c368e590695f312a369d4b6ebcf14fbeab17d683
[exim.git] / src / src / exim.c
1 /* $Cambridge: exim/src/src/exim.c,v 1.71 2010/06/07 00:12:42 pdp Exp $ */
2
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
6
7 /* Copyright (c) University of Cambridge 1995 - 2009 */
8 /* See the file NOTICE for conditions of use and distribution. */
9
10
11 /* The main function: entry point, initialization, and high-level control.
12 Also a few functions that don't naturally fit elsewhere. */
13
14
15 #include "exim.h"
16
17 extern void init_lookup_list(void);
18
19
20
21 /*************************************************
22 * Function interface to store functions *
23 *************************************************/
24
25 /* We need some real functions to pass to the PCRE regular expression library
26 for store allocation via Exim's store manager. The normal calls are actually
27 macros that pass over location information to make tracing easier. These
28 functions just interface to the standard macro calls. A good compiler will
29 optimize out the tail recursion and so not make them too expensive. There
30 are two sets of functions; one for use when we want to retain the compiled
31 regular expression for a long time; the other for short-term use. */
32
33 static void *
34 function_store_get(size_t size)
35 {
36 return store_get((int)size);
37 }
38
39 static void
40 function_dummy_free(void *block) { block = block; }
41
42 static void *
43 function_store_malloc(size_t size)
44 {
45 return store_malloc((int)size);
46 }
47
48 static void
49 function_store_free(void *block)
50 {
51 store_free(block);
52 }
53
54
55
56
57 /*************************************************
58 * Compile regular expression and panic on fail *
59 *************************************************/
60
61 /* This function is called when failure to compile a regular expression leads
62 to a panic exit. In other cases, pcre_compile() is called directly. In many
63 cases where this function is used, the results of the compilation are to be
64 placed in long-lived store, so we temporarily reset the store management
65 functions that PCRE uses if the use_malloc flag is set.
66
67 Argument:
68 pattern the pattern to compile
69 caseless TRUE if caseless matching is required
70 use_malloc TRUE if compile into malloc store
71
72 Returns: pointer to the compiled pattern
73 */
74
75 const pcre *
76 regex_must_compile(uschar *pattern, BOOL caseless, BOOL use_malloc)
77 {
78 int offset;
79 int options = PCRE_COPT;
80 const pcre *yield;
81 const uschar *error;
82 if (use_malloc)
83 {
84 pcre_malloc = function_store_malloc;
85 pcre_free = function_store_free;
86 }
87 if (caseless) options |= PCRE_CASELESS;
88 yield = pcre_compile(CS pattern, options, (const char **)&error, &offset, NULL);
89 pcre_malloc = function_store_get;
90 pcre_free = function_dummy_free;
91 if (yield == NULL)
92 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "regular expression error: "
93 "%s at offset %d while compiling %s", error, offset, pattern);
94 return yield;
95 }
96
97
98
99
100 /*************************************************
101 * Execute regular expression and set strings *
102 *************************************************/
103
104 /* This function runs a regular expression match, and sets up the pointers to
105 the matched substrings.
106
107 Arguments:
108 re the compiled expression
109 subject the subject string
110 options additional PCRE options
111 setup if < 0 do full setup
112 if >= 0 setup from setup+1 onwards,
113 excluding the full matched string
114
115 Returns: TRUE or FALSE
116 */
117
118 BOOL
119 regex_match_and_setup(const pcre *re, uschar *subject, int options, int setup)
120 {
121 int ovector[3*(EXPAND_MAXN+1)];
122 int n = pcre_exec(re, NULL, CS subject, Ustrlen(subject), 0,
123 PCRE_EOPT | options, ovector, sizeof(ovector)/sizeof(int));
124 BOOL yield = n >= 0;
125 if (n == 0) n = EXPAND_MAXN + 1;
126 if (yield)
127 {
128 int nn;
129 expand_nmax = (setup < 0)? 0 : setup + 1;
130 for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
131 {
132 expand_nstring[expand_nmax] = subject + ovector[nn];
133 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
134 }
135 expand_nmax--;
136 }
137 return yield;
138 }
139
140
141
142
143 /*************************************************
144 * Handler for SIGUSR1 *
145 *************************************************/
146
147 /* SIGUSR1 causes any exim process to write to the process log details of
148 what it is currently doing. It will only be used if the OS is capable of
149 setting up a handler that causes automatic restarting of any system call
150 that is in progress at the time.
151
152 Argument: the signal number (SIGUSR1)
153 Returns: nothing
154 */
155
156 static void
157 usr1_handler(int sig)
158 {
159 sig = sig; /* Keep picky compilers happy */
160 log_write(0, LOG_PROCESS, "%s", process_info);
161 log_close_all();
162 os_restarting_signal(SIGUSR1, usr1_handler);
163 }
164
165
166
167 /*************************************************
168 * Timeout handler *
169 *************************************************/
170
171 /* This handler is enabled most of the time that Exim is running. The handler
172 doesn't actually get used unless alarm() has been called to set a timer, to
173 place a time limit on a system call of some kind. When the handler is run, it
174 re-enables itself.
175
176 There are some other SIGALRM handlers that are used in special cases when more
177 than just a flag setting is required; for example, when reading a message's
178 input. These are normally set up in the code module that uses them, and the
179 SIGALRM handler is reset to this one afterwards.
180
181 Argument: the signal value (SIGALRM)
182 Returns: nothing
183 */
184
185 void
186 sigalrm_handler(int sig)
187 {
188 sig = sig; /* Keep picky compilers happy */
189 sigalrm_seen = TRUE;
190 os_non_restarting_signal(SIGALRM, sigalrm_handler);
191 }
192
193
194
195 /*************************************************
196 * Sleep for a fractional time interval *
197 *************************************************/
198
199 /* This function is called by millisleep() and exim_wait_tick() to wait for a
200 period of time that may include a fraction of a second. The coding is somewhat
201 tedious. We do not expect setitimer() ever to fail, but if it does, the process
202 will wait for ever, so we panic in this instance. (There was a case of this
203 when a bug in a function that calls milliwait() caused it to pass invalid data.
204 That's when I added the check. :-)
205
206 Argument: an itimerval structure containing the interval
207 Returns: nothing
208 */
209
210 static void
211 milliwait(struct itimerval *itval)
212 {
213 sigset_t sigmask;
214 sigset_t old_sigmask;
215 (void)sigemptyset(&sigmask); /* Empty mask */
216 (void)sigaddset(&sigmask, SIGALRM); /* Add SIGALRM */
217 (void)sigprocmask(SIG_BLOCK, &sigmask, &old_sigmask); /* Block SIGALRM */
218 if (setitimer(ITIMER_REAL, itval, NULL) < 0) /* Start timer */
219 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
220 "setitimer() failed: %s", strerror(errno));
221 (void)sigfillset(&sigmask); /* All signals */
222 (void)sigdelset(&sigmask, SIGALRM); /* Remove SIGALRM */
223 (void)sigsuspend(&sigmask); /* Until SIGALRM */
224 (void)sigprocmask(SIG_SETMASK, &old_sigmask, NULL); /* Restore mask */
225 }
226
227
228
229
230 /*************************************************
231 * Millisecond sleep function *
232 *************************************************/
233
234 /* The basic sleep() function has a granularity of 1 second, which is too rough
235 in some cases - for example, when using an increasing delay to slow down
236 spammers.
237
238 Argument: number of millseconds
239 Returns: nothing
240 */
241
242 void
243 millisleep(int msec)
244 {
245 struct itimerval itval;
246 itval.it_interval.tv_sec = 0;
247 itval.it_interval.tv_usec = 0;
248 itval.it_value.tv_sec = msec/1000;
249 itval.it_value.tv_usec = (msec % 1000) * 1000;
250 milliwait(&itval);
251 }
252
253
254
255 /*************************************************
256 * Compare microsecond times *
257 *************************************************/
258
259 /*
260 Arguments:
261 tv1 the first time
262 tv2 the second time
263
264 Returns: -1, 0, or +1
265 */
266
267 int
268 exim_tvcmp(struct timeval *t1, struct timeval *t2)
269 {
270 if (t1->tv_sec > t2->tv_sec) return +1;
271 if (t1->tv_sec < t2->tv_sec) return -1;
272 if (t1->tv_usec > t2->tv_usec) return +1;
273 if (t1->tv_usec < t2->tv_usec) return -1;
274 return 0;
275 }
276
277
278
279
280 /*************************************************
281 * Clock tick wait function *
282 *************************************************/
283
284 /* Exim uses a time + a pid to generate a unique identifier in two places: its
285 message IDs, and in file names for maildir deliveries. Because some OS now
286 re-use pids within the same second, sub-second times are now being used.
287 However, for absolute certaintly, we must ensure the clock has ticked before
288 allowing the relevant process to complete. At the time of implementation of
289 this code (February 2003), the speed of processors is such that the clock will
290 invariably have ticked already by the time a process has done its job. This
291 function prepares for the time when things are faster - and it also copes with
292 clocks that go backwards.
293
294 Arguments:
295 then_tv A timeval which was used to create uniqueness; its usec field
296 has been rounded down to the value of the resolution.
297 We want to be sure the current time is greater than this.
298 resolution The resolution that was used to divide the microseconds
299 (1 for maildir, larger for message ids)
300
301 Returns: nothing
302 */
303
304 void
305 exim_wait_tick(struct timeval *then_tv, int resolution)
306 {
307 struct timeval now_tv;
308 long int now_true_usec;
309
310 (void)gettimeofday(&now_tv, NULL);
311 now_true_usec = now_tv.tv_usec;
312 now_tv.tv_usec = (now_true_usec/resolution) * resolution;
313
314 if (exim_tvcmp(&now_tv, then_tv) <= 0)
315 {
316 struct itimerval itval;
317 itval.it_interval.tv_sec = 0;
318 itval.it_interval.tv_usec = 0;
319 itval.it_value.tv_sec = then_tv->tv_sec - now_tv.tv_sec;
320 itval.it_value.tv_usec = then_tv->tv_usec + resolution - now_true_usec;
321
322 /* We know that, overall, "now" is less than or equal to "then". Therefore, a
323 negative value for the microseconds is possible only in the case when "now"
324 is more than a second less than "then". That means that itval.it_value.tv_sec
325 is greater than zero. The following correction is therefore safe. */
326
327 if (itval.it_value.tv_usec < 0)
328 {
329 itval.it_value.tv_usec += 1000000;
330 itval.it_value.tv_sec -= 1;
331 }
332
333 DEBUG(D_transport|D_receive)
334 {
335 if (!running_in_test_harness)
336 {
337 debug_printf("tick check: %lu.%06lu %lu.%06lu\n",
338 then_tv->tv_sec, then_tv->tv_usec, now_tv.tv_sec, now_tv.tv_usec);
339 debug_printf("waiting %lu.%06lu\n", itval.it_value.tv_sec,
340 itval.it_value.tv_usec);
341 }
342 }
343
344 milliwait(&itval);
345 }
346 }
347
348
349
350
351 /*************************************************
352 * Set up processing details *
353 *************************************************/
354
355 /* Save a text string for dumping when SIGUSR1 is received.
356 Do checks for overruns.
357
358 Arguments: format and arguments, as for printf()
359 Returns: nothing
360 */
361
362 void
363 set_process_info(char *format, ...)
364 {
365 int len;
366 va_list ap;
367 sprintf(CS process_info, "%5d ", (int)getpid());
368 len = Ustrlen(process_info);
369 va_start(ap, format);
370 if (!string_vformat(process_info + len, PROCESS_INFO_SIZE - len, format, ap))
371 Ustrcpy(process_info + len, "**** string overflowed buffer ****");
372 DEBUG(D_process_info) debug_printf("set_process_info: %s\n", process_info);
373 va_end(ap);
374 }
375
376
377
378
379
380 /*************************************************
381 * Call fopen() with umask 777 and adjust mode *
382 *************************************************/
383
384 /* Exim runs with umask(0) so that files created with open() have the mode that
385 is specified in the open() call. However, there are some files, typically in
386 the spool directory, that are created with fopen(). They end up world-writeable
387 if no precautions are taken. Although the spool directory is not accessible to
388 the world, this is an untidiness. So this is a wrapper function for fopen()
389 that sorts out the mode of the created file.
390
391 Arguments:
392 filename the file name
393 options the fopen() options
394 mode the required mode
395
396 Returns: the fopened FILE or NULL
397 */
398
399 FILE *
400 modefopen(uschar *filename, char *options, mode_t mode)
401 {
402 mode_t saved_umask = umask(0777);
403 FILE *f = Ufopen(filename, options);
404 (void)umask(saved_umask);
405 if (f != NULL) (void)fchmod(fileno(f), mode);
406 return f;
407 }
408
409
410
411
412 /*************************************************
413 * Ensure stdin, stdout, and stderr exist *
414 *************************************************/
415
416 /* Some operating systems grumble if an exec() happens without a standard
417 input, output, and error (fds 0, 1, 2) being defined. The worry is that some
418 file will be opened and will use these fd values, and then some other bit of
419 code will assume, for example, that it can write error messages to stderr.
420 This function ensures that fds 0, 1, and 2 are open if they do not already
421 exist, by connecting them to /dev/null.
422
423 This function is also used to ensure that std{in,out,err} exist at all times,
424 so that if any library that Exim calls tries to use them, it doesn't crash.
425
426 Arguments: None
427 Returns: Nothing
428 */
429
430 void
431 exim_nullstd(void)
432 {
433 int i;
434 int devnull = -1;
435 struct stat statbuf;
436 for (i = 0; i <= 2; i++)
437 {
438 if (fstat(i, &statbuf) < 0 && errno == EBADF)
439 {
440 if (devnull < 0) devnull = open("/dev/null", O_RDWR);
441 if (devnull < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
442 string_open_failed(errno, "/dev/null"));
443 if (devnull != i) (void)dup2(devnull, i);
444 }
445 }
446 if (devnull > 2) (void)close(devnull);
447 }
448
449
450
451
452 /*************************************************
453 * Close unwanted file descriptors for delivery *
454 *************************************************/
455
456 /* This function is called from a new process that has been forked to deliver
457 an incoming message, either directly, or using exec.
458
459 We want any smtp input streams to be closed in this new process. However, it
460 has been observed that using fclose() here causes trouble. When reading in -bS
461 input, duplicate copies of messages have been seen. The files will be sharing a
462 file pointer with the parent process, and it seems that fclose() (at least on
463 some systems - I saw this on Solaris 2.5.1) messes with that file pointer, at
464 least sometimes. Hence we go for closing the underlying file descriptors.
465
466 If TLS is active, we want to shut down the TLS library, but without molesting
467 the parent's SSL connection.
468
469 For delivery of a non-SMTP message, we want to close stdin and stdout (and
470 stderr unless debugging) because the calling process might have set them up as
471 pipes and be waiting for them to close before it waits for the submission
472 process to terminate. If they aren't closed, they hold up the calling process
473 until the initial delivery process finishes, which is not what we want.
474
475 Exception: We do want it for synchronous delivery!
476
477 And notwithstanding all the above, if D_resolver is set, implying resolver
478 debugging, leave stdout open, because that's where the resolver writes its
479 debugging output.
480
481 When we close stderr (which implies we've also closed stdout), we also get rid
482 of any controlling terminal.
483
484 Arguments: None
485 Returns: Nothing
486 */
487
488 static void
489 close_unwanted(void)
490 {
491 if (smtp_input)
492 {
493 #ifdef SUPPORT_TLS
494 tls_close(FALSE); /* Shut down the TLS library */
495 #endif
496 (void)close(fileno(smtp_in));
497 (void)close(fileno(smtp_out));
498 smtp_in = NULL;
499 }
500 else
501 {
502 (void)close(0); /* stdin */
503 if ((debug_selector & D_resolver) == 0) (void)close(1); /* stdout */
504 if (debug_selector == 0) /* stderr */
505 {
506 if (!synchronous_delivery)
507 {
508 (void)close(2);
509 log_stderr = NULL;
510 }
511 (void)setsid();
512 }
513 }
514 }
515
516
517
518
519 /*************************************************
520 * Set uid and gid *
521 *************************************************/
522
523 /* This function sets a new uid and gid permanently, optionally calling
524 initgroups() to set auxiliary groups. There are some special cases when running
525 Exim in unprivileged modes. In these situations the effective uid will not be
526 root; if we already have the right effective uid/gid, and don't need to
527 initialize any groups, leave things as they are.
528
529 Arguments:
530 uid the uid
531 gid the gid
532 igflag TRUE if initgroups() wanted
533 msg text to use in debugging output and failure log
534
535 Returns: nothing; bombs out on failure
536 */
537
538 void
539 exim_setugid(uid_t uid, gid_t gid, BOOL igflag, uschar *msg)
540 {
541 uid_t euid = geteuid();
542 gid_t egid = getegid();
543
544 if (euid == root_uid || euid != uid || egid != gid || igflag)
545 {
546 /* At least one OS returns +1 for initgroups failure, so just check for
547 non-zero. */
548
549 if (igflag)
550 {
551 struct passwd *pw = getpwuid(uid);
552 if (pw != NULL)
553 {
554 if (initgroups(pw->pw_name, gid) != 0)
555 log_write(0,LOG_MAIN|LOG_PANIC_DIE,"initgroups failed for uid=%ld: %s",
556 (long int)uid, strerror(errno));
557 }
558 else log_write(0, LOG_MAIN|LOG_PANIC_DIE, "cannot run initgroups(): "
559 "no passwd entry for uid=%ld", (long int)uid);
560 }
561
562 if (setgid(gid) < 0 || setuid(uid) < 0)
563 {
564 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to set gid=%ld or uid=%ld "
565 "(euid=%ld): %s", (long int)gid, (long int)uid, (long int)euid, msg);
566 }
567 }
568
569 /* Debugging output included uid/gid and all groups */
570
571 DEBUG(D_uid)
572 {
573 int group_count, save_errno;
574 gid_t group_list[NGROUPS_MAX];
575 debug_printf("changed uid/gid: %s\n uid=%ld gid=%ld pid=%ld\n", msg,
576 (long int)geteuid(), (long int)getegid(), (long int)getpid());
577 group_count = getgroups(NGROUPS_MAX, group_list);
578 save_errno = errno;
579 debug_printf(" auxiliary group list:");
580 if (group_count > 0)
581 {
582 int i;
583 for (i = 0; i < group_count; i++) debug_printf(" %d", (int)group_list[i]);
584 }
585 else if (group_count < 0)
586 debug_printf(" <error: %s>", strerror(save_errno));
587 else debug_printf(" <none>");
588 debug_printf("\n");
589 }
590 }
591
592
593
594
595 /*************************************************
596 * Exit point *
597 *************************************************/
598
599 /* Exim exits via this function so that it always clears up any open
600 databases.
