1f450c533826a2c232f4b3ec360010bae143b1b4
[exim.git] / src / src / exim.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8
9 /* The main function: entry point, initialization, and high-level control.
10 Also a few functions that don't naturally fit elsewhere. */
11
12
13 #include "exim.h"
14
15 #ifdef __GLIBC__
16 # include <gnu/libc-version.h>
17 #endif
18
19 #ifdef USE_GNUTLS
20 # include <gnutls/gnutls.h>
21 # if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
22 # define DISABLE_OCSP
23 # endif
24 #endif
25
26 extern void init_lookup_list(void);
27
28
29
30 /*************************************************
31 * Function interface to store functions *
32 *************************************************/
33
34 /* We need some real functions to pass to the PCRE regular expression library
35 for store allocation via Exim's store manager. The normal calls are actually
36 macros that pass over location information to make tracing easier. These
37 functions just interface to the standard macro calls. A good compiler will
38 optimize out the tail recursion and so not make them too expensive. There
39 are two sets of functions; one for use when we want to retain the compiled
40 regular expression for a long time; the other for short-term use. */
41
42 static void *
43 function_store_get(size_t size)
44 {
45 return store_get((int)size);
46 }
47
48 static void
49 function_dummy_free(void *block) { block = block; }
50
51 static void *
52 function_store_malloc(size_t size)
53 {
54 return store_malloc((int)size);
55 }
56
57 static void
58 function_store_free(void *block)
59 {
60 store_free(block);
61 }
62
63
64
65
66 /*************************************************
67 * Enums for cmdline interface *
68 *************************************************/
69
70 enum commandline_info { CMDINFO_NONE=0,
71 CMDINFO_HELP, CMDINFO_SIEVE, CMDINFO_DSCP };
72
73
74
75
76 /*************************************************
77 * Compile regular expression and panic on fail *
78 *************************************************/
79
80 /* This function is called when failure to compile a regular expression leads
81 to a panic exit. In other cases, pcre_compile() is called directly. In many
82 cases where this function is used, the results of the compilation are to be
83 placed in long-lived store, so we temporarily reset the store management
84 functions that PCRE uses if the use_malloc flag is set.
85
86 Argument:
87 pattern the pattern to compile
88 caseless TRUE if caseless matching is required
89 use_malloc TRUE if compile into malloc store
90
91 Returns: pointer to the compiled pattern
92 */
93
94 const pcre *
95 regex_must_compile(const uschar *pattern, BOOL caseless, BOOL use_malloc)
96 {
97 int offset;
98 int options = PCRE_COPT;
99 const pcre *yield;
100 const uschar *error;
101 if (use_malloc)
102 {
103 pcre_malloc = function_store_malloc;
104 pcre_free = function_store_free;
105 }
106 if (caseless) options |= PCRE_CASELESS;
107 yield = pcre_compile(CCS pattern, options, (const char **)&error, &offset, NULL);
108 pcre_malloc = function_store_get;
109 pcre_free = function_dummy_free;
110 if (yield == NULL)
111 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "regular expression error: "
112 "%s at offset %d while compiling %s", error, offset, pattern);
113 return yield;
114 }
115
116
117
118
119 /*************************************************
120 * Execute regular expression and set strings *
121 *************************************************/
122
123 /* This function runs a regular expression match, and sets up the pointers to
124 the matched substrings.
125
126 Arguments:
127 re the compiled expression
128 subject the subject string
129 options additional PCRE options
130 setup if < 0 do full setup
131 if >= 0 setup from setup+1 onwards,
132 excluding the full matched string
133
134 Returns: TRUE or FALSE
135 */
136
137 BOOL
138 regex_match_and_setup(const pcre *re, const uschar *subject, int options, int setup)
139 {
140 int ovector[3*(EXPAND_MAXN+1)];
141 uschar * s = string_copy(subject); /* de-constifying */
142 int n = pcre_exec(re, NULL, CS s, Ustrlen(s), 0,
143 PCRE_EOPT | options, ovector, sizeof(ovector)/sizeof(int));
144 BOOL yield = n >= 0;
145 if (n == 0) n = EXPAND_MAXN + 1;
146 if (yield)
147 {
148 int nn;
149 expand_nmax = (setup < 0)? 0 : setup + 1;
150 for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
151 {
152 expand_nstring[expand_nmax] = s + ovector[nn];
153 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
154 }
155 expand_nmax--;
156 }
157 return yield;
158 }
159
160
161
162
163 /*************************************************
164 * Set up processing details *
165 *************************************************/
166
167 /* Save a text string for dumping when SIGUSR1 is received.
168 Do checks for overruns.
169
170 Arguments: format and arguments, as for printf()
171 Returns: nothing
172 */
173
174 void
175 set_process_info(const char *format, ...)
176 {
177 int len = sprintf(CS process_info, "%5d ", (int)getpid());
178 va_list ap;
179 va_start(ap, format);
180 if (!string_vformat(process_info + len, PROCESS_INFO_SIZE - len - 2, format, ap))
181 Ustrcpy(process_info + len, "**** string overflowed buffer ****");
182 len = Ustrlen(process_info);
183 process_info[len+0] = '\n';
184 process_info[len+1] = '\0';
185 process_info_len = len + 1;
186 DEBUG(D_process_info) debug_printf("set_process_info: %s", process_info);
187 va_end(ap);
188 }
189
190
191
192
193 /*************************************************
194 * Handler for SIGUSR1 *
195 *************************************************/
196
197 /* SIGUSR1 causes any exim process to write to the process log details of
198 what it is currently doing. It will only be used if the OS is capable of
199 setting up a handler that causes automatic restarting of any system call
200 that is in progress at the time.
201
202 This function takes care to be signal-safe.
203
204 Argument: the signal number (SIGUSR1)
205 Returns: nothing
206 */
207
208 static void
209 usr1_handler(int sig)
210 {
211 int fd;
212
213 os_restarting_signal(sig, usr1_handler);
214
215 fd = Uopen(process_log_path, O_APPEND|O_WRONLY, LOG_MODE);
216 if (fd < 0)
217 {
218 /* If we are already running as the Exim user, try to create it in the
219 current process (assuming spool_directory exists). Otherwise, if we are
220 root, do the creation in an exim:exim subprocess. */
221
222 int euid = geteuid();
223 if (euid == exim_uid)
224 fd = Uopen(process_log_path, O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
225 else if (euid == root_uid)
226 fd = log_create_as_exim(process_log_path);
227 }
228
229 /* If we are neither exim nor root, or if we failed to create the log file,
230 give up. There is not much useful we can do with errors, since we don't want
231 to disrupt whatever is going on outside the signal handler. */
232
233 if (fd < 0) return;
234
235 (void)write(fd, process_info, process_info_len);
236 (void)close(fd);
237 }
238
239
240
241 /*************************************************
242 * Timeout handler *
243 *************************************************/
244
245 /* This handler is enabled most of the time that Exim is running. The handler
246 doesn't actually get used unless alarm() has been called to set a timer, to
247 place a time limit on a system call of some kind. When the handler is run, it
248 re-enables itself.
249
250 There are some other SIGALRM handlers that are used in special cases when more
251 than just a flag setting is required; for example, when reading a message's
252 input. These are normally set up in the code module that uses them, and the
253 SIGALRM handler is reset to this one afterwards.
254
255 Argument: the signal value (SIGALRM)
256 Returns: nothing
257 */
258
259 void
260 sigalrm_handler(int sig)
261 {
262 sig = sig; /* Keep picky compilers happy */
263 sigalrm_seen = TRUE;
264 os_non_restarting_signal(SIGALRM, sigalrm_handler);
265 }
266
267
268
269 /*************************************************
270 * Sleep for a fractional time interval *
271 *************************************************/
272
273 /* This function is called by millisleep() and exim_wait_tick() to wait for a
274 period of time that may include a fraction of a second. The coding is somewhat
275 tedious. We do not expect setitimer() ever to fail, but if it does, the process
276 will wait for ever, so we panic in this instance. (There was a case of this
277 when a bug in a function that calls milliwait() caused it to pass invalid data.
278 That's when I added the check. :-)
279
280 We assume it to be not worth sleeping for under 100us; this value will
281 require revisiting as hardware advances. This avoids the issue of
282 a zero-valued timer setting meaning "never fire".
283
284 Argument: an itimerval structure containing the interval
285 Returns: nothing
286 */
287
288 static void
289 milliwait(struct itimerval *itval)
290 {
291 sigset_t sigmask;
292 sigset_t old_sigmask;
293
294 if (itval->it_value.tv_usec < 100 && itval->it_value.tv_sec == 0)
295 return;
296 (void)sigemptyset(&sigmask); /* Empty mask */
297 (void)sigaddset(&sigmask, SIGALRM); /* Add SIGALRM */
298 (void)sigprocmask(SIG_BLOCK, &sigmask, &old_sigmask); /* Block SIGALRM */
299 if (setitimer(ITIMER_REAL, itval, NULL) < 0) /* Start timer */
300 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
301 "setitimer() failed: %s", strerror(errno));
302 (void)sigfillset(&sigmask); /* All signals */
303 (void)sigdelset(&sigmask, SIGALRM); /* Remove SIGALRM */
304 (void)sigsuspend(&sigmask); /* Until SIGALRM */
305 (void)sigprocmask(SIG_SETMASK, &old_sigmask, NULL); /* Restore mask */
306 }
307
308
309
310
311 /*************************************************
312 * Millisecond sleep function *
313 *************************************************/
314
315 /* The basic sleep() function has a granularity of 1 second, which is too rough
316 in some cases - for example, when using an increasing delay to slow down
317 spammers.
318
319 Argument: number of millseconds
320 Returns: nothing
321 */
322
323 void
324 millisleep(int msec)
325 {
326 struct itimerval itval;
327 itval.it_interval.tv_sec = 0;
328 itval.it_interval.tv_usec = 0;
329 itval.it_value.tv_sec = msec/1000;
330 itval.it_value.tv_usec = (msec % 1000) * 1000;
331 milliwait(&itval);
332 }
333
334
335
336 /*************************************************
337 * Compare microsecond times *
338 *************************************************/
339
340 /*
341 Arguments:
342 tv1 the first time
343 tv2 the second time
344
345 Returns: -1, 0, or +1
346 */
347
348 int
349 exim_tvcmp(struct timeval *t1, struct timeval *t2)
350 {
351 if (t1->tv_sec > t2->tv_sec) return +1;
352 if (t1->tv_sec < t2->tv_sec) return -1;
353 if (t1->tv_usec > t2->tv_usec) return +1;
354 if (t1->tv_usec < t2->tv_usec) return -1;
355 return 0;
356 }
357
358
359
360
361 /*************************************************
362 * Clock tick wait function *
363 *************************************************/
364
365 /* Exim uses a time + a pid to generate a unique identifier in two places: its
366 message IDs, and in file names for maildir deliveries. Because some OS now
367 re-use pids within the same second, sub-second times are now being used.
368 However, for absolute certainty, we must ensure the clock has ticked before
369 allowing the relevant process to complete. At the time of implementation of
370 this code (February 2003), the speed of processors is such that the clock will
371 invariably have ticked already by the time a process has done its job. This
372 function prepares for the time when things are faster - and it also copes with
373 clocks that go backwards.
374
375 Arguments:
376 then_tv A timeval which was used to create uniqueness; its usec field
377 has been rounded down to the value of the resolution.
378 We want to be sure the current time is greater than this.
379 resolution The resolution that was used to divide the microseconds
380 (1 for maildir, larger for message ids)
381
382 Returns: nothing
383 */
384
385 void
386 exim_wait_tick(struct timeval *then_tv, int resolution)
387 {
388 struct timeval now_tv;
389 long int now_true_usec;
390
391 (void)gettimeofday(&now_tv, NULL);
392 now_true_usec = now_tv.tv_usec;
393 now_tv.tv_usec = (now_true_usec/resolution) * resolution;
394
395 if (exim_tvcmp(&now_tv, then_tv) <= 0)
396 {
397 struct itimerval itval;
398 itval.it_interval.tv_sec = 0;
399 itval.it_interval.tv_usec = 0;
400 itval.it_value.tv_sec = then_tv->tv_sec - now_tv.tv_sec;
401 itval.it_value.tv_usec = then_tv->tv_usec + resolution - now_true_usec;
402
403 /* We know that, overall, "now" is less than or equal to "then". Therefore, a
404 negative value for the microseconds is possible only in the case when "now"
405 is more than a second less than "then". That means that itval.it_value.tv_sec
406 is greater than zero. The following correction is therefore safe. */
407
408 if (itval.it_value.tv_usec < 0)
409 {
410 itval.it_value.tv_usec += 1000000;
411 itval.it_value.tv_sec -= 1;
412 }
413
414 DEBUG(D_transport|D_receive)
415 {
416 if (!running_in_test_harness)
417 {
418 debug_printf("tick check: " TIME_T_FMT ".%06lu " TIME_T_FMT ".%06lu\n",
419 then_tv->tv_sec, (long) then_tv->tv_usec,
420 now_tv.tv_sec, (long) now_tv.tv_usec);
421 debug_printf("waiting " TIME_T_FMT ".%06lu\n",
422 itval.it_value.tv_sec, (long) itval.it_value.tv_usec);
423 }
424 }
425
426 milliwait(&itval);
427 }
428 }
429
430
431
432
433 /*************************************************
434 * Call fopen() with umask 777 and adjust mode *
435 *************************************************/
436
437 /* Exim runs with umask(0) so that files created with open() have the mode that
438 is specified in the open() call. However, there are some files, typically in
439 the spool directory, that are created with fopen(). They end up world-writeable
440 if no precautions are taken. Although the spool directory is not accessible to
441 the world, this is an untidiness. So this is a wrapper function for fopen()
442 that sorts out the mode of the created file.
443
444 Arguments:
445 filename the file name
446 options the fopen() options
447 mode the required mode
448
449 Returns: the fopened FILE or NULL
450 */
451
452 FILE *
453 modefopen(const uschar *filename, const char *options, mode_t mode)
454 {
455 mode_t saved_umask = umask(0777);
456 FILE *f = Ufopen(filename, options);
457 (void)umask(saved_umask);
458 if (f != NULL) (void)fchmod(fileno(f), mode);
459 return f;
460 }
461
462
463
464
465 /*************************************************
466 * Ensure stdin, stdout, and stderr exist *
467 *************************************************/
468
469 /* Some operating systems grumble if an exec() happens without a standard
470 input, output, and error (fds 0, 1, 2) being defined. The worry is that some
471 file will be opened and will use these fd values, and then some other bit of
472 code will assume, for example, that it can write error messages to stderr.
473 This function ensures that fds 0, 1, and 2 are open if they do not already
474 exist, by connecting them to /dev/null.
475
476 This function is also used to ensure that std{in,out,err} exist at all times,
477 so that if any library that Exim calls tries to use them, it doesn't crash.
478
479 Arguments: None
480 Returns: Nothing
481 */
482
483 void
484 exim_nullstd(void)
485 {
486 int i;
487 int devnull = -1;
488 struct stat statbuf;
489 for (i = 0; i <= 2; i++)
490 {
491 if (fstat(i, &statbuf) < 0 && errno == EBADF)
492 {
493 if (devnull < 0) devnull = open("/dev/null", O_RDWR);
494 if (devnull < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
495 string_open_failed(errno, "/dev/null"));
496 if (devnull != i) (void)dup2(devnull, i);
497 }
498 }
499 if (devnull > 2) (void)close(devnull);
500 }
501
502
503
504
505 /*************************************************
506 * Close unwanted file descriptors for delivery *
507 *************************************************/
508
509 /* This function is called from a new process that has been forked to deliver
510 an incoming message, either directly, or using exec.
511
512 We want any smtp input streams to be closed in this new process. However, it
513 has been observed that using fclose() here causes trouble. When reading in -bS
514 input, duplicate copies of messages have been seen. The files will be sharing a
515 file pointer with the parent process, and it seems that fclose() (at least on
516 some systems - I saw this on Solaris 2.5.1) messes with that file pointer, at
517 least sometimes. Hence we go for closing the underlying file descriptors.
518
519 If TLS is active, we want to shut down the TLS library, but without molesting
520 the parent's SSL connection.
521
522 For delivery of a non-SMTP message, we want to close stdin and stdout (and
523 stderr unless debugging) because the calling process might have set them up as
524 pipes and be waiting for them to close before it waits for the submission
525 process to terminate. If they aren't closed, they hold up the calling process
526 until the initial delivery process finishes, which is not what we want.
527
528 Exception: We do want it for synchronous delivery!
529
530 And notwithstanding all the above, if D_resolver is set, implying resolver
531 debugging, leave stdout open, because that's where the resolver writes its
532 debugging output.
533
534 When we close stderr (which implies we've also closed stdout), we also get rid
535 of any controlling terminal.
536
537 Arguments: None
538 Returns: Nothing
539 */
540
541 static void
542 close_unwanted(void)
543 {
544 if (smtp_input)
545 {
546 #ifdef SUPPORT_TLS
547 tls_close(TRUE, FALSE); /* Shut down the TLS library */
548 #endif
549 (void)close(fileno(smtp_in));
550 (void)close(fileno(smtp_out));
551 smtp_in = NULL;
552 }
553 else
554 {
555 (void)close(0); /* stdin */
556 if ((debug_selector & D_resolver) == 0) (void)close(1); /* stdout */
557 if (debug_selector == 0) /* stderr */
558 {
559 if (!synchronous_delivery)
560 {
561 (void)close(2);
562 log_stderr = NULL;
563 }
564 (void)setsid();
565 }
566 }
567 }
568
569
570
571
572 /*************************************************
573 * Set uid and gid *
574 *************************************************/
575
576 /* This function sets a new uid and gid permanently, optionally calling
577 initgroups() to set auxiliary groups. There are some special cases when running
578 Exim in unprivileged modes. In these situations the effective uid will not be
579 root; if we already have the right effective uid/gid, and don't need to
580 initialize any groups, leave things as they are.
