is overridden in the
1619
regex_must_compile() function. */
1620
1621
pcre_malloc = function_store_get;
1622
pcre_free = function_dummy_free;
1623
1624
/* Ensure there is a big buffer for temporary use in several places. It is put
1625
in malloc store so that it can be freed for enlargement if necessary. */
1626
1627
big_buffer = store_malloc(big_buffer_size);
1628
1629
/* Set up the handler for the data request signal, and set the initial
1630
descriptive text. */
1631
1632
set_process_info("initializing");
1633
os_restarting_signal(SIGUSR1, usr1_handler);
1634
1635
/* SIGHUP is used to get the daemon to reconfigure. It gets set as appropriate
1636
in the daemon code. For the rest of Exim's uses, we ignore it. */
1637
1638
signal(SIGHUP, SIG_IGN);
1639
1640
/* We don't want to die on pipe errors as the code is written to handle
1641
the write error instead. */
1642
1643
signal(SIGPIPE, SIG_IGN);
1644
1645
/* Under some circumstance on some OS, Exim can get called with SIGCHLD
1646
set to SIG_IGN. This causes subprocesses that complete before the parent
1647
process waits for them not to hang around, so when Exim calls wait(), nothing
1648
is there. The wait() code has been made robust against this, but let's ensure
1649
that SIGCHLD is set to SIG_DFL, because it's tidier to wait and get a process
1650
ending status. We use sigaction rather than plain signal() on those OS where
1651
SA_NOCLDWAIT exists, because we want to be sure it is turned off. (There was a
1652
problem on AIX with this.) */
1653
1654
#ifdef SA_NOCLDWAIT
1655
{
1656
struct sigaction act;
1657
act.sa_handler = SIG_DFL;
1658
sigemptyset(&(act.sa_mask));
1659
act.sa_flags = 0;
1660
sigaction(SIGCHLD, &act, NULL);
1661
}
1662
#else
1663
signal(SIGCHLD, SIG_DFL);
1664
#endif
1665
1666
/* Save the arguments for use if we re-exec exim as a daemon after receiving
1667
SIGHUP. */
1668
1669
sighup_argv = argv;
1670
1671
/* Set up the version number. Set up the leading 'E' for the external form of
1672
message ids, set the pointer to the internal form, and initialize it to
1673
indicate no message being processed. */
1674
1675
version_init();
1676
message_id_option[0] = '-';
1677
message_id_external = message_id_option + 1;
1678
message_id_external[0] = 'E';
1679
message_id = message_id_external + 1;
1680
message_id[0] = 0;
1681
1682
/* Set the umask to zero so that any files Exim creates using open() are
1683
created with the modes that it specifies. NOTE: Files created with fopen() have
1684
a problem, which was not recognized till rather late (February 2006). With this
1685
umask, such files will be world writeable. (They are all content scanning files
1686
in the spool directory, which isn't world-accessible, so this is not a
1687
disaster, but it's untidy.) I don't want to change this overall setting,
1688
however, because it will interact badly with the open() calls. Instead, there's
1689
now a function called modefopen() that fiddles with the umask while calling
1690
fopen(). */
1691
1692
(void)umask(0);
1693
1694
/* Precompile the regular expression for matching a message id. Keep this in
1695
step with the code that generates ids in the accept.c module. We need to do
1696
this here, because the -M options check their arguments for syntactic validity
1697
using mac_ismsgid, which uses this. */
1698
1699
regex_ismsgid =
1700
regex_must_compile(US"^(?:[^\\W_]{6}-){2}[^\\W_]{2}$", FALSE, TRUE);
1701
1702
/* Precompile the regular expression that is used for matching an SMTP error
1703
code, possibly extended, at the start of an error message. Note that the
1704
terminating whitespace character is included. */
1705
1706
regex_smtp_code =
1707
regex_must_compile(US"^\\d\\d\\d\\s(?:\\d\\.\\d\\d?\\d?\\.\\d\\d?\\d?\\s)?",
1708
FALSE, TRUE);
1709
1710
#ifdef WHITELIST_D_MACROS
1711
/* Precompile the regular expression used to filter the content of macros
1712
given to -D for permissibility. */
1713
1714
regex_whitelisted_macro =
1715
regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE);
1716
#endif
1717
1718
1719
/* If the program is called as "mailq" treat it as equivalent to "exim -bp";
1720
this seems to be a generally accepted convention, since one finds symbolic
1721
links called "mailq" in standard OS configurations. */
1722
1723
if ((namelen == 5 && Ustrcmp(argv[0], "mailq") == 0) ||
1724
(namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/mailq", 6) == 0))
1725
{
1726
list_queue = TRUE;
1727
receiving_message = FALSE;
1728
called_as = US"-mailq";
1729
}
1730
1731
/* If the program is called as "rmail" treat it as equivalent to
1732
"exim -i -oee", thus allowing UUCP messages to be input using non-SMTP mode,
1733
i.e. preventing a single dot on a line from terminating the message, and
1734
returning with zero return code, even in cases of error (provided an error
1735
message has been sent). */
1736
1737
if ((namelen == 5 && Ustrcmp(argv[0], "rmail") == 0) ||
1738
(namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rmail", 6) == 0))
1739
{
1740
dot_ends = FALSE;
1741
called_as = US"-rmail";
1742
errors_sender_rc = EXIT_SUCCESS;
1743
}
1744
1745
/* If the program is called as "rsmtp" treat it as equivalent to "exim -bS";
1746
this is a smail convention. */
1747
1748
if ((namelen == 5 && Ustrcmp(argv[0], "rsmtp") == 0) ||
1749
(namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rsmtp", 6) == 0))
1750
{
1751
smtp_input = smtp_batched_input = TRUE;
1752
called_as = US"-rsmtp";
1753
}
1754
1755
/* If the program is called as "runq" treat it as equivalent to "exim -q";
1756
this is a smail convention. */
1757
1758
if ((namelen == 4 && Ustrcmp(argv[0], "runq") == 0) ||
1759
(namelen > 4 && Ustrncmp(argv[0] + namelen - 5, "/runq", 5) == 0))
1760
{
1761
queue_interval = 0;
1762
receiving_message = FALSE;
1763
called_as = US"-runq";
1764
}
1765
1766
/* If the program is called as "newaliases" treat it as equivalent to
1767
"exim -bi"; this is a sendmail convention. */
1768
1769
if ((namelen == 10 && Ustrcmp(argv[0], "newaliases") == 0) ||
1770
(namelen > 10 && Ustrncmp(argv[0] + namelen - 11, "/newaliases", 11) == 0))
1771
{
1772
bi_option = TRUE;
1773
receiving_message = FALSE;
1774
called_as = US"-newaliases";
1775
}
1776
1777
/* Save the original effective uid for a couple of uses later. It should
1778
normally be root, but in some esoteric environments it may not be. */
1779
1780
original_euid = geteuid();
1781
1782
/* Get the real uid and gid. If the caller is root, force the effective uid/gid
1783
to be the same as the real ones. This makes a difference only if Exim is setuid
1784
(or setgid) to something other than root, which could be the case in some
1785
special configurations. */
1786
1787
real_uid = getuid();
1788
real_gid = getgid();
1789
1790
if (real_uid == root_uid)
1791
{
1792
rv = setgid(real_gid);
1793
if (rv)
1794
{
1795
fprintf(stderr, "exim: setgid(%ld) failed: %s\n",
1796
(long int)real_gid, strerror(errno));
1797
exit(EXIT_FAILURE);
1798
}
1799
rv = setuid(real_uid);
1800
if (rv)
1801
{
1802
fprintf(stderr, "exim: setuid(%ld) failed: %s\n",
1803
(long int)real_uid, strerror(errno));
1804
exit(EXIT_FAILURE);
1805
}
1806
}
1807
1808
/* If neither the original real uid nor the original euid was root, Exim is
1809
running in an unprivileged state. */
1810
1811
unprivileged = (real_uid != root_uid && original_euid != root_uid);
1812
1813
/* Scan the program's arguments. Some can be dealt with right away; others are
1814
simply recorded for checking and handling afterwards. Do a high-level switch
1815
on the second character (the one after '-'), to save some effort. */
1816
1817
for (i = 1; i < argc; i++)
1818
{
1819
BOOL badarg = FALSE;
1820
uschar *arg = argv[i];
1821
uschar *argrest;
1822
int switchchar;
1823
1824
/* An argument not starting with '-' is the start of a recipients list;
1825
break out of the options-scanning loop. */
1826
1827
if (arg[0] != '-')
1828
{
1829
recipients_arg = i;
1830
break;
1831
}
1832
1833
/* An option consistion of -- terminates the options */
1834
1835
if (Ustrcmp(arg, "--") == 0)
1836
{
1837
recipients_arg = i + 1;
1838
break;
1839
}
1840
1841
/* Handle flagged options */
1842
1843
switchchar = arg[1];
1844
argrest = arg+2;
1845
1846
/* Make all -ex options synonymous with -oex arguments, since that
1847
is assumed by various callers. Also make -qR options synonymous with -R
1848
options, as that seems to be required as well. Allow for -qqR too, and
1849
the same for -S options. */
1850
1851
if (Ustrncmp(arg+1, "oe", 2) == 0 ||
1852
Ustrncmp(arg+1, "qR", 2) == 0 ||
1853
Ustrncmp(arg+1, "qS", 2) == 0)
1854
{
1855
switchchar = arg[2];
1856
argrest++;
1857
}
1858
else if (Ustrncmp(arg+1, "qqR", 3) == 0 || Ustrncmp(arg+1, "qqS", 3) == 0)
1859
{
1860
switchchar = arg[3];
1861
argrest += 2;
1862
queue_2stage = TRUE;
1863
}
1864
1865
/* Make -r synonymous with -f, since it is a documented alias */
1866
1867
else if (arg[1] == 'r') switchchar = 'f';
1868
1869
/* Make -ov synonymous with -v */
1870
1871
else if (Ustrcmp(arg, "-ov") == 0)
1872
{
1873
switchchar = 'v';
1874
argrest++;
1875
}
1876
1877
/* deal with --option_aliases */
1878
else if (switchchar == '-')
1879
{
1880
if (Ustrcmp(argrest, "help") == 0)
1881
{
1882
usage_wanted = TRUE;
1883
break;
1884
}
1885
else if (Ustrcmp(argrest, "version") == 0)
1886
{
1887
switchchar = 'b';
1888
argrest = US"V";
1889
}
1890
}
1891
1892
/* High-level switch on active initial letter */
1893
1894
switch(switchchar)
1895
{
1896
1897
/* sendmail uses -Ac and -Am to control which .cf file is used;
1898
we ignore them. */
1899
case 'A':
1900
if (*argrest == '\0') { badarg = TRUE; break; }
1901
else
1902
{
1903
BOOL ignore = FALSE;
1904
switch (*argrest)
1905
{
1906
case 'c':
1907
case 'm':
1908
if (*(argrest + 1) == '\0')
1909
ignore = TRUE;
1910
break;
1911
}
1912
if (!ignore) { badarg = TRUE; break; }
1913
}
1914
break;
1915
1916
/* -Btype is a sendmail option for 7bit/8bit setting. Exim is 8-bit clean
1917
so has no need of it. */
1918
1919
case 'B':
1920
if (*argrest == 0) i++; /* Skip over the type */
1921
break;
1922
1923
1924
case 'b':
1925
receiving_message = FALSE; /* Reset TRUE for -bm, -bS, -bs below */
1926
1927
/* -bd: Run in daemon mode, awaiting SMTP connections.
1928
-bdf: Ditto, but in the foreground.
1929
*/
1930
1931
if (*argrest == 'd')
1932
{
1933
daemon_listen = TRUE;
1934
if (*(++argrest) == 'f') background_daemon = FALSE;
1935
else if (*argrest != 0) { badarg = TRUE; break; }
1936
}
1937
1938
/* -be: Run in expansion test mode
1939
-bem: Ditto, but read a message from a file first
1940
*/
1941
1942
else if (*argrest == 'e')
1943
{
1944
expansion_test = checking = TRUE;
1945
if (argrest[1] == 'm')
1946
{
1947
if (++i >= argc) { badarg = TRUE; break; }
1948
expansion_test_message = argv[i];
1949
argrest++;
1950
}
1951
if (argrest[1] != 0) { badarg = TRUE; break; }
1952
}
1953
1954
/* -bF: Run system filter test */
1955
1956
else if (*argrest == 'F')
1957
{
1958
filter_test |= FTEST_SYSTEM;
1959
if (*(++argrest) != 0) { badarg = TRUE; break; }
1960
if (++i < argc) filter_test_sfile = argv[i]; else
1961
{
1962
fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
1963
exit(EXIT_FAILURE);
1964
}
1965
}
1966
1967
/* -bf: Run user filter test
1968
-bfd: Set domain for filter testing
1969
-bfl: Set local part for filter testing
1970
-bfp: Set prefix for filter testing
1971
-bfs: Set suffix for filter testing
1972
*/
1973
1974
else if (*argrest == 'f')
1975
{
1976
if (*(++argrest) == 0)
1977
{
1978
filter_test |= FTEST_USER;
1979
if (++i < argc) filter_test_ufile = argv[i]; else
1980
{
1981
fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
1982
exit(EXIT_FAILURE);
1983
}
1984
}
1985
else
1986
{
1987
if (++i >= argc)
1988
{
1989
fprintf(stderr, "exim: string expected after %s\n", arg);
1990
exit(EXIT_FAILURE);
1991
}
1992
if (Ustrcmp(argrest, "d") == 0) ftest_domain = argv[i];
1993
else if (Ustrcmp(argrest, "l") == 0) ftest_localpart = argv[i];
1994
else if (Ustrcmp(argrest, "p") == 0) ftest_prefix = argv[i];
1995
else if (Ustrcmp(argrest, "s") == 0) ftest_suffix = argv[i];
1996
else { badarg = TRUE; break; }
1997
}
1998
}
1999
2000
/* -bh: Host checking - an IP address must follow. */
2001
2002
else if (Ustrcmp(argrest, "h") == 0 || Ustrcmp(argrest, "hc") == 0)
2003
{
2004
if (++i >= argc) { badarg = TRUE; break; }
2005
sender_host_address = argv[i];
2006
host_checking = checking = log_testing_mode = TRUE;
2007
host_checking_callout = argrest[1] == 'c';
2008
}
2009
2010
/* -bi: This option is used by sendmail to initialize *the* alias file,
2011
though it has the -oA option to specify a different file. Exim has no
2012
concept of *the* alias file, but since Sun's YP make script calls
2013
sendmail this way, some support must be provided. */
2014
2015
else if (Ustrcmp(argrest, "i") == 0) bi_option = TRUE;
2016
2017
/* -bI: provide information, of the type to follow after a colon.
2018
This is an Exim flag. */
2019
2020
else if (argrest[0] == 'I' && Ustrlen(argrest) >= 2 && argrest[1] == ':')
2021
{
2022
uschar *p = &argrest[2];
2023
info_flag = CMDINFO_HELP;
2024
if (Ustrlen(p))
2025
{
2026
if (strcmpic(p, CUS"sieve") == 0)
2027
{
2028
info_flag = CMDINFO_SIEVE;
2029
info_stdout = TRUE;
2030
}
2031
else if (strcmpic(p, CUS"dscp") == 0)
2032
{
2033
info_flag = CMDINFO_DSCP;
2034
info_stdout = TRUE;
2035
}
2036
else if (strcmpic(p, CUS"help") == 0)
2037
{
2038
info_stdout = TRUE;
2039
}
2040
}
2041
}
2042
2043
/* -bm: Accept and deliver message - the default option. Reinstate
2044
receiving_message, which got turned off for all -b options. */
2045
2046
else if (Ustrcmp(argrest, "m") == 0) receiving_message = TRUE;
2047
2048
/* -bmalware: test the filename given for malware */
2049
2050
else if (Ustrcmp(argrest, "malware") == 0)
2051
{
2052
if (++i >= argc) { badarg = TRUE; break; }
2053
malware_test_file = argv[i];
2054
}
2055
2056
/* -bnq: For locally originating messages, do not qualify unqualified
2057
addresses. In the envelope, this causes errors; in header lines they
2058
just get left. */
2059
2060
else if (Ustrcmp(argrest, "nq") == 0)
2061
{
2062
allow_unqualified_sender = FALSE;
2063
allow_unqualified_recipient = FALSE;
2064
}
2065
2066
/* -bpxx: List the contents of the mail queue, in various forms. If
2067
the option is -bpc, just a queue count is needed. Otherwise, if the
2068
first letter after p is r, then order is random. */
2069
2070
else if (*argrest == 'p')
2071
{
2072
if (*(++argrest) == 'c')
2073
{
2074
count_queue = TRUE;
2075
if (*(++argrest) != 0) badarg = TRUE;
2076
break;
2077
}
2078
2079
if (*argrest == 'r')
2080
{
2081
list_queue_option = 8;
2082
argrest++;
2083
}
2084
else list_queue_option = 0;
2085
2086
list_queue = TRUE;
2087
2088
/* -bp: List the contents of the mail queue, top-level only */
2089
2090
if (*argrest == 0) {}
2091
2092
/* -bpu: List the contents of the mail queue, top-level undelivered */
2093
2094
else if (Ustrcmp(argrest, "u") == 0) list_queue_option += 1;
2095
2096
/* -bpa: List the contents of the mail queue, including all delivered */
2097
2098
else if (Ustrcmp(argrest, "a") == 0) list_queue_option += 2;
2099
2100
/* Unknown after -bp[r] */
2101
2102
else
2103
{
2104
badarg = TRUE;
2105
break;
2106
}
2107
}
2108
2109
2110
/* -bP: List the configuration variables given as the address list.