601
602 Arguments:
603 rc return code
604
605 Returns: does not return
606 */
607
608 void
609 exim_exit(int rc)
610 {
611 search_tidyup();
612 DEBUG(D_any)
613 debug_printf(">>>>>>>>>>>>>>>> Exim pid=%d terminating with rc=%d "
614 ">>>>>>>>>>>>>>>>\n", (int)getpid(), rc);
615 exit(rc);
616 }
617
618
619
620
621 /*************************************************
622 * Extract port from host address *
623 *************************************************/
624
625 /* Called to extract the port from the values given to -oMa and -oMi.
626 It also checks the syntax of the address, and terminates it before the
627 port data when a port is extracted.
628
629 Argument:
630 address the address, with possible port on the end
631
632 Returns: the port, or zero if there isn't one
633 bombs out on a syntax error
634 */
635
636 static int
637 check_port(uschar *address)
638 {
639 int port = host_address_extract_port(address);
640 if (string_is_ip_address(address, NULL) == 0)
641 {
642 fprintf(stderr, "exim abandoned: \"%s\" is not an IP address\n", address);
643 exit(EXIT_FAILURE);
644 }
645 return port;
646 }
647
648
649
650 /*************************************************
651 * Test/verify an address *
652 *************************************************/
653
654 /* This function is called by the -bv and -bt code. It extracts a working
655 address from a full RFC 822 address. This isn't really necessary per se, but it
656 has the effect of collapsing source routes.
657
658 Arguments:
659 s the address string
660 flags flag bits for verify_address()
661 exit_value to be set for failures
662
663 Returns: nothing
664 */
665
666 static void
667 test_address(uschar *s, int flags, int *exit_value)
668 {
669 int start, end, domain;
670 uschar *parse_error = NULL;
671 uschar *address = parse_extract_address(s, &parse_error, &start, &end, &domain,
672 FALSE);
673 if (address == NULL)
674 {
675 fprintf(stdout, "syntax error: %s\n", parse_error);
676 *exit_value = 2;
677 }
678 else
679 {
680 int rc = verify_address(deliver_make_addr(address,TRUE), stdout, flags, -1,
681 -1, -1, NULL, NULL, NULL);
682 if (rc == FAIL) *exit_value = 2;
683 else if (rc == DEFER && *exit_value == 0) *exit_value = 1;
684 }
685 }
686
687
688
689 /*************************************************
690 * Show supported features *
691 *************************************************/
692
693 /* This function is called for -bV/--version and for -d to output the optional
694 features of the current Exim binary.
695
696 Arguments: a FILE for printing
697 Returns: nothing
698 */
699
700 static void
701 show_whats_supported(FILE *f)
702 {
703 #ifdef DB_VERSION_STRING
704 fprintf(f, "Berkeley DB: %s\n", DB_VERSION_STRING);
705 #elif defined(BTREEVERSION) && defined(HASHVERSION)
706 #ifdef USE_DB
707 fprintf(f, "Probably Berkeley DB version 1.8x (native mode)\n");
708 #else
709 fprintf(f, "Probably Berkeley DB version 1.8x (compatibility mode)\n");
710 #endif
711 #elif defined(_DBM_RDONLY) || defined(dbm_dirfno)
712 fprintf(f, "Probably ndbm\n");
713 #elif defined(USE_TDB)
714 fprintf(f, "Using tdb\n");
715 #else
716 #ifdef USE_GDBM
717 fprintf(f, "Probably GDBM (native mode)\n");
718 #else
719 fprintf(f, "Probably GDBM (compatibility mode)\n");
720 #endif
721 #endif
722
723 fprintf(f, "Support for:");
724 #ifdef SUPPORT_CRYPTEQ
725 fprintf(f, " crypteq");
726 #endif
727 #if HAVE_ICONV
728 fprintf(f, " iconv()");
729 #endif
730 #if HAVE_IPV6
731 fprintf(f, " IPv6");
732 #endif
733 #ifdef HAVE_SETCLASSRESOURCES
734 fprintf(f, " use_setclassresources");
735 #endif
736 #ifdef SUPPORT_PAM
737 fprintf(f, " PAM");
738 #endif
739 #ifdef EXIM_PERL
740 fprintf(f, " Perl");
741 #endif
742 #ifdef EXPAND_DLFUNC
743 fprintf(f, " Expand_dlfunc");
744 #endif
745 #ifdef USE_TCP_WRAPPERS
746 fprintf(f, " TCPwrappers");
747 #endif
748 #ifdef SUPPORT_TLS
749 #ifdef USE_GNUTLS
750 fprintf(f, " GnuTLS");
751 #else
752 fprintf(f, " OpenSSL");
753 #endif
754 #endif
755 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
756 fprintf(f, " translate_ip_address");
757 #endif
758 #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
759 fprintf(f, " move_frozen_messages");
760 #endif
761 #ifdef WITH_CONTENT_SCAN
762 fprintf(f, " Content_Scanning");
763 #endif
764 #ifndef DISABLE_DKIM
765 fprintf(f, " DKIM");
766 #endif
767 #ifdef WITH_OLD_DEMIME
768 fprintf(f, " Old_Demime");
769 #endif
770 #ifdef EXPERIMENTAL_SPF
771 fprintf(f, " Experimental_SPF");
772 #endif
773 #ifdef EXPERIMENTAL_SRS
774 fprintf(f, " Experimental_SRS");
775 #endif
776 #ifdef EXPERIMENTAL_BRIGHTMAIL
777 fprintf(f, " Experimental_Brightmail");
778 #endif
779 #ifdef EXPERIMENTAL_DCC
780 fprintf(f, " Experimental_DCC");
781 #endif
782 fprintf(f, "\n");
783
784 fprintf(f, "Lookups (built-in):");
785 #if defined(LOOKUP_LSEARCH) && LOOKUP_LSEARCH!=2
786 fprintf(f, " lsearch wildlsearch nwildlsearch iplsearch");
787 #endif
788 #if defined(LOOKUP_CDB) && LOOKUP_CDB!=2
789 fprintf(f, " cdb");
790 #endif
791 #if defined(LOOKUP_DBM) && LOOKUP_DBM!=2
792 fprintf(f, " dbm dbmnz");
793 #endif
794 #if defined(LOOKUP_DNSDB) && LOOKUP_DNSDB!=2
795 fprintf(f, " dnsdb");
796 #endif
797 #if defined(LOOKUP_DSEARCH) && LOOKUP_DSEARCH!=2
798 fprintf(f, " dsearch");
799 #endif
800 #if defined(LOOKUP_IBASE) && LOOKUP_IBASE!=2
801 fprintf(f, " ibase");
802 #endif
803 #if defined(LOOKUP_LDAP) && LOOKUP_LDAP!=2
804 fprintf(f, " ldap ldapdn ldapm");
805 #endif
806 #if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
807 fprintf(f, " mysql");
808 #endif
809 #if defined(LOOKUP_NIS) && LOOKUP_NIS!=2
810 fprintf(f, " nis nis0");
811 #endif
812 #if defined(LOOKUP_NISPLUS) && LOOKUP_NISPLUS!=2
813 fprintf(f, " nisplus");
814 #endif
815 #if defined(LOOKUP_ORACLE) && LOOKUP_ORACLE!=2
816 fprintf(f, " oracle");
817 #endif
818 #if defined(LOOKUP_PASSWD) && LOOKUP_PASSWD!=2
819 fprintf(f, " passwd");
820 #endif
821 #if defined(LOOKUP_PGSQL) && LOOKUP_PGSQL!=2
822 fprintf(f, " pgsql");
823 #endif
824 #if defined(LOOKUP_SQLITE) && LOOKUP_SQLITE!=2
825 fprintf(f, " sqlite");
826 #endif
827 #if defined(LOOKUP_TESTDB) && LOOKUP_TESTDB!=2
828 fprintf(f, " testdb");
829 #endif
830 #if defined(LOOKUP_WHOSON) && LOOKUP_WHOSON!=2
831 fprintf(f, " whoson");
832 #endif
833 fprintf(f, "\n");
834
835 fprintf(f, "Authenticators:");
836 #ifdef AUTH_CRAM_MD5
837 fprintf(f, " cram_md5");
838 #endif
839 #ifdef AUTH_CYRUS_SASL
840 fprintf(f, " cyrus_sasl");
841 #endif
842 #ifdef AUTH_DOVECOT
843 fprintf(f, " dovecot");
844 #endif
845 #ifdef AUTH_PLAINTEXT
846 fprintf(f, " plaintext");
847 #endif
848 #ifdef AUTH_SPA
849 fprintf(f, " spa");
850 #endif
851 fprintf(f, "\n");
852
853 fprintf(f, "Routers:");
854 #ifdef ROUTER_ACCEPT
855 fprintf(f, " accept");
856 #endif
857 #ifdef ROUTER_DNSLOOKUP
858 fprintf(f, " dnslookup");
859 #endif
860 #ifdef ROUTER_IPLITERAL
861 fprintf(f, " ipliteral");
862 #endif
863 #ifdef ROUTER_IPLOOKUP
864 fprintf(f, " iplookup");
865 #endif
866 #ifdef ROUTER_MANUALROUTE
867 fprintf(f, " manualroute");
868 #endif
869 #ifdef ROUTER_QUERYPROGRAM
870 fprintf(f, " queryprogram");
871 #endif
872 #ifdef ROUTER_REDIRECT
873 fprintf(f, " redirect");
874 #endif
875 fprintf(f, "\n");
876
877 fprintf(f, "Transports:");
878 #ifdef TRANSPORT_APPENDFILE
879 fprintf(f, " appendfile");
880 #ifdef SUPPORT_MAILDIR
881 fprintf(f, "/maildir");
882 #endif
883 #ifdef SUPPORT_MAILSTORE
884 fprintf(f, "/mailstore");
885 #endif
886 #ifdef SUPPORT_MBX
887 fprintf(f, "/mbx");
888 #endif
889 #endif
890 #ifdef TRANSPORT_AUTOREPLY
891 fprintf(f, " autoreply");
892 #endif
893 #ifdef TRANSPORT_LMTP
894 fprintf(f, " lmtp");
895 #endif
896 #ifdef TRANSPORT_PIPE
897 fprintf(f, " pipe");
898 #endif
899 #ifdef TRANSPORT_SMTP
900 fprintf(f, " smtp");
901 #endif
902 fprintf(f, "\n");
903
904 if (fixed_never_users[0] > 0)
905 {
906 int i;
907 fprintf(f, "Fixed never_users: ");
908 for (i = 1; i <= (int)fixed_never_users[0] - 1; i++)
909 fprintf(f, "%d:", (unsigned int)fixed_never_users[i]);
910 fprintf(f, "%d\n", (unsigned int)fixed_never_users[i]);
911 }
912
913 fprintf(f, "Size of off_t: " SIZE_T_FMT "\n", sizeof(off_t));
914
915 /* This runtime check is to help diagnose library linkage mismatches which
916 result in segfaults and the like; as such, it's left until the end,
917 just in case. There will still be a "Configuration file is" line still to
918 come. */
919 #ifdef SUPPORT_TLS
920 tls_version_report(f);
921 #endif
922
923 /* Everything else is details which are only worth reporting when debugging.
924 Perhaps the tls_version_report should move into this too. */
925 DEBUG(D_any) do {
926
927 int i;
928
929 #ifdef AUTH_CYRUS_SASL
930 auth_cyrus_sasl_version_report(f);
931 #endif
932
933 fprintf(f, "Library version: PCRE: Compile: %d.%d%s\n"
934 " Runtime: %s\n",
935 PCRE_MAJOR, PCRE_MINOR,
936 /* PRE_PRERELEASE is either defined and empty or a string.
937 * unless its an ancient version of PCRE in which case it
938 * is not defined */
939 #ifdef PCRE_PRERELEASE
940 PCRE_PRERELEASE "",
941 #else
942 "",
943 #endif
944 pcre_version());
945
946 init_lookup_list();
947 for (i = 0; i < lookup_list_count; i++)
948 {
949 if (lookup_list[i]->version_report)
950 lookup_list[i]->version_report(f);
951 }
952
953 #ifdef WHITELIST_D_MACROS
954 fprintf(f, "WHITELIST_D_MACROS: \"%s\"\n", WHITELIST_D_MACROS);
955 #else
956 fprintf(f, "WHITELIST_D_MACROS unset\n");
957 #endif
958 #ifdef TRUSTED_CONFIG_LIST
959 fprintf(f, "TRUSTED_CONFIG_LIST: \"%s\"\n", TRUSTED_CONFIG_LIST);
960 #else
961 fprintf(f, "TRUSTED_CONFIG_LIST unset\n");
962 #endif
963
964 } while (0);
965 }
966
967
968
969
970 /*************************************************
971 * Quote a local part *
972 *************************************************/
973
974 /* This function is used when a sender address or a From: or Sender: header
975 line is being created from the caller's login, or from an authenticated_id. It
976 applies appropriate quoting rules for a local part.
977
978 Argument: the local part
979 Returns: the local part, quoted if necessary
980 */
981
982 uschar *
983 local_part_quote(uschar *lpart)
984 {
985 BOOL needs_quote = FALSE;
986 int size, ptr;
987 uschar *yield;
988 uschar *t;
989
990 for (t = lpart; !needs_quote && *t != 0; t++)
991 {
992 needs_quote = !isalnum(*t) && strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
993 (*t != '.' || t == lpart || t[1] == 0);
994 }
995
996 if (!needs_quote) return lpart;
997
998 size = ptr = 0;
999 yield = string_cat(NULL, &size, &ptr, US"\"", 1);
1000
1001 for (;;)
1002 {
1003 uschar *nq = US Ustrpbrk(lpart, "\\\"");
1004 if (nq == NULL)
1005 {
1006 yield = string_cat(yield, &size, &ptr, lpart, Ustrlen(lpart));
1007 break;
1008 }
1009 yield = string_cat(yield, &size, &ptr, lpart, nq - lpart);
1010 yield = string_cat(yield, &size, &ptr, US"\\", 1);
1011 yield = string_cat(yield, &size, &ptr, nq, 1);
1012 lpart = nq + 1;
1013 }
1014
1015 yield = string_cat(yield, &size, &ptr, US"\"", 1);
1016 yield[ptr] = 0;
1017 return yield;
1018 }
1019
1020
1021
1022 #ifdef USE_READLINE
1023 /*************************************************
1024 * Load readline() functions *
1025 *************************************************/
1026
1027 /* This function is called from testing executions that read data from stdin,
1028 but only when running as the calling user. Currently, only -be does this. The
1029 function loads the readline() function library and passes back the functions.
1030 On some systems, it needs the curses library, so load that too, but try without
1031 it if loading fails. All this functionality has to be requested at build time.
1032
1033 Arguments:
1034 fn_readline_ptr pointer to where to put the readline pointer
1035 fn_addhist_ptr pointer to where to put the addhistory function
1036
1037 Returns: the dlopen handle or NULL on failure
1038 */
1039
1040 static void *
1041 set_readline(char * (**fn_readline_ptr)(char *),
1042 char * (**fn_addhist_ptr)(char *))
1043 {
1044 void *dlhandle;
1045 void *dlhandle_curses = dlopen("libcurses.so", RTLD_GLOBAL|RTLD_LAZY);
1046
1047 dlhandle = dlopen("libreadline.so", RTLD_GLOBAL|RTLD_NOW);
1048 if (dlhandle_curses != NULL) dlclose(dlhandle_curses);
1049
1050 if (dlhandle != NULL)
1051 {
1052 *fn_readline_ptr = (char *(*)(char*))dlsym(dlhandle, "readline");
1053 *fn_addhist_ptr = (char *(*)(char*))dlsym(dlhandle, "add_history");
1054 }
1055 else
1056 {
1057 DEBUG(D_any) debug_printf("failed to load readline: %s\n", dlerror());
1058 }
1059
1060 return dlhandle;
1061 }
1062 #endif
1063
1064
1065
1066 /*************************************************
1067 * Get a line from stdin for testing things *
1068 *************************************************/
1069
1070 /* This function is called when running tests that can take a number of lines
1071 of input (for example, -be and -bt). It handles continuations and trailing
1072 spaces. And prompting and a blank line output on eof. If readline() is in use,
1073 the arguments are non-NULL and provide the relevant functions.
1074
1075 Arguments:
1076 fn_readline readline function or NULL
1077 fn_addhist addhist function or NULL
1078
1079 Returns: pointer to dynamic memory, or NULL at end of file
1080 */
1081
1082 static uschar *
1083 get_stdinput(char *(*fn_readline)(char *), char *(*fn_addhist)(char *))
1084 {
1085 int i;
1086 int size = 0;
1087 int ptr = 0;
1088 uschar *yield = NULL;
1089
1090 if (fn_readline == NULL) { printf("> "); fflush(stdout); }
1091
1092 for (i = 0;; i++)
1093 {
1094 uschar buffer[1024];
1095 uschar *p, *ss;
1096
1097 #ifdef USE_READLINE
1098 char *readline_line = NULL;
1099 if (fn_readline != NULL)
1100 {
1101 if ((readline_line = fn_readline((i > 0)? "":"> ")) == NULL) break;
1102 if (*readline_line != 0 && fn_addhist != NULL) fn_addhist(readline_line);
1103 p = US readline_line;
1104 }
1105 else
1106 #endif
1107
1108 /* readline() not in use */
1109
1110 {
1111 if (Ufgets(buffer, sizeof(buffer), stdin) == NULL) break;
1112 p = buffer;
1113 }
1114
1115 /* Handle the line */
1116
1117 ss = p + (int)Ustrlen(p);
1118 while (ss > p && isspace(ss[-1])) ss--;
1119
1120 if (i > 0)
1121 {
1122 while (p < ss && isspace(*p)) p++; /* leading space after cont */
1123 }
1124
1125 yield = string_cat(yield, &size, &ptr, p, ss - p);
1126
1127 #ifdef USE_READLINE
1128 if (fn_readline != NULL) free(readline_line);
1129 #endif
1130
1131 if (ss == p || yield[ptr-1] != '\\')
1132 {
1133 yield[ptr] = 0;
1134 break;
1135 }
1136 yield[--ptr] = 0;
1137 }
1138
1139 if (yield == NULL) printf("\n");
1140 return yield;
1141 }
1142
1143
1144
1145 /*************************************************
1146 * Output usage information for the program *
1147 *************************************************/
1148
1149 /* This function is called when there are no recipients
1150 or a specific --help argument was added.
