a3606c75314f6df00ea7e9002a4b9bd9a30b51b3
[exim.git] / src / src / exim.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8
9 /* The main function: entry point, initialization, and high-level control.
10 Also a few functions that don't naturally fit elsewhere. */
11
12
13 #include "exim.h"
14
15 #ifdef __GLIBC__
16 # include <gnu/libc-version.h>
17 #endif
18
19 #ifdef USE_GNUTLS
20 # include <gnutls/gnutls.h>
21 # if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
22 # define DISABLE_OCSP
23 # endif
24 #endif
25
26 extern void init_lookup_list(void);
27
28
29
30 /*************************************************
31 * Function interface to store functions *
32 *************************************************/
33
34 /* We need some real functions to pass to the PCRE regular expression library
35 for store allocation via Exim's store manager. The normal calls are actually
36 macros that pass over location information to make tracing easier. These
37 functions just interface to the standard macro calls. A good compiler will
38 optimize out the tail recursion and so not make them too expensive. There
39 are two sets of functions; one for use when we want to retain the compiled
40 regular expression for a long time; the other for short-term use. */
41
42 static void *
43 function_store_get(size_t size)
44 {
45 return store_get((int)size);
46 }
47
48 static void
49 function_dummy_free(void *block) { block = block; }
50
51 static void *
52 function_store_malloc(size_t size)
53 {
54 return store_malloc((int)size);
55 }
56
57 static void
58 function_store_free(void *block)
59 {
60 store_free(block);
61 }
62
63
64
65
66 /*************************************************
67 * Enums for cmdline interface *
68 *************************************************/
69
70 enum commandline_info { CMDINFO_NONE=0,
71 CMDINFO_HELP, CMDINFO_SIEVE, CMDINFO_DSCP };
72
73
74
75
76 /*************************************************
77 * Compile regular expression and panic on fail *
78 *************************************************/
79
80 /* This function is called when failure to compile a regular expression leads
81 to a panic exit. In other cases, pcre_compile() is called directly. In many
82 cases where this function is used, the results of the compilation are to be
83 placed in long-lived store, so we temporarily reset the store management
84 functions that PCRE uses if the use_malloc flag is set.
85
86 Argument:
87 pattern the pattern to compile
88 caseless TRUE if caseless matching is required
89 use_malloc TRUE if compile into malloc store
90
91 Returns: pointer to the compiled pattern
92 */
93
94 const pcre *
95 regex_must_compile(const uschar *pattern, BOOL caseless, BOOL use_malloc)
96 {
97 int offset;
98 int options = PCRE_COPT;
99 const pcre *yield;
100 const uschar *error;
101 if (use_malloc)
102 {
103 pcre_malloc = function_store_malloc;
104 pcre_free = function_store_free;
105 }
106 if (caseless) options |= PCRE_CASELESS;
107 yield = pcre_compile(CCS pattern, options, (const char **)&error, &offset, NULL);
108 pcre_malloc = function_store_get;
109 pcre_free = function_dummy_free;
110 if (yield == NULL)
111 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "regular expression error: "
112 "%s at offset %d while compiling %s", error, offset, pattern);
113 return yield;
114 }
115
116
117
118
119 /*************************************************
120 * Execute regular expression and set strings *
121 *************************************************/
122
123 /* This function runs a regular expression match, and sets up the pointers to
124 the matched substrings.
125
126 Arguments:
127 re the compiled expression
128 subject the subject string
129 options additional PCRE options
130 setup if < 0 do full setup
131 if >= 0 setup from setup+1 onwards,
132 excluding the full matched string
133
134 Returns: TRUE or FALSE
135 */
136
137 BOOL
138 regex_match_and_setup(const pcre *re, const uschar *subject, int options, int setup)
139 {
140 int ovector[3*(EXPAND_MAXN+1)];
141 uschar * s = string_copy(subject); /* de-constifying */
142 int n = pcre_exec(re, NULL, CS s, Ustrlen(s), 0,
143 PCRE_EOPT | options, ovector, sizeof(ovector)/sizeof(int));
144 BOOL yield = n >= 0;
145 if (n == 0) n = EXPAND_MAXN + 1;
146 if (yield)
147 {
148 int nn;
149 expand_nmax = (setup < 0)? 0 : setup + 1;
150 for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
151 {
152 expand_nstring[expand_nmax] = s + ovector[nn];
153 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
154 }
155 expand_nmax--;
156 }
157 return yield;
158 }
159
160
161
162
163 /*************************************************
164 * Set up processing details *
165 *************************************************/
166
167 /* Save a text string for dumping when SIGUSR1 is received.
168 Do checks for overruns.
169
170 Arguments: format and arguments, as for printf()
171 Returns: nothing
172 */
173
174 void
175 set_process_info(const char *format, ...)
176 {
177 int len = sprintf(CS process_info, "%5d ", (int)getpid());
178 va_list ap;
179 va_start(ap, format);
180 if (!string_vformat(process_info + len, PROCESS_INFO_SIZE - len - 2, format, ap))
181 Ustrcpy(process_info + len, "**** string overflowed buffer ****");
182 len = Ustrlen(process_info);
183 process_info[len+0] = '\n';
184 process_info[len+1] = '\0';
185 process_info_len = len + 1;
186 DEBUG(D_process_info) debug_printf("set_process_info: %s", process_info);
187 va_end(ap);
188 }
189
190
191
192
193 /*************************************************
194 * Handler for SIGUSR1 *
195 *************************************************/
196
197 /* SIGUSR1 causes any exim process to write to the process log details of
198 what it is currently doing. It will only be used if the OS is capable of
199 setting up a handler that causes automatic restarting of any system call
200 that is in progress at the time.
201
202 This function takes care to be signal-safe.
203
204 Argument: the signal number (SIGUSR1)
205 Returns: nothing
206 */
207
208 static void
209 usr1_handler(int sig)
210 {
211 int fd;
212
213 os_restarting_signal(sig, usr1_handler);
214
215 fd = Uopen(process_log_path, O_APPEND|O_WRONLY, LOG_MODE);
216 if (fd < 0)
217 {
218 /* If we are already running as the Exim user, try to create it in the
219 current process (assuming spool_directory exists). Otherwise, if we are
220 root, do the creation in an exim:exim subprocess. */
221
222 int euid = geteuid();
223 if (euid == exim_uid)
224 fd = Uopen(process_log_path, O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
225 else if (euid == root_uid)
226 fd = log_create_as_exim(process_log_path);
227 }
228
229 /* If we are neither exim nor root, or if we failed to create the log file,
230 give up. There is not much useful we can do with errors, since we don't want
231 to disrupt whatever is going on outside the signal handler. */
232
233 if (fd < 0) return;
234
235 (void)write(fd, process_info, process_info_len);
236 (void)close(fd);
237 }
238
239
240
241 /*************************************************
242 * Timeout handler *
243 *************************************************/
244
245 /* This handler is enabled most of the time that Exim is running. The handler
246 doesn't actually get used unless alarm() has been called to set a timer, to
247 place a time limit on a system call of some kind. When the handler is run, it
248 re-enables itself.
249
250 There are some other SIGALRM handlers that are used in special cases when more
251 than just a flag setting is required; for example, when reading a message's
252 input. These are normally set up in the code module that uses them, and the
253 SIGALRM handler is reset to this one afterwards.
254
255 Argument: the signal value (SIGALRM)
256 Returns: nothing
257 */
258
259 void
260 sigalrm_handler(int sig)
261 {
262 sig = sig; /* Keep picky compilers happy */
263 sigalrm_seen = TRUE;
264 os_non_restarting_signal(SIGALRM, sigalrm_handler);
265 }
266
267
268
269 /*************************************************
270 * Sleep for a fractional time interval *
271 *************************************************/
272
273 /* This function is called by millisleep() and exim_wait_tick() to wait for a
274 period of time that may include a fraction of a second. The coding is somewhat
275 tedious. We do not expect setitimer() ever to fail, but if it does, the process
276 will wait for ever, so we panic in this instance. (There was a case of this
277 when a bug in a function that calls milliwait() caused it to pass invalid data.
278 That's when I added the check. :-)
279
280 We assume it to be not worth sleeping for under 100us; this value will
281 require revisiting as hardware advances. This avoids the issue of
282 a zero-valued timer setting meaning "never fire".
283
284 Argument: an itimerval structure containing the interval
285 Returns: nothing
286 */
287
288 static void
289 milliwait(struct itimerval *itval)
290 {
291 sigset_t sigmask;
292 sigset_t old_sigmask;
293
294 if (itval->it_value.tv_usec < 100 && itval->it_value.tv_sec == 0)
295 return;
296 (void)sigemptyset(&sigmask); /* Empty mask */
297 (void)sigaddset(&sigmask, SIGALRM); /* Add SIGALRM */
298 (void)sigprocmask(SIG_BLOCK, &sigmask, &old_sigmask); /* Block SIGALRM */
299 if (setitimer(ITIMER_REAL, itval, NULL) < 0) /* Start timer */
300 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
301 "setitimer() failed: %s", strerror(errno));
302 (void)sigfillset(&sigmask); /* All signals */
303 (void)sigdelset(&sigmask, SIGALRM); /* Remove SIGALRM */
304 (void)sigsuspend(&sigmask); /* Until SIGALRM */
305 (void)sigprocmask(SIG_SETMASK, &old_sigmask, NULL); /* Restore mask */
306 }
307
308
309
310
311 /*************************************************
312 * Millisecond sleep function *
313 *************************************************/
314
315 /* The basic sleep() function has a granularity of 1 second, which is too rough
316 in some cases - for example, when using an increasing delay to slow down
317 spammers.
318
319 Argument: number of millseconds
320 Returns: nothing
321 */
322
323 void
324 millisleep(int msec)
325 {
326 struct itimerval itval;
327 itval.it_interval.tv_sec = 0;
328 itval.it_interval.tv_usec = 0;
329 itval.it_value.tv_sec = msec/1000;
330 itval.it_value.tv_usec = (msec % 1000) * 1000;
331 milliwait(&itval);
332 }
333
334
335
336 /*************************************************
337 * Compare microsecond times *
338 *************************************************/
339
340 /*
341 Arguments:
342 tv1 the first time
343 tv2 the second time
344
345 Returns: -1, 0, or +1
346 */
347
348 int
349 exim_tvcmp(struct timeval *t1, struct timeval *t2)
350 {
351 if (t1->tv_sec > t2->tv_sec) return +1;
352 if (t1->tv_sec < t2->tv_sec) return -1;
353 if (t1->tv_usec > t2->tv_usec) return +1;
354 if (t1->tv_usec < t2->tv_usec) return -1;
355 return 0;
356 }
357
358
359
360
361 /*************************************************
362 * Clock tick wait function *
363 *************************************************/
364
365 /* Exim uses a time + a pid to generate a unique identifier in two places: its
366 message IDs, and in file names for maildir deliveries. Because some OS now
367 re-use pids within the same second, sub-second times are now being used.
368 However, for absolute certaintly, we must ensure the clock has ticked before
369 allowing the relevant process to complete. At the time of implementation of
370 this code (February 2003), the speed of processors is such that the clock will
371 invariably have ticked already by the time a process has done its job. This
372 function prepares for the time when things are faster - and it also copes with
373 clocks that go backwards.
374
375 Arguments:
376 then_tv A timeval which was used to create uniqueness; its usec field
377 has been rounded down to the value of the resolution.
378 We want to be sure the current time is greater than this.
379 resolution The resolution that was used to divide the microseconds
380 (1 for maildir, larger for message ids)
381
382 Returns: nothing
383 */
384
385 void
386 exim_wait_tick(struct timeval *then_tv, int resolution)
387 {
388 struct timeval now_tv;
389 long int now_true_usec;
390
391 (void)gettimeofday(&now_tv, NULL);
392 now_true_usec = now_tv.tv_usec;
393 now_tv.tv_usec = (now_true_usec/resolution) * resolution;
394
395 if (exim_tvcmp(&now_tv, then_tv) <= 0)
396 {
397 struct itimerval itval;
398 itval.it_interval.tv_sec = 0;
399 itval.it_interval.tv_usec = 0;
400 itval.it_value.tv_sec = then_tv->tv_sec - now_tv.tv_sec;
401 itval.it_value.tv_usec = then_tv->tv_usec + resolution - now_true_usec;
402
403 /* We know that, overall, "now" is less than or equal to "then". Therefore, a
404 negative value for the microseconds is possible only in the case when "now"
405 is more than a second less than "then". That means that itval.it_value.tv_sec
406 is greater than zero. The following correction is therefore safe. */
407
408 if (itval.it_value.tv_usec < 0)
409 {
410 itval.it_value.tv_usec += 1000000;
411 itval.it_value.tv_sec -= 1;
412 }
413
414 DEBUG(D_transport|D_receive)
415 {
416 if (!running_in_test_harness)
417 {
418 debug_printf("tick check: " TIME_T_FMT ".%06lu " TIME_T_FMT ".%06lu\n",
419 then_tv->tv_sec, (long) then_tv->tv_usec,
420 now_tv.tv_sec, (long) now_tv.tv_usec);
421 debug_printf("waiting " TIME_T_FMT ".%06lu\n",
422 itval.it_value.tv_sec, (long) itval.it_value.tv_usec);
423 }
424 }
425
426 milliwait(&itval);
427 }
428 }
429
430
431
432
433 /*************************************************
434 * Call fopen() with umask 777 and adjust mode *
435 *************************************************/
436
437 /* Exim runs with umask(0) so that files created with open() have the mode that
438 is specified in the open() call. However, there are some files, typically in
439 the spool directory, that are created with fopen(). They end up world-writeable
440 if no precautions are taken. Although the spool directory is not accessible to
441 the world, this is an untidiness. So this is a wrapper function for fopen()
442 that sorts out the mode of the created file.
443
444 Arguments:
445 filename the file name
446 options the fopen() options
447 mode the required mode
448
449 Returns: the fopened FILE or NULL
450 */
451
452 FILE *
453 modefopen(const uschar *filename, const char *options, mode_t mode)
454 {
455 mode_t saved_umask = umask(0777);
456 FILE *f = Ufopen(filename, options);
457 (void)umask(saved_umask);
458 if (f != NULL) (void)fchmod(fileno(f), mode);
459 return f;
460 }
461
462
463
464
465 /*************************************************
466 * Ensure stdin, stdout, and stderr exist *
467 *************************************************/
468
469 /* Some operating systems grumble if an exec() happens without a standard
470 input, output, and error (fds 0, 1, 2) being defined. The worry is that some
471 file will be opened and will use these fd values, and then some other bit of
472 code will assume, for example, that it can write error messages to stderr.
473 This function ensures that fds 0, 1, and 2 are open if they do not already
474 exist, by connecting them to /dev/null.
475
476 This function is also used to ensure that std{in,out,err} exist at all times,
477 so that if any library that Exim calls tries to use them, it doesn't crash.
478
479 Arguments: None
480 Returns: Nothing
481 */
482
483 void
484 exim_nullstd(void)
485 {
486 int i;
487 int devnull = -1;
488 struct stat statbuf;
489 for (i = 0; i <= 2; i++)
490 {
491 if (fstat(i, &statbuf) < 0 && errno == EBADF)
492 {
493 if (devnull < 0) devnull = open("/dev/null", O_RDWR);
494 if (devnull < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
495 string_open_failed(errno, "/dev/null"));
496 if (devnull != i) (void)dup2(devnull, i);
497 }
498 }
499 if (devnull > 2) (void)close(devnull);
500 }
501
502
503
504
505 /*************************************************
506 * Close unwanted file descriptors for delivery *
507 *************************************************/
508
509 /* This function is called from a new process that has been forked to deliver
510 an incoming message, either directly, or using exec.
511
512 We want any smtp input streams to be closed in this new process. However, it
513 has been observed that using fclose() here causes trouble. When reading in -bS
514 input, duplicate copies of messages have been seen. The files will be sharing a
515 file pointer with the parent process, and it seems that fclose() (at least on
516 some systems - I saw this on Solaris 2.5.1) messes with that file pointer, at
517 least sometimes. Hence we go for closing the underlying file descriptors.
518
519 If TLS is active, we want to shut down the TLS library, but without molesting
520 the parent's SSL connection.
521
522 For delivery of a non-SMTP message, we want to close stdin and stdout (and
523 stderr unless debugging) because the calling process might have set them up as
524 pipes and be waiting for them to close before it waits for the submission
525 process to terminate. If they aren't closed, they hold up the calling process
526 until the initial delivery process finishes, which is not what we want.
527
528 Exception: We do want it for synchronous delivery!
529
530 And notwithstanding all the above, if D_resolver is set, implying resolver
531 debugging, leave stdout open, because that's where the resolver writes its
532 debugging output.
533
534 When we close stderr (which implies we've also closed stdout), we also get rid
535 of any controlling terminal.
536
537 Arguments: None
538 Returns: Nothing
539 */
540
541 static void
542 close_unwanted(void)
543 {
544 if (smtp_input)
545 {
546 #ifdef SUPPORT_TLS
547 tls_close(TRUE, FALSE); /* Shut down the TLS library */
548 #endif
549 (void)close(fileno(smtp_in));
550 (void)close(fileno(smtp_out));
551 smtp_in = NULL;
552 }
553 else
554 {
555 (void)close(0); /* stdin */
556 if ((debug_selector & D_resolver) == 0) (void)close(1); /* stdout */
557 if (debug_selector == 0) /* stderr */
558 {
559 if (!synchronous_delivery)
560 {
561 (void)close(2);
562 log_stderr = NULL;
563 }
564 (void)setsid();
565 }
566 }
567 }
568
569
570
571
572 /*************************************************
573 * Set uid and gid *
574 *************************************************/
575
576 /* This function sets a new uid and gid permanently, optionally calling
577 initgroups() to set auxiliary groups. There are some special cases when running
578 Exim in unprivileged modes. In these situations the effective uid will not be
579 root; if we already have the right effective uid/gid, and don't need to
580 initialize any groups, leave things as they are.
