Bug 1454: Option -oMm for message reference
[exim.git] / src / src / exim.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8
9/* The main function: entry point, initialization, and high-level control.
10Also a few functions that don't naturally fit elsewhere. */
11
12
13#include "exim.h"
14
6545de78
PP
15extern void init_lookup_list(void);
16
059ec3d9
PH
17
18
19/*************************************************
20* Function interface to store functions *
21*************************************************/
22
23/* We need some real functions to pass to the PCRE regular expression library
24for store allocation via Exim's store manager. The normal calls are actually
25macros that pass over location information to make tracing easier. These
26functions just interface to the standard macro calls. A good compiler will
27optimize out the tail recursion and so not make them too expensive. There
28are two sets of functions; one for use when we want to retain the compiled
29regular expression for a long time; the other for short-term use. */
30
31static void *
32function_store_get(size_t size)
33{
34return store_get((int)size);
35}
36
37static void
38function_dummy_free(void *block) { block = block; }
39
40static void *
41function_store_malloc(size_t size)
42{
43return store_malloc((int)size);
44}
45
46static void
47function_store_free(void *block)
48{
49store_free(block);
50}
51
52
53
54
55/*************************************************
98a90c36
PP
56* Enums for cmdline interface *
57*************************************************/
58
59enum commandline_info { CMDINFO_NONE=0,
36a3ae5f 60 CMDINFO_HELP, CMDINFO_SIEVE, CMDINFO_DSCP };
98a90c36
PP
61
62
63
64
65/*************************************************
059ec3d9
PH
66* Compile regular expression and panic on fail *
67*************************************************/
68
69/* This function is called when failure to compile a regular expression leads
70to a panic exit. In other cases, pcre_compile() is called directly. In many
71cases where this function is used, the results of the compilation are to be
72placed in long-lived store, so we temporarily reset the store management
73functions that PCRE uses if the use_malloc flag is set.
74
75Argument:
76 pattern the pattern to compile
77 caseless TRUE if caseless matching is required
78 use_malloc TRUE if compile into malloc store
79
80Returns: pointer to the compiled pattern
81*/
82
83const pcre *
84regex_must_compile(uschar *pattern, BOOL caseless, BOOL use_malloc)
85{
86int offset;
87int options = PCRE_COPT;
88const pcre *yield;
89const uschar *error;
90if (use_malloc)
91 {
92 pcre_malloc = function_store_malloc;
93 pcre_free = function_store_free;
94 }
95if (caseless) options |= PCRE_CASELESS;
96yield = pcre_compile(CS pattern, options, (const char **)&error, &offset, NULL);
97pcre_malloc = function_store_get;
98pcre_free = function_dummy_free;
99if (yield == NULL)
100 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "regular expression error: "
101 "%s at offset %d while compiling %s", error, offset, pattern);
102return yield;
103}
104
105
106
107
108/*************************************************
109* Execute regular expression and set strings *
110*************************************************/
111
112/* This function runs a regular expression match, and sets up the pointers to
113the matched substrings.
114
115Arguments:
116 re the compiled expression
117 subject the subject string
118 options additional PCRE options
119 setup if < 0 do full setup
120 if >= 0 setup from setup+1 onwards,
121 excluding the full matched string
122
123Returns: TRUE or FALSE
124*/
125
126BOOL
127regex_match_and_setup(const pcre *re, uschar *subject, int options, int setup)
128{
129int ovector[3*(EXPAND_MAXN+1)];
130int n = pcre_exec(re, NULL, CS subject, Ustrlen(subject), 0,
131 PCRE_EOPT | options, ovector, sizeof(ovector)/sizeof(int));
132BOOL yield = n >= 0;
133if (n == 0) n = EXPAND_MAXN + 1;
134if (yield)
135 {
136 int nn;
137 expand_nmax = (setup < 0)? 0 : setup + 1;
138 for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
139 {
140 expand_nstring[expand_nmax] = subject + ovector[nn];
141 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
142 }
143 expand_nmax--;
144 }
145return yield;
146}
147
148
149
150
151/*************************************************
921b12ca
TF
152* Set up processing details *
153*************************************************/
154
155/* Save a text string for dumping when SIGUSR1 is received.
156Do checks for overruns.
157
158Arguments: format and arguments, as for printf()
159Returns: nothing
160*/
161
162void
163set_process_info(const char *format, ...)
164{
165int len;
166va_list ap;
167sprintf(CS process_info, "%5d ", (int)getpid());
168len = Ustrlen(process_info);
169va_start(ap, format);
170if (!string_vformat(process_info + len, PROCESS_INFO_SIZE - len - 2, format, ap))
171 Ustrcpy(process_info + len, "**** string overflowed buffer ****");
172len = Ustrlen(process_info);
173process_info[len+0] = '\n';
174process_info[len+1] = '\0';
175process_info_len = len + 1;
176DEBUG(D_process_info) debug_printf("set_process_info: %s", process_info);
177va_end(ap);
178}
179
180
181
182
183/*************************************************
059ec3d9
PH
184* Handler for SIGUSR1 *
185*************************************************/
186
187/* SIGUSR1 causes any exim process to write to the process log details of
188what it is currently doing. It will only be used if the OS is capable of
189setting up a handler that causes automatic restarting of any system call
190that is in progress at the time.
191
921b12ca
TF
192This function takes care to be signal-safe.
193
059ec3d9
PH
194Argument: the signal number (SIGUSR1)
195Returns: nothing
196*/
197
198static void
199usr1_handler(int sig)
200{
921b12ca
TF
201int fd;
202
203os_restarting_signal(sig, usr1_handler);
204
205fd = Uopen(process_log_path, O_APPEND|O_WRONLY, LOG_MODE);
206if (fd < 0)
207 {
208 /* If we are already running as the Exim user, try to create it in the
209 current process (assuming spool_directory exists). Otherwise, if we are
210 root, do the creation in an exim:exim subprocess. */
211
212 int euid = geteuid();
213 if (euid == exim_uid)
214 fd = Uopen(process_log_path, O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
215 else if (euid == root_uid)
216 fd = log_create_as_exim(process_log_path);
217 }
218
219/* If we are neither exim nor root, or if we failed to create the log file,
220give up. There is not much useful we can do with errors, since we don't want
221to disrupt whatever is going on outside the signal handler. */
222
223if (fd < 0) return;
224
1ac6b2e7 225{int dummy = write(fd, process_info, process_info_len); dummy = dummy; }
921b12ca 226(void)close(fd);
059ec3d9
PH
227}
228
229
230
231/*************************************************
232* Timeout handler *
233*************************************************/
234
235/* This handler is enabled most of the time that Exim is running. The handler
236doesn't actually get used unless alarm() has been called to set a timer, to
237place a time limit on a system call of some kind. When the handler is run, it
238re-enables itself.
239
240There are some other SIGALRM handlers that are used in special cases when more
241than just a flag setting is required; for example, when reading a message's
242input. These are normally set up in the code module that uses them, and the
243SIGALRM handler is reset to this one afterwards.
244
245Argument: the signal value (SIGALRM)
246Returns: nothing
247*/
248
249void
250sigalrm_handler(int sig)
251{
252sig = sig; /* Keep picky compilers happy */
253sigalrm_seen = TRUE;
254os_non_restarting_signal(SIGALRM, sigalrm_handler);
255}
256
257
258
259/*************************************************
260* Sleep for a fractional time interval *
261*************************************************/
262
263/* This function is called by millisleep() and exim_wait_tick() to wait for a
264period of time that may include a fraction of a second. The coding is somewhat
eb2c0248
PH
265tedious. We do not expect setitimer() ever to fail, but if it does, the process
266will wait for ever, so we panic in this instance. (There was a case of this
267when a bug in a function that calls milliwait() caused it to pass invalid data.
7086e875 268That's when I added the check. :-)
059ec3d9
PH
269
270Argument: an itimerval structure containing the interval
271Returns: nothing
272*/
273
274static void
275milliwait(struct itimerval *itval)
276{
277sigset_t sigmask;
278sigset_t old_sigmask;
279(void)sigemptyset(&sigmask); /* Empty mask */
280(void)sigaddset(&sigmask, SIGALRM); /* Add SIGALRM */
281(void)sigprocmask(SIG_BLOCK, &sigmask, &old_sigmask); /* Block SIGALRM */
7086e875 282if (setitimer(ITIMER_REAL, itval, NULL) < 0) /* Start timer */
eb2c0248
PH
283 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
284 "setitimer() failed: %s", strerror(errno));
059ec3d9
PH
285(void)sigfillset(&sigmask); /* All signals */
286(void)sigdelset(&sigmask, SIGALRM); /* Remove SIGALRM */
287(void)sigsuspend(&sigmask); /* Until SIGALRM */
288(void)sigprocmask(SIG_SETMASK, &old_sigmask, NULL); /* Restore mask */
289}
290
291
292
293
294/*************************************************
295* Millisecond sleep function *
296*************************************************/
297
298/* The basic sleep() function has a granularity of 1 second, which is too rough
299in some cases - for example, when using an increasing delay to slow down
300spammers.
301
302Argument: number of millseconds
303Returns: nothing
304*/
305
306void
307millisleep(int msec)
308{
309struct itimerval itval;
310itval.it_interval.tv_sec = 0;
311itval.it_interval.tv_usec = 0;
312itval.it_value.tv_sec = msec/1000;
313itval.it_value.tv_usec = (msec % 1000) * 1000;
314milliwait(&itval);
315}
316
317
318
319/*************************************************
320* Compare microsecond times *
321*************************************************/
322
323/*
324Arguments:
325 tv1 the first time
326 tv2 the second time
327
328Returns: -1, 0, or +1
329*/
330
331int
332exim_tvcmp(struct timeval *t1, struct timeval *t2)
333{
334if (t1->tv_sec > t2->tv_sec) return +1;
335if (t1->tv_sec < t2->tv_sec) return -1;
336if (t1->tv_usec > t2->tv_usec) return +1;
337if (t1->tv_usec < t2->tv_usec) return -1;
338return 0;
339}
340
341
342
343
344/*************************************************
345* Clock tick wait function *
346*************************************************/
347
348/* Exim uses a time + a pid to generate a unique identifier in two places: its
349message IDs, and in file names for maildir deliveries. Because some OS now
350re-use pids within the same second, sub-second times are now being used.
351However, for absolute certaintly, we must ensure the clock has ticked before
352allowing the relevant process to complete. At the time of implementation of
353this code (February 2003), the speed of processors is such that the clock will
354invariably have ticked already by the time a process has done its job. This
355function prepares for the time when things are faster - and it also copes with
356clocks that go backwards.
357
358Arguments:
359 then_tv A timeval which was used to create uniqueness; its usec field
360 has been rounded down to the value of the resolution.
361 We want to be sure the current time is greater than this.
362 resolution The resolution that was used to divide the microseconds
363 (1 for maildir, larger for message ids)
364
365Returns: nothing
366*/
367
368void
369exim_wait_tick(struct timeval *then_tv, int resolution)
370{
371struct timeval now_tv;
372long int now_true_usec;
373
374(void)gettimeofday(&now_tv, NULL);
375now_true_usec = now_tv.tv_usec;
376now_tv.tv_usec = (now_true_usec/resolution) * resolution;
377
378if (exim_tvcmp(&now_tv, then_tv) <= 0)
379 {
380 struct itimerval itval;
381 itval.it_interval.tv_sec = 0;
382 itval.it_interval.tv_usec = 0;
383 itval.it_value.tv_sec = then_tv->tv_sec - now_tv.tv_sec;
384 itval.it_value.tv_usec = then_tv->tv_usec + resolution - now_true_usec;
385
386 /* We know that, overall, "now" is less than or equal to "then". Therefore, a
387 negative value for the microseconds is possible only in the case when "now"
388 is more than a second less than "then". That means that itval.it_value.tv_sec
389 is greater than zero. The following correction is therefore safe. */
390
391 if (itval.it_value.tv_usec < 0)
392 {
393 itval.it_value.tv_usec += 1000000;
394 itval.it_value.tv_sec -= 1;
395 }
396
397 DEBUG(D_transport|D_receive)
398 {
399 if (!running_in_test_harness)
400 {
401 debug_printf("tick check: %lu.%06lu %lu.%06lu\n",
402 then_tv->tv_sec, then_tv->tv_usec, now_tv.tv_sec, now_tv.tv_usec);
403 debug_printf("waiting %lu.%06lu\n", itval.it_value.tv_sec,
404 itval.it_value.tv_usec);
405 }
406 }
407
408 milliwait(&itval);
409 }
410}
411
412
413
414
415/*************************************************
2632889e
PH
416* Call fopen() with umask 777 and adjust mode *
417*************************************************/
418
419/* Exim runs with umask(0) so that files created with open() have the mode that
420is specified in the open() call. However, there are some files, typically in
421the spool directory, that are created with fopen(). They end up world-writeable
422if no precautions are taken. Although the spool directory is not accessible to
423the world, this is an untidiness. So this is a wrapper function for fopen()
424that sorts out the mode of the created file.
425
426Arguments:
427 filename the file name
428 options the fopen() options
429 mode the required mode
430
431Returns: the fopened FILE or NULL
432*/
433
434FILE *
1ba28e2b 435modefopen(const uschar *filename, const char *options, mode_t mode)
2632889e 436{
67d175de
PH
437mode_t saved_umask = umask(0777);
438FILE *f = Ufopen(filename, options);
439(void)umask(saved_umask);
2632889e
PH
440if (f != NULL) (void)fchmod(fileno(f), mode);
441return f;
442}
443
444
445
446
447/*************************************************
059ec3d9
PH
448* Ensure stdin, stdout, and stderr exist *
449*************************************************/
450
451/* Some operating systems grumble if an exec() happens without a standard
452input, output, and error (fds 0, 1, 2) being defined. The worry is that some
453file will be opened and will use these fd values, and then some other bit of
454code will assume, for example, that it can write error messages to stderr.
455This function ensures that fds 0, 1, and 2 are open if they do not already
456exist, by connecting them to /dev/null.
457
458This function is also used to ensure that std{in,out,err} exist at all times,
459so that if any library that Exim calls tries to use them, it doesn't crash.
460
461Arguments: None
462Returns: Nothing
463*/
464
465void
466exim_nullstd(void)
467{
468int i;
469int devnull = -1;
470struct stat statbuf;
471for (i = 0; i <= 2; i++)
472 {
473 if (fstat(i, &statbuf) < 0 && errno == EBADF)
474 {
475 if (devnull < 0) devnull = open("/dev/null", O_RDWR);
476 if (devnull < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
477 string_open_failed(errno, "/dev/null"));
1fe64dcc 478 if (devnull != i) (void)dup2(devnull, i);
059ec3d9
PH
479 }
480 }
1fe64dcc 481if (devnull > 2) (void)close(devnull);
059ec3d9
PH
482}
483
484
485
486
487/*************************************************
488* Close unwanted file descriptors for delivery *
489*************************************************/
490
491/* This function is called from a new process that has been forked to deliver
492an incoming message, either directly, or using exec.
493
494We want any smtp input streams to be closed in this new process. However, it
495has been observed that using fclose() here causes trouble. When reading in -bS
496input, duplicate copies of messages have been seen. The files will be sharing a
497file pointer with the parent process, and it seems that fclose() (at least on
498some systems - I saw this on Solaris 2.5.1) messes with that file pointer, at
499least sometimes. Hence we go for closing the underlying file descriptors.
500
501If TLS is active, we want to shut down the TLS library, but without molesting
502the parent's SSL connection.
503
504For delivery of a non-SMTP message, we want to close stdin and stdout (and
505stderr unless debugging) because the calling process might have set them up as
506pipes and be waiting for them to close before it waits for the submission
507process to terminate. If they aren't closed, they hold up the calling process
508until the initial delivery process finishes, which is not what we want.
509
510Exception: We do want it for synchronous delivery!
511
512And notwithstanding all the above, if D_resolver is set, implying resolver
513debugging, leave stdout open, because that's where the resolver writes its
514debugging output.
515
516When we close stderr (which implies we've also closed stdout), we also get rid
517of any controlling terminal.
518
519Arguments: None
520Returns: Nothing
521*/
522
523static void
524close_unwanted(void)
525{
526if (smtp_input)
527 {
528 #ifdef SUPPORT_TLS
a400eccf 529 tls_close(TRUE, FALSE); /* Shut down the TLS library */
059ec3d9 530 #endif
1fe64dcc
PH
531 (void)close(fileno(smtp_in));
532 (void)close(fileno(smtp_out));
059ec3d9
PH
533 smtp_in = NULL;
534 }
535else
536 {
1fe64dcc
PH
537 (void)close(0); /* stdin */
538 if ((debug_selector & D_resolver) == 0) (void)close(1); /* stdout */
539 if (debug_selector == 0) /* stderr */
059ec3d9
PH
540 {
541 if (!synchronous_delivery)
542 {
1fe64dcc 543 (void)close(2);
059ec3d9
PH
544 log_stderr = NULL;
545 }
546 (void)setsid();
547 }
548 }
549}
550
551
552
553
554/*************************************************
555* Set uid and gid *
556*************************************************/
557
558/* This function sets a new uid and gid permanently, optionally calling
559initgroups() to set auxiliary groups. There are some special cases when running
560Exim in unprivileged modes. In these situations the effective uid will not be
561root; if we already have the right effective uid/gid, and don't need to
562initialize any groups, leave things as they are.