1151
1152 Arguments:
1153 progname information on what name we were called by
1154
1155 Returns: DOES NOT RETURN
1156 */
1157
1158 static void
1159 exim_usage(uschar *progname)
1160 {
1161
1162 /* Handle specific program invocation varients */
1163 if (Ustrcmp(progname, US"-mailq") == 0)
1164 {
1165 fprintf(stderr,
1166 "mailq - list the contents of the mail queue\n\n"
1167 "For a list of options, see the Exim documentation.\n");
1168 exit(EXIT_FAILURE);
1169 }
1170
1171 /* Generic usage - we output this whatever happens */
1172 fprintf(stderr,
1173 "Exim is a Mail Transfer Agent. It is normally called by Mail User Agents,\n"
1174 "not directly from a shell command line. Options and/or arguments control\n"
1175 "what it does when called. For a list of options, see the Exim documentation.\n");
1176
1177 exit(EXIT_FAILURE);
1178 }
1179
1180
1181
1182 /*************************************************
1183 * Validate that the macros given are okay *
1184 *************************************************/
1185
1186 /* Typically, Exim will drop privileges if macros are supplied. In some
1187 cases, we want to not do so.
1188
1189 Arguments: none (macros is a global)
1190 Returns: true if trusted, false otherwise
1191 */
1192
1193 static BOOL
1194 macros_trusted(void)
1195 {
1196 #ifdef WHITELIST_D_MACROS
1197 macro_item *m;
1198 uschar *whitelisted, *end, *p, **whites, **w;
1199 int white_count, i, n;
1200 size_t len;
1201 BOOL prev_char_item, found;
1202 #endif
1203
1204 if (macros == NULL)
1205 return TRUE;
1206 #ifndef WHITELIST_D_MACROS
1207 return FALSE;
1208 #else
1209
1210 /* We only trust -D overrides for some invoking users:
1211 root, the exim run-time user, the optional config owner user.
1212 I don't know why config-owner would be needed, but since they can own the
1213 config files anyway, there's no security risk to letting them override -D. */
1214 if ( ! ((real_uid == root_uid)
1215 || (real_uid == exim_uid)
1216 #ifdef CONFIGURE_OWNER
1217 || (real_uid == config_uid)
1218 #endif
1219 ))
1220 {
1221 debug_printf("macros_trusted rejecting macros for uid %d\n", (int) real_uid);
1222 return FALSE;
1223 }
1224
1225 /* Get a list of macros which are whitelisted */
1226 whitelisted = string_copy_malloc(US WHITELIST_D_MACROS);
1227 prev_char_item = FALSE;
1228 white_count = 0;
1229 for (p = whitelisted; *p != '\0'; ++p)
1230 {
1231 if (*p == ':' || isspace(*p))
1232 {
1233 *p = '\0';
1234 if (prev_char_item)
1235 ++white_count;
1236 prev_char_item = FALSE;
1237 continue;
1238 }
1239 if (!prev_char_item)
1240 prev_char_item = TRUE;
1241 }
1242 end = p;
1243 if (prev_char_item)
1244 ++white_count;
1245 if (!white_count)
1246 return FALSE;
1247 whites = store_malloc(sizeof(uschar *) * (white_count+1));
1248 for (p = whitelisted, i = 0; (p != end) && (i < white_count); ++p)
1249 {
1250 if (*p != '\0')
1251 {
1252 whites[i++] = p;
1253 if (i == white_count)
1254 break;
1255 while (*p != '\0' && p < end)
1256 ++p;
1257 }
1258 }
1259 whites[i] = NULL;
1260
1261 /* The list of macros should be very short. Accept the N*M complexity. */
1262 for (m = macros; m != NULL; m = m->next)
1263 {
1264 found = FALSE;
1265 for (w = whites; *w; ++w)
1266 if (Ustrcmp(*w, m->name) == 0)
1267 {
1268 found = TRUE;
1269 break;
1270 }
1271 if (!found)
1272 return FALSE;
1273 if (m->replacement == NULL)
1274 continue;
1275 len = Ustrlen(m->replacement);
1276 if (len == 0)
1277 continue;
1278 n = pcre_exec(regex_whitelisted_macro, NULL, CS m->replacement, len,
1279 0, PCRE_EOPT, NULL, 0);
1280 if (n < 0)
1281 {
1282 if (n != PCRE_ERROR_NOMATCH)
1283 debug_printf("macros_trusted checking %s returned %d\n", m->name, n);
1284 return FALSE;
1285 }
1286 }
1287 DEBUG(D_any) debug_printf("macros_trusted overriden to true by whitelisting\n");
1288 return TRUE;
1289 #endif
1290 }
1291
1292
1293 /*************************************************
1294 * Entry point and high-level code *
1295 *************************************************/
1296
1297 /* Entry point for the Exim mailer. Analyse the arguments and arrange to take
1298 the appropriate action. All the necessary functions are present in the one
1299 binary. I originally thought one should split it up, but it turns out that so
1300 much of the apparatus is needed in each chunk that one might as well just have
1301 it all available all the time, which then makes the coding easier as well.
1302
1303 Arguments:
1304 argc count of entries in argv
1305 argv argument strings, with argv[0] being the program name
1306
1307 Returns: EXIT_SUCCESS if terminated successfully
1308 EXIT_FAILURE otherwise, except when a message has been sent
1309 to the sender, and -oee was given
1310 */
1311
1312 int
1313 main(int argc, char **cargv)
1314 {
1315 uschar **argv = USS cargv;
1316 int arg_receive_timeout = -1;
1317 int arg_smtp_receive_timeout = -1;
1318 int arg_error_handling = error_handling;
1319 int filter_sfd = -1;
1320 int filter_ufd = -1;
1321 int group_count;
1322 int i, rv;
1323 int list_queue_option = 0;
1324 int msg_action = 0;
1325 int msg_action_arg = -1;
1326 int namelen = (argv[0] == NULL)? 0 : Ustrlen(argv[0]);
1327 int queue_only_reason = 0;
1328 #ifdef EXIM_PERL
1329 int perl_start_option = 0;
1330 #endif
1331 int recipients_arg = argc;
1332 int sender_address_domain = 0;
1333 int test_retry_arg = -1;
1334 int test_rewrite_arg = -1;
1335 BOOL arg_queue_only = FALSE;
1336 BOOL bi_option = FALSE;
1337 BOOL checking = FALSE;
1338 BOOL count_queue = FALSE;
1339 BOOL expansion_test = FALSE;
1340 BOOL extract_recipients = FALSE;
1341 BOOL forced_delivery = FALSE;
1342 BOOL f_end_dot = FALSE;
1343 BOOL deliver_give_up = FALSE;
1344 BOOL list_queue = FALSE;
1345 BOOL list_options = FALSE;
1346 BOOL local_queue_only;
1347 BOOL more = TRUE;
1348 BOOL one_msg_action = FALSE;
1349 BOOL queue_only_set = FALSE;
1350 BOOL receiving_message = TRUE;
1351 BOOL sender_ident_set = FALSE;
1352 BOOL session_local_queue_only;
1353 BOOL unprivileged;
1354 BOOL removed_privilege = FALSE;
1355 BOOL usage_wanted = FALSE;
1356 BOOL verify_address_mode = FALSE;
1357 BOOL verify_as_sender = FALSE;
1358 BOOL version_printed = FALSE;
1359 uschar *alias_arg = NULL;
1360 uschar *called_as = US"";
1361 uschar *start_queue_run_id = NULL;
1362 uschar *stop_queue_run_id = NULL;
1363 uschar *expansion_test_message = NULL;
1364 uschar *ftest_domain = NULL;
1365 uschar *ftest_localpart = NULL;
1366 uschar *ftest_prefix = NULL;
1367 uschar *ftest_suffix = NULL;
1368 uschar *malware_test_file = NULL;
1369 uschar *real_sender_address;
1370 uschar *originator_home = US"/";
1371 void *reset_point;
1372
1373 struct passwd *pw;
1374 struct stat statbuf;
1375 pid_t passed_qr_pid = (pid_t)0;
1376 int passed_qr_pipe = -1;
1377 gid_t group_list[NGROUPS_MAX];
1378
1379 /* Possible options for -R and -S */
1380
1381 static uschar *rsopts[] = { US"f", US"ff", US"r", US"rf", US"rff" };
1382
1383 /* Need to define this in case we need to change the environment in order
1384 to get rid of a bogus time zone. We have to make it char rather than uschar
1385 because some OS define it in /usr/include/unistd.h. */
1386
1387 extern char **environ;
1388
1389 /* If the Exim user and/or group and/or the configuration file owner/group were
1390 defined by ref:name at build time, we must now find the actual uid/gid values.
1391 This is a feature to make the lives of binary distributors easier. */
1392
1393 #ifdef EXIM_USERNAME
1394 if (route_finduser(US EXIM_USERNAME, &pw, &exim_uid))
1395 {
1396 if (exim_uid == 0)
1397 {
1398 fprintf(stderr, "exim: refusing to run with uid 0 for \"%s\"\n",
1399 EXIM_USERNAME);
1400 exit(EXIT_FAILURE);
1401 }
1402 exim_gid = pw->pw_gid;
1403 }
1404 else
1405 {
1406 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1407 EXIM_USERNAME);
1408 exit(EXIT_FAILURE);
1409 }
1410 #endif
1411
1412 #ifdef EXIM_GROUPNAME
1413 if (!route_findgroup(US EXIM_GROUPNAME, &exim_gid))
1414 {
1415 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1416 EXIM_GROUPNAME);
1417 exit(EXIT_FAILURE);
1418 }
1419 #endif
1420
1421 #ifdef CONFIGURE_OWNERNAME
1422 if (!route_finduser(US CONFIGURE_OWNERNAME, NULL, &config_uid))
1423 {
1424 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1425 CONFIGURE_OWNERNAME);
1426 exit(EXIT_FAILURE);
1427 }
1428 #endif
1429
1430 /* We default the system_filter_user to be the Exim run-time user, as a
1431 sane non-root value. */
1432 system_filter_uid = exim_uid;
1433
1434 #ifdef CONFIGURE_GROUPNAME
1435 if (!route_findgroup(US CONFIGURE_GROUPNAME, &config_gid))
1436 {
1437 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1438 CONFIGURE_GROUPNAME);
1439 exit(EXIT_FAILURE);
1440 }
1441 #endif
1442
1443 /* In the Cygwin environment, some initialization needs doing. It is fudged
1444 in by means of this macro. */
1445
1446 #ifdef OS_INIT
1447 OS_INIT
1448 #endif
1449
1450 /* Check a field which is patched when we are running Exim within its
1451 testing harness; do a fast initial check, and then the whole thing. */
1452
1453 running_in_test_harness =
1454 *running_status == '<' && Ustrcmp(running_status, "<<<testing>>>") == 0;
1455
1456 /* The C standard says that the equivalent of setlocale(LC_ALL, "C") is obeyed
1457 at the start of a program; however, it seems that some environments do not
1458 follow this. A "strange" locale can affect the formatting of timestamps, so we
1459 make quite sure. */
1460
1461 setlocale(LC_ALL, "C");
1462
1463 /* Set up the default handler for timing using alarm(). */
1464
1465 os_non_restarting_signal(SIGALRM, sigalrm_handler);
1466
1467 /* Ensure we have a buffer for constructing log entries. Use malloc directly,
1468 because store_malloc writes a log entry on failure. */
1469
1470 log_buffer = (uschar *)malloc(LOG_BUFFER_SIZE);
1471 if (log_buffer == NULL)
1472 {
1473 fprintf(stderr, "exim: failed to get store for log buffer\n");
1474 exit(EXIT_FAILURE);
1475 }
1476
1477 /* Set log_stderr to stderr, provided that stderr exists. This gets reset to
1478 NULL when the daemon is run and the file is closed. We have to use this
1479 indirection, because some systems don't allow writing to the variable "stderr".
1480 */
1481
1482 if (fstat(fileno(stderr), &statbuf) >= 0) log_stderr = stderr;
1483
1484 /* Arrange for the PCRE regex library to use our store functions. Note that
1485 the normal calls are actually macros that add additional arguments for
1486 debugging purposes so we have to assign specially constructed functions here.
