40dd6a2536bd284d5a3c74ae6b41cf3a666f6abd
[exim.git] / src / src / exim.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2013 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8
9 /* The main function: entry point, initialization, and high-level control.
10 Also a few functions that don't naturally fit elsewhere. */
11
12
13 #include "exim.h"
14
15 extern void init_lookup_list(void);
16
17
18
19 /*************************************************
20 * Function interface to store functions *
21 *************************************************/
22
23 /* We need some real functions to pass to the PCRE regular expression library
24 for store allocation via Exim's store manager. The normal calls are actually
25 macros that pass over location information to make tracing easier. These
26 functions just interface to the standard macro calls. A good compiler will
27 optimize out the tail recursion and so not make them too expensive. There
28 are two sets of functions; one for use when we want to retain the compiled
29 regular expression for a long time; the other for short-term use. */
30
31 static void *
32 function_store_get(size_t size)
33 {
34 return store_get((int)size);
35 }
36
37 static void
38 function_dummy_free(void *block) { block = block; }
39
40 static void *
41 function_store_malloc(size_t size)
42 {
43 return store_malloc((int)size);
44 }
45
46 static void
47 function_store_free(void *block)
48 {
49 store_free(block);
50 }
51
52
53
54
55 /*************************************************
56 * Enums for cmdline interface *
57 *************************************************/
58
59 enum commandline_info { CMDINFO_NONE=0,
60 CMDINFO_HELP, CMDINFO_SIEVE, CMDINFO_DSCP };
61
62
63
64
65 /*************************************************
66 * Compile regular expression and panic on fail *
67 *************************************************/
68
69 /* This function is called when failure to compile a regular expression leads
70 to a panic exit. In other cases, pcre_compile() is called directly. In many
71 cases where this function is used, the results of the compilation are to be
72 placed in long-lived store, so we temporarily reset the store management
73 functions that PCRE uses if the use_malloc flag is set.
74
75 Argument:
76 pattern the pattern to compile
77 caseless TRUE if caseless matching is required
78 use_malloc TRUE if compile into malloc store
79
80 Returns: pointer to the compiled pattern
81 */
82
83 const pcre *
84 regex_must_compile(uschar *pattern, BOOL caseless, BOOL use_malloc)
85 {
86 int offset;
87 int options = PCRE_COPT;
88 const pcre *yield;
89 const uschar *error;
90 if (use_malloc)
91 {
92 pcre_malloc = function_store_malloc;
93 pcre_free = function_store_free;
94 }
95 if (caseless) options |= PCRE_CASELESS;
96 yield = pcre_compile(CS pattern, options, (const char **)&error, &offset, NULL);
97 pcre_malloc = function_store_get;
98 pcre_free = function_dummy_free;
99 if (yield == NULL)
100 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "regular expression error: "
101 "%s at offset %d while compiling %s", error, offset, pattern);
102 return yield;
103 }
104
105
106
107
108 /*************************************************
109 * Execute regular expression and set strings *
110 *************************************************/
111
112 /* This function runs a regular expression match, and sets up the pointers to
113 the matched substrings.
114
115 Arguments:
116 re the compiled expression
117 subject the subject string
118 options additional PCRE options
119 setup if < 0 do full setup
120 if >= 0 setup from setup+1 onwards,
121 excluding the full matched string
122
123 Returns: TRUE or FALSE
124 */
125
126 BOOL
127 regex_match_and_setup(const pcre *re, uschar *subject, int options, int setup)
128 {
129 int ovector[3*(EXPAND_MAXN+1)];
130 int n = pcre_exec(re, NULL, CS subject, Ustrlen(subject), 0,
131 PCRE_EOPT | options, ovector, sizeof(ovector)/sizeof(int));
132 BOOL yield = n >= 0;
133 if (n == 0) n = EXPAND_MAXN + 1;
134 if (yield)
135 {
136 int nn;
137 expand_nmax = (setup < 0)? 0 : setup + 1;
138 for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
139 {
140 expand_nstring[expand_nmax] = subject + ovector[nn];
141 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
142 }
143 expand_nmax--;
144 }
145 return yield;
146 }
147
148
149
150
151 /*************************************************
152 * Set up processing details *
153 *************************************************/
154
155 /* Save a text string for dumping when SIGUSR1 is received.
156 Do checks for overruns.
157
158 Arguments: format and arguments, as for printf()
159 Returns: nothing
160 */
161
162 void
163 set_process_info(const char *format, ...)
164 {
165 int len;
166 va_list ap;
167 sprintf(CS process_info, "%5d ", (int)getpid());
168 len = Ustrlen(process_info);
169 va_start(ap, format);
170 if (!string_vformat(process_info + len, PROCESS_INFO_SIZE - len - 2, format, ap))
171 Ustrcpy(process_info + len, "**** string overflowed buffer ****");
172 len = Ustrlen(process_info);
173 process_info[len+0] = '\n';
174 process_info[len+1] = '\0';
175 process_info_len = len + 1;
176 DEBUG(D_process_info) debug_printf("set_process_info: %s", process_info);
177 va_end(ap);
178 }
179
180
181
182
183 /*************************************************
184 * Handler for SIGUSR1 *
185 *************************************************/
186
187 /* SIGUSR1 causes any exim process to write to the process log details of
188 what it is currently doing. It will only be used if the OS is capable of
189 setting up a handler that causes automatic restarting of any system call
190 that is in progress at the time.
191
192 This function takes care to be signal-safe.
193
194 Argument: the signal number (SIGUSR1)
195 Returns: nothing
196 */
197
198 static void
199 usr1_handler(int sig)
200 {
201 int fd;
202
203 os_restarting_signal(sig, usr1_handler);
204
205 fd = Uopen(process_log_path, O_APPEND|O_WRONLY, LOG_MODE);
206 if (fd < 0)
207 {
208 /* If we are already running as the Exim user, try to create it in the
209 current process (assuming spool_directory exists). Otherwise, if we are
210 root, do the creation in an exim:exim subprocess. */
211
212 int euid = geteuid();
213 if (euid == exim_uid)
214 fd = Uopen(process_log_path, O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
215 else if (euid == root_uid)
216 fd = log_create_as_exim(process_log_path);
217 }
218
219 /* If we are neither exim nor root, or if we failed to create the log file,
220 give up. There is not much useful we can do with errors, since we don't want
221 to disrupt whatever is going on outside the signal handler. */
222
223 if (fd < 0) return;
224
225 {int dummy = write(fd, process_info, process_info_len); dummy = dummy; }
226 (void)close(fd);
227 }
228
229
230
231 /*************************************************
232 * Timeout handler *
233 *************************************************/
234
235 /* This handler is enabled most of the time that Exim is running. The handler
236 doesn't actually get used unless alarm() has been called to set a timer, to
237 place a time limit on a system call of some kind. When the handler is run, it
238 re-enables itself.
239
240 There are some other SIGALRM handlers that are used in special cases when more
241 than just a flag setting is required; for example, when reading a message's
242 input. These are normally set up in the code module that uses them, and the
243 SIGALRM handler is reset to this one afterwards.
244
245 Argument: the signal value (SIGALRM)
246 Returns: nothing
247 */
248
249 void
250 sigalrm_handler(int sig)
251 {
252 sig = sig; /* Keep picky compilers happy */
253 sigalrm_seen = TRUE;
254 os_non_restarting_signal(SIGALRM, sigalrm_handler);
255 }
256
257
258
259 /*************************************************
260 * Sleep for a fractional time interval *
261 *************************************************/
262
263 /* This function is called by millisleep() and exim_wait_tick() to wait for a
264 period of time that may include a fraction of a second. The coding is somewhat
265 tedious. We do not expect setitimer() ever to fail, but if it does, the process
266 will wait for ever, so we panic in this instance. (There was a case of this
267 when a bug in a function that calls milliwait() caused it to pass invalid data.
268 That's when I added the check. :-)
269
270 Argument: an itimerval structure containing the interval
271 Returns: nothing
272 */
273
274 static void
275 milliwait(struct itimerval *itval)
276 {
277 sigset_t sigmask;
278 sigset_t old_sigmask;
279 (void)sigemptyset(&sigmask); /* Empty mask */
280 (void)sigaddset(&sigmask, SIGALRM); /* Add SIGALRM */
281 (void)sigprocmask(SIG_BLOCK, &sigmask, &old_sigmask); /* Block SIGALRM */
282 if (setitimer(ITIMER_REAL, itval, NULL) < 0) /* Start timer */
283 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
284 "setitimer() failed: %s", strerror(errno));
285 (void)sigfillset(&sigmask); /* All signals */
286 (void)sigdelset(&sigmask, SIGALRM); /* Remove SIGALRM */
287 (void)sigsuspend(&sigmask); /* Until SIGALRM */
288 (void)sigprocmask(SIG_SETMASK, &old_sigmask, NULL); /* Restore mask */
289 }
290
291
292
293
294 /*************************************************
295 * Millisecond sleep function *
296 *************************************************/
297
298 /* The basic sleep() function has a granularity of 1 second, which is too rough
299 in some cases - for example, when using an increasing delay to slow down
300 spammers.
301
302 Argument: number of millseconds
303 Returns: nothing
304 */
305
306 void
307 millisleep(int msec)
308 {
309 struct itimerval itval;
310 itval.it_interval.tv_sec = 0;
311 itval.it_interval.tv_usec = 0;
312 itval.it_value.tv_sec = msec/1000;
313 itval.it_value.tv_usec = (msec % 1000) * 1000;
314 milliwait(&itval);
315 }
316
317
318
319 /*************************************************
320 * Compare microsecond times *
321 *************************************************/
322
323 /*
324 Arguments:
325 tv1 the first time
326 tv2 the second time
327
328 Returns: -1, 0, or +1
329 */
330
331 int
332 exim_tvcmp(struct timeval *t1, struct timeval *t2)
333 {
334 if (t1->tv_sec > t2->tv_sec) return +1;
335 if (t1->tv_sec < t2->tv_sec) return -1;
336 if (t1->tv_usec > t2->tv_usec) return +1;
337 if (t1->tv_usec < t2->tv_usec) return -1;
338 return 0;
339 }
340
341
342
343
344 /*************************************************
345 * Clock tick wait function *
346 *************************************************/
347
348 /* Exim uses a time + a pid to generate a unique identifier in two places: its
349 message IDs, and in file names for maildir deliveries. Because some OS now
350 re-use pids within the same second, sub-second times are now being used.
351 However, for absolute certaintly, we must ensure the clock has ticked before
352 allowing the relevant process to complete. At the time of implementation of
353 this code (February 2003), the speed of processors is such that the clock will
354 invariably have ticked already by the time a process has done its job. This
355 function prepares for the time when things are faster - and it also copes with
356 clocks that go backwards.
357
358 Arguments:
359 then_tv A timeval which was used to create uniqueness; its usec field
360 has been rounded down to the value of the resolution.
361 We want to be sure the current time is greater than this.
362 resolution The resolution that was used to divide the microseconds
363 (1 for maildir, larger for message ids)
364
365 Returns: nothing
366 */
367
368 void
369 exim_wait_tick(struct timeval *then_tv, int resolution)
370 {
371 struct timeval now_tv;
372 long int now_true_usec;
373
374 (void)gettimeofday(&now_tv, NULL);
375 now_true_usec = now_tv.tv_usec;
376 now_tv.tv_usec = (now_true_usec/resolution) * resolution;
377
378 if (exim_tvcmp(&now_tv, then_tv) <= 0)
379 {
380 struct itimerval itval;
381 itval.it_interval.tv_sec = 0;
382 itval.it_interval.tv_usec = 0;
383 itval.it_value.tv_sec = then_tv->tv_sec - now_tv.tv_sec;
384 itval.it_value.tv_usec = then_tv->tv_usec + resolution - now_true_usec;
385
386 /* We know that, overall, "now" is less than or equal to "then". Therefore, a
387 negative value for the microseconds is possible only in the case when "now"
388 is more than a second less than "then". That means that itval.it_value.tv_sec
389 is greater than zero. The following correction is therefore safe. */
390
391 if (itval.it_value.tv_usec < 0)
392 {
393 itval.it_value.tv_usec += 1000000;
394 itval.it_value.tv_sec -= 1;
395 }
396
397 DEBUG(D_transport|D_receive)
398 {
399 if (!running_in_test_harness)
400 {
401 debug_printf("tick check: %lu.%06lu %lu.%06lu\n",
402 then_tv->tv_sec, then_tv->tv_usec, now_tv.tv_sec, now_tv.tv_usec);
403 debug_printf("waiting %lu.%06lu\n", itval.it_value.tv_sec,
404 itval.it_value.tv_usec);
405 }
406 }
407
408 milliwait(&itval);
409 }
410 }
411
412
413
414
415 /*************************************************
416 * Call fopen() with umask 777 and adjust mode *
417 *************************************************/
418
419 /* Exim runs with umask(0) so that files created with open() have the mode that
420 is specified in the open() call. However, there are some files, typically in
421 the spool directory, that are created with fopen(). They end up world-writeable
422 if no precautions are taken. Although the spool directory is not accessible to
423 the world, this is an untidiness. So this is a wrapper function for fopen()
424 that sorts out the mode of the created file.
425
426 Arguments:
427 filename the file name
428 options the fopen() options
429 mode the required mode
430
431 Returns: the fopened FILE or NULL
432 */
433
434 FILE *
435 modefopen(const uschar *filename, const char *options, mode_t mode)
436 {
437 mode_t saved_umask = umask(0777);
438 FILE *f = Ufopen(filename, options);
439 (void)umask(saved_umask);
440 if (f != NULL) (void)fchmod(fileno(f), mode);
441 return f;
442 }
443
444
445
446
447 /*************************************************
448 * Ensure stdin, stdout, and stderr exist *
449 *************************************************/
450
451 /* Some operating systems grumble if an exec() happens without a standard
452 input, output, and error (fds 0, 1, 2) being defined. The worry is that some
453 file will be opened and will use these fd values, and then some other bit of
454 code will assume, for example, that it can write error messages to stderr.
455 This function ensures that fds 0, 1, and 2 are open if they do not already
456 exist, by connecting them to /dev/null.
457
458 This function is also used to ensure that std{in,out,err} exist at all times,
459 so that if any library that Exim calls tries to use them, it doesn't crash.
460
461 Arguments: None
462 Returns: Nothing
463 */
464
465 void
466 exim_nullstd(void)
467 {
468 int i;
469 int devnull = -1;
470 struct stat statbuf;
471 for (i = 0; i <= 2; i++)
472 {
473 if (fstat(i, &statbuf) < 0 && errno == EBADF)
474 {
475 if (devnull < 0) devnull = open("/dev/null", O_RDWR);
476 if (devnull < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
477 string_open_failed(errno, "/dev/null"));
478 if (devnull != i) (void)dup2(devnull, i);
479 }
480 }
481 if (devnull > 2) (void)close(devnull);
482 }
483
484
485
486
487 /*************************************************
488 * Close unwanted file descriptors for delivery *
489 *************************************************/
490
491 /* This function is called from a new process that has been forked to deliver
492 an incoming message, either directly, or using exec.
493
494 We want any smtp input streams to be closed in this new process. However, it
495 has been observed that using fclose() here causes trouble. When reading in -bS
496 input, duplicate copies of messages have been seen. The files will be sharing a
497 file pointer with the parent process, and it seems that fclose() (at least on
498 some systems - I saw this on Solaris 2.5.1) messes with that file pointer, at
499 least sometimes. Hence we go for closing the underlying file descriptors.
500
501 If TLS is active, we want to shut down the TLS library, but without molesting
502 the parent's SSL connection.
503
504 For delivery of a non-SMTP message, we want to close stdin and stdout (and
505 stderr unless debugging) because the calling process might have set them up as
506 pipes and be waiting for them to close before it waits for the submission
507 process to terminate. If they aren't closed, they hold up the calling process
508 until the initial delivery process finishes, which is not what we want.
509
510 Exception: We do want it for synchronous delivery!
511
512 And notwithstanding all the above, if D_resolver is set, implying resolver
513 debugging, leave stdout open, because that's where the resolver writes its
514 debugging output.
515
516 When we close stderr (which implies we've also closed stdout), we also get rid
517 of any controlling terminal.
518
519 Arguments: None
520 Returns: Nothing
521 */
522
523 static void
524 close_unwanted(void)
525 {
526 if (smtp_input)
527 {
528 #ifdef SUPPORT_TLS
529 tls_close(TRUE, FALSE); /* Shut down the TLS library */
530 #endif
531 (void)close(fileno(smtp_in));
532 (void)close(fileno(smtp_out));
533 smtp_in = NULL;
534 }
535 else
536 {
537 (void)close(0); /* stdin */
538 if ((debug_selector & D_resolver) == 0) (void)close(1); /* stdout */
539 if (debug_selector == 0) /* stderr */
540 {
541 if (!synchronous_delivery)
542 {
543 (void)close(2);
544 log_stderr = NULL;
545 }
546 (void)setsid();
547 }
548 }
549 }
550
551
552
553
554 /*************************************************
555 * Set uid and gid *
556 *************************************************/
557
558 /* This function sets a new uid and gid permanently, optionally calling
559 initgroups() to set auxiliary groups. There are some special cases when running
560 Exim in unprivileged modes. In these situations the effective uid will not be
561 root; if we already have the right effective uid/gid, and don't need to
562 initialize any groups, leave things as they are.