581
582 Arguments:
583 uid the uid
584 gid the gid
585 igflag TRUE if initgroups() wanted
586 msg text to use in debugging output and failure log
587
588 Returns: nothing; bombs out on failure
589 */
590
591 void
592 exim_setugid(uid_t uid, gid_t gid, BOOL igflag, uschar *msg)
593 {
594 uid_t euid = geteuid();
595 gid_t egid = getegid();
596
597 if (euid == root_uid || euid != uid || egid != gid || igflag)
598 {
599 /* At least one OS returns +1 for initgroups failure, so just check for
600 non-zero. */
601
602 if (igflag)
603 {
604 struct passwd *pw = getpwuid(uid);
605 if (pw != NULL)
606 {
607 if (initgroups(pw->pw_name, gid) != 0)
608 log_write(0,LOG_MAIN|LOG_PANIC_DIE,"initgroups failed for uid=%ld: %s",
609 (long int)uid, strerror(errno));
610 }
611 else log_write(0, LOG_MAIN|LOG_PANIC_DIE, "cannot run initgroups(): "
612 "no passwd entry for uid=%ld", (long int)uid);
613 }
614
615 if (setgid(gid) < 0 || setuid(uid) < 0)
616 {
617 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to set gid=%ld or uid=%ld "
618 "(euid=%ld): %s", (long int)gid, (long int)uid, (long int)euid, msg);
619 }
620 }
621
622 /* Debugging output included uid/gid and all groups */
623
624 DEBUG(D_uid)
625 {
626 int group_count, save_errno;
627 gid_t group_list[NGROUPS_MAX];
628 debug_printf("changed uid/gid: %s\n uid=%ld gid=%ld pid=%ld\n", msg,
629 (long int)geteuid(), (long int)getegid(), (long int)getpid());
630 group_count = getgroups(NGROUPS_MAX, group_list);
631 save_errno = errno;
632 debug_printf(" auxiliary group list:");
633 if (group_count > 0)
634 {
635 int i;
636 for (i = 0; i < group_count; i++) debug_printf(" %d", (int)group_list[i]);
637 }
638 else if (group_count < 0)
639 debug_printf(" <error: %s>", strerror(save_errno));
640 else debug_printf(" <none>");
641 debug_printf("\n");
642 }
643 }
644
645
646
647
648 /*************************************************
649 * Exit point *
650 *************************************************/
651
652 /* Exim exits via this function so that it always clears up any open
653 databases.
654
655 Arguments:
656 rc return code
657
658 Returns: does not return
659 */
660
661 void
662 exim_exit(int rc)
663 {
664 search_tidyup();
665 DEBUG(D_any)
666 debug_printf(">>>>>>>>>>>>>>>> Exim pid=%d terminating with rc=%d "
667 ">>>>>>>>>>>>>>>>\n", (int)getpid(), rc);
668 exit(rc);
669 }
670
671
672
673
674 /*************************************************
675 * Extract port from host address *
676 *************************************************/
677
678 /* Called to extract the port from the values given to -oMa and -oMi.
679 It also checks the syntax of the address, and terminates it before the
680 port data when a port is extracted.
681
682 Argument:
683 address the address, with possible port on the end
684
685 Returns: the port, or zero if there isn't one
686 bombs out on a syntax error
687 */
688
689 static int
690 check_port(uschar *address)
691 {
692 int port = host_address_extract_port(address);
693 if (string_is_ip_address(address, NULL) == 0)
694 {
695 fprintf(stderr, "exim abandoned: \"%s\" is not an IP address\n", address);
696 exit(EXIT_FAILURE);
697 }
698 return port;
699 }
700
701
702
703 /*************************************************
704 * Test/verify an address *
705 *************************************************/
706
707 /* This function is called by the -bv and -bt code. It extracts a working
708 address from a full RFC 822 address. This isn't really necessary per se, but it
709 has the effect of collapsing source routes.
710
711 Arguments:
712 s the address string
713 flags flag bits for verify_address()
714 exit_value to be set for failures
715
716 Returns: nothing
717 */
718
719 static void
720 test_address(uschar *s, int flags, int *exit_value)
721 {
722 int start, end, domain;
723 uschar *parse_error = NULL;
724 uschar *address = parse_extract_address(s, &parse_error, &start, &end, &domain,
725 FALSE);
726 if (address == NULL)
727 {
728 fprintf(stdout, "syntax error: %s\n", parse_error);
729 *exit_value = 2;
730 }
731 else
732 {
733 int rc = verify_address(deliver_make_addr(address,TRUE), stdout, flags, -1,
734 -1, -1, NULL, NULL, NULL);
735 if (rc == FAIL) *exit_value = 2;
736 else if (rc == DEFER && *exit_value == 0) *exit_value = 1;
737 }
738 }
739
740
741
742 /*************************************************
743 * Show supported features *
744 *************************************************/
745
746 /* This function is called for -bV/--version and for -d to output the optional
747 features of the current Exim binary.
748
749 Arguments: a FILE for printing
750 Returns: nothing
751 */
752
753 static void
754 show_whats_supported(FILE *f)
755 {
756 auth_info *authi;
757
758 #ifdef DB_VERSION_STRING
759 fprintf(f, "Berkeley DB: %s\n", DB_VERSION_STRING);
760 #elif defined(BTREEVERSION) && defined(HASHVERSION)
761 #ifdef USE_DB
762 fprintf(f, "Probably Berkeley DB version 1.8x (native mode)\n");
763 #else
764 fprintf(f, "Probably Berkeley DB version 1.8x (compatibility mode)\n");
765 #endif
766 #elif defined(_DBM_RDONLY) || defined(dbm_dirfno)
767 fprintf(f, "Probably ndbm\n");
768 #elif defined(USE_TDB)
769 fprintf(f, "Using tdb\n");
770 #else
771 #ifdef USE_GDBM
772 fprintf(f, "Probably GDBM (native mode)\n");
773 #else
774 fprintf(f, "Probably GDBM (compatibility mode)\n");
775 #endif
776 #endif
777
778 fprintf(f, "Support for:");
779 #ifdef SUPPORT_CRYPTEQ
780 fprintf(f, " crypteq");
781 #endif
782 #if HAVE_ICONV
783 fprintf(f, " iconv()");
784 #endif
785 #if HAVE_IPV6
786 fprintf(f, " IPv6");
787 #endif
788 #ifdef HAVE_SETCLASSRESOURCES
789 fprintf(f, " use_setclassresources");
790 #endif
791 #ifdef SUPPORT_PAM
792 fprintf(f, " PAM");
793 #endif
794 #ifdef EXIM_PERL
795 fprintf(f, " Perl");
796 #endif
797 #ifdef EXPAND_DLFUNC
798 fprintf(f, " Expand_dlfunc");
799 #endif
800 #ifdef USE_TCP_WRAPPERS
801 fprintf(f, " TCPwrappers");
802 #endif
803 #ifdef SUPPORT_TLS
804 #ifdef USE_GNUTLS
805 fprintf(f, " GnuTLS");
806 #else
807 fprintf(f, " OpenSSL");
808 #endif
809 #endif
810 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
811 fprintf(f, " translate_ip_address");
812 #endif
813 #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
814 fprintf(f, " move_frozen_messages");
815 #endif
816 #ifdef WITH_CONTENT_SCAN
817 fprintf(f, " Content_Scanning");
818 #endif
819 #ifndef DISABLE_DKIM
820 fprintf(f, " DKIM");
821 #endif
822 #ifndef DISABLE_DNSSEC
823 fprintf(f, " DNSSEC");
824 #endif
825 #ifndef DISABLE_EVENT
826 fprintf(f, " Event");
827 #endif
828 #ifdef SUPPORT_I18N
829 fprintf(f, " I18N");
830 #endif
831 #ifndef DISABLE_OCSP
832 fprintf(f, " OCSP");
833 #endif
834 #ifndef DISABLE_PRDR
835 fprintf(f, " PRDR");
836 #endif
837 #ifdef SUPPORT_PROXY
838 fprintf(f, " PROXY");
839 #endif
840 #ifdef SUPPORT_SOCKS
841 fprintf(f, " SOCKS");
842 #endif
843 #ifdef EXPERIMENTAL_LMDB
844 fprintf(f, " Experimental_LMDB");
845 #endif
846 #ifdef EXPERIMENTAL_SPF
847 fprintf(f, " Experimental_SPF");
848 #endif
849 #ifdef EXPERIMENTAL_SRS
850 fprintf(f, " Experimental_SRS");
851 #endif
852 #ifdef EXPERIMENTAL_BRIGHTMAIL
853 fprintf(f, " Experimental_Brightmail");
854 #endif
855 #ifdef EXPERIMENTAL_DANE
856 fprintf(f, " Experimental_DANE");
857 #endif
858 #ifdef EXPERIMENTAL_DCC
859 fprintf(f, " Experimental_DCC");
860 #endif
861 #ifdef EXPERIMENTAL_DMARC
862 fprintf(f, " Experimental_DMARC");
863 #endif
864 #ifdef EXPERIMENTAL_DSN_INFO
865 fprintf(f, " Experimental_DSN_info");
866 #endif
867 fprintf(f, "\n");
868
869 fprintf(f, "Lookups (built-in):");
870 #if defined(LOOKUP_LSEARCH) && LOOKUP_LSEARCH!=2
871 fprintf(f, " lsearch wildlsearch nwildlsearch iplsearch");
872 #endif
873 #if defined(LOOKUP_CDB) && LOOKUP_CDB!=2
874 fprintf(f, " cdb");
875 #endif
876 #if defined(LOOKUP_DBM) && LOOKUP_DBM!=2
877 fprintf(f, " dbm dbmjz dbmnz");
878 #endif
879 #if defined(LOOKUP_DNSDB) && LOOKUP_DNSDB!=2
880 fprintf(f, " dnsdb");
881 #endif
882 #if defined(LOOKUP_DSEARCH) && LOOKUP_DSEARCH!=2
883 fprintf(f, " dsearch");
884 #endif
885 #if defined(LOOKUP_IBASE) && LOOKUP_IBASE!=2
886 fprintf(f, " ibase");
887 #endif
888 #if defined(LOOKUP_LDAP) && LOOKUP_LDAP!=2
889 fprintf(f, " ldap ldapdn ldapm");
890 #endif
891 #ifdef EXPERIMENTAL_LMDB
892 fprintf(f, " lmdb");
893 #endif
894 #if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
895 fprintf(f, " mysql");
896 #endif
897 #if defined(LOOKUP_NIS) && LOOKUP_NIS!=2
898 fprintf(f, " nis nis0");
899 #endif
900 #if defined(LOOKUP_NISPLUS) && LOOKUP_NISPLUS!=2
901 fprintf(f, " nisplus");
902 #endif
903 #if defined(LOOKUP_ORACLE) && LOOKUP_ORACLE!=2
904 fprintf(f, " oracle");
905 #endif
906 #if defined(LOOKUP_PASSWD) && LOOKUP_PASSWD!=2
907 fprintf(f, " passwd");
908 #endif
909 #if defined(LOOKUP_PGSQL) && LOOKUP_PGSQL!=2
910 fprintf(f, " pgsql");
911 #endif
912 #if defined(LOOKUP_REDIS) && LOOKUP_REDIS!=2
913 fprintf(f, " redis");
914 #endif
915 #if defined(LOOKUP_SQLITE) && LOOKUP_SQLITE!=2
916 fprintf(f, " sqlite");
917 #endif
918 #if defined(LOOKUP_TESTDB) && LOOKUP_TESTDB!=2
919 fprintf(f, " testdb");
920 #endif
921 #if defined(LOOKUP_WHOSON) && LOOKUP_WHOSON!=2
922 fprintf(f, " whoson");
923 #endif
924 fprintf(f, "\n");
925
926 fprintf(f, "Authenticators:");
927 #ifdef AUTH_CRAM_MD5
928 fprintf(f, " cram_md5");
929 #endif
930 #ifdef AUTH_CYRUS_SASL
931 fprintf(f, " cyrus_sasl");
932 #endif
933 #ifdef AUTH_DOVECOT
934 fprintf(f, " dovecot");
935 #endif
936 #ifdef AUTH_GSASL
937 fprintf(f, " gsasl");
938 #endif
939 #ifdef AUTH_HEIMDAL_GSSAPI
940 fprintf(f, " heimdal_gssapi");
941 #endif
942 #ifdef AUTH_PLAINTEXT
943 fprintf(f, " plaintext");
944 #endif
945 #ifdef AUTH_SPA
946 fprintf(f, " spa");
947 #endif
948 #ifdef AUTH_TLS
949 fprintf(f, " tls");
950 #endif
951 fprintf(f, "\n");
952
953 fprintf(f, "Routers:");
954 #ifdef ROUTER_ACCEPT
955 fprintf(f, " accept");
956 #endif
957 #ifdef ROUTER_DNSLOOKUP
958 fprintf(f, " dnslookup");
959 #endif
960 #ifdef ROUTER_IPLITERAL
961 fprintf(f, " ipliteral");
962 #endif
963 #ifdef ROUTER_IPLOOKUP
964 fprintf(f, " iplookup");
965 #endif
966 #ifdef ROUTER_MANUALROUTE
967 fprintf(f, " manualroute");
968 #endif
969 #ifdef ROUTER_QUERYPROGRAM
970 fprintf(f, " queryprogram");
971 #endif
972 #ifdef ROUTER_REDIRECT
973 fprintf(f, " redirect");
974 #endif
975 fprintf(f, "\n");
976
977 fprintf(f, "Transports:");
978 #ifdef TRANSPORT_APPENDFILE
979 fprintf(f, " appendfile");
980 #ifdef SUPPORT_MAILDIR
981 fprintf(f, "/maildir");
982 #endif
983 #ifdef SUPPORT_MAILSTORE
984 fprintf(f, "/mailstore");
985 #endif
986 #ifdef SUPPORT_MBX
987 fprintf(f, "/mbx");
988 #endif
989 #endif
990 #ifdef TRANSPORT_AUTOREPLY
991 fprintf(f, " autoreply");
992 #endif
993 #ifdef TRANSPORT_LMTP
994 fprintf(f, " lmtp");
995 #endif
996 #ifdef TRANSPORT_PIPE
997 fprintf(f, " pipe");
998 #endif
999 #ifdef TRANSPORT_SMTP
1000 fprintf(f, " smtp");
1001 #endif
1002 fprintf(f, "\n");
1003
1004 if (fixed_never_users[0] > 0)
1005 {
1006 int i;
1007 fprintf(f, "Fixed never_users: ");
1008 for (i = 1; i <= (int)fixed_never_users[0] - 1; i++)
1009 fprintf(f, "%d:", (unsigned int)fixed_never_users[i]);
1010 fprintf(f, "%d\n", (unsigned int)fixed_never_users[i]);
1011 }
1012
1013 fprintf(f, "Size of off_t: " SIZE_T_FMT "\n", sizeof(off_t));
1014
1015 /* Everything else is details which are only worth reporting when debugging.
1016 Perhaps the tls_version_report should move into this too. */
1017 DEBUG(D_any) do {
1018
1019 int i;
1020
1021 /* clang defines __GNUC__ (at least, for me) so test for it first */
1022 #if defined(__clang__)
1023 fprintf(f, "Compiler: CLang [%s]\n", __clang_version__);
1024 #elif defined(__GNUC__)
1025 fprintf(f, "Compiler: GCC [%s]\n",
1026 # ifdef __VERSION__
1027 __VERSION__
1028 # else
1029 "? unknown version ?"
1030 # endif
1031 );
1032 #else
1033 fprintf(f, "Compiler: <unknown>\n");
1034 #endif
1035
1036 #ifdef __GLIBC__
1037 fprintf(f, "Library version: Glibc: Compile: %d.%d\n",
1038 __GLIBC__, __GLIBC_MINOR__);
1039 if (__GLIBC_PREREQ(2, 1))
1040 fprintf(f, " Runtime: %s\n",
1041 gnu_get_libc_version());
1042 #endif
1043
1044 #ifdef SUPPORT_TLS
1045 tls_version_report(f);
1046 #endif
1047 #ifdef SUPPORT_I18N
1048 utf8_version_report(f);
1049 #endif
1050
1051 for (authi = auths_available; *authi->driver_name != '\0'; ++authi)
1052 if (authi->version_report)
1053 (*authi->version_report)(f);
1054
1055 /* PCRE_PRERELEASE is either defined and empty or a bare sequence of
1056 characters; unless it's an ancient version of PCRE in which case it
1057 is not defined. */
1058 #ifndef PCRE_PRERELEASE
1059 # define PCRE_PRERELEASE
1060 #endif
1061 #define QUOTE(X) #X
1062 #define EXPAND_AND_QUOTE(X) QUOTE(X)
1063 fprintf(f, "Library version: PCRE: Compile: %d.%d%s\n"
1064 " Runtime: %s\n",
1065 PCRE_MAJOR, PCRE_MINOR,
1066 EXPAND_AND_QUOTE(PCRE_PRERELEASE) "",
1067 pcre_version());
1068 #undef QUOTE
1069 #undef EXPAND_AND_QUOTE
1070
1071 init_lookup_list();
1072 for (i = 0; i < lookup_list_count; i++)
1073 if (lookup_list[i]->version_report)
1074 lookup_list[i]->version_report(f);
1075
1076 #ifdef WHITELIST_D_MACROS
1077 fprintf(f, "WHITELIST_D_MACROS: \"%s\"\n", WHITELIST_D_MACROS);
1078 #else
1079 fprintf(f, "WHITELIST_D_MACROS unset\n");
1080 #endif
1081 #ifdef TRUSTED_CONFIG_LIST
1082 fprintf(f, "TRUSTED_CONFIG_LIST: \"%s\"\n", TRUSTED_CONFIG_LIST);
1083 #else
1084 fprintf(f, "TRUSTED_CONFIG_LIST unset\n");
1085 #endif
1086
1087 } while (0);
1088 }
1089
1090
1091 /*************************************************
1092 * Show auxiliary information about Exim *
1093 *************************************************/
1094
1095 static void
1096 show_exim_information(enum commandline_info request, FILE *stream)
1097 {
1098 const uschar **pp;
1099
1100 switch(request)
1101 {
1102 case CMDINFO_NONE:
1103 fprintf(stream, "Oops, something went wrong.\n");
1104 return;
1105 case CMDINFO_HELP:
1106 fprintf(stream,
1107 "The -bI: flag takes a string indicating which information to provide.\n"
1108 "If the string is not recognised, you'll get this help (on stderr).\n"
1109 "\n"
1110 " exim -bI:help this information\n"
1111 " exim -bI:dscp dscp value keywords known\n"
1112 " exim -bI:sieve list of supported sieve extensions, one per line.\n"
1113 );
1114 return;
1115 case CMDINFO_SIEVE:
1116 for (pp = exim_sieve_extension_list; *pp; ++pp)
1117 fprintf(stream, "%s\n", *pp);
1118 return;
1119 case CMDINFO_DSCP:
1120 dscp_list_to_stream(stream);
1121 return;
1122 }
1123 }
1124
1125
1126 /*************************************************
1127 * Quote a local part *
1128 *************************************************/
1129
1130 /* This function is used when a sender address or a From: or Sender: header
1131 line is being created from the caller's login, or from an authenticated_id. It
1132 applies appropriate quoting rules for a local part.