2111
Force -v, so configuration errors get displayed. */
2112
2113
else if (Ustrcmp(argrest, "P") == 0)
2114
{
2115
list_options = TRUE;
2116
debug_selector |= D_v;
2117
debug_file = stderr;
2118
}
2119
2120
/* -brt: Test retry configuration lookup */
2121
2122
else if (Ustrcmp(argrest, "rt") == 0)
2123
{
2124
test_retry_arg = i + 1;
2125
goto END_ARG;
2126
}
2127
2128
/* -brw: Test rewrite configuration */
2129
2130
else if (Ustrcmp(argrest, "rw") == 0)
2131
{
2132
test_rewrite_arg = i + 1;
2133
goto END_ARG;
2134
}
2135
2136
/* -bS: Read SMTP commands on standard input, but produce no replies -
2137
all errors are reported by sending messages. */
2138
2139
else if (Ustrcmp(argrest, "S") == 0)
2140
smtp_input = smtp_batched_input = receiving_message = TRUE;
2141
2142
/* -bs: Read SMTP commands on standard input and produce SMTP replies
2143
on standard output. */
2144
2145
else if (Ustrcmp(argrest, "s") == 0) smtp_input = receiving_message = TRUE;
2146
2147
/* -bt: address testing mode */
2148
2149
else if (Ustrcmp(argrest, "t") == 0)
2150
address_test_mode = checking = log_testing_mode = TRUE;
2151
2152
/* -bv: verify addresses */
2153
2154
else if (Ustrcmp(argrest, "v") == 0)
2155
verify_address_mode = checking = log_testing_mode = TRUE;
2156
2157
/* -bvs: verify sender addresses */
2158
2159
else if (Ustrcmp(argrest, "vs") == 0)
2160
{
2161
verify_address_mode = checking = log_testing_mode = TRUE;
2162
verify_as_sender = TRUE;
2163
}
2164
2165
/* -bV: Print version string and support details */
2166
2167
else if (Ustrcmp(argrest, "V") == 0)
2168
{
2169
printf("Exim version %s #%s built %s\n", version_string,
2170
version_cnumber, version_date);
2171
printf("%s\n", CS version_copyright);
2172
version_printed = TRUE;
2173
show_whats_supported(stdout);
2174
}
2175
2176
/* -bw: inetd wait mode, accept a listening socket as stdin */
2177
2178
else if (*argrest == 'w')
2179
{
2180
inetd_wait_mode = TRUE;
2181
background_daemon = FALSE;
2182
daemon_listen = TRUE;
2183
if (*(++argrest) != '\0')
2184
{
2185
inetd_wait_timeout = readconf_readtime(argrest, 0, FALSE);
2186
if (inetd_wait_timeout <= 0)
2187
{
2188
fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
2189
exit(EXIT_FAILURE);
2190
}
2191
}
2192
}
2193
2194
else badarg = TRUE;
2195
break;
2196
2197
2198
/* -C: change configuration file list; ignore if it isn't really
2199
a change! Enforce a prefix check if required. */
2200
2201
case 'C':
2202
if (*argrest == 0)
2203
{
2204
if(++i < argc) argrest = argv[i]; else
2205
{ badarg = TRUE; break; }
2206
}
2207
if (Ustrcmp(config_main_filelist, argrest) != 0)
2208
{
2209
#ifdef ALT_CONFIG_PREFIX
2210
int sep = 0;
2211
int len = Ustrlen(ALT_CONFIG_PREFIX);
2212
uschar *list = argrest;
2213
uschar *filename;
2214
while((filename = string_nextinlist(&list, &sep, big_buffer,
2215
big_buffer_size)) != NULL)
2216
{
2217
if ((Ustrlen(filename) < len ||
2218
Ustrncmp(filename, ALT_CONFIG_PREFIX, len) != 0 ||
2219
Ustrstr(filename, "/../") != NULL) &&
2220
(Ustrcmp(filename, "/dev/null") != 0 || real_uid != root_uid))
2221
{
2222
fprintf(stderr, "-C Permission denied\n");
2223
exit(EXIT_FAILURE);
2224
}
2225
}
2226
#endif
2227
if (real_uid != root_uid)
2228
{
2229
#ifdef TRUSTED_CONFIG_LIST
2230
2231
if (real_uid != exim_uid
2232
#ifdef CONFIGURE_OWNER
2233
&& real_uid != config_uid
2234
#endif
2235
)
2236
trusted_config = FALSE;
2237
else
2238
{
2239
FILE *trust_list = Ufopen(TRUSTED_CONFIG_LIST, "rb");
2240
if (trust_list)
2241
{
2242
struct stat statbuf;
2243
2244
if (fstat(fileno(trust_list), &statbuf) != 0 ||
2245
(statbuf.st_uid != root_uid /* owner not root */
2246
#ifdef CONFIGURE_OWNER
2247
&& statbuf.st_uid != config_uid /* owner not the special one */
2248
#endif
2249
) || /* or */
2250
(statbuf.st_gid != root_gid /* group not root */
2251
#ifdef CONFIGURE_GROUP
2252
&& statbuf.st_gid != config_gid /* group not the special one */
2253
#endif
2254
&& (statbuf.st_mode & 020) != 0 /* group writeable */
2255
) || /* or */
2256
(statbuf.st_mode & 2) != 0) /* world writeable */
2257
{
2258
trusted_config = FALSE;
2259
fclose(trust_list);
2260
}
2261
else
2262
{
2263
/* Well, the trust list at least is up to scratch... */
2264
void *reset_point = store_get(0);
2265
uschar *trusted_configs[32];
2266
int nr_configs = 0;
2267
int i = 0;
2268
2269
while (Ufgets(big_buffer, big_buffer_size, trust_list))
2270
{
2271
uschar *start = big_buffer, *nl;
2272
while (*start && isspace(*start))
2273
start++;
2274
if (*start != '/')
2275
continue;
2276
nl = Ustrchr(start, '\n');
2277
if (nl)
2278
*nl = 0;
2279
trusted_configs[nr_configs++] = string_copy(start);
2280
if (nr_configs == 32)
2281
break;
2282
}
2283
fclose(trust_list);
2284
2285
if (nr_configs)
2286
{
2287
int sep = 0;
2288
uschar *list = argrest;
2289
uschar *filename;
2290
while (trusted_config && (filename = string_nextinlist(&list,
2291
&sep, big_buffer, big_buffer_size)) != NULL)
2292
{
2293
for (i=0; i < nr_configs; i++)
2294
{
2295
if (Ustrcmp(filename, trusted_configs[i]) == 0)
2296
break;
2297
}
2298
if (i == nr_configs)
2299
{
2300
trusted_config = FALSE;
2301
break;
2302
}
2303
}
2304
store_reset(reset_point);
2305
}
2306
else
2307
{
2308
/* No valid prefixes found in trust_list file. */
2309
trusted_config = FALSE;
2310
}
2311
}
2312
}
2313
else
2314
{
2315
/* Could not open trust_list file. */
2316
trusted_config = FALSE;
2317
}
2318
}
2319
#else
2320
/* Not root; don't trust config */
2321
trusted_config = FALSE;
2322
#endif
2323
}
2324
2325
config_main_filelist = argrest;
2326
config_changed = TRUE;
2327
}
2328
break;
2329
2330
2331
/* -D: set up a macro definition */
2332
2333
case 'D':
2334
#ifdef DISABLE_D_OPTION
2335
fprintf(stderr, "exim: -D is not available in this Exim binary\n");
2336
exit(EXIT_FAILURE);
2337
#else
2338
{
2339
int ptr = 0;
2340
macro_item *mlast = NULL;
2341
macro_item *m;
2342
uschar name[24];
2343
uschar *s = argrest;
2344
2345
while (isspace(*s)) s++;
2346
2347
if (*s < 'A' || *s > 'Z')
2348
{
2349
fprintf(stderr, "exim: macro name set by -D must start with "
2350
"an upper case letter\n");
2351
exit(EXIT_FAILURE);
2352
}
2353
2354
while (isalnum(*s) || *s == '_')
2355
{
2356
if (ptr < sizeof(name)-1) name[ptr++] = *s;
2357
s++;
2358
}
2359
name[ptr] = 0;
2360
if (ptr == 0) { badarg = TRUE; break; }
2361
while (isspace(*s)) s++;
2362
if (*s != 0)
2363
{
2364
if (*s++ != '=') { badarg = TRUE; break; }
2365
while (isspace(*s)) s++;
2366
}
2367
2368
for (m = macros; m != NULL; m = m->next)
2369
{
2370
if (Ustrcmp(m->name, name) == 0)
2371
{
2372
fprintf(stderr, "exim: duplicated -D in command line\n");
2373
exit(EXIT_FAILURE);
2374
}
2375
mlast = m;
2376
}
2377
2378
m = store_get(sizeof(macro_item) + Ustrlen(name));
2379
m->next = NULL;
2380
m->command_line = TRUE;
2381
if (mlast == NULL) macros = m; else mlast->next = m;
2382
Ustrcpy(m->name, name);
2383
m->replacement = string_copy(s);
2384
2385
if (clmacro_count >= MAX_CLMACROS)
2386
{
2387
fprintf(stderr, "exim: too many -D options on command line\n");
2388
exit(EXIT_FAILURE);
2389
}
2390
clmacros[clmacro_count++] = string_sprintf("-D%s=%s", m->name,
2391
m->replacement);
2392
}
2393
#endif
2394
break;
2395
2396
/* -d: Set debug level (see also -v below) or set the drop_cr option.
2397
The latter is now a no-op, retained for compatibility only. If -dd is used,
2398
debugging subprocesses of the daemon is disabled. */
2399
2400
case 'd':
2401
if (Ustrcmp(argrest, "ropcr") == 0)
2402
{
2403
/* drop_cr = TRUE; */
2404
}
2405
2406
/* Use an intermediate variable so that we don't set debugging while
2407
decoding the debugging bits. */
2408
2409
else
2410
{
2411
unsigned int selector = D_default;
2412
debug_selector = 0;
2413
debug_file = NULL;
2414
if (*argrest == 'd')
2415
{
2416
debug_daemon = TRUE;
2417
argrest++;
2418
}
2419
if (*argrest != 0)
2420
decode_bits(&selector, NULL, D_memory, 0, argrest, debug_options,
2421
debug_options_count, US"debug", 0);
2422
debug_selector = selector;
2423
}
2424
break;
2425
2426
2427
/* -E: This is a local error message. This option is not intended for
2428
external use at all, but is not restricted to trusted callers because it
2429
does no harm (just suppresses certain error messages) and if Exim is run
2430
not setuid root it won't always be trusted when it generates error
2431
messages using this option. If there is a message id following -E, point
2432
message_reference at it, for logging. */
2433
2434
case 'E':
2435
local_error_message = TRUE;
2436
if (mac_ismsgid(argrest)) message_reference = argrest;
2437
break;
2438
2439
2440
/* -ex: The vacation program calls sendmail with the undocumented "-eq"
2441
option, so it looks as if historically the -oex options are also callable
2442
without the leading -o. So we have to accept them. Before the switch,
2443
anything starting -oe has been converted to -e. Exim does not support all
2444
of the sendmail error options. */
2445
2446
case 'e':
2447
if (Ustrcmp(argrest, "e") == 0)
2448
{
2449
arg_error_handling = ERRORS_SENDER;
2450
errors_sender_rc = EXIT_SUCCESS;
2451
}
2452
else if (Ustrcmp(argrest, "m") == 0) arg_error_handling = ERRORS_SENDER;
2453
else if (Ustrcmp(argrest, "p") == 0) arg_error_handling = ERRORS_STDERR;
2454
else if (Ustrcmp(argrest, "q") == 0) arg_error_handling = ERRORS_STDERR;
2455
else if (Ustrcmp(argrest, "w") == 0) arg_error_handling = ERRORS_SENDER;
2456
else badarg = TRUE;
2457
break;
2458
2459
2460
/* -F: Set sender's full name, used instead of the gecos entry from
2461
the password file. Since users can usually alter their gecos entries,
2462
there's no security involved in using this instead. The data can follow
2463
the -F or be in the next argument. */
2464
2465
case 'F':
2466
if (*argrest == 0)
2467
{
2468
if(++i < argc) argrest = argv[i]; else
2469
{ badarg = TRUE; break; }
2470
}
2471
originator_name = argrest;
2472
sender_name_forced = TRUE;
2473
break;
2474
2475
2476
/* -f: Set sender's address - this value is only actually used if Exim is
2477
run by a trusted user, or if untrusted_set_sender is set and matches the
2478
address, except that the null address can always be set by any user. The
2479
test for this happens later, when the value given here is ignored when not
2480
permitted. For an untrusted user, the actual sender is still put in Sender:
2481
if it doesn't match the From: header (unless no_local_from_check is set).
2482
The data can follow the -f or be in the next argument. The -r switch is an
2483
obsolete form of -f but since there appear to be programs out there that
2484
use anything that sendmail has ever supported, better accept it - the
2485
synonymizing is done before the switch above.
2486
2487
At this stage, we must allow domain literal addresses, because we don't
2488
know what the setting of allow_domain_literals is yet. Ditto for trailing
2489
dots and strip_trailing_dot. */
2490
2491
case 'f':
2492
{
2493
int start, end;
2494
uschar *errmess;
2495
if (*argrest == 0)
2496
{
2497
if (i+1 < argc) argrest = argv[++i]; else
2498
{ badarg = TRUE; break; }
2499
}
2500
if (*argrest == 0)
2501
{
2502
sender_address = string_sprintf(""); /* Ensure writeable memory */
2503
}
2504
else
2505
{
2506
uschar *temp = argrest + Ustrlen(argrest) - 1;
2507
while (temp >= argrest && isspace(*temp)) temp--;
2508
if (temp >= argrest && *temp == '.') f_end_dot = TRUE;
2509
allow_domain_literals = TRUE;
2510
strip_trailing_dot = TRUE;
2511
sender_address = parse_extract_address(argrest, &errmess, &start, &end,
2512
&sender_address_domain, TRUE);
2513
allow_domain_literals = FALSE;
2514
strip_trailing_dot = FALSE;
2515
if (sender_address == NULL)
2516
{
2517
fprintf(stderr, "exim: bad -f address \"%s\": %s\n", argrest, errmess);
2518
return EXIT_FAILURE;
2519
}
2520
}
2521
sender_address_forced = TRUE;
2522
}
2523
break;
2524
2525
/* -G: sendmail invocation to specify that it's a gateway submission and
2526
sendmail may complain about problems instead of fixing them.
2527
We make it equivalent to an ACL "control = suppress_local_fixups" and do
2528
not at this time complain about problems. */
2529
2530
case 'G':
2531
flag_G = TRUE;
2532
break;
2533
2534
/* -h: Set the hop count for an incoming message. Exim does not currently
2535
support this; it always computes it by counting the Received: headers.
2536
To put it in will require a change to the spool header file format. */
2537
2538
case 'h':
2539
if (*argrest == 0)
2540
{
2541
if(++i < argc) argrest = argv[i]; else
2542
{ badarg = TRUE; break; }
2543
}
2544
if (!isdigit(*argrest)) badarg = TRUE;
2545
break;
2546
2547
2548
/* -i: Set flag so dot doesn't end non-SMTP input (same as -oi, seems
2549
not to be documented for sendmail but mailx (at least) uses it) */
2550
2551
case 'i':
2552
if (*argrest == 0) dot_ends = FALSE; else badarg = TRUE;
2553
break;
2554
2555
2556
/* -L: set the identifier used for syslog; equivalent to setting
2557
syslog_processname in the config file, but needs to be an admin option. */
2558
2559
case 'L':
2560
if (*argrest == '\0')
2561
{
2562
if(++i < argc) argrest = argv[i]; else
2563
{ badarg = TRUE; break; }
2564
}
2565
sz = Ustrlen(argrest);
2566
if (sz > 32)
2567
{
2568
fprintf(stderr, "exim: the -L syslog name is too long: \"%s\"\n", argrest);
2569
return EXIT_FAILURE;
2570
}
2571
if (sz < 1)
2572
{
2573
fprintf(stderr, "exim: the -L syslog name is too short\n");
2574
return EXIT_FAILURE;
2575
}
2576
cmdline_syslog_name = argrest;
2577
break;
2578
2579
case 'M':
2580
receiving_message = FALSE;
2581
2582
/* -MC: continue delivery of another message via an existing open
2583
file descriptor. This option is used for an internal call by the
2584
smtp transport when there is a pending message waiting to go to an
2585
address to which it has got a connection. Five subsequent arguments are
2586
required: transport name, host name, IP address, sequence number, and
2587
message_id. Transports may decline to create new processes if the sequence
2588
number gets too big. The channel is stdin. This (-MC) must be the last
2589
argument. There's a subsequent check that the real-uid is privileged.
2590
2591
If we are running in the test harness. delay for a bit, to let the process
2592
that set this one up complete. This makes for repeatability of the logging,
2593
etc. output. */
2594
2595
if (Ustrcmp(argrest, "C") == 0)
2596
{
2597
union sockaddr_46 interface_sock;
2598
EXIM_SOCKLEN_T size = sizeof(interface_sock);
2599
2600
if (argc != i + 6)
2601
{
2602
fprintf(stderr, "exim: too many or too few arguments after -MC\n");
2603
return EXIT_FAILURE;
2604
}
2605
2606
if (msg_action_arg >= 0)
2607
{
2608
fprintf(stderr, "exim: incompatible arguments\n");
2609
return EXIT_FAILURE;
2610
}
2611
2612
continue_transport = argv[++i];
2613
continue_hostname = argv[++i];
2614
continue_host_address = argv[++i];
2615
continue_sequence = Uatoi(argv[++i]);
2616
msg_action = MSG_DELIVER;
2617
msg_action_arg = ++i;
2618
forced_delivery = TRUE;
2619
queue_run_pid = passed_qr_pid;
2620
queue_run_pipe = passed_qr_pipe;
2621
2622
if (!mac_ismsgid(argv[i]))
2623
{
2624
fprintf(stderr, "exim: malformed message id %s after -MC option\n",
2625
argv[i]);
2626
return EXIT_FAILURE;
2627
}
2628
2629
/* Set up $sending_ip_address and $sending_port */
2630
2631
if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
2632
&size) == 0)
2633
sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
2634
&sending_port);
2635
else
2636
{
2637
fprintf(stderr, "exim: getsockname() failed after -MC option: %s\n",
2638
strerror(errno));
2639
return EXIT_FAILURE;
2640
}
2641
2642
if (running_in_test_harness) millisleep(500);
2643
break;
2644
}
2645
2646
/* -MCA: set the smtp_authenticated flag; this is useful only when it
2647
precedes -MC (see above). The flag indicates that the host to which
2648
Exim is connected has accepted an AUTH sequence. */
2649
2650
else if (Ustrcmp(argrest, "CA") == 0)
2651
{
2652
smtp_authenticated = TRUE;
2653
break;
2654
}
2655
2656
/* -MCP: set the smtp_use_pipelining flag; this is useful only when
2657
it preceded -MC (see above) */
2658
2659
else if (Ustrcmp(argrest, "CP") == 0)
2660
{
2661
smtp_use_pipelining = TRUE;
2662
break;
2663
}
2664
2665
/* -MCQ: pass on the pid of the queue-running process that started
2666
this chain of deliveries and the fd of its synchronizing pipe; this
2667
is useful only when it precedes -MC (see above) */
2668
2669
else if (Ustrcmp(argrest, "CQ") == 0)
2670
{
2671
if(++i < argc) passed_qr_pid = (pid_t)(Uatol(argv[i]));
2672
else badarg = TRUE;
2673
if(++i < argc) passed_qr_pipe = (int)(Uatol(argv[i]));
2674
else badarg = TRUE;
2675
break;
2676
}
2677
2678
/* -MCS: set the smtp_use_size flag; this is useful only when it
2679
precedes -MC (see above) */
2680
2681
else if (Ustrcmp(argrest, "CS") == 0)
2682
{
2683
smtp_use_size = TRUE;
2684
break;
2685
}
2686
2687
/* -MCT: set the tls_offered flag; this is useful only when it
2688
precedes -MC (see above). The flag indicates that the host to which
2689
Exim is connected has offered TLS support. */
2690
2691
#ifdef SUPPORT_TLS
2692
else if (Ustrcmp(argrest, "CT") == 0)
2693
{
2694
tls_offered = TRUE;
2695
break;
2696
}
2697
#endif
2698
2699
/* -M[x]: various operations on the following list of message ids:
2700
-M deliver the messages, ignoring next retry times and thawing
2701
-Mc deliver the messages, checking next retry times, no thawing
2702
-Mf freeze the messages
2703
-Mg give up on the messages
2704
-Mt thaw the messages
2705
-Mrm remove the messages
2706
In the above cases, this must be the last option. There are also the
2707
following options which are followed by a single message id, and which
2708
act on that message. Some of them use the "recipient" addresses as well.