563
564 Arguments:
565 uid the uid
566 gid the gid
567 igflag TRUE if initgroups() wanted
568 msg text to use in debugging output and failure log
569
570 Returns: nothing; bombs out on failure
571 */
572
573 void
574 exim_setugid(uid_t uid, gid_t gid, BOOL igflag, uschar *msg)
575 {
576 uid_t euid = geteuid();
577 gid_t egid = getegid();
578
579 if (euid == root_uid || euid != uid || egid != gid || igflag)
580 {
581 /* At least one OS returns +1 for initgroups failure, so just check for
582 non-zero. */
583
584 if (igflag)
585 {
586 struct passwd *pw = getpwuid(uid);
587 if (pw != NULL)
588 {
589 if (initgroups(pw->pw_name, gid) != 0)
590 log_write(0,LOG_MAIN|LOG_PANIC_DIE,"initgroups failed for uid=%ld: %s",
591 (long int)uid, strerror(errno));
592 }
593 else log_write(0, LOG_MAIN|LOG_PANIC_DIE, "cannot run initgroups(): "
594 "no passwd entry for uid=%ld", (long int)uid);
595 }
596
597 if (setgid(gid) < 0 || setuid(uid) < 0)
598 {
599 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to set gid=%ld or uid=%ld "
600 "(euid=%ld): %s", (long int)gid, (long int)uid, (long int)euid, msg);
601 }
602 }
603
604 /* Debugging output included uid/gid and all groups */
605
606 DEBUG(D_uid)
607 {
608 int group_count, save_errno;
609 gid_t group_list[NGROUPS_MAX];
610 debug_printf("changed uid/gid: %s\n uid=%ld gid=%ld pid=%ld\n", msg,
611 (long int)geteuid(), (long int)getegid(), (long int)getpid());
612 group_count = getgroups(NGROUPS_MAX, group_list);
613 save_errno = errno;
614 debug_printf(" auxiliary group list:");
615 if (group_count > 0)
616 {
617 int i;
618 for (i = 0; i < group_count; i++) debug_printf(" %d", (int)group_list[i]);
619 }
620 else if (group_count < 0)
621 debug_printf(" <error: %s>", strerror(save_errno));
622 else debug_printf(" <none>");
623 debug_printf("\n");
624 }
625 }
626
627
628
629
630 /*************************************************
631 * Exit point *
632 *************************************************/
633
634 /* Exim exits via this function so that it always clears up any open
635 databases.
636
637 Arguments:
638 rc return code
639
640 Returns: does not return
641 */
642
643 void
644 exim_exit(int rc)
645 {
646 search_tidyup();
647 DEBUG(D_any)
648 debug_printf(">>>>>>>>>>>>>>>> Exim pid=%d terminating with rc=%d "
649 ">>>>>>>>>>>>>>>>\n", (int)getpid(), rc);
650 exit(rc);
651 }
652
653
654
655
656 /*************************************************
657 * Extract port from host address *
658 *************************************************/
659
660 /* Called to extract the port from the values given to -oMa and -oMi.
661 It also checks the syntax of the address, and terminates it before the
662 port data when a port is extracted.
663
664 Argument:
665 address the address, with possible port on the end
666
667 Returns: the port, or zero if there isn't one
668 bombs out on a syntax error
669 */
670
671 static int
672 check_port(uschar *address)
673 {
674 int port = host_address_extract_port(address);
675 if (string_is_ip_address(address, NULL) == 0)
676 {
677 fprintf(stderr, "exim abandoned: \"%s\" is not an IP address\n", address);
678 exit(EXIT_FAILURE);
679 }
680 return port;
681 }
682
683
684
685 /*************************************************
686 * Test/verify an address *
687 *************************************************/
688
689 /* This function is called by the -bv and -bt code. It extracts a working
690 address from a full RFC 822 address. This isn't really necessary per se, but it
691 has the effect of collapsing source routes.
692
693 Arguments:
694 s the address string
695 flags flag bits for verify_address()
696 exit_value to be set for failures
697
698 Returns: nothing
699 */
700
701 static void
702 test_address(uschar *s, int flags, int *exit_value)
703 {
704 int start, end, domain;
705 uschar *parse_error = NULL;
706 uschar *address = parse_extract_address(s, &parse_error, &start, &end, &domain,
707 FALSE);
708 if (address == NULL)
709 {
710 fprintf(stdout, "syntax error: %s\n", parse_error);
711 *exit_value = 2;
712 }
713 else
714 {
715 int rc = verify_address(deliver_make_addr(address,TRUE), stdout, flags, -1,
716 -1, -1, NULL, NULL, NULL);
717 if (rc == FAIL) *exit_value = 2;
718 else if (rc == DEFER && *exit_value == 0) *exit_value = 1;
719 }
720 }
721
722
723
724 /*************************************************
725 * Show supported features *
726 *************************************************/
727
728 /* This function is called for -bV/--version and for -d to output the optional
729 features of the current Exim binary.
730
731 Arguments: a FILE for printing
732 Returns: nothing
733 */
734
735 static void
736 show_whats_supported(FILE *f)
737 {
738 auth_info *authi;
739
740 #ifdef DB_VERSION_STRING
741 fprintf(f, "Berkeley DB: %s\n", DB_VERSION_STRING);
742 #elif defined(BTREEVERSION) && defined(HASHVERSION)
743 #ifdef USE_DB
744 fprintf(f, "Probably Berkeley DB version 1.8x (native mode)\n");
745 #else
746 fprintf(f, "Probably Berkeley DB version 1.8x (compatibility mode)\n");
747 #endif
748 #elif defined(_DBM_RDONLY) || defined(dbm_dirfno)
749 fprintf(f, "Probably ndbm\n");
750 #elif defined(USE_TDB)
751 fprintf(f, "Using tdb\n");
752 #else
753 #ifdef USE_GDBM
754 fprintf(f, "Probably GDBM (native mode)\n");
755 #else
756 fprintf(f, "Probably GDBM (compatibility mode)\n");
757 #endif
758 #endif
759
760 fprintf(f, "Support for:");
761 #ifdef SUPPORT_CRYPTEQ
762 fprintf(f, " crypteq");
763 #endif
764 #if HAVE_ICONV
765 fprintf(f, " iconv()");
766 #endif
767 #if HAVE_IPV6
768 fprintf(f, " IPv6");
769 #endif
770 #ifdef HAVE_SETCLASSRESOURCES
771 fprintf(f, " use_setclassresources");
772 #endif
773 #ifdef SUPPORT_PAM
774 fprintf(f, " PAM");
775 #endif
776 #ifdef EXIM_PERL
777 fprintf(f, " Perl");
778 #endif
779 #ifdef EXPAND_DLFUNC
780 fprintf(f, " Expand_dlfunc");
781 #endif
782 #ifdef USE_TCP_WRAPPERS
783 fprintf(f, " TCPwrappers");
784 #endif
785 #ifdef SUPPORT_TLS
786 #ifdef USE_GNUTLS
787 fprintf(f, " GnuTLS");
788 #else
789 fprintf(f, " OpenSSL");
790 #endif
791 #endif
792 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
793 fprintf(f, " translate_ip_address");
794 #endif
795 #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
796 fprintf(f, " move_frozen_messages");
797 #endif
798 #ifdef WITH_CONTENT_SCAN
799 fprintf(f, " Content_Scanning");
800 #endif
801 #ifndef DISABLE_DKIM
802 fprintf(f, " DKIM");
803 #endif
804 #ifdef WITH_OLD_DEMIME
805 fprintf(f, " Old_Demime");
806 #endif
807 #ifdef EXPERIMENTAL_SPF
808 fprintf(f, " Experimental_SPF");
809 #endif
810 #ifdef EXPERIMENTAL_SRS
811 fprintf(f, " Experimental_SRS");
812 #endif
813 #ifdef EXPERIMENTAL_BRIGHTMAIL
814 fprintf(f, " Experimental_Brightmail");
815 #endif
816 #ifdef EXPERIMENTAL_DCC
817 fprintf(f, " Experimental_DCC");
818 #endif
819 #ifdef EXPERIMENTAL_DMARC
820 fprintf(f, " Experimental_DMARC");
821 #endif
822 #ifdef EXPERIMENTAL_OCSP
823 fprintf(f, " Experimental_OCSP");
824 #endif
825 #ifdef EXPERIMENTAL_PRDR
826 fprintf(f, " Experimental_PRDR");
827 #endif
828 #ifdef EXPERIMENTAL_TPDA
829 fprintf(f, " Experimental_TPDA");
830 #endif
831 #ifdef EXPERIMENTAL_REDIS
832 fprintf(f, " Experimental_Redis");
833 #endif
834 fprintf(f, "\n");
835
836 fprintf(f, "Lookups (built-in):");
837 #if defined(LOOKUP_LSEARCH) && LOOKUP_LSEARCH!=2
838 fprintf(f, " lsearch wildlsearch nwildlsearch iplsearch");
839 #endif
840 #if defined(LOOKUP_CDB) && LOOKUP_CDB!=2
841 fprintf(f, " cdb");
842 #endif
843 #if defined(LOOKUP_DBM) && LOOKUP_DBM!=2
844 fprintf(f, " dbm dbmjz dbmnz");
845 #endif
846 #if defined(LOOKUP_DNSDB) && LOOKUP_DNSDB!=2
847 fprintf(f, " dnsdb");
848 #endif
849 #if defined(LOOKUP_DSEARCH) && LOOKUP_DSEARCH!=2
850 fprintf(f, " dsearch");
851 #endif
852 #if defined(LOOKUP_IBASE) && LOOKUP_IBASE!=2
853 fprintf(f, " ibase");
854 #endif
855 #if defined(LOOKUP_LDAP) && LOOKUP_LDAP!=2
856 fprintf(f, " ldap ldapdn ldapm");
857 #endif
858 #if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
859 fprintf(f, " mysql");
860 #endif
861 #if defined(LOOKUP_NIS) && LOOKUP_NIS!=2
862 fprintf(f, " nis nis0");
863 #endif
864 #if defined(LOOKUP_NISPLUS) && LOOKUP_NISPLUS!=2
865 fprintf(f, " nisplus");
866 #endif
867 #if defined(LOOKUP_ORACLE) && LOOKUP_ORACLE!=2
868 fprintf(f, " oracle");
869 #endif
870 #if defined(LOOKUP_PASSWD) && LOOKUP_PASSWD!=2
871 fprintf(f, " passwd");
872 #endif
873 #if defined(LOOKUP_PGSQL) && LOOKUP_PGSQL!=2
874 fprintf(f, " pgsql");
875 #endif
876 #if defined(LOOKUP_SQLITE) && LOOKUP_SQLITE!=2
877 fprintf(f, " sqlite");
878 #endif
879 #if defined(LOOKUP_TESTDB) && LOOKUP_TESTDB!=2
880 fprintf(f, " testdb");
881 #endif
882 #if defined(LOOKUP_WHOSON) && LOOKUP_WHOSON!=2
883 fprintf(f, " whoson");
884 #endif
885 fprintf(f, "\n");
886
887 fprintf(f, "Authenticators:");
888 #ifdef AUTH_CRAM_MD5
889 fprintf(f, " cram_md5");
890 #endif
891 #ifdef AUTH_CYRUS_SASL
892 fprintf(f, " cyrus_sasl");
893 #endif
894 #ifdef AUTH_DOVECOT
895 fprintf(f, " dovecot");
896 #endif
897 #ifdef AUTH_GSASL
898 fprintf(f, " gsasl");
899 #endif
900 #ifdef AUTH_HEIMDAL_GSSAPI
901 fprintf(f, " heimdal_gssapi");
902 #endif
903 #ifdef AUTH_PLAINTEXT
904 fprintf(f, " plaintext");
905 #endif
906 #ifdef AUTH_SPA
907 fprintf(f, " spa");
908 #endif
909 fprintf(f, "\n");
910
911 fprintf(f, "Routers:");
912 #ifdef ROUTER_ACCEPT
913 fprintf(f, " accept");
914 #endif
915 #ifdef ROUTER_DNSLOOKUP
916 fprintf(f, " dnslookup");
917 #endif
918 #ifdef ROUTER_IPLITERAL
919 fprintf(f, " ipliteral");
920 #endif
921 #ifdef ROUTER_IPLOOKUP
922 fprintf(f, " iplookup");
923 #endif
924 #ifdef ROUTER_MANUALROUTE
925 fprintf(f, " manualroute");
926 #endif
927 #ifdef ROUTER_QUERYPROGRAM
928 fprintf(f, " queryprogram");
929 #endif
930 #ifdef ROUTER_REDIRECT
931 fprintf(f, " redirect");
932 #endif
933 fprintf(f, "\n");
934
935 fprintf(f, "Transports:");
936 #ifdef TRANSPORT_APPENDFILE
937 fprintf(f, " appendfile");
938 #ifdef SUPPORT_MAILDIR
939 fprintf(f, "/maildir");
940 #endif
941 #ifdef SUPPORT_MAILSTORE
942 fprintf(f, "/mailstore");
943 #endif
944 #ifdef SUPPORT_MBX
945 fprintf(f, "/mbx");
946 #endif
947 #endif
948 #ifdef TRANSPORT_AUTOREPLY
949 fprintf(f, " autoreply");
950 #endif
951 #ifdef TRANSPORT_LMTP
952 fprintf(f, " lmtp");
953 #endif
954 #ifdef TRANSPORT_PIPE
955 fprintf(f, " pipe");
956 #endif
957 #ifdef TRANSPORT_SMTP
958 fprintf(f, " smtp");
959 #endif
960 fprintf(f, "\n");
961
962 if (fixed_never_users[0] > 0)
963 {
964 int i;
965 fprintf(f, "Fixed never_users: ");
966 for (i = 1; i <= (int)fixed_never_users[0] - 1; i++)
967 fprintf(f, "%d:", (unsigned int)fixed_never_users[i]);
968 fprintf(f, "%d\n", (unsigned int)fixed_never_users[i]);
969 }
970
971 fprintf(f, "Size of off_t: " SIZE_T_FMT "\n", sizeof(off_t));
972
973 /* Everything else is details which are only worth reporting when debugging.
974 Perhaps the tls_version_report should move into this too. */
975 DEBUG(D_any) do {
976
977 int i;
978
979 /* clang defines __GNUC__ (at least, for me) so test for it first */
980 #if defined(__clang__)
981 fprintf(f, "Compiler: CLang [%s]\n", __clang_version__);
982 #elif defined(__GNUC__)
983 fprintf(f, "Compiler: GCC [%s]\n",
984 # ifdef __VERSION__
985 __VERSION__
986 # else
987 "? unknown version ?"
988 # endif
989 );
990 #else
991 fprintf(f, "Compiler: <unknown>\n");
992 #endif
993
994 #ifdef SUPPORT_TLS
995 tls_version_report(f);
996 #endif
997
998 for (authi = auths_available; *authi->driver_name != '\0'; ++authi) {
999 if (authi->version_report) {
1000 (*authi->version_report)(f);
1001 }
1002 }
1003
1004 /* PCRE_PRERELEASE is either defined and empty or a bare sequence of
1005 characters; unless it's an ancient version of PCRE in which case it
1006 is not defined. */
1007 #ifndef PCRE_PRERELEASE
1008 #define PCRE_PRERELEASE
1009 #endif
1010 #define QUOTE(X) #X
1011 #define EXPAND_AND_QUOTE(X) QUOTE(X)
1012 fprintf(f, "Library version: PCRE: Compile: %d.%d%s\n"
1013 " Runtime: %s\n",
1014 PCRE_MAJOR, PCRE_MINOR,
1015 EXPAND_AND_QUOTE(PCRE_PRERELEASE) "",
1016 pcre_version());
1017 #undef QUOTE
1018 #undef EXPAND_AND_QUOTE
1019
1020 init_lookup_list();
1021 for (i = 0; i < lookup_list_count; i++)
1022 {
1023 if (lookup_list[i]->version_report)
1024 lookup_list[i]->version_report(f);
1025 }
1026
1027 #ifdef WHITELIST_D_MACROS
1028 fprintf(f, "WHITELIST_D_MACROS: \"%s\"\n", WHITELIST_D_MACROS);
1029 #else
1030 fprintf(f, "WHITELIST_D_MACROS unset\n");
1031 #endif
1032 #ifdef TRUSTED_CONFIG_LIST
1033 fprintf(f, "TRUSTED_CONFIG_LIST: \"%s\"\n", TRUSTED_CONFIG_LIST);
1034 #else
1035 fprintf(f, "TRUSTED_CONFIG_LIST unset\n");
1036 #endif
1037
1038 } while (0);
1039 }
1040
1041
1042 /*************************************************
1043 * Show auxiliary information about Exim *
1044 *************************************************/
1045
1046 static void
1047 show_exim_information(enum commandline_info request, FILE *stream)
1048 {
1049 const uschar **pp;
1050
1051 switch(request)
1052 {
1053 case CMDINFO_NONE:
1054 fprintf(stream, "Oops, something went wrong.\n");
1055 return;
1056 case CMDINFO_HELP:
1057 fprintf(stream,
1058 "The -bI: flag takes a string indicating which information to provide.\n"
1059 "If the string is not recognised, you'll get this help (on stderr).\n"
1060 "\n"
1061 " exim -bI:help this information\n"
1062 " exim -bI:dscp dscp value keywords known\n"
1063 " exim -bI:sieve list of supported sieve extensions, one per line.\n"
1064 );
1065 return;
1066 case CMDINFO_SIEVE:
1067 for (pp = exim_sieve_extension_list; *pp; ++pp)
1068 fprintf(stream, "%s\n", *pp);
1069 return;
1070 case CMDINFO_DSCP:
1071 dscp_list_to_stream(stream);
1072 return;
1073 }
1074 }
1075
1076
1077 /*************************************************
1078 * Quote a local part *
1079 *************************************************/
1080
1081 /* This function is used when a sender address or a From: or Sender: header
1082 line is being created from the caller's login, or from an authenticated_id. It
1083 applies appropriate quoting rules for a local part.