581
582 Arguments:
583 uid the uid
584 gid the gid
585 igflag TRUE if initgroups() wanted
586 msg text to use in debugging output and failure log
587
588 Returns: nothing; bombs out on failure
589 */
590
591 void
592 exim_setugid(uid_t uid, gid_t gid, BOOL igflag, uschar *msg)
593 {
594 uid_t euid = geteuid();
595 gid_t egid = getegid();
596
597 if (euid == root_uid || euid != uid || egid != gid || igflag)
598 {
599 /* At least one OS returns +1 for initgroups failure, so just check for
600 non-zero. */
601
602 if (igflag)
603 {
604 struct passwd *pw = getpwuid(uid);
605 if (pw != NULL)
606 {
607 if (initgroups(pw->pw_name, gid) != 0)
608 log_write(0,LOG_MAIN|LOG_PANIC_DIE,"initgroups failed for uid=%ld: %s",
609 (long int)uid, strerror(errno));
610 }
611 else log_write(0, LOG_MAIN|LOG_PANIC_DIE, "cannot run initgroups(): "
612 "no passwd entry for uid=%ld", (long int)uid);
613 }
614
615 if (setgid(gid) < 0 || setuid(uid) < 0)
616 {
617 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to set gid=%ld or uid=%ld "
618 "(euid=%ld): %s", (long int)gid, (long int)uid, (long int)euid, msg);
619 }
620 }
621
622 /* Debugging output included uid/gid and all groups */
623
624 DEBUG(D_uid)
625 {
626 int group_count, save_errno;
627 gid_t group_list[NGROUPS_MAX];
628 debug_printf("changed uid/gid: %s\n uid=%ld gid=%ld pid=%ld\n", msg,
629 (long int)geteuid(), (long int)getegid(), (long int)getpid());
630 group_count = getgroups(NGROUPS_MAX, group_list);
631 save_errno = errno;
632 debug_printf(" auxiliary group list:");
633 if (group_count > 0)
634 {
635 int i;
636 for (i = 0; i < group_count; i++) debug_printf(" %d", (int)group_list[i]);
637 }
638 else if (group_count < 0)
639 debug_printf(" <error: %s>", strerror(save_errno));
640 else debug_printf(" <none>");
641 debug_printf("\n");
642 }
643 }
644
645
646
647
648 /*************************************************
649 * Exit point *
650 *************************************************/
651
652 /* Exim exits via this function so that it always clears up any open
653 databases.
654
655 Arguments:
656 rc return code
657
658 Returns: does not return
659 */
660
661 void
662 exim_exit(int rc)
663 {
664 search_tidyup();
665 DEBUG(D_any)
666 debug_printf(">>>>>>>>>>>>>>>> Exim pid=%d terminating with rc=%d "
667 ">>>>>>>>>>>>>>>>\n", (int)getpid(), rc);
668 exit(rc);
669 }
670
671
672
673
674 /*************************************************
675 * Extract port from host address *
676 *************************************************/
677
678 /* Called to extract the port from the values given to -oMa and -oMi.
679 It also checks the syntax of the address, and terminates it before the
680 port data when a port is extracted.
681
682 Argument:
683 address the address, with possible port on the end
684
685 Returns: the port, or zero if there isn't one
686 bombs out on a syntax error
687 */
688
689 static int
690 check_port(uschar *address)
691 {
692 int port = host_address_extract_port(address);
693 if (string_is_ip_address(address, NULL) == 0)
694 {
695 fprintf(stderr, "exim abandoned: \"%s\" is not an IP address\n", address);
696 exit(EXIT_FAILURE);
697 }
698 return port;
699 }
700
701
702
703 /*************************************************
704 * Test/verify an address *
705 *************************************************/
706
707 /* This function is called by the -bv and -bt code. It extracts a working
708 address from a full RFC 822 address. This isn't really necessary per se, but it
709 has the effect of collapsing source routes.
710
711 Arguments:
712 s the address string
713 flags flag bits for verify_address()
714 exit_value to be set for failures
715
716 Returns: nothing
717 */
718
719 static void
720 test_address(uschar *s, int flags, int *exit_value)
721 {
722 int start, end, domain;
723 uschar *parse_error = NULL;
724 uschar *address = parse_extract_address(s, &parse_error, &start, &end, &domain,
725 FALSE);
726 if (address == NULL)
727 {
728 fprintf(stdout, "syntax error: %s\n", parse_error);
729 *exit_value = 2;
730 }
731 else
732 {
733 int rc = verify_address(deliver_make_addr(address,TRUE), stdout, flags, -1,
734 -1, -1, NULL, NULL, NULL);
735 if (rc == FAIL) *exit_value = 2;
736 else if (rc == DEFER && *exit_value == 0) *exit_value = 1;
737 }
738 }
739
740
741
742 /*************************************************
743 * Show supported features *
744 *************************************************/
745
746 /* This function is called for -bV/--version and for -d to output the optional
747 features of the current Exim binary.
748
749 Arguments: a FILE for printing
750 Returns: nothing
751 */
752
753 static void
754 show_whats_supported(FILE *f)
755 {
756 auth_info *authi;
757
758 #ifdef DB_VERSION_STRING
759 fprintf(f, "Berkeley DB: %s\n", DB_VERSION_STRING);
760 #elif defined(BTREEVERSION) && defined(HASHVERSION)
761 #ifdef USE_DB
762 fprintf(f, "Probably Berkeley DB version 1.8x (native mode)\n");
763 #else
764 fprintf(f, "Probably Berkeley DB version 1.8x (compatibility mode)\n");
765 #endif
766 #elif defined(_DBM_RDONLY) || defined(dbm_dirfno)
767 fprintf(f, "Probably ndbm\n");
768 #elif defined(USE_TDB)
769 fprintf(f, "Using tdb\n");
770 #else
771 #ifdef USE_GDBM
772 fprintf(f, "Probably GDBM (native mode)\n");
773 #else
774 fprintf(f, "Probably GDBM (compatibility mode)\n");
775 #endif
776 #endif
777
778 fprintf(f, "Support for:");
779 #ifdef SUPPORT_CRYPTEQ
780 fprintf(f, " crypteq");
781 #endif
782 #if HAVE_ICONV
783 fprintf(f, " iconv()");
784 #endif
785 #if HAVE_IPV6
786 fprintf(f, " IPv6");
787 #endif
788 #ifdef HAVE_SETCLASSRESOURCES
789 fprintf(f, " use_setclassresources");
790 #endif
791 #ifdef SUPPORT_PAM
792 fprintf(f, " PAM");
793 #endif
794 #ifdef EXIM_PERL
795 fprintf(f, " Perl");
796 #endif
797 #ifdef EXPAND_DLFUNC
798 fprintf(f, " Expand_dlfunc");
799 #endif
800 #ifdef USE_TCP_WRAPPERS
801 fprintf(f, " TCPwrappers");
802 #endif
803 #ifdef SUPPORT_TLS
804 #ifdef USE_GNUTLS
805 fprintf(f, " GnuTLS");
806 #else
807 fprintf(f, " OpenSSL");
808 #endif
809 #endif
810 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
811 fprintf(f, " translate_ip_address");
812 #endif
813 #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
814 fprintf(f, " move_frozen_messages");
815 #endif
816 #ifdef WITH_CONTENT_SCAN
817 fprintf(f, " Content_Scanning");
818 #endif
819 #ifndef DISABLE_DKIM
820 fprintf(f, " DKIM");
821 #endif
822 #ifndef DISABLE_DNSSEC
823 fprintf(f, " DNSSEC");
824 #endif
825 #ifndef DISABLE_EVENT
826 fprintf(f, " Event");
827 #endif
828 #ifdef SUPPORT_I18N
829 fprintf(f, " I18N");
830 #endif
831 #ifndef DISABLE_OCSP
832 fprintf(f, " OCSP");
833 #endif
834 #ifndef DISABLE_PRDR
835 fprintf(f, " PRDR");
836 #endif
837 #ifdef SUPPORT_PROXY
838 fprintf(f, " PROXY");
839 #endif
840 #ifdef SUPPORT_SOCKS
841 fprintf(f, " SOCKS");
842 #endif
843 #ifdef TCP_FASTOPEN
844 fprintf(f, " TCP_Fast_Open");
845 #endif
846 #ifdef EXPERIMENTAL_LMDB
847 fprintf(f, " Experimental_LMDB");
848 #endif
849 #ifdef EXPERIMENTAL_QUEUEFILE
850 fprintf(f, " Experimental_QUEUEFILE");
851 #endif
852 #ifdef EXPERIMENTAL_SPF
853 fprintf(f, " Experimental_SPF");
854 #endif
855 #ifdef EXPERIMENTAL_SRS
856 fprintf(f, " Experimental_SRS");
857 #endif
858 #ifdef EXPERIMENTAL_BRIGHTMAIL
859 fprintf(f, " Experimental_Brightmail");
860 #endif
861 #ifdef EXPERIMENTAL_DANE
862 fprintf(f, " Experimental_DANE");
863 #endif
864 #ifdef EXPERIMENTAL_DCC
865 fprintf(f, " Experimental_DCC");
866 #endif
867 #ifdef EXPERIMENTAL_DMARC
868 fprintf(f, " Experimental_DMARC");
869 #endif
870 #ifdef EXPERIMENTAL_DSN_INFO
871 fprintf(f, " Experimental_DSN_info");
872 #endif
873 fprintf(f, "\n");
874
875 fprintf(f, "Lookups (built-in):");
876 #if defined(LOOKUP_LSEARCH) && LOOKUP_LSEARCH!=2
877 fprintf(f, " lsearch wildlsearch nwildlsearch iplsearch");
878 #endif
879 #if defined(LOOKUP_CDB) && LOOKUP_CDB!=2
880 fprintf(f, " cdb");
881 #endif
882 #if defined(LOOKUP_DBM) && LOOKUP_DBM!=2
883 fprintf(f, " dbm dbmjz dbmnz");
884 #endif
885 #if defined(LOOKUP_DNSDB) && LOOKUP_DNSDB!=2
886 fprintf(f, " dnsdb");
887 #endif
888 #if defined(LOOKUP_DSEARCH) && LOOKUP_DSEARCH!=2
889 fprintf(f, " dsearch");
890 #endif
891 #if defined(LOOKUP_IBASE) && LOOKUP_IBASE!=2
892 fprintf(f, " ibase");
893 #endif
894 #if defined(LOOKUP_LDAP) && LOOKUP_LDAP!=2
895 fprintf(f, " ldap ldapdn ldapm");
896 #endif
897 #ifdef EXPERIMENTAL_LMDB
898 fprintf(f, " lmdb");
899 #endif
900 #if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
901 fprintf(f, " mysql");
902 #endif
903 #if defined(LOOKUP_NIS) && LOOKUP_NIS!=2
904 fprintf(f, " nis nis0");
905 #endif
906 #if defined(LOOKUP_NISPLUS) && LOOKUP_NISPLUS!=2
907 fprintf(f, " nisplus");
908 #endif
909 #if defined(LOOKUP_ORACLE) && LOOKUP_ORACLE!=2
910 fprintf(f, " oracle");
911 #endif
912 #if defined(LOOKUP_PASSWD) && LOOKUP_PASSWD!=2
913 fprintf(f, " passwd");
914 #endif
915 #if defined(LOOKUP_PGSQL) && LOOKUP_PGSQL!=2
916 fprintf(f, " pgsql");
917 #endif
918 #if defined(LOOKUP_REDIS) && LOOKUP_REDIS!=2
919 fprintf(f, " redis");
920 #endif
921 #if defined(LOOKUP_SQLITE) && LOOKUP_SQLITE!=2
922 fprintf(f, " sqlite");
923 #endif
924 #if defined(LOOKUP_TESTDB) && LOOKUP_TESTDB!=2
925 fprintf(f, " testdb");
926 #endif
927 #if defined(LOOKUP_WHOSON) && LOOKUP_WHOSON!=2
928 fprintf(f, " whoson");
929 #endif
930 fprintf(f, "\n");
931
932 fprintf(f, "Authenticators:");
933 #ifdef AUTH_CRAM_MD5
934 fprintf(f, " cram_md5");
935 #endif
936 #ifdef AUTH_CYRUS_SASL
937 fprintf(f, " cyrus_sasl");
938 #endif
939 #ifdef AUTH_DOVECOT
940 fprintf(f, " dovecot");
941 #endif
942 #ifdef AUTH_GSASL
943 fprintf(f, " gsasl");
944 #endif
945 #ifdef AUTH_HEIMDAL_GSSAPI
946 fprintf(f, " heimdal_gssapi");
947 #endif
948 #ifdef AUTH_PLAINTEXT
949 fprintf(f, " plaintext");
950 #endif
951 #ifdef AUTH_SPA
952 fprintf(f, " spa");
953 #endif
954 #ifdef AUTH_TLS
955 fprintf(f, " tls");
956 #endif
957 fprintf(f, "\n");
958
959 fprintf(f, "Routers:");
960 #ifdef ROUTER_ACCEPT
961 fprintf(f, " accept");
962 #endif
963 #ifdef ROUTER_DNSLOOKUP
964 fprintf(f, " dnslookup");
965 #endif
966 #ifdef ROUTER_IPLITERAL
967 fprintf(f, " ipliteral");
968 #endif
969 #ifdef ROUTER_IPLOOKUP
970 fprintf(f, " iplookup");
971 #endif
972 #ifdef ROUTER_MANUALROUTE
973 fprintf(f, " manualroute");
974 #endif
975 #ifdef ROUTER_QUERYPROGRAM
976 fprintf(f, " queryprogram");
977 #endif
978 #ifdef ROUTER_REDIRECT
979 fprintf(f, " redirect");
980 #endif
981 fprintf(f, "\n");
982
983 fprintf(f, "Transports:");
984 #ifdef TRANSPORT_APPENDFILE
985 fprintf(f, " appendfile");
986 #ifdef SUPPORT_MAILDIR
987 fprintf(f, "/maildir");
988 #endif
989 #ifdef SUPPORT_MAILSTORE
990 fprintf(f, "/mailstore");
991 #endif
992 #ifdef SUPPORT_MBX
993 fprintf(f, "/mbx");
994 #endif
995 #endif
996 #ifdef TRANSPORT_AUTOREPLY
997 fprintf(f, " autoreply");
998 #endif
999 #ifdef TRANSPORT_LMTP
1000 fprintf(f, " lmtp");
1001 #endif
1002 #ifdef TRANSPORT_PIPE
1003 fprintf(f, " pipe");
1004 #endif
1005 #ifdef EXPERIMENTAL_QUEUEFILE
1006 fprintf(f, " queuefile");
1007 #endif
1008 #ifdef TRANSPORT_SMTP
1009 fprintf(f, " smtp");
1010 #endif
1011 fprintf(f, "\n");
1012
1013 if (fixed_never_users[0] > 0)
1014 {
1015 int i;
1016 fprintf(f, "Fixed never_users: ");
1017 for (i = 1; i <= (int)fixed_never_users[0] - 1; i++)
1018 fprintf(f, "%d:", (unsigned int)fixed_never_users[i]);
1019 fprintf(f, "%d\n", (unsigned int)fixed_never_users[i]);
1020 }
1021
1022 fprintf(f, "Configure owner: %d:%d\n", config_uid, config_gid);
1023
1024 fprintf(f, "Size of off_t: " SIZE_T_FMT "\n", sizeof(off_t));
1025
1026 /* Everything else is details which are only worth reporting when debugging.
1027 Perhaps the tls_version_report should move into this too. */
1028 DEBUG(D_any) do {
1029
1030 int i;
1031
1032 /* clang defines __GNUC__ (at least, for me) so test for it first */
1033 #if defined(__clang__)
1034 fprintf(f, "Compiler: CLang [%s]\n", __clang_version__);
1035 #elif defined(__GNUC__)
1036 fprintf(f, "Compiler: GCC [%s]\n",
1037 # ifdef __VERSION__
1038 __VERSION__
1039 # else
1040 "? unknown version ?"
1041 # endif
1042 );
1043 #else
1044 fprintf(f, "Compiler: <unknown>\n");
1045 #endif
1046
1047 #ifdef __GLIBC__
1048 fprintf(f, "Library version: Glibc: Compile: %d.%d\n",
1049 __GLIBC__, __GLIBC_MINOR__);
1050 if (__GLIBC_PREREQ(2, 1))
1051 fprintf(f, " Runtime: %s\n",
1052 gnu_get_libc_version());
1053 #endif
1054
1055 #ifdef SUPPORT_TLS
1056 tls_version_report(f);
1057 #endif
1058 #ifdef SUPPORT_I18N
1059 utf8_version_report(f);
1060 #endif
1061
1062 for (authi = auths_available; *authi->driver_name != '\0'; ++authi)
1063 if (authi->version_report)
1064 (*authi->version_report)(f);
1065
1066 /* PCRE_PRERELEASE is either defined and empty or a bare sequence of
1067 characters; unless it's an ancient version of PCRE in which case it
1068 is not defined. */
1069 #ifndef PCRE_PRERELEASE
1070 # define PCRE_PRERELEASE
1071 #endif
1072 #define QUOTE(X) #X
1073 #define EXPAND_AND_QUOTE(X) QUOTE(X)
1074 fprintf(f, "Library version: PCRE: Compile: %d.%d%s\n"
1075 " Runtime: %s\n",
1076 PCRE_MAJOR, PCRE_MINOR,
1077 EXPAND_AND_QUOTE(PCRE_PRERELEASE) "",
1078 pcre_version());
1079 #undef QUOTE
1080 #undef EXPAND_AND_QUOTE
1081
1082 init_lookup_list();
1083 for (i = 0; i < lookup_list_count; i++)
1084 if (lookup_list[i]->version_report)
1085 lookup_list[i]->version_report(f);
1086
1087 #ifdef WHITELIST_D_MACROS
1088 fprintf(f, "WHITELIST_D_MACROS: \"%s\"\n", WHITELIST_D_MACROS);
1089 #else
1090 fprintf(f, "WHITELIST_D_MACROS unset\n");
1091 #endif
1092 #ifdef TRUSTED_CONFIG_LIST
1093 fprintf(f, "TRUSTED_CONFIG_LIST: \"%s\"\n", TRUSTED_CONFIG_LIST);
1094 #else
1095 fprintf(f, "TRUSTED_CONFIG_LIST unset\n");
1096 #endif
1097
1098 } while (0);
1099 }
1100
1101
1102 /*************************************************
1103 * Show auxiliary information about Exim *
1104 *************************************************/
1105
1106 static void
1107 show_exim_information(enum commandline_info request, FILE *stream)
1108 {
1109 const uschar **pp;
1110
1111 switch(request)
1112 {
1113 case CMDINFO_NONE:
1114 fprintf(stream, "Oops, something went wrong.\n");
1115 return;
1116 case CMDINFO_HELP:
1117 fprintf(stream,
1118 "The -bI: flag takes a string indicating which information to provide.\n"
1119 "If the string is not recognised, you'll get this help (on stderr).\n"
1120 "\n"
1121 " exim -bI:help this information\n"
1122 " exim -bI:dscp dscp value keywords known\n"
1123 " exim -bI:sieve list of supported sieve extensions, one per line.\n"
1124 );
1125 return;
1126 case CMDINFO_SIEVE:
1127 for (pp = exim_sieve_extension_list; *pp; ++pp)
1128 fprintf(stream, "%s\n", *pp);
1129 return;
1130 case CMDINFO_DSCP:
1131 dscp_list_to_stream(stream);
1132 return;
1133 }
1134 }
1135
1136
1137 /*************************************************
1138 * Quote a local part *
1139 *************************************************/
1140
1141 /* This function is used when a sender address or a From: or Sender: header
1142 line is being created from the caller's login, or from an authenticated_id. It
1143 applies appropriate quoting rules for a local part.