2709
-Mar add recipient(s)
2710
-Mmad mark all recipients delivered
2711
-Mmd mark recipients(s) delivered
2712
-Mes edit sender
2713
-Mset load a message for use with -be
2714
-Mvb show body
2715
-Mvc show copy (of whole message, in RFC 2822 format)
2716
-Mvh show header
2717
-Mvl show log
2718
*/
2719
2720
else if (*argrest == 0)
2721
{
2722
msg_action = MSG_DELIVER;
2723
forced_delivery = deliver_force_thaw = TRUE;
2724
}
2725
else if (Ustrcmp(argrest, "ar") == 0)
2726
{
2727
msg_action = MSG_ADD_RECIPIENT;
2728
one_msg_action = TRUE;
2729
}
2730
else if (Ustrcmp(argrest, "c") == 0) msg_action = MSG_DELIVER;
2731
else if (Ustrcmp(argrest, "es") == 0)
2732
{
2733
msg_action = MSG_EDIT_SENDER;
2734
one_msg_action = TRUE;
2735
}
2736
else if (Ustrcmp(argrest, "f") == 0) msg_action = MSG_FREEZE;
2737
else if (Ustrcmp(argrest, "g") == 0)
2738
{
2739
msg_action = MSG_DELIVER;
2740
deliver_give_up = TRUE;
2741
}
2742
else if (Ustrcmp(argrest, "mad") == 0)
2743
{
2744
msg_action = MSG_MARK_ALL_DELIVERED;
2745
}
2746
else if (Ustrcmp(argrest, "md") == 0)
2747
{
2748
msg_action = MSG_MARK_DELIVERED;
2749
one_msg_action = TRUE;
2750
}
2751
else if (Ustrcmp(argrest, "rm") == 0) msg_action = MSG_REMOVE;
2752
else if (Ustrcmp(argrest, "set") == 0)
2753
{
2754
msg_action = MSG_LOAD;
2755
one_msg_action = TRUE;
2756
}
2757
else if (Ustrcmp(argrest, "t") == 0) msg_action = MSG_THAW;
2758
else if (Ustrcmp(argrest, "vb") == 0)
2759
{
2760
msg_action = MSG_SHOW_BODY;
2761
one_msg_action = TRUE;
2762
}
2763
else if (Ustrcmp(argrest, "vc") == 0)
2764
{
2765
msg_action = MSG_SHOW_COPY;
2766
one_msg_action = TRUE;
2767
}
2768
else if (Ustrcmp(argrest, "vh") == 0)
2769
{
2770
msg_action = MSG_SHOW_HEADER;
2771
one_msg_action = TRUE;
2772
}
2773
else if (Ustrcmp(argrest, "vl") == 0)
2774
{
2775
msg_action = MSG_SHOW_LOG;
2776
one_msg_action = TRUE;
2777
}
2778
else { badarg = TRUE; break; }
2779
2780
/* All the -Mxx options require at least one message id. */
2781
2782
msg_action_arg = i + 1;
2783
if (msg_action_arg >= argc)
2784
{
2785
fprintf(stderr, "exim: no message ids given after %s option\n", arg);
2786
return EXIT_FAILURE;
2787
}
2788
2789
/* Some require only message ids to follow */
2790
2791
if (!one_msg_action)
2792
{
2793
int j;
2794
for (j = msg_action_arg; j < argc; j++) if (!mac_ismsgid(argv[j]))
2795
{
2796
fprintf(stderr, "exim: malformed message id %s after %s option\n",
2797
argv[j], arg);
2798
return EXIT_FAILURE;
2799
}
2800
goto END_ARG; /* Remaining args are ids */
2801
}
2802
2803
/* Others require only one message id, possibly followed by addresses,
2804
which will be handled as normal arguments. */
2805
2806
else
2807
{
2808
if (!mac_ismsgid(argv[msg_action_arg]))
2809
{
2810
fprintf(stderr, "exim: malformed message id %s after %s option\n",
2811
argv[msg_action_arg], arg);
2812
return EXIT_FAILURE;
2813
}
2814
i++;
2815
}
2816
break;
2817
2818
2819
/* Some programs seem to call the -om option without the leading o;
2820
for sendmail it askes for "me too". Exim always does this. */
2821
2822
case 'm':
2823
if (*argrest != 0) badarg = TRUE;
2824
break;
2825
2826
2827
/* -N: don't do delivery - a debugging option that stops transports doing
2828
their thing. It implies debugging at the D_v level. */
2829
2830
case 'N':
2831
if (*argrest == 0)
2832
{
2833
dont_deliver = TRUE;
2834
debug_selector |= D_v;
2835
debug_file = stderr;
2836
}
2837
else badarg = TRUE;
2838
break;
2839
2840
2841
/* -n: This means "don't alias" in sendmail, apparently.
2842
For normal invocations, it has no effect.
2843
It may affect some other options. */
2844
2845
case 'n':
2846
flag_n = TRUE;
2847
break;
2848
2849
/* -O: Just ignore it. In sendmail, apparently -O option=value means set
2850
option to the specified value. This form uses long names. We need to handle
2851
-O option=value and -Ooption=value. */
2852
2853
case 'O':
2854
if (*argrest == 0)
2855
{
2856
if (++i >= argc)
2857
{
2858
fprintf(stderr, "exim: string expected after -O\n");
2859
exit(EXIT_FAILURE);
2860
}
2861
}
2862
break;
2863
2864
case 'o':
2865
2866
/* -oA: Set an argument for the bi command (sendmail's "alternate alias
2867
file" option). */
2868
2869
if (*argrest == 'A')
2870
{
2871
alias_arg = argrest + 1;
2872
if (alias_arg[0] == 0)
2873
{
2874
if (i+1 < argc) alias_arg = argv[++i]; else
2875
{
2876
fprintf(stderr, "exim: string expected after -oA\n");
2877
exit(EXIT_FAILURE);
2878
}
2879
}
2880
}
2881
2882
/* -oB: Set a connection message max value for remote deliveries */
2883
2884
else if (*argrest == 'B')
2885
{
2886
uschar *p = argrest + 1;
2887
if (p[0] == 0)
2888
{
2889
if (i+1 < argc && isdigit((argv[i+1][0]))) p = argv[++i]; else
2890
{
2891
connection_max_messages = 1;
2892
p = NULL;
2893
}
2894
}
2895
2896
if (p != NULL)
2897
{
2898
if (!isdigit(*p))
2899
{
2900
fprintf(stderr, "exim: number expected after -oB\n");
2901
exit(EXIT_FAILURE);
2902
}
2903
connection_max_messages = Uatoi(p);
2904
}
2905
}
2906
2907
/* -odb: background delivery */
2908
2909
else if (Ustrcmp(argrest, "db") == 0)
2910
{
2911
synchronous_delivery = FALSE;
2912
arg_queue_only = FALSE;
2913
queue_only_set = TRUE;
2914
}
2915
2916
/* -odf: foreground delivery (smail-compatible option); same effect as
2917
-odi: interactive (synchronous) delivery (sendmail-compatible option)
2918
*/
2919
2920
else if (Ustrcmp(argrest, "df") == 0 || Ustrcmp(argrest, "di") == 0)
2921
{
2922
synchronous_delivery = TRUE;
2923
arg_queue_only = FALSE;
2924
queue_only_set = TRUE;
2925
}
2926
2927
/* -odq: queue only */
2928
2929
else if (Ustrcmp(argrest, "dq") == 0)
2930
{
2931
synchronous_delivery = FALSE;
2932
arg_queue_only = TRUE;
2933
queue_only_set = TRUE;
2934
}
2935
2936
/* -odqs: queue SMTP only - do local deliveries and remote routing,
2937
but no remote delivery */
2938
2939
else if (Ustrcmp(argrest, "dqs") == 0)
2940
{
2941
queue_smtp = TRUE;
2942
arg_queue_only = FALSE;
2943
queue_only_set = TRUE;
2944
}
2945
2946
/* -oex: Sendmail error flags. As these are also accepted without the
2947
leading -o prefix, for compatibility with vacation and other callers,
2948
they are handled with -e above. */
2949
2950
/* -oi: Set flag so dot doesn't end non-SMTP input (same as -i)
2951
-oitrue: Another sendmail syntax for the same */
2952
2953
else if (Ustrcmp(argrest, "i") == 0 ||
2954
Ustrcmp(argrest, "itrue") == 0)
2955
dot_ends = FALSE;
2956
2957
/* -oM*: Set various characteristics for an incoming message; actually
2958
acted on for trusted callers only. */
2959
2960
else if (*argrest == 'M')
2961
{
2962
if (i+1 >= argc)
2963
{
2964
fprintf(stderr, "exim: data expected after -o%s\n", argrest);
2965
exit(EXIT_FAILURE);
2966
}
2967
2968
/* -oMa: Set sender host address */
2969
2970
if (Ustrcmp(argrest, "Ma") == 0) sender_host_address = argv[++i];
2971
2972
/* -oMaa: Set authenticator name */
2973
2974
else if (Ustrcmp(argrest, "Maa") == 0)
2975
sender_host_authenticated = argv[++i];
2976
2977
/* -oMas: setting authenticated sender */
2978
2979
else if (Ustrcmp(argrest, "Mas") == 0) authenticated_sender = argv[++i];
2980
2981
/* -oMai: setting authenticated id */
2982
2983
else if (Ustrcmp(argrest, "Mai") == 0) authenticated_id = argv[++i];
2984
2985
/* -oMi: Set incoming interface address */
2986
2987
else if (Ustrcmp(argrest, "Mi") == 0) interface_address = argv[++i];
2988
2989
/* -oMr: Received protocol */
2990
2991
else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i];
2992
2993
/* -oMs: Set sender host name */
2994
2995
else if (Ustrcmp(argrest, "Ms") == 0) sender_host_name = argv[++i];
2996
2997
/* -oMt: Set sender ident */
2998
2999
else if (Ustrcmp(argrest, "Mt") == 0)
3000
{
3001
sender_ident_set = TRUE;
3002
sender_ident = argv[++i];
3003
}
3004
3005
/* Else a bad argument */
3006
3007
else
3008
{
3009
badarg = TRUE;
3010
break;
3011
}
3012
}
3013
3014
/* -om: Me-too flag for aliases. Exim always does this. Some programs
3015
seem to call this as -m (undocumented), so that is also accepted (see
3016
above). */
3017
3018
else if (Ustrcmp(argrest, "m") == 0) {}
3019
3020
/* -oo: An ancient flag for old-style addresses which still seems to
3021
crop up in some calls (see in SCO). */
3022
3023
else if (Ustrcmp(argrest, "o") == 0) {}
3024
3025
/* -oP <name>: set pid file path for daemon */
3026
3027
else if (Ustrcmp(argrest, "P") == 0)
3028
override_pid_file_path = argv[++i];
3029
3030
/* -or <n>: set timeout for non-SMTP acceptance
3031
-os <n>: set timeout for SMTP acceptance */
3032
3033
else if (*argrest == 'r' || *argrest == 's')
3034
{
3035
int *tp = (*argrest == 'r')?
3036
&arg_receive_timeout : &arg_smtp_receive_timeout;
3037
if (argrest[1] == 0)
3038
{
3039
if (i+1 < argc) *tp= readconf_readtime(argv[++i], 0, FALSE);
3040
}
3041
else *tp = readconf_readtime(argrest + 1, 0, FALSE);
3042
if (*tp < 0)
3043
{
3044
fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3045
exit(EXIT_FAILURE);
3046
}
3047
}
3048
3049
/* -oX <list>: Override local_interfaces and/or default daemon ports */
3050
3051
else if (Ustrcmp(argrest, "X") == 0)
3052
override_local_interfaces = argv[++i];
3053
3054
/* Unknown -o argument */
3055
3056
else badarg = TRUE;
3057
break;
3058
3059
3060
/* -ps: force Perl startup; -pd force delayed Perl startup */
3061
3062
case 'p':
3063
#ifdef EXIM_PERL
3064
if (*argrest == 's' && argrest[1] == 0)
3065
{
3066
perl_start_option = 1;
3067
break;
3068
}
3069
if (*argrest == 'd' && argrest[1] == 0)
3070
{
3071
perl_start_option = -1;
3072
break;
3073
}
3074
#endif
3075
3076
/* -panythingelse is taken as the Sendmail-compatible argument -prval:sval,
3077
which sets the host protocol and host name */
3078
3079
if (*argrest == 0)
3080
{
3081
if (i+1 < argc) argrest = argv[++i]; else
3082
{ badarg = TRUE; break; }
3083
}
3084
3085
if (*argrest != 0)
3086
{
3087
uschar *hn = Ustrchr(argrest, ':');
3088
if (hn == NULL)
3089
{
3090
received_protocol = argrest;
3091
}
3092
else
3093
{
3094
received_protocol = string_copyn(argrest, hn - argrest);
3095
sender_host_name = hn + 1;
3096
}
3097
}
3098
break;
3099
3100
3101
case 'q':
3102
receiving_message = FALSE;
3103
if (queue_interval >= 0)
3104
{
3105
fprintf(stderr, "exim: -q specified more than once\n");
3106
exit(EXIT_FAILURE);
3107
}
3108
3109
/* -qq...: Do queue runs in a 2-stage manner */
3110
3111
if (*argrest == 'q')
3112
{
3113
queue_2stage = TRUE;
3114
argrest++;
3115
}
3116
3117
/* -qi...: Do only first (initial) deliveries */
3118
3119
if (*argrest == 'i')
3120
{
3121
queue_run_first_delivery = TRUE;
3122
argrest++;
3123
}
3124
3125
/* -qf...: Run the queue, forcing deliveries
3126
-qff..: Ditto, forcing thawing as well */
3127
3128
if (*argrest == 'f')
3129
{
3130
queue_run_force = TRUE;
3131
if (*(++argrest) == 'f')
3132
{
3133
deliver_force_thaw = TRUE;
3134
argrest++;
3135
}
3136
}
3137
3138
/* -q[f][f]l...: Run the queue only on local deliveries */
3139
3140
if (*argrest == 'l')
3141
{
3142
queue_run_local = TRUE;
3143
argrest++;
3144
}
3145
3146
/* -q[f][f][l]: Run the queue, optionally forced, optionally local only,
3147
optionally starting from a given message id. */
3148
3149
if (*argrest == 0 &&
3150
(i + 1 >= argc || argv[i+1][0] == '-' || mac_ismsgid(argv[i+1])))
3151
{
3152
queue_interval = 0;
3153
if (i+1 < argc && mac_ismsgid(argv[i+1]))
3154
start_queue_run_id = argv[++i];
3155
if (i+1 < argc && mac_ismsgid(argv[i+1]))
3156
stop_queue_run_id = argv[++i];
3157
}
3158
3159
/* -q[f][f][l]<n>: Run the queue at regular intervals, optionally forced,
3160
optionally local only. */
3161
3162
else
3163
{
3164
if (*argrest != 0)
3165
queue_interval = readconf_readtime(argrest, 0, FALSE);
3166
else
3167
queue_interval = readconf_readtime(argv[++i], 0, FALSE);
3168
if (queue_interval <= 0)
3169
{
3170
fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3171
exit(EXIT_FAILURE);
3172
}
3173
}
3174
break;
3175
3176
3177
case 'R': /* Synonymous with -qR... */
3178
receiving_message = FALSE;
3179
3180
/* -Rf: As -R (below) but force all deliveries,
3181
-Rff: Ditto, but also thaw all frozen messages,
3182
-Rr: String is regex
3183
-Rrf: Regex and force
3184
-Rrff: Regex and force and thaw
3185
3186
in all cases provided there are no further characters in this
3187
argument. */
3188
3189
if (*argrest != 0)
3190
{
3191
int i;
3192
for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
3193
{
3194
if (Ustrcmp(argrest, rsopts[i]) == 0)
3195
{
3196
if (i != 2) queue_run_force = TRUE;
3197
if (i >= 2) deliver_selectstring_regex = TRUE;
3198
if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3199
argrest += Ustrlen(rsopts[i]);
3200
}
3201
}
3202
}
3203
3204
/* -R: Set string to match in addresses for forced queue run to
3205
pick out particular messages. */
3206
3207
if (*argrest == 0)
3208
{
3209
if (i+1 < argc) deliver_selectstring = argv[++i]; else
3210
{
3211
fprintf(stderr, "exim: string expected after -R\n");
3212
exit(EXIT_FAILURE);
3213
}
3214
}
3215
else deliver_selectstring = argrest;
3216
break;
3217
3218
3219
/* -r: an obsolete synonym for -f (see above) */
3220
3221
3222
/* -S: Like -R but works on sender. */
3223
3224
case 'S': /* Synonymous with -qS... */
3225
receiving_message = FALSE;
3226
3227
/* -Sf: As -S (below) but force all deliveries,
3228
-Sff: Ditto, but also thaw all frozen messages,
3229
-Sr: String is regex
3230
-Srf: Regex and force
3231
-Srff: Regex and force and thaw
3232
3233
in all cases provided there are no further characters in this
3234
argument. */
3235
3236
if (*argrest != 0)
3237
{
3238
int i;
3239
for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
3240
{
3241
if (Ustrcmp(argrest, rsopts[i]) == 0)
3242
{
3243
if (i != 2) queue_run_force = TRUE;
3244
if (i >= 2) deliver_selectstring_sender_regex = TRUE;
3245
if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3246
argrest += Ustrlen(rsopts[i]);
3247
}
3248
}
3249
}
3250
3251
/* -S: Set string to match in addresses for forced queue run to
3252
pick out particular messages. */
3253
3254
if (*argrest == 0)
3255
{
3256
if (i+1 < argc) deliver_selectstring_sender = argv[++i]; else
3257
{
3258
fprintf(stderr, "exim: string expected after -S\n");
3259
exit(EXIT_FAILURE);
3260
}
3261
}
3262
else deliver_selectstring_sender = argrest;
3263
break;
3264
3265
/* -Tqt is an option that is exclusively for use by the testing suite.