1084
1085 Argument: the local part
1086 Returns: the local part, quoted if necessary
1087 */
1088
1089 uschar *
1090 local_part_quote(uschar *lpart)
1091 {
1092 BOOL needs_quote = FALSE;
1093 int size, ptr;
1094 uschar *yield;
1095 uschar *t;
1096
1097 for (t = lpart; !needs_quote && *t != 0; t++)
1098 {
1099 needs_quote = !isalnum(*t) && strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
1100 (*t != '.' || t == lpart || t[1] == 0);
1101 }
1102
1103 if (!needs_quote) return lpart;
1104
1105 size = ptr = 0;
1106 yield = string_cat(NULL, &size, &ptr, US"\"", 1);
1107
1108 for (;;)
1109 {
1110 uschar *nq = US Ustrpbrk(lpart, "\\\"");
1111 if (nq == NULL)
1112 {
1113 yield = string_cat(yield, &size, &ptr, lpart, Ustrlen(lpart));
1114 break;
1115 }
1116 yield = string_cat(yield, &size, &ptr, lpart, nq - lpart);
1117 yield = string_cat(yield, &size, &ptr, US"\\", 1);
1118 yield = string_cat(yield, &size, &ptr, nq, 1);
1119 lpart = nq + 1;
1120 }
1121
1122 yield = string_cat(yield, &size, &ptr, US"\"", 1);
1123 yield[ptr] = 0;
1124 return yield;
1125 }
1126
1127
1128
1129 #ifdef USE_READLINE
1130 /*************************************************
1131 * Load readline() functions *
1132 *************************************************/
1133
1134 /* This function is called from testing executions that read data from stdin,
1135 but only when running as the calling user. Currently, only -be does this. The
1136 function loads the readline() function library and passes back the functions.
1137 On some systems, it needs the curses library, so load that too, but try without
1138 it if loading fails. All this functionality has to be requested at build time.
1139
1140 Arguments:
1141 fn_readline_ptr pointer to where to put the readline pointer
1142 fn_addhist_ptr pointer to where to put the addhistory function
1143
1144 Returns: the dlopen handle or NULL on failure
1145 */
1146
1147 static void *
1148 set_readline(char * (**fn_readline_ptr)(const char *),
1149 void (**fn_addhist_ptr)(const char *))
1150 {
1151 void *dlhandle;
1152 void *dlhandle_curses = dlopen("libcurses." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_LAZY);
1153
1154 dlhandle = dlopen("libreadline." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_NOW);
1155 if (dlhandle_curses != NULL) dlclose(dlhandle_curses);
1156
1157 if (dlhandle != NULL)
1158 {
1159 /* Checked manual pages; at least in GNU Readline 6.1, the prototypes are:
1160 * char * readline (const char *prompt);
1161 * void add_history (const char *string);
1162 */
1163 *fn_readline_ptr = (char *(*)(const char*))dlsym(dlhandle, "readline");
1164 *fn_addhist_ptr = (void(*)(const char*))dlsym(dlhandle, "add_history");
1165 }
1166 else
1167 {
1168 DEBUG(D_any) debug_printf("failed to load readline: %s\n", dlerror());
1169 }
1170
1171 return dlhandle;
1172 }
1173 #endif
1174
1175
1176
1177 /*************************************************
1178 * Get a line from stdin for testing things *
1179 *************************************************/
1180
1181 /* This function is called when running tests that can take a number of lines
1182 of input (for example, -be and -bt). It handles continuations and trailing
1183 spaces. And prompting and a blank line output on eof. If readline() is in use,
1184 the arguments are non-NULL and provide the relevant functions.
1185
1186 Arguments:
1187 fn_readline readline function or NULL
1188 fn_addhist addhist function or NULL
1189
1190 Returns: pointer to dynamic memory, or NULL at end of file
1191 */
1192
1193 static uschar *
1194 get_stdinput(char *(*fn_readline)(const char *), void(*fn_addhist)(const char *))
1195 {
1196 int i;
1197 int size = 0;
1198 int ptr = 0;
1199 uschar *yield = NULL;
1200
1201 if (fn_readline == NULL) { printf("> "); fflush(stdout); }
1202
1203 for (i = 0;; i++)
1204 {
1205 uschar buffer[1024];
1206 uschar *p, *ss;
1207
1208 #ifdef USE_READLINE
1209 char *readline_line = NULL;
1210 if (fn_readline != NULL)
1211 {
1212 if ((readline_line = fn_readline((i > 0)? "":"> ")) == NULL) break;
1213 if (*readline_line != 0 && fn_addhist != NULL) fn_addhist(readline_line);
1214 p = US readline_line;
1215 }
1216 else
1217 #endif
1218
1219 /* readline() not in use */
1220
1221 {
1222 if (Ufgets(buffer, sizeof(buffer), stdin) == NULL) break;
1223 p = buffer;
1224 }
1225
1226 /* Handle the line */
1227
1228 ss = p + (int)Ustrlen(p);
1229 while (ss > p && isspace(ss[-1])) ss--;
1230
1231 if (i > 0)
1232 {
1233 while (p < ss && isspace(*p)) p++; /* leading space after cont */
1234 }
1235
1236 yield = string_cat(yield, &size, &ptr, p, ss - p);
1237
1238 #ifdef USE_READLINE
1239 if (fn_readline != NULL) free(readline_line);
1240 #endif
1241
1242 if (ss == p || yield[ptr-1] != '\\')
1243 {
1244 yield[ptr] = 0;
1245 break;
1246 }
1247 yield[--ptr] = 0;
1248 }
1249
1250 if (yield == NULL) printf("\n");
1251 return yield;
1252 }
1253
1254
1255
1256 /*************************************************
1257 * Output usage information for the program *
1258 *************************************************/
1259
1260 /* This function is called when there are no recipients
1261 or a specific --help argument was added.
1262
1263 Arguments:
1264 progname information on what name we were called by
1265
1266 Returns: DOES NOT RETURN
1267 */
1268
1269 static void
1270 exim_usage(uschar *progname)
1271 {
1272
1273 /* Handle specific program invocation varients */
1274 if (Ustrcmp(progname, US"-mailq") == 0)
1275 {
1276 fprintf(stderr,
1277 "mailq - list the contents of the mail queue\n\n"
1278 "For a list of options, see the Exim documentation.\n");
1279 exit(EXIT_FAILURE);
1280 }
1281
1282 /* Generic usage - we output this whatever happens */
1283 fprintf(stderr,
1284 "Exim is a Mail Transfer Agent. It is normally called by Mail User Agents,\n"
1285 "not directly from a shell command line. Options and/or arguments control\n"
1286 "what it does when called. For a list of options, see the Exim documentation.\n");
1287
1288 exit(EXIT_FAILURE);
1289 }
1290
1291
1292
1293 /*************************************************
1294 * Validate that the macros given are okay *
1295 *************************************************/
1296
1297 /* Typically, Exim will drop privileges if macros are supplied. In some
1298 cases, we want to not do so.
1299
1300 Arguments: none (macros is a global)
1301 Returns: true if trusted, false otherwise
1302 */
1303
1304 static BOOL
1305 macros_trusted(void)
1306 {
1307 #ifdef WHITELIST_D_MACROS
1308 macro_item *m;
1309 uschar *whitelisted, *end, *p, **whites, **w;
1310 int white_count, i, n;
1311 size_t len;
1312 BOOL prev_char_item, found;
1313 #endif
1314
1315 if (macros == NULL)
1316 return TRUE;
1317 #ifndef WHITELIST_D_MACROS
1318 return FALSE;
1319 #else
1320
1321 /* We only trust -D overrides for some invoking users:
1322 root, the exim run-time user, the optional config owner user.
1323 I don't know why config-owner would be needed, but since they can own the
1324 config files anyway, there's no security risk to letting them override -D. */
1325 if ( ! ((real_uid == root_uid)
1326 || (real_uid == exim_uid)
1327 #ifdef CONFIGURE_OWNER
1328 || (real_uid == config_uid)
1329 #endif
1330 ))
1331 {
1332 debug_printf("macros_trusted rejecting macros for uid %d\n", (int) real_uid);
1333 return FALSE;
1334 }
1335
1336 /* Get a list of macros which are whitelisted */
1337 whitelisted = string_copy_malloc(US WHITELIST_D_MACROS);
1338 prev_char_item = FALSE;
1339 white_count = 0;
1340 for (p = whitelisted; *p != '\0'; ++p)
1341 {
1342 if (*p == ':' || isspace(*p))
1343 {
1344 *p = '\0';
1345 if (prev_char_item)
1346 ++white_count;
1347 prev_char_item = FALSE;
1348 continue;
1349 }
1350 if (!prev_char_item)
1351 prev_char_item = TRUE;
1352 }
1353 end = p;
1354 if (prev_char_item)
1355 ++white_count;
1356 if (!white_count)
1357 return FALSE;
1358 whites = store_malloc(sizeof(uschar *) * (white_count+1));
1359 for (p = whitelisted, i = 0; (p != end) && (i < white_count); ++p)
1360 {
1361 if (*p != '\0')
1362 {
1363 whites[i++] = p;
1364 if (i == white_count)
1365 break;
1366 while (*p != '\0' && p < end)
1367 ++p;
1368 }
1369 }
1370 whites[i] = NULL;
1371
1372 /* The list of macros should be very short. Accept the N*M complexity. */
1373 for (m = macros; m != NULL; m = m->next)
1374 {
1375 found = FALSE;
1376 for (w = whites; *w; ++w)
1377 if (Ustrcmp(*w, m->name) == 0)
1378 {
1379 found = TRUE;
1380 break;
1381 }
1382 if (!found)
1383 return FALSE;
1384 if (m->replacement == NULL)
1385 continue;
1386 len = Ustrlen(m->replacement);
1387 if (len == 0)
1388 continue;
1389 n = pcre_exec(regex_whitelisted_macro, NULL, CS m->replacement, len,
1390 0, PCRE_EOPT, NULL, 0);
1391 if (n < 0)
1392 {
1393 if (n != PCRE_ERROR_NOMATCH)
1394 debug_printf("macros_trusted checking %s returned %d\n", m->name, n);
1395 return FALSE;
1396 }
1397 }
1398 DEBUG(D_any) debug_printf("macros_trusted overridden to true by whitelisting\n");
1399 return TRUE;
1400 #endif
1401 }
1402
1403
1404 /*************************************************
1405 * Entry point and high-level code *
1406 *************************************************/
1407
1408 /* Entry point for the Exim mailer. Analyse the arguments and arrange to take
1409 the appropriate action. All the necessary functions are present in the one
1410 binary. I originally thought one should split it up, but it turns out that so
1411 much of the apparatus is needed in each chunk that one might as well just have
1412 it all available all the time, which then makes the coding easier as well.
1413
1414 Arguments:
1415 argc count of entries in argv
1416 argv argument strings, with argv[0] being the program name
1417
1418 Returns: EXIT_SUCCESS if terminated successfully
1419 EXIT_FAILURE otherwise, except when a message has been sent
1420 to the sender, and -oee was given
1421 */
1422
1423 int
1424 main(int argc, char **cargv)
1425 {
1426 uschar **argv = USS cargv;
1427 int arg_receive_timeout = -1;
1428 int arg_smtp_receive_timeout = -1;
1429 int arg_error_handling = error_handling;
1430 int filter_sfd = -1;
1431 int filter_ufd = -1;
1432 int group_count;
1433 int i, rv;
1434 int list_queue_option = 0;
1435 int msg_action = 0;
1436 int msg_action_arg = -1;
1437 int namelen = (argv[0] == NULL)? 0 : Ustrlen(argv[0]);
1438 int queue_only_reason = 0;
1439 #ifdef EXIM_PERL
1440 int perl_start_option = 0;
1441 #endif
1442 int recipients_arg = argc;
1443 int sender_address_domain = 0;
1444 int test_retry_arg = -1;
1445 int test_rewrite_arg = -1;
1446 BOOL arg_queue_only = FALSE;
1447 BOOL bi_option = FALSE;
1448 BOOL checking = FALSE;
1449 BOOL count_queue = FALSE;
1450 BOOL expansion_test = FALSE;
1451 BOOL extract_recipients = FALSE;
1452 BOOL flag_G = FALSE;
1453 BOOL flag_n = FALSE;
1454 BOOL forced_delivery = FALSE;
1455 BOOL f_end_dot = FALSE;
1456 BOOL deliver_give_up = FALSE;
1457 BOOL list_queue = FALSE;
1458 BOOL list_options = FALSE;
1459 BOOL local_queue_only;
1460 BOOL more = TRUE;
1461 BOOL one_msg_action = FALSE;
1462 BOOL queue_only_set = FALSE;
1463 BOOL receiving_message = TRUE;
1464 BOOL sender_ident_set = FALSE;
1465 BOOL session_local_queue_only;
1466 BOOL unprivileged;
1467 BOOL removed_privilege = FALSE;
1468 BOOL usage_wanted = FALSE;
1469 BOOL verify_address_mode = FALSE;
1470 BOOL verify_as_sender = FALSE;
1471 BOOL version_printed = FALSE;
1472 uschar *alias_arg = NULL;
1473 uschar *called_as = US"";
1474 uschar *cmdline_syslog_name = NULL;
1475 uschar *start_queue_run_id = NULL;
1476 uschar *stop_queue_run_id = NULL;
1477 uschar *expansion_test_message = NULL;
1478 uschar *ftest_domain = NULL;
1479 uschar *ftest_localpart = NULL;
1480 uschar *ftest_prefix = NULL;
1481 uschar *ftest_suffix = NULL;
1482 uschar *malware_test_file = NULL;
1483 uschar *real_sender_address;
1484 uschar *originator_home = US"/";
1485 size_t sz;
1486 void *reset_point;
1487
1488 struct passwd *pw;
1489 struct stat statbuf;
1490 pid_t passed_qr_pid = (pid_t)0;
1491 int passed_qr_pipe = -1;
1492 gid_t group_list[NGROUPS_MAX];
1493
1494 /* For the -bI: flag */
1495 enum commandline_info info_flag = CMDINFO_NONE;
1496 BOOL info_stdout = FALSE;
1497
1498 /* Possible options for -R and -S */
1499
1500 static uschar *rsopts[] = { US"f", US"ff", US"r", US"rf", US"rff" };
1501
1502 /* Need to define this in case we need to change the environment in order
1503 to get rid of a bogus time zone. We have to make it char rather than uschar
1504 because some OS define it in /usr/include/unistd.h. */
1505
1506 extern char **environ;
1507
1508 /* If the Exim user and/or group and/or the configuration file owner/group were
1509 defined by ref:name at build time, we must now find the actual uid/gid values.
1510 This is a feature to make the lives of binary distributors easier. */
1511
1512 #ifdef EXIM_USERNAME
1513 if (route_finduser(US EXIM_USERNAME, &pw, &exim_uid))
1514 {
1515 if (exim_uid == 0)
1516 {
1517 fprintf(stderr, "exim: refusing to run with uid 0 for \"%s\"\n",
1518 EXIM_USERNAME);
1519 exit(EXIT_FAILURE);
1520 }
1521 /* If ref:name uses a number as the name, route_finduser() returns
1522 TRUE with exim_uid set and pw coerced to NULL. */
1523 if (pw)
1524 exim_gid = pw->pw_gid;
1525 #ifndef EXIM_GROUPNAME
1526 else
1527 {
1528 fprintf(stderr,
1529 "exim: ref:name should specify a usercode, not a group.\n"
1530 "exim: can't let you get away with it unless you also specify a group.\n");
1531 exit(EXIT_FAILURE);
1532 }
1533 #endif
1534 }
1535 else
1536 {
1537 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1538 EXIM_USERNAME);
1539 exit(EXIT_FAILURE);
1540 }
1541 #endif
1542
1543 #ifdef EXIM_GROUPNAME
1544 if (!route_findgroup(US EXIM_GROUPNAME, &exim_gid))
1545 {
1546 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1547 EXIM_GROUPNAME);
1548 exit(EXIT_FAILURE);
1549 }
1550 #endif
1551
1552 #ifdef CONFIGURE_OWNERNAME
1553 if (!route_finduser(US CONFIGURE_OWNERNAME, NULL, &config_uid))
1554 {
1555 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1556 CONFIGURE_OWNERNAME);
1557 exit(EXIT_FAILURE);
1558 }
1559 #endif
1560
1561 /* We default the system_filter_user to be the Exim run-time user, as a
1562 sane non-root value. */
1563 system_filter_uid = exim_uid;
1564
1565 #ifdef CONFIGURE_GROUPNAME
1566 if (!route_findgroup(US CONFIGURE_GROUPNAME, &config_gid))
1567 {
1568 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1569 CONFIGURE_GROUPNAME);
1570 exit(EXIT_FAILURE);
1571 }
1572 #endif
1573
1574 /* In the Cygwin environment, some initialization needs doing. It is fudged
1575 in by means of this macro. */
1576
1577 #ifdef OS_INIT
1578 OS_INIT
1579 #endif
1580
1581 /* Check a field which is patched when we are running Exim within its
1582 testing harness; do a fast initial check, and then the whole thing. */
1583
1584 running_in_test_harness =
1585 *running_status == '<' && Ustrcmp(running_status, "<<<testing>>>") == 0;
1586
1587 /* The C standard says that the equivalent of setlocale(LC_ALL, "C") is obeyed
1588 at the start of a program; however, it seems that some environments do not
1589 follow this. A "strange" locale can affect the formatting of timestamps, so we
1590 make quite sure. */
1591
1592 setlocale(LC_ALL, "C");
1593
1594 /* Set up the default handler for timing using alarm(). */
1595
1596 os_non_restarting_signal(SIGALRM, sigalrm_handler);
1597
1598 /* Ensure we have a buffer for constructing log entries. Use malloc directly,
1599 because store_malloc writes a log entry on failure. */
1600
1601 log_buffer = (uschar *)malloc(LOG_BUFFER_SIZE);
1602 if (log_buffer == NULL)
1603 {
1604 fprintf(stderr, "exim: failed to get store for log buffer\n");
1605 exit(EXIT_FAILURE);
1606 }
1607
1608 /* Set log_stderr to stderr, provided that stderr exists. This gets reset to
1609 NULL when the daemon is run and the file is closed. We have to use this
1610 indirection, because some systems don't allow writing to the variable "stderr".
1611 */
1612
1613 if (fstat(fileno(stderr), &statbuf) >= 0) log_stderr = stderr;
1614
1615 /* Arrange for the PCRE regex library to use our store functions. Note that
1616 the normal calls are actually macros that add additional arguments for
1617 debugging purposes so we have to assign specially constructed functions here.