563
564Arguments:
565 uid the uid
566 gid the gid
567 igflag TRUE if initgroups() wanted
568 msg text to use in debugging output and failure log
569
570Returns: nothing; bombs out on failure
571*/
572
573void
574exim_setugid(uid_t uid, gid_t gid, BOOL igflag, uschar *msg)
575{
576uid_t euid = geteuid();
577gid_t egid = getegid();
578
579if (euid == root_uid || euid != uid || egid != gid || igflag)
580 {
581 /* At least one OS returns +1 for initgroups failure, so just check for
582 non-zero. */
583
584 if (igflag)
585 {
586 struct passwd *pw = getpwuid(uid);
587 if (pw != NULL)
588 {
589 if (initgroups(pw->pw_name, gid) != 0)
590 log_write(0,LOG_MAIN|LOG_PANIC_DIE,"initgroups failed for uid=%ld: %s",
591 (long int)uid, strerror(errno));
592 }
593 else log_write(0, LOG_MAIN|LOG_PANIC_DIE, "cannot run initgroups(): "
594 "no passwd entry for uid=%ld", (long int)uid);
595 }
596
597 if (setgid(gid) < 0 || setuid(uid) < 0)
598 {
599 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to set gid=%ld or uid=%ld "
600 "(euid=%ld): %s", (long int)gid, (long int)uid, (long int)euid, msg);
601 }
602 }
603
604/* Debugging output included uid/gid and all groups */
605
606DEBUG(D_uid)
607 {
cd59ab18 608 int group_count, save_errno;
059ec3d9
PH
609 gid_t group_list[NGROUPS_MAX];
610 debug_printf("changed uid/gid: %s\n uid=%ld gid=%ld pid=%ld\n", msg,
611 (long int)geteuid(), (long int)getegid(), (long int)getpid());
612 group_count = getgroups(NGROUPS_MAX, group_list);
cd59ab18 613 save_errno = errno;
059ec3d9
PH
614 debug_printf(" auxiliary group list:");
615 if (group_count > 0)
616 {
617 int i;
618 for (i = 0; i < group_count; i++) debug_printf(" %d", (int)group_list[i]);
619 }
cd59ab18
PP
620 else if (group_count < 0)
621 debug_printf(" <error: %s>", strerror(save_errno));
059ec3d9
PH
622 else debug_printf(" <none>");
623 debug_printf("\n");
624 }
625}
626
627
628
629
630/*************************************************
631* Exit point *
632*************************************************/
633
634/* Exim exits via this function so that it always clears up any open
635databases.
636
637Arguments:
638 rc return code
639
640Returns: does not return
641*/
642
643void
644exim_exit(int rc)
645{
646search_tidyup();
647DEBUG(D_any)
648 debug_printf(">>>>>>>>>>>>>>>> Exim pid=%d terminating with rc=%d "
649 ">>>>>>>>>>>>>>>>\n", (int)getpid(), rc);
650exit(rc);
651}
652
653
654
655
656/*************************************************
657* Extract port from host address *
658*************************************************/
659
660/* Called to extract the port from the values given to -oMa and -oMi.
b90c388a
PH
661It also checks the syntax of the address, and terminates it before the
662port data when a port is extracted.
059ec3d9
PH
663
664Argument:
665 address the address, with possible port on the end
666
667Returns: the port, or zero if there isn't one
668 bombs out on a syntax error
669*/
670
671static int
672check_port(uschar *address)
673{
7cd1141b 674int port = host_address_extract_port(address);
8e669ac1 675if (string_is_ip_address(address, NULL) == 0)
059ec3d9
PH
676 {
677 fprintf(stderr, "exim abandoned: \"%s\" is not an IP address\n", address);
678 exit(EXIT_FAILURE);
679 }
680return port;
681}
682
683
684
685/*************************************************
686* Test/verify an address *
687*************************************************/
688
689/* This function is called by the -bv and -bt code. It extracts a working
690address from a full RFC 822 address. This isn't really necessary per se, but it
691has the effect of collapsing source routes.
692
693Arguments:
694 s the address string
695 flags flag bits for verify_address()
696 exit_value to be set for failures
697
a5a28604 698Returns: nothing
059ec3d9
PH
699*/
700
701static void
702test_address(uschar *s, int flags, int *exit_value)
703{
704int start, end, domain;
705uschar *parse_error = NULL;
706uschar *address = parse_extract_address(s, &parse_error, &start, &end, &domain,
707 FALSE);
708if (address == NULL)
709 {
710 fprintf(stdout, "syntax error: %s\n", parse_error);
711 *exit_value = 2;
712 }
713else
714 {
715 int rc = verify_address(deliver_make_addr(address,TRUE), stdout, flags, -1,
4deaf07d 716 -1, -1, NULL, NULL, NULL);
059ec3d9
PH
717 if (rc == FAIL) *exit_value = 2;
718 else if (rc == DEFER && *exit_value == 0) *exit_value = 1;
719 }
720}
721
722
723
724/*************************************************
059ec3d9
PH
725* Show supported features *
726*************************************************/
727
4b2241d2
PP
728/* This function is called for -bV/--version and for -d to output the optional
729features of the current Exim binary.
059ec3d9
PH
730
731Arguments: a FILE for printing
732Returns: nothing
733*/
734
735static void
736show_whats_supported(FILE *f)
737{
44bbabb5
PP
738 auth_info *authi;
739
059ec3d9
PH
740#ifdef DB_VERSION_STRING
741fprintf(f, "Berkeley DB: %s\n", DB_VERSION_STRING);
742#elif defined(BTREEVERSION) && defined(HASHVERSION)
743 #ifdef USE_DB
744 fprintf(f, "Probably Berkeley DB version 1.8x (native mode)\n");
745 #else
746 fprintf(f, "Probably Berkeley DB version 1.8x (compatibility mode)\n");
747 #endif
748#elif defined(_DBM_RDONLY) || defined(dbm_dirfno)
749fprintf(f, "Probably ndbm\n");
750#elif defined(USE_TDB)
751fprintf(f, "Using tdb\n");
752#else
753 #ifdef USE_GDBM
754 fprintf(f, "Probably GDBM (native mode)\n");
755 #else
756 fprintf(f, "Probably GDBM (compatibility mode)\n");
757 #endif
758#endif
759
760fprintf(f, "Support for:");
9cec981f
PH
761#ifdef SUPPORT_CRYPTEQ
762 fprintf(f, " crypteq");
763#endif
059ec3d9
PH
764#if HAVE_ICONV
765 fprintf(f, " iconv()");
766#endif
767#if HAVE_IPV6
768 fprintf(f, " IPv6");
769#endif
79378e0f
PH
770#ifdef HAVE_SETCLASSRESOURCES
771 fprintf(f, " use_setclassresources");
929ba01c 772#endif
059ec3d9
PH
773#ifdef SUPPORT_PAM
774 fprintf(f, " PAM");
775#endif
776#ifdef EXIM_PERL
777 fprintf(f, " Perl");
778#endif
1a46a8c5
PH
779#ifdef EXPAND_DLFUNC
780 fprintf(f, " Expand_dlfunc");
781#endif
059ec3d9
PH
782#ifdef USE_TCP_WRAPPERS
783 fprintf(f, " TCPwrappers");
784#endif
785#ifdef SUPPORT_TLS
786 #ifdef USE_GNUTLS
787 fprintf(f, " GnuTLS");
788 #else
789 fprintf(f, " OpenSSL");
790 #endif
791#endif
b2f5a032
PH
792#ifdef SUPPORT_TRANSLATE_IP_ADDRESS
793 fprintf(f, " translate_ip_address");
794#endif
f174f16e
PH
795#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
796 fprintf(f, " move_frozen_messages");
797#endif
8523533c
TK
798#ifdef WITH_CONTENT_SCAN
799 fprintf(f, " Content_Scanning");
800#endif
80a47a2c
TK
801#ifndef DISABLE_DKIM
802 fprintf(f, " DKIM");
803#endif
8523533c
TK
804#ifdef WITH_OLD_DEMIME
805 fprintf(f, " Old_Demime");
806#endif
807#ifdef EXPERIMENTAL_SPF
808 fprintf(f, " Experimental_SPF");
809#endif
810#ifdef EXPERIMENTAL_SRS
811 fprintf(f, " Experimental_SRS");
812#endif
813#ifdef EXPERIMENTAL_BRIGHTMAIL
814 fprintf(f, " Experimental_Brightmail");
815#endif
6a8f9482
TK
816#ifdef EXPERIMENTAL_DCC
817 fprintf(f, " Experimental_DCC");
818#endif
4840604e
TL
819#ifdef EXPERIMENTAL_DMARC
820 fprintf(f, " Experimental_DMARC");
821#endif
ccf08019
JH
822#ifdef EXPERIMENTAL_OCSP
823 fprintf(f, " Experimental_OCSP");
824#endif
fd98a5c6
JH
825#ifdef EXPERIMENTAL_PRDR
826 fprintf(f, " Experimental_PRDR");
827#endif
930407fb
TL
828#ifdef EXPERIMENTAL_PROXY
829 fprintf(f, " Experimental_Proxy");
830#endif
d68218c7
JH
831#ifdef EXPERIMENTAL_TPDA
832 fprintf(f, " Experimental_TPDA");
833#endif
9bdd29ad
TL
834#ifdef EXPERIMENTAL_REDIS
835 fprintf(f, " Experimental_Redis");
836#endif
059ec3d9
PH
837fprintf(f, "\n");
838
e6d225ae
DW
839fprintf(f, "Lookups (built-in):");
840#if defined(LOOKUP_LSEARCH) && LOOKUP_LSEARCH!=2
059ec3d9
PH
841 fprintf(f, " lsearch wildlsearch nwildlsearch iplsearch");
842#endif
e6d225ae 843#if defined(LOOKUP_CDB) && LOOKUP_CDB!=2
059ec3d9
PH
844 fprintf(f, " cdb");
845#endif
e6d225ae 846#if defined(LOOKUP_DBM) && LOOKUP_DBM!=2
4a6a987a 847 fprintf(f, " dbm dbmjz dbmnz");
059ec3d9 848#endif
e6d225ae 849#if defined(LOOKUP_DNSDB) && LOOKUP_DNSDB!=2
059ec3d9
PH
850 fprintf(f, " dnsdb");
851#endif
e6d225ae 852#if defined(LOOKUP_DSEARCH) && LOOKUP_DSEARCH!=2
059ec3d9
PH
853 fprintf(f, " dsearch");
854#endif
e6d225ae 855#if defined(LOOKUP_IBASE) && LOOKUP_IBASE!=2
059ec3d9
PH
856 fprintf(f, " ibase");
857#endif
e6d225ae 858#if defined(LOOKUP_LDAP) && LOOKUP_LDAP!=2
059ec3d9
PH
859 fprintf(f, " ldap ldapdn ldapm");
860#endif
e6d225ae 861#if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
059ec3d9
PH
862 fprintf(f, " mysql");
863#endif
e6d225ae 864#if defined(LOOKUP_NIS) && LOOKUP_NIS!=2
059ec3d9
PH
865 fprintf(f, " nis nis0");
866#endif
e6d225ae 867#if defined(LOOKUP_NISPLUS) && LOOKUP_NISPLUS!=2
059ec3d9
PH
868 fprintf(f, " nisplus");
869#endif
e6d225ae 870#if defined(LOOKUP_ORACLE) && LOOKUP_ORACLE!=2
059ec3d9
PH
871 fprintf(f, " oracle");
872#endif
e6d225ae 873#if defined(LOOKUP_PASSWD) && LOOKUP_PASSWD!=2
059ec3d9
PH
874 fprintf(f, " passwd");
875#endif
e6d225ae 876#if defined(LOOKUP_PGSQL) && LOOKUP_PGSQL!=2
059ec3d9
PH
877 fprintf(f, " pgsql");
878#endif
e6d225ae 879#if defined(LOOKUP_SQLITE) && LOOKUP_SQLITE!=2
13b685f9
PH
880 fprintf(f, " sqlite");
881#endif
e6d225ae 882#if defined(LOOKUP_TESTDB) && LOOKUP_TESTDB!=2
059ec3d9
PH
883 fprintf(f, " testdb");
884#endif
e6d225ae 885#if defined(LOOKUP_WHOSON) && LOOKUP_WHOSON!=2
059ec3d9
PH
886 fprintf(f, " whoson");
887#endif
888fprintf(f, "\n");
889
890fprintf(f, "Authenticators:");
891#ifdef AUTH_CRAM_MD5
892 fprintf(f, " cram_md5");
893#endif
894#ifdef AUTH_CYRUS_SASL
895 fprintf(f, " cyrus_sasl");
896#endif
14aa5a05
PH
897#ifdef AUTH_DOVECOT
898 fprintf(f, " dovecot");
899#endif
44bbabb5
PP
900#ifdef AUTH_GSASL
901 fprintf(f, " gsasl");
902#endif
dde3daac
PP
903#ifdef AUTH_HEIMDAL_GSSAPI
904 fprintf(f, " heimdal_gssapi");
905#endif
059ec3d9
PH
906#ifdef AUTH_PLAINTEXT
907 fprintf(f, " plaintext");
908#endif
909#ifdef AUTH_SPA
910 fprintf(f, " spa");
911#endif
912fprintf(f, "\n");
913
914fprintf(f, "Routers:");
915#ifdef ROUTER_ACCEPT
916 fprintf(f, " accept");
917#endif
918#ifdef ROUTER_DNSLOOKUP
919 fprintf(f, " dnslookup");
920#endif
921#ifdef ROUTER_IPLITERAL
922 fprintf(f, " ipliteral");
923#endif
924#ifdef ROUTER_IPLOOKUP
925 fprintf(f, " iplookup");
926#endif
927#ifdef ROUTER_MANUALROUTE
928 fprintf(f, " manualroute");
929#endif
930#ifdef ROUTER_QUERYPROGRAM
931 fprintf(f, " queryprogram");
932#endif
933#ifdef ROUTER_REDIRECT
934 fprintf(f, " redirect");
935#endif
936fprintf(f, "\n");
937
938fprintf(f, "Transports:");
939#ifdef TRANSPORT_APPENDFILE
940 fprintf(f, " appendfile");
941 #ifdef SUPPORT_MAILDIR
942 fprintf(f, "/maildir");
943 #endif
944 #ifdef SUPPORT_MAILSTORE
945 fprintf(f, "/mailstore");
946 #endif
947 #ifdef SUPPORT_MBX
948 fprintf(f, "/mbx");
949 #endif
950#endif
951#ifdef TRANSPORT_AUTOREPLY
952 fprintf(f, " autoreply");
953#endif
954#ifdef TRANSPORT_LMTP
955 fprintf(f, " lmtp");
956#endif
957#ifdef TRANSPORT_PIPE
958 fprintf(f, " pipe");
959#endif
960#ifdef TRANSPORT_SMTP
961 fprintf(f, " smtp");
962#endif
963fprintf(f, "\n");
964
965if (fixed_never_users[0] > 0)
966 {
967 int i;
968 fprintf(f, "Fixed never_users: ");
969 for (i = 1; i <= (int)fixed_never_users[0] - 1; i++)
970 fprintf(f, "%d:", (unsigned int)fixed_never_users[i]);
971 fprintf(f, "%d\n", (unsigned int)fixed_never_users[i]);
972 }
21c28500 973
73a46702 974fprintf(f, "Size of off_t: " SIZE_T_FMT "\n", sizeof(off_t));
36f12725 975
6545de78
PP
976/* Everything else is details which are only worth reporting when debugging.
977Perhaps the tls_version_report should move into this too. */
978DEBUG(D_any) do {
979
980 int i;
981
b3c261f7
PP
982/* clang defines __GNUC__ (at least, for me) so test for it first */
983#if defined(__clang__)
984 fprintf(f, "Compiler: CLang [%s]\n", __clang_version__);
985#elif defined(__GNUC__)
986 fprintf(f, "Compiler: GCC [%s]\n",
987# ifdef __VERSION__
988 __VERSION__
989# else
990 "? unknown version ?"
991# endif
992 );
993#else
994 fprintf(f, "Compiler: <unknown>\n");
995#endif
996
754a0503
PP
997#ifdef SUPPORT_TLS
998 tls_version_report(f);
999#endif
1000
44bbabb5
PP
1001 for (authi = auths_available; *authi->driver_name != '\0'; ++authi) {
1002 if (authi->version_report) {
1003 (*authi->version_report)(f);
1004 }
1005 }
6545de78 1006
decd95cb 1007 /* PCRE_PRERELEASE is either defined and empty or a bare sequence of
6475bd82
PP
1008 characters; unless it's an ancient version of PCRE in which case it
1009 is not defined. */
1010#ifndef PCRE_PRERELEASE
1011#define PCRE_PRERELEASE
1012#endif
1013#define QUOTE(X) #X
1014#define EXPAND_AND_QUOTE(X) QUOTE(X)
6545de78
PP
1015 fprintf(f, "Library version: PCRE: Compile: %d.%d%s\n"
1016 " Runtime: %s\n",
1017 PCRE_MAJOR, PCRE_MINOR,
6475bd82 1018 EXPAND_AND_QUOTE(PCRE_PRERELEASE) "",
6545de78 1019 pcre_version());
6475bd82
PP
1020#undef QUOTE
1021#undef EXPAND_AND_QUOTE
6545de78
PP
1022
1023 init_lookup_list();
1024 for (i = 0; i < lookup_list_count; i++)
1025 {
1026 if (lookup_list[i]->version_report)
1027 lookup_list[i]->version_report(f);
1028 }
1029
b70d2586
PP
1030#ifdef WHITELIST_D_MACROS
1031 fprintf(f, "WHITELIST_D_MACROS: \"%s\"\n", WHITELIST_D_MACROS);
1032#else
1033 fprintf(f, "WHITELIST_D_MACROS unset\n");
1034#endif
1035#ifdef TRUSTED_CONFIG_LIST
1036 fprintf(f, "TRUSTED_CONFIG_LIST: \"%s\"\n", TRUSTED_CONFIG_LIST);
1037#else
1038 fprintf(f, "TRUSTED_CONFIG_LIST unset\n");
1039#endif
1040
6545de78 1041} while (0);
059ec3d9
PH
1042}
1043
1044
98a90c36
PP
1045/*************************************************
1046* Show auxiliary information about Exim *
1047*************************************************/
1048
1049static void
1050show_exim_information(enum commandline_info request, FILE *stream)
1051{
1052const uschar **pp;
1053
1054switch(request)
1055 {
1056 case CMDINFO_NONE:
1057 fprintf(stream, "Oops, something went wrong.\n");
1058 return;
1059 case CMDINFO_HELP:
1060 fprintf(stream,
1061"The -bI: flag takes a string indicating which information to provide.\n"
1062"If the string is not recognised, you'll get this help (on stderr).\n"
1063"\n"
1064" exim -bI:help this information\n"
36a3ae5f 1065" exim -bI:dscp dscp value keywords known\n"
98a90c36
PP
1066" exim -bI:sieve list of supported sieve extensions, one per line.\n"
1067);
1068 return;
1069 case CMDINFO_SIEVE:
1070 for (pp = exim_sieve_extension_list; *pp; ++pp)
1071 fprintf(stream, "%s\n", *pp);
1072 return;
36a3ae5f
PP
1073 case CMDINFO_DSCP:
1074 dscp_list_to_stream(stream);
1075 return;
98a90c36
PP
1076 }
1077}
059ec3d9
PH
1078
1079
1080/*************************************************
1081* Quote a local part *
1082*************************************************/
1083
1084/* This function is used when a sender address or a From: or Sender: header
1085line is being created from the caller's login, or from an authenticated_id. It
1086applies appropriate quoting rules for a local part.