3266
It is not recognized in other circumstances. It allows for the setting up
3267
of explicit "queue times" so that various warning/retry things can be
3268
tested. Otherwise variability of clock ticks etc. cause problems. */
3269
3270
case 'T':
3271
if (running_in_test_harness && Ustrcmp(argrest, "qt") == 0)
3272
fudged_queue_times = argv[++i];
3273
else badarg = TRUE;
3274
break;
3275
3276
3277
/* -t: Set flag to extract recipients from body of message. */
3278
3279
case 't':
3280
if (*argrest == 0) extract_recipients = TRUE;
3281
3282
/* -ti: Set flag to extract recipients from body of message, and also
3283
specify that dot does not end the message. */
3284
3285
else if (Ustrcmp(argrest, "i") == 0)
3286
{
3287
extract_recipients = TRUE;
3288
dot_ends = FALSE;
3289
}
3290
3291
/* -tls-on-connect: don't wait for STARTTLS (for old clients) */
3292
3293
#ifdef SUPPORT_TLS
3294
else if (Ustrcmp(argrest, "ls-on-connect") == 0) tls_in.on_connect = TRUE;
3295
#endif
3296
3297
else badarg = TRUE;
3298
break;
3299
3300
3301
/* -U: This means "initial user submission" in sendmail, apparently. The
3302
doc claims that in future sendmail may refuse syntactically invalid
3303
messages instead of fixing them. For the moment, we just ignore it. */
3304
3305
case 'U':
3306
break;
3307
3308
3309
/* -v: verify things - this is a very low-level debugging */
3310
3311
case 'v':
3312
if (*argrest == 0)
3313
{
3314
debug_selector |= D_v;
3315
debug_file = stderr;
3316
}
3317
else badarg = TRUE;
3318
break;
3319
3320
3321
/* -x: AIX uses this to indicate some fancy 8-bit character stuff:
3322
3323
The -x flag tells the sendmail command that mail from a local
3324
mail program has National Language Support (NLS) extended characters
3325
in the body of the mail item. The sendmail command can send mail with
3326
extended NLS characters across networks that normally corrupts these
3327
8-bit characters.
3328
3329
As Exim is 8-bit clean, it just ignores this flag. */
3330
3331
case 'x':
3332
if (*argrest != 0) badarg = TRUE;
3333
break;
3334
3335
/* -X: in sendmail: takes one parameter, logfile, and sends debugging
3336
logs to that file. We swallow the parameter and otherwise ignore it. */
3337
3338
case 'X':
3339
if (*argrest == '\0')
3340
{
3341
if (++i >= argc)
3342
{
3343
fprintf(stderr, "exim: string expected after -X\n");
3344
exit(EXIT_FAILURE);
3345
}
3346
}
3347
break;
3348
3349
/* All other initial characters are errors */
3350
3351
default:
3352
badarg = TRUE;
3353
break;
3354
} /* End of high-level switch statement */
3355
3356
/* Failed to recognize the option, or syntax error */
3357
3358
if (badarg)
3359
{
3360
fprintf(stderr, "exim abandoned: unknown, malformed, or incomplete "
3361
"option %s\n", arg);
3362
exit(EXIT_FAILURE);
3363
}
3364
}
3365
3366
3367
/* If -R or -S have been specified without -q, assume a single queue run. */
3368
3369
if ((deliver_selectstring != NULL || deliver_selectstring_sender != NULL) &&
3370
queue_interval < 0) queue_interval = 0;
3371
3372
3373
END_ARG:
3374
/* If usage_wanted is set we call the usage function - which never returns */
3375
if (usage_wanted) exim_usage(called_as);
3376
3377
/* Arguments have been processed. Check for incompatibilities. */
3378
if ((
3379
(smtp_input || extract_recipients || recipients_arg < argc) &&
3380
(daemon_listen || queue_interval >= 0 || bi_option ||
3381
test_retry_arg >= 0 || test_rewrite_arg >= 0 ||
3382
filter_test != FTEST_NONE || (msg_action_arg > 0 && !one_msg_action))
3383
) ||
3384
(
3385
msg_action_arg > 0 &&
3386
(daemon_listen || queue_interval >= 0 || list_options ||
3387
(checking && msg_action != MSG_LOAD) ||
3388
bi_option || test_retry_arg >= 0 || test_rewrite_arg >= 0)
3389
) ||
3390
(
3391
(daemon_listen || queue_interval >= 0) &&
3392
(sender_address != NULL || list_options || list_queue || checking ||
3393
bi_option)
3394
) ||
3395
(
3396
daemon_listen && queue_interval == 0
3397
) ||
3398
(
3399
inetd_wait_mode && queue_interval >= 0
3400
) ||
3401
(
3402
list_options &&
3403
(checking || smtp_input || extract_recipients ||
3404
filter_test != FTEST_NONE || bi_option)
3405
) ||
3406
(
3407
verify_address_mode &&
3408
(address_test_mode || smtp_input || extract_recipients ||
3409
filter_test != FTEST_NONE || bi_option)
3410
) ||
3411
(
3412
address_test_mode && (smtp_input || extract_recipients ||
3413
filter_test != FTEST_NONE || bi_option)
3414
) ||
3415
(
3416
smtp_input && (sender_address != NULL || filter_test != FTEST_NONE ||
3417
extract_recipients)
3418
) ||
3419
(
3420
deliver_selectstring != NULL && queue_interval < 0
3421
) ||
3422
(
3423
msg_action == MSG_LOAD &&
3424
(!expansion_test || expansion_test_message != NULL)
3425
)
3426
)
3427
{
3428
fprintf(stderr, "exim: incompatible command-line options or arguments\n");
3429
exit(EXIT_FAILURE);
3430
}
3431
3432
/* If debugging is set up, set the file and the file descriptor to pass on to
3433
child processes. It should, of course, be 2 for stderr. Also, force the daemon
3434
to run in the foreground. */
3435
3436
if (debug_selector != 0)
3437
{
3438
debug_file = stderr;
3439
debug_fd = fileno(debug_file);
3440
background_daemon = FALSE;
3441
if (running_in_test_harness) millisleep(100); /* lets caller finish */
3442
if (debug_selector != D_v) /* -v only doesn't show this */
3443
{
3444
debug_printf("Exim version %s uid=%ld gid=%ld pid=%d D=%x\n",
3445
version_string, (long int)real_uid, (long int)real_gid, (int)getpid(),
3446
debug_selector);
3447
if (!version_printed)
3448
show_whats_supported(stderr);
3449
}
3450
}
3451
3452
/* When started with root privilege, ensure that the limits on the number of
3453
open files and the number of processes (where that is accessible) are
3454
sufficiently large, or are unset, in case Exim has been called from an
3455
environment where the limits are screwed down. Not all OS have the ability to
3456
change some of these limits. */
3457
3458
if (unprivileged)
3459
{
3460
DEBUG(D_any) debug_print_ids(US"Exim has no root privilege:");
3461
}
3462
else
3463
{
3464
struct rlimit rlp;
3465
3466
#ifdef RLIMIT_NOFILE
3467
if (getrlimit(RLIMIT_NOFILE, &rlp) < 0)
3468
{
3469
log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NOFILE) failed: %s",
3470
strerror(errno));
3471
rlp.rlim_cur = rlp.rlim_max = 0;
3472
}
3473
3474
/* I originally chose 1000 as a nice big number that was unlikely to
3475
be exceeded. It turns out that some older OS have a fixed upper limit of
3476
256. */
3477
3478
if (rlp.rlim_cur < 1000)
3479
{
3480
rlp.rlim_cur = rlp.rlim_max = 1000;
3481
if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3482
{
3483
rlp.rlim_cur = rlp.rlim_max = 256;
3484
if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3485
log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NOFILE) failed: %s",
3486
strerror(errno));
3487
}
3488
}
3489
#endif
3490
3491
#ifdef RLIMIT_NPROC
3492
if (getrlimit(RLIMIT_NPROC, &rlp) < 0)
3493
{
3494
log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NPROC) failed: %s",
3495
strerror(errno));
3496
rlp.rlim_cur = rlp.rlim_max = 0;
3497
}
3498
3499
#ifdef RLIM_INFINITY
3500
if (rlp.rlim_cur != RLIM_INFINITY && rlp.rlim_cur < 1000)
3501
{
3502
rlp.rlim_cur = rlp.rlim_max = RLIM_INFINITY;
3503
#else
3504
if (rlp.rlim_cur < 1000)
3505
{
3506
rlp.rlim_cur = rlp.rlim_max = 1000;
3507
#endif
3508
if (setrlimit(RLIMIT_NPROC, &rlp) < 0)
3509
log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NPROC) failed: %s",
3510
strerror(errno));
3511
}
3512
#endif
3513
}
3514
3515
/* Exim is normally entered as root (but some special configurations are
3516
possible that don't do this). However, it always spins off sub-processes that
3517
set their uid and gid as required for local delivery. We don't want to pass on
3518
any extra groups that root may belong to, so we want to get rid of them all at
3519
this point.
3520
3521
We need to obey setgroups() at this stage, before possibly giving up root
3522
privilege for a changed configuration file, but later on we might need to
3523
check on the additional groups for the admin user privilege - can't do that
3524
till after reading the config, which might specify the exim gid. Therefore,
3525
save the group list here first. */
3526
3527
group_count = getgroups(NGROUPS_MAX, group_list);
3528
if (group_count < 0)
3529
{
3530
fprintf(stderr, "exim: getgroups() failed: %s\n", strerror(errno));
3531
exit(EXIT_FAILURE);
3532
}
3533
3534
/* There is a fundamental difference in some BSD systems in the matter of
3535
groups. FreeBSD and BSDI are known to be different; NetBSD and OpenBSD are
3536
known not to be different. On the "different" systems there is a single group
3537
list, and the first entry in it is the current group. On all other versions of
3538
Unix there is a supplementary group list, which is in *addition* to the current
3539
group. Consequently, to get rid of all extraneous groups on a "standard" system
3540
you pass over 0 groups to setgroups(), while on a "different" system you pass
3541
over a single group - the current group, which is always the first group in the
3542
list. Calling setgroups() with zero groups on a "different" system results in
3543
an error return. The following code should cope with both types of system.
3544
3545
However, if this process isn't running as root, setgroups() can't be used
3546
since you have to be root to run it, even if throwing away groups. Not being
3547
root here happens only in some unusual configurations. We just ignore the
3548
error. */
3549
3550
if (setgroups(0, NULL) != 0)
3551
{
3552
if (setgroups(1, group_list) != 0 && !unprivileged)
3553
{
3554
fprintf(stderr, "exim: setgroups() failed: %s\n", strerror(errno));
3555
exit(EXIT_FAILURE);
3556
}
3557
}
3558
3559
/* If the configuration file name has been altered by an argument on the
3560
command line (either a new file name or a macro definition) and the caller is
3561
not root, or if this is a filter testing run, remove any setuid privilege the
3562
program has and run as the underlying user.
3563
3564
The exim user is locked out of this, which severely restricts the use of -C
3565
for some purposes.
3566
3567
Otherwise, set the real ids to the effective values (should be root unless run
3568
from inetd, which it can either be root or the exim uid, if one is configured).
3569
3570
There is a private mechanism for bypassing some of this, in order to make it
3571
possible to test lots of configurations automatically, without having either to
3572
recompile each time, or to patch in an actual configuration file name and other
3573
values (such as the path name). If running in the test harness, pretend that
3574
configuration file changes and macro definitions haven't happened. */
3575
3576
if (( /* EITHER */
3577
(!trusted_config || /* Config changed, or */
3578
!macros_trusted()) && /* impermissible macros and */
3579
real_uid != root_uid && /* Not root, and */
3580
!running_in_test_harness /* Not fudged */
3581
) || /* OR */
3582
expansion_test /* expansion testing */
3583
|| /* OR */
3584
filter_test != FTEST_NONE) /* Filter testing */
3585
{
3586
setgroups(group_count, group_list);
3587
exim_setugid(real_uid, real_gid, FALSE,
3588
US"-C, -D, -be or -bf forces real uid");
3589
removed_privilege = TRUE;
3590
3591
/* In the normal case when Exim is called like this, stderr is available
3592
and should be used for any logging information because attempts to write
3593
to the log will usually fail. To arrange this, we unset really_exim. However,
3594
if no stderr is available there is no point - we might as well have a go
3595
at the log (if it fails, syslog will be written).
3596
3597
Note that if the invoker is Exim, the logs remain available. Messing with
3598
this causes unlogged successful deliveries. */
3599
3600
if ((log_stderr != NULL) && (real_uid != exim_uid))
3601
really_exim = FALSE;
3602
}
3603
3604
/* Privilege is to be retained for the moment. It may be dropped later,
3605
depending on the job that this Exim process has been asked to do. For now, set
3606
the real uid to the effective so that subsequent re-execs of Exim are done by a
3607
privileged user. */
3608
3609
else exim_setugid(geteuid(), getegid(), FALSE, US"forcing real = effective");
3610
3611
/* If testing a filter, open the file(s) now, before wasting time doing other
3612
setups and reading the message. */
3613
3614
if ((filter_test & FTEST_SYSTEM) != 0)
3615
{
3616
filter_sfd = Uopen(filter_test_sfile, O_RDONLY, 0);
3617
if (filter_sfd < 0)
3618
{
3619
fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_sfile,
3620
strerror(errno));
3621
return EXIT_FAILURE;
3622
}
3623
}
3624
3625
if ((filter_test & FTEST_USER) != 0)
3626
{
3627
filter_ufd = Uopen(filter_test_ufile, O_RDONLY, 0);
3628
if (filter_ufd < 0)
3629
{
3630
fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_ufile,
3631
strerror(errno));
3632
return EXIT_FAILURE;
3633
}
3634
}
3635
3636
/* Initialise lookup_list
3637
If debugging, already called above via version reporting.
3638
In either case, we initialise the list of available lookups while running
3639
as root. All dynamically modules are loaded from a directory which is
3640
hard-coded into the binary and is code which, if not a module, would be
3641
part of Exim already. Ability to modify the content of the directory
3642
is equivalent to the ability to modify a setuid binary!
3643
3644
This needs to happen before we read the main configuration. */
3645
init_lookup_list();
3646
3647
/* Read the main runtime configuration data; this gives up if there
3648
is a failure. It leaves the configuration file open so that the subsequent
3649
configuration data for delivery can be read if needed. */
3650
3651
readconf_main();
3652
3653
/* If an action on specific messages is requested, or if a daemon or queue
3654
runner is being started, we need to know if Exim was called by an admin user.