1487 The default is to use store in the stacking pool, but this is overridden in the
1488 regex_must_compile() function. */
1489
1490 pcre_malloc = function_store_get;
1491 pcre_free = function_dummy_free;
1492
1493 /* Ensure there is a big buffer for temporary use in several places. It is put
1494 in malloc store so that it can be freed for enlargement if necessary. */
1495
1496 big_buffer = store_malloc(big_buffer_size);
1497
1498 /* Set up the handler for the data request signal, and set the initial
1499 descriptive text. */
1500
1501 set_process_info("initializing");
1502 os_restarting_signal(SIGUSR1, usr1_handler);
1503
1504 /* SIGHUP is used to get the daemon to reconfigure. It gets set as appropriate
1505 in the daemon code. For the rest of Exim's uses, we ignore it. */
1506
1507 signal(SIGHUP, SIG_IGN);
1508
1509 /* We don't want to die on pipe errors as the code is written to handle
1510 the write error instead. */
1511
1512 signal(SIGPIPE, SIG_IGN);
1513
1514 /* Under some circumstance on some OS, Exim can get called with SIGCHLD
1515 set to SIG_IGN. This causes subprocesses that complete before the parent
1516 process waits for them not to hang around, so when Exim calls wait(), nothing
1517 is there. The wait() code has been made robust against this, but let's ensure
1518 that SIGCHLD is set to SIG_DFL, because it's tidier to wait and get a process
1519 ending status. We use sigaction rather than plain signal() on those OS where
1520 SA_NOCLDWAIT exists, because we want to be sure it is turned off. (There was a
1521 problem on AIX with this.) */
1522
1523 #ifdef SA_NOCLDWAIT
1524 {
1525 struct sigaction act;
1526 act.sa_handler = SIG_DFL;
1527 sigemptyset(&(act.sa_mask));
1528 act.sa_flags = 0;
1529 sigaction(SIGCHLD, &act, NULL);
1530 }
1531 #else
1532 signal(SIGCHLD, SIG_DFL);
1533 #endif
1534
1535 /* Save the arguments for use if we re-exec exim as a daemon after receiving
1536 SIGHUP. */
1537
1538 sighup_argv = argv;
1539
1540 /* Set up the version number. Set up the leading 'E' for the external form of
1541 message ids, set the pointer to the internal form, and initialize it to
1542 indicate no message being processed. */
1543
1544 version_init();
1545 message_id_option[0] = '-';
1546 message_id_external = message_id_option + 1;
1547 message_id_external[0] = 'E';
1548 message_id = message_id_external + 1;
1549 message_id[0] = 0;
1550
1551 /* Set the umask to zero so that any files Exim creates using open() are
1552 created with the modes that it specifies. NOTE: Files created with fopen() have
1553 a problem, which was not recognized till rather late (February 2006). With this
1554 umask, such files will be world writeable. (They are all content scanning files
1555 in the spool directory, which isn't world-accessible, so this is not a
1556 disaster, but it's untidy.) I don't want to change this overall setting,
1557 however, because it will interact badly with the open() calls. Instead, there's
1558 now a function called modefopen() that fiddles with the umask while calling
1559 fopen(). */
1560
1561 (void)umask(0);
1562
1563 /* Precompile the regular expression for matching a message id. Keep this in
1564 step with the code that generates ids in the accept.c module. We need to do
1565 this here, because the -M options check their arguments for syntactic validity
1566 using mac_ismsgid, which uses this. */
1567
1568 regex_ismsgid =
1569 regex_must_compile(US"^(?:[^\\W_]{6}-){2}[^\\W_]{2}$", FALSE, TRUE);
1570
1571 /* Precompile the regular expression that is used for matching an SMTP error
1572 code, possibly extended, at the start of an error message. Note that the
1573 terminating whitespace character is included. */
1574
1575 regex_smtp_code =
1576 regex_must_compile(US"^\\d\\d\\d\\s(?:\\d\\.\\d\\d?\\d?\\.\\d\\d?\\d?\\s)?",
1577 FALSE, TRUE);
1578
1579 #ifdef WHITELIST_D_MACROS
1580 /* Precompile the regular expression used to filter the content of macros
1581 given to -D for permissibility. */
1582
1583 regex_whitelisted_macro =
1584 regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE);
1585 #endif
1586
1587
1588 /* If the program is called as "mailq" treat it as equivalent to "exim -bp";
1589 this seems to be a generally accepted convention, since one finds symbolic
1590 links called "mailq" in standard OS configurations. */
1591
1592 if ((namelen == 5 && Ustrcmp(argv[0], "mailq") == 0) ||
1593 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/mailq", 6) == 0))
1594 {
1595 list_queue = TRUE;
1596 receiving_message = FALSE;
1597 called_as = US"-mailq";
1598 }
1599
1600 /* If the program is called as "rmail" treat it as equivalent to
1601 "exim -i -oee", thus allowing UUCP messages to be input using non-SMTP mode,
1602 i.e. preventing a single dot on a line from terminating the message, and
1603 returning with zero return code, even in cases of error (provided an error
1604 message has been sent). */
1605
1606 if ((namelen == 5 && Ustrcmp(argv[0], "rmail") == 0) ||
1607 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rmail", 6) == 0))
1608 {
1609 dot_ends = FALSE;
1610 called_as = US"-rmail";
1611 errors_sender_rc = EXIT_SUCCESS;
1612 }
1613
1614 /* If the program is called as "rsmtp" treat it as equivalent to "exim -bS";
1615 this is a smail convention. */
1616
1617 if ((namelen == 5 && Ustrcmp(argv[0], "rsmtp") == 0) ||
1618 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rsmtp", 6) == 0))
1619 {
1620 smtp_input = smtp_batched_input = TRUE;
1621 called_as = US"-rsmtp";
1622 }
1623
1624 /* If the program is called as "runq" treat it as equivalent to "exim -q";
1625 this is a smail convention. */
1626
1627 if ((namelen == 4 && Ustrcmp(argv[0], "runq") == 0) ||
1628 (namelen > 4 && Ustrncmp(argv[0] + namelen - 5, "/runq", 5) == 0))
1629 {
1630 queue_interval = 0;
1631 receiving_message = FALSE;
1632 called_as = US"-runq";
1633 }
1634
1635 /* If the program is called as "newaliases" treat it as equivalent to
1636 "exim -bi"; this is a sendmail convention. */
1637
1638 if ((namelen == 10 && Ustrcmp(argv[0], "newaliases") == 0) ||
1639 (namelen > 10 && Ustrncmp(argv[0] + namelen - 11, "/newaliases", 11) == 0))
1640 {
1641 bi_option = TRUE;
1642 receiving_message = FALSE;
1643 called_as = US"-newaliases";
1644 }
1645
1646 /* Save the original effective uid for a couple of uses later. It should
1647 normally be root, but in some esoteric environments it may not be. */
1648
1649 original_euid = geteuid();
1650
1651 /* Get the real uid and gid. If the caller is root, force the effective uid/gid
1652 to be the same as the real ones. This makes a difference only if Exim is setuid
1653 (or setgid) to something other than root, which could be the case in some
1654 special configurations. */
1655
1656 real_uid = getuid();
1657 real_gid = getgid();
1658
1659 if (real_uid == root_uid)
1660 {
1661 rv = setgid(real_gid);
1662 if (rv)
1663 {
1664 fprintf(stderr, "exim: setgid(%ld) failed: %s\n",
1665 (long int)real_gid, strerror(errno));
1666 exit(EXIT_FAILURE);
1667 }
1668 rv = setuid(real_uid);
1669 if (rv)
1670 {
1671 fprintf(stderr, "exim: setuid(%ld) failed: %s\n",
1672 (long int)real_uid, strerror(errno));
1673 exit(EXIT_FAILURE);
1674 }
1675 }
1676
1677 /* If neither the original real uid nor the original euid was root, Exim is
1678 running in an unprivileged state. */
1679
1680 unprivileged = (real_uid != root_uid && original_euid != root_uid);
1681
1682 /* Scan the program's arguments. Some can be dealt with right away; others are
1683 simply recorded for checking and handling afterwards. Do a high-level switch
1684 on the second character (the one after '-'), to save some effort. */
1685
1686 for (i = 1; i < argc; i++)
1687 {
1688 BOOL badarg = FALSE;
1689 uschar *arg = argv[i];
1690 uschar *argrest;
1691 int switchchar;
1692
1693 /* An argument not starting with '-' is the start of a recipients list;
1694 break out of the options-scanning loop. */
1695
1696 if (arg[0] != '-')
1697 {
1698 recipients_arg = i;
1699 break;
1700 }
1701
1702 /* An option consistion of -- terminates the options */
1703
1704 if (Ustrcmp(arg, "--") == 0)
1705 {
1706 recipients_arg = i + 1;
1707 break;
1708 }
1709
1710 /* Handle flagged options */
1711
1712 switchchar = arg[1];
1713 argrest = arg+2;
1714
1715 /* Make all -ex options synonymous with -oex arguments, since that
1716 is assumed by various callers. Also make -qR options synonymous with -R
1717 options, as that seems to be required as well. Allow for -qqR too, and
1718 the same for -S options. */
1719
1720 if (Ustrncmp(arg+1, "oe", 2) == 0 ||
1721 Ustrncmp(arg+1, "qR", 2) == 0 ||
1722 Ustrncmp(arg+1, "qS", 2) == 0)
1723 {
1724 switchchar = arg[2];
1725 argrest++;
1726 }
1727 else if (Ustrncmp(arg+1, "qqR", 3) == 0 || Ustrncmp(arg+1, "qqS", 3) == 0)
1728 {
1729 switchchar = arg[3];
1730 argrest += 2;
1731 queue_2stage = TRUE;
1732 }
1733
1734 /* Make -r synonymous with -f, since it is a documented alias */
1735
1736 else if (arg[1] == 'r') switchchar = 'f';
1737
1738 /* Make -ov synonymous with -v */
1739
1740 else if (Ustrcmp(arg, "-ov") == 0)
1741 {
1742 switchchar = 'v';
1743 argrest++;
1744 }
1745
1746 /* deal with --option_aliases */
1747 else if (switchchar == '-')
1748 {
1749 if (Ustrcmp(argrest, "help") == 0)
1750 {
1751 usage_wanted = TRUE;
1752 break;
1753 }
1754 else if (Ustrcmp(argrest, "version") == 0)
1755 {
1756 switchchar = 'b';
1757 argrest = US"V";
1758 }
1759 }
1760
1761 /* High-level switch on active initial letter */
1762
1763 switch(switchchar)
1764 {
1765 /* -Btype is a sendmail option for 7bit/8bit setting. Exim is 8-bit clean
1766 so has no need of it. */
1767
1768 case 'B':
1769 if (*argrest == 0) i++; /* Skip over the type */
1770 break;
1771
1772
1773 case 'b':
1774 receiving_message = FALSE; /* Reset TRUE for -bm, -bS, -bs below */
1775
1776 /* -bd: Run in daemon mode, awaiting SMTP connections.
1777 -bdf: Ditto, but in the foreground.
1778 */
1779
1780 if (*argrest == 'd')
1781 {
1782 daemon_listen = TRUE;
1783 if (*(++argrest) == 'f') background_daemon = FALSE;
1784 else if (*argrest != 0) { badarg = TRUE; break; }
1785 }
1786
1787 /* -be: Run in expansion test mode
1788 -bem: Ditto, but read a message from a file first
1789 */
1790
1791 else if (*argrest == 'e')
1792 {
1793 expansion_test = checking = TRUE;
1794 if (argrest[1] == 'm')
1795 {
1796 if (++i >= argc) { badarg = TRUE; break; }
1797 expansion_test_message = argv[i];
1798 argrest++;
1799 }
1800 if (argrest[1] != 0) { badarg = TRUE; break; }
1801 }
1802
1803 /* -bF: Run system filter test */
1804
1805 else if (*argrest == 'F')
1806 {
1807 filter_test |= FTEST_SYSTEM;
1808 if (*(++argrest) != 0) { badarg = TRUE; break; }
1809 if (++i < argc) filter_test_sfile = argv[i]; else
1810 {
1811 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
1812 exit(EXIT_FAILURE);
1813 }
1814 }
1815
1816 /* -bf: Run user filter test
1817 -bfd: Set domain for filter testing
1818 -bfl: Set local part for filter testing
1819 -bfp: Set prefix for filter testing
1820 -bfs: Set suffix for filter testing
1821 */
1822
1823 else if (*argrest == 'f')
1824 {
1825 if (*(++argrest) == 0)
1826 {
1827 filter_test |= FTEST_USER;
1828 if (++i < argc) filter_test_ufile = argv[i]; else
1829 {
1830 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
1831 exit(EXIT_FAILURE);
1832 }
1833 }
1834 else
1835 {
1836 if (++i >= argc)
1837 {
1838 fprintf(stderr, "exim: string expected after %s\n", arg);
1839 exit(EXIT_FAILURE);
1840 }
1841 if (Ustrcmp(argrest, "d") == 0) ftest_domain = argv[i];
1842 else if (Ustrcmp(argrest, "l") == 0) ftest_localpart = argv[i];
1843 else if (Ustrcmp(argrest, "p") == 0) ftest_prefix = argv[i];
1844 else if (Ustrcmp(argrest, "s") == 0) ftest_suffix = argv[i];
1845 else { badarg = TRUE; break; }
1846 }
1847 }
1848
1849 /* -bh: Host checking - an IP address must follow. */
1850
1851 else if (Ustrcmp(argrest, "h") == 0 || Ustrcmp(argrest, "hc") == 0)
1852 {
1853 if (++i >= argc) { badarg = TRUE; break; }
1854 sender_host_address = argv[i];
1855 host_checking = checking = log_testing_mode = TRUE;
1856 host_checking_callout = argrest[1] == 'c';
1857 }
1858
1859 /* -bi: This option is used by sendmail to initialize *the* alias file,
1860 though it has the -oA option to specify a different file. Exim has no
1861 concept of *the* alias file, but since Sun's YP make script calls
1862 sendmail this way, some support must be provided. */
1863
1864 else if (Ustrcmp(argrest, "i") == 0) bi_option = TRUE;
1865
1866 /* -bm: Accept and deliver message - the default option. Reinstate
1867 receiving_message, which got turned off for all -b options. */
1868
1869 else if (Ustrcmp(argrest, "m") == 0) receiving_message = TRUE;
1870
1871 /* -bmalware: test the filename given for malware */
1872
1873 else if (Ustrcmp(argrest, "malware") == 0)
1874 {
1875 if (++i >= argc) { badarg = TRUE; break; }
1876 malware_test_file = argv[i];
1877 }
1878
1879 /* -bnq: For locally originating messages, do not qualify unqualified
1880 addresses. In the envelope, this causes errors; in header lines they
1881 just get left. */
1882
1883 else if (Ustrcmp(argrest, "nq") == 0)
1884 {
1885 allow_unqualified_sender = FALSE;
1886 allow_unqualified_recipient = FALSE;
1887 }
1888
1889 /* -bpxx: List the contents of the mail queue, in various forms. If
1890 the option is -bpc, just a queue count is needed. Otherwise, if the
1891 first letter after p is r, then order is random. */
1892
1893 else if (*argrest == 'p')
1894 {
1895 if (*(++argrest) == 'c')
1896 {
1897 count_queue = TRUE;
1898 if (*(++argrest) != 0) badarg = TRUE;
1899 break;
1900 }
1901
1902 if (*argrest == 'r')
1903 {
1904 list_queue_option = 8;
1905 argrest++;
1906 }
1907 else list_queue_option = 0;
1908
1909 list_queue = TRUE;
1910
1911 /* -bp: List the contents of the mail queue, top-level only */
1912
1913 if (*argrest == 0) {}
1914
1915 /* -bpu: List the contents of the mail queue, top-level undelivered */
1916
1917 else if (Ustrcmp(argrest, "u") == 0) list_queue_option += 1;
1918
1919 /* -bpa: List the contents of the mail queue, including all delivered */
1920
1921 else if (Ustrcmp(argrest, "a") == 0) list_queue_option += 2;
1922
1923 /* Unknown after -bp[r] */
1924
1925 else
1926 {
1927 badarg = TRUE;
1928 break;
1929 }
1930 }
1931
1932
1933 /* -bP: List the configuration variables given as the address list.
1934 Force -v, so configuration errors get displayed. */
1935
1936 else if (Ustrcmp(argrest, "P") == 0)
1937 {
1938 list_options = TRUE;
1939 debug_selector |= D_v;
1940 debug_file = stderr;
1941 }
1942
1943 /* -brt: Test retry configuration lookup */
1944
1945 else if (Ustrcmp(argrest, "rt") == 0)
1946 {
1947 test_retry_arg = i + 1;
1948 goto END_ARG;
1949 }
1950
1951 /* -brw: Test rewrite configuration */
1952
1953 else if (Ustrcmp(argrest, "rw") == 0)
1954 {
1955 test_rewrite_arg = i + 1;
1956 goto END_ARG;
1957 }
1958
1959 /* -bS: Read SMTP commands on standard input, but produce no replies -
1960 all errors are reported by sending messages. */
1961
1962 else if (Ustrcmp(argrest, "S") == 0)
1963 smtp_input = smtp_batched_input = receiving_message = TRUE;
1964
1965 /* -bs: Read SMTP commands on standard input and produce SMTP replies
1966 on standard output. */
1967
1968 else if (Ustrcmp(argrest, "s") == 0) smtp_input = receiving_message = TRUE;
1969
1970 /* -bt: address testing mode */
1971
1972 else if (Ustrcmp(argrest, "t") == 0)
1973 address_test_mode = checking = log_testing_mode = TRUE;
1974
1975 /* -bv: verify addresses */
1976
1977 else if (Ustrcmp(argrest, "v") == 0)
1978 verify_address_mode = checking = log_testing_mode = TRUE;
1979
1980 /* -bvs: verify sender addresses */
1981
1982 else if (Ustrcmp(argrest, "vs") == 0)
1983 {
1984 verify_address_mode = checking = log_testing_mode = TRUE;
1985 verify_as_sender = TRUE;
1986 }
1987
1988 /* -bV: Print version string and support details */
1989
1990 else if (Ustrcmp(argrest, "V") == 0)
1991 {
1992 printf("Exim version %s #%s built %s\n", version_string,
1993 version_cnumber, version_date);
1994 printf("%s\n", CS version_copyright);
1995 version_printed = TRUE;
1996 show_whats_supported(stdout);
1997 }
1998
1999 else badarg = TRUE;
2000 break;
2001
2002
2003 /* -C: change configuration file list; ignore if it isn't really
2004 a change! Enforce a prefix check if required. */
2005
2006 case 'C':
2007 if (*argrest == 0)
2008 {
2009 if(++i < argc) argrest = argv[i]; else
2010 { badarg = TRUE; break; }
2011 }
2012 if (Ustrcmp(config_main_filelist, argrest) != 0)
2013 {
2014 #ifdef ALT_CONFIG_PREFIX
2015 int sep = 0;
2016 int len = Ustrlen(ALT_CONFIG_PREFIX);
2017 uschar *list = argrest;
2018 uschar *filename;
2019 while((filename = string_nextinlist(&list, &sep, big_buffer,
2020 big_buffer_size)) != NULL)
2021 {
2022 if ((Ustrlen(filename) < len ||
2023 Ustrncmp(filename, ALT_CONFIG_PREFIX, len) != 0 ||
2024 Ustrstr(filename, "/../") != NULL) &&
2025 (Ustrcmp(filename, "/dev/null") != 0 || real_uid != root_uid))
2026 {
2027 fprintf(stderr, "-C Permission denied\n");
2028 exit(EXIT_FAILURE);
2029 }
2030 }
2031 #endif
2032 if (real_uid != root_uid)
2033 {
2034 #ifdef TRUSTED_CONFIG_LIST
2035
2036 if (real_uid != exim_uid
2037 #ifdef CONFIGURE_OWNER
2038 && real_uid != config_uid
2039 #endif
2040 )
2041 trusted_config = FALSE;
2042 else
2043 {
2044 FILE *trust_list = Ufopen(TRUSTED_CONFIG_LIST, "rb");
2045 if (trust_list)
2046 {
2047 struct stat statbuf;
2048
2049 if (fstat(fileno(trust_list), &statbuf) != 0 ||
2050 (statbuf.st_uid != root_uid /* owner not root */
2051 #ifdef CONFIGURE_OWNER
2052 && statbuf.st_uid != config_uid /* owner not the special one */
2053 #endif
2054 ) || /* or */
2055 (statbuf.st_gid != root_gid /* group not root */
2056 #ifdef CONFIGURE_GROUP
2057 && statbuf.st_gid != config_gid /* group not the special one */
2058 #endif
2059 && (statbuf.st_mode & 020) != 0 /* group writeable */
2060 ) || /* or */
2061 (statbuf.st_mode & 2) != 0) /* world writeable */
2062 {
2063 trusted_config = FALSE;
2064 fclose(trust_list);
2065 }
2066 else
2067 {
2068 /* Well, the trust list at least is up to scratch... */
2069 void *reset_point = store_get(0);
2070 uschar *trusted_configs[32];
2071 int nr_configs = 0;
2072 int i = 0;
2073
2074 while (Ufgets(big_buffer, big_buffer_size, trust_list))
2075 {
2076 uschar *start = big_buffer, *nl;
2077 while (*start && isspace(*start))
2078 start++;
2079 if (*start != '/')
2080 continue;
2081 nl = Ustrchr(start, '\n');
2082 if (nl)
2083 *nl = 0;
2084 trusted_configs[nr_configs++] = string_copy(start);
2085 if (nr_configs == 32)
2086 break;
2087 }
2088 fclose(trust_list);
2089
2090 if (nr_configs)
2091 {
2092 int sep = 0;
2093 uschar *list = argrest;
2094 uschar *filename;
2095 while (trusted_config && (filename = string_nextinlist(&list,
2096 &sep, big_buffer, big_buffer_size)) != NULL)
2097 {
2098 for (i=0; i < nr_configs; i++)
2099 {
2100 if (Ustrcmp(filename, trusted_configs[i]) == 0)
2101 break;
2102 }
2103 if (i == nr_configs)
2104 {
2105 trusted_config = FALSE;
2106 break;
2107 }
2108 }
2109 store_reset(reset_point);
2110 }
2111 else
2112 {
2113 /* No valid prefixes found in trust_list file. */
2114 trusted_config = FALSE;
2115 }
2116 }
2117 }
2118 else
2119 {
2120 /* Could not open trust_list file. */
2121 trusted_config = FALSE;
2122 }
2123 }
2124 #else
2125 /* Not root; don't trust config */
2126 trusted_config = FALSE;
2127 #endif
2128 }
2129
2130 config_main_filelist = argrest;
2131 config_changed = TRUE;
2132 }
2133 break;
2134
2135
2136 /* -D: set up a macro definition */
2137
2138 case 'D':
2139 #ifdef DISABLE_D_OPTION
2140 fprintf(stderr, "exim: -D is not available in this Exim binary\n");
2141 exit(EXIT_FAILURE);
2142 #else
2143 {
2144 int ptr = 0;
2145 macro_item *mlast = NULL;
2146 macro_item *m;
2147 uschar name[24];
2148 uschar *s = argrest;
2149
2150 while (isspace(*s)) s++;
2151
2152 if (*s < 'A' || *s > 'Z')
2153 {
2154 fprintf(stderr, "exim: macro name set by -D must start with "
2155 "an upper case letter\n");
2156 exit(EXIT_FAILURE);
2157 }
2158
2159 while (isalnum(*s) || *s == '_')
2160 {
2161 if (ptr < sizeof(name)-1) name[ptr++] = *s;
2162 s++;
2163 }
2164 name[ptr] = 0;
2165 if (ptr == 0) { badarg = TRUE; break; }
2166 while (isspace(*s)) s++;
2167 if (*s != 0)
2168 {
2169 if (*s++ != '=') { badarg = TRUE; break; }
2170 while (isspace(*s)) s++;
2171 }
2172
2173 for (m = macros; m != NULL; m = m->next)
2174 {
2175 if (Ustrcmp(m->name, name) == 0)
2176 {
2177 fprintf(stderr, "exim: duplicated -D in command line\n");
2178 exit(EXIT_FAILURE);
2179 }
2180 mlast = m;
2181 }
2182
2183 m = store_get(sizeof(macro_item) + Ustrlen(name));
2184 m->next = NULL;
2185 m->command_line = TRUE;
2186 if (mlast == NULL) macros = m; else mlast->next = m;
2187 Ustrcpy(m->name, name);
2188 m->replacement = string_copy(s);
2189
2190 if (clmacro_count >= MAX_CLMACROS)
2191 {
2192 fprintf(stderr, "exim: too many -D options on command line\n");
2193 exit(EXIT_FAILURE);
2194 }
2195 clmacros[clmacro_count++] = string_sprintf("-D%s=%s", m->name,
2196 m->replacement);
2197 }
2198 #endif
2199 break;
2200
2201 /* -d: Set debug level (see also -v below) or set the drop_cr option.