1087
1088Argument: the local part
1089Returns: the local part, quoted if necessary
1090*/
1091
1092uschar *
1093local_part_quote(uschar *lpart)
1094{
1095BOOL needs_quote = FALSE;
1096int size, ptr;
1097uschar *yield;
1098uschar *t;
1099
1100for (t = lpart; !needs_quote && *t != 0; t++)
1101 {
1102 needs_quote = !isalnum(*t) && strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
1103 (*t != '.' || t == lpart || t[1] == 0);
1104 }
1105
1106if (!needs_quote) return lpart;
1107
1108size = ptr = 0;
1109yield = string_cat(NULL, &size, &ptr, US"\"", 1);
1110
1111for (;;)
1112 {
1113 uschar *nq = US Ustrpbrk(lpart, "\\\"");
1114 if (nq == NULL)
1115 {
1116 yield = string_cat(yield, &size, &ptr, lpart, Ustrlen(lpart));
1117 break;
1118 }
1119 yield = string_cat(yield, &size, &ptr, lpart, nq - lpart);
1120 yield = string_cat(yield, &size, &ptr, US"\\", 1);
1121 yield = string_cat(yield, &size, &ptr, nq, 1);
1122 lpart = nq + 1;
1123 }
1124
1125yield = string_cat(yield, &size, &ptr, US"\"", 1);
1126yield[ptr] = 0;
1127return yield;
1128}
1129
1130
1131
1132#ifdef USE_READLINE
1133/*************************************************
1134* Load readline() functions *
1135*************************************************/
1136
1137/* This function is called from testing executions that read data from stdin,
1138but only when running as the calling user. Currently, only -be does this. The
1139function loads the readline() function library and passes back the functions.
1140On some systems, it needs the curses library, so load that too, but try without
1141it if loading fails. All this functionality has to be requested at build time.
1142
1143Arguments:
1144 fn_readline_ptr pointer to where to put the readline pointer
1145 fn_addhist_ptr pointer to where to put the addhistory function
1146
1147Returns: the dlopen handle or NULL on failure
1148*/
1149
1150static void *
1ba28e2b
PP
1151set_readline(char * (**fn_readline_ptr)(const char *),
1152 void (**fn_addhist_ptr)(const char *))
059ec3d9
PH
1153{
1154void *dlhandle;
e12f8c32 1155void *dlhandle_curses = dlopen("libcurses." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_LAZY);
059ec3d9 1156
e12f8c32 1157dlhandle = dlopen("libreadline." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_NOW);
059ec3d9
PH
1158if (dlhandle_curses != NULL) dlclose(dlhandle_curses);
1159
1160if (dlhandle != NULL)
1161 {
1ba28e2b
PP
1162 /* Checked manual pages; at least in GNU Readline 6.1, the prototypes are:
1163 * char * readline (const char *prompt);
1164 * void add_history (const char *string);
1165 */
1166 *fn_readline_ptr = (char *(*)(const char*))dlsym(dlhandle, "readline");
1167 *fn_addhist_ptr = (void(*)(const char*))dlsym(dlhandle, "add_history");
059ec3d9
PH
1168 }
1169else
1170 {
1171 DEBUG(D_any) debug_printf("failed to load readline: %s\n", dlerror());
1172 }
1173
1174return dlhandle;
1175}
1176#endif
1177
1178
1179
1180/*************************************************
1181* Get a line from stdin for testing things *
1182*************************************************/
1183
1184/* This function is called when running tests that can take a number of lines
1185of input (for example, -be and -bt). It handles continuations and trailing
1186spaces. And prompting and a blank line output on eof. If readline() is in use,
1187the arguments are non-NULL and provide the relevant functions.
1188
1189Arguments:
1190 fn_readline readline function or NULL
1191 fn_addhist addhist function or NULL
1192
1193Returns: pointer to dynamic memory, or NULL at end of file
1194*/
1195
1196static uschar *
1ba28e2b 1197get_stdinput(char *(*fn_readline)(const char *), void(*fn_addhist)(const char *))
059ec3d9
PH
1198{
1199int i;
1200int size = 0;
1201int ptr = 0;
1202uschar *yield = NULL;
1203
328895cc 1204if (fn_readline == NULL) { printf("> "); fflush(stdout); }
059ec3d9
PH
1205
1206for (i = 0;; i++)
1207 {
1208 uschar buffer[1024];
1209 uschar *p, *ss;
1210
1211 #ifdef USE_READLINE
1212 char *readline_line = NULL;
1213 if (fn_readline != NULL)
1214 {
1215 if ((readline_line = fn_readline((i > 0)? "":"> ")) == NULL) break;
1216 if (*readline_line != 0 && fn_addhist != NULL) fn_addhist(readline_line);
1217 p = US readline_line;
1218 }
1219 else
1220 #endif
1221
1222 /* readline() not in use */
1223
1224 {
1225 if (Ufgets(buffer, sizeof(buffer), stdin) == NULL) break;
1226 p = buffer;
1227 }
1228
1229 /* Handle the line */
1230
1231 ss = p + (int)Ustrlen(p);
1232 while (ss > p && isspace(ss[-1])) ss--;
1233
1234 if (i > 0)
1235 {
1236 while (p < ss && isspace(*p)) p++; /* leading space after cont */
1237 }
1238
1239 yield = string_cat(yield, &size, &ptr, p, ss - p);
1240
1241 #ifdef USE_READLINE
1242 if (fn_readline != NULL) free(readline_line);
1243 #endif
1244
1245 if (ss == p || yield[ptr-1] != '\\')
1246 {
1247 yield[ptr] = 0;
1248 break;
1249 }
1250 yield[--ptr] = 0;
1251 }
1252
1253if (yield == NULL) printf("\n");
1254return yield;
1255}
1256
1257
1258
1259/*************************************************
81ea09ca
NM
1260* Output usage information for the program *
1261*************************************************/
1262
1263/* This function is called when there are no recipients
1264 or a specific --help argument was added.
1265
1266Arguments:
1267 progname information on what name we were called by
1268
1269Returns: DOES NOT RETURN
1270*/
1271
1272static void
1273exim_usage(uschar *progname)
1274{
1275
1276/* Handle specific program invocation varients */
1277if (Ustrcmp(progname, US"-mailq") == 0)
1278 {
1279 fprintf(stderr,
e765a0f1 1280 "mailq - list the contents of the mail queue\n\n"
81ea09ca
NM
1281 "For a list of options, see the Exim documentation.\n");
1282 exit(EXIT_FAILURE);
1283 }
1284
1285/* Generic usage - we output this whatever happens */
1286fprintf(stderr,
1287 "Exim is a Mail Transfer Agent. It is normally called by Mail User Agents,\n"
1288 "not directly from a shell command line. Options and/or arguments control\n"
1289 "what it does when called. For a list of options, see the Exim documentation.\n");
1290
1291exit(EXIT_FAILURE);
1292}
1293
1294
1295
1296/*************************************************
a7cbbf50
PP
1297* Validate that the macros given are okay *
1298*************************************************/
1299
1300/* Typically, Exim will drop privileges if macros are supplied. In some
1301cases, we want to not do so.
1302
1303Arguments: none (macros is a global)
1304Returns: true if trusted, false otherwise
1305*/
1306
1307static BOOL
1308macros_trusted(void)
1309{
1310#ifdef WHITELIST_D_MACROS
1311macro_item *m;
1312uschar *whitelisted, *end, *p, **whites, **w;
1313int white_count, i, n;
1314size_t len;
1315BOOL prev_char_item, found;
1316#endif
1317
1318if (macros == NULL)
1319 return TRUE;
1320#ifndef WHITELIST_D_MACROS
1321return FALSE;
1322#else
1323
66581d1e
PP
1324/* We only trust -D overrides for some invoking users:
1325root, the exim run-time user, the optional config owner user.
1326I don't know why config-owner would be needed, but since they can own the
1327config files anyway, there's no security risk to letting them override -D. */
1328if ( ! ((real_uid == root_uid)
1329 || (real_uid == exim_uid)
1330#ifdef CONFIGURE_OWNER
1331 || (real_uid == config_uid)
1332#endif
1333 ))
1334 {
1335 debug_printf("macros_trusted rejecting macros for uid %d\n", (int) real_uid);
1336 return FALSE;
1337 }
1338
a7cbbf50
PP
1339/* Get a list of macros which are whitelisted */
1340whitelisted = string_copy_malloc(US WHITELIST_D_MACROS);
1341prev_char_item = FALSE;
1342white_count = 0;
1343for (p = whitelisted; *p != '\0'; ++p)
1344 {
1345 if (*p == ':' || isspace(*p))
1346 {
1347 *p = '\0';
1348 if (prev_char_item)
1349 ++white_count;
1350 prev_char_item = FALSE;
1351 continue;
1352 }
1353 if (!prev_char_item)
1354 prev_char_item = TRUE;
1355 }
1356end = p;
1357if (prev_char_item)
1358 ++white_count;
1359if (!white_count)
1360 return FALSE;
1361whites = store_malloc(sizeof(uschar *) * (white_count+1));
1362for (p = whitelisted, i = 0; (p != end) && (i < white_count); ++p)
1363 {
1364 if (*p != '\0')
1365 {
1366 whites[i++] = p;
1367 if (i == white_count)
1368 break;
1369 while (*p != '\0' && p < end)
1370 ++p;
1371 }
1372 }
1373whites[i] = NULL;
1374
1375/* The list of macros should be very short. Accept the N*M complexity. */
1376for (m = macros; m != NULL; m = m->next)
1377 {
1378 found = FALSE;
1379 for (w = whites; *w; ++w)
1380 if (Ustrcmp(*w, m->name) == 0)
1381 {
1382 found = TRUE;
1383 break;
1384 }
1385 if (!found)
1386 return FALSE;
1387 if (m->replacement == NULL)
1388 continue;
1389 len = Ustrlen(m->replacement);
1390 if (len == 0)
1391 continue;
1392 n = pcre_exec(regex_whitelisted_macro, NULL, CS m->replacement, len,
1393 0, PCRE_EOPT, NULL, 0);
1394 if (n < 0)
1395 {
1396 if (n != PCRE_ERROR_NOMATCH)
1397 debug_printf("macros_trusted checking %s returned %d\n", m->name, n);
1398 return FALSE;
1399 }
1400 }
43236f35 1401DEBUG(D_any) debug_printf("macros_trusted overridden to true by whitelisting\n");
a7cbbf50
PP
1402return TRUE;
1403#endif
1404}
1405
1406
1407/*************************************************
059ec3d9
PH
1408* Entry point and high-level code *
1409*************************************************/
1410
1411/* Entry point for the Exim mailer. Analyse the arguments and arrange to take
1412the appropriate action. All the necessary functions are present in the one
1413binary. I originally thought one should split it up, but it turns out that so
1414much of the apparatus is needed in each chunk that one might as well just have
1415it all available all the time, which then makes the coding easier as well.
1416
1417Arguments:
1418 argc count of entries in argv
1419 argv argument strings, with argv[0] being the program name
1420
1421Returns: EXIT_SUCCESS if terminated successfully
1422 EXIT_FAILURE otherwise, except when a message has been sent
1423 to the sender, and -oee was given
1424*/
1425
1426int
1427main(int argc, char **cargv)
1428{
1429uschar **argv = USS cargv;
1430int arg_receive_timeout = -1;
1431int arg_smtp_receive_timeout = -1;
1432int arg_error_handling = error_handling;
f05da2e8
PH
1433int filter_sfd = -1;
1434int filter_ufd = -1;
059ec3d9 1435int group_count;
1670ef10 1436int i, rv;
059ec3d9
PH
1437int list_queue_option = 0;
1438int msg_action = 0;
1439int msg_action_arg = -1;
1440int namelen = (argv[0] == NULL)? 0 : Ustrlen(argv[0]);
1441int queue_only_reason = 0;
1442#ifdef EXIM_PERL
1443int perl_start_option = 0;
1444#endif
1445int recipients_arg = argc;
1446int sender_address_domain = 0;
1447int test_retry_arg = -1;
1448int test_rewrite_arg = -1;
1449BOOL arg_queue_only = FALSE;
1450BOOL bi_option = FALSE;
1451BOOL checking = FALSE;
1452BOOL count_queue = FALSE;
1453BOOL expansion_test = FALSE;
1454BOOL extract_recipients = FALSE;
f4ee74ac 1455BOOL flag_G = FALSE;
12f69989 1456BOOL flag_n = FALSE;
059ec3d9
PH
1457BOOL forced_delivery = FALSE;
1458BOOL f_end_dot = FALSE;
1459BOOL deliver_give_up = FALSE;
1460BOOL list_queue = FALSE;
1461BOOL list_options = FALSE;
1462BOOL local_queue_only;
1463BOOL more = TRUE;
1464BOOL one_msg_action = FALSE;
1465BOOL queue_only_set = FALSE;
1466BOOL receiving_message = TRUE;
33d73e3b 1467BOOL sender_ident_set = FALSE;
8669f003 1468BOOL session_local_queue_only;
059ec3d9
PH
1469BOOL unprivileged;
1470BOOL removed_privilege = FALSE;
81ea09ca 1471BOOL usage_wanted = FALSE;
059ec3d9
PH
1472BOOL verify_address_mode = FALSE;
1473BOOL verify_as_sender = FALSE;
1474BOOL version_printed = FALSE;
1475uschar *alias_arg = NULL;
1476uschar *called_as = US"";
a3fb9793 1477uschar *cmdline_syslog_name = NULL;
059ec3d9
PH
1478uschar *start_queue_run_id = NULL;
1479uschar *stop_queue_run_id = NULL;
328895cc 1480uschar *expansion_test_message = NULL;
059ec3d9
PH
1481uschar *ftest_domain = NULL;
1482uschar *ftest_localpart = NULL;
1483uschar *ftest_prefix = NULL;
1484uschar *ftest_suffix = NULL;
8544e77a 1485uschar *malware_test_file = NULL;
059ec3d9
PH
1486uschar *real_sender_address;
1487uschar *originator_home = US"/";
a3fb9793 1488size_t sz;
059ec3d9
PH
1489void *reset_point;
1490
1491struct passwd *pw;
1492struct stat statbuf;
1493pid_t passed_qr_pid = (pid_t)0;
1494int passed_qr_pipe = -1;
1495gid_t group_list[NGROUPS_MAX];
1496
98a90c36
PP
1497/* For the -bI: flag */
1498enum commandline_info info_flag = CMDINFO_NONE;
1499BOOL info_stdout = FALSE;
1500
059ec3d9
PH
1501/* Possible options for -R and -S */
1502
1503static uschar *rsopts[] = { US"f", US"ff", US"r", US"rf", US"rff" };
1504
1505/* Need to define this in case we need to change the environment in order
1506to get rid of a bogus time zone. We have to make it char rather than uschar
1507because some OS define it in /usr/include/unistd.h. */
1508
1509extern char **environ;
1510
35edf2ff 1511/* If the Exim user and/or group and/or the configuration file owner/group were
059ec3d9
PH
1512defined by ref:name at build time, we must now find the actual uid/gid values.
1513This is a feature to make the lives of binary distributors easier. */
1514
1515#ifdef EXIM_USERNAME
1516if (route_finduser(US EXIM_USERNAME, &pw, &exim_uid))
1517 {
10385c15
PP
1518 if (exim_uid == 0)
1519 {
1520 fprintf(stderr, "exim: refusing to run with uid 0 for \"%s\"\n",
1521 EXIM_USERNAME);
1522 exit(EXIT_FAILURE);
1523 }
084c1d8c
PP
1524 /* If ref:name uses a number as the name, route_finduser() returns
1525 TRUE with exim_uid set and pw coerced to NULL. */
1526 if (pw)
1527 exim_gid = pw->pw_gid;
1528#ifndef EXIM_GROUPNAME
1529 else
1530 {
1531 fprintf(stderr,
1532 "exim: ref:name should specify a usercode, not a group.\n"
1533 "exim: can't let you get away with it unless you also specify a group.\n");
1534 exit(EXIT_FAILURE);
1535 }
1536#endif
059ec3d9
PH
1537 }
1538else
1539 {
1540 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1541 EXIM_USERNAME);
1542 exit(EXIT_FAILURE);
1543 }
1544#endif
1545
1546#ifdef EXIM_GROUPNAME
1547if (!route_findgroup(US EXIM_GROUPNAME, &exim_gid))
1548 {
1549 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1550 EXIM_GROUPNAME);
1551 exit(EXIT_FAILURE);
1552 }
1553#endif
1554
1555#ifdef CONFIGURE_OWNERNAME
1556if (!route_finduser(US CONFIGURE_OWNERNAME, NULL, &config_uid))
1557 {
1558 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1559 CONFIGURE_OWNERNAME);
1560 exit(EXIT_FAILURE);
1561 }
1562#endif
1563
79d4bc3d
PP
1564/* We default the system_filter_user to be the Exim run-time user, as a
1565sane non-root value. */
1566system_filter_uid = exim_uid;
1567
35edf2ff
PH
1568#ifdef CONFIGURE_GROUPNAME
1569if (!route_findgroup(US CONFIGURE_GROUPNAME, &config_gid))
1570 {
1571 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1572 CONFIGURE_GROUPNAME);
1573 exit(EXIT_FAILURE);
1574 }
1575#endif
1576
059ec3d9
PH
1577/* In the Cygwin environment, some initialization needs doing. It is fudged
1578in by means of this macro. */
1579
1580#ifdef OS_INIT
1581OS_INIT
1582#endif
1583
1584/* Check a field which is patched when we are running Exim within its
1585testing harness; do a fast initial check, and then the whole thing. */
1586
1587running_in_test_harness =
1588 *running_status == '<' && Ustrcmp(running_status, "<<<testing>>>") == 0;
1589
1590/* The C standard says that the equivalent of setlocale(LC_ALL, "C") is obeyed
1591at the start of a program; however, it seems that some environments do not
1592follow this. A "strange" locale can affect the formatting of timestamps, so we
1593make quite sure. */
1594
1595setlocale(LC_ALL, "C");
1596
1597/* Set up the default handler for timing using alarm(). */
1598
1599os_non_restarting_signal(SIGALRM, sigalrm_handler);
1600
1601/* Ensure we have a buffer for constructing log entries. Use malloc directly,
1602because store_malloc writes a log entry on failure. */
1603
1604log_buffer = (uschar *)malloc(LOG_BUFFER_SIZE);
1605if (log_buffer == NULL)
1606 {
1607 fprintf(stderr, "exim: failed to get store for log buffer\n");
1608 exit(EXIT_FAILURE);
1609 }
1610
1611/* Set log_stderr to stderr, provided that stderr exists. This gets reset to
1612NULL when the daemon is run and the file is closed. We have to use this
1613indirection, because some systems don't allow writing to the variable "stderr".