3655
This is the case if the real user is root or exim, or if the real group is
3656
exim, or if one of the supplementary groups is exim or a group listed in
3657
admin_groups. We don't fail all message actions immediately if not admin_user,
3658
since some actions can be performed by non-admin users. Instead, set admin_user
3659
for later interrogation. */
3660
3661
if (real_uid == root_uid || real_uid == exim_uid || real_gid == exim_gid)
3662
admin_user = TRUE;
3663
else
3664
{
3665
int i, j;
3666
for (i = 0; i < group_count; i++)
3667
{
3668
if (group_list[i] == exim_gid) admin_user = TRUE;
3669
else if (admin_groups != NULL)
3670
{
3671
for (j = 1; j <= (int)(admin_groups[0]); j++)
3672
if (admin_groups[j] == group_list[i])
3673
{ admin_user = TRUE; break; }
3674
}
3675
if (admin_user) break;
3676
}
3677
}
3678
3679
/* Another group of privileged users are the trusted users. These are root,
3680
exim, and any caller matching trusted_users or trusted_groups. Trusted callers
3681
are permitted to specify sender_addresses with -f on the command line, and
3682
other message parameters as well. */
3683
3684
if (real_uid == root_uid || real_uid == exim_uid)
3685
trusted_caller = TRUE;
3686
else
3687
{
3688
int i, j;
3689
3690
if (trusted_users != NULL)
3691
{
3692
for (i = 1; i <= (int)(trusted_users[0]); i++)
3693
if (trusted_users[i] == real_uid)
3694
{ trusted_caller = TRUE; break; }
3695
}
3696
3697
if (!trusted_caller && trusted_groups != NULL)
3698
{
3699
for (i = 1; i <= (int)(trusted_groups[0]); i++)
3700
{
3701
if (trusted_groups[i] == real_gid)
3702
trusted_caller = TRUE;
3703
else for (j = 0; j < group_count; j++)
3704
{
3705
if (trusted_groups[i] == group_list[j])
3706
{ trusted_caller = TRUE; break; }
3707
}
3708
if (trusted_caller) break;
3709
}
3710
}
3711
}
3712
3713
/* Handle the decoding of logging options. */
3714
3715
decode_bits(&log_write_selector, &log_extra_selector, 0, 0,
3716
log_selector_string, log_options, log_options_count, US"log", 0);
3717
3718
DEBUG(D_any)
3719
{
3720
debug_printf("configuration file is %s\n", config_main_filename);
3721
debug_printf("log selectors = %08x %08x\n", log_write_selector,
3722
log_extra_selector);
3723
}
3724
3725
/* If domain literals are not allowed, check the sender address that was
3726
supplied with -f. Ditto for a stripped trailing dot. */
3727
3728
if (sender_address != NULL)
3729
{
3730
if (sender_address[sender_address_domain] == '[' && !allow_domain_literals)
3731
{
3732
fprintf(stderr, "exim: bad -f address \"%s\": domain literals not "
3733
"allowed\n", sender_address);
3734
return EXIT_FAILURE;
3735
}
3736
if (f_end_dot && !strip_trailing_dot)
3737
{
3738
fprintf(stderr, "exim: bad -f address \"%s.\": domain is malformed "
3739
"(trailing dot not allowed)\n", sender_address);
3740
return EXIT_FAILURE;
3741
}
3742
}
3743
3744
/* See if an admin user overrode our logging. */
3745
3746
if (cmdline_syslog_name != NULL)
3747
{
3748
if (admin_user)
3749
{
3750
syslog_processname = cmdline_syslog_name;
3751
log_file_path = string_copy(CUS"syslog");
3752
}
3753
else
3754
{
3755
/* not a panic, non-privileged users should not be able to spam paniclog */
3756
fprintf(stderr,
3757
"exim: you lack sufficient privilege to specify syslog process name\n");
3758
return EXIT_FAILURE;
3759
}
3760
}
3761
3762
/* Paranoia check of maximum lengths of certain strings. There is a check
3763
on the length of the log file path in log.c, which will come into effect
3764
if there are any calls to write the log earlier than this. However, if we
3765
get this far but the string is very long, it is better to stop now than to
3766
carry on and (e.g.) receive a message and then have to collapse. The call to
3767
log_write() from here will cause the ultimate panic collapse if the complete
3768
file name exceeds the buffer length. */
3769
3770
if (Ustrlen(log_file_path) > 200)
3771
log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3772
"log_file_path is longer than 200 chars: aborting");
3773
3774
if (Ustrlen(pid_file_path) > 200)
3775
log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3776
"pid_file_path is longer than 200 chars: aborting");
3777
3778
if (Ustrlen(spool_directory) > 200)
3779
log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3780
"spool_directory is longer than 200 chars: aborting");
3781
3782
/* Length check on the process name given to syslog for its TAG field,
3783
which is only permitted to be 32 characters or less. See RFC 3164. */
3784
3785
if (Ustrlen(syslog_processname) > 32)
3786
log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3787
"syslog_processname is longer than 32 chars: aborting");
3788
3789
/* In some operating systems, the environment variable TMPDIR controls where
3790
temporary files are created; Exim doesn't use these (apart from when delivering
3791
to MBX mailboxes), but called libraries such as DBM libraries may require them.
3792
If TMPDIR is found in the environment, reset it to the value defined in the
3793
TMPDIR macro, if this macro is defined. */
3794
3795
#ifdef TMPDIR
3796
{
3797
uschar **p;
3798
for (p = USS environ; *p != NULL; p++)
3799
{
3800
if (Ustrncmp(*p, "TMPDIR=", 7) == 0 &&
3801
Ustrcmp(*p+7, TMPDIR) != 0)
3802
{
3803
uschar *newp = malloc(Ustrlen(TMPDIR) + 8);
3804
sprintf(CS newp, "TMPDIR=%s", TMPDIR);
3805
*p = newp;
3806
DEBUG(D_any) debug_printf("reset TMPDIR=%s in environment\n", TMPDIR);
3807
}
3808
}
3809
}
3810
#endif
3811
3812
/* Timezone handling. If timezone_string is "utc", set a flag to cause all
3813
timestamps to be in UTC (gmtime() is used instead of localtime()). Otherwise,
3814
we may need to get rid of a bogus timezone setting. This can arise when Exim is
3815
called by a user who has set the TZ variable. This then affects the timestamps
3816
in log files and in Received: headers, and any created Date: header lines. The
3817
required timezone is settable in the configuration file, so nothing can be done
3818
about this earlier - but hopefully nothing will normally be logged earlier than
3819
this. We have to make a new environment if TZ is wrong, but don't bother if
3820
timestamps_utc is set, because then all times are in UTC anyway. */
3821
3822
if (timezone_string != NULL && strcmpic(timezone_string, US"UTC") == 0)
3823
{
3824
timestamps_utc = TRUE;
3825
}
3826
else
3827
{
3828
uschar *envtz = US getenv("TZ");
3829
if ((envtz == NULL && timezone_string != NULL) ||
3830
(envtz != NULL &&
3831
(timezone_string == NULL ||
3832
Ustrcmp(timezone_string, envtz) != 0)))
3833
{
3834
uschar **p = USS environ;
3835
uschar **new;
3836
uschar **newp;
3837
int count = 0;
3838
while (*p++ != NULL) count++;
3839
if (envtz == NULL) count++;
3840
newp = new = malloc(sizeof(uschar *) * (count + 1));
3841
for (p = USS environ; *p != NULL; p++)
3842
{
3843
if (Ustrncmp(*p, "TZ=", 3) == 0) continue;
3844
*newp++ = *p;
3845
}
3846
if (timezone_string != NULL)
3847
{
3848
*newp = malloc(Ustrlen(timezone_string) + 4);
3849
sprintf(CS *newp++, "TZ=%s", timezone_string);
3850
}
3851
*newp = NULL;
3852
environ = CSS new;
3853
tzset();
3854
DEBUG(D_any) debug_printf("Reset TZ to %s: time is %s\n", timezone_string,
3855
tod_stamp(tod_log));
3856
}
3857
}
3858
3859
/* Handle the case when we have removed the setuid privilege because of -C or
3860
-D. This means that the caller of Exim was not root.
3861
3862
There is a problem if we were running as the Exim user. The sysadmin may
3863
expect this case to retain privilege because "the binary was called by the
3864
Exim user", but it hasn't, because either the -D option set macros, or the
3865
-C option set a non-trusted configuration file. There are two possibilities:
3866
3867
(1) If deliver_drop_privilege is set, Exim is not going to re-exec in order
3868
to do message deliveries. Thus, the fact that it is running as a
3869
non-privileged user is plausible, and might be wanted in some special
3870
configurations. However, really_exim will have been set false when
3871
privilege was dropped, to stop Exim trying to write to its normal log
3872
files. Therefore, re-enable normal log processing, assuming the sysadmin
3873
has set up the log directory correctly.
3874
3875
(2) If deliver_drop_privilege is not set, the configuration won't work as
3876
apparently intended, and so we log a panic message. In order to retain
3877
root for -C or -D, the caller must either be root or be invoking a
3878
trusted configuration file (when deliver_drop_privilege is false). */
3879
3880
if (removed_privilege && (!trusted_config || macros != NULL) &&
3881
real_uid == exim_uid)
3882
{
3883
if (deliver_drop_privilege)
3884
really_exim = TRUE; /* let logging work normally */
3885
else
3886
log_write(0, LOG_MAIN|LOG_PANIC,
3887
"exim user lost privilege for using %s option",
3888
trusted_config? "-D" : "-C");
3889
}
3890
3891
/* Start up Perl interpreter if Perl support is configured and there is a
3892
perl_startup option, and the configuration or the command line specifies
3893
initializing starting. Note that the global variables are actually called
3894
opt_perl_xxx to avoid clashing with perl's namespace (perl_*). */
3895
3896
#ifdef EXIM_PERL
3897
if (perl_start_option != 0)
3898
opt_perl_at_start = (perl_start_option > 0);
3899
if (opt_perl_at_start && opt_perl_startup != NULL)
3900
{
3901
uschar *errstr;
3902
DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
3903
errstr = init_perl(opt_perl_startup);
3904
if (errstr != NULL)
3905
{
3906
fprintf(stderr, "exim: error in perl_startup code: %s\n", errstr);
3907
return EXIT_FAILURE;
3908
}
3909
opt_perl_started = TRUE;
3910
}
3911
#endif /* EXIM_PERL */
3912
3913
/* Log the arguments of the call if the configuration file said so. This is
3914
a debugging feature for finding out what arguments certain MUAs actually use.
3915
Don't attempt it if logging is disabled, or if listing variables or if
3916
verifying/testing addresses or expansions. */
3917
3918
if (((debug_selector & D_any) != 0 || (log_extra_selector & LX_arguments) != 0)
3919
&& really_exim && !list_options && !checking)
3920
{
3921
int i;
3922
uschar *p = big_buffer;
3923
char * dummy;
3924
Ustrcpy(p, "cwd= (failed)");
3925
dummy = /* quieten compiler */ getcwd(CS p+4, big_buffer_size - 4);
3926
while (*p) p++;
3927
(void)string_format(p, big_buffer_size - (p - big_buffer), " %d args:", argc);
3928
while (*p) p++;
3929
for (i = 0; i < argc; i++)
3930
{
3931
int len = Ustrlen(argv[i]);
3932
uschar *printing;
3933
uschar *quote;
3934
if (p + len + 8 >= big_buffer + big_buffer_size)
3935
{
3936
Ustrcpy(p, " ...");
3937
log_write(0, LOG_MAIN, "%s", big_buffer);
3938
Ustrcpy(big_buffer, "...");
3939
p = big_buffer + 3;
3940
}
3941
printing = string_printing(argv[i]);
3942
if (printing[0] == 0) quote = US"\""; else
3943
{
3944
uschar *pp = printing;
3945
quote = US"";
3946
while (*pp != 0) if (isspace(*pp++)) { quote = US"\""; break; }
3947
}
3948
sprintf(CS p, " %s%.*s%s", quote, (int)(big_buffer_size -
3949
(p - big_buffer) - 4), printing, quote);
3950
while (*p) p++;
3951
}
3952
3953
if ((log_extra_selector & LX_arguments) != 0)
3954
log_write(0, LOG_MAIN, "%s", big_buffer);
3955
else
3956
debug_printf("%s\n", big_buffer);
3957
}
3958
3959
/* Set the working directory to be the top-level spool directory. We don't rely
3960
on this in the code, which always uses fully qualified names, but it's useful
3961
for core dumps etc. Don't complain if it fails - the spool directory might not
3962
be generally accessible and calls with the -C option (and others) have lost
3963
privilege by now. Before the chdir, we try to ensure that the directory exists.
3964
*/
3965
3966
if (Uchdir(spool_directory) != 0)
3967
{
3968
int dummy;
3969
(void)directory_make(spool_directory, US"", SPOOL_DIRECTORY_MODE, FALSE);
3970
dummy = /* quieten compiler */ Uchdir(spool_directory);
3971
}
3972
3973
/* Handle calls with the -bi option. This is a sendmail option to rebuild *the*
3974
alias file. Exim doesn't have such a concept, but this call is screwed into
3975
Sun's YP makefiles. Handle this by calling a configured script, as the real
3976
user who called Exim. The -oA option can be used to pass an argument to the
3977
script. */
3978
3979
if (bi_option)
3980
{
3981
(void)fclose(config_file);
3982
if (bi_command != NULL)
3983
{
3984
int i = 0;
3985
uschar *argv[3];
3986
argv[i++] = bi_command;
3987
if (alias_arg != NULL) argv[i++] = alias_arg;
3988
argv[i++] = NULL;
3989
3990
setgroups(group_count, group_list);
3991
exim_setugid(real_uid, real_gid, FALSE, US"running bi_command");
3992
3993
DEBUG(D_exec) debug_printf("exec %.256s %.256s\n", argv[0],
3994
(argv[1] == NULL)? US"" : argv[1]);
3995
3996
execv(CS argv[0], (char *const *)argv);
3997
fprintf(stderr, "exim: exec failed: %s\n", strerror(errno));
3998
exit(EXIT_FAILURE);
3999
}
4000
else
4001
{
4002
DEBUG(D_any) debug_printf("-bi used but bi_command not set; exiting\n");
4003
exit(EXIT_SUCCESS);
4004
}
4005
}
4006
4007
/* We moved the admin/trusted check to be immediately after reading the
4008
configuration file. We leave these prints here to ensure that syslog setup,
4009
logfile setup, and so on has already happened. */
4010
4011
if (trusted_caller) DEBUG(D_any) debug_printf("trusted user\n");
4012
if (admin_user) DEBUG(D_any) debug_printf("admin user\n");
4013
4014
/* Only an admin user may start the daemon or force a queue run in the default
4015
configuration, but the queue run restriction can be relaxed. Only an admin
4016
user may request that a message be returned to its sender forthwith. Only an
4017
admin user may specify a debug level greater than D_v (because it might show
4018
passwords, etc. in lookup queries). Only an admin user may request a queue
4019
count. Only an admin user can use the test interface to scan for email
4020
(because Exim will be in the spool dir and able to look at mails). */
4021
4022
if (!admin_user)
4023
{
4024
BOOL debugset = (debug_selector & ~D_v) != 0;
4025
if (deliver_give_up || daemon_listen || malware_test_file ||
4026
(count_queue && queue_list_requires_admin) ||
4027
(list_queue && queue_list_requires_admin) ||
4028
(queue_interval >= 0 && prod_requires_admin) ||
4029
(debugset && !running_in_test_harness))
4030
{
4031
fprintf(stderr, "exim:%s permission denied\n", debugset? " debugging" : "");
4032
exit(EXIT_FAILURE);
4033
}
4034
}
4035
4036
/* If the real user is not root or the exim uid, the argument for passing
4037
in an open TCP/IP connection for another message is not permitted, nor is
4038
running with the -N option for any delivery action, unless this call to exim is
4039
one that supplied an input message, or we are using a patched exim for
4040
regression testing. */
4041
4042
if (real_uid != root_uid && real_uid != exim_uid &&
4043
(continue_hostname != NULL ||
4044
(dont_deliver &&
4045
(queue_interval >= 0 || daemon_listen || msg_action_arg > 0)
4046
)) && !running_in_test_harness)
4047
{
4048
fprintf(stderr, "exim: Permission denied\n");
4049
return EXIT_FAILURE;
4050
}
4051
4052
/* If the caller is not trusted, certain arguments are ignored when running for
4053
real, but are permitted when checking things (-be, -bv, -bt, -bh, -bf, -bF).
4054
Note that authority for performing certain actions on messages is tested in the
4055
queue_action() function. */
4056
4057
if (!trusted_caller && !checking && filter_test == FTEST_NONE)
4058
{
4059
sender_host_name = sender_host_address = interface_address =
4060
sender_ident = received_protocol = NULL;
4061
sender_host_port = interface_port = 0;
4062
sender_host_authenticated = authenticated_sender = authenticated_id = NULL;
4063
}
4064
4065
/* If a sender host address is set, extract the optional port number off the
4066
end of it and check its syntax. Do the same thing for the interface address.
4067
Exim exits if the syntax is bad. */
4068
4069
else
4070
{
4071
if (sender_host_address != NULL)
4072
sender_host_port = check_port(sender_host_address);
4073
if (interface_address != NULL)
4074
interface_port = check_port(interface_address);
4075
}
4076
4077
/* If the caller is trusted, then they can use -G to suppress_local_fixups. */
4078
if (flag_G)
4079
{
4080
if (trusted_caller)
4081
{
4082
suppress_local_fixups = suppress_local_fixups_default = TRUE;
4083
DEBUG(D_acl) debug_printf("suppress_local_fixups forced on by -G\n");
4084
}
4085
else
4086
{
4087
fprintf(stderr, "exim: permission denied (-G requires a trusted user)\n");
4088
return EXIT_FAILURE;
4089
}
4090
}
4091
4092
/* If an SMTP message is being received check to see if the standard input is a
4093
TCP/IP socket. If it is, we assume that Exim was called from inetd if the
4094
caller is root or the Exim user, or if the port is a privileged one. Otherwise,
4095
barf. */
4096
4097
if (smtp_input)
4098
{
4099
union sockaddr_46 inetd_sock;
4100
EXIM_SOCKLEN_T size = sizeof(inetd_sock);
4101
if (getpeername(0, (struct sockaddr *)(&inetd_sock), &size) == 0)
4102
{
4103
int family = ((struct sockaddr *)(&inetd_sock))->sa_family;
4104
if (family == AF_INET || family == AF_INET6)
4105
{
4106
union sockaddr_46 interface_sock;
4107
size = sizeof(interface_sock);
4108
4109
if (getsockname(0, (struct sockaddr *)(&interface_sock), &size) == 0)
4110
interface_address = host_ntoa(-1, &interface_sock, NULL,
4111
&interface_port);
4112
4113
if (host_is_tls_on_connect_port(interface_port)) tls_in.on_connect = TRUE;
4114
4115
if (real_uid == root_uid || real_uid == exim_uid || interface_port < 1024)
4116
{
4117
is_inetd = TRUE;
4118
sender_host_address = host_ntoa(-1, (struct sockaddr *)(&inetd_sock),
4119
NULL, &sender_host_port);
4120
if (mua_wrapper) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Input from "
4121
"inetd is not supported when mua_wrapper is set");
4122
}
4123
else
4124
{
4125
fprintf(stderr,
4126
"exim: Permission denied (unprivileged user, unprivileged port)\n");
4127
return EXIT_FAILURE;
4128
}
4129
}
4130
}
4131
}
4132
4133
/* If the load average is going to be needed while receiving a message, get it
4134
now for those OS that require the first call to os_getloadavg() to be done as
4135
root. There will be further calls later for each message received. */
4136
4137
#ifdef LOAD_AVG_NEEDS_ROOT
4138
if (receiving_message &&
4139
(queue_only_load >= 0 ||
4140
(is_inetd && smtp_load_reserve >= 0)
4141
))
4142
{
4143
load_average = OS_GETLOADAVG();
4144
}
4145
#endif
4146
4147
/* The queue_only configuration option can be overridden by -odx on the command
4148
line, except that if queue_only_override is false, queue_only cannot be unset
4149
from the command line. */
4150
4151
if (queue_only_set && (queue_only_override || arg_queue_only))
4152
queue_only = arg_queue_only;
4153
4154
/* The receive_timeout and smtp_receive_timeout options can be overridden by
4155
-or and -os. */
4156
4157
if (arg_receive_timeout >= 0) receive_timeout = arg_receive_timeout;
4158
if (arg_smtp_receive_timeout >= 0)
4159
smtp_receive_timeout = arg_smtp_receive_timeout;
4160
4161
/* If Exim was started with root privilege, unless we have already removed the
4162
root privilege above as a result of -C, -D, -be, -bf or -bF, remove it now
4163
except when starting the daemon or doing some kind of delivery or address
4164
testing (-bt). These are the only cases when root need to be retained. We run
4165
as exim for -bv and -bh. However, if deliver_drop_privilege is set, root is
4166
retained only for starting the daemon. We always do the initgroups() in this
4167
situation (controlled by the TRUE below), in order to be as close as possible
4168
to the state Exim usually runs in. */
4169
4170
if (!unprivileged && /* originally had root AND */
4171
!removed_privilege && /* still got root AND */
4172
!daemon_listen && /* not starting the daemon */
4173
queue_interval <= 0 && /* (either kind of daemon) */
4174
( /* AND EITHER */
4175
deliver_drop_privilege || /* requested unprivileged */
4176
( /* OR */
4177
queue_interval < 0 && /* not running the queue */
4178
(msg_action_arg < 0 || /* and */
4179
msg_action != MSG_DELIVER) && /* not delivering and */
4180
(!checking || !address_test_mode) /* not address checking */
4181
)
4182
))
4183
{
4184
exim_setugid(exim_uid, exim_gid, TRUE, US"privilege not needed");
4185
}
4186
4187
/* When we are retaining a privileged uid, we still change to the exim gid. */
4188
4189
else
4190
{
4191
int rv;
4192
rv = setgid(exim_gid);
4193
/* Impact of failure is that some stuff might end up with an incorrect group.