1144
1145 Argument: the local part
1146 Returns: the local part, quoted if necessary
1147 */
1148
1149 uschar *
1150 local_part_quote(uschar *lpart)
1151 {
1152 BOOL needs_quote = FALSE;
1153 int size, ptr;
1154 uschar *yield;
1155 uschar *t;
1156
1157 for (t = lpart; !needs_quote && *t != 0; t++)
1158 {
1159 needs_quote = !isalnum(*t) && strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
1160 (*t != '.' || t == lpart || t[1] == 0);
1161 }
1162
1163 if (!needs_quote) return lpart;
1164
1165 size = ptr = 0;
1166 yield = string_catn(NULL, &size, &ptr, US"\"", 1);
1167
1168 for (;;)
1169 {
1170 uschar *nq = US Ustrpbrk(lpart, "\\\"");
1171 if (nq == NULL)
1172 {
1173 yield = string_cat(yield, &size, &ptr, lpart);
1174 break;
1175 }
1176 yield = string_catn(yield, &size, &ptr, lpart, nq - lpart);
1177 yield = string_catn(yield, &size, &ptr, US"\\", 1);
1178 yield = string_catn(yield, &size, &ptr, nq, 1);
1179 lpart = nq + 1;
1180 }
1181
1182 yield = string_catn(yield, &size, &ptr, US"\"", 1);
1183 yield[ptr] = 0;
1184 return yield;
1185 }
1186
1187
1188
1189 #ifdef USE_READLINE
1190 /*************************************************
1191 * Load readline() functions *
1192 *************************************************/
1193
1194 /* This function is called from testing executions that read data from stdin,
1195 but only when running as the calling user. Currently, only -be does this. The
1196 function loads the readline() function library and passes back the functions.
1197 On some systems, it needs the curses library, so load that too, but try without
1198 it if loading fails. All this functionality has to be requested at build time.
1199
1200 Arguments:
1201 fn_readline_ptr pointer to where to put the readline pointer
1202 fn_addhist_ptr pointer to where to put the addhistory function
1203
1204 Returns: the dlopen handle or NULL on failure
1205 */
1206
1207 static void *
1208 set_readline(char * (**fn_readline_ptr)(const char *),
1209 void (**fn_addhist_ptr)(const char *))
1210 {
1211 void *dlhandle;
1212 void *dlhandle_curses = dlopen("libcurses." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_LAZY);
1213
1214 dlhandle = dlopen("libreadline." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_NOW);
1215 if (dlhandle_curses != NULL) dlclose(dlhandle_curses);
1216
1217 if (dlhandle != NULL)
1218 {
1219 /* Checked manual pages; at least in GNU Readline 6.1, the prototypes are:
1220 * char * readline (const char *prompt);
1221 * void add_history (const char *string);
1222 */
1223 *fn_readline_ptr = (char *(*)(const char*))dlsym(dlhandle, "readline");
1224 *fn_addhist_ptr = (void(*)(const char*))dlsym(dlhandle, "add_history");
1225 }
1226 else
1227 {
1228 DEBUG(D_any) debug_printf("failed to load readline: %s\n", dlerror());
1229 }
1230
1231 return dlhandle;
1232 }
1233 #endif
1234
1235
1236
1237 /*************************************************
1238 * Get a line from stdin for testing things *
1239 *************************************************/
1240
1241 /* This function is called when running tests that can take a number of lines
1242 of input (for example, -be and -bt). It handles continuations and trailing
1243 spaces. And prompting and a blank line output on eof. If readline() is in use,
1244 the arguments are non-NULL and provide the relevant functions.
1245
1246 Arguments:
1247 fn_readline readline function or NULL
1248 fn_addhist addhist function or NULL
1249
1250 Returns: pointer to dynamic memory, or NULL at end of file
1251 */
1252
1253 static uschar *
1254 get_stdinput(char *(*fn_readline)(const char *), void(*fn_addhist)(const char *))
1255 {
1256 int i;
1257 int size = 0;
1258 int ptr = 0;
1259 uschar *yield = NULL;
1260
1261 if (fn_readline == NULL) { printf("> "); fflush(stdout); }
1262
1263 for (i = 0;; i++)
1264 {
1265 uschar buffer[1024];
1266 uschar *p, *ss;
1267
1268 #ifdef USE_READLINE
1269 char *readline_line = NULL;
1270 if (fn_readline != NULL)
1271 {
1272 if ((readline_line = fn_readline((i > 0)? "":"> ")) == NULL) break;
1273 if (*readline_line != 0 && fn_addhist != NULL) fn_addhist(readline_line);
1274 p = US readline_line;
1275 }
1276 else
1277 #endif
1278
1279 /* readline() not in use */
1280
1281 {
1282 if (Ufgets(buffer, sizeof(buffer), stdin) == NULL) break;
1283 p = buffer;
1284 }
1285
1286 /* Handle the line */
1287
1288 ss = p + (int)Ustrlen(p);
1289 while (ss > p && isspace(ss[-1])) ss--;
1290
1291 if (i > 0)
1292 {
1293 while (p < ss && isspace(*p)) p++; /* leading space after cont */
1294 }
1295
1296 yield = string_catn(yield, &size, &ptr, p, ss - p);
1297
1298 #ifdef USE_READLINE
1299 if (fn_readline != NULL) free(readline_line);
1300 #endif
1301
1302 /* yield can only be NULL if ss==p */
1303 if (ss == p || yield[ptr-1] != '\\')
1304 {
1305 if (yield) yield[ptr] = 0;
1306 break;
1307 }
1308 yield[--ptr] = 0;
1309 }
1310
1311 if (yield == NULL) printf("\n");
1312 return yield;
1313 }
1314
1315
1316
1317 /*************************************************
1318 * Output usage information for the program *
1319 *************************************************/
1320
1321 /* This function is called when there are no recipients
1322 or a specific --help argument was added.
1323
1324 Arguments:
1325 progname information on what name we were called by
1326
1327 Returns: DOES NOT RETURN
1328 */
1329
1330 static void
1331 exim_usage(uschar *progname)
1332 {
1333
1334 /* Handle specific program invocation variants */
1335 if (Ustrcmp(progname, US"-mailq") == 0)
1336 {
1337 fprintf(stderr,
1338 "mailq - list the contents of the mail queue\n\n"
1339 "For a list of options, see the Exim documentation.\n");
1340 exit(EXIT_FAILURE);
1341 }
1342
1343 /* Generic usage - we output this whatever happens */
1344 fprintf(stderr,
1345 "Exim is a Mail Transfer Agent. It is normally called by Mail User Agents,\n"
1346 "not directly from a shell command line. Options and/or arguments control\n"
1347 "what it does when called. For a list of options, see the Exim documentation.\n");
1348
1349 exit(EXIT_FAILURE);
1350 }
1351
1352
1353
1354 /*************************************************
1355 * Validate that the macros given are okay *
1356 *************************************************/
1357
1358 /* Typically, Exim will drop privileges if macros are supplied. In some
1359 cases, we want to not do so.
1360
1361 Arguments: opt_D_used - true if the commandline had a "-D" option
1362 Returns: true if trusted, false otherwise
1363 */
1364
1365 static BOOL
1366 macros_trusted(BOOL opt_D_used)
1367 {
1368 #ifdef WHITELIST_D_MACROS
1369 macro_item *m;
1370 uschar *whitelisted, *end, *p, **whites, **w;
1371 int white_count, i, n;
1372 size_t len;
1373 BOOL prev_char_item, found;
1374 #endif
1375
1376 if (!opt_D_used)
1377 return TRUE;
1378 #ifndef WHITELIST_D_MACROS
1379 return FALSE;
1380 #else
1381
1382 /* We only trust -D overrides for some invoking users:
1383 root, the exim run-time user, the optional config owner user.
1384 I don't know why config-owner would be needed, but since they can own the
1385 config files anyway, there's no security risk to letting them override -D. */
1386 if ( ! ((real_uid == root_uid)
1387 || (real_uid == exim_uid)
1388 #ifdef CONFIGURE_OWNER
1389 || (real_uid == config_uid)
1390 #endif
1391 ))
1392 {
1393 debug_printf("macros_trusted rejecting macros for uid %d\n", (int) real_uid);
1394 return FALSE;
1395 }
1396
1397 /* Get a list of macros which are whitelisted */
1398 whitelisted = string_copy_malloc(US WHITELIST_D_MACROS);
1399 prev_char_item = FALSE;
1400 white_count = 0;
1401 for (p = whitelisted; *p != '\0'; ++p)
1402 {
1403 if (*p == ':' || isspace(*p))
1404 {
1405 *p = '\0';
1406 if (prev_char_item)
1407 ++white_count;
1408 prev_char_item = FALSE;
1409 continue;
1410 }
1411 if (!prev_char_item)
1412 prev_char_item = TRUE;
1413 }
1414 end = p;
1415 if (prev_char_item)
1416 ++white_count;
1417 if (!white_count)
1418 return FALSE;
1419 whites = store_malloc(sizeof(uschar *) * (white_count+1));
1420 for (p = whitelisted, i = 0; (p != end) && (i < white_count); ++p)
1421 {
1422 if (*p != '\0')
1423 {
1424 whites[i++] = p;
1425 if (i == white_count)
1426 break;
1427 while (*p != '\0' && p < end)
1428 ++p;
1429 }
1430 }
1431 whites[i] = NULL;
1432
1433 /* The list of commandline macros should be very short.
1434 Accept the N*M complexity. */
1435 for (m = macros; m; m = m->next) if (m->command_line)
1436 {
1437 found = FALSE;
1438 for (w = whites; *w; ++w)
1439 if (Ustrcmp(*w, m->name) == 0)
1440 {
1441 found = TRUE;
1442 break;
1443 }
1444 if (!found)
1445 return FALSE;
1446 if (m->replacement == NULL)
1447 continue;
1448 len = Ustrlen(m->replacement);
1449 if (len == 0)
1450 continue;
1451 n = pcre_exec(regex_whitelisted_macro, NULL, CS m->replacement, len,
1452 0, PCRE_EOPT, NULL, 0);
1453 if (n < 0)
1454 {
1455 if (n != PCRE_ERROR_NOMATCH)
1456 debug_printf("macros_trusted checking %s returned %d\n", m->name, n);
1457 return FALSE;
1458 }
1459 }
1460 DEBUG(D_any) debug_printf("macros_trusted overridden to true by whitelisting\n");
1461 return TRUE;
1462 #endif
1463 }
1464
1465
1466 /*************************************************
1467 * Entry point and high-level code *
1468 *************************************************/
1469
1470 /* Entry point for the Exim mailer. Analyse the arguments and arrange to take
1471 the appropriate action. All the necessary functions are present in the one
1472 binary. I originally thought one should split it up, but it turns out that so
1473 much of the apparatus is needed in each chunk that one might as well just have
1474 it all available all the time, which then makes the coding easier as well.
1475
1476 Arguments:
1477 argc count of entries in argv
1478 argv argument strings, with argv[0] being the program name
1479
1480 Returns: EXIT_SUCCESS if terminated successfully
1481 EXIT_FAILURE otherwise, except when a message has been sent
1482 to the sender, and -oee was given
1483 */
1484
1485 int
1486 main(int argc, char **cargv)
1487 {
1488 uschar **argv = USS cargv;
1489 int arg_receive_timeout = -1;
1490 int arg_smtp_receive_timeout = -1;
1491 int arg_error_handling = error_handling;
1492 int filter_sfd = -1;
1493 int filter_ufd = -1;
1494 int group_count;
1495 int i, rv;
1496 int list_queue_option = 0;
1497 int msg_action = 0;
1498 int msg_action_arg = -1;
1499 int namelen = (argv[0] == NULL)? 0 : Ustrlen(argv[0]);
1500 int queue_only_reason = 0;
1501 #ifdef EXIM_PERL
1502 int perl_start_option = 0;
1503 #endif
1504 int recipients_arg = argc;
1505 int sender_address_domain = 0;
1506 int test_retry_arg = -1;
1507 int test_rewrite_arg = -1;
1508 BOOL arg_queue_only = FALSE;
1509 BOOL bi_option = FALSE;
1510 BOOL checking = FALSE;
1511 BOOL count_queue = FALSE;
1512 BOOL expansion_test = FALSE;
1513 BOOL extract_recipients = FALSE;
1514 BOOL flag_G = FALSE;
1515 BOOL flag_n = FALSE;
1516 BOOL forced_delivery = FALSE;
1517 BOOL f_end_dot = FALSE;
1518 BOOL deliver_give_up = FALSE;
1519 BOOL list_queue = FALSE;
1520 BOOL list_options = FALSE;
1521 BOOL list_config = FALSE;
1522 BOOL local_queue_only;
1523 BOOL more = TRUE;
1524 BOOL one_msg_action = FALSE;
1525 BOOL opt_D_used = FALSE;
1526 BOOL queue_only_set = FALSE;
1527 BOOL receiving_message = TRUE;
1528 BOOL sender_ident_set = FALSE;
1529 BOOL session_local_queue_only;
1530 BOOL unprivileged;
1531 BOOL removed_privilege = FALSE;
1532 BOOL usage_wanted = FALSE;
1533 BOOL verify_address_mode = FALSE;
1534 BOOL verify_as_sender = FALSE;
1535 BOOL version_printed = FALSE;
1536 uschar *alias_arg = NULL;
1537 uschar *called_as = US"";
1538 uschar *cmdline_syslog_name = NULL;
1539 uschar *start_queue_run_id = NULL;
1540 uschar *stop_queue_run_id = NULL;
1541 uschar *expansion_test_message = NULL;
1542 uschar *ftest_domain = NULL;
1543 uschar *ftest_localpart = NULL;
1544 uschar *ftest_prefix = NULL;
1545 uschar *ftest_suffix = NULL;
1546 uschar *log_oneline = NULL;
1547 uschar *malware_test_file = NULL;
1548 uschar *real_sender_address;
1549 uschar *originator_home = US"/";
1550 size_t sz;
1551 void *reset_point;
1552
1553 struct passwd *pw;
1554 struct stat statbuf;
1555 pid_t passed_qr_pid = (pid_t)0;
1556 int passed_qr_pipe = -1;
1557 gid_t group_list[NGROUPS_MAX];
1558
1559 /* For the -bI: flag */
1560 enum commandline_info info_flag = CMDINFO_NONE;
1561 BOOL info_stdout = FALSE;
1562
1563 /* Possible options for -R and -S */
1564
1565 static uschar *rsopts[] = { US"f", US"ff", US"r", US"rf", US"rff" };
1566
1567 /* Need to define this in case we need to change the environment in order
1568 to get rid of a bogus time zone. We have to make it char rather than uschar
1569 because some OS define it in /usr/include/unistd.h. */
1570
1571 extern char **environ;
1572
1573 /* If the Exim user and/or group and/or the configuration file owner/group were
1574 defined by ref:name at build time, we must now find the actual uid/gid values.
1575 This is a feature to make the lives of binary distributors easier. */
1576
1577 #ifdef EXIM_USERNAME
1578 if (route_finduser(US EXIM_USERNAME, &pw, &exim_uid))
1579 {
1580 if (exim_uid == 0)
1581 {
1582 fprintf(stderr, "exim: refusing to run with uid 0 for \"%s\"\n",
1583 EXIM_USERNAME);
1584 exit(EXIT_FAILURE);
1585 }
1586 /* If ref:name uses a number as the name, route_finduser() returns
1587 TRUE with exim_uid set and pw coerced to NULL. */
1588 if (pw)
1589 exim_gid = pw->pw_gid;
1590 #ifndef EXIM_GROUPNAME
1591 else
1592 {
1593 fprintf(stderr,
1594 "exim: ref:name should specify a usercode, not a group.\n"
1595 "exim: can't let you get away with it unless you also specify a group.\n");
1596 exit(EXIT_FAILURE);
1597 }
1598 #endif
1599 }
1600 else
1601 {
1602 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1603 EXIM_USERNAME);
1604 exit(EXIT_FAILURE);
1605 }
1606 #endif
1607
1608 #ifdef EXIM_GROUPNAME
1609 if (!route_findgroup(US EXIM_GROUPNAME, &exim_gid))
1610 {
1611 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1612 EXIM_GROUPNAME);
1613 exit(EXIT_FAILURE);
1614 }
1615 #endif
1616
1617 #ifdef CONFIGURE_OWNERNAME
1618 if (!route_finduser(US CONFIGURE_OWNERNAME, NULL, &config_uid))
1619 {
1620 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1621 CONFIGURE_OWNERNAME);
1622 exit(EXIT_FAILURE);
1623 }
1624 #endif
1625
1626 /* We default the system_filter_user to be the Exim run-time user, as a
1627 sane non-root value. */
1628 system_filter_uid = exim_uid;
1629
1630 #ifdef CONFIGURE_GROUPNAME
1631 if (!route_findgroup(US CONFIGURE_GROUPNAME, &config_gid))
1632 {
1633 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1634 CONFIGURE_GROUPNAME);
1635 exit(EXIT_FAILURE);
1636 }
1637 #endif
1638
1639 /* In the Cygwin environment, some initialization used to need doing.