1618 The default is to use store in the stacking pool, but this is overridden in the
1619 regex_must_compile() function. */
1620
1621 pcre_malloc = function_store_get;
1622 pcre_free = function_dummy_free;
1623
1624 /* Ensure there is a big buffer for temporary use in several places. It is put
1625 in malloc store so that it can be freed for enlargement if necessary. */
1626
1627 big_buffer = store_malloc(big_buffer_size);
1628
1629 /* Set up the handler for the data request signal, and set the initial
1630 descriptive text. */
1631
1632 set_process_info("initializing");
1633 os_restarting_signal(SIGUSR1, usr1_handler);
1634
1635 /* SIGHUP is used to get the daemon to reconfigure. It gets set as appropriate
1636 in the daemon code. For the rest of Exim's uses, we ignore it. */
1637
1638 signal(SIGHUP, SIG_IGN);
1639
1640 /* We don't want to die on pipe errors as the code is written to handle
1641 the write error instead. */
1642
1643 signal(SIGPIPE, SIG_IGN);
1644
1645 /* Under some circumstance on some OS, Exim can get called with SIGCHLD
1646 set to SIG_IGN. This causes subprocesses that complete before the parent
1647 process waits for them not to hang around, so when Exim calls wait(), nothing
1648 is there. The wait() code has been made robust against this, but let's ensure
1649 that SIGCHLD is set to SIG_DFL, because it's tidier to wait and get a process
1650 ending status. We use sigaction rather than plain signal() on those OS where
1651 SA_NOCLDWAIT exists, because we want to be sure it is turned off. (There was a
1652 problem on AIX with this.) */
1653
1654 #ifdef SA_NOCLDWAIT
1655 {
1656 struct sigaction act;
1657 act.sa_handler = SIG_DFL;
1658 sigemptyset(&(act.sa_mask));
1659 act.sa_flags = 0;
1660 sigaction(SIGCHLD, &act, NULL);
1661 }
1662 #else
1663 signal(SIGCHLD, SIG_DFL);
1664 #endif
1665
1666 /* Save the arguments for use if we re-exec exim as a daemon after receiving
1667 SIGHUP. */
1668
1669 sighup_argv = argv;
1670
1671 /* Set up the version number. Set up the leading 'E' for the external form of
1672 message ids, set the pointer to the internal form, and initialize it to
1673 indicate no message being processed. */
1674
1675 version_init();
1676 message_id_option[0] = '-';
1677 message_id_external = message_id_option + 1;
1678 message_id_external[0] = 'E';
1679 message_id = message_id_external + 1;
1680 message_id[0] = 0;
1681
1682 /* Set the umask to zero so that any files Exim creates using open() are
1683 created with the modes that it specifies. NOTE: Files created with fopen() have
1684 a problem, which was not recognized till rather late (February 2006). With this
1685 umask, such files will be world writeable. (They are all content scanning files
1686 in the spool directory, which isn't world-accessible, so this is not a
1687 disaster, but it's untidy.) I don't want to change this overall setting,
1688 however, because it will interact badly with the open() calls. Instead, there's
1689 now a function called modefopen() that fiddles with the umask while calling
1690 fopen(). */
1691
1692 (void)umask(0);
1693
1694 /* Precompile the regular expression for matching a message id. Keep this in
1695 step with the code that generates ids in the accept.c module. We need to do
1696 this here, because the -M options check their arguments for syntactic validity
1697 using mac_ismsgid, which uses this. */
1698
1699 regex_ismsgid =
1700 regex_must_compile(US"^(?:[^\\W_]{6}-){2}[^\\W_]{2}$", FALSE, TRUE);
1701
1702 /* Precompile the regular expression that is used for matching an SMTP error
1703 code, possibly extended, at the start of an error message. Note that the
1704 terminating whitespace character is included. */
1705
1706 regex_smtp_code =
1707 regex_must_compile(US"^\\d\\d\\d\\s(?:\\d\\.\\d\\d?\\d?\\.\\d\\d?\\d?\\s)?",
1708 FALSE, TRUE);
1709
1710 #ifdef WHITELIST_D_MACROS
1711 /* Precompile the regular expression used to filter the content of macros
1712 given to -D for permissibility. */
1713
1714 regex_whitelisted_macro =
1715 regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE);
1716 #endif
1717
1718
1719 /* If the program is called as "mailq" treat it as equivalent to "exim -bp";
1720 this seems to be a generally accepted convention, since one finds symbolic
1721 links called "mailq" in standard OS configurations. */
1722
1723 if ((namelen == 5 && Ustrcmp(argv[0], "mailq") == 0) ||
1724 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/mailq", 6) == 0))
1725 {
1726 list_queue = TRUE;
1727 receiving_message = FALSE;
1728 called_as = US"-mailq";
1729 }
1730
1731 /* If the program is called as "rmail" treat it as equivalent to
1732 "exim -i -oee", thus allowing UUCP messages to be input using non-SMTP mode,
1733 i.e. preventing a single dot on a line from terminating the message, and
1734 returning with zero return code, even in cases of error (provided an error
1735 message has been sent). */
1736
1737 if ((namelen == 5 && Ustrcmp(argv[0], "rmail") == 0) ||
1738 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rmail", 6) == 0))
1739 {
1740 dot_ends = FALSE;
1741 called_as = US"-rmail";
1742 errors_sender_rc = EXIT_SUCCESS;
1743 }
1744
1745 /* If the program is called as "rsmtp" treat it as equivalent to "exim -bS";
1746 this is a smail convention. */
1747
1748 if ((namelen == 5 && Ustrcmp(argv[0], "rsmtp") == 0) ||
1749 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rsmtp", 6) == 0))
1750 {
1751 smtp_input = smtp_batched_input = TRUE;
1752 called_as = US"-rsmtp";
1753 }
1754
1755 /* If the program is called as "runq" treat it as equivalent to "exim -q";
1756 this is a smail convention. */
1757
1758 if ((namelen == 4 && Ustrcmp(argv[0], "runq") == 0) ||
1759 (namelen > 4 && Ustrncmp(argv[0] + namelen - 5, "/runq", 5) == 0))
1760 {
1761 queue_interval = 0;
1762 receiving_message = FALSE;
1763 called_as = US"-runq";
1764 }
1765
1766 /* If the program is called as "newaliases" treat it as equivalent to
1767 "exim -bi"; this is a sendmail convention. */
1768
1769 if ((namelen == 10 && Ustrcmp(argv[0], "newaliases") == 0) ||
1770 (namelen > 10 && Ustrncmp(argv[0] + namelen - 11, "/newaliases", 11) == 0))
1771 {
1772 bi_option = TRUE;
1773 receiving_message = FALSE;
1774 called_as = US"-newaliases";
1775 }
1776
1777 /* Save the original effective uid for a couple of uses later. It should
1778 normally be root, but in some esoteric environments it may not be. */
1779
1780 original_euid = geteuid();
1781
1782 /* Get the real uid and gid. If the caller is root, force the effective uid/gid
1783 to be the same as the real ones. This makes a difference only if Exim is setuid
1784 (or setgid) to something other than root, which could be the case in some
1785 special configurations. */
1786
1787 real_uid = getuid();
1788 real_gid = getgid();
1789
1790 if (real_uid == root_uid)
1791 {
1792 rv = setgid(real_gid);
1793 if (rv)
1794 {
1795 fprintf(stderr, "exim: setgid(%ld) failed: %s\n",
1796 (long int)real_gid, strerror(errno));
1797 exit(EXIT_FAILURE);
1798 }
1799 rv = setuid(real_uid);
1800 if (rv)
1801 {
1802 fprintf(stderr, "exim: setuid(%ld) failed: %s\n",
1803 (long int)real_uid, strerror(errno));
1804 exit(EXIT_FAILURE);
1805 }
1806 }
1807
1808 /* If neither the original real uid nor the original euid was root, Exim is
1809 running in an unprivileged state. */
1810
1811 unprivileged = (real_uid != root_uid && original_euid != root_uid);
1812
1813 /* Scan the program's arguments. Some can be dealt with right away; others are
1814 simply recorded for checking and handling afterwards. Do a high-level switch
1815 on the second character (the one after '-'), to save some effort. */
1816
1817 for (i = 1; i < argc; i++)
1818 {
1819 BOOL badarg = FALSE;
1820 uschar *arg = argv[i];
1821 uschar *argrest;
1822 int switchchar;
1823
1824 /* An argument not starting with '-' is the start of a recipients list;
1825 break out of the options-scanning loop. */
1826
1827 if (arg[0] != '-')
1828 {
1829 recipients_arg = i;
1830 break;
1831 }
1832
1833 /* An option consistion of -- terminates the options */
1834
1835 if (Ustrcmp(arg, "--") == 0)
1836 {
1837 recipients_arg = i + 1;
1838 break;
1839 }
1840
1841 /* Handle flagged options */
1842
1843 switchchar = arg[1];
1844 argrest = arg+2;
1845
1846 /* Make all -ex options synonymous with -oex arguments, since that
1847 is assumed by various callers. Also make -qR options synonymous with -R
1848 options, as that seems to be required as well. Allow for -qqR too, and
1849 the same for -S options. */
1850
1851 if (Ustrncmp(arg+1, "oe", 2) == 0 ||
1852 Ustrncmp(arg+1, "qR", 2) == 0 ||
1853 Ustrncmp(arg+1, "qS", 2) == 0)
1854 {
1855 switchchar = arg[2];
1856 argrest++;
1857 }
1858 else if (Ustrncmp(arg+1, "qqR", 3) == 0 || Ustrncmp(arg+1, "qqS", 3) == 0)
1859 {
1860 switchchar = arg[3];
1861 argrest += 2;
1862 queue_2stage = TRUE;
1863 }
1864
1865 /* Make -r synonymous with -f, since it is a documented alias */
1866
1867 else if (arg[1] == 'r') switchchar = 'f';
1868
1869 /* Make -ov synonymous with -v */
1870
1871 else if (Ustrcmp(arg, "-ov") == 0)
1872 {
1873 switchchar = 'v';
1874 argrest++;
1875 }
1876
1877 /* deal with --option_aliases */
1878 else if (switchchar == '-')
1879 {
1880 if (Ustrcmp(argrest, "help") == 0)
1881 {
1882 usage_wanted = TRUE;
1883 break;
1884 }
1885 else if (Ustrcmp(argrest, "version") == 0)
1886 {
1887 switchchar = 'b';
1888 argrest = US"V";
1889 }
1890 }
1891
1892 /* High-level switch on active initial letter */
1893
1894 switch(switchchar)
1895 {
1896
1897 /* sendmail uses -Ac and -Am to control which .cf file is used;
1898 we ignore them. */
1899 case 'A':
1900 if (*argrest == '\0') { badarg = TRUE; break; }
1901 else
1902 {
1903 BOOL ignore = FALSE;
1904 switch (*argrest)
1905 {
1906 case 'c':
1907 case 'm':
1908 if (*(argrest + 1) == '\0')
1909 ignore = TRUE;
1910 break;
1911 }
1912 if (!ignore) { badarg = TRUE; break; }
1913 }
1914 break;
1915
1916 /* -Btype is a sendmail option for 7bit/8bit setting. Exim is 8-bit clean
1917 so has no need of it. */
1918
1919 case 'B':
1920 if (*argrest == 0) i++; /* Skip over the type */
1921 break;
1922
1923
1924 case 'b':
1925 receiving_message = FALSE; /* Reset TRUE for -bm, -bS, -bs below */
1926
1927 /* -bd: Run in daemon mode, awaiting SMTP connections.
1928 -bdf: Ditto, but in the foreground.
1929 */
1930
1931 if (*argrest == 'd')
1932 {
1933 daemon_listen = TRUE;
1934 if (*(++argrest) == 'f') background_daemon = FALSE;
1935 else if (*argrest != 0) { badarg = TRUE; break; }
1936 }
1937
1938 /* -be: Run in expansion test mode
1939 -bem: Ditto, but read a message from a file first
1940 */
1941
1942 else if (*argrest == 'e')
1943 {
1944 expansion_test = checking = TRUE;
1945 if (argrest[1] == 'm')
1946 {
1947 if (++i >= argc) { badarg = TRUE; break; }
1948 expansion_test_message = argv[i];
1949 argrest++;
1950 }
1951 if (argrest[1] != 0) { badarg = TRUE; break; }
1952 }
1953
1954 /* -bF: Run system filter test */
1955
1956 else if (*argrest == 'F')
1957 {
1958 filter_test |= FTEST_SYSTEM;
1959 if (*(++argrest) != 0) { badarg = TRUE; break; }
1960 if (++i < argc) filter_test_sfile = argv[i]; else
1961 {
1962 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
1963 exit(EXIT_FAILURE);
1964 }
1965 }
1966
1967 /* -bf: Run user filter test
1968 -bfd: Set domain for filter testing
1969 -bfl: Set local part for filter testing
1970 -bfp: Set prefix for filter testing
1971 -bfs: Set suffix for filter testing
1972 */
1973
1974 else if (*argrest == 'f')
1975 {
1976 if (*(++argrest) == 0)
1977 {
1978 filter_test |= FTEST_USER;
1979 if (++i < argc) filter_test_ufile = argv[i]; else
1980 {
1981 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
1982 exit(EXIT_FAILURE);
1983 }
1984 }
1985 else
1986 {
1987 if (++i >= argc)
1988 {
1989 fprintf(stderr, "exim: string expected after %s\n", arg);
1990 exit(EXIT_FAILURE);
1991 }
1992 if (Ustrcmp(argrest, "d") == 0) ftest_domain = argv[i];
1993 else if (Ustrcmp(argrest, "l") == 0) ftest_localpart = argv[i];
1994 else if (Ustrcmp(argrest, "p") == 0) ftest_prefix = argv[i];
1995 else if (Ustrcmp(argrest, "s") == 0) ftest_suffix = argv[i];
1996 else { badarg = TRUE; break; }
1997 }
1998 }
1999
2000 /* -bh: Host checking - an IP address must follow. */
2001
2002 else if (Ustrcmp(argrest, "h") == 0 || Ustrcmp(argrest, "hc") == 0)
2003 {
2004 if (++i >= argc) { badarg = TRUE; break; }
2005 sender_host_address = argv[i];
2006 host_checking = checking = log_testing_mode = TRUE;
2007 host_checking_callout = argrest[1] == 'c';
2008 }
2009
2010 /* -bi: This option is used by sendmail to initialize *the* alias file,
2011 though it has the -oA option to specify a different file. Exim has no
2012 concept of *the* alias file, but since Sun's YP make script calls
2013 sendmail this way, some support must be provided. */
2014
2015 else if (Ustrcmp(argrest, "i") == 0) bi_option = TRUE;
2016
2017 /* -bI: provide information, of the type to follow after a colon.
2018 This is an Exim flag. */
2019
2020 else if (argrest[0] == 'I' && Ustrlen(argrest) >= 2 && argrest[1] == ':')
2021 {
2022 uschar *p = &argrest[2];
2023 info_flag = CMDINFO_HELP;
2024 if (Ustrlen(p))
2025 {
2026 if (strcmpic(p, CUS"sieve") == 0)
2027 {
2028 info_flag = CMDINFO_SIEVE;
2029 info_stdout = TRUE;
2030 }
2031 else if (strcmpic(p, CUS"dscp") == 0)
2032 {
2033 info_flag = CMDINFO_DSCP;
2034 info_stdout = TRUE;
2035 }
2036 else if (strcmpic(p, CUS"help") == 0)
2037 {
2038 info_stdout = TRUE;
2039 }
2040 }
2041 }
2042
2043 /* -bm: Accept and deliver message - the default option. Reinstate
2044 receiving_message, which got turned off for all -b options. */
2045
2046 else if (Ustrcmp(argrest, "m") == 0) receiving_message = TRUE;
2047
2048 /* -bmalware: test the filename given for malware */
2049
2050 else if (Ustrcmp(argrest, "malware") == 0)
2051 {
2052 if (++i >= argc) { badarg = TRUE; break; }
2053 malware_test_file = argv[i];
2054 }
2055
2056 /* -bnq: For locally originating messages, do not qualify unqualified
2057 addresses. In the envelope, this causes errors; in header lines they
2058 just get left. */
2059
2060 else if (Ustrcmp(argrest, "nq") == 0)
2061 {
2062 allow_unqualified_sender = FALSE;
2063 allow_unqualified_recipient = FALSE;
2064 }
2065
2066 /* -bpxx: List the contents of the mail queue, in various forms. If
2067 the option is -bpc, just a queue count is needed. Otherwise, if the
2068 first letter after p is r, then order is random. */
2069
2070 else if (*argrest == 'p')
2071 {
2072 if (*(++argrest) == 'c')
2073 {
2074 count_queue = TRUE;
2075 if (*(++argrest) != 0) badarg = TRUE;
2076 break;
2077 }
2078
2079 if (*argrest == 'r')
2080 {
2081 list_queue_option = 8;
2082 argrest++;
2083 }
2084 else list_queue_option = 0;
2085
2086 list_queue = TRUE;
2087
2088 /* -bp: List the contents of the mail queue, top-level only */
2089
2090 if (*argrest == 0) {}
2091
2092 /* -bpu: List the contents of the mail queue, top-level undelivered */
2093
2094 else if (Ustrcmp(argrest, "u") == 0) list_queue_option += 1;
2095
2096 /* -bpa: List the contents of the mail queue, including all delivered */
2097
2098 else if (Ustrcmp(argrest, "a") == 0) list_queue_option += 2;
2099
2100 /* Unknown after -bp[r] */
2101
2102 else
2103 {
2104 badarg = TRUE;
2105 break;
2106 }
2107 }
2108
2109
2110 /* -bP: List the configuration variables given as the address list.