4194
We track this for failures from root, since any attempt to change privilege
4195
by root should succeed and failures should be examined. For non-root,
4196
there's no security risk. For me, it's { exim -bV } on a just-built binary,
4197
no need to complain then. */
4198
if (rv == -1)
4199
{
4200
if (!(unprivileged || removed_privilege))
4201
{
4202
fprintf(stderr,
4203
"exim: changing group failed: %s\n", strerror(errno));
4204
exit(EXIT_FAILURE);
4205
}
4206
else
4207
DEBUG(D_any) debug_printf("changing group to %ld failed: %s\n",
4208
(long int)exim_gid, strerror(errno));
4209
}
4210
}
4211
4212
/* Handle a request to scan a file for malware */
4213
if (malware_test_file)
4214
{
4215
#ifdef WITH_CONTENT_SCAN
4216
int result;
4217
set_process_info("scanning file for malware");
4218
result = malware_in_file(malware_test_file);
4219
if (result == FAIL)
4220
{
4221
printf("No malware found.\n");
4222
exit(EXIT_SUCCESS);
4223
}
4224
if (result != OK)
4225
{
4226
printf("Malware lookup returned non-okay/fail: %d\n", result);
4227
exit(EXIT_FAILURE);
4228
}
4229
if (malware_name)
4230
printf("Malware found: %s\n", malware_name);
4231
else
4232
printf("Malware scan detected malware of unknown name.\n");
4233
#else
4234
printf("Malware scanning not enabled at compile time.\n");
4235
#endif
4236
exit(EXIT_FAILURE);
4237
}
4238
4239
/* Handle a request to list the delivery queue */
4240
4241
if (list_queue)
4242
{
4243
set_process_info("listing the queue");
4244
queue_list(list_queue_option, argv + recipients_arg, argc - recipients_arg);
4245
exit(EXIT_SUCCESS);
4246
}
4247
4248
/* Handle a request to count the delivery queue */
4249
4250
if (count_queue)
4251
{
4252
set_process_info("counting the queue");
4253
queue_count();
4254
exit(EXIT_SUCCESS);
4255
}
4256
4257
/* Handle actions on specific messages, except for the force delivery and
4258
message load actions, which are done below. Some actions take a whole list of
4259
message ids, which are known to continue up to the end of the arguments. Others
4260
take a single message id and then operate on the recipients list. */
4261
4262
if (msg_action_arg > 0 && msg_action != MSG_DELIVER && msg_action != MSG_LOAD)
4263
{
4264
int yield = EXIT_SUCCESS;
4265
set_process_info("acting on specified messages");
4266
4267
if (!one_msg_action)
4268
{
4269
for (i = msg_action_arg; i < argc; i++)
4270
if (!queue_action(argv[i], msg_action, NULL, 0, 0))
4271
yield = EXIT_FAILURE;
4272
}
4273
4274
else if (!queue_action(argv[msg_action_arg], msg_action, argv, argc,
4275
recipients_arg)) yield = EXIT_FAILURE;
4276
exit(yield);
4277
}
4278
4279
/* We used to set up here to skip reading the ACL section, on
4280
(msg_action_arg > 0 || (queue_interval == 0 && !daemon_listen)
4281
Now, since the intro of the ${acl } expansion, ACL definitions may be
4282
needed in transports so we lost the optimisation. */
4283
4284
readconf_rest();
4285
4286
/* The configuration data will have been read into POOL_PERM because we won't
4287
ever want to reset back past it. Change the current pool to POOL_MAIN. In fact,
4288
this is just a bit of pedantic tidiness. It wouldn't really matter if the
4289
configuration were read into POOL_MAIN, because we don't do any resets till
4290
later on. However, it seems right, and it does ensure that both pools get used.
4291
*/
4292
4293
store_pool = POOL_MAIN;
4294
4295
/* Handle the -brt option. This is for checking out retry configurations.
4296
The next three arguments are a domain name or a complete address, and
4297
optionally two error numbers. All it does is to call the function that
4298
scans the retry configuration data. */
4299
4300
if (test_retry_arg >= 0)
4301
{
4302
retry_config *yield;
4303
int basic_errno = 0;
4304
int more_errno = 0;
4305
uschar *s1, *s2;
4306
4307
if (test_retry_arg >= argc)
4308
{
4309
printf("-brt needs a domain or address argument\n");
4310
exim_exit(EXIT_FAILURE);
4311
}
4312
s1 = argv[test_retry_arg++];
4313
s2 = NULL;
4314
4315
/* If the first argument contains no @ and no . it might be a local user
4316
or it might be a single-component name. Treat as a domain. */
4317
4318
if (Ustrchr(s1, '@') == NULL && Ustrchr(s1, '.') == NULL)
4319
{
4320
printf("Warning: \"%s\" contains no '@' and no '.' characters. It is "
4321
"being \ntreated as a one-component domain, not as a local part.\n\n",
4322
s1);
4323
}
4324
4325
/* There may be an optional second domain arg. */
4326
4327
if (test_retry_arg < argc && Ustrchr(argv[test_retry_arg], '.') != NULL)
4328
s2 = argv[test_retry_arg++];
4329
4330
/* The final arg is an error name */
4331
4332
if (test_retry_arg < argc)
4333
{
4334
uschar *ss = argv[test_retry_arg];
4335
uschar *error =
4336
readconf_retry_error(ss, ss + Ustrlen(ss), &basic_errno, &more_errno);
4337
if (error != NULL)
4338
{
4339
printf("%s\n", CS error);
4340
return EXIT_FAILURE;
4341
}
4342
4343
/* For the {MAIL,RCPT,DATA}_4xx errors, a value of 255 means "any", and a
4344
code > 100 as an error is for matching codes to the decade. Turn them into
4345
a real error code, off the decade. */
4346
4347
if (basic_errno == ERRNO_MAIL4XX ||
4348
basic_errno == ERRNO_RCPT4XX ||
4349
basic_errno == ERRNO_DATA4XX)
4350
{
4351
int code = (more_errno >> 8) & 255;
4352
if (code == 255)
4353
more_errno = (more_errno & 0xffff00ff) | (21 << 8);
4354
else if (code > 100)
4355
more_errno = (more_errno & 0xffff00ff) | ((code - 96) << 8);
4356
}
4357
}
4358
4359
yield = retry_find_config(s1, s2, basic_errno, more_errno);
4360
if (yield == NULL) printf("No retry information found\n"); else
4361
{
4362
retry_rule *r;
4363
more_errno = yield->more_errno;
4364
printf("Retry rule: %s ", yield->pattern);
4365
4366
if (yield->basic_errno == ERRNO_EXIMQUOTA)
4367
{
4368
printf("quota%s%s ",
4369
(more_errno > 0)? "_" : "",
4370
(more_errno > 0)? readconf_printtime(more_errno) : US"");
4371
}
4372
else if (yield->basic_errno == ECONNREFUSED)
4373
{
4374
printf("refused%s%s ",
4375
(more_errno > 0)? "_" : "",
4376
(more_errno == 'M')? "MX" :
4377
(more_errno == 'A')? "A" : "");
4378
}
4379
else if (yield->basic_errno == ETIMEDOUT)
4380
{
4381
printf("timeout");
4382
if ((more_errno & RTEF_CTOUT) != 0) printf("_connect");
4383
more_errno &= 255;
4384
if (more_errno != 0) printf("_%s",
4385
(more_errno == 'M')? "MX" : "A");
4386
printf(" ");
4387
}
4388
else if (yield->basic_errno == ERRNO_AUTHFAIL)
4389
printf("auth_failed ");
4390
else printf("* ");
4391
4392
for (r = yield->rules; r != NULL; r = r->next)
4393
{
4394
printf("%c,%s", r->rule, readconf_printtime(r->timeout)); /* Do not */
4395
printf(",%s", readconf_printtime(r->p1)); /* amalgamate */
4396
if (r->rule == 'G')
4397
{
4398
int x = r->p2;
4399
int f = x % 1000;
4400
int d = 100;
4401
printf(",%d.", x/1000);
4402
do
4403
{
4404
printf("%d", f/d);
4405
f %= d;
4406
d /= 10;
4407
}
4408
while (f != 0);
4409
}
4410
printf("; ");
4411
}
4412
4413
printf("\n");
4414
}
4415
exim_exit(EXIT_SUCCESS);
4416
}
4417
4418
/* Handle a request to list one or more configuration options */
4419
/* If -n was set, we suppress some information */
4420
4421
if (list_options)
4422
{
4423
set_process_info("listing variables");
4424
if (recipients_arg >= argc) readconf_print(US"all", NULL, flag_n);
4425
else for (i = recipients_arg; i < argc; i++)
4426
{
4427
if (i < argc - 1 &&
4428
(Ustrcmp(argv[i], "router") == 0 ||
4429
Ustrcmp(argv[i], "transport") == 0 ||
4430
Ustrcmp(argv[i], "authenticator") == 0 ||
4431
Ustrcmp(argv[i], "macro") == 0))
4432
{
4433
readconf_print(argv[i+1], argv[i], flag_n);
4434
i++;
4435
}
4436
else readconf_print(argv[i], NULL, flag_n);
4437
}
4438
exim_exit(EXIT_SUCCESS);
4439
}
4440
4441
4442
/* Handle a request to deliver one or more messages that are already on the
4443
queue. Values of msg_action other than MSG_DELIVER and MSG_LOAD are dealt with
4444
above. MSG_LOAD is handled with -be (which is the only time it applies) below.
4445
4446
Delivery of specific messages is typically used for a small number when
4447
prodding by hand (when the option forced_delivery will be set) or when
4448
re-execing to regain root privilege. Each message delivery must happen in a
4449
separate process, so we fork a process for each one, and run them sequentially
4450
so that debugging output doesn't get intertwined, and to avoid spawning too
4451
many processes if a long list is given. However, don't fork for the last one;
4452
this saves a process in the common case when Exim is called to deliver just one
4453
message. */
4454
4455
if (msg_action_arg > 0 && msg_action != MSG_LOAD)
4456
{
4457
if (prod_requires_admin && !admin_user)
4458
{
4459
fprintf(stderr, "exim: Permission denied\n");
4460
exim_exit(EXIT_FAILURE);
4461
}
4462
set_process_info("delivering specified messages");
4463
if (deliver_give_up) forced_delivery = deliver_force_thaw = TRUE;
4464
for (i = msg_action_arg; i < argc; i++)
4465
{
4466
int status;
4467
pid_t pid;
4468
if (i == argc - 1)
4469
(void)deliver_message(argv[i], forced_delivery, deliver_give_up);
4470
else if ((pid = fork()) == 0)
4471
{
4472
(void)deliver_message(argv[i], forced_delivery, deliver_give_up);
4473
_exit(EXIT_SUCCESS);
4474
}
4475
else if (pid < 0)
4476
{
4477
fprintf(stderr, "failed to fork delivery process for %s: %s\n", argv[i],
4478
strerror(errno));
4479
exim_exit(EXIT_FAILURE);
4480
}
4481
else wait(&status);
4482
}
4483
exim_exit(EXIT_SUCCESS);
4484
}
4485
4486
4487
/* If only a single queue run is requested, without SMTP listening, we can just
4488
turn into a queue runner, with an optional starting message id. */
4489
4490
if (queue_interval == 0 && !daemon_listen)
4491
{
4492
DEBUG(D_queue_run) debug_printf("Single queue run%s%s%s%s\n",
4493
(start_queue_run_id == NULL)? US"" : US" starting at ",
4494
(start_queue_run_id == NULL)? US"" : start_queue_run_id,
4495
(stop_queue_run_id == NULL)? US"" : US" stopping at ",
4496
(stop_queue_run_id == NULL)? US"" : stop_queue_run_id);
4497
set_process_info("running the queue (single queue run)");
4498
queue_run(start_queue_run_id, stop_queue_run_id, FALSE);
4499
exim_exit(EXIT_SUCCESS);
4500
}
4501
4502
4503
/* Find the login name of the real user running this process. This is always
4504
needed when receiving a message, because it is written into the spool file. It
4505
may also be used to construct a from: or a sender: header, and in this case we
4506
need the user's full name as well, so save a copy of it, checked for RFC822
4507
syntax and munged if necessary, if it hasn't previously been set by the -F
4508
argument. We may try to get the passwd entry more than once, in case NIS or
4509
other delays are in evidence. Save the home directory for use in filter testing
4510
(only). */
4511
4512
for (i = 0;;)
4513
{
4514
if ((pw = getpwuid(real_uid)) != NULL)
4515
{
4516
originator_login = string_copy(US pw->pw_name);
4517
originator_home = string_copy(US pw->pw_dir);
4518
4519
/* If user name has not been set by -F, set it from the passwd entry
4520
unless -f has been used to set the sender address by a trusted user. */
4521
4522
if (originator_name == NULL)
4523
{
4524
if (sender_address == NULL ||
4525
(!trusted_caller && filter_test == FTEST_NONE))
4526
{
4527
uschar *name = US pw->pw_gecos;
4528
uschar *amp = Ustrchr(name, '&');
4529
uschar buffer[256];
4530
4531
/* Most Unix specify that a '&' character in the gecos field is
4532
replaced by a copy of the login name, and some even specify that
4533
the first character should be upper cased, so that's what we do. */
4534
4535
if (amp != NULL)
4536
{
4537
int loffset;
4538
string_format(buffer, sizeof(buffer), "%.*s%n%s%s",
4539
amp - name, name, &loffset, originator_login, amp + 1);
4540
buffer[loffset] = toupper(buffer[loffset]);
4541
name = buffer;
4542
}
4543
4544
/* If a pattern for matching the gecos field was supplied, apply
4545
it and then expand the name string. */
4546
4547
if (gecos_pattern != NULL && gecos_name != NULL)
4548
{
4549
const pcre *re;
4550
re = regex_must_compile(gecos_pattern, FALSE, TRUE); /* Use malloc */
4551
4552
if (regex_match_and_setup(re, name, 0, -1))
4553
{
4554
uschar *new_name = expand_string(gecos_name);
4555
expand_nmax = -1;
4556
if (new_name != NULL)
4557
{
4558
DEBUG(D_receive) debug_printf("user name \"%s\" extracted from "
4559
"gecos field \"%s\"\n", new_name, name);
4560
name = new_name;
4561
}
4562
else DEBUG(D_receive) debug_printf("failed to expand gecos_name string "
4563
"\"%s\": %s\n", gecos_name, expand_string_message);
4564
}
4565
else DEBUG(D_receive) debug_printf("gecos_pattern \"%s\" did not match "
4566
"gecos field \"%s\"\n", gecos_pattern, name);
4567
store_free((void *)re);
4568
}
4569
originator_name = string_copy(name);
4570
}
4571
4572
/* A trusted caller has used -f but not -F */
4573
4574
else originator_name = US"";
4575
}
4576
4577
/* Break the retry loop */
4578
4579
break;
4580
}
4581
4582
if (++i > finduser_retries) break;
4583
sleep(1);
4584
}
4585
4586
/* If we cannot get a user login, log the incident and give up, unless the
4587
configuration specifies something to use. When running in the test harness,
4588
any setting of unknown_login overrides the actual name. */
4589
4590
if (originator_login == NULL || running_in_test_harness)
4591
{
4592
if (unknown_login != NULL)
4593
{
4594
originator_login = expand_string(unknown_login);
4595
if (originator_name == NULL && unknown_username != NULL)
4596
originator_name = expand_string(unknown_username);
4597
if (originator_name == NULL) originator_name = US"";
4598
}
4599
if (originator_login == NULL)
4600
log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Failed to get user name for uid %d",
4601
(int)real_uid);
4602
}
4603
4604
/* Ensure that the user name is in a suitable form for use as a "phrase" in an
4605
RFC822 address.*/
4606
4607
originator_name = string_copy(parse_fix_phrase(originator_name,
4608
Ustrlen(originator_name), big_buffer, big_buffer_size));
4609
4610
/* If a message is created by this call of Exim, the uid/gid of its originator
4611
are those of the caller. These values are overridden if an existing message is
4612
read in from the spool. */
4613
4614
originator_uid = real_uid;
4615
originator_gid = real_gid;
4616
4617
DEBUG(D_receive) debug_printf("originator: uid=%d gid=%d login=%s name=%s\n",
4618
(int)originator_uid, (int)originator_gid, originator_login, originator_name);
4619
4620
/* Run in daemon and/or queue-running mode. The function daemon_go() never
4621
returns. We leave this till here so that the originator_ fields are available
4622
for incoming messages via the daemon. The daemon cannot be run in mua_wrapper
4623
mode. */
4624
4625
if (daemon_listen || inetd_wait_mode || queue_interval > 0)
4626
{
4627
if (mua_wrapper)
4628
{
4629
fprintf(stderr, "Daemon cannot be run when mua_wrapper is set\n");
4630
log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Daemon cannot be run when "
4631
"mua_wrapper is set");
4632
}
4633
daemon_go();
4634
}
4635
4636
/* If the sender ident has not been set (by a trusted caller) set it to
4637
the caller. This will get overwritten below for an inetd call. If a trusted
4638
caller has set it empty, unset it. */
4639
4640
if (sender_ident == NULL) sender_ident = originator_login;
4641
else if (sender_ident[0] == 0) sender_ident = NULL;
4642
4643
/* Handle the -brw option, which is for checking out rewriting rules. Cause log
4644
writes (on errors) to go to stderr instead. Can't do this earlier, as want the
4645
originator_* variables set. */
4646
4647
if (test_rewrite_arg >= 0)
4648
{
4649
really_exim = FALSE;
4650
if (test_rewrite_arg >= argc)
4651
{
4652
printf("-brw needs an address argument\n");
4653
exim_exit(EXIT_FAILURE);
4654
}
4655
rewrite_test(argv[test_rewrite_arg]);
4656
exim_exit(EXIT_SUCCESS);
4657
}
4658
4659
/* A locally-supplied message is considered to be coming from a local user
4660
unless a trusted caller supplies a sender address with -f, or is passing in the
4661
message via SMTP (inetd invocation or otherwise). */
4662
4663
if ((sender_address == NULL && !smtp_input) ||
4664
(!trusted_caller && filter_test == FTEST_NONE))
4665
{
4666
sender_local = TRUE;
4667
4668
/* A trusted caller can supply authenticated_sender and authenticated_id
4669
via -oMas and -oMai and if so, they will already be set. Otherwise, force
4670
defaults except when host checking. */
4671
4672
if (authenticated_sender == NULL && !host_checking)
4673
authenticated_sender = string_sprintf("%s@%s", originator_login,
4674
qualify_domain_sender);
4675
if (authenticated_id == NULL && !host_checking)
4676
authenticated_id = originator_login;
4677
}
4678
4679
/* Trusted callers are always permitted to specify the sender address.