1133
1134 Argument: the local part
1135 Returns: the local part, quoted if necessary
1136 */
1137
1138 uschar *
1139 local_part_quote(uschar *lpart)
1140 {
1141 BOOL needs_quote = FALSE;
1142 int size, ptr;
1143 uschar *yield;
1144 uschar *t;
1145
1146 for (t = lpart; !needs_quote && *t != 0; t++)
1147 {
1148 needs_quote = !isalnum(*t) && strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
1149 (*t != '.' || t == lpart || t[1] == 0);
1150 }
1151
1152 if (!needs_quote) return lpart;
1153
1154 size = ptr = 0;
1155 yield = string_catn(NULL, &size, &ptr, US"\"", 1);
1156
1157 for (;;)
1158 {
1159 uschar *nq = US Ustrpbrk(lpart, "\\\"");
1160 if (nq == NULL)
1161 {
1162 yield = string_cat(yield, &size, &ptr, lpart);
1163 break;
1164 }
1165 yield = string_catn(yield, &size, &ptr, lpart, nq - lpart);
1166 yield = string_catn(yield, &size, &ptr, US"\\", 1);
1167 yield = string_catn(yield, &size, &ptr, nq, 1);
1168 lpart = nq + 1;
1169 }
1170
1171 yield = string_catn(yield, &size, &ptr, US"\"", 1);
1172 yield[ptr] = 0;
1173 return yield;
1174 }
1175
1176
1177
1178 #ifdef USE_READLINE
1179 /*************************************************
1180 * Load readline() functions *
1181 *************************************************/
1182
1183 /* This function is called from testing executions that read data from stdin,
1184 but only when running as the calling user. Currently, only -be does this. The
1185 function loads the readline() function library and passes back the functions.
1186 On some systems, it needs the curses library, so load that too, but try without
1187 it if loading fails. All this functionality has to be requested at build time.
1188
1189 Arguments:
1190 fn_readline_ptr pointer to where to put the readline pointer
1191 fn_addhist_ptr pointer to where to put the addhistory function
1192
1193 Returns: the dlopen handle or NULL on failure
1194 */
1195
1196 static void *
1197 set_readline(char * (**fn_readline_ptr)(const char *),
1198 void (**fn_addhist_ptr)(const char *))
1199 {
1200 void *dlhandle;
1201 void *dlhandle_curses = dlopen("libcurses." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_LAZY);
1202
1203 dlhandle = dlopen("libreadline." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_NOW);
1204 if (dlhandle_curses != NULL) dlclose(dlhandle_curses);
1205
1206 if (dlhandle != NULL)
1207 {
1208 /* Checked manual pages; at least in GNU Readline 6.1, the prototypes are:
1209 * char * readline (const char *prompt);
1210 * void add_history (const char *string);
1211 */
1212 *fn_readline_ptr = (char *(*)(const char*))dlsym(dlhandle, "readline");
1213 *fn_addhist_ptr = (void(*)(const char*))dlsym(dlhandle, "add_history");
1214 }
1215 else
1216 {
1217 DEBUG(D_any) debug_printf("failed to load readline: %s\n", dlerror());
1218 }
1219
1220 return dlhandle;
1221 }
1222 #endif
1223
1224
1225
1226 /*************************************************
1227 * Get a line from stdin for testing things *
1228 *************************************************/
1229
1230 /* This function is called when running tests that can take a number of lines
1231 of input (for example, -be and -bt). It handles continuations and trailing
1232 spaces. And prompting and a blank line output on eof. If readline() is in use,
1233 the arguments are non-NULL and provide the relevant functions.
1234
1235 Arguments:
1236 fn_readline readline function or NULL
1237 fn_addhist addhist function or NULL
1238
1239 Returns: pointer to dynamic memory, or NULL at end of file
1240 */
1241
1242 static uschar *
1243 get_stdinput(char *(*fn_readline)(const char *), void(*fn_addhist)(const char *))
1244 {
1245 int i;
1246 int size = 0;
1247 int ptr = 0;
1248 uschar *yield = NULL;
1249
1250 if (fn_readline == NULL) { printf("> "); fflush(stdout); }
1251
1252 for (i = 0;; i++)
1253 {
1254 uschar buffer[1024];
1255 uschar *p, *ss;
1256
1257 #ifdef USE_READLINE
1258 char *readline_line = NULL;
1259 if (fn_readline != NULL)
1260 {
1261 if ((readline_line = fn_readline((i > 0)? "":"> ")) == NULL) break;
1262 if (*readline_line != 0 && fn_addhist != NULL) fn_addhist(readline_line);
1263 p = US readline_line;
1264 }
1265 else
1266 #endif
1267
1268 /* readline() not in use */
1269
1270 {
1271 if (Ufgets(buffer, sizeof(buffer), stdin) == NULL) break;
1272 p = buffer;
1273 }
1274
1275 /* Handle the line */
1276
1277 ss = p + (int)Ustrlen(p);
1278 while (ss > p && isspace(ss[-1])) ss--;
1279
1280 if (i > 0)
1281 {
1282 while (p < ss && isspace(*p)) p++; /* leading space after cont */
1283 }
1284
1285 yield = string_catn(yield, &size, &ptr, p, ss - p);
1286
1287 #ifdef USE_READLINE
1288 if (fn_readline != NULL) free(readline_line);
1289 #endif
1290
1291 /* yield can only be NULL if ss==p */
1292 if (ss == p || yield[ptr-1] != '\\')
1293 {
1294 if (yield) yield[ptr] = 0;
1295 break;
1296 }
1297 yield[--ptr] = 0;
1298 }
1299
1300 if (yield == NULL) printf("\n");
1301 return yield;
1302 }
1303
1304
1305
1306 /*************************************************
1307 * Output usage information for the program *
1308 *************************************************/
1309
1310 /* This function is called when there are no recipients
1311 or a specific --help argument was added.
1312
1313 Arguments:
1314 progname information on what name we were called by
1315
1316 Returns: DOES NOT RETURN
1317 */
1318
1319 static void
1320 exim_usage(uschar *progname)
1321 {
1322
1323 /* Handle specific program invocation varients */
1324 if (Ustrcmp(progname, US"-mailq") == 0)
1325 {
1326 fprintf(stderr,
1327 "mailq - list the contents of the mail queue\n\n"
1328 "For a list of options, see the Exim documentation.\n");
1329 exit(EXIT_FAILURE);
1330 }
1331
1332 /* Generic usage - we output this whatever happens */
1333 fprintf(stderr,
1334 "Exim is a Mail Transfer Agent. It is normally called by Mail User Agents,\n"
1335 "not directly from a shell command line. Options and/or arguments control\n"
1336 "what it does when called. For a list of options, see the Exim documentation.\n");
1337
1338 exit(EXIT_FAILURE);
1339 }
1340
1341
1342
1343 /*************************************************
1344 * Validate that the macros given are okay *
1345 *************************************************/
1346
1347 /* Typically, Exim will drop privileges if macros are supplied. In some
1348 cases, we want to not do so.
1349
1350 Arguments: none (macros is a global)
1351 Returns: true if trusted, false otherwise
1352 */
1353
1354 static BOOL
1355 macros_trusted(void)
1356 {
1357 #ifdef WHITELIST_D_MACROS
1358 macro_item *m;
1359 uschar *whitelisted, *end, *p, **whites, **w;
1360 int white_count, i, n;
1361 size_t len;
1362 BOOL prev_char_item, found;
1363 #endif
1364
1365 if (macros == NULL)
1366 return TRUE;
1367 #ifndef WHITELIST_D_MACROS
1368 return FALSE;
1369 #else
1370
1371 /* We only trust -D overrides for some invoking users:
1372 root, the exim run-time user, the optional config owner user.
1373 I don't know why config-owner would be needed, but since they can own the
1374 config files anyway, there's no security risk to letting them override -D. */
1375 if ( ! ((real_uid == root_uid)
1376 || (real_uid == exim_uid)
1377 #ifdef CONFIGURE_OWNER
1378 || (real_uid == config_uid)
1379 #endif
1380 ))
1381 {
1382 debug_printf("macros_trusted rejecting macros for uid %d\n", (int) real_uid);
1383 return FALSE;
1384 }
1385
1386 /* Get a list of macros which are whitelisted */
1387 whitelisted = string_copy_malloc(US WHITELIST_D_MACROS);
1388 prev_char_item = FALSE;
1389 white_count = 0;
1390 for (p = whitelisted; *p != '\0'; ++p)
1391 {
1392 if (*p == ':' || isspace(*p))
1393 {
1394 *p = '\0';
1395 if (prev_char_item)
1396 ++white_count;
1397 prev_char_item = FALSE;
1398 continue;
1399 }
1400 if (!prev_char_item)
1401 prev_char_item = TRUE;
1402 }
1403 end = p;
1404 if (prev_char_item)
1405 ++white_count;
1406 if (!white_count)
1407 return FALSE;
1408 whites = store_malloc(sizeof(uschar *) * (white_count+1));
1409 for (p = whitelisted, i = 0; (p != end) && (i < white_count); ++p)
1410 {
1411 if (*p != '\0')
1412 {
1413 whites[i++] = p;
1414 if (i == white_count)
1415 break;
1416 while (*p != '\0' && p < end)
1417 ++p;
1418 }
1419 }
1420 whites[i] = NULL;
1421
1422 /* The list of macros should be very short. Accept the N*M complexity. */
1423 for (m = macros; m != NULL; m = m->next)
1424 {
1425 found = FALSE;
1426 for (w = whites; *w; ++w)
1427 if (Ustrcmp(*w, m->name) == 0)
1428 {
1429 found = TRUE;
1430 break;
1431 }
1432 if (!found)
1433 return FALSE;
1434 if (m->replacement == NULL)
1435 continue;
1436 len = Ustrlen(m->replacement);
1437 if (len == 0)
1438 continue;
1439 n = pcre_exec(regex_whitelisted_macro, NULL, CS m->replacement, len,
1440 0, PCRE_EOPT, NULL, 0);
1441 if (n < 0)
1442 {
1443 if (n != PCRE_ERROR_NOMATCH)
1444 debug_printf("macros_trusted checking %s returned %d\n", m->name, n);
1445 return FALSE;
1446 }
1447 }
1448 DEBUG(D_any) debug_printf("macros_trusted overridden to true by whitelisting\n");
1449 return TRUE;
1450 #endif
1451 }
1452
1453
1454 /*************************************************
1455 * Entry point and high-level code *
1456 *************************************************/
1457
1458 /* Entry point for the Exim mailer. Analyse the arguments and arrange to take
1459 the appropriate action. All the necessary functions are present in the one
1460 binary. I originally thought one should split it up, but it turns out that so
1461 much of the apparatus is needed in each chunk that one might as well just have
1462 it all available all the time, which then makes the coding easier as well.
1463
1464 Arguments:
1465 argc count of entries in argv
1466 argv argument strings, with argv[0] being the program name
1467
1468 Returns: EXIT_SUCCESS if terminated successfully
1469 EXIT_FAILURE otherwise, except when a message has been sent
1470 to the sender, and -oee was given
1471 */
1472
1473 int
1474 main(int argc, char **cargv)
1475 {
1476 uschar **argv = USS cargv;
1477 int arg_receive_timeout = -1;
1478 int arg_smtp_receive_timeout = -1;
1479 int arg_error_handling = error_handling;
1480 int filter_sfd = -1;
1481 int filter_ufd = -1;
1482 int group_count;
1483 int i, rv;
1484 int list_queue_option = 0;
1485 int msg_action = 0;
1486 int msg_action_arg = -1;
1487 int namelen = (argv[0] == NULL)? 0 : Ustrlen(argv[0]);
1488 int queue_only_reason = 0;
1489 #ifdef EXIM_PERL
1490 int perl_start_option = 0;
1491 #endif
1492 int recipients_arg = argc;
1493 int sender_address_domain = 0;
1494 int test_retry_arg = -1;
1495 int test_rewrite_arg = -1;
1496 BOOL arg_queue_only = FALSE;
1497 BOOL bi_option = FALSE;
1498 BOOL checking = FALSE;
1499 BOOL count_queue = FALSE;
1500 BOOL expansion_test = FALSE;
1501 BOOL extract_recipients = FALSE;
1502 BOOL flag_G = FALSE;
1503 BOOL flag_n = FALSE;
1504 BOOL forced_delivery = FALSE;
1505 BOOL f_end_dot = FALSE;
1506 BOOL deliver_give_up = FALSE;
1507 BOOL list_queue = FALSE;
1508 BOOL list_options = FALSE;
1509 BOOL list_config = FALSE;
1510 BOOL local_queue_only;
1511 BOOL more = TRUE;
1512 BOOL one_msg_action = FALSE;
1513 BOOL queue_only_set = FALSE;
1514 BOOL receiving_message = TRUE;
1515 BOOL sender_ident_set = FALSE;
1516 BOOL session_local_queue_only;
1517 BOOL unprivileged;
1518 BOOL removed_privilege = FALSE;
1519 BOOL usage_wanted = FALSE;
1520 BOOL verify_address_mode = FALSE;
1521 BOOL verify_as_sender = FALSE;
1522 BOOL version_printed = FALSE;
1523 uschar *alias_arg = NULL;
1524 uschar *called_as = US"";
1525 uschar *cmdline_syslog_name = NULL;
1526 uschar *start_queue_run_id = NULL;
1527 uschar *stop_queue_run_id = NULL;
1528 uschar *expansion_test_message = NULL;
1529 uschar *ftest_domain = NULL;
1530 uschar *ftest_localpart = NULL;
1531 uschar *ftest_prefix = NULL;
1532 uschar *ftest_suffix = NULL;
1533 uschar *log_oneline = NULL;
1534 uschar *malware_test_file = NULL;
1535 uschar *real_sender_address;
1536 uschar *originator_home = US"/";
1537 size_t sz;
1538 void *reset_point;
1539
1540 struct passwd *pw;
1541 struct stat statbuf;
1542 pid_t passed_qr_pid = (pid_t)0;
1543 int passed_qr_pipe = -1;
1544 gid_t group_list[NGROUPS_MAX];
1545
1546 /* For the -bI: flag */
1547 enum commandline_info info_flag = CMDINFO_NONE;
1548 BOOL info_stdout = FALSE;
1549
1550 /* Possible options for -R and -S */
1551
1552 static uschar *rsopts[] = { US"f", US"ff", US"r", US"rf", US"rff" };
1553
1554 /* Need to define this in case we need to change the environment in order
1555 to get rid of a bogus time zone. We have to make it char rather than uschar
1556 because some OS define it in /usr/include/unistd.h. */
1557
1558 extern char **environ;
1559
1560 /* If the Exim user and/or group and/or the configuration file owner/group were
1561 defined by ref:name at build time, we must now find the actual uid/gid values.
1562 This is a feature to make the lives of binary distributors easier. */
1563
1564 #ifdef EXIM_USERNAME
1565 if (route_finduser(US EXIM_USERNAME, &pw, &exim_uid))
1566 {
1567 if (exim_uid == 0)
1568 {
1569 fprintf(stderr, "exim: refusing to run with uid 0 for \"%s\"\n",
1570 EXIM_USERNAME);
1571 exit(EXIT_FAILURE);
1572 }
1573 /* If ref:name uses a number as the name, route_finduser() returns
1574 TRUE with exim_uid set and pw coerced to NULL. */
1575 if (pw)
1576 exim_gid = pw->pw_gid;
1577 #ifndef EXIM_GROUPNAME
1578 else
1579 {
1580 fprintf(stderr,
1581 "exim: ref:name should specify a usercode, not a group.\n"
1582 "exim: can't let you get away with it unless you also specify a group.\n");
1583 exit(EXIT_FAILURE);
1584 }
1585 #endif
1586 }
1587 else
1588 {
1589 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1590 EXIM_USERNAME);
1591 exit(EXIT_FAILURE);
1592 }
1593 #endif
1594
1595 #ifdef EXIM_GROUPNAME
1596 if (!route_findgroup(US EXIM_GROUPNAME, &exim_gid))
1597 {
1598 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1599 EXIM_GROUPNAME);
1600 exit(EXIT_FAILURE);
1601 }
1602 #endif
1603
1604 #ifdef CONFIGURE_OWNERNAME
1605 if (!route_finduser(US CONFIGURE_OWNERNAME, NULL, &config_uid))
1606 {
1607 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1608 CONFIGURE_OWNERNAME);
1609 exit(EXIT_FAILURE);
1610 }
1611 #endif
1612
1613 /* We default the system_filter_user to be the Exim run-time user, as a
1614 sane non-root value. */
1615 system_filter_uid = exim_uid;
1616
1617 #ifdef CONFIGURE_GROUPNAME
1618 if (!route_findgroup(US CONFIGURE_GROUPNAME, &config_gid))
1619 {
1620 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1621 CONFIGURE_GROUPNAME);
1622 exit(EXIT_FAILURE);
1623 }
1624 #endif
1625
1626 /* In the Cygwin environment, some initialization used to need doing.