2111 Force -v, so configuration errors get displayed. */
2112
2113 else if (Ustrcmp(argrest, "P") == 0)
2114 {
2115 list_options = TRUE;
2116 debug_selector |= D_v;
2117 debug_file = stderr;
2118 }
2119
2120 /* -brt: Test retry configuration lookup */
2121
2122 else if (Ustrcmp(argrest, "rt") == 0)
2123 {
2124 test_retry_arg = i + 1;
2125 goto END_ARG;
2126 }
2127
2128 /* -brw: Test rewrite configuration */
2129
2130 else if (Ustrcmp(argrest, "rw") == 0)
2131 {
2132 test_rewrite_arg = i + 1;
2133 goto END_ARG;
2134 }
2135
2136 /* -bS: Read SMTP commands on standard input, but produce no replies -
2137 all errors are reported by sending messages. */
2138
2139 else if (Ustrcmp(argrest, "S") == 0)
2140 smtp_input = smtp_batched_input = receiving_message = TRUE;
2141
2142 /* -bs: Read SMTP commands on standard input and produce SMTP replies
2143 on standard output. */
2144
2145 else if (Ustrcmp(argrest, "s") == 0) smtp_input = receiving_message = TRUE;
2146
2147 /* -bt: address testing mode */
2148
2149 else if (Ustrcmp(argrest, "t") == 0)
2150 address_test_mode = checking = log_testing_mode = TRUE;
2151
2152 /* -bv: verify addresses */
2153
2154 else if (Ustrcmp(argrest, "v") == 0)
2155 verify_address_mode = checking = log_testing_mode = TRUE;
2156
2157 /* -bvs: verify sender addresses */
2158
2159 else if (Ustrcmp(argrest, "vs") == 0)
2160 {
2161 verify_address_mode = checking = log_testing_mode = TRUE;
2162 verify_as_sender = TRUE;
2163 }
2164
2165 /* -bV: Print version string and support details */
2166
2167 else if (Ustrcmp(argrest, "V") == 0)
2168 {
2169 printf("Exim version %s #%s built %s\n", version_string,
2170 version_cnumber, version_date);
2171 printf("%s\n", CS version_copyright);
2172 version_printed = TRUE;
2173 show_whats_supported(stdout);
2174 }
2175
2176 /* -bw: inetd wait mode, accept a listening socket as stdin */
2177
2178 else if (*argrest == 'w')
2179 {
2180 inetd_wait_mode = TRUE;
2181 background_daemon = FALSE;
2182 daemon_listen = TRUE;
2183 if (*(++argrest) != '\0')
2184 {
2185 inetd_wait_timeout = readconf_readtime(argrest, 0, FALSE);
2186 if (inetd_wait_timeout <= 0)
2187 {
2188 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
2189 exit(EXIT_FAILURE);
2190 }
2191 }
2192 }
2193
2194 else badarg = TRUE;
2195 break;
2196
2197
2198 /* -C: change configuration file list; ignore if it isn't really
2199 a change! Enforce a prefix check if required. */
2200
2201 case 'C':
2202 if (*argrest == 0)
2203 {
2204 if(++i < argc) argrest = argv[i]; else
2205 { badarg = TRUE; break; }
2206 }
2207 if (Ustrcmp(config_main_filelist, argrest) != 0)
2208 {
2209 #ifdef ALT_CONFIG_PREFIX
2210 int sep = 0;
2211 int len = Ustrlen(ALT_CONFIG_PREFIX);
2212 uschar *list = argrest;
2213 uschar *filename;
2214 while((filename = string_nextinlist(&list, &sep, big_buffer,
2215 big_buffer_size)) != NULL)
2216 {
2217 if ((Ustrlen(filename) < len ||
2218 Ustrncmp(filename, ALT_CONFIG_PREFIX, len) != 0 ||
2219 Ustrstr(filename, "/../") != NULL) &&
2220 (Ustrcmp(filename, "/dev/null") != 0 || real_uid != root_uid))
2221 {
2222 fprintf(stderr, "-C Permission denied\n");
2223 exit(EXIT_FAILURE);
2224 }
2225 }
2226 #endif
2227 if (real_uid != root_uid)
2228 {
2229 #ifdef TRUSTED_CONFIG_LIST
2230
2231 if (real_uid != exim_uid
2232 #ifdef CONFIGURE_OWNER
2233 && real_uid != config_uid
2234 #endif
2235 )
2236 trusted_config = FALSE;
2237 else
2238 {
2239 FILE *trust_list = Ufopen(TRUSTED_CONFIG_LIST, "rb");
2240 if (trust_list)
2241 {
2242 struct stat statbuf;
2243
2244 if (fstat(fileno(trust_list), &statbuf) != 0 ||
2245 (statbuf.st_uid != root_uid /* owner not root */
2246 #ifdef CONFIGURE_OWNER
2247 && statbuf.st_uid != config_uid /* owner not the special one */
2248 #endif
2249 ) || /* or */
2250 (statbuf.st_gid != root_gid /* group not root */
2251 #ifdef CONFIGURE_GROUP
2252 && statbuf.st_gid != config_gid /* group not the special one */
2253 #endif
2254 && (statbuf.st_mode & 020) != 0 /* group writeable */
2255 ) || /* or */
2256 (statbuf.st_mode & 2) != 0) /* world writeable */
2257 {
2258 trusted_config = FALSE;
2259 fclose(trust_list);
2260 }
2261 else
2262 {
2263 /* Well, the trust list at least is up to scratch... */
2264 void *reset_point = store_get(0);
2265 uschar *trusted_configs[32];
2266 int nr_configs = 0;
2267 int i = 0;
2268
2269 while (Ufgets(big_buffer, big_buffer_size, trust_list))
2270 {
2271 uschar *start = big_buffer, *nl;
2272 while (*start && isspace(*start))
2273 start++;
2274 if (*start != '/')
2275 continue;
2276 nl = Ustrchr(start, '\n');
2277 if (nl)
2278 *nl = 0;
2279 trusted_configs[nr_configs++] = string_copy(start);
2280 if (nr_configs == 32)
2281 break;
2282 }
2283 fclose(trust_list);
2284
2285 if (nr_configs)
2286 {
2287 int sep = 0;
2288 uschar *list = argrest;
2289 uschar *filename;
2290 while (trusted_config && (filename = string_nextinlist(&list,
2291 &sep, big_buffer, big_buffer_size)) != NULL)
2292 {
2293 for (i=0; i < nr_configs; i++)
2294 {
2295 if (Ustrcmp(filename, trusted_configs[i]) == 0)
2296 break;
2297 }
2298 if (i == nr_configs)
2299 {
2300 trusted_config = FALSE;
2301 break;
2302 }
2303 }
2304 store_reset(reset_point);
2305 }
2306 else
2307 {
2308 /* No valid prefixes found in trust_list file. */
2309 trusted_config = FALSE;
2310 }
2311 }
2312 }
2313 else
2314 {
2315 /* Could not open trust_list file. */
2316 trusted_config = FALSE;
2317 }
2318 }
2319 #else
2320 /* Not root; don't trust config */
2321 trusted_config = FALSE;
2322 #endif
2323 }
2324
2325 config_main_filelist = argrest;
2326 config_changed = TRUE;
2327 }
2328 break;
2329
2330
2331 /* -D: set up a macro definition */
2332
2333 case 'D':
2334 #ifdef DISABLE_D_OPTION
2335 fprintf(stderr, "exim: -D is not available in this Exim binary\n");
2336 exit(EXIT_FAILURE);
2337 #else
2338 {
2339 int ptr = 0;
2340 macro_item *mlast = NULL;
2341 macro_item *m;
2342 uschar name[24];
2343 uschar *s = argrest;
2344
2345 while (isspace(*s)) s++;
2346
2347 if (*s < 'A' || *s > 'Z')
2348 {
2349 fprintf(stderr, "exim: macro name set by -D must start with "
2350 "an upper case letter\n");
2351 exit(EXIT_FAILURE);
2352 }
2353
2354 while (isalnum(*s) || *s == '_')
2355 {
2356 if (ptr < sizeof(name)-1) name[ptr++] = *s;
2357 s++;
2358 }
2359 name[ptr] = 0;
2360 if (ptr == 0) { badarg = TRUE; break; }
2361 while (isspace(*s)) s++;
2362 if (*s != 0)
2363 {
2364 if (*s++ != '=') { badarg = TRUE; break; }
2365 while (isspace(*s)) s++;
2366 }
2367
2368 for (m = macros; m != NULL; m = m->next)
2369 {
2370 if (Ustrcmp(m->name, name) == 0)
2371 {
2372 fprintf(stderr, "exim: duplicated -D in command line\n");
2373 exit(EXIT_FAILURE);
2374 }
2375 mlast = m;
2376 }
2377
2378 m = store_get(sizeof(macro_item) + Ustrlen(name));
2379 m->next = NULL;
2380 m->command_line = TRUE;
2381 if (mlast == NULL) macros = m; else mlast->next = m;
2382 Ustrcpy(m->name, name);
2383 m->replacement = string_copy(s);
2384
2385 if (clmacro_count >= MAX_CLMACROS)
2386 {
2387 fprintf(stderr, "exim: too many -D options on command line\n");
2388 exit(EXIT_FAILURE);
2389 }
2390 clmacros[clmacro_count++] = string_sprintf("-D%s=%s", m->name,
2391 m->replacement);
2392 }
2393 #endif
2394 break;
2395
2396 /* -d: Set debug level (see also -v below) or set the drop_cr option.
2397 The latter is now a no-op, retained for compatibility only. If -dd is used,
2398 debugging subprocesses of the daemon is disabled. */
2399
2400 case 'd':
2401 if (Ustrcmp(argrest, "ropcr") == 0)
2402 {
2403 /* drop_cr = TRUE; */
2404 }
2405
2406 /* Use an intermediate variable so that we don't set debugging while
2407 decoding the debugging bits. */
2408
2409 else
2410 {
2411 unsigned int selector = D_default;
2412 debug_selector = 0;
2413 debug_file = NULL;
2414 if (*argrest == 'd')
2415 {
2416 debug_daemon = TRUE;
2417 argrest++;
2418 }
2419 if (*argrest != 0)
2420 decode_bits(&selector, NULL, D_memory, 0, argrest, debug_options,
2421 debug_options_count, US"debug", 0);
2422 debug_selector = selector;
2423 }
2424 break;
2425
2426
2427 /* -E: This is a local error message. This option is not intended for
2428 external use at all, but is not restricted to trusted callers because it
2429 does no harm (just suppresses certain error messages) and if Exim is run
2430 not setuid root it won't always be trusted when it generates error
2431 messages using this option. If there is a message id following -E, point
2432 message_reference at it, for logging. */
2433
2434 case 'E':
2435 local_error_message = TRUE;
2436 if (mac_ismsgid(argrest)) message_reference = argrest;
2437 break;
2438
2439
2440 /* -ex: The vacation program calls sendmail with the undocumented "-eq"
2441 option, so it looks as if historically the -oex options are also callable
2442 without the leading -o. So we have to accept them. Before the switch,
2443 anything starting -oe has been converted to -e. Exim does not support all
2444 of the sendmail error options. */
2445
2446 case 'e':
2447 if (Ustrcmp(argrest, "e") == 0)
2448 {
2449 arg_error_handling = ERRORS_SENDER;
2450 errors_sender_rc = EXIT_SUCCESS;
2451 }
2452 else if (Ustrcmp(argrest, "m") == 0) arg_error_handling = ERRORS_SENDER;
2453 else if (Ustrcmp(argrest, "p") == 0) arg_error_handling = ERRORS_STDERR;
2454 else if (Ustrcmp(argrest, "q") == 0) arg_error_handling = ERRORS_STDERR;
2455 else if (Ustrcmp(argrest, "w") == 0) arg_error_handling = ERRORS_SENDER;
2456 else badarg = TRUE;
2457 break;
2458
2459
2460 /* -F: Set sender's full name, used instead of the gecos entry from
2461 the password file. Since users can usually alter their gecos entries,
2462 there's no security involved in using this instead. The data can follow
2463 the -F or be in the next argument. */
2464
2465 case 'F':
2466 if (*argrest == 0)
2467 {
2468 if(++i < argc) argrest = argv[i]; else
2469 { badarg = TRUE; break; }
2470 }
2471 originator_name = argrest;
2472 sender_name_forced = TRUE;
2473 break;
2474
2475
2476 /* -f: Set sender's address - this value is only actually used if Exim is
2477 run by a trusted user, or if untrusted_set_sender is set and matches the
2478 address, except that the null address can always be set by any user. The
2479 test for this happens later, when the value given here is ignored when not
2480 permitted. For an untrusted user, the actual sender is still put in Sender:
2481 if it doesn't match the From: header (unless no_local_from_check is set).
2482 The data can follow the -f or be in the next argument. The -r switch is an
2483 obsolete form of -f but since there appear to be programs out there that
2484 use anything that sendmail has ever supported, better accept it - the
2485 synonymizing is done before the switch above.
2486
2487 At this stage, we must allow domain literal addresses, because we don't
2488 know what the setting of allow_domain_literals is yet. Ditto for trailing
2489 dots and strip_trailing_dot. */
2490
2491 case 'f':
2492 {
2493 int start, end;
2494 uschar *errmess;
2495 if (*argrest == 0)
2496 {
2497 if (i+1 < argc) argrest = argv[++i]; else
2498 { badarg = TRUE; break; }
2499 }
2500 if (*argrest == 0)
2501 {
2502 sender_address = string_sprintf(""); /* Ensure writeable memory */
2503 }
2504 else
2505 {
2506 uschar *temp = argrest + Ustrlen(argrest) - 1;
2507 while (temp >= argrest && isspace(*temp)) temp--;
2508 if (temp >= argrest && *temp == '.') f_end_dot = TRUE;
2509 allow_domain_literals = TRUE;
2510 strip_trailing_dot = TRUE;
2511 sender_address = parse_extract_address(argrest, &errmess, &start, &end,
2512 &sender_address_domain, TRUE);
2513 allow_domain_literals = FALSE;
2514 strip_trailing_dot = FALSE;
2515 if (sender_address == NULL)
2516 {
2517 fprintf(stderr, "exim: bad -f address \"%s\": %s\n", argrest, errmess);
2518 return EXIT_FAILURE;
2519 }
2520 }
2521 sender_address_forced = TRUE;
2522 }
2523 break;
2524
2525 /* -G: sendmail invocation to specify that it's a gateway submission and
2526 sendmail may complain about problems instead of fixing them.
2527 We make it equivalent to an ACL "control = suppress_local_fixups" and do
2528 not at this time complain about problems. */
2529
2530 case 'G':
2531 flag_G = TRUE;
2532 break;
2533
2534 /* -h: Set the hop count for an incoming message. Exim does not currently
2535 support this; it always computes it by counting the Received: headers.
2536 To put it in will require a change to the spool header file format. */
2537
2538 case 'h':
2539 if (*argrest == 0)
2540 {
2541 if(++i < argc) argrest = argv[i]; else
2542 { badarg = TRUE; break; }
2543 }
2544 if (!isdigit(*argrest)) badarg = TRUE;
2545 break;
2546
2547
2548 /* -i: Set flag so dot doesn't end non-SMTP input (same as -oi, seems
2549 not to be documented for sendmail but mailx (at least) uses it) */
2550
2551 case 'i':
2552 if (*argrest == 0) dot_ends = FALSE; else badarg = TRUE;
2553 break;
2554
2555
2556 /* -L: set the identifier used for syslog; equivalent to setting
2557 syslog_processname in the config file, but needs to be an admin option. */
2558
2559 case 'L':
2560 if (*argrest == '\0')
2561 {
2562 if(++i < argc) argrest = argv[i]; else
2563 { badarg = TRUE; break; }
2564 }
2565 sz = Ustrlen(argrest);
2566 if (sz > 32)
2567 {
2568 fprintf(stderr, "exim: the -L syslog name is too long: \"%s\"\n", argrest);
2569 return EXIT_FAILURE;
2570 }
2571 if (sz < 1)
2572 {
2573 fprintf(stderr, "exim: the -L syslog name is too short\n");
2574 return EXIT_FAILURE;
2575 }
2576 cmdline_syslog_name = argrest;
2577 break;
2578
2579 case 'M':
2580 receiving_message = FALSE;
2581
2582 /* -MC: continue delivery of another message via an existing open
2583 file descriptor. This option is used for an internal call by the
2584 smtp transport when there is a pending message waiting to go to an
2585 address to which it has got a connection. Five subsequent arguments are
2586 required: transport name, host name, IP address, sequence number, and
2587 message_id. Transports may decline to create new processes if the sequence
2588 number gets too big. The channel is stdin. This (-MC) must be the last
2589 argument. There's a subsequent check that the real-uid is privileged.
