3ab657fea12df65c9cc4ca97277755ec354adcfb
[exim.git] / src / src / exim.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8
9 /* The main function: entry point, initialization, and high-level control.
10 Also a few functions that don't naturally fit elsewhere. */
11
12
13 #include "exim.h"
14
15 extern void init_lookup_list(void);
16
17
18
19 /*************************************************
20 * Function interface to store functions *
21 *************************************************/
22
23 /* We need some real functions to pass to the PCRE regular expression library
24 for store allocation via Exim's store manager. The normal calls are actually
25 macros that pass over location information to make tracing easier. These
26 functions just interface to the standard macro calls. A good compiler will
27 optimize out the tail recursion and so not make them too expensive. There
28 are two sets of functions; one for use when we want to retain the compiled
29 regular expression for a long time; the other for short-term use. */
30
31 static void *
32 function_store_get(size_t size)
33 {
34 return store_get((int)size);
35 }
36
37 static void
38 function_dummy_free(void *block) { block = block; }
39
40 static void *
41 function_store_malloc(size_t size)
42 {
43 return store_malloc((int)size);
44 }
45
46 static void
47 function_store_free(void *block)
48 {
49 store_free(block);
50 }
51
52
53
54
55 /*************************************************
56 * Enums for cmdline interface *
57 *************************************************/
58
59 enum commandline_info { CMDINFO_NONE=0,
60 CMDINFO_HELP, CMDINFO_SIEVE, CMDINFO_DSCP };
61
62
63
64
65 /*************************************************
66 * Compile regular expression and panic on fail *
67 *************************************************/
68
69 /* This function is called when failure to compile a regular expression leads
70 to a panic exit. In other cases, pcre_compile() is called directly. In many
71 cases where this function is used, the results of the compilation are to be
72 placed in long-lived store, so we temporarily reset the store management
73 functions that PCRE uses if the use_malloc flag is set.
74
75 Argument:
76 pattern the pattern to compile
77 caseless TRUE if caseless matching is required
78 use_malloc TRUE if compile into malloc store
79
80 Returns: pointer to the compiled pattern
81 */
82
83 const pcre *
84 regex_must_compile(uschar *pattern, BOOL caseless, BOOL use_malloc)
85 {
86 int offset;
87 int options = PCRE_COPT;
88 const pcre *yield;
89 const uschar *error;
90 if (use_malloc)
91 {
92 pcre_malloc = function_store_malloc;
93 pcre_free = function_store_free;
94 }
95 if (caseless) options |= PCRE_CASELESS;
96 yield = pcre_compile(CS pattern, options, (const char **)&error, &offset, NULL);
97 pcre_malloc = function_store_get;
98 pcre_free = function_dummy_free;
99 if (yield == NULL)
100 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "regular expression error: "
101 "%s at offset %d while compiling %s", error, offset, pattern);
102 return yield;
103 }
104
105
106
107
108 /*************************************************
109 * Execute regular expression and set strings *
110 *************************************************/
111
112 /* This function runs a regular expression match, and sets up the pointers to
113 the matched substrings.
114
115 Arguments:
116 re the compiled expression
117 subject the subject string
118 options additional PCRE options
119 setup if < 0 do full setup
120 if >= 0 setup from setup+1 onwards,
121 excluding the full matched string
122
123 Returns: TRUE or FALSE
124 */
125
126 BOOL
127 regex_match_and_setup(const pcre *re, uschar *subject, int options, int setup)
128 {
129 int ovector[3*(EXPAND_MAXN+1)];
130 int n = pcre_exec(re, NULL, CS subject, Ustrlen(subject), 0,
131 PCRE_EOPT | options, ovector, sizeof(ovector)/sizeof(int));
132 BOOL yield = n >= 0;
133 if (n == 0) n = EXPAND_MAXN + 1;
134 if (yield)
135 {
136 int nn;
137 expand_nmax = (setup < 0)? 0 : setup + 1;
138 for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
139 {
140 expand_nstring[expand_nmax] = subject + ovector[nn];
141 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
142 }
143 expand_nmax--;
144 }
145 return yield;
146 }
147
148
149
150
151 /*************************************************
152 * Set up processing details *
153 *************************************************/
154
155 /* Save a text string for dumping when SIGUSR1 is received.
156 Do checks for overruns.
157
158 Arguments: format and arguments, as for printf()
159 Returns: nothing
160 */
161
162 void
163 set_process_info(const char *format, ...)
164 {
165 int len;
166 va_list ap;
167 sprintf(CS process_info, "%5d ", (int)getpid());
168 len = Ustrlen(process_info);
169 va_start(ap, format);
170 if (!string_vformat(process_info + len, PROCESS_INFO_SIZE - len - 2, format, ap))
171 Ustrcpy(process_info + len, "**** string overflowed buffer ****");
172 len = Ustrlen(process_info);
173 process_info[len+0] = '\n';
174 process_info[len+1] = '\0';
175 process_info_len = len + 1;
176 DEBUG(D_process_info) debug_printf("set_process_info: %s", process_info);
177 va_end(ap);
178 }
179
180
181
182
183 /*************************************************
184 * Handler for SIGUSR1 *
185 *************************************************/
186
187 /* SIGUSR1 causes any exim process to write to the process log details of
188 what it is currently doing. It will only be used if the OS is capable of
189 setting up a handler that causes automatic restarting of any system call
190 that is in progress at the time.
191
192 This function takes care to be signal-safe.
193
194 Argument: the signal number (SIGUSR1)
195 Returns: nothing
196 */
197
198 static void
199 usr1_handler(int sig)
200 {
201 int fd;
202
203 os_restarting_signal(sig, usr1_handler);
204
205 fd = Uopen(process_log_path, O_APPEND|O_WRONLY, LOG_MODE);
206 if (fd < 0)
207 {
208 /* If we are already running as the Exim user, try to create it in the
209 current process (assuming spool_directory exists). Otherwise, if we are
210 root, do the creation in an exim:exim subprocess. */
211
212 int euid = geteuid();
213 if (euid == exim_uid)
214 fd = Uopen(process_log_path, O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
215 else if (euid == root_uid)
216 fd = log_create_as_exim(process_log_path);
217 }
218
219 /* If we are neither exim nor root, or if we failed to create the log file,
220 give up. There is not much useful we can do with errors, since we don't want
221 to disrupt whatever is going on outside the signal handler. */
222
223 if (fd < 0) return;
224
225 {int dummy = write(fd, process_info, process_info_len); dummy = dummy; }
226 (void)close(fd);
227 }
228
229
230
231 /*************************************************
232 * Timeout handler *
233 *************************************************/
234
235 /* This handler is enabled most of the time that Exim is running. The handler
236 doesn't actually get used unless alarm() has been called to set a timer, to
237 place a time limit on a system call of some kind. When the handler is run, it
238 re-enables itself.
239
240 There are some other SIGALRM handlers that are used in special cases when more
241 than just a flag setting is required; for example, when reading a message's
242 input. These are normally set up in the code module that uses them, and the
243 SIGALRM handler is reset to this one afterwards.
244
245 Argument: the signal value (SIGALRM)
246 Returns: nothing
247 */
248
249 void
250 sigalrm_handler(int sig)
251 {
252 sig = sig; /* Keep picky compilers happy */
253 sigalrm_seen = TRUE;
254 os_non_restarting_signal(SIGALRM, sigalrm_handler);
255 }
256
257
258
259 /*************************************************
260 * Sleep for a fractional time interval *
261 *************************************************/
262
263 /* This function is called by millisleep() and exim_wait_tick() to wait for a
264 period of time that may include a fraction of a second. The coding is somewhat
265 tedious. We do not expect setitimer() ever to fail, but if it does, the process
266 will wait for ever, so we panic in this instance. (There was a case of this
267 when a bug in a function that calls milliwait() caused it to pass invalid data.
268 That's when I added the check. :-)
269
270 Argument: an itimerval structure containing the interval
271 Returns: nothing
272 */
273
274 static void
275 milliwait(struct itimerval *itval)
276 {
277 sigset_t sigmask;
278 sigset_t old_sigmask;
279 (void)sigemptyset(&sigmask); /* Empty mask */
280 (void)sigaddset(&sigmask, SIGALRM); /* Add SIGALRM */
281 (void)sigprocmask(SIG_BLOCK, &sigmask, &old_sigmask); /* Block SIGALRM */
282 if (setitimer(ITIMER_REAL, itval, NULL) < 0) /* Start timer */
283 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
284 "setitimer() failed: %s", strerror(errno));
285 (void)sigfillset(&sigmask); /* All signals */
286 (void)sigdelset(&sigmask, SIGALRM); /* Remove SIGALRM */
287 (void)sigsuspend(&sigmask); /* Until SIGALRM */
288 (void)sigprocmask(SIG_SETMASK, &old_sigmask, NULL); /* Restore mask */
289 }
290
291
292
293
294 /*************************************************
295 * Millisecond sleep function *
296 *************************************************/
297
298 /* The basic sleep() function has a granularity of 1 second, which is too rough
299 in some cases - for example, when using an increasing delay to slow down
300 spammers.
301
302 Argument: number of millseconds
303 Returns: nothing
304 */
305
306 void
307 millisleep(int msec)
308 {
309 struct itimerval itval;
310 itval.it_interval.tv_sec = 0;
311 itval.it_interval.tv_usec = 0;
312 itval.it_value.tv_sec = msec/1000;
313 itval.it_value.tv_usec = (msec % 1000) * 1000;
314 milliwait(&itval);
315 }
316
317
318
319 /*************************************************
320 * Compare microsecond times *
321 *************************************************/
322
323 /*
324 Arguments:
325 tv1 the first time
326 tv2 the second time
327
328 Returns: -1, 0, or +1
329 */
330
331 int
332 exim_tvcmp(struct timeval *t1, struct timeval *t2)
333 {
334 if (t1->tv_sec > t2->tv_sec) return +1;
335 if (t1->tv_sec < t2->tv_sec) return -1;
336 if (t1->tv_usec > t2->tv_usec) return +1;
337 if (t1->tv_usec < t2->tv_usec) return -1;
338 return 0;
339 }
340
341
342
343
344 /*************************************************
345 * Clock tick wait function *
346 *************************************************/
347
348 /* Exim uses a time + a pid to generate a unique identifier in two places: its
349 message IDs, and in file names for maildir deliveries. Because some OS now
350 re-use pids within the same second, sub-second times are now being used.
351 However, for absolute certaintly, we must ensure the clock has ticked before
352 allowing the relevant process to complete. At the time of implementation of
353 this code (February 2003), the speed of processors is such that the clock will
354 invariably have ticked already by the time a process has done its job. This
355 function prepares for the time when things are faster - and it also copes with
356 clocks that go backwards.
357
358 Arguments:
359 then_tv A timeval which was used to create uniqueness; its usec field
360 has been rounded down to the value of the resolution.
361 We want to be sure the current time is greater than this.
362 resolution The resolution that was used to divide the microseconds
363 (1 for maildir, larger for message ids)
364
365 Returns: nothing
366 */
367
368 void
369 exim_wait_tick(struct timeval *then_tv, int resolution)
370 {
371 struct timeval now_tv;
372 long int now_true_usec;
373
374 (void)gettimeofday(&now_tv, NULL);
375 now_true_usec = now_tv.tv_usec;
376 now_tv.tv_usec = (now_true_usec/resolution) * resolution;
377
378 if (exim_tvcmp(&now_tv, then_tv) <= 0)
379 {
380 struct itimerval itval;
381 itval.it_interval.tv_sec = 0;
382 itval.it_interval.tv_usec = 0;
383 itval.it_value.tv_sec = then_tv->tv_sec - now_tv.tv_sec;
384 itval.it_value.tv_usec = then_tv->tv_usec + resolution - now_true_usec;
385
386 /* We know that, overall, "now" is less than or equal to "then". Therefore, a
387 negative value for the microseconds is possible only in the case when "now"
388 is more than a second less than "then". That means that itval.it_value.tv_sec
389 is greater than zero. The following correction is therefore safe. */
390
391 if (itval.it_value.tv_usec < 0)
392 {
393 itval.it_value.tv_usec += 1000000;
394 itval.it_value.tv_sec -= 1;
395 }
396
397 DEBUG(D_transport|D_receive)
398 {
399 if (!running_in_test_harness)
400 {
401 debug_printf("tick check: %lu.%06lu %lu.%06lu\n",
402 then_tv->tv_sec, then_tv->tv_usec, now_tv.tv_sec, now_tv.tv_usec);
403 debug_printf("waiting %lu.%06lu\n", itval.it_value.tv_sec,
404 itval.it_value.tv_usec);
405 }
406 }
407
408 milliwait(&itval);
409 }
410 }
411
412
413
414
415 /*************************************************
416 * Call fopen() with umask 777 and adjust mode *
417 *************************************************/
418
419 /* Exim runs with umask(0) so that files created with open() have the mode that
420 is specified in the open() call. However, there are some files, typically in
421 the spool directory, that are created with fopen(). They end up world-writeable
422 if no precautions are taken. Although the spool directory is not accessible to
423 the world, this is an untidiness. So this is a wrapper function for fopen()
424 that sorts out the mode of the created file.
425
426 Arguments:
427 filename the file name
428 options the fopen() options
429 mode the required mode
430
431 Returns: the fopened FILE or NULL
432 */
433
434 FILE *
435 modefopen(const uschar *filename, const char *options, mode_t mode)
436 {
437 mode_t saved_umask = umask(0777);
438 FILE *f = Ufopen(filename, options);
439 (void)umask(saved_umask);
440 if (f != NULL) (void)fchmod(fileno(f), mode);
441 return f;
442 }
443
444
445
446
447 /*************************************************
448 * Ensure stdin, stdout, and stderr exist *
449 *************************************************/
450
451 /* Some operating systems grumble if an exec() happens without a standard
452 input, output, and error (fds 0, 1, 2) being defined. The worry is that some
453 file will be opened and will use these fd values, and then some other bit of
454 code will assume, for example, that it can write error messages to stderr.
455 This function ensures that fds 0, 1, and 2 are open if they do not already
456 exist, by connecting them to /dev/null.
457
458 This function is also used to ensure that std{in,out,err} exist at all times,
459 so that if any library that Exim calls tries to use them, it doesn't crash.
460
461 Arguments: None
462 Returns: Nothing
463 */
464
465 void
466 exim_nullstd(void)
467 {
468 int i;
469 int devnull = -1;
470 struct stat statbuf;
471 for (i = 0; i <= 2; i++)
472 {
473 if (fstat(i, &statbuf) < 0 && errno == EBADF)
474 {
475 if (devnull < 0) devnull = open("/dev/null", O_RDWR);
476 if (devnull < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
477 string_open_failed(errno, "/dev/null"));
478 if (devnull != i) (void)dup2(devnull, i);
479 }
480 }
481 if (devnull > 2) (void)close(devnull);
482 }
483
484
485
486
487 /*************************************************
488 * Close unwanted file descriptors for delivery *
489 *************************************************/
490
491 /* This function is called from a new process that has been forked to deliver
492 an incoming message, either directly, or using exec.
493
494 We want any smtp input streams to be closed in this new process. However, it
495 has been observed that using fclose() here causes trouble. When reading in -bS
496 input, duplicate copies of messages have been seen. The files will be sharing a
497 file pointer with the parent process, and it seems that fclose() (at least on
498 some systems - I saw this on Solaris 2.5.1) messes with that file pointer, at
499 least sometimes. Hence we go for closing the underlying file descriptors.
500
501 If TLS is active, we want to shut down the TLS library, but without molesting
502 the parent's SSL connection.
503
504 For delivery of a non-SMTP message, we want to close stdin and stdout (and
505 stderr unless debugging) because the calling process might have set them up as
506 pipes and be waiting for them to close before it waits for the submission
507 process to terminate. If they aren't closed, they hold up the calling process
508 until the initial delivery process finishes, which is not what we want.
509
510 Exception: We do want it for synchronous delivery!
511
512 And notwithstanding all the above, if D_resolver is set, implying resolver
513 debugging, leave stdout open, because that's where the resolver writes its
514 debugging output.
515
516 When we close stderr (which implies we've also closed stdout), we also get rid
517 of any controlling terminal.
518
519 Arguments: None
520 Returns: Nothing
521 */
522
523 static void
524 close_unwanted(void)
525 {
526 if (smtp_input)
527 {
528 #ifdef SUPPORT_TLS
529 tls_close(TRUE, FALSE); /* Shut down the TLS library */
530 #endif
531 (void)close(fileno(smtp_in));
532 (void)close(fileno(smtp_out));
533 smtp_in = NULL;
534 }
535 else
536 {
537 (void)close(0); /* stdin */
538 if ((debug_selector & D_resolver) == 0) (void)close(1); /* stdout */
539 if (debug_selector == 0) /* stderr */
540 {
541 if (!synchronous_delivery)
542 {
543 (void)close(2);
544 log_stderr = NULL;
545 }
546 (void)setsid();
547 }
548 }
549 }
550
551
552
553
554 /*************************************************
555 * Set uid and gid *
556 *************************************************/
557
558 /* This function sets a new uid and gid permanently, optionally calling
559 initgroups() to set auxiliary groups. There are some special cases when running
560 Exim in unprivileged modes. In these situations the effective uid will not be
561 root; if we already have the right effective uid/gid, and don't need to
562 initialize any groups, leave things as they are.