1627 It was fudged in by means of this macro; now no longer but we'll leave
1628 it in case of others. */
1629
1630 #ifdef OS_INIT
1631 OS_INIT
1632 #endif
1633
1634 /* Check a field which is patched when we are running Exim within its
1635 testing harness; do a fast initial check, and then the whole thing. */
1636
1637 running_in_test_harness =
1638 *running_status == '<' && Ustrcmp(running_status, "<<<testing>>>") == 0;
1639
1640 /* The C standard says that the equivalent of setlocale(LC_ALL, "C") is obeyed
1641 at the start of a program; however, it seems that some environments do not
1642 follow this. A "strange" locale can affect the formatting of timestamps, so we
1643 make quite sure. */
1644
1645 setlocale(LC_ALL, "C");
1646
1647 /* Set up the default handler for timing using alarm(). */
1648
1649 os_non_restarting_signal(SIGALRM, sigalrm_handler);
1650
1651 /* Ensure we have a buffer for constructing log entries. Use malloc directly,
1652 because store_malloc writes a log entry on failure. */
1653
1654 if (!(log_buffer = US malloc(LOG_BUFFER_SIZE)))
1655 {
1656 fprintf(stderr, "exim: failed to get store for log buffer\n");
1657 exit(EXIT_FAILURE);
1658 }
1659
1660 /* Initialize the default log options. */
1661
1662 bits_set(log_selector, log_selector_size, log_default);
1663
1664 /* Set log_stderr to stderr, provided that stderr exists. This gets reset to
1665 NULL when the daemon is run and the file is closed. We have to use this
1666 indirection, because some systems don't allow writing to the variable "stderr".
1667 */
1668
1669 if (fstat(fileno(stderr), &statbuf) >= 0) log_stderr = stderr;
1670
1671 /* Arrange for the PCRE regex library to use our store functions. Note that
1672 the normal calls are actually macros that add additional arguments for
1673 debugging purposes so we have to assign specially constructed functions here.
1674 The default is to use store in the stacking pool, but this is overridden in the
1675 regex_must_compile() function. */
1676
1677 pcre_malloc = function_store_get;
1678 pcre_free = function_dummy_free;
1679
1680 /* Ensure there is a big buffer for temporary use in several places. It is put
1681 in malloc store so that it can be freed for enlargement if necessary. */
1682
1683 big_buffer = store_malloc(big_buffer_size);
1684
1685 /* Set up the handler for the data request signal, and set the initial
1686 descriptive text. */
1687
1688 set_process_info("initializing");
1689 readconf_features();
1690 readconf_options();
1691 os_restarting_signal(SIGUSR1, usr1_handler);
1692
1693 /* SIGHUP is used to get the daemon to reconfigure. It gets set as appropriate
1694 in the daemon code. For the rest of Exim's uses, we ignore it. */
1695
1696 signal(SIGHUP, SIG_IGN);
1697
1698 /* We don't want to die on pipe errors as the code is written to handle
1699 the write error instead. */
1700
1701 signal(SIGPIPE, SIG_IGN);
1702
1703 /* Under some circumstance on some OS, Exim can get called with SIGCHLD
1704 set to SIG_IGN. This causes subprocesses that complete before the parent
1705 process waits for them not to hang around, so when Exim calls wait(), nothing
1706 is there. The wait() code has been made robust against this, but let's ensure
1707 that SIGCHLD is set to SIG_DFL, because it's tidier to wait and get a process
1708 ending status. We use sigaction rather than plain signal() on those OS where
1709 SA_NOCLDWAIT exists, because we want to be sure it is turned off. (There was a
1710 problem on AIX with this.) */
1711
1712 #ifdef SA_NOCLDWAIT
1713 {
1714 struct sigaction act;
1715 act.sa_handler = SIG_DFL;
1716 sigemptyset(&(act.sa_mask));
1717 act.sa_flags = 0;
1718 sigaction(SIGCHLD, &act, NULL);
1719 }
1720 #else
1721 signal(SIGCHLD, SIG_DFL);
1722 #endif
1723
1724 /* Save the arguments for use if we re-exec exim as a daemon after receiving
1725 SIGHUP. */
1726
1727 sighup_argv = argv;
1728
1729 /* Set up the version number. Set up the leading 'E' for the external form of
1730 message ids, set the pointer to the internal form, and initialize it to
1731 indicate no message being processed. */
1732
1733 version_init();
1734 message_id_option[0] = '-';
1735 message_id_external = message_id_option + 1;
1736 message_id_external[0] = 'E';
1737 message_id = message_id_external + 1;
1738 message_id[0] = 0;
1739
1740 /* Set the umask to zero so that any files Exim creates using open() are
1741 created with the modes that it specifies. NOTE: Files created with fopen() have
1742 a problem, which was not recognized till rather late (February 2006). With this
1743 umask, such files will be world writeable. (They are all content scanning files
1744 in the spool directory, which isn't world-accessible, so this is not a
1745 disaster, but it's untidy.) I don't want to change this overall setting,
1746 however, because it will interact badly with the open() calls. Instead, there's
1747 now a function called modefopen() that fiddles with the umask while calling
1748 fopen(). */
1749
1750 (void)umask(0);
1751
1752 /* Precompile the regular expression for matching a message id. Keep this in
1753 step with the code that generates ids in the accept.c module. We need to do
1754 this here, because the -M options check their arguments for syntactic validity
1755 using mac_ismsgid, which uses this. */
1756
1757 regex_ismsgid =
1758 regex_must_compile(US"^(?:[^\\W_]{6}-){2}[^\\W_]{2}$", FALSE, TRUE);
1759
1760 /* Precompile the regular expression that is used for matching an SMTP error
1761 code, possibly extended, at the start of an error message. Note that the
1762 terminating whitespace character is included. */
1763
1764 regex_smtp_code =
1765 regex_must_compile(US"^\\d\\d\\d\\s(?:\\d\\.\\d\\d?\\d?\\.\\d\\d?\\d?\\s)?",
1766 FALSE, TRUE);
1767
1768 #ifdef WHITELIST_D_MACROS
1769 /* Precompile the regular expression used to filter the content of macros
1770 given to -D for permissibility. */
1771
1772 regex_whitelisted_macro =
1773 regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE);
1774 #endif
1775
1776 for (i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL;
1777
1778 /* If the program is called as "mailq" treat it as equivalent to "exim -bp";
1779 this seems to be a generally accepted convention, since one finds symbolic
1780 links called "mailq" in standard OS configurations. */
1781
1782 if ((namelen == 5 && Ustrcmp(argv[0], "mailq") == 0) ||
1783 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/mailq", 6) == 0))
1784 {
1785 list_queue = TRUE;
1786 receiving_message = FALSE;
1787 called_as = US"-mailq";
1788 }
1789
1790 /* If the program is called as "rmail" treat it as equivalent to
1791 "exim -i -oee", thus allowing UUCP messages to be input using non-SMTP mode,
1792 i.e. preventing a single dot on a line from terminating the message, and
1793 returning with zero return code, even in cases of error (provided an error
1794 message has been sent). */
1795
1796 if ((namelen == 5 && Ustrcmp(argv[0], "rmail") == 0) ||
1797 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rmail", 6) == 0))
1798 {
1799 dot_ends = FALSE;
1800 called_as = US"-rmail";
1801 errors_sender_rc = EXIT_SUCCESS;
1802 }
1803
1804 /* If the program is called as "rsmtp" treat it as equivalent to "exim -bS";
1805 this is a smail convention. */
1806
1807 if ((namelen == 5 && Ustrcmp(argv[0], "rsmtp") == 0) ||
1808 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rsmtp", 6) == 0))
1809 {
1810 smtp_input = smtp_batched_input = TRUE;
1811 called_as = US"-rsmtp";
1812 }
1813
1814 /* If the program is called as "runq" treat it as equivalent to "exim -q";
1815 this is a smail convention. */
1816
1817 if ((namelen == 4 && Ustrcmp(argv[0], "runq") == 0) ||
1818 (namelen > 4 && Ustrncmp(argv[0] + namelen - 5, "/runq", 5) == 0))
1819 {
1820 queue_interval = 0;
1821 receiving_message = FALSE;
1822 called_as = US"-runq";
1823 }
1824
1825 /* If the program is called as "newaliases" treat it as equivalent to
1826 "exim -bi"; this is a sendmail convention. */
1827
1828 if ((namelen == 10 && Ustrcmp(argv[0], "newaliases") == 0) ||
1829 (namelen > 10 && Ustrncmp(argv[0] + namelen - 11, "/newaliases", 11) == 0))
1830 {
1831 bi_option = TRUE;
1832 receiving_message = FALSE;
1833 called_as = US"-newaliases";
1834 }
1835
1836 /* Save the original effective uid for a couple of uses later. It should
1837 normally be root, but in some esoteric environments it may not be. */
1838
1839 original_euid = geteuid();
1840
1841 /* Get the real uid and gid. If the caller is root, force the effective uid/gid
1842 to be the same as the real ones. This makes a difference only if Exim is setuid
1843 (or setgid) to something other than root, which could be the case in some
1844 special configurations. */
1845
1846 real_uid = getuid();
1847 real_gid = getgid();
1848
1849 if (real_uid == root_uid)
1850 {
1851 rv = setgid(real_gid);
1852 if (rv)
1853 {
1854 fprintf(stderr, "exim: setgid(%ld) failed: %s\n",
1855 (long int)real_gid, strerror(errno));
1856 exit(EXIT_FAILURE);
1857 }
1858 rv = setuid(real_uid);
1859 if (rv)
1860 {
1861 fprintf(stderr, "exim: setuid(%ld) failed: %s\n",
1862 (long int)real_uid, strerror(errno));
1863 exit(EXIT_FAILURE);
1864 }
1865 }
1866
1867 /* If neither the original real uid nor the original euid was root, Exim is
1868 running in an unprivileged state. */
1869
1870 unprivileged = (real_uid != root_uid && original_euid != root_uid);
1871
1872 /* Scan the program's arguments. Some can be dealt with right away; others are
1873 simply recorded for checking and handling afterwards. Do a high-level switch
1874 on the second character (the one after '-'), to save some effort. */
1875
1876 for (i = 1; i < argc; i++)
1877 {
1878 BOOL badarg = FALSE;
1879 uschar *arg = argv[i];
1880 uschar *argrest;
1881 int switchchar;
1882
1883 /* An argument not starting with '-' is the start of a recipients list;
1884 break out of the options-scanning loop. */
1885
1886 if (arg[0] != '-')
1887 {
1888 recipients_arg = i;
1889 break;
1890 }
1891
1892 /* An option consistion of -- terminates the options */
1893
1894 if (Ustrcmp(arg, "--") == 0)
1895 {
1896 recipients_arg = i + 1;
1897 break;
1898 }
1899
1900 /* Handle flagged options */
1901
1902 switchchar = arg[1];
1903 argrest = arg+2;
1904
1905 /* Make all -ex options synonymous with -oex arguments, since that
1906 is assumed by various callers. Also make -qR options synonymous with -R
1907 options, as that seems to be required as well. Allow for -qqR too, and
1908 the same for -S options. */
1909
1910 if (Ustrncmp(arg+1, "oe", 2) == 0 ||
1911 Ustrncmp(arg+1, "qR", 2) == 0 ||
1912 Ustrncmp(arg+1, "qS", 2) == 0)
1913 {
1914 switchchar = arg[2];
1915 argrest++;
1916 }
1917 else if (Ustrncmp(arg+1, "qqR", 3) == 0 || Ustrncmp(arg+1, "qqS", 3) == 0)
1918 {
1919 switchchar = arg[3];
1920 argrest += 2;
1921 queue_2stage = TRUE;
1922 }
1923
1924 /* Make -r synonymous with -f, since it is a documented alias */
1925
1926 else if (arg[1] == 'r') switchchar = 'f';
1927
1928 /* Make -ov synonymous with -v */
1929
1930 else if (Ustrcmp(arg, "-ov") == 0)
1931 {
1932 switchchar = 'v';
1933 argrest++;
1934 }
1935
1936 /* deal with --option_aliases */
1937 else if (switchchar == '-')
1938 {
1939 if (Ustrcmp(argrest, "help") == 0)
1940 {
1941 usage_wanted = TRUE;
1942 break;
1943 }
1944 else if (Ustrcmp(argrest, "version") == 0)
1945 {
1946 switchchar = 'b';
1947 argrest = US"V";
1948 }
1949 }
1950
1951 /* High-level switch on active initial letter */
1952
1953 switch(switchchar)
1954 {
1955
1956 /* sendmail uses -Ac and -Am to control which .cf file is used;
1957 we ignore them. */
1958 case 'A':
1959 if (*argrest == '\0') { badarg = TRUE; break; }
1960 else
1961 {
1962 BOOL ignore = FALSE;
1963 switch (*argrest)
1964 {
1965 case 'c':
1966 case 'm':
1967 if (*(argrest + 1) == '\0')
1968 ignore = TRUE;
1969 break;
1970 }
1971 if (!ignore) { badarg = TRUE; break; }
1972 }
1973 break;
1974
1975 /* -Btype is a sendmail option for 7bit/8bit setting. Exim is 8-bit clean
1976 so has no need of it. */
1977
1978 case 'B':
1979 if (*argrest == 0) i++; /* Skip over the type */
1980 break;
1981
1982
1983 case 'b':
1984 receiving_message = FALSE; /* Reset TRUE for -bm, -bS, -bs below */
1985
1986 /* -bd: Run in daemon mode, awaiting SMTP connections.
1987 -bdf: Ditto, but in the foreground.
1988 */
1989
1990 if (*argrest == 'd')
1991 {
1992 daemon_listen = TRUE;
1993 if (*(++argrest) == 'f') background_daemon = FALSE;
1994 else if (*argrest != 0) { badarg = TRUE; break; }
1995 }
1996
1997 /* -be: Run in expansion test mode
1998 -bem: Ditto, but read a message from a file first
1999 */
2000
2001 else if (*argrest == 'e')
2002 {
2003 expansion_test = checking = TRUE;
2004 if (argrest[1] == 'm')
2005 {
2006 if (++i >= argc) { badarg = TRUE; break; }
2007 expansion_test_message = argv[i];
2008 argrest++;
2009 }
2010 if (argrest[1] != 0) { badarg = TRUE; break; }
2011 }
2012
2013 /* -bF: Run system filter test */
2014
2015 else if (*argrest == 'F')
2016 {
2017 filter_test |= checking = FTEST_SYSTEM;
2018 if (*(++argrest) != 0) { badarg = TRUE; break; }
2019 if (++i < argc) filter_test_sfile = argv[i]; else
2020 {
2021 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
2022 exit(EXIT_FAILURE);
2023 }
2024 }
2025
2026 /* -bf: Run user filter test
2027 -bfd: Set domain for filter testing
2028 -bfl: Set local part for filter testing
2029 -bfp: Set prefix for filter testing
2030 -bfs: Set suffix for filter testing
2031 */
2032
2033 else if (*argrest == 'f')
2034 {
2035 if (*(++argrest) == 0)
2036 {
2037 filter_test |= checking = FTEST_USER;
2038 if (++i < argc) filter_test_ufile = argv[i]; else
2039 {
2040 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
2041 exit(EXIT_FAILURE);
2042 }
2043 }
2044 else
2045 {
2046 if (++i >= argc)
2047 {
2048 fprintf(stderr, "exim: string expected after %s\n", arg);
2049 exit(EXIT_FAILURE);
2050 }
2051 if (Ustrcmp(argrest, "d") == 0) ftest_domain = argv[i];
2052 else if (Ustrcmp(argrest, "l") == 0) ftest_localpart = argv[i];
2053 else if (Ustrcmp(argrest, "p") == 0) ftest_prefix = argv[i];
2054 else if (Ustrcmp(argrest, "s") == 0) ftest_suffix = argv[i];
2055 else { badarg = TRUE; break; }
2056 }
2057 }
2058
2059 /* -bh: Host checking - an IP address must follow. */
2060
2061 else if (Ustrcmp(argrest, "h") == 0 || Ustrcmp(argrest, "hc") == 0)
2062 {
2063 if (++i >= argc) { badarg = TRUE; break; }
2064 sender_host_address = argv[i];
2065 host_checking = checking = log_testing_mode = TRUE;
2066 host_checking_callout = argrest[1] == 'c';
2067 message_logs = FALSE;
2068 }
2069
2070 /* -bi: This option is used by sendmail to initialize *the* alias file,
2071 though it has the -oA option to specify a different file. Exim has no
2072 concept of *the* alias file, but since Sun's YP make script calls
2073 sendmail this way, some support must be provided. */
2074
2075 else if (Ustrcmp(argrest, "i") == 0) bi_option = TRUE;
2076
2077 /* -bI: provide information, of the type to follow after a colon.