2590
2591 If we are running in the test harness. delay for a bit, to let the process
2592 that set this one up complete. This makes for repeatability of the logging,
2593 etc. output. */
2594
2595 if (Ustrcmp(argrest, "C") == 0)
2596 {
2597 union sockaddr_46 interface_sock;
2598 EXIM_SOCKLEN_T size = sizeof(interface_sock);
2599
2600 if (argc != i + 6)
2601 {
2602 fprintf(stderr, "exim: too many or too few arguments after -MC\n");
2603 return EXIT_FAILURE;
2604 }
2605
2606 if (msg_action_arg >= 0)
2607 {
2608 fprintf(stderr, "exim: incompatible arguments\n");
2609 return EXIT_FAILURE;
2610 }
2611
2612 continue_transport = argv[++i];
2613 continue_hostname = argv[++i];
2614 continue_host_address = argv[++i];
2615 continue_sequence = Uatoi(argv[++i]);
2616 msg_action = MSG_DELIVER;
2617 msg_action_arg = ++i;
2618 forced_delivery = TRUE;
2619 queue_run_pid = passed_qr_pid;
2620 queue_run_pipe = passed_qr_pipe;
2621
2622 if (!mac_ismsgid(argv[i]))
2623 {
2624 fprintf(stderr, "exim: malformed message id %s after -MC option\n",
2625 argv[i]);
2626 return EXIT_FAILURE;
2627 }
2628
2629 /* Set up $sending_ip_address and $sending_port */
2630
2631 if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
2632 &size) == 0)
2633 sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
2634 &sending_port);
2635 else
2636 {
2637 fprintf(stderr, "exim: getsockname() failed after -MC option: %s\n",
2638 strerror(errno));
2639 return EXIT_FAILURE;
2640 }
2641
2642 if (running_in_test_harness) millisleep(500);
2643 break;
2644 }
2645
2646 /* -MCA: set the smtp_authenticated flag; this is useful only when it
2647 precedes -MC (see above). The flag indicates that the host to which
2648 Exim is connected has accepted an AUTH sequence. */
2649
2650 else if (Ustrcmp(argrest, "CA") == 0)
2651 {
2652 smtp_authenticated = TRUE;
2653 break;
2654 }
2655
2656 /* -MCP: set the smtp_use_pipelining flag; this is useful only when
2657 it preceded -MC (see above) */
2658
2659 else if (Ustrcmp(argrest, "CP") == 0)
2660 {
2661 smtp_use_pipelining = TRUE;
2662 break;
2663 }
2664
2665 /* -MCQ: pass on the pid of the queue-running process that started
2666 this chain of deliveries and the fd of its synchronizing pipe; this
2667 is useful only when it precedes -MC (see above) */
2668
2669 else if (Ustrcmp(argrest, "CQ") == 0)
2670 {
2671 if(++i < argc) passed_qr_pid = (pid_t)(Uatol(argv[i]));
2672 else badarg = TRUE;
2673 if(++i < argc) passed_qr_pipe = (int)(Uatol(argv[i]));
2674 else badarg = TRUE;
2675 break;
2676 }
2677
2678 /* -MCS: set the smtp_use_size flag; this is useful only when it
2679 precedes -MC (see above) */
2680
2681 else if (Ustrcmp(argrest, "CS") == 0)
2682 {
2683 smtp_use_size = TRUE;
2684 break;
2685 }
2686
2687 /* -MCT: set the tls_offered flag; this is useful only when it
2688 precedes -MC (see above). The flag indicates that the host to which
2689 Exim is connected has offered TLS support. */
2690
2691 #ifdef SUPPORT_TLS
2692 else if (Ustrcmp(argrest, "CT") == 0)
2693 {
2694 tls_offered = TRUE;
2695 break;
2696 }
2697 #endif
2698
2699 /* -M[x]: various operations on the following list of message ids:
2700 -M deliver the messages, ignoring next retry times and thawing
2701 -Mc deliver the messages, checking next retry times, no thawing
2702 -Mf freeze the messages
2703 -Mg give up on the messages
2704 -Mt thaw the messages
2705 -Mrm remove the messages
2706 In the above cases, this must be the last option. There are also the
2707 following options which are followed by a single message id, and which
2708 act on that message. Some of them use the "recipient" addresses as well.
2709 -Mar add recipient(s)
2710 -Mmad mark all recipients delivered
2711 -Mmd mark recipients(s) delivered
2712 -Mes edit sender
2713 -Mset load a message for use with -be
2714 -Mvb show body
2715 -Mvc show copy (of whole message, in RFC 2822 format)
2716 -Mvh show header
2717 -Mvl show log
2718 */
2719
2720 else if (*argrest == 0)
2721 {
2722 msg_action = MSG_DELIVER;
2723 forced_delivery = deliver_force_thaw = TRUE;
2724 }
2725 else if (Ustrcmp(argrest, "ar") == 0)
2726 {
2727 msg_action = MSG_ADD_RECIPIENT;
2728 one_msg_action = TRUE;
2729 }
2730 else if (Ustrcmp(argrest, "c") == 0) msg_action = MSG_DELIVER;
2731 else if (Ustrcmp(argrest, "es") == 0)
2732 {
2733 msg_action = MSG_EDIT_SENDER;
2734 one_msg_action = TRUE;
2735 }
2736 else if (Ustrcmp(argrest, "f") == 0) msg_action = MSG_FREEZE;
2737 else if (Ustrcmp(argrest, "g") == 0)
2738 {
2739 msg_action = MSG_DELIVER;
2740 deliver_give_up = TRUE;
2741 }
2742 else if (Ustrcmp(argrest, "mad") == 0)
2743 {
2744 msg_action = MSG_MARK_ALL_DELIVERED;
2745 }
2746 else if (Ustrcmp(argrest, "md") == 0)
2747 {
2748 msg_action = MSG_MARK_DELIVERED;
2749 one_msg_action = TRUE;
2750 }
2751 else if (Ustrcmp(argrest, "rm") == 0) msg_action = MSG_REMOVE;
2752 else if (Ustrcmp(argrest, "set") == 0)
2753 {
2754 msg_action = MSG_LOAD;
2755 one_msg_action = TRUE;
2756 }
2757 else if (Ustrcmp(argrest, "t") == 0) msg_action = MSG_THAW;
2758 else if (Ustrcmp(argrest, "vb") == 0)
2759 {
2760 msg_action = MSG_SHOW_BODY;
2761 one_msg_action = TRUE;
2762 }
2763 else if (Ustrcmp(argrest, "vc") == 0)
2764 {
2765 msg_action = MSG_SHOW_COPY;
2766 one_msg_action = TRUE;
2767 }
2768 else if (Ustrcmp(argrest, "vh") == 0)
2769 {
2770 msg_action = MSG_SHOW_HEADER;
2771 one_msg_action = TRUE;
2772 }
2773 else if (Ustrcmp(argrest, "vl") == 0)
2774 {
2775 msg_action = MSG_SHOW_LOG;
2776 one_msg_action = TRUE;
2777 }
2778 else { badarg = TRUE; break; }
2779
2780 /* All the -Mxx options require at least one message id. */
2781
2782 msg_action_arg = i + 1;
2783 if (msg_action_arg >= argc)
2784 {
2785 fprintf(stderr, "exim: no message ids given after %s option\n", arg);
2786 return EXIT_FAILURE;
2787 }
2788
2789 /* Some require only message ids to follow */
2790
2791 if (!one_msg_action)
2792 {
2793 int j;
2794 for (j = msg_action_arg; j < argc; j++) if (!mac_ismsgid(argv[j]))
2795 {
2796 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2797 argv[j], arg);
2798 return EXIT_FAILURE;
2799 }
2800 goto END_ARG; /* Remaining args are ids */
2801 }
2802
2803 /* Others require only one message id, possibly followed by addresses,
2804 which will be handled as normal arguments. */
2805
2806 else
2807 {
2808 if (!mac_ismsgid(argv[msg_action_arg]))
2809 {
2810 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2811 argv[msg_action_arg], arg);
2812 return EXIT_FAILURE;
2813 }
2814 i++;
2815 }
2816 break;
2817
2818
2819 /* Some programs seem to call the -om option without the leading o;
2820 for sendmail it askes for "me too". Exim always does this. */
2821
2822 case 'm':
2823 if (*argrest != 0) badarg = TRUE;
2824 break;
2825
2826
2827 /* -N: don't do delivery - a debugging option that stops transports doing
2828 their thing. It implies debugging at the D_v level. */
2829
2830 case 'N':
2831 if (*argrest == 0)
2832 {
2833 dont_deliver = TRUE;
2834 debug_selector |= D_v;
2835 debug_file = stderr;
2836 }
2837 else badarg = TRUE;
2838 break;
2839
2840
2841 /* -n: This means "don't alias" in sendmail, apparently.
2842 For normal invocations, it has no effect.
2843 It may affect some other options. */
2844
2845 case 'n':
2846 flag_n = TRUE;
2847 break;
2848
2849 /* -O: Just ignore it. In sendmail, apparently -O option=value means set
2850 option to the specified value. This form uses long names. We need to handle
2851 -O option=value and -Ooption=value. */
2852
2853 case 'O':
2854 if (*argrest == 0)
2855 {
2856 if (++i >= argc)
2857 {
2858 fprintf(stderr, "exim: string expected after -O\n");
2859 exit(EXIT_FAILURE);
2860 }
2861 }
2862 break;
2863
2864 case 'o':
2865
2866 /* -oA: Set an argument for the bi command (sendmail's "alternate alias
2867 file" option). */
2868
2869 if (*argrest == 'A')
2870 {
2871 alias_arg = argrest + 1;
2872 if (alias_arg[0] == 0)
2873 {
2874 if (i+1 < argc) alias_arg = argv[++i]; else
2875 {
2876 fprintf(stderr, "exim: string expected after -oA\n");
2877 exit(EXIT_FAILURE);
2878 }
2879 }
2880 }
2881
2882 /* -oB: Set a connection message max value for remote deliveries */
2883
2884 else if (*argrest == 'B')
2885 {
2886 uschar *p = argrest + 1;
2887 if (p[0] == 0)
2888 {
2889 if (i+1 < argc && isdigit((argv[i+1][0]))) p = argv[++i]; else
2890 {
2891 connection_max_messages = 1;
2892 p = NULL;
2893 }
2894 }
2895
2896 if (p != NULL)
2897 {
2898 if (!isdigit(*p))
2899 {
2900 fprintf(stderr, "exim: number expected after -oB\n");
2901 exit(EXIT_FAILURE);
2902 }
2903 connection_max_messages = Uatoi(p);
2904 }
2905 }
2906
2907 /* -odb: background delivery */
2908
2909 else if (Ustrcmp(argrest, "db") == 0)
2910 {
2911 synchronous_delivery = FALSE;
2912 arg_queue_only = FALSE;
2913 queue_only_set = TRUE;
2914 }
2915
2916 /* -odf: foreground delivery (smail-compatible option); same effect as
2917 -odi: interactive (synchronous) delivery (sendmail-compatible option)
2918 */
2919
2920 else if (Ustrcmp(argrest, "df") == 0 || Ustrcmp(argrest, "di") == 0)
2921 {
2922 synchronous_delivery = TRUE;
2923 arg_queue_only = FALSE;
2924 queue_only_set = TRUE;
2925 }
2926
2927 /* -odq: queue only */
2928
2929 else if (Ustrcmp(argrest, "dq") == 0)
2930 {
2931 synchronous_delivery = FALSE;
2932 arg_queue_only = TRUE;
2933 queue_only_set = TRUE;
2934 }
2935
2936 /* -odqs: queue SMTP only - do local deliveries and remote routing,
2937 but no remote delivery */
2938
2939 else if (Ustrcmp(argrest, "dqs") == 0)
2940 {
2941 queue_smtp = TRUE;
2942 arg_queue_only = FALSE;
2943 queue_only_set = TRUE;
2944 }
2945
2946 /* -oex: Sendmail error flags. As these are also accepted without the
2947 leading -o prefix, for compatibility with vacation and other callers,
2948 they are handled with -e above. */
2949
2950 /* -oi: Set flag so dot doesn't end non-SMTP input (same as -i)
2951 -oitrue: Another sendmail syntax for the same */
2952
2953 else if (Ustrcmp(argrest, "i") == 0 ||
2954 Ustrcmp(argrest, "itrue") == 0)
2955 dot_ends = FALSE;
2956
2957 /* -oM*: Set various characteristics for an incoming message; actually
2958 acted on for trusted callers only. */
2959
2960 else if (*argrest == 'M')
2961 {
2962 if (i+1 >= argc)
2963 {
2964 fprintf(stderr, "exim: data expected after -o%s\n", argrest);
2965 exit(EXIT_FAILURE);
2966 }
2967
2968 /* -oMa: Set sender host address */
2969
2970 if (Ustrcmp(argrest, "Ma") == 0) sender_host_address = argv[++i];
2971
2972 /* -oMaa: Set authenticator name */
2973
2974 else if (Ustrcmp(argrest, "Maa") == 0)
2975 sender_host_authenticated = argv[++i];
2976
2977 /* -oMas: setting authenticated sender */
2978
2979 else if (Ustrcmp(argrest, "Mas") == 0) authenticated_sender = argv[++i];
2980
2981 /* -oMai: setting authenticated id */
2982
2983 else if (Ustrcmp(argrest, "Mai") == 0) authenticated_id = argv[++i];
2984
2985 /* -oMi: Set incoming interface address */
2986
2987 else if (Ustrcmp(argrest, "Mi") == 0) interface_address = argv[++i];
2988
2989 /* -oMr: Received protocol */
2990
2991 else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i];
2992
2993 /* -oMs: Set sender host name */
2994
2995 else if (Ustrcmp(argrest, "Ms") == 0) sender_host_name = argv[++i];
2996
2997 /* -oMt: Set sender ident */
2998
2999 else if (Ustrcmp(argrest, "Mt") == 0)
3000 {
3001 sender_ident_set = TRUE;
3002 sender_ident = argv[++i];
3003 }
3004
3005 /* Else a bad argument */
3006
3007 else
3008 {
3009 badarg = TRUE;
3010 break;
3011 }
3012 }
3013
3014 /* -om: Me-too flag for aliases. Exim always does this. Some programs
3015 seem to call this as -m (undocumented), so that is also accepted (see
3016 above). */
3017
3018 else if (Ustrcmp(argrest, "m") == 0) {}
3019
3020 /* -oo: An ancient flag for old-style addresses which still seems to
3021 crop up in some calls (see in SCO). */
3022
3023 else if (Ustrcmp(argrest, "o") == 0) {}
3024
3025 /* -oP <name>: set pid file path for daemon */
3026
3027 else if (Ustrcmp(argrest, "P") == 0)
3028 override_pid_file_path = argv[++i];
3029
3030 /* -or <n>: set timeout for non-SMTP acceptance
3031 -os <n>: set timeout for SMTP acceptance */
3032
3033 else if (*argrest == 'r' || *argrest == 's')
3034 {
3035 int *tp = (*argrest == 'r')?
3036 &arg_receive_timeout : &arg_smtp_receive_timeout;
3037 if (argrest[1] == 0)
3038 {
3039 if (i+1 < argc) *tp= readconf_readtime(argv[++i], 0, FALSE);
3040 }
3041 else *tp = readconf_readtime(argrest + 1, 0, FALSE);
3042 if (*tp < 0)
3043 {
3044 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3045 exit(EXIT_FAILURE);
3046 }
3047 }
3048
3049 /* -oX <list>: Override local_interfaces and/or default daemon ports */
3050
3051 else if (Ustrcmp(argrest, "X") == 0)
3052 override_local_interfaces = argv[++i];
3053
3054 /* Unknown -o argument */
3055
3056 else badarg = TRUE;
3057 break;
3058
3059
3060 /* -ps: force Perl startup; -pd force delayed Perl startup */
3061
3062 case 'p':
3063 #ifdef EXIM_PERL
3064 if (*argrest == 's' && argrest[1] == 0)
3065 {
3066 perl_start_option = 1;
3067 break;
3068 }
3069 if (*argrest == 'd' && argrest[1] == 0)
3070 {
3071 perl_start_option = -1;
3072 break;
3073 }
3074 #endif
3075
3076 /* -panythingelse is taken as the Sendmail-compatible argument -prval:sval,
3077 which sets the host protocol and host name */
3078
3079 if (*argrest == 0)
3080 {
3081 if (i+1 < argc) argrest = argv[++i]; else
3082 { badarg = TRUE; break; }
3083 }
3084
3085 if (*argrest != 0)
3086 {
3087 uschar *hn = Ustrchr(argrest, ':');
3088 if (hn == NULL)
3089 {
3090 received_protocol = argrest;
3091 }
3092 else
3093 {
3094 received_protocol = string_copyn(argrest, hn - argrest);
3095 sender_host_name = hn + 1;
3096 }
3097 }
3098 break;
3099
3100
3101 case 'q':
3102 receiving_message = FALSE;
3103 if (queue_interval >= 0)
3104 {
3105 fprintf(stderr, "exim: -q specified more than once\n");
3106 exit(EXIT_FAILURE);
3107 }
3108
3109 /* -qq...: Do queue runs in a 2-stage manner */
3110
3111 if (*argrest == 'q')
3112 {
3113 queue_2stage = TRUE;
3114 argrest++;
3115 }
3116
3117 /* -qi...: Do only first (initial) deliveries */
3118
3119 if (*argrest == 'i')
3120 {
3121 queue_run_first_delivery = TRUE;
3122 argrest++;
3123 }
3124
3125 /* -qf...: Run the queue, forcing deliveries
3126 -qff..: Ditto, forcing thawing as well */
3127
3128 if (*argrest == 'f')
3129 {
3130 queue_run_force = TRUE;
3131 if (*(++argrest) == 'f')
3132 {
3133 deliver_force_thaw = TRUE;
3134 argrest++;
3135 }
3136 }
3137
3138 /* -q[f][f]l...: Run the queue only on local deliveries */
3139
3140 if (*argrest == 'l')
3141 {
3142 queue_run_local = TRUE;
3143 argrest++;
3144 }
3145
3146 /* -q[f][f][l]: Run the queue, optionally forced, optionally local only,
3147 optionally starting from a given message id. */
3148
3149 if (*argrest == 0 &&
3150 (i + 1 >= argc || argv[i+1][0] == '-' || mac_ismsgid(argv[i+1])))
3151 {
3152 queue_interval = 0;
3153 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3154 start_queue_run_id = argv[++i];
3155 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3156 stop_queue_run_id = argv[++i];
3157 }
3158
3159 /* -q[f][f][l]<n>: Run the queue at regular intervals, optionally forced,
3160 optionally local only. */
3161
3162 else
3163 {
3164 if (*argrest != 0)
3165 queue_interval = readconf_readtime(argrest, 0, FALSE);
3166 else
3167 queue_interval = readconf_readtime(argv[++i], 0, FALSE);
3168 if (queue_interval <= 0)
3169 {
3170 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3171 exit(EXIT_FAILURE);
3172 }
3173 }
3174 break;
3175
3176
3177 case 'R': /* Synonymous with -qR... */
3178 receiving_message = FALSE;
3179
3180 /* -Rf: As -R (below) but force all deliveries,
3181 -Rff: Ditto, but also thaw all frozen messages,
3182 -Rr: String is regex
3183 -Rrf: Regex and force
3184 -Rrff: Regex and force and thaw
3185
3186 in all cases provided there are no further characters in this
3187 argument. */
3188
3189 if (*argrest != 0)
3190 {
3191 int i;
3192 for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
3193 {
3194 if (Ustrcmp(argrest, rsopts[i]) == 0)
3195 {
3196 if (i != 2) queue_run_force = TRUE;
3197 if (i >= 2) deliver_selectstring_regex = TRUE;
3198 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3199 argrest += Ustrlen(rsopts[i]);
3200 }
3201 }
3202 }
3203
3204 /* -R: Set string to match in addresses for forced queue run to
3205 pick out particular messages. */
3206
3207 if (*argrest == 0)
3208 {
3209 if (i+1 < argc) deliver_selectstring = argv[++i]; else
3210 {
3211 fprintf(stderr, "exim: string expected after -R\n");
3212 exit(EXIT_FAILURE);
3213 }
3214 }
3215 else deliver_selectstring = argrest;
3216 break;
3217
3218
3219 /* -r: an obsolete synonym for -f (see above) */
3220
3221
3222 /* -S: Like -R but works on sender. */
3223
3224 case 'S': /* Synonymous with -qS... */
3225 receiving_message = FALSE;
3226
3227 /* -Sf: As -S (below) but force all deliveries,
3228 -Sff: Ditto, but also thaw all frozen messages,
3229 -Sr: String is regex
3230 -Srf: Regex and force
3231 -Srff: Regex and force and thaw
3232
3233 in all cases provided there are no further characters in this
3234 argument. */
3235
3236 if (*argrest != 0)
3237 {
3238 int i;
3239 for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
3240 {
3241 if (Ustrcmp(argrest, rsopts[i]) == 0)
3242 {
3243 if (i != 2) queue_run_force = TRUE;
3244 if (i >= 2) deliver_selectstring_sender_regex = TRUE;
3245 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3246 argrest += Ustrlen(rsopts[i]);
3247 }
3248 }
3249 }
3250
3251 /* -S: Set string to match in addresses for forced queue run to
3252 pick out particular messages. */
3253
3254 if (*argrest == 0)
3255 {
3256 if (i+1 < argc) deliver_selectstring_sender = argv[++i]; else
3257 {
3258 fprintf(stderr, "exim: string expected after -S\n");
3259 exit(EXIT_FAILURE);
3260 }
3261 }
3262 else deliver_selectstring_sender = argrest;
3263 break;
3264
3265 /* -Tqt is an option that is exclusively for use by the testing suite.