563
564 Arguments:
565 uid the uid
566 gid the gid
567 igflag TRUE if initgroups() wanted
568 msg text to use in debugging output and failure log
569
570 Returns: nothing; bombs out on failure
571 */
572
573 void
574 exim_setugid(uid_t uid, gid_t gid, BOOL igflag, uschar *msg)
575 {
576 uid_t euid = geteuid();
577 gid_t egid = getegid();
578
579 if (euid == root_uid || euid != uid || egid != gid || igflag)
580 {
581 /* At least one OS returns +1 for initgroups failure, so just check for
582 non-zero. */
583
584 if (igflag)
585 {
586 struct passwd *pw = getpwuid(uid);
587 if (pw != NULL)
588 {
589 if (initgroups(pw->pw_name, gid) != 0)
590 log_write(0,LOG_MAIN|LOG_PANIC_DIE,"initgroups failed for uid=%ld: %s",
591 (long int)uid, strerror(errno));
592 }
593 else log_write(0, LOG_MAIN|LOG_PANIC_DIE, "cannot run initgroups(): "
594 "no passwd entry for uid=%ld", (long int)uid);
595 }
596
597 if (setgid(gid) < 0 || setuid(uid) < 0)
598 {
599 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to set gid=%ld or uid=%ld "
600 "(euid=%ld): %s", (long int)gid, (long int)uid, (long int)euid, msg);
601 }
602 }
603
604 /* Debugging output included uid/gid and all groups */
605
606 DEBUG(D_uid)
607 {
608 int group_count, save_errno;
609 gid_t group_list[NGROUPS_MAX];
610 debug_printf("changed uid/gid: %s\n uid=%ld gid=%ld pid=%ld\n", msg,
611 (long int)geteuid(), (long int)getegid(), (long int)getpid());
612 group_count = getgroups(NGROUPS_MAX, group_list);
613 save_errno = errno;
614 debug_printf(" auxiliary group list:");
615 if (group_count > 0)
616 {
617 int i;
618 for (i = 0; i < group_count; i++) debug_printf(" %d", (int)group_list[i]);
619 }
620 else if (group_count < 0)
621 debug_printf(" <error: %s>", strerror(save_errno));
622 else debug_printf(" <none>");
623 debug_printf("\n");
624 }
625 }
626
627
628
629
630 /*************************************************
631 * Exit point *
632 *************************************************/
633
634 /* Exim exits via this function so that it always clears up any open
635 databases.
636
637 Arguments:
638 rc return code
639
640 Returns: does not return
641 */
642
643 void
644 exim_exit(int rc)
645 {
646 search_tidyup();
647 DEBUG(D_any)
648 debug_printf(">>>>>>>>>>>>>>>> Exim pid=%d terminating with rc=%d "
649 ">>>>>>>>>>>>>>>>\n", (int)getpid(), rc);
650 exit(rc);
651 }
652
653
654
655
656 /*************************************************
657 * Extract port from host address *
658 *************************************************/
659
660 /* Called to extract the port from the values given to -oMa and -oMi.
661 It also checks the syntax of the address, and terminates it before the
662 port data when a port is extracted.
663
664 Argument:
665 address the address, with possible port on the end
666
667 Returns: the port, or zero if there isn't one
668 bombs out on a syntax error
669 */
670
671 static int
672 check_port(uschar *address)
673 {
674 int port = host_address_extract_port(address);
675 if (string_is_ip_address(address, NULL) == 0)
676 {
677 fprintf(stderr, "exim abandoned: \"%s\" is not an IP address\n", address);
678 exit(EXIT_FAILURE);
679 }
680 return port;
681 }
682
683
684
685 /*************************************************
686 * Test/verify an address *
687 *************************************************/
688
689 /* This function is called by the -bv and -bt code. It extracts a working
690 address from a full RFC 822 address. This isn't really necessary per se, but it
691 has the effect of collapsing source routes.
692
693 Arguments:
694 s the address string
695 flags flag bits for verify_address()
696 exit_value to be set for failures
697
698 Returns: nothing
699 */
700
701 static void
702 test_address(uschar *s, int flags, int *exit_value)
703 {
704 int start, end, domain;
705 uschar *parse_error = NULL;
706 uschar *address = parse_extract_address(s, &parse_error, &start, &end, &domain,
707 FALSE);
708 if (address == NULL)
709 {
710 fprintf(stdout, "syntax error: %s\n", parse_error);
711 *exit_value = 2;
712 }
713 else
714 {
715 int rc = verify_address(deliver_make_addr(address,TRUE), stdout, flags, -1,
716 -1, -1, NULL, NULL, NULL);
717 if (rc == FAIL) *exit_value = 2;
718 else if (rc == DEFER && *exit_value == 0) *exit_value = 1;
719 }
720 }
721
722
723
724 /*************************************************
725 * Show supported features *
726 *************************************************/
727
728 /* This function is called for -bV/--version and for -d to output the optional
729 features of the current Exim binary.
730
731 Arguments: a FILE for printing
732 Returns: nothing
733 */
734
735 static void
736 show_whats_supported(FILE *f)
737 {
738 auth_info *authi;
739
740 #ifdef DB_VERSION_STRING
741 fprintf(f, "Berkeley DB: %s\n", DB_VERSION_STRING);
742 #elif defined(BTREEVERSION) && defined(HASHVERSION)
743 #ifdef USE_DB
744 fprintf(f, "Probably Berkeley DB version 1.8x (native mode)\n");
745 #else
746 fprintf(f, "Probably Berkeley DB version 1.8x (compatibility mode)\n");
747 #endif
748 #elif defined(_DBM_RDONLY) || defined(dbm_dirfno)
749 fprintf(f, "Probably ndbm\n");
750 #elif defined(USE_TDB)
751 fprintf(f, "Using tdb\n");
752 #else
753 #ifdef USE_GDBM
754 fprintf(f, "Probably GDBM (native mode)\n");
755 #else
756 fprintf(f, "Probably GDBM (compatibility mode)\n");
757 #endif
758 #endif
759
760 fprintf(f, "Support for:");
761 #ifdef SUPPORT_CRYPTEQ
762 fprintf(f, " crypteq");
763 #endif
764 #if HAVE_ICONV
765 fprintf(f, " iconv()");
766 #endif
767 #if HAVE_IPV6
768 fprintf(f, " IPv6");
769 #endif
770 #ifdef HAVE_SETCLASSRESOURCES
771 fprintf(f, " use_setclassresources");
772 #endif
773 #ifdef SUPPORT_PAM
774 fprintf(f, " PAM");
775 #endif
776 #ifdef EXIM_PERL
777 fprintf(f, " Perl");
778 #endif
779 #ifdef EXPAND_DLFUNC
780 fprintf(f, " Expand_dlfunc");
781 #endif
782 #ifdef USE_TCP_WRAPPERS
783 fprintf(f, " TCPwrappers");
784 #endif
785 #ifdef SUPPORT_TLS
786 #ifdef USE_GNUTLS
787 fprintf(f, " GnuTLS");
788 #else
789 fprintf(f, " OpenSSL");
790 #endif
791 #endif
792 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
793 fprintf(f, " translate_ip_address");
794 #endif
795 #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
796 fprintf(f, " move_frozen_messages");
797 #endif
798 #ifdef WITH_CONTENT_SCAN
799 fprintf(f, " Content_Scanning");
800 #endif
801 #ifndef DISABLE_DKIM
802 fprintf(f, " DKIM");
803 #endif
804 #ifdef WITH_OLD_DEMIME
805 fprintf(f, " Old_Demime");
806 #endif
807 #ifdef EXPERIMENTAL_SPF
808 fprintf(f, " Experimental_SPF");
809 #endif
810 #ifdef EXPERIMENTAL_SRS
811 fprintf(f, " Experimental_SRS");
812 #endif
813 #ifdef EXPERIMENTAL_BRIGHTMAIL
814 fprintf(f, " Experimental_Brightmail");
815 #endif
816 #ifdef EXPERIMENTAL_DCC
817 fprintf(f, " Experimental_DCC");
818 #endif
819 #ifdef EXPERIMENTAL_DMARC
820 fprintf(f, " Experimental_DMARC");
821 #endif
822 #ifdef EXPERIMENTAL_OCSP
823 fprintf(f, " Experimental_OCSP");
824 #endif
825 #ifdef EXPERIMENTAL_PRDR
826 fprintf(f, " Experimental_PRDR");
827 #endif
828 #ifdef EXPERIMENTAL_PROXY
829 fprintf(f, " Experimental_Proxy");
830 #endif
831 #ifdef EXPERIMENTAL_TPDA
832 fprintf(f, " Experimental_TPDA");
833 #endif
834 #ifdef EXPERIMENTAL_REDIS
835 fprintf(f, " Experimental_Redis");
836 #endif
837 fprintf(f, "\n");
838
839 fprintf(f, "Lookups (built-in):");
840 #if defined(LOOKUP_LSEARCH) && LOOKUP_LSEARCH!=2
841 fprintf(f, " lsearch wildlsearch nwildlsearch iplsearch");
842 #endif
843 #if defined(LOOKUP_CDB) && LOOKUP_CDB!=2
844 fprintf(f, " cdb");
845 #endif
846 #if defined(LOOKUP_DBM) && LOOKUP_DBM!=2
847 fprintf(f, " dbm dbmjz dbmnz");
848 #endif
849 #if defined(LOOKUP_DNSDB) && LOOKUP_DNSDB!=2
850 fprintf(f, " dnsdb");
851 #endif
852 #if defined(LOOKUP_DSEARCH) && LOOKUP_DSEARCH!=2
853 fprintf(f, " dsearch");
854 #endif
855 #if defined(LOOKUP_IBASE) && LOOKUP_IBASE!=2
856 fprintf(f, " ibase");
857 #endif
858 #if defined(LOOKUP_LDAP) && LOOKUP_LDAP!=2
859 fprintf(f, " ldap ldapdn ldapm");
860 #endif
861 #if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
862 fprintf(f, " mysql");
863 #endif
864 #if defined(LOOKUP_NIS) && LOOKUP_NIS!=2
865 fprintf(f, " nis nis0");
866 #endif
867 #if defined(LOOKUP_NISPLUS) && LOOKUP_NISPLUS!=2
868 fprintf(f, " nisplus");
869 #endif
870 #if defined(LOOKUP_ORACLE) && LOOKUP_ORACLE!=2
871 fprintf(f, " oracle");
872 #endif
873 #if defined(LOOKUP_PASSWD) && LOOKUP_PASSWD!=2
874 fprintf(f, " passwd");
875 #endif
876 #if defined(LOOKUP_PGSQL) && LOOKUP_PGSQL!=2
877 fprintf(f, " pgsql");
878 #endif
879 #if defined(LOOKUP_SQLITE) && LOOKUP_SQLITE!=2
880 fprintf(f, " sqlite");
881 #endif
882 #if defined(LOOKUP_TESTDB) && LOOKUP_TESTDB!=2
883 fprintf(f, " testdb");
884 #endif
885 #if defined(LOOKUP_WHOSON) && LOOKUP_WHOSON!=2
886 fprintf(f, " whoson");
887 #endif
888 fprintf(f, "\n");
889
890 fprintf(f, "Authenticators:");
891 #ifdef AUTH_CRAM_MD5
892 fprintf(f, " cram_md5");
893 #endif
894 #ifdef AUTH_CYRUS_SASL
895 fprintf(f, " cyrus_sasl");
896 #endif
897 #ifdef AUTH_DOVECOT
898 fprintf(f, " dovecot");
899 #endif
900 #ifdef AUTH_GSASL
901 fprintf(f, " gsasl");
902 #endif
903 #ifdef AUTH_HEIMDAL_GSSAPI
904 fprintf(f, " heimdal_gssapi");
905 #endif
906 #ifdef AUTH_PLAINTEXT
907 fprintf(f, " plaintext");
908 #endif
909 #ifdef AUTH_SPA
910 fprintf(f, " spa");
911 #endif
912 fprintf(f, "\n");
913
914 fprintf(f, "Routers:");
915 #ifdef ROUTER_ACCEPT
916 fprintf(f, " accept");
917 #endif
918 #ifdef ROUTER_DNSLOOKUP
919 fprintf(f, " dnslookup");
920 #endif
921 #ifdef ROUTER_IPLITERAL
922 fprintf(f, " ipliteral");
923 #endif
924 #ifdef ROUTER_IPLOOKUP
925 fprintf(f, " iplookup");
926 #endif
927 #ifdef ROUTER_MANUALROUTE
928 fprintf(f, " manualroute");
929 #endif
930 #ifdef ROUTER_QUERYPROGRAM
931 fprintf(f, " queryprogram");
932 #endif
933 #ifdef ROUTER_REDIRECT
934 fprintf(f, " redirect");
935 #endif
936 fprintf(f, "\n");
937
938 fprintf(f, "Transports:");
939 #ifdef TRANSPORT_APPENDFILE
940 fprintf(f, " appendfile");
941 #ifdef SUPPORT_MAILDIR
942 fprintf(f, "/maildir");
943 #endif
944 #ifdef SUPPORT_MAILSTORE
945 fprintf(f, "/mailstore");
946 #endif
947 #ifdef SUPPORT_MBX
948 fprintf(f, "/mbx");
949 #endif
950 #endif
951 #ifdef TRANSPORT_AUTOREPLY
952 fprintf(f, " autoreply");
953 #endif
954 #ifdef TRANSPORT_LMTP
955 fprintf(f, " lmtp");
956 #endif
957 #ifdef TRANSPORT_PIPE
958 fprintf(f, " pipe");
959 #endif
960 #ifdef TRANSPORT_SMTP
961 fprintf(f, " smtp");
962 #endif
963 fprintf(f, "\n");
964
965 if (fixed_never_users[0] > 0)
966 {
967 int i;
968 fprintf(f, "Fixed never_users: ");
969 for (i = 1; i <= (int)fixed_never_users[0] - 1; i++)
970 fprintf(f, "%d:", (unsigned int)fixed_never_users[i]);
971 fprintf(f, "%d\n", (unsigned int)fixed_never_users[i]);
972 }
973
974 fprintf(f, "Size of off_t: " SIZE_T_FMT "\n", sizeof(off_t));
975
976 /* Everything else is details which are only worth reporting when debugging.
977 Perhaps the tls_version_report should move into this too. */
978 DEBUG(D_any) do {
979
980 int i;
981
982 /* clang defines __GNUC__ (at least, for me) so test for it first */
983 #if defined(__clang__)
984 fprintf(f, "Compiler: CLang [%s]\n", __clang_version__);
985 #elif defined(__GNUC__)
986 fprintf(f, "Compiler: GCC [%s]\n",
987 # ifdef __VERSION__
988 __VERSION__
989 # else
990 "? unknown version ?"
991 # endif
992 );
993 #else
994 fprintf(f, "Compiler: <unknown>\n");
995 #endif
996
997 #ifdef SUPPORT_TLS
998 tls_version_report(f);
999 #endif
1000
1001 for (authi = auths_available; *authi->driver_name != '\0'; ++authi) {
1002 if (authi->version_report) {
1003 (*authi->version_report)(f);
1004 }
1005 }
1006
1007 /* PCRE_PRERELEASE is either defined and empty or a bare sequence of
1008 characters; unless it's an ancient version of PCRE in which case it
1009 is not defined. */
1010 #ifndef PCRE_PRERELEASE
1011 #define PCRE_PRERELEASE
1012 #endif
1013 #define QUOTE(X) #X
1014 #define EXPAND_AND_QUOTE(X) QUOTE(X)
1015 fprintf(f, "Library version: PCRE: Compile: %d.%d%s\n"
1016 " Runtime: %s\n",
1017 PCRE_MAJOR, PCRE_MINOR,
1018 EXPAND_AND_QUOTE(PCRE_PRERELEASE) "",
1019 pcre_version());
1020 #undef QUOTE
1021 #undef EXPAND_AND_QUOTE
1022
1023 init_lookup_list();
1024 for (i = 0; i < lookup_list_count; i++)
1025 {
1026 if (lookup_list[i]->version_report)
1027 lookup_list[i]->version_report(f);
1028 }
1029
1030 #ifdef WHITELIST_D_MACROS
1031 fprintf(f, "WHITELIST_D_MACROS: \"%s\"\n", WHITELIST_D_MACROS);
1032 #else
1033 fprintf(f, "WHITELIST_D_MACROS unset\n");
1034 #endif
1035 #ifdef TRUSTED_CONFIG_LIST
1036 fprintf(f, "TRUSTED_CONFIG_LIST: \"%s\"\n", TRUSTED_CONFIG_LIST);
1037 #else
1038 fprintf(f, "TRUSTED_CONFIG_LIST unset\n");
1039 #endif
1040
1041 } while (0);
1042 }
1043
1044
1045 /*************************************************
1046 * Show auxiliary information about Exim *
1047 *************************************************/
1048
1049 static void
1050 show_exim_information(enum commandline_info request, FILE *stream)
1051 {
1052 const uschar **pp;
1053
1054 switch(request)
1055 {
1056 case CMDINFO_NONE:
1057 fprintf(stream, "Oops, something went wrong.\n");
1058 return;
1059 case CMDINFO_HELP:
1060 fprintf(stream,
1061 "The -bI: flag takes a string indicating which information to provide.\n"
1062 "If the string is not recognised, you'll get this help (on stderr).\n"
1063 "\n"
1064 " exim -bI:help this information\n"
1065 " exim -bI:dscp dscp value keywords known\n"
1066 " exim -bI:sieve list of supported sieve extensions, one per line.\n"
1067 );
1068 return;
1069 case CMDINFO_SIEVE:
1070 for (pp = exim_sieve_extension_list; *pp; ++pp)
1071 fprintf(stream, "%s\n", *pp);
1072 return;
1073 case CMDINFO_DSCP:
1074 dscp_list_to_stream(stream);
1075 return;
1076 }
1077 }
1078
1079
1080 /*************************************************
1081 * Quote a local part *
1082 *************************************************/
1083
1084 /* This function is used when a sender address or a From: or Sender: header
1085 line is being created from the caller's login, or from an authenticated_id. It
1086 applies appropriate quoting rules for a local part.