2078 This is an Exim flag. */
2079
2080 else if (argrest[0] == 'I' && Ustrlen(argrest) >= 2 && argrest[1] == ':')
2081 {
2082 uschar *p = &argrest[2];
2083 info_flag = CMDINFO_HELP;
2084 if (Ustrlen(p))
2085 {
2086 if (strcmpic(p, CUS"sieve") == 0)
2087 {
2088 info_flag = CMDINFO_SIEVE;
2089 info_stdout = TRUE;
2090 }
2091 else if (strcmpic(p, CUS"dscp") == 0)
2092 {
2093 info_flag = CMDINFO_DSCP;
2094 info_stdout = TRUE;
2095 }
2096 else if (strcmpic(p, CUS"help") == 0)
2097 {
2098 info_stdout = TRUE;
2099 }
2100 }
2101 }
2102
2103 /* -bm: Accept and deliver message - the default option. Reinstate
2104 receiving_message, which got turned off for all -b options. */
2105
2106 else if (Ustrcmp(argrest, "m") == 0) receiving_message = TRUE;
2107
2108 /* -bmalware: test the filename given for malware */
2109
2110 else if (Ustrcmp(argrest, "malware") == 0)
2111 {
2112 if (++i >= argc) { badarg = TRUE; break; }
2113 checking = TRUE;
2114 malware_test_file = argv[i];
2115 }
2116
2117 /* -bnq: For locally originating messages, do not qualify unqualified
2118 addresses. In the envelope, this causes errors; in header lines they
2119 just get left. */
2120
2121 else if (Ustrcmp(argrest, "nq") == 0)
2122 {
2123 allow_unqualified_sender = FALSE;
2124 allow_unqualified_recipient = FALSE;
2125 }
2126
2127 /* -bpxx: List the contents of the mail queue, in various forms. If
2128 the option is -bpc, just a queue count is needed. Otherwise, if the
2129 first letter after p is r, then order is random. */
2130
2131 else if (*argrest == 'p')
2132 {
2133 if (*(++argrest) == 'c')
2134 {
2135 count_queue = TRUE;
2136 if (*(++argrest) != 0) badarg = TRUE;
2137 break;
2138 }
2139
2140 if (*argrest == 'r')
2141 {
2142 list_queue_option = 8;
2143 argrest++;
2144 }
2145 else list_queue_option = 0;
2146
2147 list_queue = TRUE;
2148
2149 /* -bp: List the contents of the mail queue, top-level only */
2150
2151 if (*argrest == 0) {}
2152
2153 /* -bpu: List the contents of the mail queue, top-level undelivered */
2154
2155 else if (Ustrcmp(argrest, "u") == 0) list_queue_option += 1;
2156
2157 /* -bpa: List the contents of the mail queue, including all delivered */
2158
2159 else if (Ustrcmp(argrest, "a") == 0) list_queue_option += 2;
2160
2161 /* Unknown after -bp[r] */
2162
2163 else
2164 {
2165 badarg = TRUE;
2166 break;
2167 }
2168 }
2169
2170
2171 /* -bP: List the configuration variables given as the address list.
2172 Force -v, so configuration errors get displayed. */
2173
2174 else if (Ustrcmp(argrest, "P") == 0)
2175 {
2176 /* -bP config: we need to setup here, because later,
2177 * when list_options is checked, the config is read already */
2178 if (argv[i+1] && Ustrcmp(argv[i+1], "config") == 0)
2179 {
2180 list_config = TRUE;
2181 readconf_save_config(version_string);
2182 }
2183 else
2184 {
2185 list_options = TRUE;
2186 debug_selector |= D_v;
2187 debug_file = stderr;
2188 }
2189 }
2190
2191 /* -brt: Test retry configuration lookup */
2192
2193 else if (Ustrcmp(argrest, "rt") == 0)
2194 {
2195 checking = TRUE;
2196 test_retry_arg = i + 1;
2197 goto END_ARG;
2198 }
2199
2200 /* -brw: Test rewrite configuration */
2201
2202 else if (Ustrcmp(argrest, "rw") == 0)
2203 {
2204 checking = TRUE;
2205 test_rewrite_arg = i + 1;
2206 goto END_ARG;
2207 }
2208
2209 /* -bS: Read SMTP commands on standard input, but produce no replies -
2210 all errors are reported by sending messages. */
2211
2212 else if (Ustrcmp(argrest, "S") == 0)
2213 smtp_input = smtp_batched_input = receiving_message = TRUE;
2214
2215 /* -bs: Read SMTP commands on standard input and produce SMTP replies
2216 on standard output. */
2217
2218 else if (Ustrcmp(argrest, "s") == 0) smtp_input = receiving_message = TRUE;
2219
2220 /* -bt: address testing mode */
2221
2222 else if (Ustrcmp(argrest, "t") == 0)
2223 address_test_mode = checking = log_testing_mode = TRUE;
2224
2225 /* -bv: verify addresses */
2226
2227 else if (Ustrcmp(argrest, "v") == 0)
2228 verify_address_mode = checking = log_testing_mode = TRUE;
2229
2230 /* -bvs: verify sender addresses */
2231
2232 else if (Ustrcmp(argrest, "vs") == 0)
2233 {
2234 verify_address_mode = checking = log_testing_mode = TRUE;
2235 verify_as_sender = TRUE;
2236 }
2237
2238 /* -bV: Print version string and support details */
2239
2240 else if (Ustrcmp(argrest, "V") == 0)
2241 {
2242 printf("Exim version %s #%s built %s\n", version_string,
2243 version_cnumber, version_date);
2244 printf("%s\n", CS version_copyright);
2245 version_printed = TRUE;
2246 show_whats_supported(stdout);
2247 log_testing_mode = TRUE;
2248 }
2249
2250 /* -bw: inetd wait mode, accept a listening socket as stdin */
2251
2252 else if (*argrest == 'w')
2253 {
2254 inetd_wait_mode = TRUE;
2255 background_daemon = FALSE;
2256 daemon_listen = TRUE;
2257 if (*(++argrest) != '\0')
2258 {
2259 inetd_wait_timeout = readconf_readtime(argrest, 0, FALSE);
2260 if (inetd_wait_timeout <= 0)
2261 {
2262 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
2263 exit(EXIT_FAILURE);
2264 }
2265 }
2266 }
2267
2268 else badarg = TRUE;
2269 break;
2270
2271
2272 /* -C: change configuration file list; ignore if it isn't really
2273 a change! Enforce a prefix check if required. */
2274
2275 case 'C':
2276 if (*argrest == 0)
2277 {
2278 if(++i < argc) argrest = argv[i]; else
2279 { badarg = TRUE; break; }
2280 }
2281 if (Ustrcmp(config_main_filelist, argrest) != 0)
2282 {
2283 #ifdef ALT_CONFIG_PREFIX
2284 int sep = 0;
2285 int len = Ustrlen(ALT_CONFIG_PREFIX);
2286 uschar *list = argrest;
2287 uschar *filename;
2288 while((filename = string_nextinlist(&list, &sep, big_buffer,
2289 big_buffer_size)) != NULL)
2290 {
2291 if ((Ustrlen(filename) < len ||
2292 Ustrncmp(filename, ALT_CONFIG_PREFIX, len) != 0 ||
2293 Ustrstr(filename, "/../") != NULL) &&
2294 (Ustrcmp(filename, "/dev/null") != 0 || real_uid != root_uid))
2295 {
2296 fprintf(stderr, "-C Permission denied\n");
2297 exit(EXIT_FAILURE);
2298 }
2299 }
2300 #endif
2301 if (real_uid != root_uid)
2302 {
2303 #ifdef TRUSTED_CONFIG_LIST
2304
2305 if (real_uid != exim_uid
2306 #ifdef CONFIGURE_OWNER
2307 && real_uid != config_uid
2308 #endif
2309 )
2310 trusted_config = FALSE;
2311 else
2312 {
2313 FILE *trust_list = Ufopen(TRUSTED_CONFIG_LIST, "rb");
2314 if (trust_list)
2315 {
2316 struct stat statbuf;
2317
2318 if (fstat(fileno(trust_list), &statbuf) != 0 ||
2319 (statbuf.st_uid != root_uid /* owner not root */
2320 #ifdef CONFIGURE_OWNER
2321 && statbuf.st_uid != config_uid /* owner not the special one */
2322 #endif
2323 ) || /* or */
2324 (statbuf.st_gid != root_gid /* group not root */
2325 #ifdef CONFIGURE_GROUP
2326 && statbuf.st_gid != config_gid /* group not the special one */
2327 #endif
2328 && (statbuf.st_mode & 020) != 0 /* group writeable */
2329 ) || /* or */
2330 (statbuf.st_mode & 2) != 0) /* world writeable */
2331 {
2332 trusted_config = FALSE;
2333 fclose(trust_list);
2334 }
2335 else
2336 {
2337 /* Well, the trust list at least is up to scratch... */
2338 void *reset_point = store_get(0);
2339 uschar *trusted_configs[32];
2340 int nr_configs = 0;
2341 int i = 0;
2342
2343 while (Ufgets(big_buffer, big_buffer_size, trust_list))
2344 {
2345 uschar *start = big_buffer, *nl;
2346 while (*start && isspace(*start))
2347 start++;
2348 if (*start != '/')
2349 continue;
2350 nl = Ustrchr(start, '\n');
2351 if (nl)
2352 *nl = 0;
2353 trusted_configs[nr_configs++] = string_copy(start);
2354 if (nr_configs == 32)
2355 break;
2356 }
2357 fclose(trust_list);
2358
2359 if (nr_configs)
2360 {
2361 int sep = 0;
2362 const uschar *list = argrest;
2363 uschar *filename;
2364 while (trusted_config && (filename = string_nextinlist(&list,
2365 &sep, big_buffer, big_buffer_size)) != NULL)
2366 {
2367 for (i=0; i < nr_configs; i++)
2368 {
2369 if (Ustrcmp(filename, trusted_configs[i]) == 0)
2370 break;
2371 }
2372 if (i == nr_configs)
2373 {
2374 trusted_config = FALSE;
2375 break;
2376 }
2377 }
2378 store_reset(reset_point);
2379 }
2380 else
2381 {
2382 /* No valid prefixes found in trust_list file. */
2383 trusted_config = FALSE;
2384 }
2385 }
2386 }
2387 else
2388 {
2389 /* Could not open trust_list file. */
2390 trusted_config = FALSE;
2391 }
2392 }
2393 #else
2394 /* Not root; don't trust config */
2395 trusted_config = FALSE;
2396 #endif
2397 }
2398
2399 config_main_filelist = argrest;
2400 config_changed = TRUE;
2401 }
2402 break;
2403
2404
2405 /* -D: set up a macro definition */
2406
2407 case 'D':
2408 #ifdef DISABLE_D_OPTION
2409 fprintf(stderr, "exim: -D is not available in this Exim binary\n");
2410 exit(EXIT_FAILURE);
2411 #else
2412 {
2413 int ptr = 0;
2414 macro_item *mlast = NULL;
2415 macro_item *m;
2416 uschar name[24];
2417 uschar *s = argrest;
2418
2419 while (isspace(*s)) s++;
2420
2421 if (*s < 'A' || *s > 'Z')
2422 {
2423 fprintf(stderr, "exim: macro name set by -D must start with "
2424 "an upper case letter\n");
2425 exit(EXIT_FAILURE);
2426 }
2427
2428 while (isalnum(*s) || *s == '_')
2429 {
2430 if (ptr < sizeof(name)-1) name[ptr++] = *s;
2431 s++;
2432 }
2433 name[ptr] = 0;
2434 if (ptr == 0) { badarg = TRUE; break; }
2435 while (isspace(*s)) s++;
2436 if (*s != 0)
2437 {
2438 if (*s++ != '=') { badarg = TRUE; break; }
2439 while (isspace(*s)) s++;
2440 }
2441
2442 for (m = macros; m != NULL; m = m->next)
2443 {
2444 if (Ustrcmp(m->name, name) == 0)
2445 {
2446 fprintf(stderr, "exim: duplicated -D in command line\n");
2447 exit(EXIT_FAILURE);
2448 }
2449 mlast = m;
2450 }
2451
2452 m = store_get(sizeof(macro_item) + Ustrlen(name));
2453 m->next = NULL;
2454 m->command_line = TRUE;
2455 if (mlast == NULL) macros = m; else mlast->next = m;
2456 Ustrcpy(m->name, name);
2457 m->replacement = string_copy(s);
2458
2459 if (clmacro_count >= MAX_CLMACROS)
2460 {
2461 fprintf(stderr, "exim: too many -D options on command line\n");
2462 exit(EXIT_FAILURE);
2463 }
2464 clmacros[clmacro_count++] = string_sprintf("-D%s=%s", m->name,
2465 m->replacement);
2466 }
2467 #endif
2468 break;
2469
2470 /* -d: Set debug level (see also -v below) or set the drop_cr option.
2471 The latter is now a no-op, retained for compatibility only. If -dd is used,
2472 debugging subprocesses of the daemon is disabled. */
2473
2474 case 'd':
2475 if (Ustrcmp(argrest, "ropcr") == 0)
2476 {
2477 /* drop_cr = TRUE; */
2478 }
2479
2480 /* Use an intermediate variable so that we don't set debugging while
2481 decoding the debugging bits. */
2482
2483 else
2484 {
2485 unsigned int selector = D_default;
2486 debug_selector = 0;
2487 debug_file = NULL;
2488 if (*argrest == 'd')
2489 {
2490 debug_daemon = TRUE;
2491 argrest++;
2492 }
2493 if (*argrest != 0)
2494 decode_bits(&selector, 1, debug_notall, argrest,
2495 debug_options, debug_options_count, US"debug", 0);
2496 debug_selector = selector;
2497 }
2498 break;
2499
2500
2501 /* -E: This is a local error message. This option is not intended for
2502 external use at all, but is not restricted to trusted callers because it
2503 does no harm (just suppresses certain error messages) and if Exim is run
2504 not setuid root it won't always be trusted when it generates error
2505 messages using this option. If there is a message id following -E, point
2506 message_reference at it, for logging. */
2507
2508 case 'E':
2509 local_error_message = TRUE;
2510 if (mac_ismsgid(argrest)) message_reference = argrest;
2511 break;
2512
2513
2514 /* -ex: The vacation program calls sendmail with the undocumented "-eq"
2515 option, so it looks as if historically the -oex options are also callable
2516 without the leading -o. So we have to accept them. Before the switch,
2517 anything starting -oe has been converted to -e. Exim does not support all
2518 of the sendmail error options. */
2519
2520 case 'e':
2521 if (Ustrcmp(argrest, "e") == 0)
2522 {
2523 arg_error_handling = ERRORS_SENDER;
2524 errors_sender_rc = EXIT_SUCCESS;
2525 }
2526 else if (Ustrcmp(argrest, "m") == 0) arg_error_handling = ERRORS_SENDER;
2527 else if (Ustrcmp(argrest, "p") == 0) arg_error_handling = ERRORS_STDERR;
2528 else if (Ustrcmp(argrest, "q") == 0) arg_error_handling = ERRORS_STDERR;
2529 else if (Ustrcmp(argrest, "w") == 0) arg_error_handling = ERRORS_SENDER;
2530 else badarg = TRUE;
2531 break;
2532
2533
2534 /* -F: Set sender's full name, used instead of the gecos entry from
2535 the password file. Since users can usually alter their gecos entries,
2536 there's no security involved in using this instead. The data can follow
2537 the -F or be in the next argument. */
2538
2539 case 'F':
2540 if (*argrest == 0)
2541 {
2542 if(++i < argc) argrest = argv[i]; else
2543 { badarg = TRUE; break; }
2544 }
2545 originator_name = argrest;
2546 sender_name_forced = TRUE;
2547 break;
2548
2549
2550 /* -f: Set sender's address - this value is only actually used if Exim is
2551 run by a trusted user, or if untrusted_set_sender is set and matches the
2552 address, except that the null address can always be set by any user. The
2553 test for this happens later, when the value given here is ignored when not
2554 permitted. For an untrusted user, the actual sender is still put in Sender:
2555 if it doesn't match the From: header (unless no_local_from_check is set).
2556 The data can follow the -f or be in the next argument. The -r switch is an
2557 obsolete form of -f but since there appear to be programs out there that
2558 use anything that sendmail has ever supported, better accept it - the
2559 synonymizing is done before the switch above.
2560
2561 At this stage, we must allow domain literal addresses, because we don't
2562 know what the setting of allow_domain_literals is yet. Ditto for trailing
2563 dots and strip_trailing_dot. */
2564
2565 case 'f':
2566 {
2567 int dummy_start, dummy_end;
2568 uschar *errmess;
2569 if (*argrest == 0)
2570 {
2571 if (i+1 < argc) argrest = argv[++i]; else
2572 { badarg = TRUE; break; }
2573 }
2574 if (*argrest == 0)
2575 sender_address = string_sprintf(""); /* Ensure writeable memory */
2576 else
2577 {
2578 uschar *temp = argrest + Ustrlen(argrest) - 1;
2579 while (temp >= argrest && isspace(*temp)) temp--;
2580 if (temp >= argrest && *temp == '.') f_end_dot = TRUE;
2581 allow_domain_literals = TRUE;
2582 strip_trailing_dot = TRUE;
2583 #ifdef SUPPORT_I18N
2584 allow_utf8_domains = TRUE;
2585 #endif
2586 sender_address = parse_extract_address(argrest, &errmess,
2587 &dummy_start, &dummy_end, &sender_address_domain, TRUE);
2588 #ifdef SUPPORT_I18N
2589 message_smtputf8 = string_is_utf8(sender_address);
2590 allow_utf8_domains = FALSE;
2591 #endif
2592 allow_domain_literals = FALSE;
2593 strip_trailing_dot = FALSE;
2594 if (sender_address == NULL)
2595 {
2596 fprintf(stderr, "exim: bad -f address \"%s\": %s\n", argrest, errmess);
2597 return EXIT_FAILURE;
2598 }
2599 }
2600 sender_address_forced = TRUE;
2601 }
2602 break;
2603
2604 /* -G: sendmail invocation to specify that it's a gateway submission and
2605 sendmail may complain about problems instead of fixing them.
2606 We make it equivalent to an ACL "control = suppress_local_fixups" and do
2607 not at this time complain about problems. */
2608
2609 case 'G':
2610 flag_G = TRUE;
2611 break;
2612
2613 /* -h: Set the hop count for an incoming message. Exim does not currently
2614 support this; it always computes it by counting the Received: headers.