3266 It is not recognized in other circumstances. It allows for the setting up
3267 of explicit "queue times" so that various warning/retry things can be
3268 tested. Otherwise variability of clock ticks etc. cause problems. */
3269
3270 case 'T':
3271 if (running_in_test_harness && Ustrcmp(argrest, "qt") == 0)
3272 fudged_queue_times = argv[++i];
3273 else badarg = TRUE;
3274 break;
3275
3276
3277 /* -t: Set flag to extract recipients from body of message. */
3278
3279 case 't':
3280 if (*argrest == 0) extract_recipients = TRUE;
3281
3282 /* -ti: Set flag to extract recipients from body of message, and also
3283 specify that dot does not end the message. */
3284
3285 else if (Ustrcmp(argrest, "i") == 0)
3286 {
3287 extract_recipients = TRUE;
3288 dot_ends = FALSE;
3289 }
3290
3291 /* -tls-on-connect: don't wait for STARTTLS (for old clients) */
3292
3293 #ifdef SUPPORT_TLS
3294 else if (Ustrcmp(argrest, "ls-on-connect") == 0) tls_in.on_connect = TRUE;
3295 #endif
3296
3297 else badarg = TRUE;
3298 break;
3299
3300
3301 /* -U: This means "initial user submission" in sendmail, apparently. The
3302 doc claims that in future sendmail may refuse syntactically invalid
3303 messages instead of fixing them. For the moment, we just ignore it. */
3304
3305 case 'U':
3306 break;
3307
3308
3309 /* -v: verify things - this is a very low-level debugging */
3310
3311 case 'v':
3312 if (*argrest == 0)
3313 {
3314 debug_selector |= D_v;
3315 debug_file = stderr;
3316 }
3317 else badarg = TRUE;
3318 break;
3319
3320
3321 /* -x: AIX uses this to indicate some fancy 8-bit character stuff:
3322
3323 The -x flag tells the sendmail command that mail from a local
3324 mail program has National Language Support (NLS) extended characters
3325 in the body of the mail item. The sendmail command can send mail with
3326 extended NLS characters across networks that normally corrupts these
3327 8-bit characters.
3328
3329 As Exim is 8-bit clean, it just ignores this flag. */
3330
3331 case 'x':
3332 if (*argrest != 0) badarg = TRUE;
3333 break;
3334
3335 /* -X: in sendmail: takes one parameter, logfile, and sends debugging
3336 logs to that file. We swallow the parameter and otherwise ignore it. */
3337
3338 case 'X':
3339 if (*argrest == '\0')
3340 {
3341 if (++i >= argc)
3342 {
3343 fprintf(stderr, "exim: string expected after -X\n");
3344 exit(EXIT_FAILURE);
3345 }
3346 }
3347 break;
3348
3349 /* All other initial characters are errors */
3350
3351 default:
3352 badarg = TRUE;
3353 break;
3354 } /* End of high-level switch statement */
3355
3356 /* Failed to recognize the option, or syntax error */
3357
3358 if (badarg)
3359 {
3360 fprintf(stderr, "exim abandoned: unknown, malformed, or incomplete "
3361 "option %s\n", arg);
3362 exit(EXIT_FAILURE);
3363 }
3364 }
3365
3366
3367 /* If -R or -S have been specified without -q, assume a single queue run. */
3368
3369 if ((deliver_selectstring != NULL || deliver_selectstring_sender != NULL) &&
3370 queue_interval < 0) queue_interval = 0;
3371
3372
3373 END_ARG:
3374 /* If usage_wanted is set we call the usage function - which never returns */
3375 if (usage_wanted) exim_usage(called_as);
3376
3377 /* Arguments have been processed. Check for incompatibilities. */
3378 if ((
3379 (smtp_input || extract_recipients || recipients_arg < argc) &&
3380 (daemon_listen || queue_interval >= 0 || bi_option ||
3381 test_retry_arg >= 0 || test_rewrite_arg >= 0 ||
3382 filter_test != FTEST_NONE || (msg_action_arg > 0 && !one_msg_action))
3383 ) ||
3384 (
3385 msg_action_arg > 0 &&
3386 (daemon_listen || queue_interval >= 0 || list_options ||
3387 (checking && msg_action != MSG_LOAD) ||
3388 bi_option || test_retry_arg >= 0 || test_rewrite_arg >= 0)
3389 ) ||
3390 (
3391 (daemon_listen || queue_interval >= 0) &&
3392 (sender_address != NULL || list_options || list_queue || checking ||
3393 bi_option)
3394 ) ||
3395 (
3396 daemon_listen && queue_interval == 0
3397 ) ||
3398 (
3399 inetd_wait_mode && queue_interval >= 0
3400 ) ||
3401 (
3402 list_options &&
3403 (checking || smtp_input || extract_recipients ||
3404 filter_test != FTEST_NONE || bi_option)
3405 ) ||
3406 (
3407 verify_address_mode &&
3408 (address_test_mode || smtp_input || extract_recipients ||
3409 filter_test != FTEST_NONE || bi_option)
3410 ) ||
3411 (
3412 address_test_mode && (smtp_input || extract_recipients ||
3413 filter_test != FTEST_NONE || bi_option)
3414 ) ||
3415 (
3416 smtp_input && (sender_address != NULL || filter_test != FTEST_NONE ||
3417 extract_recipients)
3418 ) ||
3419 (
3420 deliver_selectstring != NULL && queue_interval < 0
3421 ) ||
3422 (
3423 msg_action == MSG_LOAD &&
3424 (!expansion_test || expansion_test_message != NULL)
3425 )
3426 )
3427 {
3428 fprintf(stderr, "exim: incompatible command-line options or arguments\n");
3429 exit(EXIT_FAILURE);
3430 }
3431
3432 /* If debugging is set up, set the file and the file descriptor to pass on to
3433 child processes. It should, of course, be 2 for stderr. Also, force the daemon
3434 to run in the foreground. */
3435
3436 if (debug_selector != 0)
3437 {
3438 debug_file = stderr;
3439 debug_fd = fileno(debug_file);
3440 background_daemon = FALSE;
3441 if (running_in_test_harness) millisleep(100); /* lets caller finish */
3442 if (debug_selector != D_v) /* -v only doesn't show this */
3443 {
3444 debug_printf("Exim version %s uid=%ld gid=%ld pid=%d D=%x\n",
3445 version_string, (long int)real_uid, (long int)real_gid, (int)getpid(),
3446 debug_selector);
3447 if (!version_printed)
3448 show_whats_supported(stderr);
3449 }
3450 }
3451
3452 /* When started with root privilege, ensure that the limits on the number of
3453 open files and the number of processes (where that is accessible) are
3454 sufficiently large, or are unset, in case Exim has been called from an
3455 environment where the limits are screwed down. Not all OS have the ability to
3456 change some of these limits. */
3457
3458 if (unprivileged)
3459 {
3460 DEBUG(D_any) debug_print_ids(US"Exim has no root privilege:");
3461 }
3462 else
3463 {
3464 struct rlimit rlp;
3465
3466 #ifdef RLIMIT_NOFILE
3467 if (getrlimit(RLIMIT_NOFILE, &rlp) < 0)
3468 {
3469 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NOFILE) failed: %s",
3470 strerror(errno));
3471 rlp.rlim_cur = rlp.rlim_max = 0;
3472 }
3473
3474 /* I originally chose 1000 as a nice big number that was unlikely to
3475 be exceeded. It turns out that some older OS have a fixed upper limit of
3476 256. */
3477
3478 if (rlp.rlim_cur < 1000)
3479 {
3480 rlp.rlim_cur = rlp.rlim_max = 1000;
3481 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3482 {
3483 rlp.rlim_cur = rlp.rlim_max = 256;
3484 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3485 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NOFILE) failed: %s",
3486 strerror(errno));
3487 }
3488 }
3489 #endif
3490
3491 #ifdef RLIMIT_NPROC
3492 if (getrlimit(RLIMIT_NPROC, &rlp) < 0)
3493 {
3494 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NPROC) failed: %s",
3495 strerror(errno));
3496 rlp.rlim_cur = rlp.rlim_max = 0;
3497 }
3498
3499 #ifdef RLIM_INFINITY
3500 if (rlp.rlim_cur != RLIM_INFINITY && rlp.rlim_cur < 1000)
3501 {
3502 rlp.rlim_cur = rlp.rlim_max = RLIM_INFINITY;
3503 #else
3504 if (rlp.rlim_cur < 1000)
3505 {
3506 rlp.rlim_cur = rlp.rlim_max = 1000;
3507 #endif
3508 if (setrlimit(RLIMIT_NPROC, &rlp) < 0)
3509 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NPROC) failed: %s",
3510 strerror(errno));
3511 }
3512 #endif
3513 }
3514
3515 /* Exim is normally entered as root (but some special configurations are
3516 possible that don't do this). However, it always spins off sub-processes that
3517 set their uid and gid as required for local delivery. We don't want to pass on
3518 any extra groups that root may belong to, so we want to get rid of them all at
3519 this point.
3520
3521 We need to obey setgroups() at this stage, before possibly giving up root
3522 privilege for a changed configuration file, but later on we might need to
3523 check on the additional groups for the admin user privilege - can't do that
3524 till after reading the config, which might specify the exim gid. Therefore,
3525 save the group list here first. */
3526
3527 group_count = getgroups(NGROUPS_MAX, group_list);
3528 if (group_count < 0)
3529 {
3530 fprintf(stderr, "exim: getgroups() failed: %s\n", strerror(errno));
3531 exit(EXIT_FAILURE);
3532 }
3533
3534 /* There is a fundamental difference in some BSD systems in the matter of
3535 groups. FreeBSD and BSDI are known to be different; NetBSD and OpenBSD are
3536 known not to be different. On the "different" systems there is a single group
3537 list, and the first entry in it is the current group. On all other versions of
3538 Unix there is a supplementary group list, which is in *addition* to the current
3539 group. Consequently, to get rid of all extraneous groups on a "standard" system
3540 you pass over 0 groups to setgroups(), while on a "different" system you pass
3541 over a single group - the current group, which is always the first group in the
3542 list. Calling setgroups() with zero groups on a "different" system results in
3543 an error return. The following code should cope with both types of system.
3544
3545 However, if this process isn't running as root, setgroups() can't be used
3546 since you have to be root to run it, even if throwing away groups. Not being
3547 root here happens only in some unusual configurations. We just ignore the
3548 error. */
3549
3550 if (setgroups(0, NULL) != 0)
3551 {
3552 if (setgroups(1, group_list) != 0 && !unprivileged)
3553 {
3554 fprintf(stderr, "exim: setgroups() failed: %s\n", strerror(errno));
3555 exit(EXIT_FAILURE);
3556 }
3557 }
3558
3559 /* If the configuration file name has been altered by an argument on the
3560 command line (either a new file name or a macro definition) and the caller is
3561 not root, or if this is a filter testing run, remove any setuid privilege the
3562 program has and run as the underlying user.
3563
3564 The exim user is locked out of this, which severely restricts the use of -C
3565 for some purposes.
3566
3567 Otherwise, set the real ids to the effective values (should be root unless run
3568 from inetd, which it can either be root or the exim uid, if one is configured).
3569
3570 There is a private mechanism for bypassing some of this, in order to make it
3571 possible to test lots of configurations automatically, without having either to
3572 recompile each time, or to patch in an actual configuration file name and other
3573 values (such as the path name). If running in the test harness, pretend that
3574 configuration file changes and macro definitions haven't happened. */
3575
3576 if (( /* EITHER */
3577 (!trusted_config || /* Config changed, or */
3578 !macros_trusted()) && /* impermissible macros and */
3579 real_uid != root_uid && /* Not root, and */
3580 !running_in_test_harness /* Not fudged */
3581 ) || /* OR */
3582 expansion_test /* expansion testing */
3583 || /* OR */
3584 filter_test != FTEST_NONE) /* Filter testing */
3585 {
3586 setgroups(group_count, group_list);
3587 exim_setugid(real_uid, real_gid, FALSE,
3588 US"-C, -D, -be or -bf forces real uid");
3589 removed_privilege = TRUE;
3590
3591 /* In the normal case when Exim is called like this, stderr is available
3592 and should be used for any logging information because attempts to write
3593 to the log will usually fail. To arrange this, we unset really_exim. However,
3594 if no stderr is available there is no point - we might as well have a go
3595 at the log (if it fails, syslog will be written).
3596
3597 Note that if the invoker is Exim, the logs remain available. Messing with
3598 this causes unlogged successful deliveries. */
3599
3600 if ((log_stderr != NULL) && (real_uid != exim_uid))
3601 really_exim = FALSE;
3602 }
3603
3604 /* Privilege is to be retained for the moment. It may be dropped later,
3605 depending on the job that this Exim process has been asked to do. For now, set
3606 the real uid to the effective so that subsequent re-execs of Exim are done by a
3607 privileged user. */
3608
3609 else exim_setugid(geteuid(), getegid(), FALSE, US"forcing real = effective");
3610
3611 /* If testing a filter, open the file(s) now, before wasting time doing other
3612 setups and reading the message. */
3613
3614 if ((filter_test & FTEST_SYSTEM) != 0)
3615 {
3616 filter_sfd = Uopen(filter_test_sfile, O_RDONLY, 0);
3617 if (filter_sfd < 0)
3618 {
3619 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_sfile,
3620 strerror(errno));
3621 return EXIT_FAILURE;
3622 }
3623 }
3624
3625 if ((filter_test & FTEST_USER) != 0)
3626 {
3627 filter_ufd = Uopen(filter_test_ufile, O_RDONLY, 0);
3628 if (filter_ufd < 0)
3629 {
3630 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_ufile,
3631 strerror(errno));
3632 return EXIT_FAILURE;
3633 }
3634 }
3635
3636 /* Initialise lookup_list
3637 If debugging, already called above via version reporting.
3638 In either case, we initialise the list of available lookups while running
3639 as root. All dynamically modules are loaded from a directory which is
3640 hard-coded into the binary and is code which, if not a module, would be
3641 part of Exim already. Ability to modify the content of the directory
3642 is equivalent to the ability to modify a setuid binary!
3643
3644 This needs to happen before we read the main configuration. */
3645 init_lookup_list();
3646
3647 /* Read the main runtime configuration data; this gives up if there
3648 is a failure. It leaves the configuration file open so that the subsequent
3649 configuration data for delivery can be read if needed. */
3650
3651 readconf_main();
3652
3653 /* If an action on specific messages is requested, or if a daemon or queue
3654 runner is being started, we need to know if Exim was called by an admin user.