1614*/
1615
1616if (fstat(fileno(stderr), &statbuf) >= 0) log_stderr = stderr;
1617
1618/* Arrange for the PCRE regex library to use our store functions. Note that
1619the normal calls are actually macros that add additional arguments for
1620debugging purposes so we have to assign specially constructed functions here.
1621The default is to use store in the stacking pool, but this is overridden in the
1622regex_must_compile() function. */
1623
1624pcre_malloc = function_store_get;
1625pcre_free = function_dummy_free;
1626
1627/* Ensure there is a big buffer for temporary use in several places. It is put
1628in malloc store so that it can be freed for enlargement if necessary. */
1629
1630big_buffer = store_malloc(big_buffer_size);
1631
1632/* Set up the handler for the data request signal, and set the initial
1633descriptive text. */
1634
1635set_process_info("initializing");
1636os_restarting_signal(SIGUSR1, usr1_handler);
1637
1638/* SIGHUP is used to get the daemon to reconfigure. It gets set as appropriate
1639in the daemon code. For the rest of Exim's uses, we ignore it. */
1640
1641signal(SIGHUP, SIG_IGN);
1642
1643/* We don't want to die on pipe errors as the code is written to handle
1644the write error instead. */
1645
1646signal(SIGPIPE, SIG_IGN);
1647
1648/* Under some circumstance on some OS, Exim can get called with SIGCHLD
1649set to SIG_IGN. This causes subprocesses that complete before the parent
1650process waits for them not to hang around, so when Exim calls wait(), nothing
1651is there. The wait() code has been made robust against this, but let's ensure
1652that SIGCHLD is set to SIG_DFL, because it's tidier to wait and get a process
1653ending status. We use sigaction rather than plain signal() on those OS where
1654SA_NOCLDWAIT exists, because we want to be sure it is turned off. (There was a
1655problem on AIX with this.) */
1656
1657#ifdef SA_NOCLDWAIT
1658 {
1659 struct sigaction act;
1660 act.sa_handler = SIG_DFL;
1661 sigemptyset(&(act.sa_mask));
1662 act.sa_flags = 0;
1663 sigaction(SIGCHLD, &act, NULL);
1664 }
1665#else
1666signal(SIGCHLD, SIG_DFL);
1667#endif
1668
1669/* Save the arguments for use if we re-exec exim as a daemon after receiving
1670SIGHUP. */
1671
1672sighup_argv = argv;
1673
1674/* Set up the version number. Set up the leading 'E' for the external form of
1675message ids, set the pointer to the internal form, and initialize it to
1676indicate no message being processed. */
1677
1678version_init();
1679message_id_option[0] = '-';
1680message_id_external = message_id_option + 1;
1681message_id_external[0] = 'E';
1682message_id = message_id_external + 1;
1683message_id[0] = 0;
1684
67d175de 1685/* Set the umask to zero so that any files Exim creates using open() are
2632889e
PH
1686created with the modes that it specifies. NOTE: Files created with fopen() have
1687a problem, which was not recognized till rather late (February 2006). With this
1688umask, such files will be world writeable. (They are all content scanning files
1689in the spool directory, which isn't world-accessible, so this is not a
1690disaster, but it's untidy.) I don't want to change this overall setting,
1691however, because it will interact badly with the open() calls. Instead, there's
1692now a function called modefopen() that fiddles with the umask while calling
1693fopen(). */
059ec3d9 1694
67d175de 1695(void)umask(0);
059ec3d9
PH
1696
1697/* Precompile the regular expression for matching a message id. Keep this in
1698step with the code that generates ids in the accept.c module. We need to do
1699this here, because the -M options check their arguments for syntactic validity
1700using mac_ismsgid, which uses this. */
1701
1702regex_ismsgid =
1703 regex_must_compile(US"^(?:[^\\W_]{6}-){2}[^\\W_]{2}$", FALSE, TRUE);
1704
a5bd321b 1705/* Precompile the regular expression that is used for matching an SMTP error
d6a96edc
PH
1706code, possibly extended, at the start of an error message. Note that the
1707terminating whitespace character is included. */
a5bd321b
PH
1708
1709regex_smtp_code =
1710 regex_must_compile(US"^\\d\\d\\d\\s(?:\\d\\.\\d\\d?\\d?\\.\\d\\d?\\d?\\s)?",
1711 FALSE, TRUE);
1712
a7cbbf50
PP
1713#ifdef WHITELIST_D_MACROS
1714/* Precompile the regular expression used to filter the content of macros
1715given to -D for permissibility. */
1716
1717regex_whitelisted_macro =
1718 regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE);
1719#endif
1720
1721
059ec3d9
PH
1722/* If the program is called as "mailq" treat it as equivalent to "exim -bp";
1723this seems to be a generally accepted convention, since one finds symbolic
1724links called "mailq" in standard OS configurations. */
1725
1726if ((namelen == 5 && Ustrcmp(argv[0], "mailq") == 0) ||
1727 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/mailq", 6) == 0))
1728 {
1729 list_queue = TRUE;
1730 receiving_message = FALSE;
1731 called_as = US"-mailq";
1732 }
1733
1734/* If the program is called as "rmail" treat it as equivalent to
1735"exim -i -oee", thus allowing UUCP messages to be input using non-SMTP mode,
1736i.e. preventing a single dot on a line from terminating the message, and
1737returning with zero return code, even in cases of error (provided an error
1738message has been sent). */
1739
1740if ((namelen == 5 && Ustrcmp(argv[0], "rmail") == 0) ||
1741 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rmail", 6) == 0))
1742 {
1743 dot_ends = FALSE;
1744 called_as = US"-rmail";
1745 errors_sender_rc = EXIT_SUCCESS;
1746 }
1747
1748/* If the program is called as "rsmtp" treat it as equivalent to "exim -bS";
1749this is a smail convention. */
1750
1751if ((namelen == 5 && Ustrcmp(argv[0], "rsmtp") == 0) ||
1752 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rsmtp", 6) == 0))
1753 {
1754 smtp_input = smtp_batched_input = TRUE;
1755 called_as = US"-rsmtp";
1756 }
1757
1758/* If the program is called as "runq" treat it as equivalent to "exim -q";
1759this is a smail convention. */
1760
1761if ((namelen == 4 && Ustrcmp(argv[0], "runq") == 0) ||
1762 (namelen > 4 && Ustrncmp(argv[0] + namelen - 5, "/runq", 5) == 0))
1763 {
1764 queue_interval = 0;
1765 receiving_message = FALSE;
1766 called_as = US"-runq";
1767 }
1768
1769/* If the program is called as "newaliases" treat it as equivalent to
1770"exim -bi"; this is a sendmail convention. */
1771
1772if ((namelen == 10 && Ustrcmp(argv[0], "newaliases") == 0) ||
1773 (namelen > 10 && Ustrncmp(argv[0] + namelen - 11, "/newaliases", 11) == 0))
1774 {
1775 bi_option = TRUE;
1776 receiving_message = FALSE;
1777 called_as = US"-newaliases";
1778 }
1779
1780/* Save the original effective uid for a couple of uses later. It should
1781normally be root, but in some esoteric environments it may not be. */
1782
1783original_euid = geteuid();
1784
1785/* Get the real uid and gid. If the caller is root, force the effective uid/gid
1786to be the same as the real ones. This makes a difference only if Exim is setuid
1787(or setgid) to something other than root, which could be the case in some
1788special configurations. */
1789
1790real_uid = getuid();
1791real_gid = getgid();
1792
1793if (real_uid == root_uid)
1794 {
1670ef10
PP
1795 rv = setgid(real_gid);
1796 if (rv)
1797 {
1798 fprintf(stderr, "exim: setgid(%ld) failed: %s\n",
1799 (long int)real_gid, strerror(errno));
1800 exit(EXIT_FAILURE);
1801 }
1802 rv = setuid(real_uid);
1803 if (rv)
1804 {
1805 fprintf(stderr, "exim: setuid(%ld) failed: %s\n",
1806 (long int)real_uid, strerror(errno));
1807 exit(EXIT_FAILURE);
1808 }
059ec3d9
PH
1809 }
1810
1811/* If neither the original real uid nor the original euid was root, Exim is
1812running in an unprivileged state. */
1813
1814unprivileged = (real_uid != root_uid && original_euid != root_uid);
1815
059ec3d9
PH
1816/* Scan the program's arguments. Some can be dealt with right away; others are
1817simply recorded for checking and handling afterwards. Do a high-level switch
1818on the second character (the one after '-'), to save some effort. */
1819
1820for (i = 1; i < argc; i++)
1821 {
1822 BOOL badarg = FALSE;
1823 uschar *arg = argv[i];
1824 uschar *argrest;
1825 int switchchar;
1826
1827 /* An argument not starting with '-' is the start of a recipients list;
1828 break out of the options-scanning loop. */
1829
1830 if (arg[0] != '-')
1831 {
1832 recipients_arg = i;
1833 break;
1834 }
1835
1836 /* An option consistion of -- terminates the options */
1837
1838 if (Ustrcmp(arg, "--") == 0)
1839 {
1840 recipients_arg = i + 1;
1841 break;
1842 }
1843
1844 /* Handle flagged options */
1845
1846 switchchar = arg[1];
1847 argrest = arg+2;
1848
1849 /* Make all -ex options synonymous with -oex arguments, since that
1850 is assumed by various callers. Also make -qR options synonymous with -R
1851 options, as that seems to be required as well. Allow for -qqR too, and
1852 the same for -S options. */
1853
1854 if (Ustrncmp(arg+1, "oe", 2) == 0 ||
1855 Ustrncmp(arg+1, "qR", 2) == 0 ||
1856 Ustrncmp(arg+1, "qS", 2) == 0)
1857 {
1858 switchchar = arg[2];
1859 argrest++;
1860 }
1861 else if (Ustrncmp(arg+1, "qqR", 3) == 0 || Ustrncmp(arg+1, "qqS", 3) == 0)
1862 {
1863 switchchar = arg[3];
1864 argrest += 2;
1865 queue_2stage = TRUE;
1866 }
1867
1868 /* Make -r synonymous with -f, since it is a documented alias */
1869
1870 else if (arg[1] == 'r') switchchar = 'f';
1871
1872 /* Make -ov synonymous with -v */
1873
1874 else if (Ustrcmp(arg, "-ov") == 0)
1875 {
1876 switchchar = 'v';
1877 argrest++;
1878 }
1879
4b2241d2
PP
1880 /* deal with --option_aliases */
1881 else if (switchchar == '-')
1882 {
1883 if (Ustrcmp(argrest, "help") == 0)
1884 {
1885 usage_wanted = TRUE;
1886 break;
1887 }
1888 else if (Ustrcmp(argrest, "version") == 0)
1889 {
1890 switchchar = 'b';
73a46702 1891 argrest = US"V";
4b2241d2
PP
1892 }
1893 }
1894
059ec3d9
PH
1895 /* High-level switch on active initial letter */
1896
1897 switch(switchchar)
1898 {
a3fb9793
PP
1899
1900 /* sendmail uses -Ac and -Am to control which .cf file is used;
1901 we ignore them. */
1902 case 'A':
1903 if (*argrest == '\0') { badarg = TRUE; break; }
1904 else
1905 {
1906 BOOL ignore = FALSE;
1907 switch (*argrest)
1908 {
1909 case 'c':
1910 case 'm':
1911 if (*(argrest + 1) == '\0')
1912 ignore = TRUE;
1913 break;
1914 }
1915 if (!ignore) { badarg = TRUE; break; }
1916 }
1917 break;
1918
059ec3d9
PH
1919 /* -Btype is a sendmail option for 7bit/8bit setting. Exim is 8-bit clean
1920 so has no need of it. */
1921
1922 case 'B':
1923 if (*argrest == 0) i++; /* Skip over the type */
1924 break;
1925
1926
1927 case 'b':
1928 receiving_message = FALSE; /* Reset TRUE for -bm, -bS, -bs below */
1929
1930 /* -bd: Run in daemon mode, awaiting SMTP connections.
1931 -bdf: Ditto, but in the foreground.
1932 */
1933
1934 if (*argrest == 'd')
1935 {
1936 daemon_listen = TRUE;
1937 if (*(++argrest) == 'f') background_daemon = FALSE;
1938 else if (*argrest != 0) { badarg = TRUE; break; }
1939 }
1940
328895cc
PH
1941 /* -be: Run in expansion test mode
1942 -bem: Ditto, but read a message from a file first
1943 */
059ec3d9
PH
1944
1945 else if (*argrest == 'e')
328895cc 1946 {
059ec3d9 1947 expansion_test = checking = TRUE;
328895cc
PH
1948 if (argrest[1] == 'm')
1949 {
1950 if (++i >= argc) { badarg = TRUE; break; }
1951 expansion_test_message = argv[i];
1952 argrest++;
1953 }
1954 if (argrest[1] != 0) { badarg = TRUE; break; }
1955 }
059ec3d9 1956
f05da2e8
PH
1957 /* -bF: Run system filter test */
1958
1959 else if (*argrest == 'F')
1960 {
1961 filter_test |= FTEST_SYSTEM;
1962 if (*(++argrest) != 0) { badarg = TRUE; break; }
1963 if (++i < argc) filter_test_sfile = argv[i]; else
1964 {
1965 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
1966 exit(EXIT_FAILURE);
1967 }
1968 }
1969
1970 /* -bf: Run user filter test
059ec3d9
PH
1971 -bfd: Set domain for filter testing
1972 -bfl: Set local part for filter testing
1973 -bfp: Set prefix for filter testing
1974 -bfs: Set suffix for filter testing
1975 */
1976
f05da2e8 1977 else if (*argrest == 'f')
059ec3d9 1978 {
f05da2e8 1979 if (*(++argrest) == 0)
059ec3d9 1980 {
f05da2e8
PH
1981 filter_test |= FTEST_USER;
1982 if (++i < argc) filter_test_ufile = argv[i]; else
059ec3d9
PH
1983 {
1984 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
1985 exit(EXIT_FAILURE);
1986 }
1987 }
1988 else
1989 {
1990 if (++i >= argc)
1991 {
1992 fprintf(stderr, "exim: string expected after %s\n", arg);
1993 exit(EXIT_FAILURE);
1994 }
1995 if (Ustrcmp(argrest, "d") == 0) ftest_domain = argv[i];
1996 else if (Ustrcmp(argrest, "l") == 0) ftest_localpart = argv[i];
1997 else if (Ustrcmp(argrest, "p") == 0) ftest_prefix = argv[i];
1998 else if (Ustrcmp(argrest, "s") == 0) ftest_suffix = argv[i];
1999 else { badarg = TRUE; break; }
2000 }
2001 }
2002
2003 /* -bh: Host checking - an IP address must follow. */
2004
2005 else if (Ustrcmp(argrest, "h") == 0 || Ustrcmp(argrest, "hc") == 0)
2006 {
2007 if (++i >= argc) { badarg = TRUE; break; }
2008 sender_host_address = argv[i];
2009 host_checking = checking = log_testing_mode = TRUE;
2010 host_checking_callout = argrest[1] == 'c';
2011 }
2012
2013 /* -bi: This option is used by sendmail to initialize *the* alias file,
2014 though it has the -oA option to specify a different file. Exim has no
2015 concept of *the* alias file, but since Sun's YP make script calls
2016 sendmail this way, some support must be provided. */
2017
2018 else if (Ustrcmp(argrest, "i") == 0) bi_option = TRUE;
2019
98a90c36
PP
2020 /* -bI: provide information, of the type to follow after a colon.
2021 This is an Exim flag. */
2022
2023 else if (argrest[0] == 'I' && Ustrlen(argrest) >= 2 && argrest[1] == ':')
2024 {
2025 uschar *p = &argrest[2];
2026 info_flag = CMDINFO_HELP;
2027 if (Ustrlen(p))
2028 {
2029 if (strcmpic(p, CUS"sieve") == 0)
2030 {
2031 info_flag = CMDINFO_SIEVE;
2032 info_stdout = TRUE;
2033 }
36a3ae5f
PP
2034 else if (strcmpic(p, CUS"dscp") == 0)
2035 {
2036 info_flag = CMDINFO_DSCP;
2037 info_stdout = TRUE;
2038 }
98a90c36
PP
2039 else if (strcmpic(p, CUS"help") == 0)
2040 {
2041 info_stdout = TRUE;
2042 }
2043 }
2044 }
2045
059ec3d9
PH
2046 /* -bm: Accept and deliver message - the default option. Reinstate
2047 receiving_message, which got turned off for all -b options. */
2048
2049 else if (Ustrcmp(argrest, "m") == 0) receiving_message = TRUE;
2050
8544e77a
PP
2051 /* -bmalware: test the filename given for malware */
2052
2053 else if (Ustrcmp(argrest, "malware") == 0)
2054 {
2055 if (++i >= argc) { badarg = TRUE; break; }
2056 malware_test_file = argv[i];
2057 }
2058
059ec3d9
PH
2059 /* -bnq: For locally originating messages, do not qualify unqualified
2060 addresses. In the envelope, this causes errors; in header lines they
2061 just get left. */
2062
2063 else if (Ustrcmp(argrest, "nq") == 0)
2064 {
2065 allow_unqualified_sender = FALSE;
2066 allow_unqualified_recipient = FALSE;
2067 }
2068
2069 /* -bpxx: List the contents of the mail queue, in various forms. If
2070 the option is -bpc, just a queue count is needed. Otherwise, if the
2071 first letter after p is r, then order is random. */
2072
2073 else if (*argrest == 'p')
2074 {
2075 if (*(++argrest) == 'c')
2076 {
2077 count_queue = TRUE;
2078 if (*(++argrest) != 0) badarg = TRUE;
2079 break;
2080 }
2081
2082 if (*argrest == 'r')
2083 {
2084 list_queue_option = 8;
2085 argrest++;
2086 }
2087 else list_queue_option = 0;
2088
2089 list_queue = TRUE;
2090
2091 /* -bp: List the contents of the mail queue, top-level only */
2092
2093 if (*argrest == 0) {}
2094
2095 /* -bpu: List the contents of the mail queue, top-level undelivered */
2096
2097 else if (Ustrcmp(argrest, "u") == 0) list_queue_option += 1;
2098
2099 /* -bpa: List the contents of the mail queue, including all delivered */
2100
2101 else if (Ustrcmp(argrest, "a") == 0) list_queue_option += 2;
2102
2103 /* Unknown after -bp[r] */
2104
2105 else
2106 {
2107 badarg = TRUE;
2108 break;
2109 }
2110 }
2111
2112
2113 /* -bP: List the configuration variables given as the address list.