2615 To put it in will require a change to the spool header file format. */
2616
2617 case 'h':
2618 if (*argrest == 0)
2619 {
2620 if(++i < argc) argrest = argv[i]; else
2621 { badarg = TRUE; break; }
2622 }
2623 if (!isdigit(*argrest)) badarg = TRUE;
2624 break;
2625
2626
2627 /* -i: Set flag so dot doesn't end non-SMTP input (same as -oi, seems
2628 not to be documented for sendmail but mailx (at least) uses it) */
2629
2630 case 'i':
2631 if (*argrest == 0) dot_ends = FALSE; else badarg = TRUE;
2632 break;
2633
2634
2635 /* -L: set the identifier used for syslog; equivalent to setting
2636 syslog_processname in the config file, but needs to be an admin option. */
2637
2638 case 'L':
2639 if (*argrest == '\0')
2640 {
2641 if(++i < argc) argrest = argv[i]; else
2642 { badarg = TRUE; break; }
2643 }
2644 sz = Ustrlen(argrest);
2645 if (sz > 32)
2646 {
2647 fprintf(stderr, "exim: the -L syslog name is too long: \"%s\"\n", argrest);
2648 return EXIT_FAILURE;
2649 }
2650 if (sz < 1)
2651 {
2652 fprintf(stderr, "exim: the -L syslog name is too short\n");
2653 return EXIT_FAILURE;
2654 }
2655 cmdline_syslog_name = argrest;
2656 break;
2657
2658 case 'M':
2659 receiving_message = FALSE;
2660
2661 /* -MC: continue delivery of another message via an existing open
2662 file descriptor. This option is used for an internal call by the
2663 smtp transport when there is a pending message waiting to go to an
2664 address to which it has got a connection. Five subsequent arguments are
2665 required: transport name, host name, IP address, sequence number, and
2666 message_id. Transports may decline to create new processes if the sequence
2667 number gets too big. The channel is stdin. This (-MC) must be the last
2668 argument. There's a subsequent check that the real-uid is privileged.
2669
2670 If we are running in the test harness. delay for a bit, to let the process
2671 that set this one up complete. This makes for repeatability of the logging,
2672 etc. output. */
2673
2674 if (Ustrcmp(argrest, "C") == 0)
2675 {
2676 union sockaddr_46 interface_sock;
2677 EXIM_SOCKLEN_T size = sizeof(interface_sock);
2678
2679 if (argc != i + 6)
2680 {
2681 fprintf(stderr, "exim: too many or too few arguments after -MC\n");
2682 return EXIT_FAILURE;
2683 }
2684
2685 if (msg_action_arg >= 0)
2686 {
2687 fprintf(stderr, "exim: incompatible arguments\n");
2688 return EXIT_FAILURE;
2689 }
2690
2691 continue_transport = argv[++i];
2692 continue_hostname = argv[++i];
2693 continue_host_address = argv[++i];
2694 continue_sequence = Uatoi(argv[++i]);
2695 msg_action = MSG_DELIVER;
2696 msg_action_arg = ++i;
2697 forced_delivery = TRUE;
2698 queue_run_pid = passed_qr_pid;
2699 queue_run_pipe = passed_qr_pipe;
2700
2701 if (!mac_ismsgid(argv[i]))
2702 {
2703 fprintf(stderr, "exim: malformed message id %s after -MC option\n",
2704 argv[i]);
2705 return EXIT_FAILURE;
2706 }
2707
2708 /* Set up $sending_ip_address and $sending_port */
2709
2710 if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
2711 &size) == 0)
2712 sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
2713 &sending_port);
2714 else
2715 {
2716 fprintf(stderr, "exim: getsockname() failed after -MC option: %s\n",
2717 strerror(errno));
2718 return EXIT_FAILURE;
2719 }
2720
2721 if (running_in_test_harness) millisleep(500);
2722 break;
2723 }
2724
2725 else if (*argrest == 'C' && argrest[1] && !argrest[2])
2726 {
2727 switch(argrest[1])
2728 {
2729 /* -MCA: set the smtp_authenticated flag; this is useful only when it
2730 precedes -MC (see above). The flag indicates that the host to which
2731 Exim is connected has accepted an AUTH sequence. */
2732
2733 case 'A': smtp_authenticated = TRUE; break;
2734
2735 /* -MCD: set the smtp_use_dsn flag; this indicates that the host
2736 that exim is connected to supports the esmtp extension DSN */
2737
2738 case 'D': smtp_peer_options |= PEER_OFFERED_DSN; break;
2739
2740 /* -MCG: set the queue name, to a non-default value */
2741
2742 case 'G': if (++i < argc) queue_name = string_copy(argv[i]);
2743 else badarg = TRUE;
2744 break;
2745
2746 /* -MCK: the peer offered CHUNKING. Must precede -MC */
2747
2748 case 'K': smtp_peer_options |= PEER_OFFERED_CHUNKING; break;
2749
2750 /* -MCP: set the smtp_use_pipelining flag; this is useful only when
2751 it preceded -MC (see above) */
2752
2753 case 'P': smtp_peer_options |= PEER_OFFERED_PIPE; break;
2754
2755 /* -MCQ: pass on the pid of the queue-running process that started
2756 this chain of deliveries and the fd of its synchronizing pipe; this
2757 is useful only when it precedes -MC (see above) */
2758
2759 case 'Q': if (++i < argc) passed_qr_pid = (pid_t)(Uatol(argv[i]));
2760 else badarg = TRUE;
2761 if (++i < argc) passed_qr_pipe = (int)(Uatol(argv[i]));
2762 else badarg = TRUE;
2763 break;
2764
2765 /* -MCS: set the smtp_use_size flag; this is useful only when it
2766 precedes -MC (see above) */
2767
2768 case 'S': smtp_peer_options |= PEER_OFFERED_SIZE; break;
2769
2770 #ifdef SUPPORT_TLS
2771 /* -MCT: set the tls_offered flag; this is useful only when it
2772 precedes -MC (see above). The flag indicates that the host to which
2773 Exim is connected has offered TLS support. */
2774
2775 case 'T': smtp_peer_options |= PEER_OFFERED_TLS; break;
2776 #endif
2777
2778 default: badarg = TRUE; break;
2779 }
2780 break;
2781 }
2782
2783 /* -M[x]: various operations on the following list of message ids:
2784 -M deliver the messages, ignoring next retry times and thawing
2785 -Mc deliver the messages, checking next retry times, no thawing
2786 -Mf freeze the messages
2787 -Mg give up on the messages
2788 -Mt thaw the messages
2789 -Mrm remove the messages
2790 In the above cases, this must be the last option. There are also the
2791 following options which are followed by a single message id, and which
2792 act on that message. Some of them use the "recipient" addresses as well.
2793 -Mar add recipient(s)
2794 -Mmad mark all recipients delivered
2795 -Mmd mark recipients(s) delivered
2796 -Mes edit sender
2797 -Mset load a message for use with -be
2798 -Mvb show body
2799 -Mvc show copy (of whole message, in RFC 2822 format)
2800 -Mvh show header
2801 -Mvl show log
2802 */
2803
2804 else if (*argrest == 0)
2805 {
2806 msg_action = MSG_DELIVER;
2807 forced_delivery = deliver_force_thaw = TRUE;
2808 }
2809 else if (Ustrcmp(argrest, "ar") == 0)
2810 {
2811 msg_action = MSG_ADD_RECIPIENT;
2812 one_msg_action = TRUE;
2813 }
2814 else if (Ustrcmp(argrest, "c") == 0) msg_action = MSG_DELIVER;
2815 else if (Ustrcmp(argrest, "es") == 0)
2816 {
2817 msg_action = MSG_EDIT_SENDER;
2818 one_msg_action = TRUE;
2819 }
2820 else if (Ustrcmp(argrest, "f") == 0) msg_action = MSG_FREEZE;
2821 else if (Ustrcmp(argrest, "g") == 0)
2822 {
2823 msg_action = MSG_DELIVER;
2824 deliver_give_up = TRUE;
2825 }
2826 else if (Ustrcmp(argrest, "mad") == 0)
2827 {
2828 msg_action = MSG_MARK_ALL_DELIVERED;
2829 }
2830 else if (Ustrcmp(argrest, "md") == 0)
2831 {
2832 msg_action = MSG_MARK_DELIVERED;
2833 one_msg_action = TRUE;
2834 }
2835 else if (Ustrcmp(argrest, "rm") == 0) msg_action = MSG_REMOVE;
2836 else if (Ustrcmp(argrest, "set") == 0)
2837 {
2838 msg_action = MSG_LOAD;
2839 one_msg_action = TRUE;
2840 }
2841 else if (Ustrcmp(argrest, "t") == 0) msg_action = MSG_THAW;
2842 else if (Ustrcmp(argrest, "vb") == 0)
2843 {
2844 msg_action = MSG_SHOW_BODY;
2845 one_msg_action = TRUE;
2846 }
2847 else if (Ustrcmp(argrest, "vc") == 0)
2848 {
2849 msg_action = MSG_SHOW_COPY;
2850 one_msg_action = TRUE;
2851 }
2852 else if (Ustrcmp(argrest, "vh") == 0)
2853 {
2854 msg_action = MSG_SHOW_HEADER;
2855 one_msg_action = TRUE;
2856 }
2857 else if (Ustrcmp(argrest, "vl") == 0)
2858 {
2859 msg_action = MSG_SHOW_LOG;
2860 one_msg_action = TRUE;
2861 }
2862 else { badarg = TRUE; break; }
2863
2864 /* All the -Mxx options require at least one message id. */
2865
2866 msg_action_arg = i + 1;
2867 if (msg_action_arg >= argc)
2868 {
2869 fprintf(stderr, "exim: no message ids given after %s option\n", arg);
2870 return EXIT_FAILURE;
2871 }
2872
2873 /* Some require only message ids to follow */
2874
2875 if (!one_msg_action)
2876 {
2877 int j;
2878 for (j = msg_action_arg; j < argc; j++) if (!mac_ismsgid(argv[j]))
2879 {
2880 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2881 argv[j], arg);
2882 return EXIT_FAILURE;
2883 }
2884 goto END_ARG; /* Remaining args are ids */
2885 }
2886
2887 /* Others require only one message id, possibly followed by addresses,
2888 which will be handled as normal arguments. */
2889
2890 else
2891 {
2892 if (!mac_ismsgid(argv[msg_action_arg]))
2893 {
2894 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2895 argv[msg_action_arg], arg);
2896 return EXIT_FAILURE;
2897 }
2898 i++;
2899 }
2900 break;
2901
2902
2903 /* Some programs seem to call the -om option without the leading o;
2904 for sendmail it askes for "me too". Exim always does this. */
2905
2906 case 'm':
2907 if (*argrest != 0) badarg = TRUE;
2908 break;
2909
2910
2911 /* -N: don't do delivery - a debugging option that stops transports doing
2912 their thing. It implies debugging at the D_v level. */
2913
2914 case 'N':
2915 if (*argrest == 0)
2916 {
2917 dont_deliver = TRUE;
2918 debug_selector |= D_v;
2919 debug_file = stderr;
2920 }
2921 else badarg = TRUE;
2922 break;
2923
2924
2925 /* -n: This means "don't alias" in sendmail, apparently.
2926 For normal invocations, it has no effect.
2927 It may affect some other options. */
2928
2929 case 'n':
2930 flag_n = TRUE;
2931 break;
2932
2933 /* -O: Just ignore it. In sendmail, apparently -O option=value means set
2934 option to the specified value. This form uses long names. We need to handle
2935 -O option=value and -Ooption=value. */
2936
2937 case 'O':
2938 if (*argrest == 0)
2939 {
2940 if (++i >= argc)
2941 {
2942 fprintf(stderr, "exim: string expected after -O\n");
2943 exit(EXIT_FAILURE);
2944 }
2945 }
2946 break;
2947
2948 case 'o':
2949
2950 /* -oA: Set an argument for the bi command (sendmail's "alternate alias
2951 file" option). */
2952
2953 if (*argrest == 'A')
2954 {
2955 alias_arg = argrest + 1;
2956 if (alias_arg[0] == 0)
2957 {
2958 if (i+1 < argc) alias_arg = argv[++i]; else
2959 {
2960 fprintf(stderr, "exim: string expected after -oA\n");
2961 exit(EXIT_FAILURE);
2962 }
2963 }
2964 }
2965
2966 /* -oB: Set a connection message max value for remote deliveries */
2967
2968 else if (*argrest == 'B')
2969 {
2970 uschar *p = argrest + 1;
2971 if (p[0] == 0)
2972 {
2973 if (i+1 < argc && isdigit((argv[i+1][0]))) p = argv[++i]; else
2974 {
2975 connection_max_messages = 1;
2976 p = NULL;
2977 }
2978 }
2979
2980 if (p != NULL)
2981 {
2982 if (!isdigit(*p))
2983 {
2984 fprintf(stderr, "exim: number expected after -oB\n");
2985 exit(EXIT_FAILURE);
2986 }
2987 connection_max_messages = Uatoi(p);
2988 }
2989 }
2990
2991 /* -odb: background delivery */
2992
2993 else if (Ustrcmp(argrest, "db") == 0)
2994 {
2995 synchronous_delivery = FALSE;
2996 arg_queue_only = FALSE;
2997 queue_only_set = TRUE;
2998 }
2999
3000 /* -odf: foreground delivery (smail-compatible option); same effect as
3001 -odi: interactive (synchronous) delivery (sendmail-compatible option)
3002 */
3003
3004 else if (Ustrcmp(argrest, "df") == 0 || Ustrcmp(argrest, "di") == 0)
3005 {
3006 synchronous_delivery = TRUE;
3007 arg_queue_only = FALSE;
3008 queue_only_set = TRUE;
3009 }
3010
3011 /* -odq: queue only */
3012
3013 else if (Ustrcmp(argrest, "dq") == 0)
3014 {
3015 synchronous_delivery = FALSE;
3016 arg_queue_only = TRUE;
3017 queue_only_set = TRUE;
3018 }
3019
3020 /* -odqs: queue SMTP only - do local deliveries and remote routing,
3021 but no remote delivery */
3022
3023 else if (Ustrcmp(argrest, "dqs") == 0)
3024 {
3025 queue_smtp = TRUE;
3026 arg_queue_only = FALSE;
3027 queue_only_set = TRUE;
3028 }
3029
3030 /* -oex: Sendmail error flags. As these are also accepted without the
3031 leading -o prefix, for compatibility with vacation and other callers,
3032 they are handled with -e above. */
3033
3034 /* -oi: Set flag so dot doesn't end non-SMTP input (same as -i)
3035 -oitrue: Another sendmail syntax for the same */
3036
3037 else if (Ustrcmp(argrest, "i") == 0 ||
3038 Ustrcmp(argrest, "itrue") == 0)
3039 dot_ends = FALSE;
3040
3041 /* -oM*: Set various characteristics for an incoming message; actually
3042 acted on for trusted callers only. */
3043
3044 else if (*argrest == 'M')
3045 {
3046 if (i+1 >= argc)
3047 {
3048 fprintf(stderr, "exim: data expected after -o%s\n", argrest);
3049 exit(EXIT_FAILURE);
3050 }
3051
3052 /* -oMa: Set sender host address */
3053
3054 if (Ustrcmp(argrest, "Ma") == 0) sender_host_address = argv[++i];
3055
3056 /* -oMaa: Set authenticator name */
3057
3058 else if (Ustrcmp(argrest, "Maa") == 0)
3059 sender_host_authenticated = argv[++i];
3060
3061 /* -oMas: setting authenticated sender */
3062
3063 else if (Ustrcmp(argrest, "Mas") == 0) authenticated_sender = argv[++i];
3064
3065 /* -oMai: setting authenticated id */
3066
3067 else if (Ustrcmp(argrest, "Mai") == 0) authenticated_id = argv[++i];
3068
3069 /* -oMi: Set incoming interface address */
3070
3071 else if (Ustrcmp(argrest, "Mi") == 0) interface_address = argv[++i];
3072
3073 /* -oMm: Message reference */
3074
3075 else if (Ustrcmp(argrest, "Mm") == 0)
3076 {
3077 if (!mac_ismsgid(argv[i+1]))
3078 {
3079 fprintf(stderr,"-oMm must be a valid message ID\n");
3080 exit(EXIT_FAILURE);
3081 }
3082 if (!trusted_config)
3083 {
3084 fprintf(stderr,"-oMm must be called by a trusted user/config\n");
3085 exit(EXIT_FAILURE);
3086 }
3087 message_reference = argv[++i];
3088 }
3089
3090 /* -oMr: Received protocol */
3091
3092 else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i];
3093
3094 /* -oMs: Set sender host name */
3095
3096 else if (Ustrcmp(argrest, "Ms") == 0) sender_host_name = argv[++i];
3097
3098 /* -oMt: Set sender ident */
3099
3100 else if (Ustrcmp(argrest, "Mt") == 0)
3101 {
3102 sender_ident_set = TRUE;
3103 sender_ident = argv[++i];
3104 }
3105
3106 /* Else a bad argument */
3107
3108 else
3109 {
3110 badarg = TRUE;
3111 break;
3112 }
3113 }
3114
3115 /* -om: Me-too flag for aliases. Exim always does this. Some programs
3116 seem to call this as -m (undocumented), so that is also accepted (see
3117 above). */
3118
3119 else if (Ustrcmp(argrest, "m") == 0) {}
3120
3121 /* -oo: An ancient flag for old-style addresses which still seems to
3122 crop up in some calls (see in SCO). */
3123
3124 else if (Ustrcmp(argrest, "o") == 0) {}
3125
3126 /* -oP <name>: set pid file path for daemon */
3127
3128 else if (Ustrcmp(argrest, "P") == 0)
3129 override_pid_file_path = argv[++i];
3130
3131 /* -or <n>: set timeout for non-SMTP acceptance
3132 -os <n>: set timeout for SMTP acceptance */
3133
3134 else if (*argrest == 'r' || *argrest == 's')
3135 {
3136 int *tp = (*argrest == 'r')?