2202 The latter is now a no-op, retained for compatibility only. If -dd is used,
2203 debugging subprocesses of the daemon is disabled. */
2204
2205 case 'd':
2206 if (Ustrcmp(argrest, "ropcr") == 0)
2207 {
2208 /* drop_cr = TRUE; */
2209 }
2210
2211 /* Use an intermediate variable so that we don't set debugging while
2212 decoding the debugging bits. */
2213
2214 else
2215 {
2216 unsigned int selector = D_default;
2217 debug_selector = 0;
2218 debug_file = NULL;
2219 if (*argrest == 'd')
2220 {
2221 debug_daemon = TRUE;
2222 argrest++;
2223 }
2224 if (*argrest != 0)
2225 decode_bits(&selector, NULL, D_memory, 0, argrest, debug_options,
2226 debug_options_count, US"debug", 0);
2227 debug_selector = selector;
2228 }
2229 break;
2230
2231
2232 /* -E: This is a local error message. This option is not intended for
2233 external use at all, but is not restricted to trusted callers because it
2234 does no harm (just suppresses certain error messages) and if Exim is run
2235 not setuid root it won't always be trusted when it generates error
2236 messages using this option. If there is a message id following -E, point
2237 message_reference at it, for logging. */
2238
2239 case 'E':
2240 local_error_message = TRUE;
2241 if (mac_ismsgid(argrest)) message_reference = argrest;
2242 break;
2243
2244
2245 /* -ex: The vacation program calls sendmail with the undocumented "-eq"
2246 option, so it looks as if historically the -oex options are also callable
2247 without the leading -o. So we have to accept them. Before the switch,
2248 anything starting -oe has been converted to -e. Exim does not support all
2249 of the sendmail error options. */
2250
2251 case 'e':
2252 if (Ustrcmp(argrest, "e") == 0)
2253 {
2254 arg_error_handling = ERRORS_SENDER;
2255 errors_sender_rc = EXIT_SUCCESS;
2256 }
2257 else if (Ustrcmp(argrest, "m") == 0) arg_error_handling = ERRORS_SENDER;
2258 else if (Ustrcmp(argrest, "p") == 0) arg_error_handling = ERRORS_STDERR;
2259 else if (Ustrcmp(argrest, "q") == 0) arg_error_handling = ERRORS_STDERR;
2260 else if (Ustrcmp(argrest, "w") == 0) arg_error_handling = ERRORS_SENDER;
2261 else badarg = TRUE;
2262 break;
2263
2264
2265 /* -F: Set sender's full name, used instead of the gecos entry from
2266 the password file. Since users can usually alter their gecos entries,
2267 there's no security involved in using this instead. The data can follow
2268 the -F or be in the next argument. */
2269
2270 case 'F':
2271 if (*argrest == 0)
2272 {
2273 if(++i < argc) argrest = argv[i]; else
2274 { badarg = TRUE; break; }
2275 }
2276 originator_name = argrest;
2277 sender_name_forced = TRUE;
2278 break;
2279
2280
2281 /* -f: Set sender's address - this value is only actually used if Exim is
2282 run by a trusted user, or if untrusted_set_sender is set and matches the
2283 address, except that the null address can always be set by any user. The
2284 test for this happens later, when the value given here is ignored when not
2285 permitted. For an untrusted user, the actual sender is still put in Sender:
2286 if it doesn't match the From: header (unless no_local_from_check is set).
2287 The data can follow the -f or be in the next argument. The -r switch is an
2288 obsolete form of -f but since there appear to be programs out there that
2289 use anything that sendmail has ever supported, better accept it - the
2290 synonymizing is done before the switch above.
2291
2292 At this stage, we must allow domain literal addresses, because we don't
2293 know what the setting of allow_domain_literals is yet. Ditto for trailing
2294 dots and strip_trailing_dot. */
2295
2296 case 'f':
2297 {
2298 int start, end;
2299 uschar *errmess;
2300 if (*argrest == 0)
2301 {
2302 if (i+1 < argc) argrest = argv[++i]; else
2303 { badarg = TRUE; break; }
2304 }
2305 if (*argrest == 0)
2306 {
2307 sender_address = string_sprintf(""); /* Ensure writeable memory */
2308 }
2309 else
2310 {
2311 uschar *temp = argrest + Ustrlen(argrest) - 1;
2312 while (temp >= argrest && isspace(*temp)) temp--;
2313 if (temp >= argrest && *temp == '.') f_end_dot = TRUE;
2314 allow_domain_literals = TRUE;
2315 strip_trailing_dot = TRUE;
2316 sender_address = parse_extract_address(argrest, &errmess, &start, &end,
2317 &sender_address_domain, TRUE);
2318 allow_domain_literals = FALSE;
2319 strip_trailing_dot = FALSE;
2320 if (sender_address == NULL)
2321 {
2322 fprintf(stderr, "exim: bad -f address \"%s\": %s\n", argrest, errmess);
2323 return EXIT_FAILURE;
2324 }
2325 }
2326 sender_address_forced = TRUE;
2327 }
2328 break;
2329
2330 /* This is some Sendmail thing which can be ignored */
2331
2332 case 'G':
2333 break;
2334
2335 /* -h: Set the hop count for an incoming message. Exim does not currently
2336 support this; it always computes it by counting the Received: headers.
2337 To put it in will require a change to the spool header file format. */
2338
2339 case 'h':
2340 if (*argrest == 0)
2341 {
2342 if(++i < argc) argrest = argv[i]; else
2343 { badarg = TRUE; break; }
2344 }
2345 if (!isdigit(*argrest)) badarg = TRUE;
2346 break;
2347
2348
2349 /* -i: Set flag so dot doesn't end non-SMTP input (same as -oi, seems
2350 not to be documented for sendmail but mailx (at least) uses it) */
2351
2352 case 'i':
2353 if (*argrest == 0) dot_ends = FALSE; else badarg = TRUE;
2354 break;
2355
2356
2357 case 'M':
2358 receiving_message = FALSE;
2359
2360 /* -MC: continue delivery of another message via an existing open
2361 file descriptor. This option is used for an internal call by the
2362 smtp transport when there is a pending message waiting to go to an
2363 address to which it has got a connection. Five subsequent arguments are
2364 required: transport name, host name, IP address, sequence number, and
2365 message_id. Transports may decline to create new processes if the sequence
2366 number gets too big. The channel is stdin. This (-MC) must be the last
2367 argument. There's a subsequent check that the real-uid is privileged.
2368
2369 If we are running in the test harness. delay for a bit, to let the process
2370 that set this one up complete. This makes for repeatability of the logging,
2371 etc. output. */
2372
2373 if (Ustrcmp(argrest, "C") == 0)
2374 {
2375 union sockaddr_46 interface_sock;
2376 EXIM_SOCKLEN_T size = sizeof(interface_sock);
2377
2378 if (argc != i + 6)
2379 {
2380 fprintf(stderr, "exim: too many or too few arguments after -MC\n");
2381 return EXIT_FAILURE;
2382 }
2383
2384 if (msg_action_arg >= 0)
2385 {
2386 fprintf(stderr, "exim: incompatible arguments\n");
2387 return EXIT_FAILURE;
2388 }
2389
2390 continue_transport = argv[++i];
2391 continue_hostname = argv[++i];
2392 continue_host_address = argv[++i];
2393 continue_sequence = Uatoi(argv[++i]);
2394 msg_action = MSG_DELIVER;
2395 msg_action_arg = ++i;
2396 forced_delivery = TRUE;
2397 queue_run_pid = passed_qr_pid;
2398 queue_run_pipe = passed_qr_pipe;
2399
2400 if (!mac_ismsgid(argv[i]))
2401 {
2402 fprintf(stderr, "exim: malformed message id %s after -MC option\n",
2403 argv[i]);
2404 return EXIT_FAILURE;
2405 }
2406
2407 /* Set up $sending_ip_address and $sending_port */
2408
2409 if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
2410 &size) == 0)
2411 sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
2412 &sending_port);
2413 else
2414 {
2415 fprintf(stderr, "exim: getsockname() failed after -MC option: %s\n",
2416 strerror(errno));
2417 return EXIT_FAILURE;
2418 }
2419
2420 if (running_in_test_harness) millisleep(500);
2421 break;
2422 }
2423
2424 /* -MCA: set the smtp_authenticated flag; this is useful only when it
2425 precedes -MC (see above). The flag indicates that the host to which
2426 Exim is connected has accepted an AUTH sequence. */
2427
2428 else if (Ustrcmp(argrest, "CA") == 0)
2429 {
2430 smtp_authenticated = TRUE;
2431 break;
2432 }
2433
2434 /* -MCP: set the smtp_use_pipelining flag; this is useful only when
2435 it preceded -MC (see above) */
2436
2437 else if (Ustrcmp(argrest, "CP") == 0)
2438 {
2439 smtp_use_pipelining = TRUE;
2440 break;
2441 }
2442
2443 /* -MCQ: pass on the pid of the queue-running process that started
2444 this chain of deliveries and the fd of its synchronizing pipe; this
2445 is useful only when it precedes -MC (see above) */
2446
2447 else if (Ustrcmp(argrest, "CQ") == 0)
2448 {
2449 if(++i < argc) passed_qr_pid = (pid_t)(Uatol(argv[i]));
2450 else badarg = TRUE;
2451 if(++i < argc) passed_qr_pipe = (int)(Uatol(argv[i]));
2452 else badarg = TRUE;
2453 break;
2454 }
2455
2456 /* -MCS: set the smtp_use_size flag; this is useful only when it
2457 precedes -MC (see above) */
2458
2459 else if (Ustrcmp(argrest, "CS") == 0)
2460 {
2461 smtp_use_size = TRUE;
2462 break;
2463 }
2464
2465 /* -MCT: set the tls_offered flag; this is useful only when it
2466 precedes -MC (see above). The flag indicates that the host to which
2467 Exim is connected has offered TLS support. */
2468
2469 #ifdef SUPPORT_TLS
2470 else if (Ustrcmp(argrest, "CT") == 0)
2471 {
2472 tls_offered = TRUE;
2473 break;
2474 }
2475 #endif
2476
2477 /* -M[x]: various operations on the following list of message ids:
2478 -M deliver the messages, ignoring next retry times and thawing
2479 -Mc deliver the messages, checking next retry times, no thawing
2480 -Mf freeze the messages
2481 -Mg give up on the messages
2482 -Mt thaw the messages
2483 -Mrm remove the messages
2484 In the above cases, this must be the last option. There are also the
2485 following options which are followed by a single message id, and which
2486 act on that message. Some of them use the "recipient" addresses as well.
2487 -Mar add recipient(s)
2488 -Mmad mark all recipients delivered
2489 -Mmd mark recipients(s) delivered
2490 -Mes edit sender
2491 -Mset load a message for use with -be
2492 -Mvb show body
2493 -Mvc show copy (of whole message, in RFC 2822 format)
2494 -Mvh show header
2495 -Mvl show log
2496 */
2497
2498 else if (*argrest == 0)
2499 {
2500 msg_action = MSG_DELIVER;
2501 forced_delivery = deliver_force_thaw = TRUE;
2502 }
2503 else if (Ustrcmp(argrest, "ar") == 0)
2504 {
2505 msg_action = MSG_ADD_RECIPIENT;
2506 one_msg_action = TRUE;
2507 }
2508 else if (Ustrcmp(argrest, "c") == 0) msg_action = MSG_DELIVER;
2509 else if (Ustrcmp(argrest, "es") == 0)
2510 {
2511 msg_action = MSG_EDIT_SENDER;
2512 one_msg_action = TRUE;
2513 }
2514 else if (Ustrcmp(argrest, "f") == 0) msg_action = MSG_FREEZE;
2515 else if (Ustrcmp(argrest, "g") == 0)
2516 {
2517 msg_action = MSG_DELIVER;
2518 deliver_give_up = TRUE;
2519 }
2520 else if (Ustrcmp(argrest, "mad") == 0)
2521 {
2522 msg_action = MSG_MARK_ALL_DELIVERED;
2523 }
2524 else if (Ustrcmp(argrest, "md") == 0)
2525 {
2526 msg_action = MSG_MARK_DELIVERED;
2527 one_msg_action = TRUE;
2528 }
2529 else if (Ustrcmp(argrest, "rm") == 0) msg_action = MSG_REMOVE;
2530 else if (Ustrcmp(argrest, "set") == 0)
2531 {
2532 msg_action = MSG_LOAD;
2533 one_msg_action = TRUE;
2534 }
2535 else if (Ustrcmp(argrest, "t") == 0) msg_action = MSG_THAW;
2536 else if (Ustrcmp(argrest, "vb") == 0)
2537 {
2538 msg_action = MSG_SHOW_BODY;
2539 one_msg_action = TRUE;
2540 }
2541 else if (Ustrcmp(argrest, "vc") == 0)
2542 {
2543 msg_action = MSG_SHOW_COPY;
2544 one_msg_action = TRUE;
2545 }
2546 else if (Ustrcmp(argrest, "vh") == 0)
2547 {
2548 msg_action = MSG_SHOW_HEADER;
2549 one_msg_action = TRUE;
2550 }
2551 else if (Ustrcmp(argrest, "vl") == 0)
2552 {
2553 msg_action = MSG_SHOW_LOG;
2554 one_msg_action = TRUE;
2555 }
2556 else { badarg = TRUE; break; }
2557
2558 /* All the -Mxx options require at least one message id. */
2559
2560 msg_action_arg = i + 1;
2561 if (msg_action_arg >= argc)
2562 {
2563 fprintf(stderr, "exim: no message ids given after %s option\n", arg);
2564 return EXIT_FAILURE;
2565 }
2566
2567 /* Some require only message ids to follow */
2568
2569 if (!one_msg_action)
2570 {
2571 int j;
2572 for (j = msg_action_arg; j < argc; j++) if (!mac_ismsgid(argv[j]))
2573 {
2574 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2575 argv[j], arg);
2576 return EXIT_FAILURE;
2577 }
2578 goto END_ARG; /* Remaining args are ids */
2579 }
2580
2581 /* Others require only one message id, possibly followed by addresses,
2582 which will be handled as normal arguments. */
2583
2584 else
2585 {
2586 if (!mac_ismsgid(argv[msg_action_arg]))
2587 {
2588 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2589 argv[msg_action_arg], arg);
2590 return EXIT_FAILURE;
2591 }
2592 i++;
2593 }
2594 break;
2595
2596
2597 /* Some programs seem to call the -om option without the leading o;
2598 for sendmail it askes for "me too". Exim always does this. */
2599
2600 case 'm':
2601 if (*argrest != 0) badarg = TRUE;
2602 break;
2603
2604
2605 /* -N: don't do delivery - a debugging option that stops transports doing
2606 their thing. It implies debugging at the D_v level. */
2607
2608 case 'N':
2609 if (*argrest == 0)
2610 {
2611 dont_deliver = TRUE;
2612 debug_selector |= D_v;
2613 debug_file = stderr;
2614 }
2615 else badarg = TRUE;
2616 break;
2617
2618
2619 /* -n: This means "don't alias" in sendmail, apparently. Just ignore
2620 it. */
2621
2622 case 'n':
2623 break;
2624
2625 /* -O: Just ignore it. In sendmail, apparently -O option=value means set
2626 option to the specified value. This form uses long names. We need to handle
2627 -O option=value and -Ooption=value. */
2628
2629 case 'O':
2630 if (*argrest == 0)
2631 {
2632 if (++i >= argc)
2633 {
2634 fprintf(stderr, "exim: string expected after -O\n");
2635 exit(EXIT_FAILURE);
2636 }
2637 }
2638 break;
2639
2640 case 'o':
2641
2642 /* -oA: Set an argument for the bi command (sendmail's "alternate alias
2643 file" option). */
2644
2645 if (*argrest == 'A')
2646 {
2647 alias_arg = argrest + 1;
2648 if (alias_arg[0] == 0)
2649 {
2650 if (i+1 < argc) alias_arg = argv[++i]; else
2651 {
2652 fprintf(stderr, "exim: string expected after -oA\n");
2653 exit(EXIT_FAILURE);
2654 }
2655 }
2656 }
2657
2658 /* -oB: Set a connection message max value for remote deliveries */
2659
2660 else if (*argrest == 'B')
2661 {
2662 uschar *p = argrest + 1;
2663 if (p[0] == 0)
2664 {
2665 if (i+1 < argc && isdigit((argv[i+1][0]))) p = argv[++i]; else
2666 {
2667 connection_max_messages = 1;
2668 p = NULL;
2669 }
2670 }
2671
2672 if (p != NULL)
2673 {
2674 if (!isdigit(*p))
2675 {
2676 fprintf(stderr, "exim: number expected after -oB\n");
2677 exit(EXIT_FAILURE);
2678 }
2679 connection_max_messages = Uatoi(p);
2680 }
2681 }
2682
2683 /* -odb: background delivery */
2684
2685 else if (Ustrcmp(argrest, "db") == 0)
2686 {
2687 synchronous_delivery = FALSE;
2688 arg_queue_only = FALSE;
2689 queue_only_set = TRUE;
2690 }
2691
2692 /* -odf: foreground delivery (smail-compatible option); same effect as
2693 -odi: interactive (synchronous) delivery (sendmail-compatible option)
2694 */
2695
2696 else if (Ustrcmp(argrest, "df") == 0 || Ustrcmp(argrest, "di") == 0)
2697 {
2698 synchronous_delivery = TRUE;
2699 arg_queue_only = FALSE;
2700 queue_only_set = TRUE;
2701 }
2702
2703 /* -odq: queue only */
2704
2705 else if (Ustrcmp(argrest, "dq") == 0)
2706 {
2707 synchronous_delivery = FALSE;
2708 arg_queue_only = TRUE;
2709 queue_only_set = TRUE;
2710 }
2711
2712 /* -odqs: queue SMTP only - do local deliveries and remote routing,
2713 but no remote delivery */
2714
2715 else if (Ustrcmp(argrest, "dqs") == 0)
2716 {
2717 queue_smtp = TRUE;
2718 arg_queue_only = FALSE;
2719 queue_only_set = TRUE;
2720 }
2721
2722 /* -oex: Sendmail error flags. As these are also accepted without the
2723 leading -o prefix, for compatibility with vacation and other callers,
2724 they are handled with -e above. */
2725
2726 /* -oi: Set flag so dot doesn't end non-SMTP input (same as -i)
2727 -oitrue: Another sendmail syntax for the same */
2728
2729 else if (Ustrcmp(argrest, "i") == 0 ||
2730 Ustrcmp(argrest, "itrue") == 0)
2731 dot_ends = FALSE;
2732
2733 /* -oM*: Set various characteristics for an incoming message; actually
2734 acted on for trusted callers only. */
2735
2736 else if (*argrest == 'M')
2737 {
2738 if (i+1 >= argc)
2739 {
2740 fprintf(stderr, "exim: data expected after -o%s\n", argrest);
2741 exit(EXIT_FAILURE);
2742 }
2743
2744 /* -oMa: Set sender host address */
2745
2746 if (Ustrcmp(argrest, "Ma") == 0) sender_host_address = argv[++i];
2747
2748 /* -oMaa: Set authenticator name */
2749
2750 else if (Ustrcmp(argrest, "Maa") == 0)
2751 sender_host_authenticated = argv[++i];
2752
2753 /* -oMas: setting authenticated sender */
2754
2755 else if (Ustrcmp(argrest, "Mas") == 0) authenticated_sender = argv[++i];
2756
2757 /* -oMai: setting authenticated id */
2758
2759 else if (Ustrcmp(argrest, "Mai") == 0) authenticated_id = argv[++i];
2760
2761 /* -oMi: Set incoming interface address */
2762
2763 else if (Ustrcmp(argrest, "Mi") == 0) interface_address = argv[++i];
2764
2765 /* -oMr: Received protocol */
2766
2767 else if (Ustrcmp(argrest, "Mr") == 0) received_protocol = argv[++i];
2768
2769 /* -oMs: Set sender host name */
2770
2771 else if (Ustrcmp(argrest, "Ms") == 0) sender_host_name = argv[++i];
2772
2773 /* -oMt: Set sender ident */
2774
2775 else if (Ustrcmp(argrest, "Mt") == 0)
2776 {
2777 sender_ident_set = TRUE;
2778 sender_ident = argv[++i];
2779 }
2780
2781 /* Else a bad argument */
2782
2783 else
2784 {
2785 badarg = TRUE;
2786 break;
2787 }
2788 }
2789
2790 /* -om: Me-too flag for aliases. Exim always does this. Some programs
2791 seem to call this as -m (undocumented), so that is also accepted (see
2792 above). */
2793
2794 else if (Ustrcmp(argrest, "m") == 0) {}
2795
2796 /* -oo: An ancient flag for old-style addresses which still seems to
2797 crop up in some calls (see in SCO). */
2798
2799 else if (Ustrcmp(argrest, "o") == 0) {}
2800
2801 /* -oP <name>: set pid file path for daemon */
2802
2803 else if (Ustrcmp(argrest, "P") == 0)
2804 override_pid_file_path = argv[++i];
2805
2806 /* -or <n>: set timeout for non-SMTP acceptance
2807 -os <n>: set timeout for SMTP acceptance */
2808
2809 else if (*argrest == 'r' || *argrest == 's')
2810 {
2811 int *tp = (*argrest == 'r')?