2114 Force -v, so configuration errors get displayed. */
2115
2116 else if (Ustrcmp(argrest, "P") == 0)
2117 {
2118 list_options = TRUE;
2119 debug_selector |= D_v;
2120 debug_file = stderr;
2121 }
2122
2123 /* -brt: Test retry configuration lookup */
2124
2125 else if (Ustrcmp(argrest, "rt") == 0)
2126 {
2127 test_retry_arg = i + 1;
2128 goto END_ARG;
2129 }
2130
2131 /* -brw: Test rewrite configuration */
2132
2133 else if (Ustrcmp(argrest, "rw") == 0)
2134 {
2135 test_rewrite_arg = i + 1;
2136 goto END_ARG;
2137 }
2138
2139 /* -bS: Read SMTP commands on standard input, but produce no replies -
2140 all errors are reported by sending messages. */
2141
2142 else if (Ustrcmp(argrest, "S") == 0)
2143 smtp_input = smtp_batched_input = receiving_message = TRUE;
2144
2145 /* -bs: Read SMTP commands on standard input and produce SMTP replies
2146 on standard output. */
2147
2148 else if (Ustrcmp(argrest, "s") == 0) smtp_input = receiving_message = TRUE;
2149
2150 /* -bt: address testing mode */
2151
2152 else if (Ustrcmp(argrest, "t") == 0)
2153 address_test_mode = checking = log_testing_mode = TRUE;
2154
2155 /* -bv: verify addresses */
2156
2157 else if (Ustrcmp(argrest, "v") == 0)
2158 verify_address_mode = checking = log_testing_mode = TRUE;
2159
2160 /* -bvs: verify sender addresses */
2161
2162 else if (Ustrcmp(argrest, "vs") == 0)
2163 {
2164 verify_address_mode = checking = log_testing_mode = TRUE;
2165 verify_as_sender = TRUE;
2166 }
2167
2168 /* -bV: Print version string and support details */
2169
2170 else if (Ustrcmp(argrest, "V") == 0)
2171 {
2172 printf("Exim version %s #%s built %s\n", version_string,
2173 version_cnumber, version_date);
2174 printf("%s\n", CS version_copyright);
2175 version_printed = TRUE;
2176 show_whats_supported(stdout);
2177 }
2178
9ee44efb
PP
2179 /* -bw: inetd wait mode, accept a listening socket as stdin */
2180
2181 else if (*argrest == 'w')
2182 {
2183 inetd_wait_mode = TRUE;
2184 background_daemon = FALSE;
2185 daemon_listen = TRUE;
2186 if (*(++argrest) != '\0')
2187 {
2188 inetd_wait_timeout = readconf_readtime(argrest, 0, FALSE);
2189 if (inetd_wait_timeout <= 0)
2190 {
2191 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
2192 exit(EXIT_FAILURE);
2193 }
2194 }
2195 }
2196
059ec3d9
PH
2197 else badarg = TRUE;
2198 break;
2199
2200
2201 /* -C: change configuration file list; ignore if it isn't really
2202 a change! Enforce a prefix check if required. */
2203
2204 case 'C':
2205 if (*argrest == 0)
2206 {
2207 if(++i < argc) argrest = argv[i]; else
2208 { badarg = TRUE; break; }
2209 }
2210 if (Ustrcmp(config_main_filelist, argrest) != 0)
2211 {
2212 #ifdef ALT_CONFIG_PREFIX
2213 int sep = 0;
2214 int len = Ustrlen(ALT_CONFIG_PREFIX);
2215 uschar *list = argrest;
2216 uschar *filename;
2217 while((filename = string_nextinlist(&list, &sep, big_buffer,
2218 big_buffer_size)) != NULL)
2219 {
2220 if ((Ustrlen(filename) < len ||
2221 Ustrncmp(filename, ALT_CONFIG_PREFIX, len) != 0 ||
2222 Ustrstr(filename, "/../") != NULL) &&
2223 (Ustrcmp(filename, "/dev/null") != 0 || real_uid != root_uid))
2224 {
2225 fprintf(stderr, "-C Permission denied\n");
2226 exit(EXIT_FAILURE);
2227 }
2228 }
2229 #endif
261dc43e
DW
2230 if (real_uid != root_uid)
2231 {
90b6341f 2232 #ifdef TRUSTED_CONFIG_LIST
261dc43e 2233
90b6341f
DW
2234 if (real_uid != exim_uid
2235 #ifdef CONFIGURE_OWNER
2236 && real_uid != config_uid
2237 #endif
2238 )
261dc43e
DW
2239 trusted_config = FALSE;
2240 else
2241 {
90b6341f 2242 FILE *trust_list = Ufopen(TRUSTED_CONFIG_LIST, "rb");
261dc43e
DW
2243 if (trust_list)
2244 {
2245 struct stat statbuf;
2246
2247 if (fstat(fileno(trust_list), &statbuf) != 0 ||
2248 (statbuf.st_uid != root_uid /* owner not root */
2249 #ifdef CONFIGURE_OWNER
2250 && statbuf.st_uid != config_uid /* owner not the special one */
2251 #endif
2252 ) || /* or */
2253 (statbuf.st_gid != root_gid /* group not root */
2254 #ifdef CONFIGURE_GROUP
2255 && statbuf.st_gid != config_gid /* group not the special one */
2256 #endif
2257 && (statbuf.st_mode & 020) != 0 /* group writeable */
2258 ) || /* or */
2259 (statbuf.st_mode & 2) != 0) /* world writeable */
2260 {
2261 trusted_config = FALSE;
2262 fclose(trust_list);
2263 }
2264 else
2265 {
2266 /* Well, the trust list at least is up to scratch... */
2267 void *reset_point = store_get(0);
90b6341f
DW
2268 uschar *trusted_configs[32];
2269 int nr_configs = 0;
261dc43e
DW
2270 int i = 0;
2271
2272 while (Ufgets(big_buffer, big_buffer_size, trust_list))
2273 {
2274 uschar *start = big_buffer, *nl;
2275 while (*start && isspace(*start))
2276 start++;
1e83d68b 2277 if (*start != '/')
261dc43e
DW
2278 continue;
2279 nl = Ustrchr(start, '\n');
2280 if (nl)
2281 *nl = 0;
90b6341f
DW
2282 trusted_configs[nr_configs++] = string_copy(start);
2283 if (nr_configs == 32)
261dc43e
DW
2284 break;
2285 }
2286 fclose(trust_list);
2287
90b6341f 2288 if (nr_configs)
261dc43e
DW
2289 {
2290 int sep = 0;
2291 uschar *list = argrest;
2292 uschar *filename;
2293 while (trusted_config && (filename = string_nextinlist(&list,
2294 &sep, big_buffer, big_buffer_size)) != NULL)
2295 {
90b6341f 2296 for (i=0; i < nr_configs; i++)
261dc43e 2297 {
90b6341f 2298 if (Ustrcmp(filename, trusted_configs[i]) == 0)
261dc43e
DW
2299 break;
2300 }
90b6341f 2301 if (i == nr_configs)
261dc43e
DW
2302 {
2303 trusted_config = FALSE;
2304 break;
2305 }
2306 }
1e83d68b 2307 store_reset(reset_point);
261dc43e
DW
2308 }
2309 else
2310 {
2311 /* No valid prefixes found in trust_list file. */
2312 trusted_config = FALSE;
2313 }
2314 }
2315 }
2316 else
2317 {
2318 /* Could not open trust_list file. */
2319 trusted_config = FALSE;
2320 }
2321 }
2322 #else
2323 /* Not root; don't trust config */
2324 trusted_config = FALSE;
2325 #endif
2326 }
059ec3d9
PH
2327
2328 config_main_filelist = argrest;
2329 config_changed = TRUE;
2330 }
2331 break;
2332
2333
2334 /* -D: set up a macro definition */
2335
2336 case 'D':
2337 #ifdef DISABLE_D_OPTION
2338 fprintf(stderr, "exim: -D is not available in this Exim binary\n");
2339 exit(EXIT_FAILURE);
2340 #else
2341 {
2342 int ptr = 0;
2343 macro_item *mlast = NULL;
2344 macro_item *m;
2345 uschar name[24];
2346 uschar *s = argrest;
2347
2348 while (isspace(*s)) s++;
2349
2350 if (*s < 'A' || *s > 'Z')
2351 {
2352 fprintf(stderr, "exim: macro name set by -D must start with "
2353 "an upper case letter\n");
2354 exit(EXIT_FAILURE);
2355 }
2356
2357 while (isalnum(*s) || *s == '_')
2358 {
2359 if (ptr < sizeof(name)-1) name[ptr++] = *s;
2360 s++;
2361 }
2362 name[ptr] = 0;
2363 if (ptr == 0) { badarg = TRUE; break; }
2364 while (isspace(*s)) s++;
2365 if (*s != 0)
2366 {
2367 if (*s++ != '=') { badarg = TRUE; break; }
2368 while (isspace(*s)) s++;
2369 }
2370
2371 for (m = macros; m != NULL; m = m->next)
2372 {
2373 if (Ustrcmp(m->name, name) == 0)
2374 {
2375 fprintf(stderr, "exim: duplicated -D in command line\n");
2376 exit(EXIT_FAILURE);
2377 }
2378 mlast = m;
2379 }
2380
2381 m = store_get(sizeof(macro_item) + Ustrlen(name));
2382 m->next = NULL;
2383 m->command_line = TRUE;
2384 if (mlast == NULL) macros = m; else mlast->next = m;
2385 Ustrcpy(m->name, name);
2386 m->replacement = string_copy(s);
2387
2388 if (clmacro_count >= MAX_CLMACROS)
2389 {
2390 fprintf(stderr, "exim: too many -D options on command line\n");
2391 exit(EXIT_FAILURE);
2392 }
2393 clmacros[clmacro_count++] = string_sprintf("-D%s=%s", m->name,
2394 m->replacement);
2395 }
2396 #endif
2397 break;
2398
2399 /* -d: Set debug level (see also -v below) or set the drop_cr option.
8e669ac1 2400 The latter is now a no-op, retained for compatibility only. If -dd is used,
3d235903 2401 debugging subprocesses of the daemon is disabled. */
059ec3d9
PH
2402
2403 case 'd':
2404 if (Ustrcmp(argrest, "ropcr") == 0)
2405 {
2406 /* drop_cr = TRUE; */
2407 }
2408
2409 /* Use an intermediate variable so that we don't set debugging while
2410 decoding the debugging bits. */
2411
2412 else
2413 {
2414 unsigned int selector = D_default;
2415 debug_selector = 0;
2416 debug_file = NULL;
3d235903
PH
2417 if (*argrest == 'd')
2418 {
2419 debug_daemon = TRUE;
2420 argrest++;
2421 }
059ec3d9 2422 if (*argrest != 0)
1fe64dcc 2423 decode_bits(&selector, NULL, D_memory, 0, argrest, debug_options,
ed7f7860 2424 debug_options_count, US"debug", 0);
059ec3d9
PH
2425 debug_selector = selector;
2426 }
2427 break;
2428
2429
2430 /* -E: This is a local error message. This option is not intended for
2431 external use at all, but is not restricted to trusted callers because it
2432 does no harm (just suppresses certain error messages) and if Exim is run
2433 not setuid root it won't always be trusted when it generates error
2434 messages using this option. If there is a message id following -E, point
2435 message_reference at it, for logging. */
2436
2437 case 'E':
2438 local_error_message = TRUE;
2439 if (mac_ismsgid(argrest)) message_reference = argrest;
2440 break;
2441
2442
2443 /* -ex: The vacation program calls sendmail with the undocumented "-eq"
2444 option, so it looks as if historically the -oex options are also callable
2445 without the leading -o. So we have to accept them. Before the switch,
2446 anything starting -oe has been converted to -e. Exim does not support all
2447 of the sendmail error options. */
2448
2449 case 'e':
2450 if (Ustrcmp(argrest, "e") == 0)
2451 {
2452 arg_error_handling = ERRORS_SENDER;
2453 errors_sender_rc = EXIT_SUCCESS;
2454 }
2455 else if (Ustrcmp(argrest, "m") == 0) arg_error_handling = ERRORS_SENDER;
2456 else if (Ustrcmp(argrest, "p") == 0) arg_error_handling = ERRORS_STDERR;
2457 else if (Ustrcmp(argrest, "q") == 0) arg_error_handling = ERRORS_STDERR;
2458 else if (Ustrcmp(argrest, "w") == 0) arg_error_handling = ERRORS_SENDER;
2459 else badarg = TRUE;
2460 break;
2461
2462
2463 /* -F: Set sender's full name, used instead of the gecos entry from
2464 the password file. Since users can usually alter their gecos entries,
2465 there's no security involved in using this instead. The data can follow
2466 the -F or be in the next argument. */
2467
2468 case 'F':
2469 if (*argrest == 0)
2470 {
2471 if(++i < argc) argrest = argv[i]; else
2472 { badarg = TRUE; break; }
2473 }
2474 originator_name = argrest;
2fe1a124 2475 sender_name_forced = TRUE;
059ec3d9
PH
2476 break;
2477
2478
2479 /* -f: Set sender's address - this value is only actually used if Exim is
2480 run by a trusted user, or if untrusted_set_sender is set and matches the
2481 address, except that the null address can always be set by any user. The
2482 test for this happens later, when the value given here is ignored when not
2483 permitted. For an untrusted user, the actual sender is still put in Sender:
2484 if it doesn't match the From: header (unless no_local_from_check is set).
2485 The data can follow the -f or be in the next argument. The -r switch is an
2486 obsolete form of -f but since there appear to be programs out there that
2487 use anything that sendmail has ever supported, better accept it - the
2488 synonymizing is done before the switch above.
2489
2490 At this stage, we must allow domain literal addresses, because we don't
2491 know what the setting of allow_domain_literals is yet. Ditto for trailing
2492 dots and strip_trailing_dot. */
2493
2494 case 'f':
2495 {
2496 int start, end;
2497 uschar *errmess;
2498 if (*argrest == 0)
2499 {
2500 if (i+1 < argc) argrest = argv[++i]; else
2501 { badarg = TRUE; break; }
2502 }
2503 if (*argrest == 0)
2504 {
2505 sender_address = string_sprintf(""); /* Ensure writeable memory */
2506 }
2507 else
2508 {
2509 uschar *temp = argrest + Ustrlen(argrest) - 1;
2510 while (temp >= argrest && isspace(*temp)) temp--;
2511 if (temp >= argrest && *temp == '.') f_end_dot = TRUE;
2512 allow_domain_literals = TRUE;
2513 strip_trailing_dot = TRUE;
2514 sender_address = parse_extract_address(argrest, &errmess, &start, &end,
2515 &sender_address_domain, TRUE);
2516 allow_domain_literals = FALSE;
2517 strip_trailing_dot = FALSE;
2518 if (sender_address == NULL)
2519 {
2520 fprintf(stderr, "exim: bad -f address \"%s\": %s\n", argrest, errmess);
2521 return EXIT_FAILURE;
2522 }
2523 }
2524 sender_address_forced = TRUE;
2525 }
2526 break;
2527
a3fb9793 2528 /* -G: sendmail invocation to specify that it's a gateway submission and
f4ee74ac
PP
2529 sendmail may complain about problems instead of fixing them.
2530 We make it equivalent to an ACL "control = suppress_local_fixups" and do
2531 not at this time complain about problems. */
059ec3d9
PH
2532
2533 case 'G':
f4ee74ac 2534 flag_G = TRUE;
059ec3d9
PH
2535 break;
2536
2537 /* -h: Set the hop count for an incoming message. Exim does not currently
2538 support this; it always computes it by counting the Received: headers.
2539 To put it in will require a change to the spool header file format. */
2540
2541 case 'h':
2542 if (*argrest == 0)
2543 {
2544 if(++i < argc) argrest = argv[i]; else
2545 { badarg = TRUE; break; }
2546 }
2547 if (!isdigit(*argrest)) badarg = TRUE;
2548 break;
2549
2550
2551 /* -i: Set flag so dot doesn't end non-SMTP input (same as -oi, seems
2552 not to be documented for sendmail but mailx (at least) uses it) */
2553
2554 case 'i':
2555 if (*argrest == 0) dot_ends = FALSE; else badarg = TRUE;
2556 break;
2557
2558
a3fb9793
PP
2559 /* -L: set the identifier used for syslog; equivalent to setting
2560 syslog_processname in the config file, but needs to be an admin option. */
2561
2562 case 'L':
2563 if (*argrest == '\0')
2564 {
2565 if(++i < argc) argrest = argv[i]; else
2566 { badarg = TRUE; break; }
2567 }
2568 sz = Ustrlen(argrest);
2569 if (sz > 32)
2570 {
2571 fprintf(stderr, "exim: the -L syslog name is too long: \"%s\"\n", argrest);
2572 return EXIT_FAILURE;
2573 }
2574 if (sz < 1)
2575 {
2576 fprintf(stderr, "exim: the -L syslog name is too short\n");
2577 return EXIT_FAILURE;
2578 }
2579 cmdline_syslog_name = argrest;
2580 break;
2581
059ec3d9
PH
2582 case 'M':
2583 receiving_message = FALSE;
2584
2585 /* -MC: continue delivery of another message via an existing open
2586 file descriptor. This option is used for an internal call by the
2587 smtp transport when there is a pending message waiting to go to an
2588 address to which it has got a connection. Five subsequent arguments are
2589 required: transport name, host name, IP address, sequence number, and
2590 message_id. Transports may decline to create new processes if the sequence
2591 number gets too big. The channel is stdin. This (-MC) must be the last
2592 argument. There's a subsequent check that the real-uid is privileged.