1087
1088 Argument: the local part
1089 Returns: the local part, quoted if necessary
1090 */
1091
1092 uschar *
1093 local_part_quote(uschar *lpart)
1094 {
1095 BOOL needs_quote = FALSE;
1096 int size, ptr;
1097 uschar *yield;
1098 uschar *t;
1099
1100 for (t = lpart; !needs_quote && *t != 0; t++)
1101 {
1102 needs_quote = !isalnum(*t) && strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
1103 (*t != '.' || t == lpart || t[1] == 0);
1104 }
1105
1106 if (!needs_quote) return lpart;
1107
1108 size = ptr = 0;
1109 yield = string_cat(NULL, &size, &ptr, US"\"", 1);
1110
1111 for (;;)
1112 {
1113 uschar *nq = US Ustrpbrk(lpart, "\\\"");
1114 if (nq == NULL)
1115 {
1116 yield = string_cat(yield, &size, &ptr, lpart, Ustrlen(lpart));
1117 break;
1118 }
1119 yield = string_cat(yield, &size, &ptr, lpart, nq - lpart);
1120 yield = string_cat(yield, &size, &ptr, US"\\", 1);
1121 yield = string_cat(yield, &size, &ptr, nq, 1);
1122 lpart = nq + 1;
1123 }
1124
1125 yield = string_cat(yield, &size, &ptr, US"\"", 1);
1126 yield[ptr] = 0;
1127 return yield;
1128 }
1129
1130
1131
1132 #ifdef USE_READLINE
1133 /*************************************************
1134 * Load readline() functions *
1135 *************************************************/
1136
1137 /* This function is called from testing executions that read data from stdin,
1138 but only when running as the calling user. Currently, only -be does this. The
1139 function loads the readline() function library and passes back the functions.
1140 On some systems, it needs the curses library, so load that too, but try without
1141 it if loading fails. All this functionality has to be requested at build time.
1142
1143 Arguments:
1144 fn_readline_ptr pointer to where to put the readline pointer
1145 fn_addhist_ptr pointer to where to put the addhistory function
1146
1147 Returns: the dlopen handle or NULL on failure
1148 */
1149
1150 static void *
1151 set_readline(char * (**fn_readline_ptr)(const char *),
1152 void (**fn_addhist_ptr)(const char *))
1153 {
1154 void *dlhandle;
1155 void *dlhandle_curses = dlopen("libcurses." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_LAZY);
1156
1157 dlhandle = dlopen("libreadline." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_NOW);
1158 if (dlhandle_curses != NULL) dlclose(dlhandle_curses);
1159
1160 if (dlhandle != NULL)
1161 {
1162 /* Checked manual pages; at least in GNU Readline 6.1, the prototypes are:
1163 * char * readline (const char *prompt);
1164 * void add_history (const char *string);
1165 */
1166 *fn_readline_ptr = (char *(*)(const char*))dlsym(dlhandle, "readline");
1167 *fn_addhist_ptr = (void(*)(const char*))dlsym(dlhandle, "add_history");
1168 }
1169 else
1170 {
1171 DEBUG(D_any) debug_printf("failed to load readline: %s\n", dlerror());
1172 }
1173
1174 return dlhandle;
1175 }
1176 #endif
1177
1178
1179
1180 /*************************************************
1181 * Get a line from stdin for testing things *
1182 *************************************************/
1183
1184 /* This function is called when running tests that can take a number of lines
1185 of input (for example, -be and -bt). It handles continuations and trailing
1186 spaces. And prompting and a blank line output on eof. If readline() is in use,
1187 the arguments are non-NULL and provide the relevant functions.
1188
1189 Arguments:
1190 fn_readline readline function or NULL
1191 fn_addhist addhist function or NULL
1192
1193 Returns: pointer to dynamic memory, or NULL at end of file
1194 */
1195
1196 static uschar *
1197 get_stdinput(char *(*fn_readline)(const char *), void(*fn_addhist)(const char *))
1198 {
1199 int i;
1200 int size = 0;
1201 int ptr = 0;
1202 uschar *yield = NULL;
1203
1204 if (fn_readline == NULL) { printf("> "); fflush(stdout); }
1205
1206 for (i = 0;; i++)
1207 {
1208 uschar buffer[1024];
1209 uschar *p, *ss;
1210
1211 #ifdef USE_READLINE
1212 char *readline_line = NULL;
1213 if (fn_readline != NULL)
1214 {
1215 if ((readline_line = fn_readline((i > 0)? "":"> ")) == NULL) break;
1216 if (*readline_line != 0 && fn_addhist != NULL) fn_addhist(readline_line);
1217 p = US readline_line;
1218 }
1219 else
1220 #endif
1221
1222 /* readline() not in use */
1223
1224 {
1225 if (Ufgets(buffer, sizeof(buffer), stdin) == NULL) break;
1226 p = buffer;
1227 }
1228
1229 /* Handle the line */
1230
1231 ss = p + (int)Ustrlen(p);
1232 while (ss > p && isspace(ss[-1])) ss--;
1233
1234 if (i > 0)
1235 {
1236 while (p < ss && isspace(*p)) p++; /* leading space after cont */
1237 }
1238
1239 yield = string_cat(yield, &size, &ptr, p, ss - p);
1240
1241 #ifdef USE_READLINE
1242 if (fn_readline != NULL) free(readline_line);
1243 #endif
1244
1245 if (ss == p || yield[ptr-1] != '\\')
1246 {
1247 yield[ptr] = 0;
1248 break;
1249 }
1250 yield[--ptr] = 0;
1251 }
1252
1253 if (yield == NULL) printf("\n");
1254 return yield;
1255 }
1256
1257
1258
1259 /*************************************************
1260 * Output usage information for the program *
1261 *************************************************/
1262
1263 /* This function is called when there are no recipients
1264 or a specific --help argument was added.
1265
1266 Arguments:
1267 progname information on what name we were called by
1268
1269 Returns: DOES NOT RETURN
1270 */
1271
1272 static void
1273 exim_usage(uschar *progname)
1274 {
1275
1276 /* Handle specific program invocation varients */
1277 if (Ustrcmp(progname, US"-mailq") == 0)
1278 {
1279 fprintf(stderr,
1280 "mailq - list the contents of the mail queue\n\n"
1281 "For a list of options, see the Exim documentation.\n");
1282 exit(EXIT_FAILURE);
1283 }
1284
1285 /* Generic usage - we output this whatever happens */
1286 fprintf(stderr,
1287 "Exim is a Mail Transfer Agent. It is normally called by Mail User Agents,\n"
1288 "not directly from a shell command line. Options and/or arguments control\n"
1289 "what it does when called. For a list of options, see the Exim documentation.\n");
1290
1291 exit(EXIT_FAILURE);
1292 }
1293
1294
1295
1296 /*************************************************
1297 * Validate that the macros given are okay *
1298 *************************************************/
1299
1300 /* Typically, Exim will drop privileges if macros are supplied. In some
1301 cases, we want to not do so.
1302
1303 Arguments: none (macros is a global)
1304 Returns: true if trusted, false otherwise
1305 */
1306
1307 static BOOL
1308 macros_trusted(void)
1309 {
1310 #ifdef WHITELIST_D_MACROS
1311 macro_item *m;
1312 uschar *whitelisted, *end, *p, **whites, **w;
1313 int white_count, i, n;
1314 size_t len;
1315 BOOL prev_char_item, found;
1316 #endif
1317
1318 if (macros == NULL)
1319 return TRUE;
1320 #ifndef WHITELIST_D_MACROS
1321 return FALSE;
1322 #else
1323
1324 /* We only trust -D overrides for some invoking users:
1325 root, the exim run-time user, the optional config owner user.
1326 I don't know why config-owner would be needed, but since they can own the
1327 config files anyway, there's no security risk to letting them override -D. */
1328 if ( ! ((real_uid == root_uid)
1329 || (real_uid == exim_uid)
1330 #ifdef CONFIGURE_OWNER
1331 || (real_uid == config_uid)
1332 #endif
1333 ))
1334 {
1335 debug_printf("macros_trusted rejecting macros for uid %d\n", (int) real_uid);
1336 return FALSE;
1337 }
1338
1339 /* Get a list of macros which are whitelisted */
1340 whitelisted = string_copy_malloc(US WHITELIST_D_MACROS);
1341 prev_char_item = FALSE;
1342 white_count = 0;
1343 for (p = whitelisted; *p != '\0'; ++p)
1344 {
1345 if (*p == ':' || isspace(*p))
1346 {
1347 *p = '\0';
1348 if (prev_char_item)
1349 ++white_count;
1350 prev_char_item = FALSE;
1351 continue;
1352 }
1353 if (!prev_char_item)
1354 prev_char_item = TRUE;
1355 }
1356 end = p;
1357 if (prev_char_item)
1358 ++white_count;
1359 if (!white_count)
1360 return FALSE;
1361 whites = store_malloc(sizeof(uschar *) * (white_count+1));
1362 for (p = whitelisted, i = 0; (p != end) && (i < white_count); ++p)
1363 {
1364 if (*p != '\0')
1365 {
1366 whites[i++] = p;
1367 if (i == white_count)
1368 break;
1369 while (*p != '\0' && p < end)
1370 ++p;
1371 }
1372 }
1373 whites[i] = NULL;
1374
1375 /* The list of macros should be very short. Accept the N*M complexity. */
1376 for (m = macros; m != NULL; m = m->next)
1377 {
1378 found = FALSE;
1379 for (w = whites; *w; ++w)
1380 if (Ustrcmp(*w, m->name) == 0)
1381 {
1382 found = TRUE;
1383 break;
1384 }
1385 if (!found)
1386 return FALSE;
1387 if (m->replacement == NULL)
1388 continue;
1389 len = Ustrlen(m->replacement);
1390 if (len == 0)
1391 continue;
1392 n = pcre_exec(regex_whitelisted_macro, NULL, CS m->replacement, len,
1393 0, PCRE_EOPT, NULL, 0);
1394 if (n < 0)
1395 {
1396 if (n != PCRE_ERROR_NOMATCH)
1397 debug_printf("macros_trusted checking %s returned %d\n", m->name, n);
1398 return FALSE;
1399 }
1400 }
1401 DEBUG(D_any) debug_printf("macros_trusted overridden to true by whitelisting\n");
1402 return TRUE;
1403 #endif
1404 }
1405
1406
1407 /*************************************************
1408 * Entry point and high-level code *
1409 *************************************************/
1410
1411 /* Entry point for the Exim mailer. Analyse the arguments and arrange to take
1412 the appropriate action. All the necessary functions are present in the one
1413 binary. I originally thought one should split it up, but it turns out that so
1414 much of the apparatus is needed in each chunk that one might as well just have
1415 it all available all the time, which then makes the coding easier as well.
1416
1417 Arguments:
1418 argc count of entries in argv
1419 argv argument strings, with argv[0] being the program name
1420
1421 Returns: EXIT_SUCCESS if terminated successfully
1422 EXIT_FAILURE otherwise, except when a message has been sent
1423 to the sender, and -oee was given
1424 */
1425
1426 int
1427 main(int argc, char **cargv)
1428 {
1429 uschar **argv = USS cargv;
1430 int arg_receive_timeout = -1;
1431 int arg_smtp_receive_timeout = -1;
1432 int arg_error_handling = error_handling;
1433 int filter_sfd = -1;
1434 int filter_ufd = -1;
1435 int group_count;
1436 int i, rv;
1437 int list_queue_option = 0;
1438 int msg_action = 0;
1439 int msg_action_arg = -1;
1440 int namelen = (argv[0] == NULL)? 0 : Ustrlen(argv[0]);
1441 int queue_only_reason = 0;
1442 #ifdef EXIM_PERL
1443 int perl_start_option = 0;
1444 #endif
1445 int recipients_arg = argc;
1446 int sender_address_domain = 0;
1447 int test_retry_arg = -1;
1448 int test_rewrite_arg = -1;
1449 BOOL arg_queue_only = FALSE;
1450 BOOL bi_option = FALSE;
1451 BOOL checking = FALSE;
1452 BOOL count_queue = FALSE;
1453 BOOL expansion_test = FALSE;
1454 BOOL extract_recipients = FALSE;
1455 BOOL flag_G = FALSE;
1456 BOOL flag_n = FALSE;
1457 BOOL forced_delivery = FALSE;
1458 BOOL f_end_dot = FALSE;
1459 BOOL deliver_give_up = FALSE;
1460 BOOL list_queue = FALSE;
1461 BOOL list_options = FALSE;
1462 BOOL local_queue_only;
1463 BOOL more = TRUE;
1464 BOOL one_msg_action = FALSE;
1465 BOOL queue_only_set = FALSE;
1466 BOOL receiving_message = TRUE;
1467 BOOL sender_ident_set = FALSE;
1468 BOOL session_local_queue_only;
1469 BOOL unprivileged;
1470 BOOL removed_privilege = FALSE;
1471 BOOL usage_wanted = FALSE;
1472 BOOL verify_address_mode = FALSE;
1473 BOOL verify_as_sender = FALSE;
1474 BOOL version_printed = FALSE;
1475 uschar *alias_arg = NULL;
1476 uschar *called_as = US"";
1477 uschar *cmdline_syslog_name = NULL;
1478 uschar *start_queue_run_id = NULL;
1479 uschar *stop_queue_run_id = NULL;
1480 uschar *expansion_test_message = NULL;
1481 uschar *ftest_domain = NULL;
1482 uschar *ftest_localpart = NULL;
1483 uschar *ftest_prefix = NULL;
1484 uschar *ftest_suffix = NULL;
1485 uschar *malware_test_file = NULL;
1486 uschar *real_sender_address;
1487 uschar *originator_home = US"/";
1488 size_t sz;
1489 void *reset_point;
1490
1491 struct passwd *pw;
1492 struct stat statbuf;
1493 pid_t passed_qr_pid = (pid_t)0;
1494 int passed_qr_pipe = -1;
1495 gid_t group_list[NGROUPS_MAX];
1496
1497 /* For the -bI: flag */
1498 enum commandline_info info_flag = CMDINFO_NONE;
1499 BOOL info_stdout = FALSE;
1500
1501 /* Possible options for -R and -S */
1502
1503 static uschar *rsopts[] = { US"f", US"ff", US"r", US"rf", US"rff" };
1504
1505 /* Need to define this in case we need to change the environment in order
1506 to get rid of a bogus time zone. We have to make it char rather than uschar
1507 because some OS define it in /usr/include/unistd.h. */
1508
1509 extern char **environ;
1510
1511 /* If the Exim user and/or group and/or the configuration file owner/group were
1512 defined by ref:name at build time, we must now find the actual uid/gid values.
1513 This is a feature to make the lives of binary distributors easier. */
1514
1515 #ifdef EXIM_USERNAME
1516 if (route_finduser(US EXIM_USERNAME, &pw, &exim_uid))
1517 {
1518 if (exim_uid == 0)
1519 {
1520 fprintf(stderr, "exim: refusing to run with uid 0 for \"%s\"\n",
1521 EXIM_USERNAME);
1522 exit(EXIT_FAILURE);
1523 }
1524 /* If ref:name uses a number as the name, route_finduser() returns
1525 TRUE with exim_uid set and pw coerced to NULL. */
1526 if (pw)
1527 exim_gid = pw->pw_gid;
1528 #ifndef EXIM_GROUPNAME
1529 else
1530 {
1531 fprintf(stderr,
1532 "exim: ref:name should specify a usercode, not a group.\n"
1533 "exim: can't let you get away with it unless you also specify a group.\n");
1534 exit(EXIT_FAILURE);
1535 }
1536 #endif
1537 }
1538 else
1539 {
1540 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1541 EXIM_USERNAME);
1542 exit(EXIT_FAILURE);
1543 }
1544 #endif
1545
1546 #ifdef EXIM_GROUPNAME
1547 if (!route_findgroup(US EXIM_GROUPNAME, &exim_gid))
1548 {
1549 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1550 EXIM_GROUPNAME);
1551 exit(EXIT_FAILURE);
1552 }
1553 #endif
1554
1555 #ifdef CONFIGURE_OWNERNAME
1556 if (!route_finduser(US CONFIGURE_OWNERNAME, NULL, &config_uid))
1557 {
1558 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1559 CONFIGURE_OWNERNAME);
1560 exit(EXIT_FAILURE);
1561 }
1562 #endif
1563
1564 /* We default the system_filter_user to be the Exim run-time user, as a
1565 sane non-root value. */
1566 system_filter_uid = exim_uid;
1567
1568 #ifdef CONFIGURE_GROUPNAME
1569 if (!route_findgroup(US CONFIGURE_GROUPNAME, &config_gid))
1570 {
1571 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1572 CONFIGURE_GROUPNAME);
1573 exit(EXIT_FAILURE);
1574 }
1575 #endif
1576
1577 /* In the Cygwin environment, some initialization needs doing. It is fudged
1578 in by means of this macro. */
1579
1580 #ifdef OS_INIT
1581 OS_INIT
1582 #endif
1583
1584 /* Check a field which is patched when we are running Exim within its
1585 testing harness; do a fast initial check, and then the whole thing. */
1586
1587 running_in_test_harness =
1588 *running_status == '<' && Ustrcmp(running_status, "<<<testing>>>") == 0;
1589
1590 /* The C standard says that the equivalent of setlocale(LC_ALL, "C") is obeyed
1591 at the start of a program; however, it seems that some environments do not
1592 follow this. A "strange" locale can affect the formatting of timestamps, so we
1593 make quite sure. */
1594
1595 setlocale(LC_ALL, "C");
1596
1597 /* Set up the default handler for timing using alarm(). */
1598
1599 os_non_restarting_signal(SIGALRM, sigalrm_handler);
1600
1601 /* Ensure we have a buffer for constructing log entries. Use malloc directly,
1602 because store_malloc writes a log entry on failure. */
1603
1604 log_buffer = (uschar *)malloc(LOG_BUFFER_SIZE);
1605 if (log_buffer == NULL)
1606 {
1607 fprintf(stderr, "exim: failed to get store for log buffer\n");
1608 exit(EXIT_FAILURE);
1609 }
1610
1611 /* Set log_stderr to stderr, provided that stderr exists. This gets reset to
1612 NULL when the daemon is run and the file is closed. We have to use this
1613 indirection, because some systems don't allow writing to the variable "stderr".
1614 */
1615
1616 if (fstat(fileno(stderr), &statbuf) >= 0) log_stderr = stderr;
1617
1618 /* Arrange for the PCRE regex library to use our store functions. Note that
1619 the normal calls are actually macros that add additional arguments for
1620 debugging purposes so we have to assign specially constructed functions here.