1640 It was fudged in by means of this macro; now no longer but we'll leave
1641 it in case of others. */
1642
1643 #ifdef OS_INIT
1644 OS_INIT
1645 #endif
1646
1647 /* Check a field which is patched when we are running Exim within its
1648 testing harness; do a fast initial check, and then the whole thing. */
1649
1650 running_in_test_harness =
1651 *running_status == '<' && Ustrcmp(running_status, "<<<testing>>>") == 0;
1652
1653 /* The C standard says that the equivalent of setlocale(LC_ALL, "C") is obeyed
1654 at the start of a program; however, it seems that some environments do not
1655 follow this. A "strange" locale can affect the formatting of timestamps, so we
1656 make quite sure. */
1657
1658 setlocale(LC_ALL, "C");
1659
1660 /* Set up the default handler for timing using alarm(). */
1661
1662 os_non_restarting_signal(SIGALRM, sigalrm_handler);
1663
1664 /* Ensure we have a buffer for constructing log entries. Use malloc directly,
1665 because store_malloc writes a log entry on failure. */
1666
1667 if (!(log_buffer = US malloc(LOG_BUFFER_SIZE)))
1668 {
1669 fprintf(stderr, "exim: failed to get store for log buffer\n");
1670 exit(EXIT_FAILURE);
1671 }
1672
1673 /* Initialize the default log options. */
1674
1675 bits_set(log_selector, log_selector_size, log_default);
1676
1677 /* Set log_stderr to stderr, provided that stderr exists. This gets reset to
1678 NULL when the daemon is run and the file is closed. We have to use this
1679 indirection, because some systems don't allow writing to the variable "stderr".
1680 */
1681
1682 if (fstat(fileno(stderr), &statbuf) >= 0) log_stderr = stderr;
1683
1684 /* Arrange for the PCRE regex library to use our store functions. Note that
1685 the normal calls are actually macros that add additional arguments for
1686 debugging purposes so we have to assign specially constructed functions here.
1687 The default is to use store in the stacking pool, but this is overridden in the
1688 regex_must_compile() function. */
1689
1690 pcre_malloc = function_store_get;
1691 pcre_free = function_dummy_free;
1692
1693 /* Ensure there is a big buffer for temporary use in several places. It is put
1694 in malloc store so that it can be freed for enlargement if necessary. */
1695
1696 big_buffer = store_malloc(big_buffer_size);
1697
1698 /* Set up the handler for the data request signal, and set the initial
1699 descriptive text. */
1700
1701 set_process_info("initializing");
1702 os_restarting_signal(SIGUSR1, usr1_handler);
1703
1704 /* SIGHUP is used to get the daemon to reconfigure. It gets set as appropriate
1705 in the daemon code. For the rest of Exim's uses, we ignore it. */
1706
1707 signal(SIGHUP, SIG_IGN);
1708
1709 /* We don't want to die on pipe errors as the code is written to handle
1710 the write error instead. */
1711
1712 signal(SIGPIPE, SIG_IGN);
1713
1714 /* Under some circumstance on some OS, Exim can get called with SIGCHLD
1715 set to SIG_IGN. This causes subprocesses that complete before the parent
1716 process waits for them not to hang around, so when Exim calls wait(), nothing
1717 is there. The wait() code has been made robust against this, but let's ensure
1718 that SIGCHLD is set to SIG_DFL, because it's tidier to wait and get a process
1719 ending status. We use sigaction rather than plain signal() on those OS where
1720 SA_NOCLDWAIT exists, because we want to be sure it is turned off. (There was a
1721 problem on AIX with this.) */
1722
1723 #ifdef SA_NOCLDWAIT
1724 {
1725 struct sigaction act;
1726 act.sa_handler = SIG_DFL;
1727 sigemptyset(&(act.sa_mask));
1728 act.sa_flags = 0;
1729 sigaction(SIGCHLD, &act, NULL);
1730 }
1731 #else
1732 signal(SIGCHLD, SIG_DFL);
1733 #endif
1734
1735 /* Save the arguments for use if we re-exec exim as a daemon after receiving
1736 SIGHUP. */
1737
1738 sighup_argv = argv;
1739
1740 /* Set up the version number. Set up the leading 'E' for the external form of
1741 message ids, set the pointer to the internal form, and initialize it to
1742 indicate no message being processed. */
1743
1744 version_init();
1745 message_id_option[0] = '-';
1746 message_id_external = message_id_option + 1;
1747 message_id_external[0] = 'E';
1748 message_id = message_id_external + 1;
1749 message_id[0] = 0;
1750
1751 /* Set the umask to zero so that any files Exim creates using open() are
1752 created with the modes that it specifies. NOTE: Files created with fopen() have
1753 a problem, which was not recognized till rather late (February 2006). With this
1754 umask, such files will be world writeable. (They are all content scanning files
1755 in the spool directory, which isn't world-accessible, so this is not a
1756 disaster, but it's untidy.) I don't want to change this overall setting,
1757 however, because it will interact badly with the open() calls. Instead, there's
1758 now a function called modefopen() that fiddles with the umask while calling
1759 fopen(). */
1760
1761 (void)umask(0);
1762
1763 /* Precompile the regular expression for matching a message id. Keep this in
1764 step with the code that generates ids in the accept.c module. We need to do
1765 this here, because the -M options check their arguments for syntactic validity
1766 using mac_ismsgid, which uses this. */
1767
1768 regex_ismsgid =
1769 regex_must_compile(US"^(?:[^\\W_]{6}-){2}[^\\W_]{2}$", FALSE, TRUE);
1770
1771 /* Precompile the regular expression that is used for matching an SMTP error
1772 code, possibly extended, at the start of an error message. Note that the
1773 terminating whitespace character is included. */
1774
1775 regex_smtp_code =
1776 regex_must_compile(US"^\\d\\d\\d\\s(?:\\d\\.\\d\\d?\\d?\\.\\d\\d?\\d?\\s)?",
1777 FALSE, TRUE);
1778
1779 #ifdef WHITELIST_D_MACROS
1780 /* Precompile the regular expression used to filter the content of macros
1781 given to -D for permissibility. */
1782
1783 regex_whitelisted_macro =
1784 regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE);
1785 #endif
1786
1787 for (i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL;
1788
1789 /* If the program is called as "mailq" treat it as equivalent to "exim -bp";
1790 this seems to be a generally accepted convention, since one finds symbolic
1791 links called "mailq" in standard OS configurations. */
1792
1793 if ((namelen == 5 && Ustrcmp(argv[0], "mailq") == 0) ||
1794 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/mailq", 6) == 0))
1795 {
1796 list_queue = TRUE;
1797 receiving_message = FALSE;
1798 called_as = US"-mailq";
1799 }
1800
1801 /* If the program is called as "rmail" treat it as equivalent to
1802 "exim -i -oee", thus allowing UUCP messages to be input using non-SMTP mode,
1803 i.e. preventing a single dot on a line from terminating the message, and
1804 returning with zero return code, even in cases of error (provided an error
1805 message has been sent). */
1806
1807 if ((namelen == 5 && Ustrcmp(argv[0], "rmail") == 0) ||
1808 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rmail", 6) == 0))
1809 {
1810 dot_ends = FALSE;
1811 called_as = US"-rmail";
1812 errors_sender_rc = EXIT_SUCCESS;
1813 }
1814
1815 /* If the program is called as "rsmtp" treat it as equivalent to "exim -bS";
1816 this is a smail convention. */
1817
1818 if ((namelen == 5 && Ustrcmp(argv[0], "rsmtp") == 0) ||
1819 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rsmtp", 6) == 0))
1820 {
1821 smtp_input = smtp_batched_input = TRUE;
1822 called_as = US"-rsmtp";
1823 }
1824
1825 /* If the program is called as "runq" treat it as equivalent to "exim -q";
1826 this is a smail convention. */
1827
1828 if ((namelen == 4 && Ustrcmp(argv[0], "runq") == 0) ||
1829 (namelen > 4 && Ustrncmp(argv[0] + namelen - 5, "/runq", 5) == 0))
1830 {
1831 queue_interval = 0;
1832 receiving_message = FALSE;
1833 called_as = US"-runq";
1834 }
1835
1836 /* If the program is called as "newaliases" treat it as equivalent to
1837 "exim -bi"; this is a sendmail convention. */
1838
1839 if ((namelen == 10 && Ustrcmp(argv[0], "newaliases") == 0) ||
1840 (namelen > 10 && Ustrncmp(argv[0] + namelen - 11, "/newaliases", 11) == 0))
1841 {
1842 bi_option = TRUE;
1843 receiving_message = FALSE;
1844 called_as = US"-newaliases";
1845 }
1846
1847 /* Save the original effective uid for a couple of uses later. It should
1848 normally be root, but in some esoteric environments it may not be. */
1849
1850 original_euid = geteuid();
1851
1852 /* Get the real uid and gid. If the caller is root, force the effective uid/gid
1853 to be the same as the real ones. This makes a difference only if Exim is setuid
1854 (or setgid) to something other than root, which could be the case in some
1855 special configurations. */
1856
1857 real_uid = getuid();
1858 real_gid = getgid();
1859
1860 if (real_uid == root_uid)
1861 {
1862 rv = setgid(real_gid);
1863 if (rv)
1864 {
1865 fprintf(stderr, "exim: setgid(%ld) failed: %s\n",
1866 (long int)real_gid, strerror(errno));
1867 exit(EXIT_FAILURE);
1868 }
1869 rv = setuid(real_uid);
1870 if (rv)
1871 {
1872 fprintf(stderr, "exim: setuid(%ld) failed: %s\n",
1873 (long int)real_uid, strerror(errno));
1874 exit(EXIT_FAILURE);
1875 }
1876 }
1877
1878 /* If neither the original real uid nor the original euid was root, Exim is
1879 running in an unprivileged state. */
1880
1881 unprivileged = (real_uid != root_uid && original_euid != root_uid);
1882
1883 /* Scan the program's arguments. Some can be dealt with right away; others are
1884 simply recorded for checking and handling afterwards. Do a high-level switch
1885 on the second character (the one after '-'), to save some effort. */
1886
1887 for (i = 1; i < argc; i++)
1888 {
1889 BOOL badarg = FALSE;
1890 uschar *arg = argv[i];
1891 uschar *argrest;
1892 int switchchar;
1893
1894 /* An argument not starting with '-' is the start of a recipients list;
1895 break out of the options-scanning loop. */
1896
1897 if (arg[0] != '-')
1898 {
1899 recipients_arg = i;
1900 break;
1901 }
1902
1903 /* An option consisting of -- terminates the options */
1904
1905 if (Ustrcmp(arg, "--") == 0)
1906 {
1907 recipients_arg = i + 1;
1908 break;
1909 }
1910
1911 /* Handle flagged options */
1912
1913 switchchar = arg[1];
1914 argrest = arg+2;
1915
1916 /* Make all -ex options synonymous with -oex arguments, since that
1917 is assumed by various callers. Also make -qR options synonymous with -R
1918 options, as that seems to be required as well. Allow for -qqR too, and
1919 the same for -S options. */
1920
1921 if (Ustrncmp(arg+1, "oe", 2) == 0 ||
1922 Ustrncmp(arg+1, "qR", 2) == 0 ||
1923 Ustrncmp(arg+1, "qS", 2) == 0)
1924 {
1925 switchchar = arg[2];
1926 argrest++;
1927 }
1928 else if (Ustrncmp(arg+1, "qqR", 3) == 0 || Ustrncmp(arg+1, "qqS", 3) == 0)
1929 {
1930 switchchar = arg[3];
1931 argrest += 2;
1932 queue_2stage = TRUE;
1933 }
1934
1935 /* Make -r synonymous with -f, since it is a documented alias */
1936
1937 else if (arg[1] == 'r') switchchar = 'f';
1938
1939 /* Make -ov synonymous with -v */
1940
1941 else if (Ustrcmp(arg, "-ov") == 0)
1942 {
1943 switchchar = 'v';
1944 argrest++;
1945 }
1946
1947 /* deal with --option_aliases */
1948 else if (switchchar == '-')
1949 {
1950 if (Ustrcmp(argrest, "help") == 0)
1951 {
1952 usage_wanted = TRUE;
1953 break;
1954 }
1955 else if (Ustrcmp(argrest, "version") == 0)
1956 {
1957 switchchar = 'b';
1958 argrest = US"V";
1959 }
1960 }
1961
1962 /* High-level switch on active initial letter */
1963
1964 switch(switchchar)
1965 {
1966
1967 /* sendmail uses -Ac and -Am to control which .cf file is used;
1968 we ignore them. */
1969 case 'A':
1970 if (*argrest == '\0') { badarg = TRUE; break; }
1971 else
1972 {
1973 BOOL ignore = FALSE;
1974 switch (*argrest)
1975 {
1976 case 'c':
1977 case 'm':
1978 if (*(argrest + 1) == '\0')
1979 ignore = TRUE;
1980 break;
1981 }
1982 if (!ignore) { badarg = TRUE; break; }
1983 }
1984 break;
1985
1986 /* -Btype is a sendmail option for 7bit/8bit setting. Exim is 8-bit clean
1987 so has no need of it. */
1988
1989 case 'B':
1990 if (*argrest == 0) i++; /* Skip over the type */
1991 break;
1992
1993
1994 case 'b':
1995 receiving_message = FALSE; /* Reset TRUE for -bm, -bS, -bs below */
1996
1997 /* -bd: Run in daemon mode, awaiting SMTP connections.
1998 -bdf: Ditto, but in the foreground.
1999 */
2000
2001 if (*argrest == 'd')
2002 {
2003 daemon_listen = TRUE;
2004 if (*(++argrest) == 'f') background_daemon = FALSE;
2005 else if (*argrest != 0) { badarg = TRUE; break; }
2006 }
2007
2008 /* -be: Run in expansion test mode
2009 -bem: Ditto, but read a message from a file first
2010 */
2011
2012 else if (*argrest == 'e')
2013 {
2014 expansion_test = checking = TRUE;
2015 if (argrest[1] == 'm')
2016 {
2017 if (++i >= argc) { badarg = TRUE; break; }
2018 expansion_test_message = argv[i];
2019 argrest++;
2020 }
2021 if (argrest[1] != 0) { badarg = TRUE; break; }
2022 }
2023
2024 /* -bF: Run system filter test */
2025
2026 else if (*argrest == 'F')
2027 {
2028 filter_test |= checking = FTEST_SYSTEM;
2029 if (*(++argrest) != 0) { badarg = TRUE; break; }
2030 if (++i < argc) filter_test_sfile = argv[i]; else
2031 {
2032 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
2033 exit(EXIT_FAILURE);
2034 }
2035 }
2036
2037 /* -bf: Run user filter test
2038 -bfd: Set domain for filter testing
2039 -bfl: Set local part for filter testing
2040 -bfp: Set prefix for filter testing
2041 -bfs: Set suffix for filter testing
2042 */
2043
2044 else if (*argrest == 'f')
2045 {
2046 if (*(++argrest) == 0)
2047 {
2048 filter_test |= checking = FTEST_USER;
2049 if (++i < argc) filter_test_ufile = argv[i]; else
2050 {
2051 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
2052 exit(EXIT_FAILURE);
2053 }
2054 }
2055 else
2056 {
2057 if (++i >= argc)
2058 {
2059 fprintf(stderr, "exim: string expected after %s\n", arg);
2060 exit(EXIT_FAILURE);
2061 }
2062 if (Ustrcmp(argrest, "d") == 0) ftest_domain = argv[i];
2063 else if (Ustrcmp(argrest, "l") == 0) ftest_localpart = argv[i];
2064 else if (Ustrcmp(argrest, "p") == 0) ftest_prefix = argv[i];
2065 else if (Ustrcmp(argrest, "s") == 0) ftest_suffix = argv[i];
2066 else { badarg = TRUE; break; }
2067 }
2068 }
2069
2070 /* -bh: Host checking - an IP address must follow. */
2071
2072 else if (Ustrcmp(argrest, "h") == 0 || Ustrcmp(argrest, "hc") == 0)
2073 {
2074 if (++i >= argc) { badarg = TRUE; break; }
2075 sender_host_address = argv[i];
2076 host_checking = checking = log_testing_mode = TRUE;
2077 host_checking_callout = argrest[1] == 'c';
2078 message_logs = FALSE;
2079 }
2080
2081 /* -bi: This option is used by sendmail to initialize *the* alias file,
2082 though it has the -oA option to specify a different file. Exim has no
2083 concept of *the* alias file, but since Sun's YP make script calls
2084 sendmail this way, some support must be provided. */
2085
2086 else if (Ustrcmp(argrest, "i") == 0) bi_option = TRUE;
2087
2088 /* -bI: provide information, of the type to follow after a colon.