2812 &arg_receive_timeout : &arg_smtp_receive_timeout;
2813 if (argrest[1] == 0)
2814 {
2815 if (i+1 < argc) *tp= readconf_readtime(argv[++i], 0, FALSE);
2816 }
2817 else *tp = readconf_readtime(argrest + 1, 0, FALSE);
2818 if (*tp < 0)
2819 {
2820 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
2821 exit(EXIT_FAILURE);
2822 }
2823 }
2824
2825 /* -oX <list>: Override local_interfaces and/or default daemon ports */
2826
2827 else if (Ustrcmp(argrest, "X") == 0)
2828 override_local_interfaces = argv[++i];
2829
2830 /* Unknown -o argument */
2831
2832 else badarg = TRUE;
2833 break;
2834
2835
2836 /* -ps: force Perl startup; -pd force delayed Perl startup */
2837
2838 case 'p':
2839 #ifdef EXIM_PERL
2840 if (*argrest == 's' && argrest[1] == 0)
2841 {
2842 perl_start_option = 1;
2843 break;
2844 }
2845 if (*argrest == 'd' && argrest[1] == 0)
2846 {
2847 perl_start_option = -1;
2848 break;
2849 }
2850 #endif
2851
2852 /* -panythingelse is taken as the Sendmail-compatible argument -prval:sval,
2853 which sets the host protocol and host name */
2854
2855 if (*argrest == 0)
2856 {
2857 if (i+1 < argc) argrest = argv[++i]; else
2858 { badarg = TRUE; break; }
2859 }
2860
2861 if (*argrest != 0)
2862 {
2863 uschar *hn = Ustrchr(argrest, ':');
2864 if (hn == NULL)
2865 {
2866 received_protocol = argrest;
2867 }
2868 else
2869 {
2870 received_protocol = string_copyn(argrest, hn - argrest);
2871 sender_host_name = hn + 1;
2872 }
2873 }
2874 break;
2875
2876
2877 case 'q':
2878 receiving_message = FALSE;
2879 if (queue_interval >= 0)
2880 {
2881 fprintf(stderr, "exim: -q specified more than once\n");
2882 exit(EXIT_FAILURE);
2883 }
2884
2885 /* -qq...: Do queue runs in a 2-stage manner */
2886
2887 if (*argrest == 'q')
2888 {
2889 queue_2stage = TRUE;
2890 argrest++;
2891 }
2892
2893 /* -qi...: Do only first (initial) deliveries */
2894
2895 if (*argrest == 'i')
2896 {
2897 queue_run_first_delivery = TRUE;
2898 argrest++;
2899 }
2900
2901 /* -qf...: Run the queue, forcing deliveries
2902 -qff..: Ditto, forcing thawing as well */
2903
2904 if (*argrest == 'f')
2905 {
2906 queue_run_force = TRUE;
2907 if (*(++argrest) == 'f')
2908 {
2909 deliver_force_thaw = TRUE;
2910 argrest++;
2911 }
2912 }
2913
2914 /* -q[f][f]l...: Run the queue only on local deliveries */
2915
2916 if (*argrest == 'l')
2917 {
2918 queue_run_local = TRUE;
2919 argrest++;
2920 }
2921
2922 /* -q[f][f][l]: Run the queue, optionally forced, optionally local only,
2923 optionally starting from a given message id. */
2924
2925 if (*argrest == 0 &&
2926 (i + 1 >= argc || argv[i+1][0] == '-' || mac_ismsgid(argv[i+1])))
2927 {
2928 queue_interval = 0;
2929 if (i+1 < argc && mac_ismsgid(argv[i+1]))
2930 start_queue_run_id = argv[++i];
2931 if (i+1 < argc && mac_ismsgid(argv[i+1]))
2932 stop_queue_run_id = argv[++i];
2933 }
2934
2935 /* -q[f][f][l]<n>: Run the queue at regular intervals, optionally forced,
2936 optionally local only. */
2937
2938 else
2939 {
2940 if (*argrest != 0)
2941 queue_interval = readconf_readtime(argrest, 0, FALSE);
2942 else
2943 queue_interval = readconf_readtime(argv[++i], 0, FALSE);
2944 if (queue_interval <= 0)
2945 {
2946 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
2947 exit(EXIT_FAILURE);
2948 }
2949 }
2950 break;
2951
2952
2953 case 'R': /* Synonymous with -qR... */
2954 receiving_message = FALSE;
2955
2956 /* -Rf: As -R (below) but force all deliveries,
2957 -Rff: Ditto, but also thaw all frozen messages,
2958 -Rr: String is regex
2959 -Rrf: Regex and force
2960 -Rrff: Regex and force and thaw
2961
2962 in all cases provided there are no further characters in this
2963 argument. */
2964
2965 if (*argrest != 0)
2966 {
2967 int i;
2968 for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
2969 {
2970 if (Ustrcmp(argrest, rsopts[i]) == 0)
2971 {
2972 if (i != 2) queue_run_force = TRUE;
2973 if (i >= 2) deliver_selectstring_regex = TRUE;
2974 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
2975 argrest += Ustrlen(rsopts[i]);
2976 }
2977 }
2978 }
2979
2980 /* -R: Set string to match in addresses for forced queue run to
2981 pick out particular messages. */
2982
2983 if (*argrest == 0)
2984 {
2985 if (i+1 < argc) deliver_selectstring = argv[++i]; else
2986 {
2987 fprintf(stderr, "exim: string expected after -R\n");
2988 exit(EXIT_FAILURE);
2989 }
2990 }
2991 else deliver_selectstring = argrest;
2992 break;
2993
2994
2995 /* -r: an obsolete synonym for -f (see above) */
2996
2997
2998 /* -S: Like -R but works on sender. */
2999
3000 case 'S': /* Synonymous with -qS... */
3001 receiving_message = FALSE;
3002
3003 /* -Sf: As -S (below) but force all deliveries,
3004 -Sff: Ditto, but also thaw all frozen messages,
3005 -Sr: String is regex
3006 -Srf: Regex and force
3007 -Srff: Regex and force and thaw
3008
3009 in all cases provided there are no further characters in this
3010 argument. */
3011
3012 if (*argrest != 0)
3013 {
3014 int i;
3015 for (i = 0; i < sizeof(rsopts)/sizeof(uschar *); i++)
3016 {
3017 if (Ustrcmp(argrest, rsopts[i]) == 0)
3018 {
3019 if (i != 2) queue_run_force = TRUE;
3020 if (i >= 2) deliver_selectstring_sender_regex = TRUE;
3021 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3022 argrest += Ustrlen(rsopts[i]);
3023 }
3024 }
3025 }
3026
3027 /* -S: Set string to match in addresses for forced queue run to
3028 pick out particular messages. */
3029
3030 if (*argrest == 0)
3031 {
3032 if (i+1 < argc) deliver_selectstring_sender = argv[++i]; else
3033 {
3034 fprintf(stderr, "exim: string expected after -S\n");
3035 exit(EXIT_FAILURE);
3036 }
3037 }
3038 else deliver_selectstring_sender = argrest;
3039 break;
3040
3041 /* -Tqt is an option that is exclusively for use by the testing suite.
3042 It is not recognized in other circumstances. It allows for the setting up
3043 of explicit "queue times" so that various warning/retry things can be
3044 tested. Otherwise variability of clock ticks etc. cause problems. */
3045
3046 case 'T':
3047 if (running_in_test_harness && Ustrcmp(argrest, "qt") == 0)
3048 fudged_queue_times = argv[++i];
3049 else badarg = TRUE;
3050 break;
3051
3052
3053 /* -t: Set flag to extract recipients from body of message. */
3054
3055 case 't':
3056 if (*argrest == 0) extract_recipients = TRUE;
3057
3058 /* -ti: Set flag to extract recipients from body of message, and also
3059 specify that dot does not end the message. */
3060
3061 else if (Ustrcmp(argrest, "i") == 0)
3062 {
3063 extract_recipients = TRUE;
3064 dot_ends = FALSE;
3065 }
3066
3067 /* -tls-on-connect: don't wait for STARTTLS (for old clients) */
3068
3069 #ifdef SUPPORT_TLS
3070 else if (Ustrcmp(argrest, "ls-on-connect") == 0) tls_on_connect = TRUE;
3071 #endif
3072
3073 else badarg = TRUE;
3074 break;
3075
3076
3077 /* -U: This means "initial user submission" in sendmail, apparently. The
3078 doc claims that in future sendmail may refuse syntactically invalid
3079 messages instead of fixing them. For the moment, we just ignore it. */
3080
3081 case 'U':
3082 break;
3083
3084
3085 /* -v: verify things - this is a very low-level debugging */
3086
3087 case 'v':
3088 if (*argrest == 0)
3089 {
3090 debug_selector |= D_v;
3091 debug_file = stderr;
3092 }
3093 else badarg = TRUE;
3094 break;
3095
3096
3097 /* -x: AIX uses this to indicate some fancy 8-bit character stuff:
3098
3099 The -x flag tells the sendmail command that mail from a local
3100 mail program has National Language Support (NLS) extended characters
3101 in the body of the mail item. The sendmail command can send mail with
3102 extended NLS characters across networks that normally corrupts these
3103 8-bit characters.
3104
3105 As Exim is 8-bit clean, it just ignores this flag. */
3106
3107 case 'x':
3108 if (*argrest != 0) badarg = TRUE;
3109 break;
3110
3111 /* All other initial characters are errors */
3112
3113 default:
3114 badarg = TRUE;
3115 break;
3116 } /* End of high-level switch statement */
3117
3118 /* Failed to recognize the option, or syntax error */
3119
3120 if (badarg)
3121 {
3122 fprintf(stderr, "exim abandoned: unknown, malformed, or incomplete "
3123 "option %s\n", arg);
3124 exit(EXIT_FAILURE);
3125 }
3126 }
3127
3128
3129 /* If -R or -S have been specified without -q, assume a single queue run. */
3130
3131 if ((deliver_selectstring != NULL || deliver_selectstring_sender != NULL) &&
3132 queue_interval < 0) queue_interval = 0;
3133
3134
3135 END_ARG:
3136 /* If usage_wanted is set we call the usage function - which never returns */
3137 if (usage_wanted) exim_usage(called_as);
3138
3139 /* Arguments have been processed. Check for incompatibilities. */
3140 if ((
3141 (smtp_input || extract_recipients || recipients_arg < argc) &&
3142 (daemon_listen || queue_interval >= 0 || bi_option ||
3143 test_retry_arg >= 0 || test_rewrite_arg >= 0 ||
3144 filter_test != FTEST_NONE || (msg_action_arg > 0 && !one_msg_action))
3145 ) ||
3146 (
3147 msg_action_arg > 0 &&
3148 (daemon_listen || queue_interval >= 0 || list_options ||
3149 (checking && msg_action != MSG_LOAD) ||
3150 bi_option || test_retry_arg >= 0 || test_rewrite_arg >= 0)
3151 ) ||
3152 (
3153 (daemon_listen || queue_interval >= 0) &&
3154 (sender_address != NULL || list_options || list_queue || checking ||
3155 bi_option)
3156 ) ||
3157 (
3158 daemon_listen && queue_interval == 0
3159 ) ||
3160 (
3161 list_options &&
3162 (checking || smtp_input || extract_recipients ||
3163 filter_test != FTEST_NONE || bi_option)
3164 ) ||
3165 (
3166 verify_address_mode &&
3167 (address_test_mode || smtp_input || extract_recipients ||
3168 filter_test != FTEST_NONE || bi_option)
3169 ) ||
3170 (
3171 address_test_mode && (smtp_input || extract_recipients ||
3172 filter_test != FTEST_NONE || bi_option)
3173 ) ||
3174 (
3175 smtp_input && (sender_address != NULL || filter_test != FTEST_NONE ||
3176 extract_recipients)
3177 ) ||
3178 (
3179 deliver_selectstring != NULL && queue_interval < 0
3180 ) ||
3181 (
3182 msg_action == MSG_LOAD &&
3183 (!expansion_test || expansion_test_message != NULL)
3184 )
3185 )
3186 {
3187 fprintf(stderr, "exim: incompatible command-line options or arguments\n");
3188 exit(EXIT_FAILURE);
3189 }
3190
3191 /* If debugging is set up, set the file and the file descriptor to pass on to
3192 child processes. It should, of course, be 2 for stderr. Also, force the daemon
3193 to run in the foreground. */
3194
3195 if (debug_selector != 0)
3196 {
3197 debug_file = stderr;
3198 debug_fd = fileno(debug_file);
3199 background_daemon = FALSE;
3200 if (running_in_test_harness) millisleep(100); /* lets caller finish */
3201 if (debug_selector != D_v) /* -v only doesn't show this */
3202 {
3203 debug_printf("Exim version %s uid=%ld gid=%ld pid=%d D=%x\n",
3204 version_string, (long int)real_uid, (long int)real_gid, (int)getpid(),
3205 debug_selector);
3206 if (!version_printed)
3207 show_whats_supported(stderr);
3208 }
3209 }
3210
3211 /* When started with root privilege, ensure that the limits on the number of
3212 open files and the number of processes (where that is accessible) are
3213 sufficiently large, or are unset, in case Exim has been called from an
3214 environment where the limits are screwed down. Not all OS have the ability to
3215 change some of these limits. */
3216
3217 if (unprivileged)
3218 {
3219 DEBUG(D_any) debug_print_ids(US"Exim has no root privilege:");
3220 }
3221 else
3222 {
3223 struct rlimit rlp;
3224
3225 #ifdef RLIMIT_NOFILE
3226 if (getrlimit(RLIMIT_NOFILE, &rlp) < 0)
3227 {
3228 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NOFILE) failed: %s",
3229 strerror(errno));
3230 rlp.rlim_cur = rlp.rlim_max = 0;
3231 }
3232
3233 /* I originally chose 1000 as a nice big number that was unlikely to
3234 be exceeded. It turns out that some older OS have a fixed upper limit of
3235 256. */
3236
3237 if (rlp.rlim_cur < 1000)
3238 {
3239 rlp.rlim_cur = rlp.rlim_max = 1000;
3240 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3241 {
3242 rlp.rlim_cur = rlp.rlim_max = 256;
3243 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3244 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NOFILE) failed: %s",
3245 strerror(errno));
3246 }
3247 }
3248 #endif
3249
3250 #ifdef RLIMIT_NPROC
3251 if (getrlimit(RLIMIT_NPROC, &rlp) < 0)
3252 {
3253 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NPROC) failed: %s",
3254 strerror(errno));
3255 rlp.rlim_cur = rlp.rlim_max = 0;
3256 }
3257
3258 #ifdef RLIM_INFINITY
3259 if (rlp.rlim_cur != RLIM_INFINITY && rlp.rlim_cur < 1000)
3260 {
3261 rlp.rlim_cur = rlp.rlim_max = RLIM_INFINITY;
3262 #else
3263 if (rlp.rlim_cur < 1000)
3264 {
3265 rlp.rlim_cur = rlp.rlim_max = 1000;
3266 #endif
3267 if (setrlimit(RLIMIT_NPROC, &rlp) < 0)
3268 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NPROC) failed: %s",
3269 strerror(errno));
3270 }
3271 #endif
3272 }
3273
3274 /* Exim is normally entered as root (but some special configurations are
3275 possible that don't do this). However, it always spins off sub-processes that
3276 set their uid and gid as required for local delivery. We don't want to pass on
3277 any extra groups that root may belong to, so we want to get rid of them all at
3278 this point.