1621 The default is to use store in the stacking pool, but this is overridden in the
1622 regex_must_compile() function. */
1623
1624 pcre_malloc = function_store_get;
1625 pcre_free = function_dummy_free;
1626
1627 /* Ensure there is a big buffer for temporary use in several places. It is put
1628 in malloc store so that it can be freed for enlargement if necessary. */
1629
1630 big_buffer = store_malloc(big_buffer_size);
1631
1632 /* Set up the handler for the data request signal, and set the initial
1633 descriptive text. */
1634
1635 set_process_info("initializing");
1636 os_restarting_signal(SIGUSR1, usr1_handler);
1637
1638 /* SIGHUP is used to get the daemon to reconfigure. It gets set as appropriate
1639 in the daemon code. For the rest of Exim's uses, we ignore it. */
1640
1641 signal(SIGHUP, SIG_IGN);
1642
1643 /* We don't want to die on pipe errors as the code is written to handle
1644 the write error instead. */
1645
1646 signal(SIGPIPE, SIG_IGN);
1647
1648 /* Under some circumstance on some OS, Exim can get called with SIGCHLD
1649 set to SIG_IGN. This causes subprocesses that complete before the parent
1650 process waits for them not to hang around, so when Exim calls wait(), nothing
1651 is there. The wait() code has been made robust against this, but let's ensure
1652 that SIGCHLD is set to SIG_DFL, because it's tidier to wait and get a process
1653 ending status. We use sigaction rather than plain signal() on those OS where
1654 SA_NOCLDWAIT exists, because we want to be sure it is turned off. (There was a
1655 problem on AIX with this.) */
1656
1657 #ifdef SA_NOCLDWAIT
1658 {
1659 struct sigaction act;
1660 act.sa_handler = SIG_DFL;
1661 sigemptyset(&(act.sa_mask));
1662 act.sa_flags = 0;
1663 sigaction(SIGCHLD, &act, NULL);
1664 }
1665 #else
1666 signal(SIGCHLD, SIG_DFL);
1667 #endif
1668
1669 /* Save the arguments for use if we re-exec exim as a daemon after receiving
1670 SIGHUP. */
1671
1672 sighup_argv = argv;
1673
1674 /* Set up the version number. Set up the leading 'E' for the external form of
1675 message ids, set the pointer to the internal form, and initialize it to
1676 indicate no message being processed. */
1677
1678 version_init();
1679 message_id_option[0] = '-';
1680 message_id_external = message_id_option + 1;
1681 message_id_external[0] = 'E';
1682 message_id = message_id_external + 1;
1683 message_id[0] = 0;
1684
1685 /* Set the umask to zero so that any files Exim creates using open() are
1686 created with the modes that it specifies. NOTE: Files created with fopen() have
1687 a problem, which was not recognized till rather late (February 2006). With this
1688 umask, such files will be world writeable. (They are all content scanning files
1689 in the spool directory, which isn't world-accessible, so this is not a
1690 disaster, but it's untidy.) I don't want to change this overall setting,
1691 however, because it will interact badly with the open() calls. Instead, there's
1692 now a function called modefopen() that fiddles with the umask while calling
1693 fopen(). */
1694
1695 (void)umask(0);
1696
1697 /* Precompile the regular expression for matching a message id. Keep this in
1698 step with the code that generates ids in the accept.c module. We need to do
1699 this here, because the -M options check their arguments for syntactic validity
1700 using mac_ismsgid, which uses this. */
1701
1702 regex_ismsgid =
1703 regex_must_compile(US"^(?:[^\\W_]{6}-){2}[^\\W_]{2}$", FALSE, TRUE);
1704
1705 /* Precompile the regular expression that is used for matching an SMTP error
1706 code, possibly extended, at the start of an error message. Note that the
1707 terminating whitespace character is included. */
1708
1709 regex_smtp_code =
1710 regex_must_compile(US"^\\d\\d\\d\\s(?:\\d\\.\\d\\d?\\d?\\.\\d\\d?\\d?\\s)?",
1711 FALSE, TRUE);
1712
1713 #ifdef WHITELIST_D_MACROS
1714 /* Precompile the regular expression used to filter the content of macros
1715 given to -D for permissibility. */
1716
1717 regex_whitelisted_macro =
1718 regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE);
1719 #endif
1720
1721
1722 /* If the program is called as "mailq" treat it as equivalent to "exim -bp";
1723 this seems to be a generally accepted convention, since one finds symbolic
1724 links called "mailq" in standard OS configurations. */
1725
1726 if ((namelen == 5 && Ustrcmp(argv[0], "mailq") == 0) ||
1727 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/mailq", 6) == 0))
1728 {
1729 list_queue = TRUE;
1730 receiving_message = FALSE;
1731 called_as = US"-mailq";
1732 }
1733
1734 /* If the program is called as "rmail" treat it as equivalent to
1735 "exim -i -oee", thus allowing UUCP messages to be input using non-SMTP mode,
1736 i.e. preventing a single dot on a line from terminating the message, and
1737 returning with zero return code, even in cases of error (provided an error
1738 message has been sent). */
1739
1740 if ((namelen == 5 && Ustrcmp(argv[0], "rmail") == 0) ||
1741 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rmail", 6) == 0))
1742 {
1743 dot_ends = FALSE;
1744 called_as = US"-rmail";
1745 errors_sender_rc = EXIT_SUCCESS;
1746 }
1747
1748 /* If the program is called as "rsmtp" treat it as equivalent to "exim -bS";
1749 this is a smail convention. */
1750
1751 if ((namelen == 5 && Ustrcmp(argv[0], "rsmtp") == 0) ||
1752 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rsmtp", 6) == 0))
1753 {
1754 smtp_input = smtp_batched_input = TRUE;
1755 called_as = US"-rsmtp";
1756 }
1757
1758 /* If the program is called as "runq" treat it as equivalent to "exim -q";
1759 this is a smail convention. */
1760
1761 if ((namelen == 4 && Ustrcmp(argv[0], "runq") == 0) ||
1762 (namelen > 4 && Ustrncmp(argv[0] + namelen - 5, "/runq", 5) == 0))
1763 {
1764 queue_interval = 0;
1765 receiving_message = FALSE;
1766 called_as = US"-runq";
1767 }
1768
1769 /* If the program is called as "newaliases" treat it as equivalent to
1770 "exim -bi"; this is a sendmail convention. */
1771
1772 if ((namelen == 10 && Ustrcmp(argv[0], "newaliases") == 0) ||
1773 (namelen > 10 && Ustrncmp(argv[0] + namelen - 11, "/newaliases", 11) == 0))
1774 {
1775 bi_option = TRUE;
1776 receiving_message = FALSE;
1777 called_as = US"-newaliases";
1778 }
1779
1780 /* Save the original effective uid for a couple of uses later. It should
1781 normally be root, but in some esoteric environments it may not be. */
1782
1783 original_euid = geteuid();
1784
1785 /* Get the real uid and gid. If the caller is root, force the effective uid/gid
1786 to be the same as the real ones. This makes a difference only if Exim is setuid
1787 (or setgid) to something other than root, which could be the case in some
1788 special configurations. */
1789
1790 real_uid = getuid();
1791 real_gid = getgid();
1792
1793 if (real_uid == root_uid)
1794 {
1795 rv = setgid(real_gid);
1796 if (rv)
1797 {
1798 fprintf(stderr, "exim: setgid(%ld) failed: %s\n",
1799 (long int)real_gid, strerror(errno));
1800 exit(EXIT_FAILURE);
1801 }
1802 rv = setuid(real_uid);
1803 if (rv)
1804 {
1805 fprintf(stderr, "exim: setuid(%ld) failed: %s\n",
1806 (long int)real_uid, strerror(errno));
1807 exit(EXIT_FAILURE);
1808 }
1809 }
1810
1811 /* If neither the original real uid nor the original euid was root, Exim is
1812 running in an unprivileged state. */
1813
1814 unprivileged = (real_uid != root_uid && original_euid != root_uid);
1815
1816 /* Scan the program's arguments. Some can be dealt with right away; others are
1817 simply recorded for checking and handling afterwards. Do a high-level switch
1818 on the second character (the one after '-'), to save some effort. */
1819
1820 for (i = 1; i < argc; i++)
1821 {
1822 BOOL badarg = FALSE;
1823 uschar *arg = argv[i];
1824 uschar *argrest;
1825 int switchchar;
1826
1827 /* An argument not starting with '-' is the start of a recipients list;
1828 break out of the options-scanning loop. */
1829
1830 if (arg[0] != '-')
1831 {
1832 recipients_arg = i;
1833 break;
1834 }
1835
1836 /* An option consistion of -- terminates the options */
1837
1838 if (Ustrcmp(arg, "--") == 0)
1839 {
1840 recipients_arg = i + 1;
1841 break;
1842 }
1843
1844 /* Handle flagged options */
1845
1846 switchchar = arg[1];
1847 argrest = arg+2;
1848
1849 /* Make all -ex options synonymous with -oex arguments, since that
1850 is assumed by various callers. Also make -qR options synonymous with -R
1851 options, as that seems to be required as well. Allow for -qqR too, and
1852 the same for -S options. */
1853
1854 if (Ustrncmp(arg+1, "oe", 2) == 0 ||
1855 Ustrncmp(arg+1, "qR", 2) == 0 ||
1856 Ustrncmp(arg+1, "qS", 2) == 0)
1857 {
1858 switchchar = arg[2];
1859 argrest++;
1860 }
1861 else if (Ustrncmp(arg+1, "qqR", 3) == 0 || Ustrncmp(arg+1, "qqS", 3) == 0)
1862 {
1863 switchchar = arg[3];
1864 argrest += 2;
1865 queue_2stage = TRUE;
1866 }
1867
1868 /* Make -r synonymous with -f, since it is a documented alias */
1869
1870 else if (arg[1] == 'r') switchchar = 'f';
1871
1872 /* Make -ov synonymous with -v */
1873
1874 else if (Ustrcmp(arg, "-ov") == 0)
1875 {
1876 switchchar = 'v';
1877 argrest++;
1878 }
1879
1880 /* deal with --option_aliases */
1881 else if (switchchar == '-')
1882 {
1883 if (Ustrcmp(argrest, "help") == 0)
1884 {
1885 usage_wanted = TRUE;
1886 break;
1887 }
1888 else if (Ustrcmp(argrest, "version") == 0)
1889 {
1890 switchchar = 'b';
1891 argrest = US"V";
1892 }
1893 }
1894
1895 /* High-level switch on active initial letter */
1896
1897 switch(switchchar)
1898 {
1899
1900 /* sendmail uses -Ac and -Am to control which .cf file is used;
1901 we ignore them. */
1902 case 'A':
1903 if (*argrest == '\0') { badarg = TRUE; break; }
1904 else
1905 {
1906 BOOL ignore = FALSE;
1907 switch (*argrest)
1908 {
1909 case 'c':
1910 case 'm':
1911 if (*(argrest + 1) == '\0')
1912 ignore = TRUE;
1913 break;
1914 }
1915 if (!ignore) { badarg = TRUE; break; }
1916 }
1917 break;
1918
1919 /* -Btype is a sendmail option for 7bit/8bit setting. Exim is 8-bit clean
1920 so has no need of it. */
1921
1922 case 'B':
1923 if (*argrest == 0) i++; /* Skip over the type */
1924 break;
1925
1926
1927 case 'b':
1928 receiving_message = FALSE; /* Reset TRUE for -bm, -bS, -bs below */
1929
1930 /* -bd: Run in daemon mode, awaiting SMTP connections.
1931 -bdf: Ditto, but in the foreground.
1932 */
1933
1934 if (*argrest == 'd')
1935 {
1936 daemon_listen = TRUE;
1937 if (*(++argrest) == 'f') background_daemon = FALSE;
1938 else if (*argrest != 0) { badarg = TRUE; break; }
1939 }
1940
1941 /* -be: Run in expansion test mode
1942 -bem: Ditto, but read a message from a file first
1943 */
1944
1945 else if (*argrest == 'e')
1946 {
1947 expansion_test = checking = TRUE;
1948 if (argrest[1] == 'm')
1949 {
1950 if (++i >= argc) { badarg = TRUE; break; }
1951 expansion_test_message = argv[i];
1952 argrest++;
1953 }
1954 if (argrest[1] != 0) { badarg = TRUE; break; }
1955 }
1956
1957 /* -bF: Run system filter test */
1958
1959 else if (*argrest == 'F')
1960 {
1961 filter_test |= FTEST_SYSTEM;
1962 if (*(++argrest) != 0) { badarg = TRUE; break; }
1963 if (++i < argc) filter_test_sfile = argv[i]; else
1964 {
1965 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
1966 exit(EXIT_FAILURE);
1967 }
1968 }
1969
1970 /* -bf: Run user filter test
1971 -bfd: Set domain for filter testing
1972 -bfl: Set local part for filter testing
1973 -bfp: Set prefix for filter testing
1974 -bfs: Set suffix for filter testing
1975 */
1976
1977 else if (*argrest == 'f')
1978 {
1979 if (*(++argrest) == 0)
1980 {
1981 filter_test |= FTEST_USER;
1982 if (++i < argc) filter_test_ufile = argv[i]; else
1983 {
1984 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
1985 exit(EXIT_FAILURE);
1986 }
1987 }
1988 else
1989 {
1990 if (++i >= argc)
1991 {
1992 fprintf(stderr, "exim: string expected after %s\n", arg);
1993 exit(EXIT_FAILURE);
1994 }
1995 if (Ustrcmp(argrest, "d") == 0) ftest_domain = argv[i];
1996 else if (Ustrcmp(argrest, "l") == 0) ftest_localpart = argv[i];
1997 else if (Ustrcmp(argrest, "p") == 0) ftest_prefix = argv[i];
1998 else if (Ustrcmp(argrest, "s") == 0) ftest_suffix = argv[i];
1999 else { badarg = TRUE; break; }
2000 }
2001 }
2002
2003 /* -bh: Host checking - an IP address must follow. */
2004
2005 else if (Ustrcmp(argrest, "h") == 0 || Ustrcmp(argrest, "hc") == 0)
2006 {
2007 if (++i >= argc) { badarg = TRUE; break; }
2008 sender_host_address = argv[i];
2009 host_checking = checking = log_testing_mode = TRUE;
2010 host_checking_callout = argrest[1] == 'c';
2011 }
2012
2013 /* -bi: This option is used by sendmail to initialize *the* alias file,
2014 though it has the -oA option to specify a different file. Exim has no
2015 concept of *the* alias file, but since Sun's YP make script calls
2016 sendmail this way, some support must be provided. */
2017
2018 else if (Ustrcmp(argrest, "i") == 0) bi_option = TRUE;
2019
2020 /* -bI: provide information, of the type to follow after a colon.
2021 This is an Exim flag. */
2022
2023 else if (argrest[0] == 'I' && Ustrlen(argrest) >= 2 && argrest[1] == ':')
2024 {
2025 uschar *p = &argrest[2];
2026 info_flag = CMDINFO_HELP;
2027 if (Ustrlen(p))
2028 {
2029 if (strcmpic(p, CUS"sieve") == 0)
2030 {
2031 info_flag = CMDINFO_SIEVE;
2032 info_stdout = TRUE;
2033 }
2034 else if (strcmpic(p, CUS"dscp") == 0)
2035 {
2036 info_flag = CMDINFO_DSCP;
2037 info_stdout = TRUE;
2038 }
2039 else if (strcmpic(p, CUS"help") == 0)
2040 {
2041 info_stdout = TRUE;
2042 }
2043 }
2044 }
2045
2046 /* -bm: Accept and deliver message - the default option. Reinstate
2047 receiving_message, which got turned off for all -b options. */
2048
2049 else if (Ustrcmp(argrest, "m") == 0) receiving_message = TRUE;
2050
2051 /* -bmalware: test the filename given for malware */
2052
2053 else if (Ustrcmp(argrest, "malware") == 0)
2054 {
2055 if (++i >= argc) { badarg = TRUE; break; }
2056 malware_test_file = argv[i];
2057 }
2058
2059 /* -bnq: For locally originating messages, do not qualify unqualified
2060 addresses. In the envelope, this causes errors; in header lines they
2061 just get left. */
2062
2063 else if (Ustrcmp(argrest, "nq") == 0)
2064 {
2065 allow_unqualified_sender = FALSE;
2066 allow_unqualified_recipient = FALSE;
2067 }
2068
2069 /* -bpxx: List the contents of the mail queue, in various forms. If
2070 the option is -bpc, just a queue count is needed. Otherwise, if the
2071 first letter after p is r, then order is random. */
2072
2073 else if (*argrest == 'p')
2074 {
2075 if (*(++argrest) == 'c')
2076 {
2077 count_queue = TRUE;
2078 if (*(++argrest) != 0) badarg = TRUE;
2079 break;
2080 }
2081
2082 if (*argrest == 'r')
2083 {
2084 list_queue_option = 8;
2085 argrest++;
2086 }
2087 else list_queue_option = 0;
2088
2089 list_queue = TRUE;
2090
2091 /* -bp: List the contents of the mail queue, top-level only */
2092
2093 if (*argrest == 0) {}
2094
2095 /* -bpu: List the contents of the mail queue, top-level undelivered */
2096
2097 else if (Ustrcmp(argrest, "u") == 0) list_queue_option += 1;
2098
2099 /* -bpa: List the contents of the mail queue, including all delivered */
2100
2101 else if (Ustrcmp(argrest, "a") == 0) list_queue_option += 2;
2102
2103 /* Unknown after -bp[r] */
2104
2105 else
2106 {
2107 badarg = TRUE;
2108 break;
2109 }
2110 }
2111
2112
2113 /* -bP: List the configuration variables given as the address list.