2593
2594 If we are running in the test harness. delay for a bit, to let the process
2595 that set this one up complete. This makes for repeatability of the logging,
2596 etc. output. */
2597
2598 if (Ustrcmp(argrest, "C") == 0)
2599 {
41c7c167
PH
2600 union sockaddr_46 interface_sock;
2601 EXIM_SOCKLEN_T size = sizeof(interface_sock);
2602
059ec3d9
PH
2603 if (argc != i + 6)
2604 {
2605 fprintf(stderr, "exim: too many or too few arguments after -MC\n");
2606 return EXIT_FAILURE;
2607 }
2608
2609 if (msg_action_arg >= 0)
2610 {
2611 fprintf(stderr, "exim: incompatible arguments\n");
2612 return EXIT_FAILURE;
2613 }
2614
2615 continue_transport = argv[++i];
2616 continue_hostname = argv[++i];
2617 continue_host_address = argv[++i];
2618 continue_sequence = Uatoi(argv[++i]);
2619 msg_action = MSG_DELIVER;
2620 msg_action_arg = ++i;
2621 forced_delivery = TRUE;
2622 queue_run_pid = passed_qr_pid;
2623 queue_run_pipe = passed_qr_pipe;
2624
2625 if (!mac_ismsgid(argv[i]))
2626 {
2627 fprintf(stderr, "exim: malformed message id %s after -MC option\n",
2628 argv[i]);
2629 return EXIT_FAILURE;
2630 }
2631
41c7c167
PH
2632 /* Set up $sending_ip_address and $sending_port */
2633
2634 if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
2635 &size) == 0)
2636 sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
2637 &sending_port);
2638 else
2639 {
2640 fprintf(stderr, "exim: getsockname() failed after -MC option: %s\n",
2641 strerror(errno));
2642 return EXIT_FAILURE;
2643 }
2644
059ec3d9
PH
2645 if (running_in_test_harness) millisleep(500);
2646 break;
2647 }
2648
2649 /* -MCA: set the smtp_authenticated flag; this is useful only when it
2650 precedes -MC (see above). The flag indicates that the host to which
2651 Exim is connected has accepted an AUTH sequence. */
2652
2653 else if (Ustrcmp(argrest, "CA") == 0)
2654 {
2655 smtp_authenticated = TRUE;
2656 break;
2657 }
2658
2659 /* -MCP: set the smtp_use_pipelining flag; this is useful only when
2660 it preceded -MC (see above) */
2661
2662 else if (Ustrcmp(argrest, "CP") == 0)
2663 {
2664 smtp_use_pipelining = TRUE;
2665 break;
2666 }
2667
2668 /* -MCQ: pass on the pid of the queue-running process that started
2669 this chain of deliveries and the fd of its synchronizing pipe; this
2670 is useful only when it precedes -MC (see above) */
2671
2672 else if (Ustrcmp(argrest, "CQ") == 0)
2673 {
2674 if(++i < argc) passed_qr_pid = (pid_t)(Uatol(argv[i]));
2675 else badarg = TRUE;
2676 if(++i < argc) passed_qr_pipe = (int)(Uatol(argv[i]));
2677 else badarg = TRUE;
2678 break;
2679 }
2680
2681 /* -MCS: set the smtp_use_size flag; this is useful only when it
2682 precedes -MC (see above) */
2683
2684 else if (Ustrcmp(argrest, "CS") == 0)
2685 {
2686 smtp_use_size = TRUE;
2687 break;
2688 }
2689
2690 /* -MCT: set the tls_offered flag; this is useful only when it
2691 precedes -MC (see above). The flag indicates that the host to which
2692 Exim is connected has offered TLS support. */
2693
2694 #ifdef SUPPORT_TLS
2695 else if (Ustrcmp(argrest, "CT") == 0)
2696 {
2697 tls_offered = TRUE;
2698 break;
2699 }
2700 #endif
2701
2702 /* -M[x]: various operations on the following list of message ids:
2703 -M deliver the messages, ignoring next retry times and thawing
2704 -Mc deliver the messages, checking next retry times, no thawing
2705 -Mf freeze the messages
2706 -Mg give up on the messages
2707 -Mt thaw the messages
2708 -Mrm remove the messages
2709 In the above cases, this must be the last option. There are also the
2710 following options which are followed by a single message id, and which
2711 act on that message. Some of them use the "recipient" addresses as well.
2712 -Mar add recipient(s)
2713 -Mmad mark all recipients delivered
2714 -Mmd mark recipients(s) delivered
2715 -Mes edit sender
0ef732d9 2716 -Mset load a message for use with -be
059ec3d9 2717 -Mvb show body
a96603a0 2718 -Mvc show copy (of whole message, in RFC 2822 format)
059ec3d9
PH
2719 -Mvh show header
2720 -Mvl show log
2721 */
2722
2723 else if (*argrest == 0)
2724 {
2725 msg_action = MSG_DELIVER;
2726 forced_delivery = deliver_force_thaw = TRUE;
2727 }
2728 else if (Ustrcmp(argrest, "ar") == 0)
2729 {
2730 msg_action = MSG_ADD_RECIPIENT;
2731 one_msg_action = TRUE;
2732 }
2733 else if (Ustrcmp(argrest, "c") == 0) msg_action = MSG_DELIVER;
2734 else if (Ustrcmp(argrest, "es") == 0)
2735 {
2736 msg_action = MSG_EDIT_SENDER;
2737 one_msg_action = TRUE;
2738 }
2739 else if (Ustrcmp(argrest, "f") == 0) msg_action = MSG_FREEZE;
2740 else if (Ustrcmp(argrest, "g") == 0)
2741 {
2742 msg_action = MSG_DELIVER;
2743 deliver_give_up = TRUE;
2744 }
2745 else if (Ustrcmp(argrest, "mad") == 0)
2746 {
2747 msg_action = MSG_MARK_ALL_DELIVERED;
2748 }
2749 else if (Ustrcmp(argrest, "md") == 0)
2750 {
2751 msg_action = MSG_MARK_DELIVERED;
2752 one_msg_action = TRUE;
2753 }
2754 else if (Ustrcmp(argrest, "rm") == 0) msg_action = MSG_REMOVE;
0ef732d9
PH
2755 else if (Ustrcmp(argrest, "set") == 0)
2756 {
2757 msg_action = MSG_LOAD;
2758 one_msg_action = TRUE;
2759 }
059ec3d9
PH
2760 else if (Ustrcmp(argrest, "t") == 0) msg_action = MSG_THAW;
2761 else if (Ustrcmp(argrest, "vb") == 0)
2762 {
2763 msg_action = MSG_SHOW_BODY;
2764 one_msg_action = TRUE;
2765 }
a96603a0
PH
2766 else if (Ustrcmp(argrest, "vc") == 0)
2767 {
2768 msg_action = MSG_SHOW_COPY;
2769 one_msg_action = TRUE;
2770 }
059ec3d9
PH
2771 else if (Ustrcmp(argrest, "vh") == 0)
2772 {
2773 msg_action = MSG_SHOW_HEADER;
2774 one_msg_action = TRUE;
2775 }
2776 else if (Ustrcmp(argrest, "vl") == 0)
2777 {
2778 msg_action = MSG_SHOW_LOG;
2779 one_msg_action = TRUE;
2780 }
2781 else { badarg = TRUE; break; }
2782
2783 /* All the -Mxx options require at least one message id. */
2784
2785 msg_action_arg = i + 1;
2786 if (msg_action_arg >= argc)
2787 {
2788 fprintf(stderr, "exim: no message ids given after %s option\n", arg);
2789 return EXIT_FAILURE;
2790 }
2791
2792 /* Some require only message ids to follow */
2793
2794 if (!one_msg_action)
2795 {
2796 int j;
2797 for (j = msg_action_arg; j < argc; j++) if (!mac_ismsgid(argv[j]))
2798 {
2799 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2800 argv[j], arg);
2801 return EXIT_FAILURE;
2802 }
2803 goto END_ARG; /* Remaining args are ids */
2804 }
2805
2806 /* Others require only one message id, possibly followed by addresses,
2807 which will be handled as normal arguments. */
2808
2809 else
2810 {
2811 if (!mac_ismsgid(argv[msg_action_arg]))
2812 {
2813 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2814 argv[msg_action_arg], arg);
2815 return EXIT_FAILURE;
2816 }
2817 i++;
2818 }
2819 break;
2820
2821
2822 /* Some programs seem to call the -om option without the leading o;
2823 for sendmail it askes for "me too". Exim always does this. */
2824
2825 case 'm':
2826 if (*argrest != 0) badarg = TRUE;
2827 break;
2828
2829
2830 /* -N: don't do delivery - a debugging option that stops transports doing
2831 their thing. It implies debugging at the D_v level. */
2832
2833 case 'N':
2834 if (*argrest == 0)
2835 {
2836 dont_deliver = TRUE;
2837 debug_selector |= D_v;
2838 debug_file = stderr;
2839 }
2840 else badarg = TRUE;
2841 break;
2842
2843
12f69989
PP
2844 /* -n: This means "don't alias" in sendmail, apparently.
2845 For normal invocations, it has no effect.
2846 It may affect some other options. */
059ec3d9
PH
2847
2848 case 'n':
12f69989 2849 flag_n = TRUE;
059ec3d9
PH
2850 break;
2851
2852 /* -O: Just ignore it. In sendmail, apparently -O option=value means set
2853 option to the specified value. This form uses long names. We need to handle
2854 -O option=value and -Ooption=value. */
2855
2856 case 'O':
2857 if (*argrest == 0)
2858 {
2859 if (++i >= argc)
2860 {
2861 fprintf(stderr, "exim: string expected after -O\n");
2862 exit(EXIT_FAILURE);
2863 }
2864 }
2865 break;
2866
2867 case 'o':
2868
2869 /* -oA: Set an argument for the bi command (sendmail's "alternate alias
2870 file" option). */
2871
2872 if (*argrest == 'A')
2873 {
2874 alias_arg = argrest + 1;
2875 if (alias_arg[0] == 0)
2876 {
2877 if (i+1 < argc) alias_arg = argv[++i]; else
2878 {
2879 fprintf(stderr, "exim: string expected after -oA\n");
2880 exit(EXIT_FAILURE);
2881 }
2882 }
2883 }
2884
2885 /* -oB: Set a connection message max value for remote deliveries */
2886
2887 else if (*argrest == 'B')
2888 {
2889 uschar *p = argrest + 1;
2890 if (p[0] == 0)
2891 {
2892 if (i+1 < argc && isdigit((argv[i+1][0]))) p = argv[++i]; else
2893 {
2894 connection_max_messages = 1;
2895 p = NULL;
2896 }
2897 }
2898
2899 if (p != NULL)
2900 {
2901 if (!isdigit(*p))
2902 {
2903 fprintf(stderr, "exim: number expected after -oB\n");
2904 exit(EXIT_FAILURE);
2905 }
2906 connection_max_messages = Uatoi(p);
2907 }
2908 }
2909
2910 /* -odb: background delivery */
2911
2912 else if (Ustrcmp(argrest, "db") == 0)
2913 {
2914 synchronous_delivery = FALSE;
2915 arg_queue_only = FALSE;
2916 queue_only_set = TRUE;
2917 }
2918
2919 /* -odf: foreground delivery (smail-compatible option); same effect as
2920 -odi: interactive (synchronous) delivery (sendmail-compatible option)
2921 */
2922
2923 else if (Ustrcmp(argrest, "df") == 0 || Ustrcmp(argrest, "di") == 0)
2924 {
2925 synchronous_delivery = TRUE;
2926 arg_queue_only = FALSE;
2927 queue_only_set = TRUE;
2928 }
2929
2930 /* -odq: queue only */
2931
2932 else if (Ustrcmp(argrest, "dq") == 0)
2933 {
2934 synchronous_delivery = FALSE;
2935 arg_queue_only = TRUE;
2936 queue_only_set = TRUE;
2937 }
2938
2939 /* -odqs: queue SMTP only - do local deliveries and remote routing,
2940 but no remote delivery */
2941
2942 else if (Ustrcmp(argrest, "dqs") == 0)
2943 {
2944 queue_smtp = TRUE;
2945 arg_queue_only = FALSE;
2946 queue_only_set = TRUE;
2947 }
2948
2949 /* -oex: Sendmail error flags. As these are also accepted without the
2950 leading -o prefix, for compatibility with vacation and other callers,
2951 they are handled with -e above. */
2952
2953 /* -oi: Set flag so dot doesn't end non-SMTP input (same as -i)
2954 -oitrue: Another sendmail syntax for the same */
2955
2956 else if (Ustrcmp(argrest, "i") == 0 ||
2957 Ustrcmp(argrest, "itrue") == 0)
2958 dot_ends = FALSE;
2959
2960 /* -oM*: Set various characteristics for an incoming message; actually
2961 acted on for trusted callers only. */
2962
2963 else if (*argrest == 'M')
2964 {
2965 if (i+1 >= argc)
2966 {
2967 fprintf(stderr, "exim: data expected after -o%s\n", argrest);
2968 exit(EXIT_FAILURE);
2969 }
2970
2971 /* -oMa: Set sender host address */
2972
2973 if (Ustrcmp(argrest, "Ma") == 0) sender_host_address = argv[++i];
2974
2975 /* -oMaa: Set authenticator name */
2976
2977 else if (Ustrcmp(argrest, "Maa") == 0)
2978 sender_host_authenticated = argv[++i];
2979
2980 /* -oMas: setting authenticated sender */
2981
2982 else if (Ustrcmp(argrest, "Mas") == 0) authenticated_sender = argv[++i];
2983
2984 /* -oMai: setting authenticated id */
2985
2986 else if (Ustrcmp(argrest, "Mai") == 0) authenticated_id = argv[++i];
2987
2988 /* -oMi: Set incoming interface address */
2989
2990 else if (Ustrcmp(argrest, "Mi") == 0) interface_address = argv[++i];
2991
d2af03f4
HS
2992 /* -oMm: Message reference */
2993
2994 else if (Ustrcmp(argrest, "Mm") == 0)
2995 {
2996 if (!mac_ismsgid(argv[i+1]))
2997 {
2998 fprintf(stderr,"-oMm must be a valid message ID\n");
2999 exit(EXIT_FAILURE);
3000 }
3001 if (!trusted_config)
3002 {
3003 fprintf(stderr,"-oMm must be called by a trusted user/config\n");
3004 exit(EXIT_FAILURE);
3005 }
3006 message_reference = argv[++i];
3007 }
3008
059ec3d9
PH
3009 /* -oMr: Received protocol */
3010
3011 else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i];
3012
3013 /* -oMs: Set sender host name */
3014
3015 else if (Ustrcmp(argrest, "Ms") == 0) sender_host_name = argv[++i];
3016
3017 /* -oMt: Set sender ident */
3018
33d73e3b
PH
3019 else if (Ustrcmp(argrest, "Mt") == 0)
3020 {
3021 sender_ident_set = TRUE;
3022 sender_ident = argv[++i];
3023 }
059ec3d9
PH
3024
3025 /* Else a bad argument */
3026
3027 else
3028 {
3029 badarg = TRUE;
3030 break;
3031 }
3032 }
3033
3034 /* -om: Me-too flag for aliases. Exim always does this. Some programs
3035 seem to call this as -m (undocumented), so that is also accepted (see
3036 above). */
3037
3038 else if (Ustrcmp(argrest, "m") == 0) {}
3039
3040 /* -oo: An ancient flag for old-style addresses which still seems to
3041 crop up in some calls (see in SCO). */
3042
3043 else if (Ustrcmp(argrest, "o") == 0) {}
3044
3045 /* -oP <name>: set pid file path for daemon */
3046
3047 else if (Ustrcmp(argrest, "P") == 0)
3048 override_pid_file_path = argv[++i];
3049
3050 /* -or <n>: set timeout for non-SMTP acceptance
3051 -os <n>: set timeout for SMTP acceptance */
3052
3053 else if (*argrest == 'r' || *argrest == 's')
3054 {
3055 int *tp = (*argrest == 'r')?