3655 This is the case if the real user is root or exim, or if the real group is
3656 exim, or if one of the supplementary groups is exim or a group listed in
3657 admin_groups. We don't fail all message actions immediately if not admin_user,
3658 since some actions can be performed by non-admin users. Instead, set admin_user
3659 for later interrogation. */
3660
3661 if (real_uid == root_uid || real_uid == exim_uid || real_gid == exim_gid)
3662 admin_user = TRUE;
3663 else
3664 {
3665 int i, j;
3666 for (i = 0; i < group_count; i++)
3667 {
3668 if (group_list[i] == exim_gid) admin_user = TRUE;
3669 else if (admin_groups != NULL)
3670 {
3671 for (j = 1; j <= (int)(admin_groups[0]); j++)
3672 if (admin_groups[j] == group_list[i])
3673 { admin_user = TRUE; break; }
3674 }
3675 if (admin_user) break;
3676 }
3677 }
3678
3679 /* Another group of privileged users are the trusted users. These are root,
3680 exim, and any caller matching trusted_users or trusted_groups. Trusted callers
3681 are permitted to specify sender_addresses with -f on the command line, and
3682 other message parameters as well. */
3683
3684 if (real_uid == root_uid || real_uid == exim_uid)
3685 trusted_caller = TRUE;
3686 else
3687 {
3688 int i, j;
3689
3690 if (trusted_users != NULL)
3691 {
3692 for (i = 1; i <= (int)(trusted_users[0]); i++)
3693 if (trusted_users[i] == real_uid)
3694 { trusted_caller = TRUE; break; }
3695 }
3696
3697 if (!trusted_caller && trusted_groups != NULL)
3698 {
3699 for (i = 1; i <= (int)(trusted_groups[0]); i++)
3700 {
3701 if (trusted_groups[i] == real_gid)
3702 trusted_caller = TRUE;
3703 else for (j = 0; j < group_count; j++)
3704 {
3705 if (trusted_groups[i] == group_list[j])
3706 { trusted_caller = TRUE; break; }
3707 }
3708 if (trusted_caller) break;
3709 }
3710 }
3711 }
3712
3713 /* Handle the decoding of logging options. */
3714
3715 decode_bits(&log_write_selector, &log_extra_selector, 0, 0,
3716 log_selector_string, log_options, log_options_count, US"log", 0);
3717
3718 DEBUG(D_any)
3719 {
3720 debug_printf("configuration file is %s\n", config_main_filename);
3721 debug_printf("log selectors = %08x %08x\n", log_write_selector,
3722 log_extra_selector);
3723 }
3724
3725 /* If domain literals are not allowed, check the sender address that was
3726 supplied with -f. Ditto for a stripped trailing dot. */
3727
3728 if (sender_address != NULL)
3729 {
3730 if (sender_address[sender_address_domain] == '[' && !allow_domain_literals)
3731 {
3732 fprintf(stderr, "exim: bad -f address \"%s\": domain literals not "
3733 "allowed\n", sender_address);
3734 return EXIT_FAILURE;
3735 }
3736 if (f_end_dot && !strip_trailing_dot)
3737 {
3738 fprintf(stderr, "exim: bad -f address \"%s.\": domain is malformed "
3739 "(trailing dot not allowed)\n", sender_address);
3740 return EXIT_FAILURE;
3741 }
3742 }
3743
3744 /* See if an admin user overrode our logging. */
3745
3746 if (cmdline_syslog_name != NULL)
3747 {
3748 if (admin_user)
3749 {
3750 syslog_processname = cmdline_syslog_name;
3751 log_file_path = string_copy(CUS"syslog");
3752 }
3753 else
3754 {
3755 /* not a panic, non-privileged users should not be able to spam paniclog */
3756 fprintf(stderr,
3757 "exim: you lack sufficient privilege to specify syslog process name\n");
3758 return EXIT_FAILURE;
3759 }
3760 }
3761
3762 /* Paranoia check of maximum lengths of certain strings. There is a check
3763 on the length of the log file path in log.c, which will come into effect
3764 if there are any calls to write the log earlier than this. However, if we
3765 get this far but the string is very long, it is better to stop now than to
3766 carry on and (e.g.) receive a message and then have to collapse. The call to
3767 log_write() from here will cause the ultimate panic collapse if the complete
3768 file name exceeds the buffer length. */
3769
3770 if (Ustrlen(log_file_path) > 200)
3771 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3772 "log_file_path is longer than 200 chars: aborting");
3773
3774 if (Ustrlen(pid_file_path) > 200)
3775 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3776 "pid_file_path is longer than 200 chars: aborting");
3777
3778 if (Ustrlen(spool_directory) > 200)
3779 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3780 "spool_directory is longer than 200 chars: aborting");
3781
3782 /* Length check on the process name given to syslog for its TAG field,
3783 which is only permitted to be 32 characters or less. See RFC 3164. */
3784
3785 if (Ustrlen(syslog_processname) > 32)
3786 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3787 "syslog_processname is longer than 32 chars: aborting");
3788
3789 /* In some operating systems, the environment variable TMPDIR controls where
3790 temporary files are created; Exim doesn't use these (apart from when delivering
3791 to MBX mailboxes), but called libraries such as DBM libraries may require them.
3792 If TMPDIR is found in the environment, reset it to the value defined in the
3793 TMPDIR macro, if this macro is defined. */
3794
3795 #ifdef TMPDIR
3796 {
3797 uschar **p;
3798 for (p = USS environ; *p != NULL; p++)
3799 {
3800 if (Ustrncmp(*p, "TMPDIR=", 7) == 0 &&
3801 Ustrcmp(*p+7, TMPDIR) != 0)
3802 {
3803 uschar *newp = malloc(Ustrlen(TMPDIR) + 8);
3804 sprintf(CS newp, "TMPDIR=%s", TMPDIR);
3805 *p = newp;
3806 DEBUG(D_any) debug_printf("reset TMPDIR=%s in environment\n", TMPDIR);
3807 }
3808 }
3809 }
3810 #endif
3811
3812 /* Timezone handling. If timezone_string is "utc", set a flag to cause all
3813 timestamps to be in UTC (gmtime() is used instead of localtime()). Otherwise,
3814 we may need to get rid of a bogus timezone setting. This can arise when Exim is
3815 called by a user who has set the TZ variable. This then affects the timestamps
3816 in log files and in Received: headers, and any created Date: header lines. The
3817 required timezone is settable in the configuration file, so nothing can be done
3818 about this earlier - but hopefully nothing will normally be logged earlier than
3819 this. We have to make a new environment if TZ is wrong, but don't bother if
3820 timestamps_utc is set, because then all times are in UTC anyway. */
3821
3822 if (timezone_string != NULL && strcmpic(timezone_string, US"UTC") == 0)
3823 {
3824 timestamps_utc = TRUE;
3825 }
3826 else
3827 {
3828 uschar *envtz = US getenv("TZ");
3829 if ((envtz == NULL && timezone_string != NULL) ||
3830 (envtz != NULL &&
3831 (timezone_string == NULL ||
3832 Ustrcmp(timezone_string, envtz) != 0)))
3833 {
3834 uschar **p = USS environ;
3835 uschar **new;
3836 uschar **newp;
3837 int count = 0;
3838 while (*p++ != NULL) count++;
3839 if (envtz == NULL) count++;
3840 newp = new = malloc(sizeof(uschar *) * (count + 1));
3841 for (p = USS environ; *p != NULL; p++)
3842 {
3843 if (Ustrncmp(*p, "TZ=", 3) == 0) continue;
3844 *newp++ = *p;
3845 }
3846 if (timezone_string != NULL)
3847 {
3848 *newp = malloc(Ustrlen(timezone_string) + 4);
3849 sprintf(CS *newp++, "TZ=%s", timezone_string);
3850 }
3851 *newp = NULL;
3852 environ = CSS new;
3853 tzset();
3854 DEBUG(D_any) debug_printf("Reset TZ to %s: time is %s\n", timezone_string,
3855 tod_stamp(tod_log));
3856 }
3857 }
3858
3859 /* Handle the case when we have removed the setuid privilege because of -C or
3860 -D. This means that the caller of Exim was not root.
3861
3862 There is a problem if we were running as the Exim user. The sysadmin may
3863 expect this case to retain privilege because "the binary was called by the
3864 Exim user", but it hasn't, because either the -D option set macros, or the
3865 -C option set a non-trusted configuration file. There are two possibilities:
3866
3867 (1) If deliver_drop_privilege is set, Exim is not going to re-exec in order
3868 to do message deliveries. Thus, the fact that it is running as a
3869 non-privileged user is plausible, and might be wanted in some special
3870 configurations. However, really_exim will have been set false when
3871 privilege was dropped, to stop Exim trying to write to its normal log
3872 files. Therefore, re-enable normal log processing, assuming the sysadmin
3873 has set up the log directory correctly.
3874
3875 (2) If deliver_drop_privilege is not set, the configuration won't work as
3876 apparently intended, and so we log a panic message. In order to retain
3877 root for -C or -D, the caller must either be root or be invoking a
3878 trusted configuration file (when deliver_drop_privilege is false). */
3879
3880 if (removed_privilege && (!trusted_config || macros != NULL) &&
3881 real_uid == exim_uid)
3882 {
3883 if (deliver_drop_privilege)
3884 really_exim = TRUE; /* let logging work normally */
3885 else
3886 log_write(0, LOG_MAIN|LOG_PANIC,
3887 "exim user lost privilege for using %s option",
3888 trusted_config? "-D" : "-C");
3889 }
3890
3891 /* Start up Perl interpreter if Perl support is configured and there is a
3892 perl_startup option, and the configuration or the command line specifies
3893 initializing starting. Note that the global variables are actually called
3894 opt_perl_xxx to avoid clashing with perl's namespace (perl_*). */
3895
3896 #ifdef EXIM_PERL
3897 if (perl_start_option != 0)
3898 opt_perl_at_start = (perl_start_option > 0);
3899 if (opt_perl_at_start && opt_perl_startup != NULL)
3900 {
3901 uschar *errstr;
3902 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
3903 errstr = init_perl(opt_perl_startup);
3904 if (errstr != NULL)
3905 {
3906 fprintf(stderr, "exim: error in perl_startup code: %s\n", errstr);
3907 return EXIT_FAILURE;
3908 }
3909 opt_perl_started = TRUE;
3910 }
3911 #endif /* EXIM_PERL */
3912
3913 /* Log the arguments of the call if the configuration file said so. This is
3914 a debugging feature for finding out what arguments certain MUAs actually use.
3915 Don't attempt it if logging is disabled, or if listing variables or if
3916 verifying/testing addresses or expansions. */
3917
3918 if (((debug_selector & D_any) != 0 || (log_extra_selector & LX_arguments) != 0)
3919 && really_exim && !list_options && !checking)
3920 {
3921 int i;
3922 uschar *p = big_buffer;
3923 char * dummy;
3924 Ustrcpy(p, "cwd= (failed)");
3925 dummy = /* quieten compiler */ getcwd(CS p+4, big_buffer_size - 4);
3926 while (*p) p++;
3927 (void)string_format(p, big_buffer_size - (p - big_buffer), " %d args:", argc);
3928 while (*p) p++;
3929 for (i = 0; i < argc; i++)
3930 {
3931 int len = Ustrlen(argv[i]);
3932 uschar *printing;
3933 uschar *quote;
3934 if (p + len + 8 >= big_buffer + big_buffer_size)
3935 {
3936 Ustrcpy(p, " ...");
3937 log_write(0, LOG_MAIN, "%s", big_buffer);
3938 Ustrcpy(big_buffer, "...");
3939 p = big_buffer + 3;
3940 }
3941 printing = string_printing(argv[i]);
3942 if (printing[0] == 0) quote = US"\""; else
3943 {
3944 uschar *pp = printing;
3945 quote = US"";
3946 while (*pp != 0) if (isspace(*pp++)) { quote = US"\""; break; }
3947 }
3948 sprintf(CS p, " %s%.*s%s", quote, (int)(big_buffer_size -
3949 (p - big_buffer) - 4), printing, quote);
3950 while (*p) p++;
3951 }
3952
3953 if ((log_extra_selector & LX_arguments) != 0)
3954 log_write(0, LOG_MAIN, "%s", big_buffer);
3955 else
3956 debug_printf("%s\n", big_buffer);
3957 }
3958
3959 /* Set the working directory to be the top-level spool directory. We don't rely
3960 on this in the code, which always uses fully qualified names, but it's useful
3961 for core dumps etc. Don't complain if it fails - the spool directory might not
3962 be generally accessible and calls with the -C option (and others) have lost
3963 privilege by now. Before the chdir, we try to ensure that the directory exists.
3964 */
3965
3966 if (Uchdir(spool_directory) != 0)
3967 {
3968 int dummy;
3969 (void)directory_make(spool_directory, US"", SPOOL_DIRECTORY_MODE, FALSE);
3970 dummy = /* quieten compiler */ Uchdir(spool_directory);
3971 }
3972
3973 /* Handle calls with the -bi option. This is a sendmail option to rebuild *the*
3974 alias file. Exim doesn't have such a concept, but this call is screwed into
3975 Sun's YP makefiles. Handle this by calling a configured script, as the real
3976 user who called Exim. The -oA option can be used to pass an argument to the
3977 script. */
3978
3979 if (bi_option)
3980 {
3981 (void)fclose(config_file);
3982 if (bi_command != NULL)
3983 {
3984 int i = 0;
3985 uschar *argv[3];
3986 argv[i++] = bi_command;
3987 if (alias_arg != NULL) argv[i++] = alias_arg;
3988 argv[i++] = NULL;
3989
3990 setgroups(group_count, group_list);
3991 exim_setugid(real_uid, real_gid, FALSE, US"running bi_command");
3992
3993 DEBUG(D_exec) debug_printf("exec %.256s %.256s\n", argv[0],
3994 (argv[1] == NULL)? US"" : argv[1]);
3995
3996 execv(CS argv[0], (char *const *)argv);
3997 fprintf(stderr, "exim: exec failed: %s\n", strerror(errno));
3998 exit(EXIT_FAILURE);
3999 }
4000 else
4001 {
4002 DEBUG(D_any) debug_printf("-bi used but bi_command not set; exiting\n");
4003 exit(EXIT_SUCCESS);
4004 }
4005 }
4006
4007 /* We moved the admin/trusted check to be immediately after reading the
4008 configuration file. We leave these prints here to ensure that syslog setup,
4009 logfile setup, and so on has already happened. */
4010
4011 if (trusted_caller) DEBUG(D_any) debug_printf("trusted user\n");
4012 if (admin_user) DEBUG(D_any) debug_printf("admin user\n");
4013
4014 /* Only an admin user may start the daemon or force a queue run in the default
4015 configuration, but the queue run restriction can be relaxed. Only an admin
4016 user may request that a message be returned to its sender forthwith. Only an
4017 admin user may specify a debug level greater than D_v (because it might show
4018 passwords, etc. in lookup queries). Only an admin user may request a queue
4019 count. Only an admin user can use the test interface to scan for email
4020 (because Exim will be in the spool dir and able to look at mails). */
4021
4022 if (!admin_user)
4023 {
4024 BOOL debugset = (debug_selector & ~D_v) != 0;
4025 if (deliver_give_up || daemon_listen || malware_test_file ||
4026 (count_queue && queue_list_requires_admin) ||
4027 (list_queue && queue_list_requires_admin) ||
4028 (queue_interval >= 0 && prod_requires_admin) ||
4029 (debugset && !running_in_test_harness))
4030 {
4031 fprintf(stderr, "exim:%s permission denied\n", debugset? " debugging" : "");
4032 exit(EXIT_FAILURE);
4033 }
4034 }
4035
4036 /* If the real user is not root or the exim uid, the argument for passing
4037 in an open TCP/IP connection for another message is not permitted, nor is
4038 running with the -N option for any delivery action, unless this call to exim is
4039 one that supplied an input message, or we are using a patched exim for
4040 regression testing. */
4041
4042 if (real_uid != root_uid && real_uid != exim_uid &&
4043 (continue_hostname != NULL ||
4044 (dont_deliver &&
4045 (queue_interval >= 0 || daemon_listen || msg_action_arg > 0)
4046 )) && !running_in_test_harness)
4047 {
4048 fprintf(stderr, "exim: Permission denied\n");
4049 return EXIT_FAILURE;
4050 }
4051
4052 /* If the caller is not trusted, certain arguments are ignored when running for
4053 real, but are permitted when checking things (-be, -bv, -bt, -bh, -bf, -bF).
4054 Note that authority for performing certain actions on messages is tested in the
4055 queue_action() function. */
4056
4057 if (!trusted_caller && !checking && filter_test == FTEST_NONE)
4058 {
4059 sender_host_name = sender_host_address = interface_address =
4060 sender_ident = received_protocol = NULL;
4061 sender_host_port = interface_port = 0;
4062 sender_host_authenticated = authenticated_sender = authenticated_id = NULL;
4063 }
4064
4065 /* If a sender host address is set, extract the optional port number off the
4066 end of it and check its syntax. Do the same thing for the interface address.
4067 Exim exits if the syntax is bad. */
4068
4069 else
4070 {
4071 if (sender_host_address != NULL)
4072 sender_host_port = check_port(sender_host_address);
4073 if (interface_address != NULL)
4074 interface_port = check_port(interface_address);
4075 }
4076
4077 /* If the caller is trusted, then they can use -G to suppress_local_fixups. */
4078 if (flag_G)
4079 {
4080 if (trusted_caller)
4081 {
4082 suppress_local_fixups = suppress_local_fixups_default = TRUE;
4083 DEBUG(D_acl) debug_printf("suppress_local_fixups forced on by -G\n");
4084 }
4085 else
4086 {
4087 fprintf(stderr, "exim: permission denied (-G requires a trusted user)\n");
4088 return EXIT_FAILURE;
4089 }
4090 }
4091
4092 /* If an SMTP message is being received check to see if the standard input is a
4093 TCP/IP socket. If it is, we assume that Exim was called from inetd if the
4094 caller is root or the Exim user, or if the port is a privileged one. Otherwise,
4095 barf. */
4096
4097 if (smtp_input)
4098 {
4099 union sockaddr_46 inetd_sock;
4100 EXIM_SOCKLEN_T size = sizeof(inetd_sock);
4101 if (getpeername(0, (struct sockaddr *)(&inetd_sock), &size) == 0)
4102 {
4103 int family = ((struct sockaddr *)(&inetd_sock))->sa_family;
4104 if (family == AF_INET || family == AF_INET6)
4105 {
4106 union sockaddr_46 interface_sock;
4107 size = sizeof(interface_sock);
4108
4109 if (getsockname(0, (struct sockaddr *)(&interface_sock), &size) == 0)
4110 interface_address = host_ntoa(-1, &interface_sock, NULL,
4111 &interface_port);
4112
4113 if (host_is_tls_on_connect_port(interface_port)) tls_in.on_connect = TRUE;
4114
4115 if (real_uid == root_uid || real_uid == exim_uid || interface_port < 1024)
4116 {
4117 is_inetd = TRUE;
4118 sender_host_address = host_ntoa(-1, (struct sockaddr *)(&inetd_sock),
4119 NULL, &sender_host_port);
4120 if (mua_wrapper) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Input from "
4121 "inetd is not supported when mua_wrapper is set");
4122 }
4123 else
4124 {
4125 fprintf(stderr,
4126 "exim: Permission denied (unprivileged user, unprivileged port)\n");
4127 return EXIT_FAILURE;
4128 }
4129 }