2089 This is an Exim flag. */
2090
2091 else if (argrest[0] == 'I' && Ustrlen(argrest) >= 2 && argrest[1] == ':')
2092 {
2093 uschar *p = &argrest[2];
2094 info_flag = CMDINFO_HELP;
2095 if (Ustrlen(p))
2096 {
2097 if (strcmpic(p, CUS"sieve") == 0)
2098 {
2099 info_flag = CMDINFO_SIEVE;
2100 info_stdout = TRUE;
2101 }
2102 else if (strcmpic(p, CUS"dscp") == 0)
2103 {
2104 info_flag = CMDINFO_DSCP;
2105 info_stdout = TRUE;
2106 }
2107 else if (strcmpic(p, CUS"help") == 0)
2108 {
2109 info_stdout = TRUE;
2110 }
2111 }
2112 }
2113
2114 /* -bm: Accept and deliver message - the default option. Reinstate
2115 receiving_message, which got turned off for all -b options. */
2116
2117 else if (Ustrcmp(argrest, "m") == 0) receiving_message = TRUE;
2118
2119 /* -bmalware: test the filename given for malware */
2120
2121 else if (Ustrcmp(argrest, "malware") == 0)
2122 {
2123 if (++i >= argc) { badarg = TRUE; break; }
2124 checking = TRUE;
2125 malware_test_file = argv[i];
2126 }
2127
2128 /* -bnq: For locally originating messages, do not qualify unqualified
2129 addresses. In the envelope, this causes errors; in header lines they
2130 just get left. */
2131
2132 else if (Ustrcmp(argrest, "nq") == 0)
2133 {
2134 allow_unqualified_sender = FALSE;
2135 allow_unqualified_recipient = FALSE;
2136 }
2137
2138 /* -bpxx: List the contents of the mail queue, in various forms. If
2139 the option is -bpc, just a queue count is needed. Otherwise, if the
2140 first letter after p is r, then order is random. */
2141
2142 else if (*argrest == 'p')
2143 {
2144 if (*(++argrest) == 'c')
2145 {
2146 count_queue = TRUE;
2147 if (*(++argrest) != 0) badarg = TRUE;
2148 break;
2149 }
2150
2151 if (*argrest == 'r')
2152 {
2153 list_queue_option = 8;
2154 argrest++;
2155 }
2156 else list_queue_option = 0;
2157
2158 list_queue = TRUE;
2159
2160 /* -bp: List the contents of the mail queue, top-level only */
2161
2162 if (*argrest == 0) {}
2163
2164 /* -bpu: List the contents of the mail queue, top-level undelivered */
2165
2166 else if (Ustrcmp(argrest, "u") == 0) list_queue_option += 1;
2167
2168 /* -bpa: List the contents of the mail queue, including all delivered */
2169
2170 else if (Ustrcmp(argrest, "a") == 0) list_queue_option += 2;
2171
2172 /* Unknown after -bp[r] */
2173
2174 else
2175 {
2176 badarg = TRUE;
2177 break;
2178 }
2179 }
2180
2181
2182 /* -bP: List the configuration variables given as the address list.
2183 Force -v, so configuration errors get displayed. */
2184
2185 else if (Ustrcmp(argrest, "P") == 0)
2186 {
2187 /* -bP config: we need to setup here, because later,
2188 * when list_options is checked, the config is read already */
2189 if (argv[i+1] && Ustrcmp(argv[i+1], "config") == 0)
2190 {
2191 list_config = TRUE;
2192 readconf_save_config(version_string);
2193 }
2194 else
2195 {
2196 list_options = TRUE;
2197 debug_selector |= D_v;
2198 debug_file = stderr;
2199 }
2200 }
2201
2202 /* -brt: Test retry configuration lookup */
2203
2204 else if (Ustrcmp(argrest, "rt") == 0)
2205 {
2206 checking = TRUE;
2207 test_retry_arg = i + 1;
2208 goto END_ARG;
2209 }
2210
2211 /* -brw: Test rewrite configuration */
2212
2213 else if (Ustrcmp(argrest, "rw") == 0)
2214 {
2215 checking = TRUE;
2216 test_rewrite_arg = i + 1;
2217 goto END_ARG;
2218 }
2219
2220 /* -bS: Read SMTP commands on standard input, but produce no replies -
2221 all errors are reported by sending messages. */
2222
2223 else if (Ustrcmp(argrest, "S") == 0)
2224 smtp_input = smtp_batched_input = receiving_message = TRUE;
2225
2226 /* -bs: Read SMTP commands on standard input and produce SMTP replies
2227 on standard output. */
2228
2229 else if (Ustrcmp(argrest, "s") == 0) smtp_input = receiving_message = TRUE;
2230
2231 /* -bt: address testing mode */
2232
2233 else if (Ustrcmp(argrest, "t") == 0)
2234 address_test_mode = checking = log_testing_mode = TRUE;
2235
2236 /* -bv: verify addresses */
2237
2238 else if (Ustrcmp(argrest, "v") == 0)
2239 verify_address_mode = checking = log_testing_mode = TRUE;
2240
2241 /* -bvs: verify sender addresses */
2242
2243 else if (Ustrcmp(argrest, "vs") == 0)
2244 {
2245 verify_address_mode = checking = log_testing_mode = TRUE;
2246 verify_as_sender = TRUE;
2247 }
2248
2249 /* -bV: Print version string and support details */
2250
2251 else if (Ustrcmp(argrest, "V") == 0)
2252 {
2253 printf("Exim version %s #%s built %s\n", version_string,
2254 version_cnumber, version_date);
2255 printf("%s\n", CS version_copyright);
2256 version_printed = TRUE;
2257 show_whats_supported(stdout);
2258 log_testing_mode = TRUE;
2259 }
2260
2261 /* -bw: inetd wait mode, accept a listening socket as stdin */
2262
2263 else if (*argrest == 'w')
2264 {
2265 inetd_wait_mode = TRUE;
2266 background_daemon = FALSE;
2267 daemon_listen = TRUE;
2268 if (*(++argrest) != '\0')
2269 {
2270 inetd_wait_timeout = readconf_readtime(argrest, 0, FALSE);
2271 if (inetd_wait_timeout <= 0)
2272 {
2273 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
2274 exit(EXIT_FAILURE);
2275 }
2276 }
2277 }
2278
2279 else badarg = TRUE;
2280 break;
2281
2282
2283 /* -C: change configuration file list; ignore if it isn't really
2284 a change! Enforce a prefix check if required. */
2285
2286 case 'C':
2287 if (*argrest == 0)
2288 {
2289 if(++i < argc) argrest = argv[i]; else
2290 { badarg = TRUE; break; }
2291 }
2292 if (Ustrcmp(config_main_filelist, argrest) != 0)
2293 {
2294 #ifdef ALT_CONFIG_PREFIX
2295 int sep = 0;
2296 int len = Ustrlen(ALT_CONFIG_PREFIX);
2297 uschar *list = argrest;
2298 uschar *filename;
2299 while((filename = string_nextinlist(&list, &sep, big_buffer,
2300 big_buffer_size)) != NULL)
2301 {
2302 if ((Ustrlen(filename) < len ||
2303 Ustrncmp(filename, ALT_CONFIG_PREFIX, len) != 0 ||
2304 Ustrstr(filename, "/../") != NULL) &&
2305 (Ustrcmp(filename, "/dev/null") != 0 || real_uid != root_uid))
2306 {
2307 fprintf(stderr, "-C Permission denied\n");
2308 exit(EXIT_FAILURE);
2309 }
2310 }
2311 #endif
2312 if (real_uid != root_uid)
2313 {
2314 #ifdef TRUSTED_CONFIG_LIST
2315
2316 if (real_uid != exim_uid
2317 #ifdef CONFIGURE_OWNER
2318 && real_uid != config_uid
2319 #endif
2320 )
2321 trusted_config = FALSE;
2322 else
2323 {
2324 FILE *trust_list = Ufopen(TRUSTED_CONFIG_LIST, "rb");
2325 if (trust_list)
2326 {
2327 struct stat statbuf;
2328
2329 if (fstat(fileno(trust_list), &statbuf) != 0 ||
2330 (statbuf.st_uid != root_uid /* owner not root */
2331 #ifdef CONFIGURE_OWNER
2332 && statbuf.st_uid != config_uid /* owner not the special one */
2333 #endif
2334 ) || /* or */
2335 (statbuf.st_gid != root_gid /* group not root */
2336 #ifdef CONFIGURE_GROUP
2337 && statbuf.st_gid != config_gid /* group not the special one */
2338 #endif
2339 && (statbuf.st_mode & 020) != 0 /* group writeable */
2340 ) || /* or */
2341 (statbuf.st_mode & 2) != 0) /* world writeable */
2342 {
2343 trusted_config = FALSE;
2344 fclose(trust_list);
2345 }
2346 else
2347 {
2348 /* Well, the trust list at least is up to scratch... */
2349 void *reset_point = store_get(0);
2350 uschar *trusted_configs[32];
2351 int nr_configs = 0;
2352 int i = 0;
2353
2354 while (Ufgets(big_buffer, big_buffer_size, trust_list))
2355 {
2356 uschar *start = big_buffer, *nl;
2357 while (*start && isspace(*start))
2358 start++;
2359 if (*start != '/')
2360 continue;
2361 nl = Ustrchr(start, '\n');
2362 if (nl)
2363 *nl = 0;
2364 trusted_configs[nr_configs++] = string_copy(start);
2365 if (nr_configs == 32)
2366 break;
2367 }
2368 fclose(trust_list);
2369
2370 if (nr_configs)
2371 {
2372 int sep = 0;
2373 const uschar *list = argrest;
2374 uschar *filename;
2375 while (trusted_config && (filename = string_nextinlist(&list,
2376 &sep, big_buffer, big_buffer_size)) != NULL)
2377 {
2378 for (i=0; i < nr_configs; i++)
2379 {
2380 if (Ustrcmp(filename, trusted_configs[i]) == 0)
2381 break;
2382 }
2383 if (i == nr_configs)
2384 {
2385 trusted_config = FALSE;
2386 break;
2387 }
2388 }
2389 store_reset(reset_point);
2390 }
2391 else
2392 {
2393 /* No valid prefixes found in trust_list file. */
2394 trusted_config = FALSE;
2395 }
2396 }
2397 }
2398 else
2399 {
2400 /* Could not open trust_list file. */
2401 trusted_config = FALSE;
2402 }
2403 }
2404 #else
2405 /* Not root; don't trust config */
2406 trusted_config = FALSE;
2407 #endif
2408 }
2409
2410 config_main_filelist = argrest;
2411 config_changed = TRUE;
2412 }
2413 break;
2414
2415
2416 /* -D: set up a macro definition */
2417
2418 case 'D':
2419 #ifdef DISABLE_D_OPTION
2420 fprintf(stderr, "exim: -D is not available in this Exim binary\n");
2421 exit(EXIT_FAILURE);
2422 #else
2423 {
2424 int ptr = 0;
2425 macro_item *m;
2426 uschar name[24];
2427 uschar *s = argrest;
2428
2429 opt_D_used = TRUE;
2430 while (isspace(*s)) s++;
2431
2432 if (*s < 'A' || *s > 'Z')
2433 {
2434 fprintf(stderr, "exim: macro name set by -D must start with "
2435 "an upper case letter\n");
2436 exit(EXIT_FAILURE);
2437 }
2438
2439 while (isalnum(*s) || *s == '_')
2440 {
2441 if (ptr < sizeof(name)-1) name[ptr++] = *s;
2442 s++;
2443 }
2444 name[ptr] = 0;
2445 if (ptr == 0) { badarg = TRUE; break; }
2446 while (isspace(*s)) s++;
2447 if (*s != 0)
2448 {
2449 if (*s++ != '=') { badarg = TRUE; break; }
2450 while (isspace(*s)) s++;
2451 }
2452
2453 for (m = macros; m; m = m->next)
2454 if (Ustrcmp(m->name, name) == 0)
2455 {
2456 fprintf(stderr, "exim: duplicated -D in command line\n");
2457 exit(EXIT_FAILURE);
2458 }
2459
2460 m = macro_create(name, s, TRUE, FALSE);
2461
2462 if (clmacro_count >= MAX_CLMACROS)
2463 {
2464 fprintf(stderr, "exim: too many -D options on command line\n");
2465 exit(EXIT_FAILURE);
2466 }
2467 clmacros[clmacro_count++] = string_sprintf("-D%s=%s", m->name,
2468 m->replacement);
2469 }
2470 #endif
2471 break;
2472
2473 /* -d: Set debug level (see also -v below) or set the drop_cr option.
2474 The latter is now a no-op, retained for compatibility only. If -dd is used,
2475 debugging subprocesses of the daemon is disabled. */
2476
2477 case 'd':
2478 if (Ustrcmp(argrest, "ropcr") == 0)
2479 {
2480 /* drop_cr = TRUE; */
2481 }
2482
2483 /* Use an intermediate variable so that we don't set debugging while
2484 decoding the debugging bits. */
2485
2486 else
2487 {
2488 unsigned int selector = D_default;
2489 debug_selector = 0;
2490 debug_file = NULL;
2491 if (*argrest == 'd')
2492 {
2493 debug_daemon = TRUE;
2494 argrest++;
2495 }
2496 if (*argrest != 0)
2497 decode_bits(&selector, 1, debug_notall, argrest,
2498 debug_options, debug_options_count, US"debug", 0);
2499 debug_selector = selector;
2500 }
2501 break;
2502
2503
2504 /* -E: This is a local error message. This option is not intended for
2505 external use at all, but is not restricted to trusted callers because it
2506 does no harm (just suppresses certain error messages) and if Exim is run
2507 not setuid root it won't always be trusted when it generates error
2508 messages using this option. If there is a message id following -E, point
2509 message_reference at it, for logging. */
2510
2511 case 'E':
2512 local_error_message = TRUE;
2513 if (mac_ismsgid(argrest)) message_reference = argrest;
2514 break;
2515
2516
2517 /* -ex: The vacation program calls sendmail with the undocumented "-eq"
2518 option, so it looks as if historically the -oex options are also callable
2519 without the leading -o. So we have to accept them. Before the switch,
2520 anything starting -oe has been converted to -e. Exim does not support all
2521 of the sendmail error options. */
2522
2523 case 'e':
2524 if (Ustrcmp(argrest, "e") == 0)
2525 {
2526 arg_error_handling = ERRORS_SENDER;
2527 errors_sender_rc = EXIT_SUCCESS;
2528 }
2529 else if (Ustrcmp(argrest, "m") == 0) arg_error_handling = ERRORS_SENDER;
2530 else if (Ustrcmp(argrest, "p") == 0) arg_error_handling = ERRORS_STDERR;
2531 else if (Ustrcmp(argrest, "q") == 0) arg_error_handling = ERRORS_STDERR;
2532 else if (Ustrcmp(argrest, "w") == 0) arg_error_handling = ERRORS_SENDER;
2533 else badarg = TRUE;
2534 break;
2535
2536
2537 /* -F: Set sender's full name, used instead of the gecos entry from
2538 the password file. Since users can usually alter their gecos entries,
2539 there's no security involved in using this instead. The data can follow
2540 the -F or be in the next argument. */
2541
2542 case 'F':
2543 if (*argrest == 0)
2544 {
2545 if(++i < argc) argrest = argv[i]; else
2546 { badarg = TRUE; break; }
2547 }
2548 originator_name = argrest;
2549 sender_name_forced = TRUE;
2550 break;
2551
2552
2553 /* -f: Set sender's address - this value is only actually used if Exim is
2554 run by a trusted user, or if untrusted_set_sender is set and matches the
2555 address, except that the null address can always be set by any user. The
2556 test for this happens later, when the value given here is ignored when not
2557 permitted. For an untrusted user, the actual sender is still put in Sender:
2558 if it doesn't match the From: header (unless no_local_from_check is set).
2559 The data can follow the -f or be in the next argument. The -r switch is an
2560 obsolete form of -f but since there appear to be programs out there that
2561 use anything that sendmail has ever supported, better accept it - the
2562 synonymizing is done before the switch above.
2563
2564 At this stage, we must allow domain literal addresses, because we don't
2565 know what the setting of allow_domain_literals is yet. Ditto for trailing
2566 dots and strip_trailing_dot. */
2567
2568 case 'f':
2569 {
2570 int dummy_start, dummy_end;
2571 uschar *errmess;
2572 if (*argrest == 0)
2573 {
2574 if (i+1 < argc) argrest = argv[++i]; else
2575 { badarg = TRUE; break; }
2576 }
2577 if (*argrest == 0)
2578 sender_address = string_sprintf(""); /* Ensure writeable memory */
2579 else
2580 {
2581 uschar *temp = argrest + Ustrlen(argrest) - 1;
2582 while (temp >= argrest && isspace(*temp)) temp--;
2583 if (temp >= argrest && *temp == '.') f_end_dot = TRUE;
2584 allow_domain_literals = TRUE;
2585 strip_trailing_dot = TRUE;
2586 #ifdef SUPPORT_I18N
2587 allow_utf8_domains = TRUE;
2588 #endif
2589 sender_address = parse_extract_address(argrest, &errmess,
2590 &dummy_start, &dummy_end, &sender_address_domain, TRUE);
2591 #ifdef SUPPORT_I18N
2592 message_smtputf8 = string_is_utf8(sender_address);
2593 allow_utf8_domains = FALSE;
2594 #endif
2595 allow_domain_literals = FALSE;
2596 strip_trailing_dot = FALSE;
2597 if (sender_address == NULL)
2598 {
2599 fprintf(stderr, "exim: bad -f address \"%s\": %s\n", argrest, errmess);
2600 return EXIT_FAILURE;
2601 }
2602 }
2603 sender_address_forced = TRUE;
2604 }
2605 break;
2606
2607 /* -G: sendmail invocation to specify that it's a gateway submission and
2608 sendmail may complain about problems instead of fixing them.
2609 We make it equivalent to an ACL "control = suppress_local_fixups" and do
2610 not at this time complain about problems. */
2611
2612 case 'G':
2613 flag_G = TRUE;
2614 break;
2615
2616 /* -h: Set the hop count for an incoming message. Exim does not currently
2617 support this; it always computes it by counting the Received: headers.