2114 Force -v, so configuration errors get displayed. */
2115
2116 else if (Ustrcmp(argrest, "P") == 0)
2117 {
2118 list_options = TRUE;
2119 debug_selector |= D_v;
2120 debug_file = stderr;
2121 }
2122
2123 /* -brt: Test retry configuration lookup */
2124
2125 else if (Ustrcmp(argrest, "rt") == 0)
2126 {
2127 test_retry_arg = i + 1;
2128 goto END_ARG;
2129 }
2130
2131 /* -brw: Test rewrite configuration */
2132
2133 else if (Ustrcmp(argrest, "rw") == 0)
2134 {
2135 test_rewrite_arg = i + 1;
2136 goto END_ARG;
2137 }
2138
2139 /* -bS: Read SMTP commands on standard input, but produce no replies -
2140 all errors are reported by sending messages. */
2141
2142 else if (Ustrcmp(argrest, "S") == 0)
2143 smtp_input = smtp_batched_input = receiving_message = TRUE;
2144
2145 /* -bs: Read SMTP commands on standard input and produce SMTP replies
2146 on standard output. */
2147
2148 else if (Ustrcmp(argrest, "s") == 0) smtp_input = receiving_message = TRUE;
2149
2150 /* -bt: address testing mode */
2151
2152 else if (Ustrcmp(argrest, "t") == 0)
2153 address_test_mode = checking = log_testing_mode = TRUE;
2154
2155 /* -bv: verify addresses */
2156
2157 else if (Ustrcmp(argrest, "v") == 0)
2158 verify_address_mode = checking = log_testing_mode = TRUE;
2159
2160 /* -bvs: verify sender addresses */
2161
2162 else if (Ustrcmp(argrest, "vs") == 0)
2163 {
2164 verify_address_mode = checking = log_testing_mode = TRUE;
2165 verify_as_sender = TRUE;
2166 }
2167
2168 /* -bV: Print version string and support details */
2169
2170 else if (Ustrcmp(argrest, "V") == 0)
2171 {
2172 printf("Exim version %s #%s built %s\n", version_string,
2173 version_cnumber, version_date);
2174 printf("%s\n", CS version_copyright);
2175 version_printed = TRUE;
2176 show_whats_supported(stdout);
2177 }
2178
2179 /* -bw: inetd wait mode, accept a listening socket as stdin */
2180
2181 else if (*argrest == 'w')
2182 {
2183 inetd_wait_mode = TRUE;
2184 background_daemon = FALSE;
2185 daemon_listen = TRUE;
2186 if (*(++argrest) != '\0')
2187 {
2188 inetd_wait_timeout = readconf_readtime(argrest, 0, FALSE);
2189 if (inetd_wait_timeout <= 0)
2190 {
2191 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
2192 exit(EXIT_FAILURE);
2193 }
2194 }
2195 }
2196
2197 else badarg = TRUE;
2198 break;
2199
2200
2201 /* -C: change configuration file list; ignore if it isn't really
2202 a change! Enforce a prefix check if required. */
2203
2204 case 'C':
2205 if (*argrest == 0)
2206 {
2207 if(++i < argc) argrest = argv[i]; else
2208 { badarg = TRUE; break; }
2209 }
2210 if (Ustrcmp(config_main_filelist, argrest) != 0)
2211 {
2212 #ifdef ALT_CONFIG_PREFIX
2213 int sep = 0;
2214 int len = Ustrlen(ALT_CONFIG_PREFIX);
2215 uschar *list = argrest;
2216 uschar *filename;
2217 while((filename = string_nextinlist(&list, &sep, big_buffer,
2218 big_buffer_size)) != NULL)
2219 {
2220 if ((Ustrlen(filename) < len ||
2221 Ustrncmp(filename, ALT_CONFIG_PREFIX, len) != 0 ||
2222 Ustrstr(filename, "/../") != NULL) &&
2223 (Ustrcmp(filename, "/dev/null") != 0 || real_uid != root_uid))
2224 {
2225 fprintf(stderr, "-C Permission denied\n");
2226 exit(EXIT_FAILURE);
2227 }
2228 }
2229 #endif
2230 if (real_uid != root_uid)
2231 {
2232 #ifdef TRUSTED_CONFIG_LIST
2233
2234 if (real_uid != exim_uid
2235 #ifdef CONFIGURE_OWNER
2236 && real_uid != config_uid
2237 #endif
2238 )
2239 trusted_config = FALSE;
2240 else
2241 {
2242 FILE *trust_list = Ufopen(TRUSTED_CONFIG_LIST, "rb");
2243 if (trust_list)
2244 {
2245 struct stat statbuf;
2246
2247 if (fstat(fileno(trust_list), &statbuf) != 0 ||
2248 (statbuf.st_uid != root_uid /* owner not root */
2249 #ifdef CONFIGURE_OWNER
2250 && statbuf.st_uid != config_uid /* owner not the special one */
2251 #endif
2252 ) || /* or */
2253 (statbuf.st_gid != root_gid /* group not root */
2254 #ifdef CONFIGURE_GROUP
2255 && statbuf.st_gid != config_gid /* group not the special one */
2256 #endif
2257 && (statbuf.st_mode & 020) != 0 /* group writeable */
2258 ) || /* or */
2259 (statbuf.st_mode & 2) != 0) /* world writeable */
2260 {
2261 trusted_config = FALSE;
2262 fclose(trust_list);
2263 }
2264 else
2265 {
2266 /* Well, the trust list at least is up to scratch... */
2267 void *reset_point = store_get(0);
2268 uschar *trusted_configs[32];
2269 int nr_configs = 0;
2270 int i = 0;
2271
2272 while (Ufgets(big_buffer, big_buffer_size, trust_list))
2273 {
2274 uschar *start = big_buffer, *nl;
2275 while (*start && isspace(*start))
2276 start++;
2277 if (*start != '/')
2278 continue;
2279 nl = Ustrchr(start, '\n');
2280 if (nl)
2281 *nl = 0;
2282 trusted_configs[nr_configs++] = string_copy(start);
2283 if (nr_configs == 32)
2284 break;
2285 }
2286 fclose(trust_list);
2287
2288 if (nr_configs)
2289 {
2290 int sep = 0;
2291 uschar *list = argrest;
2292 uschar *filename;
2293 while (trusted_config && (filename = string_nextinlist(&list,
2294 &sep, big_buffer, big_buffer_size)) != NULL)
2295 {
2296 for (i=0; i < nr_configs; i++)
2297 {
2298 if (Ustrcmp(filename, trusted_configs[i]) == 0)
2299 break;
2300 }
2301 if (i == nr_configs)
2302 {
2303 trusted_config = FALSE;
2304 break;
2305 }
2306 }
2307 store_reset(reset_point);
2308 }
2309 else
2310 {
2311 /* No valid prefixes found in trust_list file. */
2312 trusted_config = FALSE;
2313 }
2314 }
2315 }
2316 else
2317 {
2318 /* Could not open trust_list file. */
2319 trusted_config = FALSE;
2320 }
2321 }
2322 #else
2323 /* Not root; don't trust config */
2324 trusted_config = FALSE;
2325 #endif
2326 }
2327
2328 config_main_filelist = argrest;
2329 config_changed = TRUE;
2330 }
2331 break;
2332
2333
2334 /* -D: set up a macro definition */
2335
2336 case 'D':
2337 #ifdef DISABLE_D_OPTION
2338 fprintf(stderr, "exim: -D is not available in this Exim binary\n");
2339 exit(EXIT_FAILURE);
2340 #else
2341 {
2342 int ptr = 0;
2343 macro_item *mlast = NULL;
2344 macro_item *m;
2345 uschar name[24];
2346 uschar *s = argrest;
2347
2348 while (isspace(*s)) s++;
2349
2350 if (*s < 'A' || *s > 'Z')
2351 {
2352 fprintf(stderr, "exim: macro name set by -D must start with "
2353 "an upper case letter\n");
2354 exit(EXIT_FAILURE);
2355 }
2356
2357 while (isalnum(*s) || *s == '_')
2358 {
2359 if (ptr < sizeof(name)-1) name[ptr++] = *s;
2360 s++;
2361 }
2362 name[ptr] = 0;
2363 if (ptr == 0) { badarg = TRUE; break; }
2364 while (isspace(*s)) s++;
2365 if (*s != 0)
2366 {
2367 if (*s++ != '=') { badarg = TRUE; break; }
2368 while (isspace(*s)) s++;
2369 }
2370
2371 for (m = macros; m != NULL; m = m->next)
2372 {
2373 if (Ustrcmp(m->name, name) == 0)
2374 {
2375 fprintf(stderr, "exim: duplicated -D in command line\n");
2376 exit(EXIT_FAILURE);
2377 }
2378 mlast = m;
2379 }
2380
2381 m = store_get(sizeof(macro_item) + Ustrlen(name));
2382 m->next = NULL;
2383 m->command_line = TRUE;
2384 if (mlast == NULL) macros = m; else mlast->next = m;
2385 Ustrcpy(m->name, name);
2386 m->replacement = string_copy(s);
2387
2388 if (clmacro_count >= MAX_CLMACROS)
2389 {
2390 fprintf(stderr, "exim: too many -D options on command line\n");
2391 exit(EXIT_FAILURE);
2392 }
2393 clmacros[clmacro_count++] = string_sprintf("-D%s=%s", m->name,
2394 m->replacement);
2395 }
2396 #endif
2397 break;
2398
2399 /* -d: Set debug level (see also -v below) or set the drop_cr option.
2400 The latter is now a no-op, retained for compatibility only. If -dd is used,
2401 debugging subprocesses of the daemon is disabled. */
2402
2403 case 'd':
2404 if (Ustrcmp(argrest, "ropcr") == 0)
2405 {
2406 /* drop_cr = TRUE; */
2407 }
2408
2409 /* Use an intermediate variable so that we don't set debugging while
2410 decoding the debugging bits. */
2411
2412 else
2413 {
2414 unsigned int selector = D_default;
2415 debug_selector = 0;
2416 debug_file = NULL;
2417 if (*argrest == 'd')
2418 {
2419 debug_daemon = TRUE;
2420 argrest++;
2421 }
2422 if (*argrest != 0)
2423 decode_bits(&selector, NULL, D_memory, 0, argrest, debug_options,
2424 debug_options_count, US"debug", 0);
2425 debug_selector = selector;
2426 }
2427 break;
2428
2429
2430 /* -E: This is a local error message. This option is not intended for
2431 external use at all, but is not restricted to trusted callers because it
2432 does no harm (just suppresses certain error messages) and if Exim is run
2433 not setuid root it won't always be trusted when it generates error
2434 messages using this option. If there is a message id following -E, point
2435 message_reference at it, for logging. */
2436
2437 case 'E':
2438 local_error_message = TRUE;
2439 if (mac_ismsgid(argrest)) message_reference = argrest;
2440 break;
2441
2442
2443 /* -ex: The vacation program calls sendmail with the undocumented "-eq"
2444 option, so it looks as if historically the -oex options are also callable
2445 without the leading -o. So we have to accept them. Before the switch,
2446 anything starting -oe has been converted to -e. Exim does not support all
2447 of the sendmail error options. */
2448
2449 case 'e':
2450 if (Ustrcmp(argrest, "e") == 0)
2451 {
2452 arg_error_handling = ERRORS_SENDER;
2453 errors_sender_rc = EXIT_SUCCESS;
2454 }
2455 else if (Ustrcmp(argrest, "m") == 0) arg_error_handling = ERRORS_SENDER;
2456 else if (Ustrcmp(argrest, "p") == 0) arg_error_handling = ERRORS_STDERR;
2457 else if (Ustrcmp(argrest, "q") == 0) arg_error_handling = ERRORS_STDERR;
2458 else if (Ustrcmp(argrest, "w") == 0) arg_error_handling = ERRORS_SENDER;
2459 else badarg = TRUE;
2460 break;
2461
2462
2463 /* -F: Set sender's full name, used instead of the gecos entry from
2464 the password file. Since users can usually alter their gecos entries,
2465 there's no security involved in using this instead. The data can follow
2466 the -F or be in the next argument. */
2467
2468 case 'F':
2469 if (*argrest == 0)
2470 {
2471 if(++i < argc) argrest = argv[i]; else
2472 { badarg = TRUE; break; }
2473 }
2474 originator_name = argrest;
2475 sender_name_forced = TRUE;
2476 break;
2477
2478
2479 /* -f: Set sender's address - this value is only actually used if Exim is
2480 run by a trusted user, or if untrusted_set_sender is set and matches the
2481 address, except that the null address can always be set by any user. The
2482 test for this happens later, when the value given here is ignored when not
2483 permitted. For an untrusted user, the actual sender is still put in Sender:
2484 if it doesn't match the From: header (unless no_local_from_check is set).
2485 The data can follow the -f or be in the next argument. The -r switch is an
2486 obsolete form of -f but since there appear to be programs out there that
2487 use anything that sendmail has ever supported, better accept it - the
2488 synonymizing is done before the switch above.
2489
2490 At this stage, we must allow domain literal addresses, because we don't
2491 know what the setting of allow_domain_literals is yet. Ditto for trailing
2492 dots and strip_trailing_dot. */
2493
2494 case 'f':
2495 {
2496 int start, end;
2497 uschar *errmess;
2498 if (*argrest == 0)
2499 {
2500 if (i+1 < argc) argrest = argv[++i]; else
2501 { badarg = TRUE; break; }
2502 }
2503 if (*argrest == 0)
2504 {
2505 sender_address = string_sprintf(""); /* Ensure writeable memory */
2506 }
2507 else
2508 {
2509 uschar *temp = argrest + Ustrlen(argrest) - 1;
2510 while (temp >= argrest && isspace(*temp)) temp--;
2511 if (temp >= argrest && *temp == '.') f_end_dot = TRUE;
2512 allow_domain_literals = TRUE;
2513 strip_trailing_dot = TRUE;
2514 sender_address = parse_extract_address(argrest, &errmess, &start, &end,
2515 &sender_address_domain, TRUE);
2516 allow_domain_literals = FALSE;
2517 strip_trailing_dot = FALSE;
2518 if (sender_address == NULL)
2519 {
2520 fprintf(stderr, "exim: bad -f address \"%s\": %s\n", argrest, errmess);
2521 return EXIT_FAILURE;
2522 }
2523 }
2524 sender_address_forced = TRUE;
2525 }
2526 break;
2527
2528 /* -G: sendmail invocation to specify that it's a gateway submission and
2529 sendmail may complain about problems instead of fixing them.
2530 We make it equivalent to an ACL "control = suppress_local_fixups" and do
2531 not at this time complain about problems. */
2532
2533 case 'G':
2534 flag_G = TRUE;
2535 break;
2536
2537 /* -h: Set the hop count for an incoming message. Exim does not currently
2538 support this; it always computes it by counting the Received: headers.
2539 To put it in will require a change to the spool header file format. */
2540
2541 case 'h':
2542 if (*argrest == 0)
2543 {
2544 if(++i < argc) argrest = argv[i]; else
2545 { badarg = TRUE; break; }
2546 }
2547 if (!isdigit(*argrest)) badarg = TRUE;
2548 break;
2549
2550
2551 /* -i: Set flag so dot doesn't end non-SMTP input (same as -oi, seems
2552 not to be documented for sendmail but mailx (at least) uses it) */
2553
2554 case 'i':
2555 if (*argrest == 0) dot_ends = FALSE; else badarg = TRUE;
2556 break;
2557
2558
2559 /* -L: set the identifier used for syslog; equivalent to setting
2560 syslog_processname in the config file, but needs to be an admin option. */
2561
2562 case 'L':
2563 if (*argrest == '\0')
2564 {
2565 if(++i < argc) argrest = argv[i]; else
2566 { badarg = TRUE; break; }
2567 }
2568 sz = Ustrlen(argrest);
2569 if (sz > 32)
2570 {
2571 fprintf(stderr, "exim: the -L syslog name is too long: \"%s\"\n", argrest);
2572 return EXIT_FAILURE;
2573 }
2574 if (sz < 1)
2575 {
2576 fprintf(stderr, "exim: the -L syslog name is too short\n");
2577 return EXIT_FAILURE;
2578 }
2579 cmdline_syslog_name = argrest;
2580 break;
2581
2582 case 'M':
2583 receiving_message = FALSE;
2584
2585 /* -MC: continue delivery of another message via an existing open
2586 file descriptor. This option is used for an internal call by the
2587 smtp transport when there is a pending message waiting to go to an
2588 address to which it has got a connection. Five subsequent arguments are
2589 required: transport name, host name, IP address, sequence number, and
2590 message_id. Transports may decline to create new processes if the sequence
2591 number gets too big. The channel is stdin. This (-MC) must be the last
2592 argument. There's a subsequent check that the real-uid is privileged.