3137 &arg_receive_timeout : &arg_smtp_receive_timeout;
3138 if (argrest[1] == 0)
3139 {
3140 if (i+1 < argc) *tp= readconf_readtime(argv[++i], 0, FALSE);
3141 }
3142 else *tp = readconf_readtime(argrest + 1, 0, FALSE);
3143 if (*tp < 0)
3144 {
3145 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3146 exit(EXIT_FAILURE);
3147 }
3148 }
3149
3150 /* -oX <list>: Override local_interfaces and/or default daemon ports */
3151
3152 else if (Ustrcmp(argrest, "X") == 0)
3153 override_local_interfaces = argv[++i];
3154
3155 /* Unknown -o argument */
3156
3157 else badarg = TRUE;
3158 break;
3159
3160
3161 /* -ps: force Perl startup; -pd force delayed Perl startup */
3162
3163 case 'p':
3164 #ifdef EXIM_PERL
3165 if (*argrest == 's' && argrest[1] == 0)
3166 {
3167 perl_start_option = 1;
3168 break;
3169 }
3170 if (*argrest == 'd' && argrest[1] == 0)
3171 {
3172 perl_start_option = -1;
3173 break;
3174 }
3175 #endif
3176
3177 /* -panythingelse is taken as the Sendmail-compatible argument -prval:sval,
3178 which sets the host protocol and host name */
3179
3180 if (*argrest == 0)
3181 {
3182 if (i+1 < argc) argrest = argv[++i]; else
3183 { badarg = TRUE; break; }
3184 }
3185
3186 if (*argrest != 0)
3187 {
3188 uschar *hn = Ustrchr(argrest, ':');
3189 if (hn == NULL)
3190 {
3191 received_protocol = argrest;
3192 }
3193 else
3194 {
3195 received_protocol = string_copyn(argrest, hn - argrest);
3196 sender_host_name = hn + 1;
3197 }
3198 }
3199 break;
3200
3201
3202 case 'q':
3203 receiving_message = FALSE;
3204 if (queue_interval >= 0)
3205 {
3206 fprintf(stderr, "exim: -q specified more than once\n");
3207 exit(EXIT_FAILURE);
3208 }
3209
3210 /* -qq...: Do queue runs in a 2-stage manner */
3211
3212 if (*argrest == 'q')
3213 {
3214 queue_2stage = TRUE;
3215 argrest++;
3216 }
3217
3218 /* -qi...: Do only first (initial) deliveries */
3219
3220 if (*argrest == 'i')
3221 {
3222 queue_run_first_delivery = TRUE;
3223 argrest++;
3224 }
3225
3226 /* -qf...: Run the queue, forcing deliveries
3227 -qff..: Ditto, forcing thawing as well */
3228
3229 if (*argrest == 'f')
3230 {
3231 queue_run_force = TRUE;
3232 if (*++argrest == 'f')
3233 {
3234 deliver_force_thaw = TRUE;
3235 argrest++;
3236 }
3237 }
3238
3239 /* -q[f][f]l...: Run the queue only on local deliveries */
3240
3241 if (*argrest == 'l')
3242 {
3243 queue_run_local = TRUE;
3244 argrest++;
3245 }
3246
3247 /* -q[f][f][l][G<name>]... Work on the named queue */
3248
3249 if (*argrest == 'G')
3250 {
3251 int i;
3252 for (argrest++, i = 0; argrest[i] && argrest[i] != '/'; ) i++;
3253 queue_name = string_copyn(argrest, i);
3254 argrest += i;
3255 if (*argrest == '/') argrest++;
3256 }
3257
3258 /* -q[f][f][l][G<name>]: Run the queue, optionally forced, optionally local
3259 only, optionally named, optionally starting from a given message id. */
3260
3261 if (*argrest == 0 &&
3262 (i + 1 >= argc || argv[i+1][0] == '-' || mac_ismsgid(argv[i+1])))
3263 {
3264 queue_interval = 0;
3265 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3266 start_queue_run_id = argv[++i];
3267 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3268 stop_queue_run_id = argv[++i];
3269 }
3270
3271 /* -q[f][f][l][G<name>/]<n>: Run the queue at regular intervals, optionally
3272 forced, optionally local only, optionally named. */
3273
3274 else if ((queue_interval = readconf_readtime(*argrest ? argrest : argv[++i],
3275 0, FALSE)) <= 0)
3276 {
3277 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3278 exit(EXIT_FAILURE);
3279 }
3280 break;
3281
3282
3283 case 'R': /* Synonymous with -qR... */
3284 receiving_message = FALSE;
3285
3286 /* -Rf: As -R (below) but force all deliveries,
3287 -Rff: Ditto, but also thaw all frozen messages,
3288 -Rr: String is regex
3289 -Rrf: Regex and force
3290 -Rrff: Regex and force and thaw
3291
3292 in all cases provided there are no further characters in this
3293 argument. */
3294
3295 if (*argrest != 0)
3296 {
3297 int i;
3298 for (i = 0; i < nelem(rsopts); i++)
3299 if (Ustrcmp(argrest, rsopts[i]) == 0)
3300 {
3301 if (i != 2) queue_run_force = TRUE;
3302 if (i >= 2) deliver_selectstring_regex = TRUE;
3303 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3304 argrest += Ustrlen(rsopts[i]);
3305 }
3306 }
3307
3308 /* -R: Set string to match in addresses for forced queue run to
3309 pick out particular messages. */
3310
3311 if (*argrest)
3312 deliver_selectstring = argrest;
3313 else if (i+1 < argc)
3314 deliver_selectstring = argv[++i];
3315 else
3316 {
3317 fprintf(stderr, "exim: string expected after -R\n");
3318 exit(EXIT_FAILURE);
3319 }
3320 break;
3321
3322
3323 /* -r: an obsolete synonym for -f (see above) */
3324
3325
3326 /* -S: Like -R but works on sender. */
3327
3328 case 'S': /* Synonymous with -qS... */
3329 receiving_message = FALSE;
3330
3331 /* -Sf: As -S (below) but force all deliveries,
3332 -Sff: Ditto, but also thaw all frozen messages,
3333 -Sr: String is regex
3334 -Srf: Regex and force
3335 -Srff: Regex and force and thaw
3336
3337 in all cases provided there are no further characters in this
3338 argument. */
3339
3340 if (*argrest)
3341 {
3342 int i;
3343 for (i = 0; i < nelem(rsopts); i++)
3344 if (Ustrcmp(argrest, rsopts[i]) == 0)
3345 {
3346 if (i != 2) queue_run_force = TRUE;
3347 if (i >= 2) deliver_selectstring_sender_regex = TRUE;
3348 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3349 argrest += Ustrlen(rsopts[i]);
3350 }
3351 }
3352
3353 /* -S: Set string to match in addresses for forced queue run to
3354 pick out particular messages. */
3355
3356 if (*argrest)
3357 deliver_selectstring_sender = argrest;
3358 else if (i+1 < argc)
3359 deliver_selectstring_sender = argv[++i];
3360 else
3361 {
3362 fprintf(stderr, "exim: string expected after -S\n");
3363 exit(EXIT_FAILURE);
3364 }
3365 break;
3366
3367 /* -Tqt is an option that is exclusively for use by the testing suite.
3368 It is not recognized in other circumstances. It allows for the setting up
3369 of explicit "queue times" so that various warning/retry things can be
3370 tested. Otherwise variability of clock ticks etc. cause problems. */
3371
3372 case 'T':
3373 if (running_in_test_harness && Ustrcmp(argrest, "qt") == 0)
3374 fudged_queue_times = argv[++i];
3375 else badarg = TRUE;
3376 break;
3377
3378
3379 /* -t: Set flag to extract recipients from body of message. */
3380
3381 case 't':
3382 if (*argrest == 0) extract_recipients = TRUE;
3383
3384 /* -ti: Set flag to extract recipients from body of message, and also
3385 specify that dot does not end the message. */
3386
3387 else if (Ustrcmp(argrest, "i") == 0)
3388 {
3389 extract_recipients = TRUE;
3390 dot_ends = FALSE;
3391 }
3392
3393 /* -tls-on-connect: don't wait for STARTTLS (for old clients) */
3394
3395 #ifdef SUPPORT_TLS
3396 else if (Ustrcmp(argrest, "ls-on-connect") == 0) tls_in.on_connect = TRUE;
3397 #endif
3398
3399 else badarg = TRUE;
3400 break;
3401
3402
3403 /* -U: This means "initial user submission" in sendmail, apparently. The
3404 doc claims that in future sendmail may refuse syntactically invalid
3405 messages instead of fixing them. For the moment, we just ignore it. */
3406
3407 case 'U':
3408 break;
3409
3410
3411 /* -v: verify things - this is a very low-level debugging */
3412
3413 case 'v':
3414 if (*argrest == 0)
3415 {
3416 debug_selector |= D_v;
3417 debug_file = stderr;
3418 }
3419 else badarg = TRUE;
3420 break;
3421
3422
3423 /* -x: AIX uses this to indicate some fancy 8-bit character stuff:
3424
3425 The -x flag tells the sendmail command that mail from a local
3426 mail program has National Language Support (NLS) extended characters
3427 in the body of the mail item. The sendmail command can send mail with
3428 extended NLS characters across networks that normally corrupts these
3429 8-bit characters.
3430
3431 As Exim is 8-bit clean, it just ignores this flag. */
3432
3433 case 'x':
3434 if (*argrest != 0) badarg = TRUE;
3435 break;
3436
3437 /* -X: in sendmail: takes one parameter, logfile, and sends debugging
3438 logs to that file. We swallow the parameter and otherwise ignore it. */
3439
3440 case 'X':
3441 if (*argrest == '\0')
3442 if (++i >= argc)
3443 {
3444 fprintf(stderr, "exim: string expected after -X\n");
3445 exit(EXIT_FAILURE);
3446 }
3447 break;
3448
3449 case 'z':
3450 if (*argrest == '\0')
3451 if (++i < argc) log_oneline = argv[i]; else
3452 {
3453 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
3454 exit(EXIT_FAILURE);
3455 }
3456 break;
3457
3458 /* All other initial characters are errors */
3459
3460 default:
3461 badarg = TRUE;
3462 break;
3463 } /* End of high-level switch statement */
3464
3465 /* Failed to recognize the option, or syntax error */
3466
3467 if (badarg)
3468 {
3469 fprintf(stderr, "exim abandoned: unknown, malformed, or incomplete "
3470 "option %s\n", arg);
3471 exit(EXIT_FAILURE);
3472 }
3473 }
3474
3475
3476 /* If -R or -S have been specified without -q, assume a single queue run. */
3477
3478 if ( (deliver_selectstring || deliver_selectstring_sender)
3479 && queue_interval < 0)
3480 queue_interval = 0;
3481
3482
3483 END_ARG:
3484 /* If usage_wanted is set we call the usage function - which never returns */
3485 if (usage_wanted) exim_usage(called_as);
3486
3487 /* Arguments have been processed. Check for incompatibilities. */
3488 if ((
3489 (smtp_input || extract_recipients || recipients_arg < argc) &&
3490 (daemon_listen || queue_interval >= 0 || bi_option ||
3491 test_retry_arg >= 0 || test_rewrite_arg >= 0 ||
3492 filter_test != FTEST_NONE || (msg_action_arg > 0 && !one_msg_action))
3493 ) ||
3494 (
3495 msg_action_arg > 0 &&
3496 (daemon_listen || queue_interval > 0 || list_options ||
3497 (checking && msg_action != MSG_LOAD) ||
3498 bi_option || test_retry_arg >= 0 || test_rewrite_arg >= 0)
3499 ) ||
3500 (
3501 (daemon_listen || queue_interval > 0) &&
3502 (sender_address != NULL || list_options || list_queue || checking ||
3503 bi_option)
3504 ) ||
3505 (
3506 daemon_listen && queue_interval == 0
3507 ) ||
3508 (
3509 inetd_wait_mode && queue_interval >= 0
3510 ) ||
3511 (
3512 list_options &&
3513 (checking || smtp_input || extract_recipients ||
3514 filter_test != FTEST_NONE || bi_option)
3515 ) ||
3516 (
3517 verify_address_mode &&
3518 (address_test_mode || smtp_input || extract_recipients ||
3519 filter_test != FTEST_NONE || bi_option)
3520 ) ||
3521 (
3522 address_test_mode && (smtp_input || extract_recipients ||
3523 filter_test != FTEST_NONE || bi_option)
3524 ) ||
3525 (
3526 smtp_input && (sender_address != NULL || filter_test != FTEST_NONE ||
3527 extract_recipients)
3528 ) ||
3529 (
3530 deliver_selectstring != NULL && queue_interval < 0
3531 ) ||
3532 (
3533 msg_action == MSG_LOAD &&
3534 (!expansion_test || expansion_test_message != NULL)
3535 )
3536 )
3537 {
3538 fprintf(stderr, "exim: incompatible command-line options or arguments\n");
3539 exit(EXIT_FAILURE);
3540 }
3541
3542 /* If debugging is set up, set the file and the file descriptor to pass on to
3543 child processes. It should, of course, be 2 for stderr. Also, force the daemon
3544 to run in the foreground. */
3545
3546 if (debug_selector != 0)
3547 {
3548 debug_file = stderr;
3549 debug_fd = fileno(debug_file);
3550 background_daemon = FALSE;
3551 if (running_in_test_harness) millisleep(100); /* lets caller finish */
3552 if (debug_selector != D_v) /* -v only doesn't show this */
3553 {
3554 debug_printf("Exim version %s uid=%ld gid=%ld pid=%d D=%x\n",
3555 version_string, (long int)real_uid, (long int)real_gid, (int)getpid(),
3556 debug_selector);
3557 if (!version_printed)
3558 show_whats_supported(stderr);
3559 }
3560 }
3561
3562 /* When started with root privilege, ensure that the limits on the number of
3563 open files and the number of processes (where that is accessible) are
3564 sufficiently large, or are unset, in case Exim has been called from an
3565 environment where the limits are screwed down. Not all OS have the ability to
3566 change some of these limits. */
3567
3568 if (unprivileged)
3569 {
3570 DEBUG(D_any) debug_print_ids(US"Exim has no root privilege:");
3571 }
3572 else
3573 {
3574 struct rlimit rlp;
3575
3576 #ifdef RLIMIT_NOFILE
3577 if (getrlimit(RLIMIT_NOFILE, &rlp) < 0)
3578 {
3579 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NOFILE) failed: %s",
3580 strerror(errno));
3581 rlp.rlim_cur = rlp.rlim_max = 0;
3582 }
3583
3584 /* I originally chose 1000 as a nice big number that was unlikely to
3585 be exceeded. It turns out that some older OS have a fixed upper limit of
3586 256. */
3587
3588 if (rlp.rlim_cur < 1000)
3589 {
3590 rlp.rlim_cur = rlp.rlim_max = 1000;
3591 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3592 {
3593 rlp.rlim_cur = rlp.rlim_max = 256;
3594 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3595 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NOFILE) failed: %s",
3596 strerror(errno));
3597 }
3598 }
3599 #endif
3600
3601 #ifdef RLIMIT_NPROC
3602 if (getrlimit(RLIMIT_NPROC, &rlp) < 0)
3603 {
3604 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NPROC) failed: %s",
3605 strerror(errno));
3606 rlp.rlim_cur = rlp.rlim_max = 0;
3607 }
3608
3609 #ifdef RLIM_INFINITY
3610 if (rlp.rlim_cur != RLIM_INFINITY && rlp.rlim_cur < 1000)
3611 {
3612 rlp.rlim_cur = rlp.rlim_max = RLIM_INFINITY;
3613 #else
3614 if (rlp.rlim_cur < 1000)
3615 {
3616 rlp.rlim_cur = rlp.rlim_max = 1000;
3617 #endif
3618 if (setrlimit(RLIMIT_NPROC, &rlp) < 0)
3619 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NPROC) failed: %s",
3620 strerror(errno));
3621 }
3622 #endif
3623 }
3624
3625 /* Exim is normally entered as root (but some special configurations are
3626 possible that don't do this). However, it always spins off sub-processes that
3627 set their uid and gid as required for local delivery. We don't want to pass on
3628 any extra groups that root may belong to, so we want to get rid of them all at
3629 this point.
3630
3631 We need to obey setgroups() at this stage, before possibly giving up root
3632 privilege for a changed configuration file, but later on we might need to
3633 check on the additional groups for the admin user privilege - can't do that
3634 till after reading the config, which might specify the exim gid. Therefore,
3635 save the group list here first. */
3636
3637 group_count = getgroups(NGROUPS_MAX, group_list);
3638 if (group_count < 0)
3639 {
3640 fprintf(stderr, "exim: getgroups() failed: %s\n", strerror(errno));
3641 exit(EXIT_FAILURE);
3642 }
3643
3644 /* There is a fundamental difference in some BSD systems in the matter of
3645 groups. FreeBSD and BSDI are known to be different; NetBSD and OpenBSD are
3646 known not to be different. On the "different" systems there is a single group
3647 list, and the first entry in it is the current group. On all other versions of
3648 Unix there is a supplementary group list, which is in *addition* to the current
3649 group. Consequently, to get rid of all extraneous groups on a "standard" system
3650 you pass over 0 groups to setgroups(), while on a "different" system you pass
3651 over a single group - the current group, which is always the first group in the
3652 list. Calling setgroups() with zero groups on a "different" system results in
3653 an error return. The following code should cope with both types of system.
3654
3655 However, if this process isn't running as root, setgroups() can't be used
3656 since you have to be root to run it, even if throwing away groups. Not being
3657 root here happens only in some unusual configurations. We just ignore the
3658 error. */
3659
3660 if (setgroups(0, NULL) != 0)
3661 {
3662 if (setgroups(1, group_list) != 0 && !unprivileged)
3663 {
3664 fprintf(stderr, "exim: setgroups() failed: %s\n", strerror(errno));
3665 exit(EXIT_FAILURE);
3666 }
3667 }
3668
3669 /* If the configuration file name has been altered by an argument on the
3670 command line (either a new file name or a macro definition) and the caller is
3671 not root, or if this is a filter testing run, remove any setuid privilege the
3672 program has and run as the underlying user.
3673
3674 The exim user is locked out of this, which severely restricts the use of -C
3675 for some purposes.
3676
3677 Otherwise, set the real ids to the effective values (should be root unless run
3678 from inetd, which it can either be root or the exim uid, if one is configured).