3279
3280 We need to obey setgroups() at this stage, before possibly giving up root
3281 privilege for a changed configuration file, but later on we might need to
3282 check on the additional groups for the admin user privilege - can't do that
3283 till after reading the config, which might specify the exim gid. Therefore,
3284 save the group list here first. */
3285
3286 group_count = getgroups(NGROUPS_MAX, group_list);
3287 if (group_count < 0)
3288 {
3289 fprintf(stderr, "exim: getgroups() failed: %s\n", strerror(errno));
3290 exit(EXIT_FAILURE);
3291 }
3292
3293 /* There is a fundamental difference in some BSD systems in the matter of
3294 groups. FreeBSD and BSDI are known to be different; NetBSD and OpenBSD are
3295 known not to be different. On the "different" systems there is a single group
3296 list, and the first entry in it is the current group. On all other versions of
3297 Unix there is a supplementary group list, which is in *addition* to the current
3298 group. Consequently, to get rid of all extraneous groups on a "standard" system
3299 you pass over 0 groups to setgroups(), while on a "different" system you pass
3300 over a single group - the current group, which is always the first group in the
3301 list. Calling setgroups() with zero groups on a "different" system results in
3302 an error return. The following code should cope with both types of system.
3303
3304 However, if this process isn't running as root, setgroups() can't be used
3305 since you have to be root to run it, even if throwing away groups. Not being
3306 root here happens only in some unusual configurations. We just ignore the
3307 error. */
3308
3309 if (setgroups(0, NULL) != 0)
3310 {
3311 if (setgroups(1, group_list) != 0 && !unprivileged)
3312 {
3313 fprintf(stderr, "exim: setgroups() failed: %s\n", strerror(errno));
3314 exit(EXIT_FAILURE);
3315 }
3316 }
3317
3318 /* If the configuration file name has been altered by an argument on the
3319 command line (either a new file name or a macro definition) and the caller is
3320 not root, or if this is a filter testing run, remove any setuid privilege the
3321 program has and run as the underlying user.
3322
3323 The exim user is locked out of this, which severely restricts the use of -C
3324 for some purposes.
3325
3326 Otherwise, set the real ids to the effective values (should be root unless run
3327 from inetd, which it can either be root or the exim uid, if one is configured).
3328
3329 There is a private mechanism for bypassing some of this, in order to make it
3330 possible to test lots of configurations automatically, without having either to
3331 recompile each time, or to patch in an actual configuration file name and other
3332 values (such as the path name). If running in the test harness, pretend that
3333 configuration file changes and macro definitions haven't happened. */
3334
3335 if (( /* EITHER */
3336 (!trusted_config || /* Config changed, or */
3337 !macros_trusted()) && /* impermissible macros and */
3338 real_uid != root_uid && /* Not root, and */
3339 !running_in_test_harness /* Not fudged */
3340 ) || /* OR */
3341 expansion_test /* expansion testing */
3342 || /* OR */
3343 filter_test != FTEST_NONE) /* Filter testing */
3344 {
3345 setgroups(group_count, group_list);
3346 exim_setugid(real_uid, real_gid, FALSE,
3347 US"-C, -D, -be or -bf forces real uid");
3348 removed_privilege = TRUE;
3349
3350 /* In the normal case when Exim is called like this, stderr is available
3351 and should be used for any logging information because attempts to write
3352 to the log will usually fail. To arrange this, we unset really_exim. However,
3353 if no stderr is available there is no point - we might as well have a go
3354 at the log (if it fails, syslog will be written).
3355
3356 Note that if the invoker is Exim, the logs remain available. Messing with
3357 this causes unlogged successful deliveries. */
3358
3359 if ((log_stderr != NULL) && (real_uid != exim_uid))
3360 really_exim = FALSE;
3361 }
3362
3363 /* Privilege is to be retained for the moment. It may be dropped later,
3364 depending on the job that this Exim process has been asked to do. For now, set
3365 the real uid to the effective so that subsequent re-execs of Exim are done by a
3366 privileged user. */
3367
3368 else exim_setugid(geteuid(), getegid(), FALSE, US"forcing real = effective");
3369
3370 /* If testing a filter, open the file(s) now, before wasting time doing other
3371 setups and reading the message. */
3372
3373 if ((filter_test & FTEST_SYSTEM) != 0)
3374 {
3375 filter_sfd = Uopen(filter_test_sfile, O_RDONLY, 0);
3376 if (filter_sfd < 0)
3377 {
3378 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_sfile,
3379 strerror(errno));
3380 return EXIT_FAILURE;
3381 }
3382 }
3383
3384 if ((filter_test & FTEST_USER) != 0)
3385 {
3386 filter_ufd = Uopen(filter_test_ufile, O_RDONLY, 0);
3387 if (filter_ufd < 0)
3388 {
3389 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_ufile,
3390 strerror(errno));
3391 return EXIT_FAILURE;
3392 }
3393 }
3394
3395 /* Read the main runtime configuration data; this gives up if there
3396 is a failure. It leaves the configuration file open so that the subsequent
3397 configuration data for delivery can be read if needed. */
3398
3399 readconf_main();
3400
3401 /* Handle the decoding of logging options. */
3402
3403 decode_bits(&log_write_selector, &log_extra_selector, 0, 0,
3404 log_selector_string, log_options, log_options_count, US"log", 0);
3405
3406 DEBUG(D_any)
3407 {
3408 debug_printf("configuration file is %s\n", config_main_filename);
3409 debug_printf("log selectors = %08x %08x\n", log_write_selector,
3410 log_extra_selector);
3411 }
3412
3413 /* If domain literals are not allowed, check the sender address that was
3414 supplied with -f. Ditto for a stripped trailing dot. */
3415
3416 if (sender_address != NULL)
3417 {
3418 if (sender_address[sender_address_domain] == '[' && !allow_domain_literals)
3419 {
3420 fprintf(stderr, "exim: bad -f address \"%s\": domain literals not "
3421 "allowed\n", sender_address);
3422 return EXIT_FAILURE;
3423 }
3424 if (f_end_dot && !strip_trailing_dot)
3425 {
3426 fprintf(stderr, "exim: bad -f address \"%s.\": domain is malformed "
3427 "(trailing dot not allowed)\n", sender_address);
3428 return EXIT_FAILURE;
3429 }
3430 }
3431
3432 /* Paranoia check of maximum lengths of certain strings. There is a check
3433 on the length of the log file path in log.c, which will come into effect
3434 if there are any calls to write the log earlier than this. However, if we
3435 get this far but the string is very long, it is better to stop now than to
3436 carry on and (e.g.) receive a message and then have to collapse. The call to
3437 log_write() from here will cause the ultimate panic collapse if the complete
3438 file name exceeds the buffer length. */
3439
3440 if (Ustrlen(log_file_path) > 200)
3441 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3442 "log_file_path is longer than 200 chars: aborting");
3443
3444 if (Ustrlen(pid_file_path) > 200)
3445 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3446 "pid_file_path is longer than 200 chars: aborting");
3447
3448 if (Ustrlen(spool_directory) > 200)
3449 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3450 "spool_directory is longer than 200 chars: aborting");
3451
3452 /* Length check on the process name given to syslog for its TAG field,
3453 which is only permitted to be 32 characters or less. See RFC 3164. */
3454
3455 if (Ustrlen(syslog_processname) > 32)
3456 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3457 "syslog_processname is longer than 32 chars: aborting");
3458
3459 /* In some operating systems, the environment variable TMPDIR controls where
3460 temporary files are created; Exim doesn't use these (apart from when delivering
3461 to MBX mailboxes), but called libraries such as DBM libraries may require them.
3462 If TMPDIR is found in the environment, reset it to the value defined in the
3463 TMPDIR macro, if this macro is defined. */
3464
3465 #ifdef TMPDIR
3466 {
3467 uschar **p;
3468 for (p = USS environ; *p != NULL; p++)
3469 {
3470 if (Ustrncmp(*p, "TMPDIR=", 7) == 0 &&
3471 Ustrcmp(*p+7, TMPDIR) != 0)
3472 {
3473 uschar *newp = malloc(Ustrlen(TMPDIR) + 8);
3474 sprintf(CS newp, "TMPDIR=%s", TMPDIR);
3475 *p = newp;
3476 DEBUG(D_any) debug_printf("reset TMPDIR=%s in environment\n", TMPDIR);
3477 }
3478 }
3479 }
3480 #endif
3481
3482 /* Timezone handling. If timezone_string is "utc", set a flag to cause all
3483 timestamps to be in UTC (gmtime() is used instead of localtime()). Otherwise,
3484 we may need to get rid of a bogus timezone setting. This can arise when Exim is
3485 called by a user who has set the TZ variable. This then affects the timestamps
3486 in log files and in Received: headers, and any created Date: header lines. The
3487 required timezone is settable in the configuration file, so nothing can be done
3488 about this earlier - but hopefully nothing will normally be logged earlier than
3489 this. We have to make a new environment if TZ is wrong, but don't bother if
3490 timestamps_utc is set, because then all times are in UTC anyway. */
3491
3492 if (timezone_string != NULL && strcmpic(timezone_string, US"UTC") == 0)
3493 {
3494 timestamps_utc = TRUE;
3495 }
3496 else
3497 {
3498 uschar *envtz = US getenv("TZ");
3499 if ((envtz == NULL && timezone_string != NULL) ||
3500 (envtz != NULL &&
3501 (timezone_string == NULL ||
3502 Ustrcmp(timezone_string, envtz) != 0)))
3503 {
3504 uschar **p = USS environ;
3505 uschar **new;
3506 uschar **newp;
3507 int count = 0;
3508 while (*p++ != NULL) count++;
3509 if (envtz == NULL) count++;
3510 newp = new = malloc(sizeof(uschar *) * (count + 1));
3511 for (p = USS environ; *p != NULL; p++)
3512 {
3513 if (Ustrncmp(*p, "TZ=", 3) == 0) continue;
3514 *newp++ = *p;
3515 }
3516 if (timezone_string != NULL)
3517 {
3518 *newp = malloc(Ustrlen(timezone_string) + 4);
3519 sprintf(CS *newp++, "TZ=%s", timezone_string);
3520 }
3521 *newp = NULL;
3522 environ = CSS new;
3523 tzset();
3524 DEBUG(D_any) debug_printf("Reset TZ to %s: time is %s\n", timezone_string,
3525 tod_stamp(tod_log));
3526 }
3527 }
3528
3529 /* Handle the case when we have removed the setuid privilege because of -C or
3530 -D. This means that the caller of Exim was not root.
3531
3532 There is a problem if we were running as the Exim user. The sysadmin may
3533 expect this case to retain privilege because "the binary was called by the
3534 Exim user", but it hasn't, because either the -D option set macros, or the
3535 -C option set a non-trusted configuration file. There are two possibilities:
3536
3537 (1) If deliver_drop_privilege is set, Exim is not going to re-exec in order
3538 to do message deliveries. Thus, the fact that it is running as a
3539 non-privileged user is plausible, and might be wanted in some special
3540 configurations. However, really_exim will have been set false when
3541 privilege was dropped, to stop Exim trying to write to its normal log
3542 files. Therefore, re-enable normal log processing, assuming the sysadmin
3543 has set up the log directory correctly.
3544
3545 (2) If deliver_drop_privilege is not set, the configuration won't work as
3546 apparently intended, and so we log a panic message. In order to retain
3547 root for -C or -D, the caller must either be root or be invoking a
3548 trusted configuration file (when deliver_drop_privilege is false). */
3549
3550 if (removed_privilege && (!trusted_config || macros != NULL) &&
3551 real_uid == exim_uid)
3552 {
3553 if (deliver_drop_privilege)
3554 really_exim = TRUE; /* let logging work normally */
3555 else
3556 log_write(0, LOG_MAIN|LOG_PANIC,
3557 "exim user lost privilege for using %s option",
3558 trusted_config? "-D" : "-C");
3559 }
3560
3561 /* Start up Perl interpreter if Perl support is configured and there is a
3562 perl_startup option, and the configuration or the command line specifies
3563 initializing starting. Note that the global variables are actually called
3564 opt_perl_xxx to avoid clashing with perl's namespace (perl_*). */
3565
3566 #ifdef EXIM_PERL
3567 if (perl_start_option != 0)
3568 opt_perl_at_start = (perl_start_option > 0);
3569 if (opt_perl_at_start && opt_perl_startup != NULL)
3570 {
3571 uschar *errstr;
3572 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
3573 errstr = init_perl(opt_perl_startup);
3574 if (errstr != NULL)
3575 {
3576 fprintf(stderr, "exim: error in perl_startup code: %s\n", errstr);
3577 return EXIT_FAILURE;
3578 }
3579 opt_perl_started = TRUE;
3580 }
3581 #endif /* EXIM_PERL */
3582
3583 /* Initialise lookup_list
3584 If debugging, already called above via version reporting.
3585 This does mean that debugging causes the list to be initialised while root.
3586 This *should* be harmless -- all modules are loaded from a fixed dir and
3587 it's code that would, if not a module, be part of Exim already. */
3588 init_lookup_list();
3589
3590 /* Log the arguments of the call if the configuration file said so. This is
3591 a debugging feature for finding out what arguments certain MUAs actually use.
3592 Don't attempt it if logging is disabled, or if listing variables or if
3593 verifying/testing addresses or expansions. */
3594
3595 if (((debug_selector & D_any) != 0 || (log_extra_selector & LX_arguments) != 0)
3596 && really_exim && !list_options && !checking)
3597 {
3598 int i;
3599 uschar *p = big_buffer;
3600 Ustrcpy(p, "cwd=");
3601 (void)getcwd(CS p+4, big_buffer_size - 4);
3602 while (*p) p++;
3603 (void)string_format(p, big_buffer_size - (p - big_buffer), " %d args:", argc);
3604 while (*p) p++;
3605 for (i = 0; i < argc; i++)
3606 {
3607 int len = Ustrlen(argv[i]);
3608 uschar *printing;
3609 uschar *quote;
3610 if (p + len + 8 >= big_buffer + big_buffer_size)
3611 {
3612 Ustrcpy(p, " ...");
3613 log_write(0, LOG_MAIN, "%s", big_buffer);
3614 Ustrcpy(big_buffer, "...");
3615 p = big_buffer + 3;
3616 }
3617 printing = string_printing(argv[i]);
3618 if (printing[0] == 0) quote = US"\""; else
3619 {
3620 uschar *pp = printing;
3621 quote = US"";
3622 while (*pp != 0) if (isspace(*pp++)) { quote = US"\""; break; }
3623 }
3624 sprintf(CS p, " %s%.*s%s", quote, (int)(big_buffer_size -
3625 (p - big_buffer) - 4), printing, quote);
3626 while (*p) p++;
3627 }
3628
3629 if ((log_extra_selector & LX_arguments) != 0)
3630 log_write(0, LOG_MAIN, "%s", big_buffer);
3631 else
3632 debug_printf("%s\n", big_buffer);
3633 }
3634
3635 /* Set the working directory to be the top-level spool directory. We don't rely
3636 on this in the code, which always uses fully qualified names, but it's useful
3637 for core dumps etc. Don't complain if it fails - the spool directory might not
3638 be generally accessible and calls with the -C option (and others) have lost
3639 privilege by now. Before the chdir, we try to ensure that the directory exists.