2593
2594 If we are running in the test harness. delay for a bit, to let the process
2595 that set this one up complete. This makes for repeatability of the logging,
2596 etc. output. */
2597
2598 if (Ustrcmp(argrest, "C") == 0)
2599 {
2600 union sockaddr_46 interface_sock;
2601 EXIM_SOCKLEN_T size = sizeof(interface_sock);
2602
2603 if (argc != i + 6)
2604 {
2605 fprintf(stderr, "exim: too many or too few arguments after -MC\n");
2606 return EXIT_FAILURE;
2607 }
2608
2609 if (msg_action_arg >= 0)
2610 {
2611 fprintf(stderr, "exim: incompatible arguments\n");
2612 return EXIT_FAILURE;
2613 }
2614
2615 continue_transport = argv[++i];
2616 continue_hostname = argv[++i];
2617 continue_host_address = argv[++i];
2618 continue_sequence = Uatoi(argv[++i]);
2619 msg_action = MSG_DELIVER;
2620 msg_action_arg = ++i;
2621 forced_delivery = TRUE;
2622 queue_run_pid = passed_qr_pid;
2623 queue_run_pipe = passed_qr_pipe;
2624
2625 if (!mac_ismsgid(argv[i]))
2626 {
2627 fprintf(stderr, "exim: malformed message id %s after -MC option\n",
2628 argv[i]);
2629 return EXIT_FAILURE;
2630 }
2631
2632 /* Set up $sending_ip_address and $sending_port */
2633
2634 if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
2635 &size) == 0)
2636 sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
2637 &sending_port);
2638 else
2639 {
2640 fprintf(stderr, "exim: getsockname() failed after -MC option: %s\n",
2641 strerror(errno));
2642 return EXIT_FAILURE;
2643 }
2644
2645 if (running_in_test_harness) millisleep(500);
2646 break;
2647 }
2648
2649 /* -MCA: set the smtp_authenticated flag; this is useful only when it
2650 precedes -MC (see above). The flag indicates that the host to which
2651 Exim is connected has accepted an AUTH sequence. */
2652
2653 else if (Ustrcmp(argrest, "CA") == 0)
2654 {
2655 smtp_authenticated = TRUE;
2656 break;
2657 }
2658
2659 /* -MCP: set the smtp_use_pipelining flag; this is useful only when
2660 it preceded -MC (see above) */
2661
2662 else if (Ustrcmp(argrest, "CP") == 0)
2663 {
2664 smtp_use_pipelining = TRUE;
2665 break;
2666 }
2667
2668 /* -MCQ: pass on the pid of the queue-running process that started
2669 this chain of deliveries and the fd of its synchronizing pipe; this
2670 is useful only when it precedes -MC (see above) */
2671
2672 else if (Ustrcmp(argrest, "CQ") == 0)
2673 {
2674 if(++i < argc) passed_qr_pid = (pid_t)(Uatol(argv[i]));
2675 else badarg = TRUE;
2676 if(++i < argc) passed_qr_pipe = (int)(Uatol(argv[i]));
2677 else badarg = TRUE;
2678 break;
2679 }
2680
2681 /* -MCS: set the smtp_use_size flag; this is useful only when it
2682 precedes -MC (see above) */
2683
2684 else if (Ustrcmp(argrest, "CS") == 0)
2685 {
2686 smtp_use_size = TRUE;
2687 break;
2688 }
2689
2690 /* -MCT: set the tls_offered flag; this is useful only when it
2691 precedes -MC (see above). The flag indicates that the host to which
2692 Exim is connected has offered TLS support. */
2693
2694 #ifdef SUPPORT_TLS
2695 else if (Ustrcmp(argrest, "CT") == 0)
2696 {
2697 tls_offered = TRUE;
2698 break;
2699 }
2700 #endif
2701
2702 /* -M[x]: various operations on the following list of message ids:
2703 -M deliver the messages, ignoring next retry times and thawing
2704 -Mc deliver the messages, checking next retry times, no thawing
2705 -Mf freeze the messages
2706 -Mg give up on the messages
2707 -Mt thaw the messages
2708 -Mrm remove the messages
2709 In the above cases, this must be the last option. There are also the
2710 following options which are followed by a single message id, and which
2711 act on that message. Some of them use the "recipient" addresses as well.
2712 -Mar add recipient(s)
2713 -Mmad mark all recipients delivered
2714 -Mmd mark recipients(s) delivered
2715 -Mes edit sender
2716 -Mset load a message for use with -be
2717 -Mvb show body
2718 -Mvc show copy (of whole message, in RFC 2822 format)
2719 -Mvh show header
2720 -Mvl show log
2721 */
2722
2723 else if (*argrest == 0)
2724 {
2725 msg_action = MSG_DELIVER;
2726 forced_delivery = deliver_force_thaw = TRUE;
2727 }
2728 else if (Ustrcmp(argrest, "ar") == 0)
2729 {
2730 msg_action = MSG_ADD_RECIPIENT;
2731 one_msg_action = TRUE;
2732 }
2733 else if (Ustrcmp(argrest, "c") == 0) msg_action = MSG_DELIVER;
2734 else if (Ustrcmp(argrest, "es") == 0)
2735 {
2736 msg_action = MSG_EDIT_SENDER;
2737 one_msg_action = TRUE;
2738 }
2739 else if (Ustrcmp(argrest, "f") == 0) msg_action = MSG_FREEZE;
2740 else if (Ustrcmp(argrest, "g") == 0)
2741 {
2742 msg_action = MSG_DELIVER;
2743 deliver_give_up = TRUE;
2744 }
2745 else if (Ustrcmp(argrest, "mad") == 0)
2746 {
2747 msg_action = MSG_MARK_ALL_DELIVERED;
2748 }
2749 else if (Ustrcmp(argrest, "md") == 0)
2750 {
2751 msg_action = MSG_MARK_DELIVERED;
2752 one_msg_action = TRUE;
2753 }
2754 else if (Ustrcmp(argrest, "rm") == 0) msg_action = MSG_REMOVE;
2755 else if (Ustrcmp(argrest, "set") == 0)
2756 {
2757 msg_action = MSG_LOAD;
2758 one_msg_action = TRUE;
2759 }
2760 else if (Ustrcmp(argrest, "t") == 0) msg_action = MSG_THAW;
2761 else if (Ustrcmp(argrest, "vb") == 0)
2762 {
2763 msg_action = MSG_SHOW_BODY;
2764 one_msg_action = TRUE;
2765 }
2766 else if (Ustrcmp(argrest, "vc") == 0)
2767 {
2768 msg_action = MSG_SHOW_COPY;
2769 one_msg_action = TRUE;
2770 }
2771 else if (Ustrcmp(argrest, "vh") == 0)
2772 {
2773 msg_action = MSG_SHOW_HEADER;
2774 one_msg_action = TRUE;
2775 }
2776 else if (Ustrcmp(argrest, "vl") == 0)
2777 {
2778 msg_action = MSG_SHOW_LOG;
2779 one_msg_action = TRUE;
2780 }
2781 else { badarg = TRUE; break; }
2782
2783 /* All the -Mxx options require at least one message id. */
2784
2785 msg_action_arg = i + 1;
2786 if (msg_action_arg >= argc)
2787 {
2788 fprintf(stderr, "exim: no message ids given after %s option\n", arg);
2789 return EXIT_FAILURE;
2790 }
2791
2792 /* Some require only message ids to follow */
2793
2794 if (!one_msg_action)
2795 {
2796 int j;
2797 for (j = msg_action_arg; j < argc; j++) if (!mac_ismsgid(argv[j]))
2798 {
2799 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2800 argv[j], arg);
2801 return EXIT_FAILURE;
2802 }
2803 goto END_ARG; /* Remaining args are ids */
2804 }
2805
2806 /* Others require only one message id, possibly followed by addresses,
2807 which will be handled as normal arguments. */
2808
2809 else
2810 {
2811 if (!mac_ismsgid(argv[msg_action_arg]))
2812 {
2813 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2814 argv[msg_action_arg], arg);
2815 return EXIT_FAILURE;
2816 }
2817 i++;
2818 }
2819 break;
2820
2821
2822 /* Some programs seem to call the -om option without the leading o;
2823 for sendmail it askes for "me too". Exim always does this. */
2824
2825 case 'm':
2826 if (*argrest != 0) badarg = TRUE;
2827 break;
2828
2829
2830 /* -N: don't do delivery - a debugging option that stops transports doing
2831 their thing. It implies debugging at the D_v level. */
2832
2833 case 'N':
2834 if (*argrest == 0)
2835 {
2836 dont_deliver = TRUE;
2837 debug_selector |= D_v;
2838 debug_file = stderr;
2839 }
2840 else badarg = TRUE;
2841 break;
2842
2843
2844 /* -n: This means "don't alias" in sendmail, apparently.
2845 For normal invocations, it has no effect.
2846 It may affect some other options. */
2847
2848 case 'n':
2849 flag_n = TRUE;
2850 break;
2851
2852 /* -O: Just ignore it. In sendmail, apparently -O option=value means set
2853 option to the specified value. This form uses long names. We need to handle
2854 -O option=value and -Ooption=value. */
2855
2856 case 'O':
2857 if (*argrest == 0)
2858 {
2859 if (++i >= argc)
2860 {
2861 fprintf(stderr, "exim: string expected after -O\n");
2862 exit(EXIT_FAILURE);
2863 }
2864 }
2865 break;
2866
2867 case 'o':
2868
2869 /* -oA: Set an argument for the bi command (sendmail's "alternate alias
2870 file" option). */
2871
2872 if (*argrest == 'A')
2873 {
2874 alias_arg = argrest + 1;
2875 if (alias_arg[0] == 0)
2876 {
2877 if (i+1 < argc) alias_arg = argv[++i]; else
2878 {
2879 fprintf(stderr, "exim: string expected after -oA\n");
2880 exit(EXIT_FAILURE);
2881 }
2882 }
2883 }
2884
2885 /* -oB: Set a connection message max value for remote deliveries */
2886
2887 else if (*argrest == 'B')
2888 {
2889 uschar *p = argrest + 1;
2890 if (p[0] == 0)
2891 {
2892 if (i+1 < argc && isdigit((argv[i+1][0]))) p = argv[++i]; else
2893 {
2894 connection_max_messages = 1;
2895 p = NULL;
2896 }
2897 }
2898
2899 if (p != NULL)
2900 {
2901 if (!isdigit(*p))
2902 {
2903 fprintf(stderr, "exim: number expected after -oB\n");
2904 exit(EXIT_FAILURE);
2905 }
2906 connection_max_messages = Uatoi(p);
2907 }
2908 }
2909
2910 /* -odb: background delivery */
2911
2912 else if (Ustrcmp(argrest, "db") == 0)
2913 {
2914 synchronous_delivery = FALSE;
2915 arg_queue_only = FALSE;
2916 queue_only_set = TRUE;
2917 }
2918
2919 /* -odf: foreground delivery (smail-compatible option); same effect as
2920 -odi: interactive (synchronous) delivery (sendmail-compatible option)
2921 */
2922
2923 else if (Ustrcmp(argrest, "df") == 0 || Ustrcmp(argrest, "di") == 0)
2924 {
2925 synchronous_delivery = TRUE;
2926 arg_queue_only = FALSE;
2927 queue_only_set = TRUE;
2928 }
2929
2930 /* -odq: queue only */
2931
2932 else if (Ustrcmp(argrest, "dq") == 0)
2933 {
2934 synchronous_delivery = FALSE;
2935 arg_queue_only = TRUE;
2936 queue_only_set = TRUE;
2937 }
2938
2939 /* -odqs: queue SMTP only - do local deliveries and remote routing,
2940 but no remote delivery */
2941
2942 else if (Ustrcmp(argrest, "dqs") == 0)
2943 {
2944 queue_smtp = TRUE;
2945 arg_queue_only = FALSE;
2946 queue_only_set = TRUE;
2947 }
2948
2949 /* -oex: Sendmail error flags. As these are also accepted without the
2950 leading -o prefix, for compatibility with vacation and other callers,
2951 they are handled with -e above. */
2952
2953 /* -oi: Set flag so dot doesn't end non-SMTP input (same as -i)
2954 -oitrue: Another sendmail syntax for the same */
2955
2956 else if (Ustrcmp(argrest, "i") == 0 ||
2957 Ustrcmp(argrest, "itrue") == 0)
2958 dot_ends = FALSE;
2959
2960 /* -oM*: Set various characteristics for an incoming message; actually
2961 acted on for trusted callers only. */
2962
2963 else if (*argrest == 'M')
2964 {
2965 if (i+1 >= argc)
2966 {
2967 fprintf(stderr, "exim: data expected after -o%s\n", argrest);
2968 exit(EXIT_FAILURE);
2969 }
2970
2971 /* -oMa: Set sender host address */
2972
2973 if (Ustrcmp(argrest, "Ma") == 0) sender_host_address = argv[++i];
2974
2975 /* -oMaa: Set authenticator name */
2976
2977 else if (Ustrcmp(argrest, "Maa") == 0)
2978 sender_host_authenticated = argv[++i];
2979
2980 /* -oMas: setting authenticated sender */
2981
2982 else if (Ustrcmp(argrest, "Mas") == 0) authenticated_sender = argv[++i];
2983
2984 /* -oMai: setting authenticated id */
2985
2986 else if (Ustrcmp(argrest, "Mai") == 0) authenticated_id = argv[++i];
2987
2988 /* -oMi: Set incoming interface address */
2989
2990 else if (Ustrcmp(argrest, "Mi") == 0) interface_address = argv[++i];
2991
2992 /* -oMr: Received protocol */
2993
2994 else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i];
2995
2996 /* -oMs: Set sender host name */
2997
2998 else if (Ustrcmp(argrest, "Ms") == 0) sender_host_name = argv[++i];
2999
3000 /* -oMt: Set sender ident */
3001
3002 else if (Ustrcmp(argrest, "Mt") == 0)
3003 {
3004 sender_ident_set = TRUE;
3005 sender_ident = argv[++i];
3006 }
3007
3008 /* Else a bad argument */
3009
3010 else
3011 {
3012 badarg = TRUE;
3013 break;
3014 }
3015 }
3016
3017 /* -om: Me-too flag for aliases. Exim always does this. Some programs
3018 seem to call this as -m (undocumented), so that is also accepted (see
3019 above). */
3020
3021 else if (Ustrcmp(argrest, "m") == 0) {}
3022
3023 /* -oo: An ancient flag for old-style addresses which still seems to
3024 crop up in some calls (see in SCO). */
3025
3026 else if (Ustrcmp(argrest, "o") == 0) {}
3027
3028 /* -oP <name>: set pid file path for daemon */
3029
3030 else if (Ustrcmp(argrest, "P") == 0)
3031 override_pid_file_path = argv[++i];
3032
3033 /* -or <n>: set timeout for non-SMTP acceptance
3034 -os <n>: set timeout for SMTP acceptance */
3035
3036 else if (*argrest == 'r' || *argrest == 's')
3037 {
3038 int *tp = (*argrest == 'r')?
3039 &arg_receive_timeout : &arg_smtp_receive_timeout;
3040 if (argrest[1] == 0)
3041 {
3042 if (i+1 < argc) *tp= readconf_readtime(argv[++i], 0, FALSE);
3043 }
3044 else *tp = readconf_readtime(argrest + 1, 0, FALSE);
3045 if (*tp < 0)
3046 {
3047 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3048 exit(EXIT_FAILURE);
3049 }
3050 }
3051
3052 /* -oX <list>: Override local_interfaces and/or default daemon ports */
3053
3054 else if (Ustrcmp(argrest, "X") == 0)
3055 override_local_interfaces = argv[++i];
3056
3057 /* Unknown -o argument */
3058
3059 else badarg = TRUE;
3060 break;
3061
3062
3063 /* -ps: force Perl startup; -pd force delayed Perl startup */
3064
3065 case 'p':
3066 #ifdef EXIM_PERL
3067 if (*argrest == 's' && argrest[1] == 0)
3068 {
3069 perl_start_option = 1;
3070 break;
3071 }
3072 if (*argrest == 'd' && argrest[1] == 0)
3073 {
3074 perl_start_option = -1;
3075 break;
3076 }
3077 #endif
3078
3079 /* -panythingelse is taken as the Sendmail-compatible argument -prval:sval,
3080 which sets the host protocol and host name */
3081
3082 if (*argrest == 0)
3083 {
3084 if (i+1 < argc) argrest = argv[++i]; else
3085 { badarg = TRUE; break; }
3086 }
3087
3088 if (*argrest != 0)
3089 {
3090 uschar *hn = Ustrchr(argrest, ':');
3091 if (hn == NULL)
3092 {
3093 received_protocol = argrest;
3094 }
3095 else
3096 {
3097 received_protocol = string_copyn(argrest, hn - argrest);
3098 sender_host_name = hn + 1;
3099 }
3100 }
3101 break;
3102
3103
3104 case 'q':
3105 receiving_message = FALSE;
3106 if (queue_interval >= 0)
3107 {
3108 fprintf(stderr, "exim: -q specified more than once\n");
3109 exit(EXIT_FAILURE);
3110 }
3111
3112 /* -qq...: Do queue runs in a 2-stage manner */
3113
3114 if (*argrest == 'q')
3115 {
3116 queue_2stage = TRUE;
3117 argrest++;
3118 }
3119
3120 /* -qi...: Do only first (initial) deliveries */
3121
3122 if (*argrest == 'i')
3123 {
3124 queue_run_first_delivery = TRUE;
3125 argrest++;
3126 }
3127
3128 /* -qf...: Run the queue, forcing deliveries
3129 -qff..: Ditto, forcing thawing as well */
3130
3131 if (*argrest == 'f')
3132 {
3133 queue_run_force = TRUE;
3134 if (*(++argrest) == 'f')
3135 {
3136 deliver_force_thaw = TRUE;
3137 argrest++;
3138 }
3139 }
3140
3141 /* -q[f][f]l...: Run the queue only on local deliveries */
3142
3143 if (*argrest == 'l')
3144 {
3145 queue_run_local = TRUE;
3146 argrest++;
3147 }
3148
3149 /* -q[f][f][l]: Run the queue, optionally forced, optionally local only,
3150 optionally starting from a given message id. */
3151
3152 if (*argrest == 0 &&
3153 (i + 1 >= argc || argv[i+1][0] == '-' || mac_ismsgid(argv[i+1])))
3154 {
3155 queue_interval = 0;
3156 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3157 start_queue_run_id = argv[++i];
3158 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3159 stop_queue_run_id = argv[++i];
3160 }
3161
3162 /* -q[f][f][l]<n>: Run the queue at regular intervals, optionally forced,
3163 optionally local only. */
3164
3165 else
3166 {
3167 if (*argrest != 0)
3168 queue_interval = readconf_readtime(argrest, 0, FALSE);
3169 else
3170 queue_interval = readconf_readtime(argv[++i], 0, FALSE);
3171 if (queue_interval <= 0)
3172 {
3173 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3174 exit(EXIT_FAILURE);
3175 }
3176 }
3177 break;
3178
3179
3180 case 'R': /* Synonymous with -qR... */
3181 receiving_message = FALSE;
3182
3183 /* -Rf: As -R (below) but force all deliveries,
3184 -Rff: Ditto, but also thaw all frozen messages,
3185 -Rr: String is regex
3186 -Rrf: Regex and force
3187 -Rrff: Regex and force and thaw
3188
3189 in all cases provided there are no further characters in this
3190 argument. */
3191
3192 if (*argrest != 0)
3193 {
3194 int i;
3195 for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
3196 {
3197 if (Ustrcmp(argrest, rsopts[i]) == 0)
3198 {
3199 if (i != 2) queue_run_force = TRUE;
3200 if (i >= 2) deliver_selectstring_regex = TRUE;
3201 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3202 argrest += Ustrlen(rsopts[i]);
3203 }
3204 }
3205 }
3206
3207 /* -R: Set string to match in addresses for forced queue run to
3208 pick out particular messages. */
3209
3210 if (*argrest == 0)
3211 {
3212 if (i+1 < argc) deliver_selectstring = argv[++i]; else
3213 {
3214 fprintf(stderr, "exim: string expected after -R\n");
3215 exit(EXIT_FAILURE);
3216 }
3217 }
3218 else deliver_selectstring = argrest;
3219 break;
3220
3221
3222 /* -r: an obsolete synonym for -f (see above) */
3223
3224
3225 /* -S: Like -R but works on sender. */
3226
3227 case 'S': /* Synonymous with -qS... */
3228 receiving_message = FALSE;
3229
3230 /* -Sf: As -S (below) but force all deliveries,
3231 -Sff: Ditto, but also thaw all frozen messages,
3232 -Sr: String is regex
3233 -Srf: Regex and force
3234 -Srff: Regex and force and thaw
3235
3236 in all cases provided there are no further characters in this
3237 argument. */
3238
3239 if (*argrest != 0)
3240 {
3241 int i;
3242 for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
3243 {
3244 if (Ustrcmp(argrest, rsopts[i]) == 0)
3245 {
3246 if (i != 2) queue_run_force = TRUE;
3247 if (i >= 2) deliver_selectstring_sender_regex = TRUE;
3248 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3249 argrest += Ustrlen(rsopts[i]);
3250 }
3251 }
3252 }
3253
3254 /* -S: Set string to match in addresses for forced queue run to
3255 pick out particular messages. */
3256
3257 if (*argrest == 0)
3258 {
3259 if (i+1 < argc) deliver_selectstring_sender = argv[++i]; else
3260 {
3261 fprintf(stderr, "exim: string expected after -S\n");
3262 exit(EXIT_FAILURE);
3263 }
3264 }
3265 else deliver_selectstring_sender = argrest;
3266 break;
3267
3268 /* -Tqt is an option that is exclusively for use by the testing suite.