2618 To put it in will require a change to the spool header file format. */
2619
2620 case 'h':
2621 if (*argrest == 0)
2622 {
2623 if(++i < argc) argrest = argv[i]; else
2624 { badarg = TRUE; break; }
2625 }
2626 if (!isdigit(*argrest)) badarg = TRUE;
2627 break;
2628
2629
2630 /* -i: Set flag so dot doesn't end non-SMTP input (same as -oi, seems
2631 not to be documented for sendmail but mailx (at least) uses it) */
2632
2633 case 'i':
2634 if (*argrest == 0) dot_ends = FALSE; else badarg = TRUE;
2635 break;
2636
2637
2638 /* -L: set the identifier used for syslog; equivalent to setting
2639 syslog_processname in the config file, but needs to be an admin option. */
2640
2641 case 'L':
2642 if (*argrest == '\0')
2643 {
2644 if(++i < argc) argrest = argv[i]; else
2645 { badarg = TRUE; break; }
2646 }
2647 sz = Ustrlen(argrest);
2648 if (sz > 32)
2649 {
2650 fprintf(stderr, "exim: the -L syslog name is too long: \"%s\"\n", argrest);
2651 return EXIT_FAILURE;
2652 }
2653 if (sz < 1)
2654 {
2655 fprintf(stderr, "exim: the -L syslog name is too short\n");
2656 return EXIT_FAILURE;
2657 }
2658 cmdline_syslog_name = argrest;
2659 break;
2660
2661 case 'M':
2662 receiving_message = FALSE;
2663
2664 /* -MC: continue delivery of another message via an existing open
2665 file descriptor. This option is used for an internal call by the
2666 smtp transport when there is a pending message waiting to go to an
2667 address to which it has got a connection. Five subsequent arguments are
2668 required: transport name, host name, IP address, sequence number, and
2669 message_id. Transports may decline to create new processes if the sequence
2670 number gets too big. The channel is stdin. This (-MC) must be the last
2671 argument. There's a subsequent check that the real-uid is privileged.
2672
2673 If we are running in the test harness. delay for a bit, to let the process
2674 that set this one up complete. This makes for repeatability of the logging,
2675 etc. output. */
2676
2677 if (Ustrcmp(argrest, "C") == 0)
2678 {
2679 union sockaddr_46 interface_sock;
2680 EXIM_SOCKLEN_T size = sizeof(interface_sock);
2681
2682 if (argc != i + 6)
2683 {
2684 fprintf(stderr, "exim: too many or too few arguments after -MC\n");
2685 return EXIT_FAILURE;
2686 }
2687
2688 if (msg_action_arg >= 0)
2689 {
2690 fprintf(stderr, "exim: incompatible arguments\n");
2691 return EXIT_FAILURE;
2692 }
2693
2694 continue_transport = argv[++i];
2695 continue_hostname = argv[++i];
2696 continue_host_address = argv[++i];
2697 continue_sequence = Uatoi(argv[++i]);
2698 msg_action = MSG_DELIVER;
2699 msg_action_arg = ++i;
2700 forced_delivery = TRUE;
2701 queue_run_pid = passed_qr_pid;
2702 queue_run_pipe = passed_qr_pipe;
2703
2704 if (!mac_ismsgid(argv[i]))
2705 {
2706 fprintf(stderr, "exim: malformed message id %s after -MC option\n",
2707 argv[i]);
2708 return EXIT_FAILURE;
2709 }
2710
2711 /* Set up $sending_ip_address and $sending_port */
2712
2713 if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
2714 &size) == 0)
2715 sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
2716 &sending_port);
2717 else
2718 {
2719 fprintf(stderr, "exim: getsockname() failed after -MC option: %s\n",
2720 strerror(errno));
2721 return EXIT_FAILURE;
2722 }
2723
2724 if (running_in_test_harness) millisleep(500);
2725 break;
2726 }
2727
2728 else if (*argrest == 'C' && argrest[1] && !argrest[2])
2729 {
2730 switch(argrest[1])
2731 {
2732 /* -MCA: set the smtp_authenticated flag; this is useful only when it
2733 precedes -MC (see above). The flag indicates that the host to which
2734 Exim is connected has accepted an AUTH sequence. */
2735
2736 case 'A': smtp_authenticated = TRUE; break;
2737
2738 /* -MCD: set the smtp_use_dsn flag; this indicates that the host
2739 that exim is connected to supports the esmtp extension DSN */
2740
2741 case 'D': smtp_peer_options |= PEER_OFFERED_DSN; break;
2742
2743 /* -MCG: set the queue name, to a non-default value */
2744
2745 case 'G': if (++i < argc) queue_name = string_copy(argv[i]);
2746 else badarg = TRUE;
2747 break;
2748
2749 /* -MCK: the peer offered CHUNKING. Must precede -MC */
2750
2751 case 'K': smtp_peer_options |= PEER_OFFERED_CHUNKING; break;
2752
2753 /* -MCP: set the smtp_use_pipelining flag; this is useful only when
2754 it preceded -MC (see above) */
2755
2756 case 'P': smtp_peer_options |= PEER_OFFERED_PIPE; break;
2757
2758 /* -MCQ: pass on the pid of the queue-running process that started
2759 this chain of deliveries and the fd of its synchronizing pipe; this
2760 is useful only when it precedes -MC (see above) */
2761
2762 case 'Q': if (++i < argc) passed_qr_pid = (pid_t)(Uatol(argv[i]));
2763 else badarg = TRUE;
2764 if (++i < argc) passed_qr_pipe = (int)(Uatol(argv[i]));
2765 else badarg = TRUE;
2766 break;
2767
2768 /* -MCS: set the smtp_use_size flag; this is useful only when it
2769 precedes -MC (see above) */
2770
2771 case 'S': smtp_peer_options |= PEER_OFFERED_SIZE; break;
2772
2773 #ifdef SUPPORT_TLS
2774 /* -MCT: set the tls_offered flag; this is useful only when it
2775 precedes -MC (see above). The flag indicates that the host to which
2776 Exim is connected has offered TLS support. */
2777
2778 case 'T': smtp_peer_options |= PEER_OFFERED_TLS; break;
2779 #endif
2780
2781 default: badarg = TRUE; break;
2782 }
2783 break;
2784 }
2785
2786 /* -M[x]: various operations on the following list of message ids:
2787 -M deliver the messages, ignoring next retry times and thawing
2788 -Mc deliver the messages, checking next retry times, no thawing
2789 -Mf freeze the messages
2790 -Mg give up on the messages
2791 -Mt thaw the messages
2792 -Mrm remove the messages
2793 In the above cases, this must be the last option. There are also the
2794 following options which are followed by a single message id, and which
2795 act on that message. Some of them use the "recipient" addresses as well.
2796 -Mar add recipient(s)
2797 -Mmad mark all recipients delivered
2798 -Mmd mark recipients(s) delivered
2799 -Mes edit sender
2800 -Mset load a message for use with -be
2801 -Mvb show body
2802 -Mvc show copy (of whole message, in RFC 2822 format)
2803 -Mvh show header
2804 -Mvl show log
2805 */
2806
2807 else if (*argrest == 0)
2808 {
2809 msg_action = MSG_DELIVER;
2810 forced_delivery = deliver_force_thaw = TRUE;
2811 }
2812 else if (Ustrcmp(argrest, "ar") == 0)
2813 {
2814 msg_action = MSG_ADD_RECIPIENT;
2815 one_msg_action = TRUE;
2816 }
2817 else if (Ustrcmp(argrest, "c") == 0) msg_action = MSG_DELIVER;
2818 else if (Ustrcmp(argrest, "es") == 0)
2819 {
2820 msg_action = MSG_EDIT_SENDER;
2821 one_msg_action = TRUE;
2822 }
2823 else if (Ustrcmp(argrest, "f") == 0) msg_action = MSG_FREEZE;
2824 else if (Ustrcmp(argrest, "g") == 0)
2825 {
2826 msg_action = MSG_DELIVER;
2827 deliver_give_up = TRUE;
2828 }
2829 else if (Ustrcmp(argrest, "mad") == 0)
2830 {
2831 msg_action = MSG_MARK_ALL_DELIVERED;
2832 }
2833 else if (Ustrcmp(argrest, "md") == 0)
2834 {
2835 msg_action = MSG_MARK_DELIVERED;
2836 one_msg_action = TRUE;
2837 }
2838 else if (Ustrcmp(argrest, "rm") == 0) msg_action = MSG_REMOVE;
2839 else if (Ustrcmp(argrest, "set") == 0)
2840 {
2841 msg_action = MSG_LOAD;
2842 one_msg_action = TRUE;
2843 }
2844 else if (Ustrcmp(argrest, "t") == 0) msg_action = MSG_THAW;
2845 else if (Ustrcmp(argrest, "vb") == 0)
2846 {
2847 msg_action = MSG_SHOW_BODY;
2848 one_msg_action = TRUE;
2849 }
2850 else if (Ustrcmp(argrest, "vc") == 0)
2851 {
2852 msg_action = MSG_SHOW_COPY;
2853 one_msg_action = TRUE;
2854 }
2855 else if (Ustrcmp(argrest, "vh") == 0)
2856 {
2857 msg_action = MSG_SHOW_HEADER;
2858 one_msg_action = TRUE;
2859 }
2860 else if (Ustrcmp(argrest, "vl") == 0)
2861 {
2862 msg_action = MSG_SHOW_LOG;
2863 one_msg_action = TRUE;
2864 }
2865 else { badarg = TRUE; break; }
2866
2867 /* All the -Mxx options require at least one message id. */
2868
2869 msg_action_arg = i + 1;
2870 if (msg_action_arg >= argc)
2871 {
2872 fprintf(stderr, "exim: no message ids given after %s option\n", arg);
2873 return EXIT_FAILURE;
2874 }
2875
2876 /* Some require only message ids to follow */
2877
2878 if (!one_msg_action)
2879 {
2880 int j;
2881 for (j = msg_action_arg; j < argc; j++) if (!mac_ismsgid(argv[j]))
2882 {
2883 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2884 argv[j], arg);
2885 return EXIT_FAILURE;
2886 }
2887 goto END_ARG; /* Remaining args are ids */
2888 }
2889
2890 /* Others require only one message id, possibly followed by addresses,
2891 which will be handled as normal arguments. */
2892
2893 else
2894 {
2895 if (!mac_ismsgid(argv[msg_action_arg]))
2896 {
2897 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2898 argv[msg_action_arg], arg);
2899 return EXIT_FAILURE;
2900 }
2901 i++;
2902 }
2903 break;
2904
2905
2906 /* Some programs seem to call the -om option without the leading o;
2907 for sendmail it askes for "me too". Exim always does this. */
2908
2909 case 'm':
2910 if (*argrest != 0) badarg = TRUE;
2911 break;
2912
2913
2914 /* -N: don't do delivery - a debugging option that stops transports doing
2915 their thing. It implies debugging at the D_v level. */
2916
2917 case 'N':
2918 if (*argrest == 0)
2919 {
2920 dont_deliver = TRUE;
2921 debug_selector |= D_v;
2922 debug_file = stderr;
2923 }
2924 else badarg = TRUE;
2925 break;
2926
2927
2928 /* -n: This means "don't alias" in sendmail, apparently.
2929 For normal invocations, it has no effect.
2930 It may affect some other options. */
2931
2932 case 'n':
2933 flag_n = TRUE;
2934 break;
2935
2936 /* -O: Just ignore it. In sendmail, apparently -O option=value means set
2937 option to the specified value. This form uses long names. We need to handle
2938 -O option=value and -Ooption=value. */
2939
2940 case 'O':
2941 if (*argrest == 0)
2942 {
2943 if (++i >= argc)
2944 {
2945 fprintf(stderr, "exim: string expected after -O\n");
2946 exit(EXIT_FAILURE);
2947 }
2948 }
2949 break;
2950
2951 case 'o':
2952
2953 /* -oA: Set an argument for the bi command (sendmail's "alternate alias
2954 file" option). */
2955
2956 if (*argrest == 'A')
2957 {
2958 alias_arg = argrest + 1;
2959 if (alias_arg[0] == 0)
2960 {
2961 if (i+1 < argc) alias_arg = argv[++i]; else
2962 {
2963 fprintf(stderr, "exim: string expected after -oA\n");
2964 exit(EXIT_FAILURE);
2965 }
2966 }
2967 }
2968
2969 /* -oB: Set a connection message max value for remote deliveries */
2970
2971 else if (*argrest == 'B')
2972 {
2973 uschar *p = argrest + 1;
2974 if (p[0] == 0)
2975 {
2976 if (i+1 < argc && isdigit((argv[i+1][0]))) p = argv[++i]; else
2977 {
2978 connection_max_messages = 1;
2979 p = NULL;
2980 }
2981 }
2982
2983 if (p != NULL)
2984 {
2985 if (!isdigit(*p))
2986 {
2987 fprintf(stderr, "exim: number expected after -oB\n");
2988 exit(EXIT_FAILURE);
2989 }
2990 connection_max_messages = Uatoi(p);
2991 }
2992 }
2993
2994 /* -odb: background delivery */
2995
2996 else if (Ustrcmp(argrest, "db") == 0)
2997 {
2998 synchronous_delivery = FALSE;
2999 arg_queue_only = FALSE;
3000 queue_only_set = TRUE;
3001 }
3002
3003 /* -odf: foreground delivery (smail-compatible option); same effect as
3004 -odi: interactive (synchronous) delivery (sendmail-compatible option)
3005 */
3006
3007 else if (Ustrcmp(argrest, "df") == 0 || Ustrcmp(argrest, "di") == 0)
3008 {
3009 synchronous_delivery = TRUE;
3010 arg_queue_only = FALSE;
3011 queue_only_set = TRUE;
3012 }
3013
3014 /* -odq: queue only */
3015
3016 else if (Ustrcmp(argrest, "dq") == 0)
3017 {
3018 synchronous_delivery = FALSE;
3019 arg_queue_only = TRUE;
3020 queue_only_set = TRUE;
3021 }
3022
3023 /* -odqs: queue SMTP only - do local deliveries and remote routing,
3024 but no remote delivery */
3025
3026 else if (Ustrcmp(argrest, "dqs") == 0)
3027 {
3028 queue_smtp = TRUE;
3029 arg_queue_only = FALSE;
3030 queue_only_set = TRUE;
3031 }
3032
3033 /* -oex: Sendmail error flags. As these are also accepted without the
3034 leading -o prefix, for compatibility with vacation and other callers,
3035 they are handled with -e above. */
3036
3037 /* -oi: Set flag so dot doesn't end non-SMTP input (same as -i)
3038 -oitrue: Another sendmail syntax for the same */
3039
3040 else if (Ustrcmp(argrest, "i") == 0 ||
3041 Ustrcmp(argrest, "itrue") == 0)
3042 dot_ends = FALSE;
3043
3044 /* -oM*: Set various characteristics for an incoming message; actually
3045 acted on for trusted callers only. */
3046
3047 else if (*argrest == 'M')
3048 {
3049 if (i+1 >= argc)
3050 {
3051 fprintf(stderr, "exim: data expected after -o%s\n", argrest);
3052 exit(EXIT_FAILURE);
3053 }
3054
3055 /* -oMa: Set sender host address */
3056
3057 if (Ustrcmp(argrest, "Ma") == 0) sender_host_address = argv[++i];
3058
3059 /* -oMaa: Set authenticator name */
3060
3061 else if (Ustrcmp(argrest, "Maa") == 0)
3062 sender_host_authenticated = argv[++i];
3063
3064 /* -oMas: setting authenticated sender */
3065
3066 else if (Ustrcmp(argrest, "Mas") == 0) authenticated_sender = argv[++i];
3067
3068 /* -oMai: setting authenticated id */
3069
3070 else if (Ustrcmp(argrest, "Mai") == 0) authenticated_id = argv[++i];
3071
3072 /* -oMi: Set incoming interface address */
3073
3074 else if (Ustrcmp(argrest, "Mi") == 0) interface_address = argv[++i];
3075
3076 /* -oMm: Message reference */
3077
3078 else if (Ustrcmp(argrest, "Mm") == 0)
3079 {
3080 if (!mac_ismsgid(argv[i+1]))
3081 {
3082 fprintf(stderr,"-oMm must be a valid message ID\n");
3083 exit(EXIT_FAILURE);
3084 }
3085 if (!trusted_config)
3086 {
3087 fprintf(stderr,"-oMm must be called by a trusted user/config\n");
3088 exit(EXIT_FAILURE);
3089 }
3090 message_reference = argv[++i];
3091 }
3092
3093 /* -oMr: Received protocol */
3094
3095 else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i];
3096
3097 /* -oMs: Set sender host name */
3098
3099 else if (Ustrcmp(argrest, "Ms") == 0) sender_host_name = argv[++i];
3100
3101 /* -oMt: Set sender ident */
3102
3103 else if (Ustrcmp(argrest, "Mt") == 0)
3104 {
3105 sender_ident_set = TRUE;
3106 sender_ident = argv[++i];
3107 }
3108
3109 /* Else a bad argument */
3110
3111 else
3112 {
3113 badarg = TRUE;
3114 break;
3115 }
3116 }
3117
3118 /* -om: Me-too flag for aliases. Exim always does this. Some programs
3119 seem to call this as -m (undocumented), so that is also accepted (see
3120 above). */
3121
3122 else if (Ustrcmp(argrest, "m") == 0) {}
3123
3124 /* -oo: An ancient flag for old-style addresses which still seems to
3125 crop up in some calls (see in SCO). */
3126
3127 else if (Ustrcmp(argrest, "o") == 0) {}
3128
3129 /* -oP <name>: set pid file path for daemon */
3130
3131 else if (Ustrcmp(argrest, "P") == 0)
3132 override_pid_file_path = argv[++i];
3133
3134 /* -or <n>: set timeout for non-SMTP acceptance
3135 -os <n>: set timeout for SMTP acceptance */
3136
3137 else if (*argrest == 'r' || *argrest == 's')
3138 {
3139 int *tp = (*argrest == 'r')?