3679
3680 There is a private mechanism for bypassing some of this, in order to make it
3681 possible to test lots of configurations automatically, without having either to
3682 recompile each time, or to patch in an actual configuration file name and other
3683 values (such as the path name). If running in the test harness, pretend that
3684 configuration file changes and macro definitions haven't happened. */
3685
3686 if (( /* EITHER */
3687 (!trusted_config || /* Config changed, or */
3688 !macros_trusted()) && /* impermissible macros and */
3689 real_uid != root_uid && /* Not root, and */
3690 !running_in_test_harness /* Not fudged */
3691 ) || /* OR */
3692 expansion_test /* expansion testing */
3693 || /* OR */
3694 filter_test != FTEST_NONE) /* Filter testing */
3695 {
3696 setgroups(group_count, group_list);
3697 exim_setugid(real_uid, real_gid, FALSE,
3698 US"-C, -D, -be or -bf forces real uid");
3699 removed_privilege = TRUE;
3700
3701 /* In the normal case when Exim is called like this, stderr is available
3702 and should be used for any logging information because attempts to write
3703 to the log will usually fail. To arrange this, we unset really_exim. However,
3704 if no stderr is available there is no point - we might as well have a go
3705 at the log (if it fails, syslog will be written).
3706
3707 Note that if the invoker is Exim, the logs remain available. Messing with
3708 this causes unlogged successful deliveries. */
3709
3710 if ((log_stderr != NULL) && (real_uid != exim_uid))
3711 really_exim = FALSE;
3712 }
3713
3714 /* Privilege is to be retained for the moment. It may be dropped later,
3715 depending on the job that this Exim process has been asked to do. For now, set
3716 the real uid to the effective so that subsequent re-execs of Exim are done by a
3717 privileged user. */
3718
3719 else exim_setugid(geteuid(), getegid(), FALSE, US"forcing real = effective");
3720
3721 /* If testing a filter, open the file(s) now, before wasting time doing other
3722 setups and reading the message. */
3723
3724 if ((filter_test & FTEST_SYSTEM) != 0)
3725 {
3726 filter_sfd = Uopen(filter_test_sfile, O_RDONLY, 0);
3727 if (filter_sfd < 0)
3728 {
3729 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_sfile,
3730 strerror(errno));
3731 return EXIT_FAILURE;
3732 }
3733 }
3734
3735 if ((filter_test & FTEST_USER) != 0)
3736 {
3737 filter_ufd = Uopen(filter_test_ufile, O_RDONLY, 0);
3738 if (filter_ufd < 0)
3739 {
3740 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_ufile,
3741 strerror(errno));
3742 return EXIT_FAILURE;
3743 }
3744 }
3745
3746 /* Initialise lookup_list
3747 If debugging, already called above via version reporting.
3748 In either case, we initialise the list of available lookups while running
3749 as root. All dynamically modules are loaded from a directory which is
3750 hard-coded into the binary and is code which, if not a module, would be
3751 part of Exim already. Ability to modify the content of the directory
3752 is equivalent to the ability to modify a setuid binary!
3753
3754 This needs to happen before we read the main configuration. */
3755 init_lookup_list();
3756
3757 #ifdef SUPPORT_I18N
3758 if (running_in_test_harness) smtputf8_advertise_hosts = NULL;
3759 #endif
3760
3761 /* Read the main runtime configuration data; this gives up if there
3762 is a failure. It leaves the configuration file open so that the subsequent
3763 configuration data for delivery can be read if needed.
3764
3765 NOTE: immediatly after opening the configuration file we change the working
3766 directory to "/"! Later we change to $spool_directory. We do it there, because
3767 during readconf_main() some expansion takes place already. */
3768
3769 /* Store the initial cwd before we change directories */
3770 if ((initial_cwd = os_getcwd(NULL, 0)) == NULL)
3771 {
3772 perror("exim: can't get the current working directory");
3773 exit(EXIT_FAILURE);
3774 }
3775
3776 /* checking:
3777 -be[m] expansion test -
3778 -b[fF] filter test new
3779 -bh[c] host test -
3780 -bmalware malware_test_file new
3781 -brt retry test new
3782 -brw rewrite test new
3783 -bt address test -
3784 -bv[s] address verify -
3785 list_options:
3786 -bP <option> (except -bP config, which sets list_config)
3787
3788 If any of these options is set, we suppress warnings about configuration
3789 issues (currently about tls_advertise_hosts and keep_environment not being
3790 defined) */
3791
3792 readconf_main(checking || list_options);
3793
3794 /* Now in directory "/" */
3795
3796 if (cleanup_environment() == FALSE)
3797 log_write(0, LOG_PANIC_DIE, "Can't cleanup environment");
3798
3799
3800 /* If an action on specific messages is requested, or if a daemon or queue
3801 runner is being started, we need to know if Exim was called by an admin user.
3802 This is the case if the real user is root or exim, or if the real group is
3803 exim, or if one of the supplementary groups is exim or a group listed in
3804 admin_groups. We don't fail all message actions immediately if not admin_user,
3805 since some actions can be performed by non-admin users. Instead, set admin_user
3806 for later interrogation. */
3807
3808 if (real_uid == root_uid || real_uid == exim_uid || real_gid == exim_gid)
3809 admin_user = TRUE;
3810 else
3811 {
3812 int i, j;
3813 for (i = 0; i < group_count; i++)
3814 {
3815 if (group_list[i] == exim_gid) admin_user = TRUE;
3816 else if (admin_groups != NULL)
3817 {
3818 for (j = 1; j <= (int)(admin_groups[0]); j++)
3819 if (admin_groups[j] == group_list[i])
3820 { admin_user = TRUE; break; }
3821 }
3822 if (admin_user) break;
3823 }
3824 }
3825
3826 /* Another group of privileged users are the trusted users. These are root,
3827 exim, and any caller matching trusted_users or trusted_groups. Trusted callers
3828 are permitted to specify sender_addresses with -f on the command line, and
3829 other message parameters as well. */
3830
3831 if (real_uid == root_uid || real_uid == exim_uid)
3832 trusted_caller = TRUE;
3833 else
3834 {
3835 int i, j;
3836
3837 if (trusted_users != NULL)
3838 {
3839 for (i = 1; i <= (int)(trusted_users[0]); i++)
3840 if (trusted_users[i] == real_uid)
3841 { trusted_caller = TRUE; break; }
3842 }
3843
3844 if (!trusted_caller && trusted_groups != NULL)
3845 {
3846 for (i = 1; i <= (int)(trusted_groups[0]); i++)
3847 {
3848 if (trusted_groups[i] == real_gid)
3849 trusted_caller = TRUE;
3850 else for (j = 0; j < group_count; j++)
3851 {
3852 if (trusted_groups[i] == group_list[j])
3853 { trusted_caller = TRUE; break; }
3854 }
3855 if (trusted_caller) break;
3856 }
3857 }
3858 }
3859
3860 /* Handle the decoding of logging options. */
3861
3862 decode_bits(log_selector, log_selector_size, log_notall,
3863 log_selector_string, log_options, log_options_count, US"log", 0);
3864
3865 DEBUG(D_any)
3866 {
3867 int i;
3868 debug_printf("configuration file is %s\n", config_main_filename);
3869 debug_printf("log selectors =");
3870 for (i = 0; i < log_selector_size; i++)
3871 debug_printf(" %08x", log_selector[i]);
3872 debug_printf("\n");
3873 }
3874
3875 /* If domain literals are not allowed, check the sender address that was
3876 supplied with -f. Ditto for a stripped trailing dot. */
3877
3878 if (sender_address != NULL)
3879 {
3880 if (sender_address[sender_address_domain] == '[' && !allow_domain_literals)
3881 {
3882 fprintf(stderr, "exim: bad -f address \"%s\": domain literals not "
3883 "allowed\n", sender_address);
3884 return EXIT_FAILURE;
3885 }
3886 if (f_end_dot && !strip_trailing_dot)
3887 {
3888 fprintf(stderr, "exim: bad -f address \"%s.\": domain is malformed "
3889 "(trailing dot not allowed)\n", sender_address);
3890 return EXIT_FAILURE;
3891 }
3892 }
3893
3894 /* See if an admin user overrode our logging. */
3895
3896 if (cmdline_syslog_name != NULL)
3897 {
3898 if (admin_user)
3899 {
3900 syslog_processname = cmdline_syslog_name;
3901 log_file_path = string_copy(CUS"syslog");
3902 }
3903 else
3904 {
3905 /* not a panic, non-privileged users should not be able to spam paniclog */
3906 fprintf(stderr,
3907 "exim: you lack sufficient privilege to specify syslog process name\n");
3908 return EXIT_FAILURE;
3909 }
3910 }
3911
3912 /* Paranoia check of maximum lengths of certain strings. There is a check
3913 on the length of the log file path in log.c, which will come into effect
3914 if there are any calls to write the log earlier than this. However, if we
3915 get this far but the string is very long, it is better to stop now than to
3916 carry on and (e.g.) receive a message and then have to collapse. The call to
3917 log_write() from here will cause the ultimate panic collapse if the complete
3918 file name exceeds the buffer length. */
3919
3920 if (Ustrlen(log_file_path) > 200)
3921 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3922 "log_file_path is longer than 200 chars: aborting");
3923
3924 if (Ustrlen(pid_file_path) > 200)
3925 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3926 "pid_file_path is longer than 200 chars: aborting");
3927
3928 if (Ustrlen(spool_directory) > 200)
3929 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3930 "spool_directory is longer than 200 chars: aborting");
3931
3932 /* Length check on the process name given to syslog for its TAG field,
3933 which is only permitted to be 32 characters or less. See RFC 3164. */
3934
3935 if (Ustrlen(syslog_processname) > 32)
3936 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3937 "syslog_processname is longer than 32 chars: aborting");
3938
3939 if (log_oneline)
3940 if (admin_user)
3941 {
3942 log_write(0, LOG_MAIN, "%s", log_oneline);
3943 return EXIT_SUCCESS;
3944 }
3945 else
3946 return EXIT_FAILURE;
3947
3948 /* In some operating systems, the environment variable TMPDIR controls where
3949 temporary files are created; Exim doesn't use these (apart from when delivering
3950 to MBX mailboxes), but called libraries such as DBM libraries may require them.
3951 If TMPDIR is found in the environment, reset it to the value defined in the
3952 EXIM_TMPDIR macro, if this macro is defined. For backward compatibility this
3953 macro may be called TMPDIR in old "Local/Makefile"s. It's converted to
3954 EXIM_TMPDIR by the build scripts.
3955 */
3956
3957 #ifdef EXIM_TMPDIR
3958 {
3959 uschar **p;
3960 if (environ) for (p = USS environ; *p; p++)
3961 if (Ustrncmp(*p, "TMPDIR=", 7) == 0 && Ustrcmp(*p+7, EXIM_TMPDIR) != 0)
3962 {
3963 uschar * newp = store_malloc(Ustrlen(EXIM_TMPDIR) + 8);
3964 sprintf(CS newp, "TMPDIR=%s", EXIM_TMPDIR);
3965 *p = newp;
3966 DEBUG(D_any) debug_printf("reset TMPDIR=%s in environment\n", EXIM_TMPDIR);
3967 }
3968 }
3969 #endif
3970
3971 /* Timezone handling. If timezone_string is "utc", set a flag to cause all
3972 timestamps to be in UTC (gmtime() is used instead of localtime()). Otherwise,
3973 we may need to get rid of a bogus timezone setting. This can arise when Exim is
3974 called by a user who has set the TZ variable. This then affects the timestamps
3975 in log files and in Received: headers, and any created Date: header lines. The
3976 required timezone is settable in the configuration file, so nothing can be done
3977 about this earlier - but hopefully nothing will normally be logged earlier than
3978 this. We have to make a new environment if TZ is wrong, but don't bother if
3979 timestamps_utc is set, because then all times are in UTC anyway. */
3980
3981 if (timezone_string && strcmpic(timezone_string, US"UTC") == 0)
3982 timestamps_utc = TRUE;
3983 else
3984 {
3985 uschar *envtz = US getenv("TZ");
3986 if (envtz
3987 ? !timezone_string || Ustrcmp(timezone_string, envtz) != 0
3988 : timezone_string != NULL
3989 )
3990 {
3991 uschar **p = USS environ;
3992 uschar **new;
3993 uschar **newp;
3994 int count = 0;
3995 if (environ) while (*p++) count++;
3996 if (!envtz) count++;
3997 newp = new = store_malloc(sizeof(uschar *) * (count + 1));
3998 if (environ) for (p = USS environ; *p; p++)
3999 if (Ustrncmp(*p, "TZ=", 3) != 0) *newp++ = *p;
4000 if (timezone_string)
4001 {
4002 *newp = store_malloc(Ustrlen(timezone_string) + 4);
4003 sprintf(CS *newp++, "TZ=%s", timezone_string);
4004 }
4005 *newp = NULL;
4006 environ = CSS new;
4007 tzset();
4008 DEBUG(D_any) debug_printf("Reset TZ to %s: time is %s\n", timezone_string,
4009 tod_stamp(tod_log));
4010 }
4011 }
4012
4013 /* Handle the case when we have removed the setuid privilege because of -C or
4014 -D. This means that the caller of Exim was not root.
4015
4016 There is a problem if we were running as the Exim user. The sysadmin may
4017 expect this case to retain privilege because "the binary was called by the
4018 Exim user", but it hasn't, because either the -D option set macros, or the
4019 -C option set a non-trusted configuration file. There are two possibilities:
4020
4021 (1) If deliver_drop_privilege is set, Exim is not going to re-exec in order
4022 to do message deliveries. Thus, the fact that it is running as a
4023 non-privileged user is plausible, and might be wanted in some special
4024 configurations. However, really_exim will have been set false when
4025 privilege was dropped, to stop Exim trying to write to its normal log
4026 files. Therefore, re-enable normal log processing, assuming the sysadmin
4027 has set up the log directory correctly.
4028
4029 (2) If deliver_drop_privilege is not set, the configuration won't work as
4030 apparently intended, and so we log a panic message. In order to retain
4031 root for -C or -D, the caller must either be root or be invoking a
4032 trusted configuration file (when deliver_drop_privilege is false). */
4033
4034 if (removed_privilege && (!trusted_config || macros != NULL) &&
4035 real_uid == exim_uid)
4036 {
4037 if (deliver_drop_privilege)
4038 really_exim = TRUE; /* let logging work normally */
4039 else
4040 log_write(0, LOG_MAIN|LOG_PANIC,
4041 "exim user lost privilege for using %s option",
4042 trusted_config? "-D" : "-C");
4043 }
4044
4045 /* Start up Perl interpreter if Perl support is configured and there is a
4046 perl_startup option, and the configuration or the command line specifies
4047 initializing starting. Note that the global variables are actually called
4048 opt_perl_xxx to avoid clashing with perl's namespace (perl_*). */
4049
4050 #ifdef EXIM_PERL
4051 if (perl_start_option != 0)
4052 opt_perl_at_start = (perl_start_option > 0);
4053 if (opt_perl_at_start && opt_perl_startup != NULL)
4054 {
4055 uschar *errstr;
4056 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
4057 errstr = init_perl(opt_perl_startup);
4058 if (errstr != NULL)
4059 {
4060 fprintf(stderr, "exim: error in perl_startup code: %s\n", errstr);
4061 return EXIT_FAILURE;
4062 }
4063 opt_perl_started = TRUE;
4064 }
4065 #endif /* EXIM_PERL */
4066
4067 /* Log the arguments of the call if the configuration file said so. This is
4068 a debugging feature for finding out what arguments certain MUAs actually use.
4069 Don't attempt it if logging is disabled, or if listing variables or if
4070 verifying/testing addresses or expansions. */
4071
4072 if (((debug_selector & D_any) != 0 || LOGGING(arguments))
4073 && really_exim && !list_options && !checking)
4074 {
4075 int i;
4076 uschar *p = big_buffer;
4077 Ustrcpy(p, "cwd= (failed)");
4078
4079 Ustrncpy(p + 4, initial_cwd, big_buffer_size-5);
4080
4081 while (*p) p++;
4082 (void)string_format(p, big_buffer_size - (p - big_buffer), " %d args:", argc);
4083 while (*p) p++;
4084 for (i = 0; i < argc; i++)
4085 {
4086 int len = Ustrlen(argv[i]);
4087 const uschar *printing;
4088 uschar *quote;
4089 if (p + len + 8 >= big_buffer + big_buffer_size)
4090 {
4091 Ustrcpy(p, " ...");
4092 log_write(0, LOG_MAIN, "%s", big_buffer);
4093 Ustrcpy(big_buffer, "...");
4094 p = big_buffer + 3;
4095 }
4096 printing = string_printing(argv[i]);
4097 if (printing[0] == 0) quote = US"\""; else
4098 {
4099 const uschar *pp = printing;
4100 quote = US"";
4101 while (*pp != 0) if (isspace(*pp++)) { quote = US"\""; break; }
4102 }
4103 sprintf(CS p, " %s%.*s%s", quote, (int)(big_buffer_size -
4104 (p - big_buffer) - 4), printing, quote);
4105 while (*p) p++;
4106 }
4107
4108 if (LOGGING(arguments))
4109 log_write(0, LOG_MAIN, "%s", big_buffer);
4110 else
4111 debug_printf("%s\n", big_buffer);
4112 }
4113
4114 /* Set the working directory to be the top-level spool directory. We don't rely
4115 on this in the code, which always uses fully qualified names, but it's useful
4116 for core dumps etc. Don't complain if it fails - the spool directory might not
4117 be generally accessible and calls with the -C option (and others) have lost
4118 privilege by now. Before the chdir, we try to ensure that the directory exists.
4119 */
4120
4121 if (Uchdir(spool_directory) != 0)
4122 {
4123 int dummy;
4124 (void)directory_make(spool_directory, US"", SPOOL_DIRECTORY_MODE, FALSE);
4125 dummy = /* quieten compiler */ Uchdir(spool_directory);
4126 }
4127
4128 /* Handle calls with the -bi option. This is a sendmail option to rebuild *the*
4129 alias file. Exim doesn't have such a concept, but this call is screwed into
4130 Sun's YP makefiles. Handle this by calling a configured script, as the real
4131 user who called Exim. The -oA option can be used to pass an argument to the
4132 script. */
4133
4134 if (bi_option)
4135 {
4136 (void)fclose(config_file);
4137 if (bi_command != NULL)