4680
Untrusted callers may specify it if it matches untrusted_set_sender, or if what
4681
is specified is the empty address. However, if a trusted caller does not
4682
specify a sender address for SMTP input, we leave sender_address unset. This
4683
causes the MAIL commands to be honoured. */
4684
4685
if ((!smtp_input && sender_address == NULL) ||
4686
!receive_check_set_sender(sender_address))
4687
{
4688
/* Either the caller is not permitted to set a general sender, or this is
4689
non-SMTP input and the trusted caller has not set a sender. If there is no
4690
sender, or if a sender other than <> is set, override with the originator's
4691
login (which will get qualified below), except when checking things. */
4692
4693
if (sender_address == NULL /* No sender_address set */
4694
|| /* OR */
4695
(sender_address[0] != 0 && /* Non-empty sender address, AND */
4696
!checking && /* Not running tests, AND */
4697
filter_test == FTEST_NONE)) /* Not testing a filter */
4698
{
4699
sender_address = originator_login;
4700
sender_address_forced = FALSE;
4701
sender_address_domain = 0;
4702
}
4703
}
4704
4705
/* Remember whether an untrusted caller set the sender address */
4706
4707
sender_set_untrusted = sender_address != originator_login && !trusted_caller;
4708
4709
/* Ensure that the sender address is fully qualified unless it is the empty
4710
address, which indicates an error message, or doesn't exist (root caller, smtp
4711
interface, no -f argument). */
4712
4713
if (sender_address != NULL && sender_address[0] != 0 &&
4714
sender_address_domain == 0)
4715
sender_address = string_sprintf("%s@%s", local_part_quote(sender_address),
4716
qualify_domain_sender);
4717
4718
DEBUG(D_receive) debug_printf("sender address = %s\n", sender_address);
4719
4720
/* Handle a request to verify a list of addresses, or test them for delivery.
4721
This must follow the setting of the sender address, since routers can be
4722
predicated upon the sender. If no arguments are given, read addresses from
4723
stdin. Set debug_level to at least D_v to get full output for address testing.
4724
*/
4725
4726
if (verify_address_mode || address_test_mode)
4727
{
4728
int exit_value = 0;
4729
int flags = vopt_qualify;
4730
4731
if (verify_address_mode)
4732
{
4733
if (!verify_as_sender) flags |= vopt_is_recipient;
4734
DEBUG(D_verify) debug_print_ids(US"Verifying:");
4735
}
4736
4737
else
4738
{
4739
flags |= vopt_is_recipient;
4740
debug_selector |= D_v;
4741
debug_file = stderr;
4742
debug_fd = fileno(debug_file);
4743
DEBUG(D_verify) debug_print_ids(US"Address testing:");
4744
}
4745
4746
if (recipients_arg < argc)
4747
{
4748
while (recipients_arg < argc)
4749
{
4750
uschar *s = argv[recipients_arg++];
4751
while (*s != 0)
4752
{
4753
BOOL finished = FALSE;
4754
uschar *ss = parse_find_address_end(s, FALSE);
4755
if (*ss == ',') *ss = 0; else finished = TRUE;
4756
test_address(s, flags, &exit_value);
4757
s = ss;
4758
if (!finished)
4759
while (*(++s) != 0 && (*s == ',' || isspace(*s)));
4760
}
4761
}
4762
}
4763
4764
else for (;;)
4765
{
4766
uschar *s = get_stdinput(NULL, NULL);
4767
if (s == NULL) break;
4768
test_address(s, flags, &exit_value);
4769
}
4770
4771
route_tidyup();
4772
exim_exit(exit_value);
4773
}
4774
4775
/* Handle expansion checking. Either expand items on the command line, or read
4776
from stdin if there aren't any. If -Mset was specified, load the message so
4777
that its variables can be used, but restrict this facility to admin users.
4778
Otherwise, if -bem was used, read a message from stdin. */
4779
4780
if (expansion_test)
4781
{
4782
if (msg_action_arg > 0 && msg_action == MSG_LOAD)
4783
{
4784
uschar spoolname[256]; /* Not big_buffer; used in spool_read_header() */
4785
if (!admin_user)
4786
{
4787
fprintf(stderr, "exim: permission denied\n");
4788
exit(EXIT_FAILURE);
4789
}
4790
message_id = argv[msg_action_arg];
4791
(void)string_format(spoolname, sizeof(spoolname), "%s-H", message_id);
4792
if (!spool_open_datafile(message_id))
4793
printf ("Failed to load message datafile %s\n", message_id);
4794
if (spool_read_header(spoolname, TRUE, FALSE) != spool_read_OK)
4795
printf ("Failed to load message %s\n", message_id);
4796
}
4797
4798
/* Read a test message from a file. We fudge it up to be on stdin, saving
4799
stdin itself for later reading of expansion strings. */
4800
4801
else if (expansion_test_message != NULL)
4802
{
4803
int save_stdin = dup(0);
4804
int fd = Uopen(expansion_test_message, O_RDONLY, 0);
4805
if (fd < 0)
4806
{
4807
fprintf(stderr, "exim: failed to open %s: %s\n", expansion_test_message,
4808
strerror(errno));
4809
return EXIT_FAILURE;
4810
}
4811
(void) dup2(fd, 0);
4812
filter_test = FTEST_USER; /* Fudge to make it look like filter test */
4813
message_ended = END_NOTENDED;
4814
read_message_body(receive_msg(extract_recipients));
4815
message_linecount += body_linecount;
4816
(void)dup2(save_stdin, 0);
4817
(void)close(save_stdin);
4818
clearerr(stdin); /* Required by Darwin */
4819
}
4820
4821
/* Allow $recipients for this testing */
4822
4823
enable_dollar_recipients = TRUE;
4824
4825
/* Expand command line items */
4826
4827
if (recipients_arg < argc)
4828
{
4829
while (recipients_arg < argc)
4830
{
4831
uschar *s = argv[recipients_arg++];
4832
uschar *ss = expand_string(s);
4833
if (ss == NULL) printf ("Failed: %s\n", expand_string_message);
4834
else printf("%s\n", CS ss);
4835
}
4836
}
4837
4838
/* Read stdin */
4839
4840
else
4841
{
4842
char *(*fn_readline)(const char *) = NULL;
4843
void (*fn_addhist)(const char *) = NULL;
4844
4845
#ifdef USE_READLINE
4846
void *dlhandle = set_readline(&fn_readline, &fn_addhist);
4847
#endif
4848
4849
for (;;)
4850
{
4851
uschar *ss;
4852
uschar *source = get_stdinput(fn_readline, fn_addhist);
4853
if (source == NULL) break;
4854
ss = expand_string(source);
4855
if (ss == NULL)
4856
printf ("Failed: %s\n", expand_string_message);
4857
else printf("%s\n", CS ss);
4858
}
4859
4860
#ifdef USE_READLINE
4861
if (dlhandle != NULL) dlclose(dlhandle);
4862
#endif
4863
}
4864
4865
/* The data file will be open after -Mset */
4866
4867
if (deliver_datafile >= 0)
4868
{
4869
(void)close(deliver_datafile);
4870
deliver_datafile = -1;
4871
}
4872
4873
exim_exit(EXIT_SUCCESS);
4874
}
4875
4876
4877
/* The active host name is normally the primary host name, but it can be varied
4878
for hosts that want to play several parts at once. We need to ensure that it is
4879
set for host checking, and for receiving messages. */
4880
4881
smtp_active_hostname = primary_hostname;
4882
if (raw_active_hostname != NULL)
4883
{
4884
uschar *nah = expand_string(raw_active_hostname);
4885
if (nah == NULL)
4886
{
4887
if (!expand_string_forcedfail)
4888
log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to expand \"%s\" "
4889
"(smtp_active_hostname): %s", raw_active_hostname,
4890
expand_string_message);
4891
}
4892
else if (nah[0] != 0) smtp_active_hostname = nah;
4893
}
4894
4895
/* Handle host checking: this facility mocks up an incoming SMTP call from a
4896
given IP address so that the blocking and relay configuration can be tested.
4897
Unless a sender_ident was set by -oMt, we discard it (the default is the
4898
caller's login name). An RFC 1413 call is made only if we are running in the
4899
test harness and an incoming interface and both ports are specified, because
4900
there is no TCP/IP call to find the ident for. */
4901
4902
if (host_checking)
4903
{
4904
int x[4];
4905
int size;
4906
4907
if (!sender_ident_set)
4908
{
4909
sender_ident = NULL;
4910
if (running_in_test_harness && sender_host_port != 0 &&
4911
interface_address != NULL && interface_port != 0)
4912
verify_get_ident(1413);
4913
}
4914
4915
/* In case the given address is a non-canonical IPv6 address, canonicize
4916
it. The code works for both IPv4 and IPv6, as it happens. */
4917
4918
size = host_aton(sender_host_address, x);
4919
sender_host_address = store_get(48); /* large enough for full IPv6 */
4920
(void)host_nmtoa(size, x, -1, sender_host_address, ':');
4921
4922
/* Now set up for testing */
4923
4924
host_build_sender_fullhost();
4925
smtp_input = TRUE;
4926
smtp_in = stdin;
4927
smtp_out = stdout;
4928
sender_local = FALSE;
4929
sender_host_notsocket = TRUE;
4930
debug_file = stderr;
4931
debug_fd = fileno(debug_file);
4932
fprintf(stdout, "\n**** SMTP testing session as if from host %s\n"
4933
"**** but without any ident (RFC 1413) callback.\n"
4934
"**** This is not for real!\n\n",
4935
sender_host_address);
4936
4937
if (verify_check_host(&hosts_connection_nolog) == OK)
4938
log_write_selector &= ~L_smtp_connection;
4939
log_write(L_smtp_connection, LOG_MAIN, "%s", smtp_get_connection_info());
4940
4941
/* NOTE: We do *not* call smtp_log_no_mail() if smtp_start_session() fails,
4942
because a log line has already been written for all its failure exists
4943
(usually "connection refused: <reason>") and writing another one is
4944
unnecessary clutter. */
4945
4946
if (smtp_start_session())
4947
{
4948
reset_point = store_get(0);
4949
for (;;)
4950
{
4951
store_reset(reset_point);
4952
if (smtp_setup_msg() <= 0) break;
4953
if (!receive_msg(FALSE)) break;
4954
}
4955
smtp_log_no_mail();
4956
}
4957
exim_exit(EXIT_SUCCESS);
4958
}
4959
4960
4961
/* Arrange for message reception if recipients or SMTP were specified;
4962
otherwise complain unless a version print (-bV) happened or this is a filter
4963
verification test or info dump.
4964
In the former case, show the configuration file name. */
4965
4966
if (recipients_arg >= argc && !extract_recipients && !smtp_input)
4967
{
4968
if (version_printed)
4969
{
4970
printf("Configuration file is %s\n", config_main_filename);
4971
return EXIT_SUCCESS;
4972
}
4973
4974
if (info_flag != CMDINFO_NONE)
4975
{
4976
show_exim_information(info_flag, info_stdout ? stdout : stderr);
4977
return info_stdout ? EXIT_SUCCESS : EXIT_FAILURE;
4978
}
4979
4980
if (filter_test == FTEST_NONE)
4981
exim_usage(called_as);
4982
}
4983
4984
4985
/* If mua_wrapper is set, Exim is being used to turn an MUA that submits on the
4986
standard input into an MUA that submits to a smarthost over TCP/IP. We know
4987
that we are not called from inetd, because that is rejected above. The
4988
following configuration settings are forced here:
4989
4990
(1) Synchronous delivery (-odi)
4991
(2) Errors to stderr (-oep == -oeq)
4992
(3) No parallel remote delivery
4993
(4) Unprivileged delivery
4994
4995
We don't force overall queueing options because there are several of them;
4996
instead, queueing is avoided below when mua_wrapper is set. However, we do need
4997
to override any SMTP queueing. */
4998
4999
if (mua_wrapper)
5000
{
5001
synchronous_delivery = TRUE;
5002
arg_error_handling = ERRORS_STDERR;
5003
remote_max_parallel = 1;
5004
deliver_drop_privilege = TRUE;
5005
queue_smtp = FALSE;
5006
queue_smtp_domains = NULL;
5007
}
5008
5009
5010
/* Prepare to accept one or more new messages on the standard input. When a
5011
message has been read, its id is returned in message_id[]. If doing immediate
5012
delivery, we fork a delivery process for each received message, except for the
5013
last one, where we can save a process switch.
5014
5015
It is only in non-smtp mode that error_handling is allowed to be changed from
5016
its default of ERRORS_SENDER by argument. (Idle thought: are any of the
5017
sendmail error modes other than -oem ever actually used? Later: yes.) */
5018
5019
if (!smtp_input) error_handling = arg_error_handling;
5020
5021
/* If this is an inetd call, ensure that stderr is closed to prevent panic
5022
logging being sent down the socket and make an identd call to get the
5023
sender_ident. */
5024
5025
else if (is_inetd)
5026
{
5027
(void)fclose(stderr);
5028
exim_nullstd(); /* Re-open to /dev/null */
5029
verify_get_ident(IDENT_PORT);
5030
host_build_sender_fullhost();
5031
set_process_info("handling incoming connection from %s via inetd",
5032
sender_fullhost);
5033
}
5034
5035
/* If the sender host address has been set, build sender_fullhost if it hasn't
5036
already been done (which it will have been for inetd). This caters for the
5037
case when it is forced by -oMa. However, we must flag that it isn't a socket,
5038
so that the test for IP options is skipped for -bs input. */
5039
5040
if (sender_host_address != NULL && sender_fullhost == NULL)
5041
{
5042
host_build_sender_fullhost();
5043
set_process_info("handling incoming connection from %s via -oMa",
5044
sender_fullhost);
5045
sender_host_notsocket = TRUE;
5046
}
5047
5048
/* Otherwise, set the sender host as unknown except for inetd calls. This
5049
prevents host checking in the case of -bs not from inetd and also for -bS. */
5050
5051
else if (!is_inetd) sender_host_unknown = TRUE;
5052
5053
/* If stdout does not exist, then dup stdin to stdout. This can happen
5054
if exim is started from inetd. In this case fd 0 will be set to the socket,
5055
but fd 1 will not be set. This also happens for passed SMTP channels. */
5056
5057
if (fstat(1, &statbuf) < 0) (void)dup2(0, 1);
5058
5059
/* Set up the incoming protocol name and the state of the program. Root is
5060
allowed to force received protocol via the -oMr option above. If we have come
5061
via inetd, the process info has already been set up. We don't set
5062
received_protocol here for smtp input, as it varies according to
5063
batch/HELO/EHLO/AUTH/TLS. */
5064
5065
if (smtp_input)
5066
{
5067
if (!is_inetd) set_process_info("accepting a local %sSMTP message from <%s>",
5068
smtp_batched_input? "batched " : "",
5069
(sender_address!= NULL)? sender_address : originator_login);
5070
}
5071
else
5072
{
5073
if (received_protocol == NULL)
5074
received_protocol = string_sprintf("local%s", called_as);
5075
set_process_info("accepting a local non-SMTP message from <%s>",
5076
sender_address);
5077
}
5078
5079
/* Initialize the session_local_queue-only flag (this will be ignored if
5080
mua_wrapper is set) */
5081
5082
queue_check_only();
5083
session_local_queue_only = queue_only;
5084
5085
/* For non-SMTP and for batched SMTP input, check that there is enough space on
5086
the spool if so configured. On failure, we must not attempt to send an error
5087
message! (For interactive SMTP, the check happens at MAIL FROM and an SMTP
5088
error code is given.) */
5089
5090
if ((!smtp_input || smtp_batched_input) && !receive_check_fs(0))
5091
{
5092
fprintf(stderr, "exim: insufficient disk space\n");
5093
return EXIT_FAILURE;
5094
}
5095
5096
/* If this is smtp input of any kind, real or batched, handle the start of the
5097
SMTP session.