3269 It is not recognized in other circumstances. It allows for the setting up
3270 of explicit "queue times" so that various warning/retry things can be
3271 tested. Otherwise variability of clock ticks etc. cause problems. */
3272
3273 case 'T':
3274 if (running_in_test_harness && Ustrcmp(argrest, "qt") == 0)
3275 fudged_queue_times = argv[++i];
3276 else badarg = TRUE;
3277 break;
3278
3279
3280 /* -t: Set flag to extract recipients from body of message. */
3281
3282 case 't':
3283 if (*argrest == 0) extract_recipients = TRUE;
3284
3285 /* -ti: Set flag to extract recipients from body of message, and also
3286 specify that dot does not end the message. */
3287
3288 else if (Ustrcmp(argrest, "i") == 0)
3289 {
3290 extract_recipients = TRUE;
3291 dot_ends = FALSE;
3292 }
3293
3294 /* -tls-on-connect: don't wait for STARTTLS (for old clients) */
3295
3296 #ifdef SUPPORT_TLS
3297 else if (Ustrcmp(argrest, "ls-on-connect") == 0) tls_in.on_connect = TRUE;
3298 #endif
3299
3300 else badarg = TRUE;
3301 break;
3302
3303
3304 /* -U: This means "initial user submission" in sendmail, apparently. The
3305 doc claims that in future sendmail may refuse syntactically invalid
3306 messages instead of fixing them. For the moment, we just ignore it. */
3307
3308 case 'U':
3309 break;
3310
3311
3312 /* -v: verify things - this is a very low-level debugging */
3313
3314 case 'v':
3315 if (*argrest == 0)
3316 {
3317 debug_selector |= D_v;
3318 debug_file = stderr;
3319 }
3320 else badarg = TRUE;
3321 break;
3322
3323
3324 /* -x: AIX uses this to indicate some fancy 8-bit character stuff:
3325
3326 The -x flag tells the sendmail command that mail from a local
3327 mail program has National Language Support (NLS) extended characters
3328 in the body of the mail item. The sendmail command can send mail with
3329 extended NLS characters across networks that normally corrupts these
3330 8-bit characters.
3331
3332 As Exim is 8-bit clean, it just ignores this flag. */
3333
3334 case 'x':
3335 if (*argrest != 0) badarg = TRUE;
3336 break;
3337
3338 /* -X: in sendmail: takes one parameter, logfile, and sends debugging
3339 logs to that file. We swallow the parameter and otherwise ignore it. */
3340
3341 case 'X':
3342 if (*argrest == '\0')
3343 {
3344 if (++i >= argc)
3345 {
3346 fprintf(stderr, "exim: string expected after -X\n");
3347 exit(EXIT_FAILURE);
3348 }
3349 }
3350 break;
3351
3352 /* All other initial characters are errors */
3353
3354 default:
3355 badarg = TRUE;
3356 break;
3357 } /* End of high-level switch statement */
3358
3359 /* Failed to recognize the option, or syntax error */
3360
3361 if (badarg)
3362 {
3363 fprintf(stderr, "exim abandoned: unknown, malformed, or incomplete "
3364 "option %s\n", arg);
3365 exit(EXIT_FAILURE);
3366 }
3367 }
3368
3369
3370 /* If -R or -S have been specified without -q, assume a single queue run. */
3371
3372 if ((deliver_selectstring != NULL || deliver_selectstring_sender != NULL) &&
3373 queue_interval < 0) queue_interval = 0;
3374
3375
3376 END_ARG:
3377 /* If usage_wanted is set we call the usage function - which never returns */
3378 if (usage_wanted) exim_usage(called_as);
3379
3380 /* Arguments have been processed. Check for incompatibilities. */
3381 if ((
3382 (smtp_input || extract_recipients || recipients_arg < argc) &&
3383 (daemon_listen || queue_interval >= 0 || bi_option ||
3384 test_retry_arg >= 0 || test_rewrite_arg >= 0 ||
3385 filter_test != FTEST_NONE || (msg_action_arg > 0 && !one_msg_action))
3386 ) ||
3387 (
3388 msg_action_arg > 0 &&
3389 (daemon_listen || queue_interval >= 0 || list_options ||
3390 (checking && msg_action != MSG_LOAD) ||
3391 bi_option || test_retry_arg >= 0 || test_rewrite_arg >= 0)
3392 ) ||
3393 (
3394 (daemon_listen || queue_interval >= 0) &&
3395 (sender_address != NULL || list_options || list_queue || checking ||
3396 bi_option)
3397 ) ||
3398 (
3399 daemon_listen && queue_interval == 0
3400 ) ||
3401 (
3402 inetd_wait_mode && queue_interval >= 0
3403 ) ||
3404 (
3405 list_options &&
3406 (checking || smtp_input || extract_recipients ||
3407 filter_test != FTEST_NONE || bi_option)
3408 ) ||
3409 (
3410 verify_address_mode &&
3411 (address_test_mode || smtp_input || extract_recipients ||
3412 filter_test != FTEST_NONE || bi_option)
3413 ) ||
3414 (
3415 address_test_mode && (smtp_input || extract_recipients ||
3416 filter_test != FTEST_NONE || bi_option)
3417 ) ||
3418 (
3419 smtp_input && (sender_address != NULL || filter_test != FTEST_NONE ||
3420 extract_recipients)
3421 ) ||
3422 (
3423 deliver_selectstring != NULL && queue_interval < 0
3424 ) ||
3425 (
3426 msg_action == MSG_LOAD &&
3427 (!expansion_test || expansion_test_message != NULL)
3428 )
3429 )
3430 {
3431 fprintf(stderr, "exim: incompatible command-line options or arguments\n");
3432 exit(EXIT_FAILURE);
3433 }
3434
3435 /* If debugging is set up, set the file and the file descriptor to pass on to
3436 child processes. It should, of course, be 2 for stderr. Also, force the daemon
3437 to run in the foreground. */
3438
3439 if (debug_selector != 0)
3440 {
3441 debug_file = stderr;
3442 debug_fd = fileno(debug_file);
3443 background_daemon = FALSE;
3444 if (running_in_test_harness) millisleep(100); /* lets caller finish */
3445 if (debug_selector != D_v) /* -v only doesn't show this */
3446 {
3447 debug_printf("Exim version %s uid=%ld gid=%ld pid=%d D=%x\n",
3448 version_string, (long int)real_uid, (long int)real_gid, (int)getpid(),
3449 debug_selector);
3450 if (!version_printed)
3451 show_whats_supported(stderr);
3452 }
3453 }
3454
3455 /* When started with root privilege, ensure that the limits on the number of
3456 open files and the number of processes (where that is accessible) are
3457 sufficiently large, or are unset, in case Exim has been called from an
3458 environment where the limits are screwed down. Not all OS have the ability to
3459 change some of these limits. */
3460
3461 if (unprivileged)
3462 {
3463 DEBUG(D_any) debug_print_ids(US"Exim has no root privilege:");
3464 }
3465 else
3466 {
3467 struct rlimit rlp;
3468
3469 #ifdef RLIMIT_NOFILE
3470 if (getrlimit(RLIMIT_NOFILE, &rlp) < 0)
3471 {
3472 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NOFILE) failed: %s",
3473 strerror(errno));
3474 rlp.rlim_cur = rlp.rlim_max = 0;
3475 }
3476
3477 /* I originally chose 1000 as a nice big number that was unlikely to
3478 be exceeded. It turns out that some older OS have a fixed upper limit of
3479 256. */
3480
3481 if (rlp.rlim_cur < 1000)
3482 {
3483 rlp.rlim_cur = rlp.rlim_max = 1000;
3484 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3485 {
3486 rlp.rlim_cur = rlp.rlim_max = 256;
3487 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3488 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NOFILE) failed: %s",
3489 strerror(errno));
3490 }
3491 }
3492 #endif
3493
3494 #ifdef RLIMIT_NPROC
3495 if (getrlimit(RLIMIT_NPROC, &rlp) < 0)
3496 {
3497 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NPROC) failed: %s",
3498 strerror(errno));
3499 rlp.rlim_cur = rlp.rlim_max = 0;
3500 }
3501
3502 #ifdef RLIM_INFINITY
3503 if (rlp.rlim_cur != RLIM_INFINITY && rlp.rlim_cur < 1000)
3504 {
3505 rlp.rlim_cur = rlp.rlim_max = RLIM_INFINITY;
3506 #else
3507 if (rlp.rlim_cur < 1000)
3508 {
3509 rlp.rlim_cur = rlp.rlim_max = 1000;
3510 #endif
3511 if (setrlimit(RLIMIT_NPROC, &rlp) < 0)
3512 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NPROC) failed: %s",
3513 strerror(errno));
3514 }
3515 #endif
3516 }
3517
3518 /* Exim is normally entered as root (but some special configurations are
3519 possible that don't do this). However, it always spins off sub-processes that
3520 set their uid and gid as required for local delivery. We don't want to pass on
3521 any extra groups that root may belong to, so we want to get rid of them all at
3522 this point.
3523
3524 We need to obey setgroups() at this stage, before possibly giving up root
3525 privilege for a changed configuration file, but later on we might need to
3526 check on the additional groups for the admin user privilege - can't do that
3527 till after reading the config, which might specify the exim gid. Therefore,
3528 save the group list here first. */
3529
3530 group_count = getgroups(NGROUPS_MAX, group_list);
3531 if (group_count < 0)
3532 {
3533 fprintf(stderr, "exim: getgroups() failed: %s\n", strerror(errno));
3534 exit(EXIT_FAILURE);
3535 }
3536
3537 /* There is a fundamental difference in some BSD systems in the matter of
3538 groups. FreeBSD and BSDI are known to be different; NetBSD and OpenBSD are
3539 known not to be different. On the "different" systems there is a single group
3540 list, and the first entry in it is the current group. On all other versions of
3541 Unix there is a supplementary group list, which is in *addition* to the current
3542 group. Consequently, to get rid of all extraneous groups on a "standard" system
3543 you pass over 0 groups to setgroups(), while on a "different" system you pass
3544 over a single group - the current group, which is always the first group in the
3545 list. Calling setgroups() with zero groups on a "different" system results in
3546 an error return. The following code should cope with both types of system.
3547
3548 However, if this process isn't running as root, setgroups() can't be used
3549 since you have to be root to run it, even if throwing away groups. Not being
3550 root here happens only in some unusual configurations. We just ignore the
3551 error. */
3552
3553 if (setgroups(0, NULL) != 0)
3554 {
3555 if (setgroups(1, group_list) != 0 && !unprivileged)
3556 {
3557 fprintf(stderr, "exim: setgroups() failed: %s\n", strerror(errno));
3558 exit(EXIT_FAILURE);
3559 }
3560 }
3561
3562 /* If the configuration file name has been altered by an argument on the
3563 command line (either a new file name or a macro definition) and the caller is
3564 not root, or if this is a filter testing run, remove any setuid privilege the
3565 program has and run as the underlying user.
3566
3567 The exim user is locked out of this, which severely restricts the use of -C
3568 for some purposes.
3569
3570 Otherwise, set the real ids to the effective values (should be root unless run
3571 from inetd, which it can either be root or the exim uid, if one is configured).
3572
3573 There is a private mechanism for bypassing some of this, in order to make it
3574 possible to test lots of configurations automatically, without having either to
3575 recompile each time, or to patch in an actual configuration file name and other
3576 values (such as the path name). If running in the test harness, pretend that
3577 configuration file changes and macro definitions haven't happened. */
3578
3579 if (( /* EITHER */
3580 (!trusted_config || /* Config changed, or */
3581 !macros_trusted()) && /* impermissible macros and */
3582 real_uid != root_uid && /* Not root, and */
3583 !running_in_test_harness /* Not fudged */
3584 ) || /* OR */
3585 expansion_test /* expansion testing */
3586 || /* OR */
3587 filter_test != FTEST_NONE) /* Filter testing */
3588 {
3589 setgroups(group_count, group_list);
3590 exim_setugid(real_uid, real_gid, FALSE,
3591 US"-C, -D, -be or -bf forces real uid");
3592 removed_privilege = TRUE;
3593
3594 /* In the normal case when Exim is called like this, stderr is available
3595 and should be used for any logging information because attempts to write
3596 to the log will usually fail. To arrange this, we unset really_exim. However,
3597 if no stderr is available there is no point - we might as well have a go
3598 at the log (if it fails, syslog will be written).
3599
3600 Note that if the invoker is Exim, the logs remain available. Messing with
3601 this causes unlogged successful deliveries. */
3602
3603 if ((log_stderr != NULL) && (real_uid != exim_uid))
3604 really_exim = FALSE;
3605 }
3606
3607 /* Privilege is to be retained for the moment. It may be dropped later,
3608 depending on the job that this Exim process has been asked to do. For now, set
3609 the real uid to the effective so that subsequent re-execs of Exim are done by a
3610 privileged user. */
3611
3612 else exim_setugid(geteuid(), getegid(), FALSE, US"forcing real = effective");
3613
3614 /* If testing a filter, open the file(s) now, before wasting time doing other
3615 setups and reading the message. */
3616
3617 if ((filter_test & FTEST_SYSTEM) != 0)
3618 {
3619 filter_sfd = Uopen(filter_test_sfile, O_RDONLY, 0);
3620 if (filter_sfd < 0)
3621 {
3622 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_sfile,
3623 strerror(errno));
3624 return EXIT_FAILURE;
3625 }
3626 }
3627
3628 if ((filter_test & FTEST_USER) != 0)
3629 {
3630 filter_ufd = Uopen(filter_test_ufile, O_RDONLY, 0);
3631 if (filter_ufd < 0)
3632 {
3633 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_ufile,
3634 strerror(errno));
3635 return EXIT_FAILURE;
3636 }
3637 }
3638
3639 /* Initialise lookup_list
3640 If debugging, already called above via version reporting.
3641 In either case, we initialise the list of available lookups while running
3642 as root. All dynamically modules are loaded from a directory which is
3643 hard-coded into the binary and is code which, if not a module, would be
3644 part of Exim already. Ability to modify the content of the directory
3645 is equivalent to the ability to modify a setuid binary!
3646
3647 This needs to happen before we read the main configuration. */
3648 init_lookup_list();
3649
3650 /* Read the main runtime configuration data; this gives up if there
3651 is a failure. It leaves the configuration file open so that the subsequent
3652 configuration data for delivery can be read if needed. */
3653
3654 readconf_main();
3655
3656 /* If an action on specific messages is requested, or if a daemon or queue
3657 runner is being started, we need to know if Exim was called by an admin user.