3140 &arg_receive_timeout : &arg_smtp_receive_timeout;
3141 if (argrest[1] == 0)
3142 {
3143 if (i+1 < argc) *tp= readconf_readtime(argv[++i], 0, FALSE);
3144 }
3145 else *tp = readconf_readtime(argrest + 1, 0, FALSE);
3146 if (*tp < 0)
3147 {
3148 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3149 exit(EXIT_FAILURE);
3150 }
3151 }
3152
3153 /* -oX <list>: Override local_interfaces and/or default daemon ports */
3154
3155 else if (Ustrcmp(argrest, "X") == 0)
3156 override_local_interfaces = argv[++i];
3157
3158 /* Unknown -o argument */
3159
3160 else badarg = TRUE;
3161 break;
3162
3163
3164 /* -ps: force Perl startup; -pd force delayed Perl startup */
3165
3166 case 'p':
3167 #ifdef EXIM_PERL
3168 if (*argrest == 's' && argrest[1] == 0)
3169 {
3170 perl_start_option = 1;
3171 break;
3172 }
3173 if (*argrest == 'd' && argrest[1] == 0)
3174 {
3175 perl_start_option = -1;
3176 break;
3177 }
3178 #endif
3179
3180 /* -panythingelse is taken as the Sendmail-compatible argument -prval:sval,
3181 which sets the host protocol and host name */
3182
3183 if (*argrest == 0)
3184 {
3185 if (i+1 < argc) argrest = argv[++i]; else
3186 { badarg = TRUE; break; }
3187 }
3188
3189 if (*argrest != 0)
3190 {
3191 uschar *hn = Ustrchr(argrest, ':');
3192 if (hn == NULL)
3193 {
3194 received_protocol = argrest;
3195 }
3196 else
3197 {
3198 int old_pool = store_pool;
3199 store_pool = POOL_PERM;
3200 received_protocol = string_copyn(argrest, hn - argrest);
3201 store_pool = old_pool;
3202 sender_host_name = hn + 1;
3203 }
3204 }
3205 break;
3206
3207
3208 case 'q':
3209 receiving_message = FALSE;
3210 if (queue_interval >= 0)
3211 {
3212 fprintf(stderr, "exim: -q specified more than once\n");
3213 exit(EXIT_FAILURE);
3214 }
3215
3216 /* -qq...: Do queue runs in a 2-stage manner */
3217
3218 if (*argrest == 'q')
3219 {
3220 queue_2stage = TRUE;
3221 argrest++;
3222 }
3223
3224 /* -qi...: Do only first (initial) deliveries */
3225
3226 if (*argrest == 'i')
3227 {
3228 queue_run_first_delivery = TRUE;
3229 argrest++;
3230 }
3231
3232 /* -qf...: Run the queue, forcing deliveries
3233 -qff..: Ditto, forcing thawing as well */
3234
3235 if (*argrest == 'f')
3236 {
3237 queue_run_force = TRUE;
3238 if (*++argrest == 'f')
3239 {
3240 deliver_force_thaw = TRUE;
3241 argrest++;
3242 }
3243 }
3244
3245 /* -q[f][f]l...: Run the queue only on local deliveries */
3246
3247 if (*argrest == 'l')
3248 {
3249 queue_run_local = TRUE;
3250 argrest++;
3251 }
3252
3253 /* -q[f][f][l][G<name>]... Work on the named queue */
3254
3255 if (*argrest == 'G')
3256 {
3257 int i;
3258 for (argrest++, i = 0; argrest[i] && argrest[i] != '/'; ) i++;
3259 queue_name = string_copyn(argrest, i);
3260 argrest += i;
3261 if (*argrest == '/') argrest++;
3262 }
3263
3264 /* -q[f][f][l][G<name>]: Run the queue, optionally forced, optionally local
3265 only, optionally named, optionally starting from a given message id. */
3266
3267 if (*argrest == 0 &&
3268 (i + 1 >= argc || argv[i+1][0] == '-' || mac_ismsgid(argv[i+1])))
3269 {
3270 queue_interval = 0;
3271 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3272 start_queue_run_id = argv[++i];
3273 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3274 stop_queue_run_id = argv[++i];
3275 }
3276
3277 /* -q[f][f][l][G<name>/]<n>: Run the queue at regular intervals, optionally
3278 forced, optionally local only, optionally named. */
3279
3280 else if ((queue_interval = readconf_readtime(*argrest ? argrest : argv[++i],
3281 0, FALSE)) <= 0)
3282 {
3283 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3284 exit(EXIT_FAILURE);
3285 }
3286 break;
3287
3288
3289 case 'R': /* Synonymous with -qR... */
3290 receiving_message = FALSE;
3291
3292 /* -Rf: As -R (below) but force all deliveries,
3293 -Rff: Ditto, but also thaw all frozen messages,
3294 -Rr: String is regex
3295 -Rrf: Regex and force
3296 -Rrff: Regex and force and thaw
3297
3298 in all cases provided there are no further characters in this
3299 argument. */
3300
3301 if (*argrest != 0)
3302 {
3303 int i;
3304 for (i = 0; i < nelem(rsopts); i++)
3305 if (Ustrcmp(argrest, rsopts[i]) == 0)
3306 {
3307 if (i != 2) queue_run_force = TRUE;
3308 if (i >= 2) deliver_selectstring_regex = TRUE;
3309 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3310 argrest += Ustrlen(rsopts[i]);
3311 }
3312 }
3313
3314 /* -R: Set string to match in addresses for forced queue run to
3315 pick out particular messages. */
3316
3317 if (*argrest)
3318 deliver_selectstring = argrest;
3319 else if (i+1 < argc)
3320 deliver_selectstring = argv[++i];
3321 else
3322 {
3323 fprintf(stderr, "exim: string expected after -R\n");
3324 exit(EXIT_FAILURE);
3325 }
3326 break;
3327
3328
3329 /* -r: an obsolete synonym for -f (see above) */
3330
3331
3332 /* -S: Like -R but works on sender. */
3333
3334 case 'S': /* Synonymous with -qS... */
3335 receiving_message = FALSE;
3336
3337 /* -Sf: As -S (below) but force all deliveries,
3338 -Sff: Ditto, but also thaw all frozen messages,
3339 -Sr: String is regex
3340 -Srf: Regex and force
3341 -Srff: Regex and force and thaw
3342
3343 in all cases provided there are no further characters in this
3344 argument. */
3345
3346 if (*argrest)
3347 {
3348 int i;
3349 for (i = 0; i < nelem(rsopts); i++)
3350 if (Ustrcmp(argrest, rsopts[i]) == 0)
3351 {
3352 if (i != 2) queue_run_force = TRUE;
3353 if (i >= 2) deliver_selectstring_sender_regex = TRUE;
3354 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3355 argrest += Ustrlen(rsopts[i]);
3356 }
3357 }
3358
3359 /* -S: Set string to match in addresses for forced queue run to
3360 pick out particular messages. */
3361
3362 if (*argrest)
3363 deliver_selectstring_sender = argrest;
3364 else if (i+1 < argc)
3365 deliver_selectstring_sender = argv[++i];
3366 else
3367 {
3368 fprintf(stderr, "exim: string expected after -S\n");
3369 exit(EXIT_FAILURE);
3370 }
3371 break;
3372
3373 /* -Tqt is an option that is exclusively for use by the testing suite.
3374 It is not recognized in other circumstances. It allows for the setting up
3375 of explicit "queue times" so that various warning/retry things can be
3376 tested. Otherwise variability of clock ticks etc. cause problems. */
3377
3378 case 'T':
3379 if (running_in_test_harness && Ustrcmp(argrest, "qt") == 0)
3380 fudged_queue_times = argv[++i];
3381 else badarg = TRUE;
3382 break;
3383
3384
3385 /* -t: Set flag to extract recipients from body of message. */
3386
3387 case 't':
3388 if (*argrest == 0) extract_recipients = TRUE;
3389
3390 /* -ti: Set flag to extract recipients from body of message, and also
3391 specify that dot does not end the message. */
3392
3393 else if (Ustrcmp(argrest, "i") == 0)
3394 {
3395 extract_recipients = TRUE;
3396 dot_ends = FALSE;
3397 }
3398
3399 /* -tls-on-connect: don't wait for STARTTLS (for old clients) */
3400
3401 #ifdef SUPPORT_TLS
3402 else if (Ustrcmp(argrest, "ls-on-connect") == 0) tls_in.on_connect = TRUE;
3403 #endif
3404
3405 else badarg = TRUE;
3406 break;
3407
3408
3409 /* -U: This means "initial user submission" in sendmail, apparently. The
3410 doc claims that in future sendmail may refuse syntactically invalid
3411 messages instead of fixing them. For the moment, we just ignore it. */
3412
3413 case 'U':
3414 break;
3415
3416
3417 /* -v: verify things - this is a very low-level debugging */
3418
3419 case 'v':
3420 if (*argrest == 0)
3421 {
3422 debug_selector |= D_v;
3423 debug_file = stderr;
3424 }
3425 else badarg = TRUE;
3426 break;
3427
3428
3429 /* -x: AIX uses this to indicate some fancy 8-bit character stuff:
3430
3431 The -x flag tells the sendmail command that mail from a local
3432 mail program has National Language Support (NLS) extended characters
3433 in the body of the mail item. The sendmail command can send mail with
3434 extended NLS characters across networks that normally corrupts these
3435 8-bit characters.
3436
3437 As Exim is 8-bit clean, it just ignores this flag. */
3438
3439 case 'x':
3440 if (*argrest != 0) badarg = TRUE;
3441 break;
3442
3443 /* -X: in sendmail: takes one parameter, logfile, and sends debugging
3444 logs to that file. We swallow the parameter and otherwise ignore it. */
3445
3446 case 'X':
3447 if (*argrest == '\0')
3448 if (++i >= argc)
3449 {
3450 fprintf(stderr, "exim: string expected after -X\n");
3451 exit(EXIT_FAILURE);
3452 }
3453 break;
3454
3455 case 'z':
3456 if (*argrest == '\0')
3457 if (++i < argc) log_oneline = argv[i]; else
3458 {
3459 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
3460 exit(EXIT_FAILURE);
3461 }
3462 break;
3463
3464 /* All other initial characters are errors */
3465
3466 default:
3467 badarg = TRUE;
3468 break;
3469 } /* End of high-level switch statement */
3470
3471 /* Failed to recognize the option, or syntax error */
3472
3473 if (badarg)
3474 {
3475 fprintf(stderr, "exim abandoned: unknown, malformed, or incomplete "
3476 "option %s\n", arg);
3477 exit(EXIT_FAILURE);
3478 }
3479 }
3480
3481
3482 /* If -R or -S have been specified without -q, assume a single queue run. */
3483
3484 if ( (deliver_selectstring || deliver_selectstring_sender)
3485 && queue_interval < 0)
3486 queue_interval = 0;
3487
3488
3489 END_ARG:
3490 /* If usage_wanted is set we call the usage function - which never returns */
3491 if (usage_wanted) exim_usage(called_as);
3492
3493 /* Arguments have been processed. Check for incompatibilities. */
3494 if ((
3495 (smtp_input || extract_recipients || recipients_arg < argc) &&
3496 (daemon_listen || queue_interval >= 0 || bi_option ||
3497 test_retry_arg >= 0 || test_rewrite_arg >= 0 ||
3498 filter_test != FTEST_NONE || (msg_action_arg > 0 && !one_msg_action))
3499 ) ||
3500 (
3501 msg_action_arg > 0 &&
3502 (daemon_listen || queue_interval > 0 || list_options ||
3503 (checking && msg_action != MSG_LOAD) ||
3504 bi_option || test_retry_arg >= 0 || test_rewrite_arg >= 0)
3505 ) ||
3506 (
3507 (daemon_listen || queue_interval > 0) &&
3508 (sender_address != NULL || list_options || list_queue || checking ||
3509 bi_option)
3510 ) ||
3511 (
3512 daemon_listen && queue_interval == 0
3513 ) ||
3514 (
3515 inetd_wait_mode && queue_interval >= 0
3516 ) ||
3517 (
3518 list_options &&
3519 (checking || smtp_input || extract_recipients ||
3520 filter_test != FTEST_NONE || bi_option)
3521 ) ||
3522 (
3523 verify_address_mode &&
3524 (address_test_mode || smtp_input || extract_recipients ||
3525 filter_test != FTEST_NONE || bi_option)
3526 ) ||
3527 (
3528 address_test_mode && (smtp_input || extract_recipients ||
3529 filter_test != FTEST_NONE || bi_option)
3530 ) ||
3531 (
3532 smtp_input && (sender_address != NULL || filter_test != FTEST_NONE ||
3533 extract_recipients)
3534 ) ||
3535 (
3536 deliver_selectstring != NULL && queue_interval < 0
3537 ) ||
3538 (
3539 msg_action == MSG_LOAD &&
3540 (!expansion_test || expansion_test_message != NULL)
3541 )
3542 )
3543 {
3544 fprintf(stderr, "exim: incompatible command-line options or arguments\n");
3545 exit(EXIT_FAILURE);
3546 }
3547
3548 /* If debugging is set up, set the file and the file descriptor to pass on to
3549 child processes. It should, of course, be 2 for stderr. Also, force the daemon
3550 to run in the foreground. */
3551
3552 if (debug_selector != 0)
3553 {
3554 debug_file = stderr;
3555 debug_fd = fileno(debug_file);
3556 background_daemon = FALSE;
3557 if (running_in_test_harness) millisleep(100); /* lets caller finish */
3558 if (debug_selector != D_v) /* -v only doesn't show this */
3559 {
3560 debug_printf("Exim version %s uid=%ld gid=%ld pid=%d D=%x\n",
3561 version_string, (long int)real_uid, (long int)real_gid, (int)getpid(),
3562 debug_selector);
3563 if (!version_printed)
3564 show_whats_supported(stderr);
3565 }
3566 }
3567
3568 /* When started with root privilege, ensure that the limits on the number of
3569 open files and the number of processes (where that is accessible) are
3570 sufficiently large, or are unset, in case Exim has been called from an
3571 environment where the limits are screwed down. Not all OS have the ability to
3572 change some of these limits. */
3573
3574 if (unprivileged)
3575 {
3576 DEBUG(D_any) debug_print_ids(US"Exim has no root privilege:");
3577 }
3578 else
3579 {
3580 struct rlimit rlp;
3581
3582 #ifdef RLIMIT_NOFILE
3583 if (getrlimit(RLIMIT_NOFILE, &rlp) < 0)
3584 {
3585 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NOFILE) failed: %s",
3586 strerror(errno));
3587 rlp.rlim_cur = rlp.rlim_max = 0;
3588 }
3589
3590 /* I originally chose 1000 as a nice big number that was unlikely to
3591 be exceeded. It turns out that some older OS have a fixed upper limit of
3592 256. */
3593
3594 if (rlp.rlim_cur < 1000)
3595 {
3596 rlp.rlim_cur = rlp.rlim_max = 1000;
3597 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3598 {
3599 rlp.rlim_cur = rlp.rlim_max = 256;
3600 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3601 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NOFILE) failed: %s",
3602 strerror(errno));
3603 }
3604 }
3605 #endif
3606
3607 #ifdef RLIMIT_NPROC
3608 if (getrlimit(RLIMIT_NPROC, &rlp) < 0)
3609 {
3610 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NPROC) failed: %s",
3611 strerror(errno));
3612 rlp.rlim_cur = rlp.rlim_max = 0;
3613 }
3614
3615 #ifdef RLIM_INFINITY
3616 if (rlp.rlim_cur != RLIM_INFINITY && rlp.rlim_cur < 1000)
3617 {
3618 rlp.rlim_cur = rlp.rlim_max = RLIM_INFINITY;
3619 #else
3620 if (rlp.rlim_cur < 1000)
3621 {
3622 rlp.rlim_cur = rlp.rlim_max = 1000;
3623 #endif
3624 if (setrlimit(RLIMIT_NPROC, &rlp) < 0)
3625 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NPROC) failed: %s",
3626 strerror(errno));
3627 }
3628 #endif
3629 }
3630
3631 /* Exim is normally entered as root (but some special configurations are
3632 possible that don't do this). However, it always spins off sub-processes that
3633 set their uid and gid as required for local delivery. We don't want to pass on
3634 any extra groups that root may belong to, so we want to get rid of them all at
3635 this point.
3636
3637 We need to obey setgroups() at this stage, before possibly giving up root
3638 privilege for a changed configuration file, but later on we might need to
3639 check on the additional groups for the admin user privilege - can't do that
3640 till after reading the config, which might specify the exim gid. Therefore,
3641 save the group list here first. */
3642
3643 group_count = getgroups(NGROUPS_MAX, group_list);
3644 if (group_count < 0)
3645 {
3646 fprintf(stderr, "exim: getgroups() failed: %s\n", strerror(errno));
3647 exit(EXIT_FAILURE);
3648 }
3649
3650 /* There is a fundamental difference in some BSD systems in the matter of
3651 groups. FreeBSD and BSDI are known to be different; NetBSD and OpenBSD are
3652 known not to be different. On the "different" systems there is a single group
3653 list, and the first entry in it is the current group. On all other versions of
3654 Unix there is a supplementary group list, which is in *addition* to the current
3655 group. Consequently, to get rid of all extraneous groups on a "standard" system
3656 you pass over 0 groups to setgroups(), while on a "different" system you pass
3657 over a single group - the current group, which is always the first group in the
3658 list. Calling setgroups() with zero groups on a "different" system results in
3659 an error return. The following code should cope with both types of system.
3660
3661 However, if this process isn't running as root, setgroups() can't be used
3662 since you have to be root to run it, even if throwing away groups. Not being
3663 root here happens only in some unusual configurations. We just ignore the
3664 error. */
3665
3666 if (setgroups(0, NULL) != 0)
3667 {
3668 if (setgroups(1, group_list) != 0 && !unprivileged)
3669 {
3670 fprintf(stderr, "exim: setgroups() failed: %s\n", strerror(errno));
3671 exit(EXIT_FAILURE);
3672 }
3673 }
3674
3675 /* If the configuration file name has been altered by an argument on the
3676 command line (either a new file name or a macro definition) and the caller is
3677 not root, or if this is a filter testing run, remove any setuid privilege the
3678 program has and run as the underlying user.
3679
3680 The exim user is locked out of this, which severely restricts the use of -C
3681 for some purposes.
3682
3683 Otherwise, set the real ids to the effective values (should be root unless run
3684 from inetd, which it can either be root or the exim uid, if one is configured).