3056 &arg_receive_timeout : &arg_smtp_receive_timeout;
3057 if (argrest[1] == 0)
3058 {
3059 if (i+1 < argc) *tp= readconf_readtime(argv[++i], 0, FALSE);
3060 }
3061 else *tp = readconf_readtime(argrest + 1, 0, FALSE);
3062 if (*tp < 0)
3063 {
3064 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3065 exit(EXIT_FAILURE);
3066 }
3067 }
3068
3069 /* -oX <list>: Override local_interfaces and/or default daemon ports */
3070
3071 else if (Ustrcmp(argrest, "X") == 0)
3072 override_local_interfaces = argv[++i];
3073
3074 /* Unknown -o argument */
3075
3076 else badarg = TRUE;
3077 break;
3078
3079
3080 /* -ps: force Perl startup; -pd force delayed Perl startup */
3081
3082 case 'p':
3083 #ifdef EXIM_PERL
3084 if (*argrest == 's' && argrest[1] == 0)
3085 {
3086 perl_start_option = 1;
3087 break;
3088 }
3089 if (*argrest == 'd' && argrest[1] == 0)
3090 {
3091 perl_start_option = -1;
3092 break;
3093 }
3094 #endif
3095
3096 /* -panythingelse is taken as the Sendmail-compatible argument -prval:sval,
3097 which sets the host protocol and host name */
3098
3099 if (*argrest == 0)
3100 {
3101 if (i+1 < argc) argrest = argv[++i]; else
3102 { badarg = TRUE; break; }
3103 }
3104
3105 if (*argrest != 0)
3106 {
3107 uschar *hn = Ustrchr(argrest, ':');
3108 if (hn == NULL)
3109 {
3110 received_protocol = argrest;
3111 }
3112 else
3113 {
3114 received_protocol = string_copyn(argrest, hn - argrest);
3115 sender_host_name = hn + 1;
3116 }
3117 }
3118 break;
3119
3120
3121 case 'q':
3122 receiving_message = FALSE;
3cc66b45
PH
3123 if (queue_interval >= 0)
3124 {
3125 fprintf(stderr, "exim: -q specified more than once\n");
3126 exit(EXIT_FAILURE);
3127 }
059ec3d9
PH
3128
3129 /* -qq...: Do queue runs in a 2-stage manner */
3130
3131 if (*argrest == 'q')
3132 {
3133 queue_2stage = TRUE;
3134 argrest++;
3135 }
3136
3137 /* -qi...: Do only first (initial) deliveries */
3138
3139 if (*argrest == 'i')
3140 {
3141 queue_run_first_delivery = TRUE;
3142 argrest++;
3143 }
3144
3145 /* -qf...: Run the queue, forcing deliveries
3146 -qff..: Ditto, forcing thawing as well */
3147
3148 if (*argrest == 'f')
3149 {
3150 queue_run_force = TRUE;
3151 if (*(++argrest) == 'f')
3152 {
3153 deliver_force_thaw = TRUE;
3154 argrest++;
3155 }
3156 }
3157
3158 /* -q[f][f]l...: Run the queue only on local deliveries */
3159
3160 if (*argrest == 'l')
3161 {
3162 queue_run_local = TRUE;
3163 argrest++;
3164 }
3165
3166 /* -q[f][f][l]: Run the queue, optionally forced, optionally local only,
3167 optionally starting from a given message id. */
3168
3169 if (*argrest == 0 &&
3170 (i + 1 >= argc || argv[i+1][0] == '-' || mac_ismsgid(argv[i+1])))
3171 {
3172 queue_interval = 0;
3173 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3174 start_queue_run_id = argv[++i];
3175 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3176 stop_queue_run_id = argv[++i];
3177 }
3178
3179 /* -q[f][f][l]<n>: Run the queue at regular intervals, optionally forced,
3180 optionally local only. */
3181
3182 else
3183 {
3184 if (*argrest != 0)
3185 queue_interval = readconf_readtime(argrest, 0, FALSE);
3186 else
3187 queue_interval = readconf_readtime(argv[++i], 0, FALSE);
3188 if (queue_interval <= 0)
3189 {
3190 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3191 exit(EXIT_FAILURE);
3192 }
3193 }
3194 break;
3195
3196
3197 case 'R': /* Synonymous with -qR... */
3198 receiving_message = FALSE;
3199
3200 /* -Rf: As -R (below) but force all deliveries,
3201 -Rff: Ditto, but also thaw all frozen messages,
3202 -Rr: String is regex
3203 -Rrf: Regex and force
3204 -Rrff: Regex and force and thaw
3205
3206 in all cases provided there are no further characters in this
3207 argument. */
3208
3209 if (*argrest != 0)
3210 {
3211 int i;
3212 for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
3213 {
3214 if (Ustrcmp(argrest, rsopts[i]) == 0)
3215 {
3216 if (i != 2) queue_run_force = TRUE;
3217 if (i >= 2) deliver_selectstring_regex = TRUE;
3218 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3219 argrest += Ustrlen(rsopts[i]);
3220 }
3221 }
3222 }
3223
3224 /* -R: Set string to match in addresses for forced queue run to
3225 pick out particular messages. */
3226
3227 if (*argrest == 0)
3228 {
3229 if (i+1 < argc) deliver_selectstring = argv[++i]; else
3230 {
3231 fprintf(stderr, "exim: string expected after -R\n");
3232 exit(EXIT_FAILURE);
3233 }
3234 }
3235 else deliver_selectstring = argrest;
059ec3d9
PH
3236 break;
3237
3238
3239 /* -r: an obsolete synonym for -f (see above) */
3240
3241
3242 /* -S: Like -R but works on sender. */
3243
3244 case 'S': /* Synonymous with -qS... */
3245 receiving_message = FALSE;
3246
3247 /* -Sf: As -S (below) but force all deliveries,
3248 -Sff: Ditto, but also thaw all frozen messages,
3249 -Sr: String is regex
3250 -Srf: Regex and force
3251 -Srff: Regex and force and thaw
3252
3253 in all cases provided there are no further characters in this
3254 argument. */
3255
3256 if (*argrest != 0)
3257 {
3258 int i;
3259 for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
3260 {
3261 if (Ustrcmp(argrest, rsopts[i]) == 0)
3262 {
3263 if (i != 2) queue_run_force = TRUE;
3264 if (i >= 2) deliver_selectstring_sender_regex = TRUE;
3265 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3266 argrest += Ustrlen(rsopts[i]);
3267 }
3268 }
3269 }
3270
3271 /* -S: Set string to match in addresses for forced queue run to
3272 pick out particular messages. */
3273
3274 if (*argrest == 0)
3275 {
3276 if (i+1 < argc) deliver_selectstring_sender = argv[++i]; else
3277 {
3278 fprintf(stderr, "exim: string expected after -S\n");
3279 exit(EXIT_FAILURE);
3280 }
3281 }
3282 else deliver_selectstring_sender = argrest;
059ec3d9
PH
3283 break;
3284
3285 /* -Tqt is an option that is exclusively for use by the testing suite.
3286 It is not recognized in other circumstances. It allows for the setting up
3287 of explicit "queue times" so that various warning/retry things can be
3288 tested. Otherwise variability of clock ticks etc. cause problems. */
3289
3290 case 'T':
3291 if (running_in_test_harness && Ustrcmp(argrest, "qt") == 0)
3292 fudged_queue_times = argv[++i];
3293 else badarg = TRUE;
3294 break;
3295
3296
3297 /* -t: Set flag to extract recipients from body of message. */
3298
3299 case 't':
3300 if (*argrest == 0) extract_recipients = TRUE;
3301
3302 /* -ti: Set flag to extract recipients from body of message, and also
3303 specify that dot does not end the message. */
3304
3305 else if (Ustrcmp(argrest, "i") == 0)
3306 {
3307 extract_recipients = TRUE;
3308 dot_ends = FALSE;
3309 }
3310
3311 /* -tls-on-connect: don't wait for STARTTLS (for old clients) */
3312
3313 #ifdef SUPPORT_TLS
817d9f57 3314 else if (Ustrcmp(argrest, "ls-on-connect") == 0) tls_in.on_connect = TRUE;
059ec3d9
PH
3315 #endif
3316
3317 else badarg = TRUE;
3318 break;
3319
3320
3321 /* -U: This means "initial user submission" in sendmail, apparently. The
3322 doc claims that in future sendmail may refuse syntactically invalid
3323 messages instead of fixing them. For the moment, we just ignore it. */
3324
3325 case 'U':
3326 break;
3327
3328
3329 /* -v: verify things - this is a very low-level debugging */
3330
3331 case 'v':
3332 if (*argrest == 0)
3333 {
3334 debug_selector |= D_v;
3335 debug_file = stderr;
3336 }
3337 else badarg = TRUE;
3338 break;
3339
3340
3341 /* -x: AIX uses this to indicate some fancy 8-bit character stuff:
3342
3343 The -x flag tells the sendmail command that mail from a local
3344 mail program has National Language Support (NLS) extended characters
3345 in the body of the mail item. The sendmail command can send mail with
3346 extended NLS characters across networks that normally corrupts these
3347 8-bit characters.
3348
3349 As Exim is 8-bit clean, it just ignores this flag. */
3350
3351 case 'x':
3352 if (*argrest != 0) badarg = TRUE;
3353 break;
3354
a3fb9793
PP
3355 /* -X: in sendmail: takes one parameter, logfile, and sends debugging
3356 logs to that file. We swallow the parameter and otherwise ignore it. */
3357
3358 case 'X':
3359 if (*argrest == '\0')
3360 {
3361 if (++i >= argc)
3362 {
3363 fprintf(stderr, "exim: string expected after -X\n");
3364 exit(EXIT_FAILURE);
3365 }
3366 }
3367 break;
3368
059ec3d9
PH
3369 /* All other initial characters are errors */
3370
3371 default:
3372 badarg = TRUE;
3373 break;
3374 } /* End of high-level switch statement */
3375
3376 /* Failed to recognize the option, or syntax error */
3377
3378 if (badarg)
3379 {
3380 fprintf(stderr, "exim abandoned: unknown, malformed, or incomplete "
3381 "option %s\n", arg);
3382 exit(EXIT_FAILURE);
3383 }
3384 }
3385
3386
3cc66b45
PH
3387/* If -R or -S have been specified without -q, assume a single queue run. */
3388
3389if ((deliver_selectstring != NULL || deliver_selectstring_sender != NULL) &&
3390 queue_interval < 0) queue_interval = 0;
3391
3392
059ec3d9 3393END_ARG:
81ea09ca
NM
3394/* If usage_wanted is set we call the usage function - which never returns */
3395if (usage_wanted) exim_usage(called_as);
3396
3397/* Arguments have been processed. Check for incompatibilities. */
059ec3d9
PH
3398if ((
3399 (smtp_input || extract_recipients || recipients_arg < argc) &&
3400 (daemon_listen || queue_interval >= 0 || bi_option ||
3401 test_retry_arg >= 0 || test_rewrite_arg >= 0 ||
f05da2e8 3402 filter_test != FTEST_NONE || (msg_action_arg > 0 && !one_msg_action))
059ec3d9
PH
3403 ) ||
3404 (
3405 msg_action_arg > 0 &&
0ef732d9
PH
3406 (daemon_listen || queue_interval >= 0 || list_options ||
3407 (checking && msg_action != MSG_LOAD) ||
3408 bi_option || test_retry_arg >= 0 || test_rewrite_arg >= 0)
059ec3d9
PH
3409 ) ||
3410 (
3411 (daemon_listen || queue_interval >= 0) &&
3412 (sender_address != NULL || list_options || list_queue || checking ||
0ef732d9 3413 bi_option)
059ec3d9
PH
3414 ) ||
3415 (
3416 daemon_listen && queue_interval == 0
3417 ) ||
3418 (
9ee44efb
PP
3419 inetd_wait_mode && queue_interval >= 0
3420 ) ||
3421 (
059ec3d9
PH
3422 list_options &&
3423 (checking || smtp_input || extract_recipients ||
f05da2e8 3424 filter_test != FTEST_NONE || bi_option)
059ec3d9
PH
3425 ) ||
3426 (
3427 verify_address_mode &&
3428 (address_test_mode || smtp_input || extract_recipients ||
f05da2e8 3429 filter_test != FTEST_NONE || bi_option)
059ec3d9
PH
3430 ) ||
3431 (
3432 address_test_mode && (smtp_input || extract_recipients ||
f05da2e8 3433 filter_test != FTEST_NONE || bi_option)
059ec3d9
PH
3434 ) ||
3435 (
f05da2e8 3436 smtp_input && (sender_address != NULL || filter_test != FTEST_NONE ||
059ec3d9
PH
3437 extract_recipients)
3438 ) ||
3439 (
3440 deliver_selectstring != NULL && queue_interval < 0
328895cc
PH
3441 ) ||
3442 (
3443 msg_action == MSG_LOAD &&
3444 (!expansion_test || expansion_test_message != NULL)
059ec3d9
PH
3445 )
3446 )
3447 {
3448 fprintf(stderr, "exim: incompatible command-line options or arguments\n");
3449 exit(EXIT_FAILURE);
3450 }
3451
3452/* If debugging is set up, set the file and the file descriptor to pass on to
3453child processes. It should, of course, be 2 for stderr. Also, force the daemon
3454to run in the foreground. */
3455
3456if (debug_selector != 0)
3457 {
3458 debug_file = stderr;
3459 debug_fd = fileno(debug_file);
3460 background_daemon = FALSE;
3461 if (running_in_test_harness) millisleep(100); /* lets caller finish */
3462 if (debug_selector != D_v) /* -v only doesn't show this */
3463 {
3464 debug_printf("Exim version %s uid=%ld gid=%ld pid=%d D=%x\n",
3465 version_string, (long int)real_uid, (long int)real_gid, (int)getpid(),
3466 debug_selector);
6545de78
PP
3467 if (!version_printed)
3468 show_whats_supported(stderr);
059ec3d9
PH
3469 }
3470 }
3471
3472/* When started with root privilege, ensure that the limits on the number of
3473open files and the number of processes (where that is accessible) are
3474sufficiently large, or are unset, in case Exim has been called from an
3475environment where the limits are screwed down. Not all OS have the ability to
3476change some of these limits. */
3477
3478if (unprivileged)
3479 {
3480 DEBUG(D_any) debug_print_ids(US"Exim has no root privilege:");
3481 }
3482else
3483 {
3484 struct rlimit rlp;
3485
3486 #ifdef RLIMIT_NOFILE
3487 if (getrlimit(RLIMIT_NOFILE, &rlp) < 0)
3488 {
3489 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NOFILE) failed: %s",
3490 strerror(errno));
3491 rlp.rlim_cur = rlp.rlim_max = 0;
3492 }
eb2c0248
PH
3493
3494 /* I originally chose 1000 as a nice big number that was unlikely to
a494b1e1
PH
3495 be exceeded. It turns out that some older OS have a fixed upper limit of
3496 256. */
eb2c0248 3497
059ec3d9
PH
3498 if (rlp.rlim_cur < 1000)
3499 {
3500 rlp.rlim_cur = rlp.rlim_max = 1000;
3501 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
eb2c0248 3502 {
a494b1e1
PH
3503 rlp.rlim_cur = rlp.rlim_max = 256;
3504 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3505 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NOFILE) failed: %s",
3506 strerror(errno));
eb2c0248 3507 }
059ec3d9
PH
3508 }
3509 #endif
3510
3511 #ifdef RLIMIT_NPROC
3512 if (getrlimit(RLIMIT_NPROC, &rlp) < 0)
3513 {
3514 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NPROC) failed: %s",
3515 strerror(errno));
3516 rlp.rlim_cur = rlp.rlim_max = 0;
3517 }
3518
3519 #ifdef RLIM_INFINITY
3520 if (rlp.rlim_cur != RLIM_INFINITY && rlp.rlim_cur < 1000)
3521 {
3522 rlp.rlim_cur = rlp.rlim_max = RLIM_INFINITY;
3523 #else
3524 if (rlp.rlim_cur < 1000)
3525 {
3526 rlp.rlim_cur = rlp.rlim_max = 1000;
3527 #endif
3528 if (setrlimit(RLIMIT_NPROC, &rlp) < 0)
3529 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NPROC) failed: %s",
3530 strerror(errno));
3531 }
3532 #endif
3533 }
3534
3535/* Exim is normally entered as root (but some special configurations are
3536possible that don't do this). However, it always spins off sub-processes that
3537set their uid and gid as required for local delivery. We don't want to pass on
3538any extra groups that root may belong to, so we want to get rid of them all at
3539this point.
3540
3541We need to obey setgroups() at this stage, before possibly giving up root
3542privilege for a changed configuration file, but later on we might need to
3543check on the additional groups for the admin user privilege - can't do that
3544till after reading the config, which might specify the exim gid. Therefore,
3545save the group list here first. */
3546
3547group_count = getgroups(NGROUPS_MAX, group_list);
cd59ab18
PP
3548if (group_count < 0)
3549 {
3550 fprintf(stderr, "exim: getgroups() failed: %s\n", strerror(errno));
3551 exit(EXIT_FAILURE);
3552 }
059ec3d9
PH
3553
3554/* There is a fundamental difference in some BSD systems in the matter of
3555groups. FreeBSD and BSDI are known to be different; NetBSD and OpenBSD are
3556known not to be different. On the "different" systems there is a single group
3557list, and the first entry in it is the current group. On all other versions of
3558Unix there is a supplementary group list, which is in *addition* to the current
3559group. Consequently, to get rid of all extraneous groups on a "standard" system
3560you pass over 0 groups to setgroups(), while on a "different" system you pass
3561over a single group - the current group, which is always the first group in the
3562list. Calling setgroups() with zero groups on a "different" system results in
3563an error return. The following code should cope with both types of system.
3564
3565However, if this process isn't running as root, setgroups() can't be used
3566since you have to be root to run it, even if throwing away groups. Not being
3567root here happens only in some unusual configurations. We just ignore the
3568error. */
3569
3570if (setgroups(0, NULL) != 0)
3571 {
3572 if (setgroups(1, group_list) != 0 && !unprivileged)
3573 {
3574 fprintf(stderr, "exim: setgroups() failed: %s\n", strerror(errno));
3575 exit(EXIT_FAILURE);
3576 }
3577 }
3578
3579/* If the configuration file name has been altered by an argument on the
3580command line (either a new file name or a macro definition) and the caller is
cd25e41d
DW
3581not root, or if this is a filter testing run, remove any setuid privilege the
3582program has and run as the underlying user.
059ec3d9 3583
cd25e41d
DW
3584The exim user is locked out of this, which severely restricts the use of -C
3585for some purposes.
059ec3d9
PH
3586
3587Otherwise, set the real ids to the effective values (should be root unless run
3588from inetd, which it can either be root or the exim uid, if one is configured).
3589
3590There is a private mechanism for bypassing some of this, in order to make it
3591possible to test lots of configurations automatically, without having either to
3592recompile each time, or to patch in an actual configuration file name and other
3593values (such as the path name). If running in the test harness, pretend that
3594configuration file changes and macro definitions haven't happened. */
3595
3596if (( /* EITHER */
a7cbbf50
PP
3597 (!trusted_config || /* Config changed, or */
3598 !macros_trusted()) && /* impermissible macros and */
059ec3d9 3599 real_uid != root_uid && /* Not root, and */
059ec3d9
PH
3600 !running_in_test_harness /* Not fudged */
3601 ) || /* OR */
3602 expansion_test /* expansion testing */
3603 || /* OR */
f05da2e8 3604 filter_test != FTEST_NONE) /* Filter testing */
059ec3d9
PH
3605 {
3606 setgroups(group_count, group_list);
3607 exim_setugid(real_uid, real_gid, FALSE,
3608 US"-C, -D, -be or -bf forces real uid");
3609 removed_privilege = TRUE;
3610
3611 /* In the normal case when Exim is called like this, stderr is available
3612 and should be used for any logging information because attempts to write
3613 to the log will usually fail. To arrange this, we unset really_exim. However,
3614 if no stderr is available there is no point - we might as well have a go
b7487bce 3615 at the log (if it fails, syslog will be written).