5098
5099
NOTE: We do *not* call smtp_log_no_mail() if smtp_start_session() fails,
5100
because a log line has already been written for all its failure exists
5101
(usually "connection refused: <reason>") and writing another one is
5102
unnecessary clutter. */
5103
5104
if (smtp_input)
5105
{
5106
smtp_in = stdin;
5107
smtp_out = stdout;
5108
if (verify_check_host(&hosts_connection_nolog) == OK)
5109
log_write_selector &= ~L_smtp_connection;
5110
log_write(L_smtp_connection, LOG_MAIN, "%s", smtp_get_connection_info());
5111
if (!smtp_start_session())
5112
{
5113
mac_smtp_fflush();
5114
exim_exit(EXIT_SUCCESS);
5115
}
5116
}
5117
5118
/* Otherwise, set up the input size limit here. */
5119
5120
else
5121
{
5122
thismessage_size_limit = expand_string_integer(message_size_limit, TRUE);
5123
if (expand_string_message != NULL)
5124
{
5125
if (thismessage_size_limit == -1)
5126
log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to expand "
5127
"message_size_limit: %s", expand_string_message);
5128
else
5129
log_write(0, LOG_MAIN|LOG_PANIC_DIE, "invalid value for "
5130
"message_size_limit: %s", expand_string_message);
5131
}
5132
}
5133
5134
/* Loop for several messages when reading SMTP input. If we fork any child
5135
processes, we don't want to wait for them unless synchronous delivery is
5136
requested, so set SIGCHLD to SIG_IGN in that case. This is not necessarily the
5137
same as SIG_DFL, despite the fact that documentation often lists the default as
5138
"ignore". This is a confusing area. This is what I know:
5139
5140
At least on some systems (e.g. Solaris), just setting SIG_IGN causes child
5141
processes that complete simply to go away without ever becoming defunct. You
5142
can't then wait for them - but we don't want to wait for them in the
5143
non-synchronous delivery case. However, this behaviour of SIG_IGN doesn't
5144
happen for all OS (e.g. *BSD is different).
5145
5146
But that's not the end of the story. Some (many? all?) systems have the
5147
SA_NOCLDWAIT option for sigaction(). This requests the behaviour that Solaris
5148
has by default, so it seems that the difference is merely one of default
5149
(compare restarting vs non-restarting signals).
5150
5151
To cover all cases, Exim sets SIG_IGN with SA_NOCLDWAIT here if it can. If not,
5152
it just sets SIG_IGN. To be on the safe side it also calls waitpid() at the end
5153
of the loop below. Paranoia rules.
5154
5155
February 2003: That's *still* not the end of the story. There are now versions
5156
of Linux (where SIG_IGN does work) that are picky. If, having set SIG_IGN, a
5157
process then calls waitpid(), a grumble is written to the system log, because
5158
this is logically inconsistent. In other words, it doesn't like the paranoia.
5159
As a consequenc of this, the waitpid() below is now excluded if we are sure
5160
that SIG_IGN works. */
5161
5162
if (!synchronous_delivery)
5163
{
5164
#ifdef SA_NOCLDWAIT
5165
struct sigaction act;
5166
act.sa_handler = SIG_IGN;
5167
sigemptyset(&(act.sa_mask));
5168
act.sa_flags = SA_NOCLDWAIT;
5169
sigaction(SIGCHLD, &act, NULL);
5170
#else
5171
signal(SIGCHLD, SIG_IGN);
5172
#endif
5173
}
5174
5175
/* Save the current store pool point, for resetting at the start of
5176
each message, and save the real sender address, if any. */
5177
5178
reset_point = store_get(0);
5179
real_sender_address = sender_address;
5180
5181
/* Loop to receive messages; receive_msg() returns TRUE if there are more
5182
messages to be read (SMTP input), or FALSE otherwise (not SMTP, or SMTP channel
5183
collapsed). */
5184
5185
while (more)
5186
{
5187
store_reset(reset_point);
5188
message_id[0] = 0;
5189
5190
/* Handle the SMTP case; call smtp_setup_mst() to deal with the initial SMTP
5191
input and build the recipients list, before calling receive_msg() to read the
5192
message proper. Whatever sender address is given in the SMTP transaction is
5193
often ignored for local senders - we use the actual sender, which is normally
5194
either the underlying user running this process or a -f argument provided by
5195
a trusted caller. It is saved in real_sender_address. The test for whether to
5196
accept the SMTP sender is encapsulated in receive_check_set_sender(). */
5197
5198
if (smtp_input)
5199
{
5200
int rc;
5201
if ((rc = smtp_setup_msg()) > 0)
5202
{
5203
if (real_sender_address != NULL &&
5204
!receive_check_set_sender(sender_address))
5205
{
5206
sender_address = raw_sender = real_sender_address;
5207
sender_address_unrewritten = NULL;
5208
}
5209
5210
/* For batched SMTP, we have to run the acl_not_smtp_start ACL, since it
5211
isn't really SMTP, so no other ACL will run until the acl_not_smtp one at
5212
the very end. The result of the ACL is ignored (as for other non-SMTP
5213
messages). It is run for its potential side effects. */
5214
5215
if (smtp_batched_input && acl_not_smtp_start != NULL)
5216
{
5217
uschar *user_msg, *log_msg;
5218
enable_dollar_recipients = TRUE;
5219
(void)acl_check(ACL_WHERE_NOTSMTP_START, NULL, acl_not_smtp_start,
5220
&user_msg, &log_msg);
5221
enable_dollar_recipients = FALSE;
5222
}
5223
5224
/* Now get the data for the message */
5225
5226
more = receive_msg(extract_recipients);
5227
if (message_id[0] == 0)
5228
{
5229
if (more) continue;
5230
smtp_log_no_mail(); /* Log no mail if configured */
5231
exim_exit(EXIT_FAILURE);
5232
}
5233
}
5234
else
5235
{
5236
smtp_log_no_mail(); /* Log no mail if configured */
5237
exim_exit((rc == 0)? EXIT_SUCCESS : EXIT_FAILURE);
5238
}
5239
}
5240
5241
/* In the non-SMTP case, we have all the information from the command
5242
line, but must process it in case it is in the more general RFC822
5243
format, and in any case, to detect syntax errors. Also, it appears that
5244
the use of comma-separated lists as single arguments is common, so we
5245
had better support them. */
5246
5247
else
5248
{
5249
int i;
5250
int rcount = 0;
5251
int count = argc - recipients_arg;
5252
uschar **list = argv + recipients_arg;
5253
5254
/* These options cannot be changed dynamically for non-SMTP messages */
5255
5256
active_local_sender_retain = local_sender_retain;
5257
active_local_from_check = local_from_check;
5258
5259
/* Save before any rewriting */
5260
5261
raw_sender = string_copy(sender_address);
5262
5263
/* Loop for each argument */
5264
5265
for (i = 0; i < count; i++)
5266
{
5267
int start, end, domain;
5268
uschar *errmess;
5269
uschar *s = list[i];
5270
5271
/* Loop for each comma-separated address */
5272
5273
while (*s != 0)
5274
{
5275
BOOL finished = FALSE;
5276
uschar *recipient;
5277
uschar *ss = parse_find_address_end(s, FALSE);
5278
5279
if (*ss == ',') *ss = 0; else finished = TRUE;
5280
5281
/* Check max recipients - if -t was used, these aren't recipients */
5282
5283
if (recipients_max > 0 && ++rcount > recipients_max &&
5284
!extract_recipients)
5285
{
5286
if (error_handling == ERRORS_STDERR)
5287
{
5288
fprintf(stderr, "exim: too many recipients\n");
5289
exim_exit(EXIT_FAILURE);
5290
}
5291
else
5292
{
5293
return
5294
moan_to_sender(ERRMESS_TOOMANYRECIP, NULL, NULL, stdin, TRUE)?
5295
errors_sender_rc : EXIT_FAILURE;
5296
}
5297
}
5298
5299
recipient =
5300
parse_extract_address(s, &errmess, &start, &end, &domain, FALSE);
5301
5302
if (domain == 0 && !allow_unqualified_recipient)
5303
{
5304
recipient = NULL;
5305
errmess = US"unqualified recipient address not allowed";
5306
}
5307
5308
if (recipient == NULL)
5309
{
5310
if (error_handling == ERRORS_STDERR)
5311
{
5312
fprintf(stderr, "exim: bad recipient address \"%s\": %s\n",
5313
string_printing(list[i]), errmess);
5314
exim_exit(EXIT_FAILURE);
5315
}
5316
else
5317
{
5318
error_block eblock;
5319
eblock.next = NULL;
5320
eblock.text1 = string_printing(list[i]);
5321
eblock.text2 = errmess;
5322
return
5323
moan_to_sender(ERRMESS_BADARGADDRESS, &eblock, NULL, stdin, TRUE)?
5324
errors_sender_rc : EXIT_FAILURE;
5325
}
5326
}
5327
5328
receive_add_recipient(recipient, -1);
5329
s = ss;
5330
if (!finished)
5331
while (*(++s) != 0 && (*s == ',' || isspace(*s)));
5332
}
5333
}
5334
5335
/* Show the recipients when debugging */
5336
5337
DEBUG(D_receive)
5338
{
5339
int i;
5340
if (sender_address != NULL) debug_printf("Sender: %s\n", sender_address);
5341
if (recipients_list != NULL)
5342
{
5343
debug_printf("Recipients:\n");
5344
for (i = 0; i < recipients_count; i++)
5345
debug_printf(" %s\n", recipients_list[i].address);
5346
}
5347
}
5348
5349
/* Run the acl_not_smtp_start ACL if required. The result of the ACL is
5350
ignored; rejecting here would just add complication, and it can just as
5351
well be done later. Allow $recipients to be visible in the ACL. */
5352
5353
if (acl_not_smtp_start != NULL)
5354
{
5355
uschar *user_msg, *log_msg;
5356
enable_dollar_recipients = TRUE;
5357
(void)acl_check(ACL_WHERE_NOTSMTP_START, NULL, acl_not_smtp_start,
5358
&user_msg, &log_msg);
5359
enable_dollar_recipients = FALSE;
5360
}
5361
5362
/* Read the data for the message. If filter_test is not FTEST_NONE, this
5363
will just read the headers for the message, and not write anything onto the
5364
spool. */
5365
5366
message_ended = END_NOTENDED;
5367
more = receive_msg(extract_recipients);
5368
5369
/* more is always FALSE here (not SMTP message) when reading a message
5370
for real; when reading the headers of a message for filter testing,
5371
it is TRUE if the headers were terminated by '.' and FALSE otherwise. */
5372
5373
if (message_id[0] == 0) exim_exit(EXIT_FAILURE);
5374
} /* Non-SMTP message reception */
5375
5376
/* If this is a filter testing run, there are headers in store, but
5377
no message on the spool. Run the filtering code in testing mode, setting
5378
the domain to the qualify domain and the local part to the current user,
5379
unless they have been set by options. The prefix and suffix are left unset
5380
unless specified. The the return path is set to to the sender unless it has
5381
already been set from a return-path header in the message. */
5382
5383
if (filter_test != FTEST_NONE)
5384
{
5385
deliver_domain = (ftest_domain != NULL)?
5386
ftest_domain : qualify_domain_recipient;
5387
deliver_domain_orig = deliver_domain;
5388
deliver_localpart = (ftest_localpart != NULL)?
5389
ftest_localpart : originator_login;
5390
deliver_localpart_orig = deliver_localpart;
5391
deliver_localpart_prefix = ftest_prefix;
5392
deliver_localpart_suffix = ftest_suffix;
5393
deliver_home = originator_home;
5394
5395
if (return_path == NULL)
5396
{
5397
printf("Return-path copied from sender\n");
5398
return_path = string_copy(sender_address);
5399
}
5400
else
5401
{
5402
printf("Return-path = %s\n", (return_path[0] == 0)? US"<>" : return_path);
5403
}
5404
printf("Sender = %s\n", (sender_address[0] == 0)? US"<>" : sender_address);
5405
5406
receive_add_recipient(
5407
string_sprintf("%s%s%s@%s",
5408
(ftest_prefix == NULL)? US"" : ftest_prefix,
5409
deliver_localpart,
5410
(ftest_suffix == NULL)? US"" : ftest_suffix,
5411
deliver_domain), -1);
5412
5413
printf("Recipient = %s\n", recipients_list[0].address);
5414
if (ftest_prefix != NULL) printf("Prefix = %s\n", ftest_prefix);
5415
if (ftest_suffix != NULL) printf("Suffix = %s\n", ftest_suffix);
5416
5417
if (chdir("/")) /* Get away from wherever the user is running this from */
5418
{
5419
DEBUG(D_receive) debug_printf("chdir(\"/\") failed\n");
5420
exim_exit(EXIT_FAILURE);
5421
}
5422
5423
/* Now we run either a system filter test, or a user filter test, or both.
5424
In the latter case, headers added by the system filter will persist and be
5425
available to the user filter. We need to copy the filter variables
5426
explicitly. */
5427
5428
if ((filter_test & FTEST_SYSTEM) != 0)
5429
{
5430
if (!filter_runtest(filter_sfd, filter_test_sfile, TRUE, more))
5431
exim_exit(EXIT_FAILURE);
5432
}
5433
5434
memcpy(filter_sn, filter_n, sizeof(filter_sn));
5435
5436
if ((filter_test & FTEST_USER) != 0)
5437
{
5438
if (!filter_runtest(filter_ufd, filter_test_ufile, FALSE, more))
5439
exim_exit(EXIT_FAILURE);
5440
}
5441
5442
exim_exit(EXIT_SUCCESS);
5443
}
5444
5445
/* Else act on the result of message reception. We should not get here unless
5446
message_id[0] is non-zero. If queue_only is set, session_local_queue_only
5447
will be TRUE. If it is not, check on the number of messages received in this
5448
connection. */
5449
5450
if (!session_local_queue_only &&
5451
smtp_accept_queue_per_connection > 0 &&
5452
receive_messagecount > smtp_accept_queue_per_connection)
5453
{
5454
session_local_queue_only = TRUE;
5455
queue_only_reason = 2;
5456
}
5457
5458
/* Initialize local_queue_only from session_local_queue_only. If it is false,
5459
and queue_only_load is set, check that the load average is below it. If it is
5460
not, set local_queue_only TRUE. If queue_only_load_latch is true (the
5461
default), we put the whole session into queue_only mode. It then remains this
5462
way for any subsequent messages on the same SMTP connection. This is a
5463
deliberate choice; even though the load average may fall, it doesn't seem
5464
right to deliver later messages on the same call when not delivering earlier
5465
ones. However, there are odd cases where this is not wanted, so this can be
5466
changed by setting queue_only_load_latch false. */
5467
5468
local_queue_only = session_local_queue_only;
5469
if (!local_queue_only && queue_only_load >= 0)
5470
{
5471
local_queue_only = (load_average = OS_GETLOADAVG()) > queue_only_load;
5472
if (local_queue_only)
5473
{
5474
queue_only_reason = 3;
5475
if (queue_only_load_latch) session_local_queue_only = TRUE;
5476
}
5477
}
5478
5479
/* If running as an MUA wrapper, all queueing options and freezing options
5480
are ignored. */
5481
5482
if (mua_wrapper)
5483
local_queue_only = queue_only_policy = deliver_freeze = FALSE;
5484
5485
/* Log the queueing here, when it will get a message id attached, but
5486
not if queue_only is set (case 0). Case 1 doesn't happen here (too many
5487
connections). */
5488
5489
if (local_queue_only) switch(queue_only_reason)
5490
{
5491
case 2:
5492
log_write(L_delay_delivery,
5493
LOG_MAIN, "no immediate delivery: more than %d messages "
5494
"received in one connection", smtp_accept_queue_per_connection);
5495
break;
5496
5497
case 3:
5498
log_write(L_delay_delivery,
5499
LOG_MAIN, "no immediate delivery: load average %.2f",
5500
(double)load_average/1000.0);
5501
break;
5502
}
5503
5504
/* Else do the delivery unless the ACL or local_scan() called for queue only
5505
or froze the message. Always deliver in a separate process. A fork failure is
5506
not a disaster, as the delivery will eventually happen on a subsequent queue
5507
run. The search cache must be tidied before the fork, as the parent will
5508
do it before exiting. The child will trigger a lookup failure and
5509
thereby defer the delivery if it tries to use (for example) a cached ldap
5510
connection that the parent has called unbind on. */
5511
5512
else if (!queue_only_policy && !deliver_freeze)
5513
{
5514
pid_t pid;
5515
search_tidyup();
5516
5517
if ((pid = fork()) == 0)
5518
{
5519
int rc;
5520
close_unwanted(); /* Close unwanted file descriptors and TLS */
5521
exim_nullstd(); /* Ensure std{in,out,err} exist */
5522
5523
/* Re-exec Exim if we need to regain privilege (note: in mua_wrapper
5524
mode, deliver_drop_privilege is forced TRUE). */
5525
5526
if (geteuid() != root_uid && !deliver_drop_privilege && !unprivileged)
5527
{
5528
(void)child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 2, US"-Mc",
5529
message_id);
5530
/* Control does not return here. */
5531
}
5532
5533
/* No need to re-exec */
5534
5535
rc = deliver_message(message_id, FALSE, FALSE);
5536
search_tidyup();
5537
_exit((!mua_wrapper || rc == DELIVER_MUA_SUCCEEDED)?
5538
EXIT_SUCCESS : EXIT_FAILURE);
5539
}
5540
5541
if (pid < 0)
5542
{
5543
log_write(0, LOG_MAIN|LOG_PANIC, "failed to fork automatic delivery "
5544
"process: %s", strerror(errno));
5545
}
5546
5547
/* In the parent, wait if synchronous delivery is required. This will
5548
always be the case in MUA wrapper mode. */
5549
5550
else if (synchronous_delivery)
5551
{
5552
int status;
5553
while (wait(&status) != pid);
5554
if ((status & 0x00ff) != 0)
5555
log_write(0, LOG_MAIN|LOG_PANIC,
5556
"process %d crashed with signal %d while delivering %s",
5557
(int)pid, status & 0x00ff, message_id);
5558
if (mua_wrapper && (status & 0xffff) != 0) exim_exit(EXIT_FAILURE);
5559
}
5560
}
5561
5562
/* The loop will repeat if more is TRUE. If we do not know know that the OS
5563
automatically reaps children (see comments above the loop), clear away any
5564
finished subprocesses here, in case there are lots of messages coming in
5565
from the same source. */
5566
5567
#ifndef SIG_IGN_WORKS
5568
while (waitpid(-1, NULL, WNOHANG) > 0);
5569
#endif
5570
}
5571
5572
exim_exit(EXIT_SUCCESS); /* Never returns */
5573
return 0; /* To stop compiler warning */
5574
}
5575
5576
/* End of exim.c */
Loggerhead is a web-based interface for Breezy
Version: 2.0.1