3658 This is the case if the real user is root or exim, or if the real group is
3659 exim, or if one of the supplementary groups is exim or a group listed in
3660 admin_groups. We don't fail all message actions immediately if not admin_user,
3661 since some actions can be performed by non-admin users. Instead, set admin_user
3662 for later interrogation. */
3663
3664 if (real_uid == root_uid || real_uid == exim_uid || real_gid == exim_gid)
3665 admin_user = TRUE;
3666 else
3667 {
3668 int i, j;
3669 for (i = 0; i < group_count; i++)
3670 {
3671 if (group_list[i] == exim_gid) admin_user = TRUE;
3672 else if (admin_groups != NULL)
3673 {
3674 for (j = 1; j <= (int)(admin_groups[0]); j++)
3675 if (admin_groups[j] == group_list[i])
3676 { admin_user = TRUE; break; }
3677 }
3678 if (admin_user) break;
3679 }
3680 }
3681
3682 /* Another group of privileged users are the trusted users. These are root,
3683 exim, and any caller matching trusted_users or trusted_groups. Trusted callers
3684 are permitted to specify sender_addresses with -f on the command line, and
3685 other message parameters as well. */
3686
3687 if (real_uid == root_uid || real_uid == exim_uid)
3688 trusted_caller = TRUE;
3689 else
3690 {
3691 int i, j;
3692
3693 if (trusted_users != NULL)
3694 {
3695 for (i = 1; i <= (int)(trusted_users[0]); i++)
3696 if (trusted_users[i] == real_uid)
3697 { trusted_caller = TRUE; break; }
3698 }
3699
3700 if (!trusted_caller && trusted_groups != NULL)
3701 {
3702 for (i = 1; i <= (int)(trusted_groups[0]); i++)
3703 {
3704 if (trusted_groups[i] == real_gid)
3705 trusted_caller = TRUE;
3706 else for (j = 0; j < group_count; j++)
3707 {
3708 if (trusted_groups[i] == group_list[j])
3709 { trusted_caller = TRUE; break; }
3710 }
3711 if (trusted_caller) break;
3712 }
3713 }
3714 }
3715
3716 /* Handle the decoding of logging options. */
3717
3718 decode_bits(&log_write_selector, &log_extra_selector, 0, 0,
3719 log_selector_string, log_options, log_options_count, US"log", 0);
3720
3721 DEBUG(D_any)
3722 {
3723 debug_printf("configuration file is %s\n", config_main_filename);
3724 debug_printf("log selectors = %08x %08x\n", log_write_selector,
3725 log_extra_selector);
3726 }
3727
3728 /* If domain literals are not allowed, check the sender address that was
3729 supplied with -f. Ditto for a stripped trailing dot. */
3730
3731 if (sender_address != NULL)
3732 {
3733 if (sender_address[sender_address_domain] == '[' && !allow_domain_literals)
3734 {
3735 fprintf(stderr, "exim: bad -f address \"%s\": domain literals not "
3736 "allowed\n", sender_address);
3737 return EXIT_FAILURE;
3738 }
3739 if (f_end_dot && !strip_trailing_dot)
3740 {
3741 fprintf(stderr, "exim: bad -f address \"%s.\": domain is malformed "
3742 "(trailing dot not allowed)\n", sender_address);
3743 return EXIT_FAILURE;
3744 }
3745 }
3746
3747 /* See if an admin user overrode our logging. */
3748
3749 if (cmdline_syslog_name != NULL)
3750 {
3751 if (admin_user)
3752 {
3753 syslog_processname = cmdline_syslog_name;
3754 log_file_path = string_copy(CUS"syslog");
3755 }
3756 else
3757 {
3758 /* not a panic, non-privileged users should not be able to spam paniclog */
3759 fprintf(stderr,
3760 "exim: you lack sufficient privilege to specify syslog process name\n");
3761 return EXIT_FAILURE;
3762 }
3763 }
3764
3765 /* Paranoia check of maximum lengths of certain strings. There is a check
3766 on the length of the log file path in log.c, which will come into effect
3767 if there are any calls to write the log earlier than this. However, if we
3768 get this far but the string is very long, it is better to stop now than to
3769 carry on and (e.g.) receive a message and then have to collapse. The call to
3770 log_write() from here will cause the ultimate panic collapse if the complete
3771 file name exceeds the buffer length. */
3772
3773 if (Ustrlen(log_file_path) > 200)
3774 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3775 "log_file_path is longer than 200 chars: aborting");
3776
3777 if (Ustrlen(pid_file_path) > 200)
3778 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3779 "pid_file_path is longer than 200 chars: aborting");
3780
3781 if (Ustrlen(spool_directory) > 200)
3782 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3783 "spool_directory is longer than 200 chars: aborting");
3784
3785 /* Length check on the process name given to syslog for its TAG field,
3786 which is only permitted to be 32 characters or less. See RFC 3164. */
3787
3788 if (Ustrlen(syslog_processname) > 32)
3789 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3790 "syslog_processname is longer than 32 chars: aborting");
3791
3792 /* In some operating systems, the environment variable TMPDIR controls where
3793 temporary files are created; Exim doesn't use these (apart from when delivering
3794 to MBX mailboxes), but called libraries such as DBM libraries may require them.
3795 If TMPDIR is found in the environment, reset it to the value defined in the
3796 TMPDIR macro, if this macro is defined. */
3797
3798 #ifdef TMPDIR
3799 {
3800 uschar **p;
3801 for (p = USS environ; *p != NULL; p++)
3802 {
3803 if (Ustrncmp(*p, "TMPDIR=", 7) == 0 &&
3804 Ustrcmp(*p+7, TMPDIR) != 0)
3805 {
3806 uschar *newp = malloc(Ustrlen(TMPDIR) + 8);
3807 sprintf(CS newp, "TMPDIR=%s", TMPDIR);
3808 *p = newp;
3809 DEBUG(D_any) debug_printf("reset TMPDIR=%s in environment\n", TMPDIR);
3810 }
3811 }
3812 }
3813 #endif
3814
3815 /* Timezone handling. If timezone_string is "utc", set a flag to cause all
3816 timestamps to be in UTC (gmtime() is used instead of localtime()). Otherwise,
3817 we may need to get rid of a bogus timezone setting. This can arise when Exim is
3818 called by a user who has set the TZ variable. This then affects the timestamps
3819 in log files and in Received: headers, and any created Date: header lines. The
3820 required timezone is settable in the configuration file, so nothing can be done
3821 about this earlier - but hopefully nothing will normally be logged earlier than
3822 this. We have to make a new environment if TZ is wrong, but don't bother if
3823 timestamps_utc is set, because then all times are in UTC anyway. */
3824
3825 if (timezone_string != NULL && strcmpic(timezone_string, US"UTC") == 0)
3826 {
3827 timestamps_utc = TRUE;
3828 }
3829 else
3830 {
3831 uschar *envtz = US getenv("TZ");
3832 if ((envtz == NULL && timezone_string != NULL) ||
3833 (envtz != NULL &&
3834 (timezone_string == NULL ||
3835 Ustrcmp(timezone_string, envtz) != 0)))
3836 {
3837 uschar **p = USS environ;
3838 uschar **new;
3839 uschar **newp;
3840 int count = 0;
3841 while (*p++ != NULL) count++;
3842 if (envtz == NULL) count++;
3843 newp = new = malloc(sizeof(uschar *) * (count + 1));
3844 for (p = USS environ; *p != NULL; p++)
3845 {
3846 if (Ustrncmp(*p, "TZ=", 3) == 0) continue;
3847 *newp++ = *p;
3848 }
3849 if (timezone_string != NULL)
3850 {
3851 *newp = malloc(Ustrlen(timezone_string) + 4);
3852 sprintf(CS *newp++, "TZ=%s", timezone_string);
3853 }
3854 *newp = NULL;
3855 environ = CSS new;
3856 tzset();
3857 DEBUG(D_any) debug_printf("Reset TZ to %s: time is %s\n", timezone_string,
3858 tod_stamp(tod_log));
3859 }
3860 }
3861
3862 /* Handle the case when we have removed the setuid privilege because of -C or
3863 -D. This means that the caller of Exim was not root.
3864
3865 There is a problem if we were running as the Exim user. The sysadmin may
3866 expect this case to retain privilege because "the binary was called by the
3867 Exim user", but it hasn't, because either the -D option set macros, or the
3868 -C option set a non-trusted configuration file. There are two possibilities:
3869
3870 (1) If deliver_drop_privilege is set, Exim is not going to re-exec in order
3871 to do message deliveries. Thus, the fact that it is running as a
3872 non-privileged user is plausible, and might be wanted in some special
3873 configurations. However, really_exim will have been set false when
3874 privilege was dropped, to stop Exim trying to write to its normal log
3875 files. Therefore, re-enable normal log processing, assuming the sysadmin
3876 has set up the log directory correctly.
3877
3878 (2) If deliver_drop_privilege is not set, the configuration won't work as
3879 apparently intended, and so we log a panic message. In order to retain
3880 root for -C or -D, the caller must either be root or be invoking a
3881 trusted configuration file (when deliver_drop_privilege is false). */
3882
3883 if (removed_privilege && (!trusted_config || macros != NULL) &&
3884 real_uid == exim_uid)
3885 {
3886 if (deliver_drop_privilege)
3887 really_exim = TRUE; /* let logging work normally */
3888 else
3889 log_write(0, LOG_MAIN|LOG_PANIC,
3890 "exim user lost privilege for using %s option",
3891 trusted_config? "-D" : "-C");
3892 }
3893
3894 /* Start up Perl interpreter if Perl support is configured and there is a
3895 perl_startup option, and the configuration or the command line specifies
3896 initializing starting. Note that the global variables are actually called
3897 opt_perl_xxx to avoid clashing with perl's namespace (perl_*). */
3898
3899 #ifdef EXIM_PERL
3900 if (perl_start_option != 0)
3901 opt_perl_at_start = (perl_start_option > 0);
3902 if (opt_perl_at_start && opt_perl_startup != NULL)
3903 {
3904 uschar *errstr;
3905 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
3906 errstr = init_perl(opt_perl_startup);
3907 if (errstr != NULL)
3908 {
3909 fprintf(stderr, "exim: error in perl_startup code: %s\n", errstr);
3910 return EXIT_FAILURE;
3911 }
3912 opt_perl_started = TRUE;
3913 }
3914 #endif /* EXIM_PERL */
3915
3916 /* Log the arguments of the call if the configuration file said so. This is
3917 a debugging feature for finding out what arguments certain MUAs actually use.
3918 Don't attempt it if logging is disabled, or if listing variables or if
3919 verifying/testing addresses or expansions. */
3920
3921 if (((debug_selector & D_any) != 0 || (log_extra_selector & LX_arguments) != 0)
3922 && really_exim && !list_options && !checking)
3923 {
3924 int i;
3925 uschar *p = big_buffer;
3926 char * dummy;
3927 Ustrcpy(p, "cwd= (failed)");
3928 dummy = /* quieten compiler */ getcwd(CS p+4, big_buffer_size - 4);
3929 while (*p) p++;
3930 (void)string_format(p, big_buffer_size - (p - big_buffer), " %d args:", argc);
3931 while (*p) p++;
3932 for (i = 0; i < argc; i++)
3933 {
3934 int len = Ustrlen(argv[i]);
3935 uschar *printing;
3936 uschar *quote;
3937 if (p + len + 8 >= big_buffer + big_buffer_size)
3938 {
3939 Ustrcpy(p, " ...");
3940 log_write(0, LOG_MAIN, "%s", big_buffer);
3941 Ustrcpy(big_buffer, "...");
3942 p = big_buffer + 3;
3943 }
3944 printing = string_printing(argv[i]);
3945 if (printing[0] == 0) quote = US"\""; else
3946 {
3947 uschar *pp = printing;
3948 quote = US"";
3949 while (*pp != 0) if (isspace(*pp++)) { quote = US"\""; break; }
3950 }
3951 sprintf(CS p, " %s%.*s%s", quote, (int)(big_buffer_size -
3952 (p - big_buffer) - 4), printing, quote);
3953 while (*p) p++;
3954 }
3955
3956 if ((log_extra_selector & LX_arguments) != 0)
3957 log_write(0, LOG_MAIN, "%s", big_buffer);
3958 else
3959 debug_printf("%s\n", big_buffer);
3960 }
3961
3962 /* Set the working directory to be the top-level spool directory. We don't rely
3963 on this in the code, which always uses fully qualified names, but it's useful
3964 for core dumps etc. Don't complain if it fails - the spool directory might not
3965 be generally accessible and calls with the -C option (and others) have lost
3966 privilege by now. Before the chdir, we try to ensure that the directory exists.
3967 */
3968
3969 if (Uchdir(spool_directory) != 0)
3970 {
3971 int dummy;
3972 (void)directory_make(spool_directory, US"", SPOOL_DIRECTORY_MODE, FALSE);
3973 dummy = /* quieten compiler */ Uchdir(spool_directory);
3974 }
3975
3976 /* Handle calls with the -bi option. This is a sendmail option to rebuild *the*
3977 alias file. Exim doesn't have such a concept, but this call is screwed into
3978 Sun's YP makefiles. Handle this by calling a configured script, as the real
3979 user who called Exim. The -oA option can be used to pass an argument to the
3980 script. */
3981
3982 if (bi_option)
3983 {
3984 (void)fclose(config_file);
3985 if (bi_command != NULL)
3986 {
3987 int i = 0;
3988 uschar *argv[3];
3989 argv[i++] = bi_command;
3990 if (alias_arg != NULL) argv[i++] = alias_arg;
3991 argv[i++] = NULL;
3992
3993 setgroups(group_count, group_list);
3994 exim_setugid(real_uid, real_gid, FALSE, US"running bi_command");
3995
3996 DEBUG(D_exec) debug_printf("exec %.256s %.256s\n", argv[0],
3997 (argv[1] == NULL)? US"" : argv[1]);
3998
3999 execv(CS argv[0], (char *const *)argv);
4000 fprintf(stderr, "exim: exec failed: %s\n", strerror(errno));
4001 exit(EXIT_FAILURE);
4002 }
4003 else
4004 {
4005 DEBUG(D_any) debug_printf("-bi used but bi_command not set; exiting\n");
4006 exit(EXIT_SUCCESS);
4007 }
4008 }
4009
4010 /* We moved the admin/trusted check to be immediately after reading the
4011 configuration file. We leave these prints here to ensure that syslog setup,
4012 logfile setup, and so on has already happened. */
4013
4014 if (trusted_caller) DEBUG(D_any) debug_printf("trusted user\n");
4015 if (admin_user) DEBUG(D_any) debug_printf("admin user\n");
4016
4017 /* Only an admin user may start the daemon or force a queue run in the default
4018 configuration, but the queue run restriction can be relaxed. Only an admin
4019 user may request that a message be returned to its sender forthwith. Only an
4020 admin user may specify a debug level greater than D_v (because it might show
4021 passwords, etc. in lookup queries). Only an admin user may request a queue
4022 count. Only an admin user can use the test interface to scan for email
4023 (because Exim will be in the spool dir and able to look at mails). */
4024
4025 if (!admin_user)
4026 {
4027 BOOL debugset = (debug_selector & ~D_v) != 0;
4028 if (deliver_give_up || daemon_listen || malware_test_file ||
4029 (count_queue && queue_list_requires_admin) ||
4030 (list_queue && queue_list_requires_admin) ||
4031 (queue_interval >= 0 && prod_requires_admin) ||
4032 (debugset && !running_in_test_harness))
4033 {
4034 fprintf(stderr, "exim:%s permission denied\n", debugset? " debugging" : "");
4035 exit(EXIT_FAILURE);
4036 }
4037 }
4038
4039 /* If the real user is not root or the exim uid, the argument for passing
4040 in an open TCP/IP connection for another message is not permitted, nor is
4041 running with the -N option for any delivery action, unless this call to exim is
4042 one that supplied an input message, or we are using a patched exim for
4043 regression testing. */
4044
4045 if (real_uid != root_uid && real_uid != exim_uid &&
4046 (continue_hostname != NULL ||
4047 (dont_deliver &&
4048 (queue_interval >= 0 || daemon_listen || msg_action_arg > 0)
4049 )) && !running_in_test_harness)
4050 {
4051 fprintf(stderr, "exim: Permission denied\n");
4052 return EXIT_FAILURE;
4053 }
4054
4055 /* If the caller is not trusted, certain arguments are ignored when running for
4056 real, but are permitted when checking things (-be, -bv, -bt, -bh, -bf, -bF).
4057 Note that authority for performing certain actions on messages is tested in the
4058 queue_action() function. */
4059
4060 if (!trusted_caller && !checking && filter_test == FTEST_NONE)
4061 {
4062 sender_host_name = sender_host_address = interface_address =
4063 sender_ident = received_protocol = NULL;
4064 sender_host_port = interface_port = 0;
4065 sender_host_authenticated = authenticated_sender = authenticated_id = NULL;
4066 }
4067
4068 /* If a sender host address is set, extract the optional port number off the
4069 end of it and check its syntax. Do the same thing for the interface address.
4070 Exim exits if the syntax is bad. */
4071
4072 else
4073 {
4074 if (sender_host_address != NULL)
4075 sender_host_port = check_port(sender_host_address);
4076 if (interface_address != NULL)
4077 interface_port = check_port(interface_address);
4078 }
4079
4080 /* If the caller is trusted, then they can use -G to suppress_local_fixups. */
4081 if (flag_G)
4082 {
4083 if (trusted_caller)
4084 {
4085 suppress_local_fixups = suppress_local_fixups_default = TRUE;
4086 DEBUG(D_acl) debug_printf("suppress_local_fixups forced on by -G\n");
4087 }
4088 else
4089 {
4090 fprintf(stderr, "exim: permission denied (-G requires a trusted user)\n");
4091 return EXIT_FAILURE;
4092 }
4093 }
4094
4095 /* If an SMTP message is being received check to see if the standard input is a
4096 TCP/IP socket. If it is, we assume that Exim was called from inetd if the
4097 caller is root or the Exim user, or if the port is a privileged one. Otherwise,
4098 barf. */
4099
4100 if (smtp_input)
4101 {
4102 union sockaddr_46 inetd_sock;
4103 EXIM_SOCKLEN_T size = sizeof(inetd_sock);
4104 if (getpeername(0, (struct sockaddr *)(&inetd_sock), &size) == 0)
4105 {
4106 int family = ((struct sockaddr *)(&inetd_sock))->sa_family;
4107 if (family == AF_INET || family == AF_INET6)
4108 {
4109 union sockaddr_46 interface_sock;
4110 size = sizeof(interface_sock);
4111
4112 if (getsockname(0, (struct sockaddr *)(&interface_sock), &size) == 0)
4113 interface_address = host_ntoa(-1, &interface_sock, NULL,
4114 &interface_port);
4115
4116 if (host_is_tls_on_connect_port(interface_port)) tls_in.on_connect = TRUE;
4117
4118 if (real_uid == root_uid || real_uid == exim_uid || interface_port < 1024)
4119 {
4120 is_inetd = TRUE;
4121 sender_host_address = host_ntoa(-1, (struct sockaddr *)(&inetd_sock),
4122 NULL, &sender_host_port);
4123 if (mua_wrapper) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Input from "
4124 "inetd is not supported when mua_wrapper is set");
4125 }
4126 else
4127 {
4128 fprintf(stderr,
4129 "exim: Permission denied (unprivileged user, unprivileged port)