059ec3d9 3616
b7487bce
PP
3617 Note that if the invoker is Exim, the logs remain available. Messing with
3618 this causes unlogged successful deliveries. */
3619
3620 if ((log_stderr != NULL) && (real_uid != exim_uid))
3621 really_exim = FALSE;
059ec3d9
PH
3622 }
3623
3624/* Privilege is to be retained for the moment. It may be dropped later,
3625depending on the job that this Exim process has been asked to do. For now, set
3626the real uid to the effective so that subsequent re-execs of Exim are done by a
3627privileged user. */
3628
3629else exim_setugid(geteuid(), getegid(), FALSE, US"forcing real = effective");
3630
f05da2e8 3631/* If testing a filter, open the file(s) now, before wasting time doing other
059ec3d9
PH
3632setups and reading the message. */
3633
f05da2e8
PH
3634if ((filter_test & FTEST_SYSTEM) != 0)
3635 {
3636 filter_sfd = Uopen(filter_test_sfile, O_RDONLY, 0);
3637 if (filter_sfd < 0)
3638 {
3639 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_sfile,
3640 strerror(errno));
3641 return EXIT_FAILURE;
3642 }
3643 }
3644
3645if ((filter_test & FTEST_USER) != 0)
059ec3d9 3646 {
f05da2e8
PH
3647 filter_ufd = Uopen(filter_test_ufile, O_RDONLY, 0);
3648 if (filter_ufd < 0)
059ec3d9 3649 {
f05da2e8 3650 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_ufile,
059ec3d9
PH
3651 strerror(errno));
3652 return EXIT_FAILURE;
3653 }
3654 }
3655
8829633f
PP
3656/* Initialise lookup_list
3657If debugging, already called above via version reporting.
3658In either case, we initialise the list of available lookups while running
3659as root. All dynamically modules are loaded from a directory which is
3660hard-coded into the binary and is code which, if not a module, would be
3661part of Exim already. Ability to modify the content of the directory
3662is equivalent to the ability to modify a setuid binary!
3663
3664This needs to happen before we read the main configuration. */
3665init_lookup_list();
3666
059ec3d9
PH
3667/* Read the main runtime configuration data; this gives up if there
3668is a failure. It leaves the configuration file open so that the subsequent
3669configuration data for delivery can be read if needed. */
3670
3671readconf_main();
3672
a3fb9793
PP
3673/* If an action on specific messages is requested, or if a daemon or queue
3674runner is being started, we need to know if Exim was called by an admin user.
3675This is the case if the real user is root or exim, or if the real group is
3676exim, or if one of the supplementary groups is exim or a group listed in
3677admin_groups. We don't fail all message actions immediately if not admin_user,
3678since some actions can be performed by non-admin users. Instead, set admin_user
3679for later interrogation. */
3680
3681if (real_uid == root_uid || real_uid == exim_uid || real_gid == exim_gid)
3682 admin_user = TRUE;
3683else
3684 {
3685 int i, j;
3686 for (i = 0; i < group_count; i++)
3687 {
3688 if (group_list[i] == exim_gid) admin_user = TRUE;
3689 else if (admin_groups != NULL)
3690 {
3691 for (j = 1; j <= (int)(admin_groups[0]); j++)
3692 if (admin_groups[j] == group_list[i])
3693 { admin_user = TRUE; break; }
3694 }
3695 if (admin_user) break;
3696 }
3697 }
3698
3699/* Another group of privileged users are the trusted users. These are root,
3700exim, and any caller matching trusted_users or trusted_groups. Trusted callers
3701are permitted to specify sender_addresses with -f on the command line, and
3702other message parameters as well. */
3703
3704if (real_uid == root_uid || real_uid == exim_uid)
3705 trusted_caller = TRUE;
3706else
3707 {
3708 int i, j;
3709
3710 if (trusted_users != NULL)
3711 {
3712 for (i = 1; i <= (int)(trusted_users[0]); i++)
3713 if (trusted_users[i] == real_uid)
3714 { trusted_caller = TRUE; break; }
3715 }
3716
3717 if (!trusted_caller && trusted_groups != NULL)
3718 {
3719 for (i = 1; i <= (int)(trusted_groups[0]); i++)
3720 {
3721 if (trusted_groups[i] == real_gid)
3722 trusted_caller = TRUE;
3723 else for (j = 0; j < group_count; j++)
3724 {
3725 if (trusted_groups[i] == group_list[j])
3726 { trusted_caller = TRUE; break; }
3727 }
3728 if (trusted_caller) break;
3729 }
3730 }
3731 }
3732
059ec3d9
PH
3733/* Handle the decoding of logging options. */
3734
ed7f7860
PP
3735decode_bits(&log_write_selector, &log_extra_selector, 0, 0,
3736 log_selector_string, log_options, log_options_count, US"log", 0);
059ec3d9
PH
3737
3738DEBUG(D_any)
3739 {
3740 debug_printf("configuration file is %s\n", config_main_filename);
3741 debug_printf("log selectors = %08x %08x\n", log_write_selector,
3742 log_extra_selector);
3743 }
3744
3745/* If domain literals are not allowed, check the sender address that was
3746supplied with -f. Ditto for a stripped trailing dot. */
3747
3748if (sender_address != NULL)
3749 {
3750 if (sender_address[sender_address_domain] == '[' && !allow_domain_literals)
3751 {
3752 fprintf(stderr, "exim: bad -f address \"%s\": domain literals not "
3753 "allowed\n", sender_address);
3754 return EXIT_FAILURE;
3755 }
3756 if (f_end_dot && !strip_trailing_dot)
3757 {
3758 fprintf(stderr, "exim: bad -f address \"%s.\": domain is malformed "
3759 "(trailing dot not allowed)\n", sender_address);
3760 return EXIT_FAILURE;
3761 }
3762 }
3763
a3fb9793
PP
3764/* See if an admin user overrode our logging. */
3765
3766if (cmdline_syslog_name != NULL)
3767 {
3768 if (admin_user)
3769 {
3770 syslog_processname = cmdline_syslog_name;
3771 log_file_path = string_copy(CUS"syslog");
3772 }
3773 else
3774 {
3775 /* not a panic, non-privileged users should not be able to spam paniclog */
3776 fprintf(stderr,
3777 "exim: you lack sufficient privilege to specify syslog process name\n");
3778 return EXIT_FAILURE;
3779 }
3780 }
3781
059ec3d9
PH
3782/* Paranoia check of maximum lengths of certain strings. There is a check
3783on the length of the log file path in log.c, which will come into effect
3784if there are any calls to write the log earlier than this. However, if we
3785get this far but the string is very long, it is better to stop now than to
3786carry on and (e.g.) receive a message and then have to collapse. The call to
3787log_write() from here will cause the ultimate panic collapse if the complete
3788file name exceeds the buffer length. */
3789
3790if (Ustrlen(log_file_path) > 200)
3791 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3792 "log_file_path is longer than 200 chars: aborting");
3793
3794if (Ustrlen(pid_file_path) > 200)
3795 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3796 "pid_file_path is longer than 200 chars: aborting");
3797
3798if (Ustrlen(spool_directory) > 200)
3799 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3800 "spool_directory is longer than 200 chars: aborting");
3801
3802/* Length check on the process name given to syslog for its TAG field,
3803which is only permitted to be 32 characters or less. See RFC 3164. */
3804
3805if (Ustrlen(syslog_processname) > 32)
3806 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3807 "syslog_processname is longer than 32 chars: aborting");
3808
3809/* In some operating systems, the environment variable TMPDIR controls where
3810temporary files are created; Exim doesn't use these (apart from when delivering
3811to MBX mailboxes), but called libraries such as DBM libraries may require them.
3812If TMPDIR is found in the environment, reset it to the value defined in the
3813TMPDIR macro, if this macro is defined. */
3814
3815#ifdef TMPDIR
3816 {
3817 uschar **p;
3818 for (p = USS environ; *p != NULL; p++)
3819 {
3820 if (Ustrncmp(*p, "TMPDIR=", 7) == 0 &&
3821 Ustrcmp(*p+7, TMPDIR) != 0)
3822 {
3823 uschar *newp = malloc(Ustrlen(TMPDIR) + 8);
3824 sprintf(CS newp, "TMPDIR=%s", TMPDIR);
3825 *p = newp;
3826 DEBUG(D_any) debug_printf("reset TMPDIR=%s in environment\n", TMPDIR);
3827 }
3828 }
3829 }
3830#endif
3831
3832/* Timezone handling. If timezone_string is "utc", set a flag to cause all
3833timestamps to be in UTC (gmtime() is used instead of localtime()). Otherwise,
3834we may need to get rid of a bogus timezone setting. This can arise when Exim is
3835called by a user who has set the TZ variable. This then affects the timestamps
3836in log files and in Received: headers, and any created Date: header lines. The
3837required timezone is settable in the configuration file, so nothing can be done
3838about this earlier - but hopefully nothing will normally be logged earlier than
3839this. We have to make a new environment if TZ is wrong, but don't bother if
3840timestamps_utc is set, because then all times are in UTC anyway. */
3841
3842if (timezone_string != NULL && strcmpic(timezone_string, US"UTC") == 0)
3843 {
3844 timestamps_utc = TRUE;
3845 }
3846else
3847 {
3848 uschar *envtz = US getenv("TZ");
3849 if ((envtz == NULL && timezone_string != NULL) ||
3850 (envtz != NULL &&
3851 (timezone_string == NULL ||
3852 Ustrcmp(timezone_string, envtz) != 0)))
3853 {
3854 uschar **p = USS environ;
3855 uschar **new;
3856 uschar **newp;
3857 int count = 0;
3858 while (*p++ != NULL) count++;
3859 if (envtz == NULL) count++;
3860 newp = new = malloc(sizeof(uschar *) * (count + 1));
3861 for (p = USS environ; *p != NULL; p++)
3862 {
3863 if (Ustrncmp(*p, "TZ=", 3) == 0) continue;
3864 *newp++ = *p;
3865 }
3866 if (timezone_string != NULL)
3867 {
3868 *newp = malloc(Ustrlen(timezone_string) + 4);
3869 sprintf(CS *newp++, "TZ=%s", timezone_string);
3870 }
3871 *newp = NULL;
3872 environ = CSS new;
3873 tzset();
3874 DEBUG(D_any) debug_printf("Reset TZ to %s: time is %s\n", timezone_string,
3875 tod_stamp(tod_log));
3876 }
3877 }
3878
3879/* Handle the case when we have removed the setuid privilege because of -C or
cd25e41d 3880-D. This means that the caller of Exim was not root.
059ec3d9 3881
cd25e41d
DW
3882There is a problem if we were running as the Exim user. The sysadmin may
3883expect this case to retain privilege because "the binary was called by the
3884Exim user", but it hasn't, because either the -D option set macros, or the
261dc43e 3885-C option set a non-trusted configuration file. There are two possibilities:
059ec3d9
PH
3886
3887 (1) If deliver_drop_privilege is set, Exim is not going to re-exec in order
3888 to do message deliveries. Thus, the fact that it is running as a
3889 non-privileged user is plausible, and might be wanted in some special
3890 configurations. However, really_exim will have been set false when
3891 privilege was dropped, to stop Exim trying to write to its normal log
3892 files. Therefore, re-enable normal log processing, assuming the sysadmin
3893 has set up the log directory correctly.
3894
3895 (2) If deliver_drop_privilege is not set, the configuration won't work as
3896 apparently intended, and so we log a panic message. In order to retain
261dc43e
DW
3897 root for -C or -D, the caller must either be root or be invoking a
3898 trusted configuration file (when deliver_drop_privilege is false). */
059ec3d9 3899
e2f5dc15 3900if (removed_privilege && (!trusted_config || macros != NULL) &&
059ec3d9
PH
3901 real_uid == exim_uid)
3902 {
059ec3d9
PH
3903 if (deliver_drop_privilege)
3904 really_exim = TRUE; /* let logging work normally */
3905 else
3906 log_write(0, LOG_MAIN|LOG_PANIC,
cd25e41d 3907 "exim user lost privilege for using %s option",
90b6341f 3908 trusted_config? "-D" : "-C");
059ec3d9
PH
3909 }
3910
3911/* Start up Perl interpreter if Perl support is configured and there is a
3912perl_startup option, and the configuration or the command line specifies
3913initializing starting. Note that the global variables are actually called
3914opt_perl_xxx to avoid clashing with perl's namespace (perl_*). */
3915
3916#ifdef EXIM_PERL
3917if (perl_start_option != 0)
3918 opt_perl_at_start = (perl_start_option > 0);
3919if (opt_perl_at_start && opt_perl_startup != NULL)
3920 {
3921 uschar *errstr;
3922 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
3923 errstr = init_perl(opt_perl_startup);
3924 if (errstr != NULL)
3925 {
3926 fprintf(stderr, "exim: error in perl_startup code: %s\n", errstr);
3927 return EXIT_FAILURE;
3928 }
3929 opt_perl_started = TRUE;
3930 }
3931#endif /* EXIM_PERL */
3932
3933/* Log the arguments of the call if the configuration file said so. This is
3934a debugging feature for finding out what arguments certain MUAs actually use.
3935Don't attempt it if logging is disabled, or if listing variables or if
3936verifying/testing addresses or expansions. */
3937
31619da6
PH
3938if (((debug_selector & D_any) != 0 || (log_extra_selector & LX_arguments) != 0)
3939 && really_exim && !list_options && !checking)
059ec3d9
PH
3940 {
3941 int i;
3942 uschar *p = big_buffer;
1ac6b2e7
JH
3943 char * dummy;
3944 Ustrcpy(p, "cwd= (failed)");
3945 dummy = /* quieten compiler */ getcwd(CS p+4, big_buffer_size - 4);
059ec3d9
PH
3946 while (*p) p++;
3947 (void)string_format(p, big_buffer_size - (p - big_buffer), " %d args:", argc);
3948 while (*p) p++;
3949 for (i = 0; i < argc; i++)
3950 {
3951 int len = Ustrlen(argv[i]);
3952 uschar *printing;
3953 uschar *quote;
3954 if (p + len + 8 >= big_buffer + big_buffer_size)
3955 {
3956 Ustrcpy(p, " ...");
3957 log_write(0, LOG_MAIN, "%s", big_buffer);
3958 Ustrcpy(big_buffer, "...");
3959 p = big_buffer + 3;
3960 }
3961 printing = string_printing(argv[i]);
3962 if (printing[0] == 0) quote = US"\""; else
3963 {
3964 uschar *pp = printing;
3965 quote = US"";
3966 while (*pp != 0) if (isspace(*pp++)) { quote = US"\""; break; }
3967 }
3968 sprintf(CS p, " %s%.*s%s", quote, (int)(big_buffer_size -
3969 (p - big_buffer) - 4), printing, quote);
3970 while (*p) p++;
3971 }
31619da6
PH
3972
3973 if ((log_extra_selector & LX_arguments) != 0)
3974 log_write(0, LOG_MAIN, "%s", big_buffer);
3975 else
3976 debug_printf("%s\n", big_buffer);
059ec3d9
PH
3977 }
3978
3979/* Set the working directory to be the top-level spool directory. We don't rely
3980on this in the code, which always uses fully qualified names, but it's useful
3981for core dumps etc. Don't complain if it fails - the spool directory might not
3982be generally accessible and calls with the -C option (and others) have lost
ba18e66a
PH
3983privilege by now. Before the chdir, we try to ensure that the directory exists.
3984*/
059ec3d9
PH
3985
3986if (Uchdir(spool_directory) != 0)
3987 {
1ac6b2e7 3988 int dummy;
ba18e66a 3989 (void)directory_make(spool_directory, US"", SPOOL_DIRECTORY_MODE, FALSE);
1ac6b2e7 3990 dummy = /* quieten compiler */ Uchdir(spool_directory);
059ec3d9
PH
3991 }
3992
3993/* Handle calls with the -bi option. This is a sendmail option to rebuild *the*
3994alias file. Exim doesn't have such a concept, but this call is screwed into
3995Sun's YP makefiles. Handle this by calling a configured script, as the real
3996user who called Exim. The -oA option can be used to pass an argument to the
3997script. */
3998
3999if (bi_option)
4000 {
1fe64dcc 4001 (void)fclose(config_file);
059ec3d9
PH
4002 if (bi_command != NULL)
4003 {
4004 int i = 0;
4005 uschar *argv[3];
4006 argv[i++] = bi_command;
4007 if (alias_arg != NULL) argv[i++] = alias_arg;
4008 argv[i++] = NULL;
4009
4010 setgroups(group_count, group_list);
4011 exim_setugid(real_uid, real_gid, FALSE, US"running bi_command");
4012
4013 DEBUG(D_exec) debug_printf("exec %.256s %.256s\n", argv[0],
4014 (argv[1] == NULL)? US"" : argv[1]);
4015
4016 execv(CS argv[0], (char *const *)argv);
4017 fprintf(stderr, "exim: exec failed: %s\n", strerror(errno));
4018 exit(EXIT_FAILURE);
4019 }
4020 else
4021 {
4022 DEBUG(D_any) debug_printf("-bi used but bi_command not set; exiting\n");
4023 exit(EXIT_SUCCESS);
4024 }
4025 }
4026
a3fb9793
PP
4027/* We moved the admin/trusted check to be immediately after reading the
4028configuration file. We leave these prints here to ensure that syslog setup,
4029logfile setup, and so on has already happened. */
059ec3d9
PH
4030
4031if (trusted_caller) DEBUG(D_any) debug_printf("trusted user\n");
4032if (admin_user) DEBUG(D_any) debug_printf("admin user\n");
4033
4034/* Only an admin user may start the daemon or force a queue run in the default
4035configuration, but the queue run restriction can be relaxed. Only an admin
4036user may request that a message be returned to its sender forthwith. Only an
4037admin user may specify a debug level greater than D_v (because it might show
4038passwords, etc. in lookup queries). Only an admin user may request a queue