3685
3686 There is a private mechanism for bypassing some of this, in order to make it
3687 possible to test lots of configurations automatically, without having either to
3688 recompile each time, or to patch in an actual configuration file name and other
3689 values (such as the path name). If running in the test harness, pretend that
3690 configuration file changes and macro definitions haven't happened. */
3691
3692 if (( /* EITHER */
3693 (!trusted_config || /* Config changed, or */
3694 !macros_trusted(opt_D_used)) && /* impermissible macros and */
3695 real_uid != root_uid && /* Not root, and */
3696 !running_in_test_harness /* Not fudged */
3697 ) || /* OR */
3698 expansion_test /* expansion testing */
3699 || /* OR */
3700 filter_test != FTEST_NONE) /* Filter testing */
3701 {
3702 setgroups(group_count, group_list);
3703 exim_setugid(real_uid, real_gid, FALSE,
3704 US"-C, -D, -be or -bf forces real uid");
3705 removed_privilege = TRUE;
3706
3707 /* In the normal case when Exim is called like this, stderr is available
3708 and should be used for any logging information because attempts to write
3709 to the log will usually fail. To arrange this, we unset really_exim. However,
3710 if no stderr is available there is no point - we might as well have a go
3711 at the log (if it fails, syslog will be written).
3712
3713 Note that if the invoker is Exim, the logs remain available. Messing with
3714 this causes unlogged successful deliveries. */
3715
3716 if ((log_stderr != NULL) && (real_uid != exim_uid))
3717 really_exim = FALSE;
3718 }
3719
3720 /* Privilege is to be retained for the moment. It may be dropped later,
3721 depending on the job that this Exim process has been asked to do. For now, set
3722 the real uid to the effective so that subsequent re-execs of Exim are done by a
3723 privileged user. */
3724
3725 else exim_setugid(geteuid(), getegid(), FALSE, US"forcing real = effective");
3726
3727 /* If testing a filter, open the file(s) now, before wasting time doing other
3728 setups and reading the message. */
3729
3730 if ((filter_test & FTEST_SYSTEM) != 0)
3731 {
3732 filter_sfd = Uopen(filter_test_sfile, O_RDONLY, 0);
3733 if (filter_sfd < 0)
3734 {
3735 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_sfile,
3736 strerror(errno));
3737 return EXIT_FAILURE;
3738 }
3739 }
3740
3741 if ((filter_test & FTEST_USER) != 0)
3742 {
3743 filter_ufd = Uopen(filter_test_ufile, O_RDONLY, 0);
3744 if (filter_ufd < 0)
3745 {
3746 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_ufile,
3747 strerror(errno));
3748 return EXIT_FAILURE;
3749 }
3750 }
3751
3752 /* Initialise lookup_list
3753 If debugging, already called above via version reporting.
3754 In either case, we initialise the list of available lookups while running
3755 as root. All dynamically modules are loaded from a directory which is
3756 hard-coded into the binary and is code which, if not a module, would be
3757 part of Exim already. Ability to modify the content of the directory
3758 is equivalent to the ability to modify a setuid binary!
3759
3760 This needs to happen before we read the main configuration. */
3761 init_lookup_list();
3762
3763 #ifdef SUPPORT_I18N
3764 if (running_in_test_harness) smtputf8_advertise_hosts = NULL;
3765 #endif
3766
3767 /* Read the main runtime configuration data; this gives up if there
3768 is a failure. It leaves the configuration file open so that the subsequent
3769 configuration data for delivery can be read if needed.
3770
3771 NOTE: immediatly after opening the configuration file we change the working
3772 directory to "/"! Later we change to $spool_directory. We do it there, because
3773 during readconf_main() some expansion takes place already. */
3774
3775 /* Store the initial cwd before we change directories */
3776 if ((initial_cwd = os_getcwd(NULL, 0)) == NULL)
3777 {
3778 perror("exim: can't get the current working directory");
3779 exit(EXIT_FAILURE);
3780 }
3781
3782 /* checking:
3783 -be[m] expansion test -
3784 -b[fF] filter test new
3785 -bh[c] host test -
3786 -bmalware malware_test_file new
3787 -brt retry test new
3788 -brw rewrite test new
3789 -bt address test -
3790 -bv[s] address verify -
3791 list_options:
3792 -bP <option> (except -bP config, which sets list_config)
3793
3794 If any of these options is set, we suppress warnings about configuration
3795 issues (currently about tls_advertise_hosts and keep_environment not being
3796 defined) */
3797
3798 readconf_main(checking || list_options);
3799
3800 /* Now in directory "/" */
3801
3802 if (cleanup_environment() == FALSE)
3803 log_write(0, LOG_PANIC_DIE, "Can't cleanup environment");
3804
3805
3806 /* If an action on specific messages is requested, or if a daemon or queue
3807 runner is being started, we need to know if Exim was called by an admin user.
3808 This is the case if the real user is root or exim, or if the real group is
3809 exim, or if one of the supplementary groups is exim or a group listed in
3810 admin_groups. We don't fail all message actions immediately if not admin_user,
3811 since some actions can be performed by non-admin users. Instead, set admin_user
3812 for later interrogation. */
3813
3814 if (real_uid == root_uid || real_uid == exim_uid || real_gid == exim_gid)
3815 admin_user = TRUE;
3816 else
3817 {
3818 int i, j;
3819 for (i = 0; i < group_count; i++)
3820 {
3821 if (group_list[i] == exim_gid) admin_user = TRUE;
3822 else if (admin_groups != NULL)
3823 {
3824 for (j = 1; j <= (int)(admin_groups[0]); j++)
3825 if (admin_groups[j] == group_list[i])
3826 { admin_user = TRUE; break; }
3827 }
3828 if (admin_user) break;
3829 }
3830 }
3831
3832 /* Another group of privileged users are the trusted users. These are root,
3833 exim, and any caller matching trusted_users or trusted_groups. Trusted callers
3834 are permitted to specify sender_addresses with -f on the command line, and
3835 other message parameters as well. */
3836
3837 if (real_uid == root_uid || real_uid == exim_uid)
3838 trusted_caller = TRUE;
3839 else
3840 {
3841 int i, j;
3842
3843 if (trusted_users != NULL)
3844 {
3845 for (i = 1; i <= (int)(trusted_users[0]); i++)
3846 if (trusted_users[i] == real_uid)
3847 { trusted_caller = TRUE; break; }
3848 }
3849
3850 if (!trusted_caller && trusted_groups != NULL)
3851 {
3852 for (i = 1; i <= (int)(trusted_groups[0]); i++)
3853 {
3854 if (trusted_groups[i] == real_gid)
3855 trusted_caller = TRUE;
3856 else for (j = 0; j < group_count; j++)
3857 {
3858 if (trusted_groups[i] == group_list[j])
3859 { trusted_caller = TRUE; break; }
3860 }
3861 if (trusted_caller) break;
3862 }
3863 }
3864 }
3865
3866 /* Handle the decoding of logging options. */
3867
3868 decode_bits(log_selector, log_selector_size, log_notall,
3869 log_selector_string, log_options, log_options_count, US"log", 0);
3870
3871 DEBUG(D_any)
3872 {
3873 int i;
3874 debug_printf("configuration file is %s\n", config_main_filename);
3875 debug_printf("log selectors =");
3876 for (i = 0; i < log_selector_size; i++)
3877 debug_printf(" %08x", log_selector[i]);
3878 debug_printf("\n");
3879 }
3880
3881 /* If domain literals are not allowed, check the sender address that was
3882 supplied with -f. Ditto for a stripped trailing dot. */
3883
3884 if (sender_address != NULL)
3885 {
3886 if (sender_address[sender_address_domain] == '[' && !allow_domain_literals)
3887 {
3888 fprintf(stderr, "exim: bad -f address \"%s\": domain literals not "
3889 "allowed\n", sender_address);
3890 return EXIT_FAILURE;
3891 }
3892 if (f_end_dot && !strip_trailing_dot)
3893 {
3894 fprintf(stderr, "exim: bad -f address \"%s.\": domain is malformed "
3895 "(trailing dot not allowed)\n", sender_address);
3896 return EXIT_FAILURE;
3897 }
3898 }
3899
3900 /* See if an admin user overrode our logging. */
3901
3902 if (cmdline_syslog_name != NULL)
3903 {
3904 if (admin_user)
3905 {
3906 syslog_processname = cmdline_syslog_name;
3907 log_file_path = string_copy(CUS"syslog");
3908 }
3909 else
3910 {
3911 /* not a panic, non-privileged users should not be able to spam paniclog */
3912 fprintf(stderr,
3913 "exim: you lack sufficient privilege to specify syslog process name\n");
3914 return EXIT_FAILURE;
3915 }
3916 }
3917
3918 /* Paranoia check of maximum lengths of certain strings. There is a check
3919 on the length of the log file path in log.c, which will come into effect
3920 if there are any calls to write the log earlier than this. However, if we
3921 get this far but the string is very long, it is better to stop now than to
3922 carry on and (e.g.) receive a message and then have to collapse. The call to
3923 log_write() from here will cause the ultimate panic collapse if the complete
3924 file name exceeds the buffer length. */
3925
3926 if (Ustrlen(log_file_path) > 200)
3927 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3928 "log_file_path is longer than 200 chars: aborting");
3929
3930 if (Ustrlen(pid_file_path) > 200)
3931 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3932 "pid_file_path is longer than 200 chars: aborting");
3933
3934 if (Ustrlen(spool_directory) > 200)
3935 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3936 "spool_directory is longer than 200 chars: aborting");
3937
3938 /* Length check on the process name given to syslog for its TAG field,
3939 which is only permitted to be 32 characters or less. See RFC 3164. */
3940
3941 if (Ustrlen(syslog_processname) > 32)
3942 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3943 "syslog_processname is longer than 32 chars: aborting");
3944
3945 if (log_oneline)
3946 if (admin_user)
3947 {
3948 log_write(0, LOG_MAIN, "%s", log_oneline);
3949 return EXIT_SUCCESS;
3950 }
3951 else
3952 return EXIT_FAILURE;
3953
3954 /* In some operating systems, the environment variable TMPDIR controls where
3955 temporary files are created; Exim doesn't use these (apart from when delivering
3956 to MBX mailboxes), but called libraries such as DBM libraries may require them.
3957 If TMPDIR is found in the environment, reset it to the value defined in the
3958 EXIM_TMPDIR macro, if this macro is defined. For backward compatibility this
3959 macro may be called TMPDIR in old "Local/Makefile"s. It's converted to
3960 EXIM_TMPDIR by the build scripts.
3961 */
3962
3963 #ifdef EXIM_TMPDIR
3964 {
3965 uschar **p;
3966 if (environ) for (p = USS environ; *p; p++)
3967 if (Ustrncmp(*p, "TMPDIR=", 7) == 0 && Ustrcmp(*p+7, EXIM_TMPDIR) != 0)
3968 {
3969 uschar * newp = store_malloc(Ustrlen(EXIM_TMPDIR) + 8);
3970 sprintf(CS newp, "TMPDIR=%s", EXIM_TMPDIR);
3971 *p = newp;
3972 DEBUG(D_any) debug_printf("reset TMPDIR=%s in environment\n", EXIM_TMPDIR);
3973 }
3974 }
3975 #endif
3976
3977 /* Timezone handling. If timezone_string is "utc", set a flag to cause all
3978 timestamps to be in UTC (gmtime() is used instead of localtime()). Otherwise,
3979 we may need to get rid of a bogus timezone setting. This can arise when Exim is
3980 called by a user who has set the TZ variable. This then affects the timestamps
3981 in log files and in Received: headers, and any created Date: header lines. The
3982 required timezone is settable in the configuration file, so nothing can be done
3983 about this earlier - but hopefully nothing will normally be logged earlier than
3984 this. We have to make a new environment if TZ is wrong, but don't bother if
3985 timestamps_utc is set, because then all times are in UTC anyway. */
3986
3987 if (timezone_string && strcmpic(timezone_string, US"UTC") == 0)
3988 timestamps_utc = TRUE;
3989 else
3990 {
3991 uschar *envtz = US getenv("TZ");
3992 if (envtz
3993 ? !timezone_string || Ustrcmp(timezone_string, envtz) != 0
3994 : timezone_string != NULL
3995 )
3996 {
3997 uschar **p = USS environ;
3998 uschar **new;
3999 uschar **newp;
4000 int count = 0;
4001 if (environ) while (*p++) count++;
4002 if (!envtz) count++;
4003 newp = new = store_malloc(sizeof(uschar *) * (count + 1));
4004 if (environ) for (p = USS environ; *p; p++)
4005 if (Ustrncmp(*p, "TZ=", 3) != 0) *newp++ = *p;
4006 if (timezone_string)
4007 {
4008 *newp = store_malloc(Ustrlen(timezone_string) + 4);
4009 sprintf(CS *newp++, "TZ=%s", timezone_string);
4010 }
4011 *newp = NULL;
4012 environ = CSS new;
4013 tzset();
4014 DEBUG(D_any) debug_printf("Reset TZ to %s: time is %s\n", timezone_string,
4015 tod_stamp(tod_log));
4016 }
4017 }
4018
4019 /* Handle the case when we have removed the setuid privilege because of -C or
4020 -D. This means that the caller of Exim was not root.
4021
4022 There is a problem if we were running as the Exim user. The sysadmin may
4023 expect this case to retain privilege because "the binary was called by the
4024 Exim user", but it hasn't, because either the -D option set macros, or the
4025 -C option set a non-trusted configuration file. There are two possibilities:
4026
4027 (1) If deliver_drop_privilege is set, Exim is not going to re-exec in order
4028 to do message deliveries. Thus, the fact that it is running as a
4029 non-privileged user is plausible, and might be wanted in some special
4030 configurations. However, really_exim will have been set false when
4031 privilege was dropped, to stop Exim trying to write to its normal log
4032 files. Therefore, re-enable normal log processing, assuming the sysadmin
4033 has set up the log directory correctly.
4034
4035 (2) If deliver_drop_privilege is not set, the configuration won't work as
4036 apparently intended, and so we log a panic message. In order to retain
4037 root for -C or -D, the caller must either be root or be invoking a
4038 trusted configuration file (when deliver_drop_privilege is false). */
4039
4040 if ( removed_privilege
4041 && (!trusted_config || opt_D_used)
4042 && real_uid == exim_uid)
4043 if (deliver_drop_privilege)
4044 really_exim = TRUE; /* let logging work normally */
4045 else
4046 log_write(0, LOG_MAIN|LOG_PANIC,
4047 "exim user lost privilege for using %s option",
4048 trusted_config? "-D" : "-C");
4049
4050 /* Start up Perl interpreter if Perl support is configured and there is a
4051 perl_startup option, and the configuration or the command line specifies
4052 initializing starting. Note that the global variables are actually called
4053 opt_perl_xxx to avoid clashing with perl's namespace (perl_*). */
4054
4055 #ifdef EXIM_PERL
4056 if (perl_start_option != 0)
4057 opt_perl_at_start = (perl_start_option > 0);
4058 if (opt_perl_at_start && opt_perl_startup != NULL)
4059 {
4060 uschar *errstr;
4061 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
4062 errstr = init_perl(opt_perl_startup);
4063 if (errstr != NULL)
4064 {
4065 fprintf(stderr, "exim: error in perl_startup code: %s\n", errstr);
4066 return EXIT_FAILURE;
4067 }
4068 opt_perl_started = TRUE;
4069 }
4070 #endif /* EXIM_PERL */
4071
4072 /* Log the arguments of the call if the configuration file said so. This is
4073 a debugging feature for finding out what arguments certain MUAs actually use.
4074 Don't attempt it if logging is disabled, or if listing variables or if
4075 verifying/testing addresses or expansions. */
4076
4077 if (((debug_selector & D_any) != 0 || LOGGING(arguments))
4078 && really_exim && !list_options && !checking)
4079 {
4080 int i;
4081 uschar *p = big_buffer;
4082 Ustrcpy(p, "cwd= (failed)");
4083
4084 Ustrncpy(p + 4, initial_cwd, big_buffer_size-5);
4085
4086 while (*p) p++;
4087 (void)string_format(p, big_buffer_size - (p - big_buffer), " %d args:", argc);
4088 while (*p) p++;
4089 for (i = 0; i < argc; i++)
4090 {
4091 int len = Ustrlen(argv[i]);
4092 const uschar *printing;
4093 uschar *quote;
4094 if (p + len + 8 >= big_buffer + big_buffer_size)
4095 {
4096 Ustrcpy(p, " ...");
4097 log_write(0, LOG_MAIN, "%s", big_buffer);
4098 Ustrcpy(big_buffer, "...");
4099 p = big_buffer + 3;
4100 }
4101 printing = string_printing(argv[i]);
4102 if (printing[0] == 0) quote = US"\""; else
4103 {
4104 const uschar *pp = printing;
4105 quote = US"";
4106 while (*pp != 0) if (isspace(*pp++)) { quote = US"\""; break; }
4107 }
4108 sprintf(CS p, " %s%.*s%s", quote, (int)(big_buffer_size -
4109 (p - big_buffer) - 4), printing, quote);
4110 while (*p) p++;
4111 }
4112
4113 if (LOGGING(arguments))
4114 log_write(0, LOG_MAIN, "%s", big_buffer);
4115 else
4116 debug_printf("%s\n", big_buffer);
4117 }
4118
4119 /* Set the working directory to be the top-level spool directory. We don't rely
4120 on this in the code, which always uses fully qualified names, but it's useful
4121 for core dumps etc. Don't complain if it fails - the spool directory might not
4122 be generally accessible and calls with the -C option (and others) have lost
4123 privilege by now. Before the chdir, we try to ensure that the directory exists.
4124 */
4125
4126 if (Uchdir(spool_directory) != 0)
4127 {
4128 int dummy;
4129 (void)directory_make(spool_directory, US"", SPOOL_DIRECTORY_MODE, FALSE);
4130 dummy = /* quieten compiler */ Uchdir(spool_directory);
4131 }
4132
4133 /* Handle calls with the -bi option. This is a sendmail option to rebuild *the*
4134 alias file. Exim doesn't have such a concept, but this call is screwed into
4135 Sun's YP makefiles. Handle this by calling a configured script, as the real
4136 user who called Exim. The -oA option can be used to pass an argument to the
4137 script. */
4138