3640 */
3641
3642 if (Uchdir(spool_directory) != 0)
3643 {
3644 (void)directory_make(spool_directory, US"", SPOOL_DIRECTORY_MODE, FALSE);
3645 (void)Uchdir(spool_directory);
3646 }
3647
3648 /* Handle calls with the -bi option. This is a sendmail option to rebuild *the*
3649 alias file. Exim doesn't have such a concept, but this call is screwed into
3650 Sun's YP makefiles. Handle this by calling a configured script, as the real
3651 user who called Exim. The -oA option can be used to pass an argument to the
3652 script. */
3653
3654 if (bi_option)
3655 {
3656 (void)fclose(config_file);
3657 if (bi_command != NULL)
3658 {
3659 int i = 0;
3660 uschar *argv[3];
3661 argv[i++] = bi_command;
3662 if (alias_arg != NULL) argv[i++] = alias_arg;
3663 argv[i++] = NULL;
3664
3665 setgroups(group_count, group_list);
3666 exim_setugid(real_uid, real_gid, FALSE, US"running bi_command");
3667
3668 DEBUG(D_exec) debug_printf("exec %.256s %.256s\n", argv[0],
3669 (argv[1] == NULL)? US"" : argv[1]);
3670
3671 execv(CS argv[0], (char *const *)argv);
3672 fprintf(stderr, "exim: exec failed: %s\n", strerror(errno));
3673 exit(EXIT_FAILURE);
3674 }
3675 else
3676 {
3677 DEBUG(D_any) debug_printf("-bi used but bi_command not set; exiting\n");
3678 exit(EXIT_SUCCESS);
3679 }
3680 }
3681
3682 /* If an action on specific messages is requested, or if a daemon or queue
3683 runner is being started, we need to know if Exim was called by an admin user.
3684 This is the case if the real user is root or exim, or if the real group is
3685 exim, or if one of the supplementary groups is exim or a group listed in
3686 admin_groups. We don't fail all message actions immediately if not admin_user,
3687 since some actions can be performed by non-admin users. Instead, set admin_user
3688 for later interrogation. */
3689
3690 if (real_uid == root_uid || real_uid == exim_uid || real_gid == exim_gid)
3691 admin_user = TRUE;
3692 else
3693 {
3694 int i, j;
3695 for (i = 0; i < group_count; i++)
3696 {
3697 if (group_list[i] == exim_gid) admin_user = TRUE;
3698 else if (admin_groups != NULL)
3699 {
3700 for (j = 1; j <= (int)(admin_groups[0]); j++)
3701 if (admin_groups[j] == group_list[i])
3702 { admin_user = TRUE; break; }
3703 }
3704 if (admin_user) break;
3705 }
3706 }
3707
3708 /* Another group of privileged users are the trusted users. These are root,
3709 exim, and any caller matching trusted_users or trusted_groups. Trusted callers
3710 are permitted to specify sender_addresses with -f on the command line, and
3711 other message parameters as well. */
3712
3713 if (real_uid == root_uid || real_uid == exim_uid)
3714 trusted_caller = TRUE;
3715 else
3716 {
3717 int i, j;
3718
3719 if (trusted_users != NULL)
3720 {
3721 for (i = 1; i <= (int)(trusted_users[0]); i++)
3722 if (trusted_users[i] == real_uid)
3723 { trusted_caller = TRUE; break; }
3724 }
3725
3726 if (!trusted_caller && trusted_groups != NULL)
3727 {
3728 for (i = 1; i <= (int)(trusted_groups[0]); i++)
3729 {
3730 if (trusted_groups[i] == real_gid)
3731 trusted_caller = TRUE;
3732 else for (j = 0; j < group_count; j++)
3733 {
3734 if (trusted_groups[i] == group_list[j])
3735 { trusted_caller = TRUE; break; }
3736 }
3737 if (trusted_caller) break;
3738 }
3739 }
3740 }
3741
3742 if (trusted_caller) DEBUG(D_any) debug_printf("trusted user\n");
3743 if (admin_user) DEBUG(D_any) debug_printf("admin user\n");
3744
3745 /* Only an admin user may start the daemon or force a queue run in the default
3746 configuration, but the queue run restriction can be relaxed. Only an admin
3747 user may request that a message be returned to its sender forthwith. Only an
3748 admin user may specify a debug level greater than D_v (because it might show
3749 passwords, etc. in lookup queries). Only an admin user may request a queue
3750 count. Only an admin user can use the test interface to scan for email
3751 (because Exim will be in the spool dir and able to look at mails). */
3752
3753 if (!admin_user)
3754 {
3755 BOOL debugset = (debug_selector & ~D_v) != 0;
3756 if (deliver_give_up || daemon_listen || malware_test_file ||
3757 (count_queue && queue_list_requires_admin) ||
3758 (list_queue && queue_list_requires_admin) ||
3759 (queue_interval >= 0 && prod_requires_admin) ||
3760 (debugset && !running_in_test_harness))
3761 {
3762 fprintf(stderr, "exim:%s permission denied\n", debugset? " debugging" : "");
3763 exit(EXIT_FAILURE);
3764 }
3765 }
3766
3767 /* If the real user is not root or the exim uid, the argument for passing
3768 in an open TCP/IP connection for another message is not permitted, nor is
3769 running with the -N option for any delivery action, unless this call to exim is
3770 one that supplied an input message, or we are using a patched exim for
3771 regression testing. */
3772
3773 if (real_uid != root_uid && real_uid != exim_uid &&
3774 (continue_hostname != NULL ||
3775 (dont_deliver &&
3776 (queue_interval >= 0 || daemon_listen || msg_action_arg > 0)
3777 )) && !running_in_test_harness)
3778 {
3779 fprintf(stderr, "exim: Permission denied\n");
3780 return EXIT_FAILURE;
3781 }
3782
3783 /* If the caller is not trusted, certain arguments are ignored when running for
3784 real, but are permitted when checking things (-be, -bv, -bt, -bh, -bf, -bF).
3785 Note that authority for performing certain actions on messages is tested in the
3786 queue_action() function. */
3787
3788 if (!trusted_caller && !checking && filter_test == FTEST_NONE)
3789 {
3790 sender_host_name = sender_host_address = interface_address =
3791 sender_ident = received_protocol = NULL;
3792 sender_host_port = interface_port = 0;
3793 sender_host_authenticated = authenticated_sender = authenticated_id = NULL;
3794 }
3795
3796 /* If a sender host address is set, extract the optional port number off the
3797 end of it and check its syntax. Do the same thing for the interface address.
3798 Exim exits if the syntax is bad. */
3799
3800 else
3801 {
3802 if (sender_host_address != NULL)
3803 sender_host_port = check_port(sender_host_address);
3804 if (interface_address != NULL)
3805 interface_port = check_port(interface_address);
3806 }
3807
3808 /* If an SMTP message is being received check to see if the standard input is a
3809 TCP/IP socket. If it is, we assume that Exim was called from inetd if the
3810 caller is root or the Exim user, or if the port is a privileged one. Otherwise,
3811 barf. */
3812
3813 if (smtp_input)
3814 {
3815 union sockaddr_46 inetd_sock;
3816 EXIM_SOCKLEN_T size = sizeof(inetd_sock);
3817 if (getpeername(0, (struct sockaddr *)(&inetd_sock), &size) == 0)
3818 {
3819 int family = ((struct sockaddr *)(&inetd_sock))->sa_family;
3820 if (family == AF_INET || family == AF_INET6)
3821 {
3822 union sockaddr_46 interface_sock;
3823 size = sizeof(interface_sock);
3824
3825 if (getsockname(0, (struct sockaddr *)(&interface_sock), &size) == 0)
3826 interface_address = host_ntoa(-1, &interface_sock, NULL,
3827 &interface_port);
3828
3829 if (host_is_tls_on_connect_port(interface_port)) tls_on_connect = TRUE;
3830
3831 if (real_uid == root_uid || real_uid == exim_uid || interface_port < 1024)
3832 {
3833 is_inetd = TRUE;
3834 sender_host_address = host_ntoa(-1, (struct sockaddr *)(&inetd_sock),
3835 NULL, &sender_host_port);
3836 if (mua_wrapper) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Input from "
3837 "inetd is not supported when mua_wrapper is set");
3838 }
3839 else
3840 {
3841 fprintf(stderr,
3842 "exim: Permission denied (unprivileged user, unprivileged port)\n");
3843 return EXIT_FAILURE;
3844 }
3845 }
3846 }
3847 }
3848
3849 /* If the load average is going to be needed while receiving a message, get it
3850 now for those OS that require the first call to os_getloadavg() to be done as
3851 root. There will be further calls later for each message received. */
3852
3853 #ifdef LOAD_AVG_NEEDS_ROOT
3854 if (receiving_message &&
3855 (queue_only_load >= 0 ||
3856 (is_inetd && smtp_load_reserve >= 0)
3857 ))
3858 {
3859 load_average = OS_GETLOADAVG();
3860 }
3861 #endif
3862
3863 /* The queue_only configuration option can be overridden by -odx on the command
3864 line, except that if queue_only_override is false, queue_only cannot be unset
3865 from the command line. */
3866
3867 if (queue_only_set && (queue_only_override || arg_queue_only))
3868 queue_only = arg_queue_only;
3869
3870 /* The receive_timeout and smtp_receive_timeout options can be overridden by
3871 -or and -os. */
3872
3873 if (arg_receive_timeout >= 0) receive_timeout = arg_receive_timeout;
3874 if (arg_smtp_receive_timeout >= 0)
3875 smtp_receive_timeout = arg_smtp_receive_timeout;
3876
3877 /* If Exim was started with root privilege, unless we have already removed the
3878 root privilege above as a result of -C, -D, -be, -bf or -bF, remove it now
3879 except when starting the daemon or doing some kind of delivery or address
3880 testing (-bt). These are the only cases when root need to be retained. We run
3881 as exim for -bv and -bh. However, if deliver_drop_privilege is set, root is
3882 retained only for starting the daemon. We always do the initgroups() in this
3883 situation (controlled by the TRUE below), in order to be as close as possible
3884 to the state Exim usually runs in. */
3885
3886 if (!unprivileged && /* originally had root AND */
3887 !removed_privilege && /* still got root AND */
3888 !daemon_listen && /* not starting the daemon */
3889 queue_interval <= 0 && /* (either kind of daemon) */
3890 ( /* AND EITHER */
3891 deliver_drop_privilege || /* requested unprivileged */
3892 ( /* OR */
3893 queue_interval < 0 && /* not running the queue */
3894 (msg_action_arg < 0 || /* and */
3895 msg_action != MSG_DELIVER) && /* not delivering and */
3896 (!checking || !address_test_mode) /* not address checking */
3897 )
3898 ))
3899 {
3900 exim_setugid(exim_uid, exim_gid, TRUE, US"privilege not needed");
3901 }
3902
3903 /* When we are retaining a privileged uid, we still change to the exim gid. */
3904
3905 else
3906 {
3907 int rv;
3908 rv = setgid(exim_gid);
3909 /* Impact of failure is that some stuff might end up with an incorrect group.
3910 We track this for failures from root, since any attempt to change privilege
3911 by root should succeed and failures should be examined. For non-root,
3912 there's no security risk. For me, it's { exim -bV } on a just-built binary,
3913 no need to complain then. */
3914 if (rv == -1)
3915 {
3916 if (!(unprivileged || removed_privilege))
3917 {
3918 fprintf(stderr,
3919 "exim: changing group failed: %s\n", strerror(errno));
3920 exit(EXIT_FAILURE);
3921 }
3922 else
3923 DEBUG(D_any) debug_printf("changing group to %ld failed: %s\n",
3924 (long int)exim_gid, strerror(errno));
3925 }
3926 }
3927
3928 /* Handle a request to scan a file for malware */
3929 if (malware_test_file)
3930 {
3931 #ifdef WITH_CONTENT_SCAN
3932 int result;
3933 set_process_info("scanning file for malware");
3934 result = malware_in_file(malware_test_file);
3935 if (result == FAIL)
3936 {
3937 printf("No malware found.\n");
3938 exit(EXIT_SUCCESS);
3939 }
3940 if (result != OK)
3941 {
3942 printf("Malware lookup returned non-okay/fail: %d\n", result);
3943 exit(EXIT_FAILURE);
3944 }
3945 if (malware_name)
3946 printf("Malware found: %s\n", malware_name);
3947 else
3948 printf("Malware scan detected malware of unknown name.\n");
3949 #else
3950 printf("Malware scanning not enabled at compile time.\n");
3951 #endif
3952 exit(EXIT_FAILURE);
3953 }
3954
3955 /* Handle a request to list the delivery queue */
3956
3957 if (list_queue)
3958 {
3959 set_process_info("listing the queue");
3960 queue_list(list_queue_option, argv + recipients_arg, argc - recipients_arg);
3961 exit(EXIT_SUCCESS);
3962 }
3963
3964 /* Handle a request to count the delivery queue */
3965
3966 if (count_queue)
3967 {
3968 set_process_info("counting the queue");
3969 queue_count();
3970 exit(EXIT_SUCCESS);
3971 }
3972
3973 /* Handle actions on specific messages, except for the force delivery and
3974 message load actions, which are done below. Some actions take a whole list of
3975 message ids, which are known to continue up to the end of the arguments. Others
3976 take a single message id and then operate on the recipients list. */
3977
3978 if (msg_action_arg > 0 && msg_action != MSG_DELIVER && msg_action != MSG_LOAD)
3979 {
3980 int yield = EXIT_SUCCESS;
3981 set_process_info("acting on specified messages");
3982
3983 if (!one_msg_action)
3984 {
3985 for (i = msg_action_arg; i < argc; i++)
3986 if (!queue_action(argv[i], msg_action, NULL, 0, 0))
3987 yield = EXIT_FAILURE;
3988 }
3989
3990 else if (!queue_action(argv[msg_action_arg], msg_action, argv, argc,
3991 recipients_arg)) yield = EXIT_FAILURE;
3992 exit(yield);
3993 }
3994
3995 /* All the modes below here require the remaining configuration sections
3996 to be read, except that we can skip over the ACL setting when delivering
3997 specific messages, or doing a queue run. (For various testing cases we could
3998 skip too, but as they are rare, it doesn't really matter.) The argument is TRUE
3999 for skipping. */
4000
4001 readconf_rest(msg_action_arg > 0 || (queue_interval == 0 && !daemon_listen));
4002
4003 /* The configuration data will have been read into POOL_PERM because we won't
4004 ever want to reset back past it. Change the current pool to POOL_MAIN. In fact,
4005 this is just a bit of pedantic tidiness. It wouldn't really matter if the
4006 configuration were read into POOL_MAIN, because we don't do any resets till
4007 later on. However, it seems right, and it does ensure that both pools get used.
4008 */
4009
4010 store_pool = POOL_MAIN;
4011
4012 /* Handle the -brt option. This is for checking out retry configurations.
4013 The next three arguments are a domain name or a complete address, and
4014 optionally two error numbers. All it does is to call the function that
4015 scans the retry configuration data. */
4016
4017 if (test_retry_arg >= 0)
4018 {
4019 retry_config *yield;
4020 int basic_errno = 0;
4021 int more_errno = 0;
4022 uschar *s1, *s2;
4023
4024 if (test_retry_arg >= argc)
4025 {
4026 printf("-brt needs a domain or address argument\n");
4027 exim_exit(EXIT_FAILURE);
4028 }
4029 s1 = argv[test_retry_arg++];
4030 s2 = NULL;
4031
4032 /* If the first argument contains no @ and no . it might be a local user
4033 or it might be a single-component name. Treat as a domain. */
4034
4035 if (Ustrchr(s1, '@') == NULL && Ustrchr(s1, '.') == NULL)
4036 {
4037 printf("Warning: \"%s\" contains no '@' and no '.' characters. It is "
4038 "being \ntreated as a one-component domain, not as a local part.\n\n",
4039 s1);
4040 }
4041
4042 /* There may be an optional second domain arg. */
4043
4044 if (test_retry_arg < argc && Ustrchr(argv[test_retry_arg], '.') != NULL)
4045 s2 = argv[test_retry_arg++];
4046
4047 /* The final arg is an error name */
4048
4049 if (test_retry_arg < argc)
4050 {
4051 uschar *ss = argv[test_retry_arg];
4052 uschar *error =
4053 readconf_retry_error(ss, ss + Ustrlen(ss), &basic_errno, &more_errno);
4054 if (error != NULL)
4055 {
4056 printf("%s\n", CS error);
4057 return EXIT_FAILURE;
4058 }
4059
4060 /* For the {MAIL,RCPT,DATA}_4xx errors, a value of 255 means "any", and a
4061 code > 100 as an error is for matching codes to the decade. Turn them into
4062 a real error code, off the decade. */
4063
4064 if (basic_errno == ERRNO_MAIL4XX ||
4065 basic_errno == ERRNO_RCPT4XX ||
4066 basic_errno == ERRNO_DATA4XX)
4067 {
4068 int code = (more_errno >> 8) & 255;
4069 if (code == 255)
4070 more_errno = (more_errno & 0xffff00ff) | (21 << 8);
4071 else if (code > 100)
4072 more_errno = (more_errno & 0xffff00ff) | ((code - 96) << 8);
4073 }
4074 }
4075
4076 yield = retry_find_config(s1, s2, basic_errno, more_errno);
4077 if (yield == NULL) printf("No retry information found\n"); else
4078 {
4079 retry_rule *r;
4080 more_errno = yield->more_errno;
4081 printf("Retry rule: %s ", yield->pattern);
4082
4083 if (yield->basic_errno == ERRNO_EXIMQUOTA)
4084 {
4085 printf("quota%s%s ",
4086 (more_errno > 0)? "_" : "",
4087 (more_errno > 0)? readconf_printtime(more_errno) : US"");
4088 }
4089 else if (yield->basic_errno == ECONNREFUSED)
4090 {
4091 printf("refused%s%s ",
4092 (more_errno > 0)? "_" : "",
4093 (more_errno == 'M')? "MX" :
4094 (more_errno == 'A')? "A" : "");
4095 }
4096 else if (yield->basic_errno == ETIMEDOUT)
4097 {
4098 printf("timeout");
4099 if ((more_errno & RTEF_CTOUT) != 0) printf("_connect");
4100 more_errno &= 255;
4101 if (more_errno != 0) printf("_%s",
4102 (more_errno == 'M')? "MX" : "A");
4103 printf(" ");
4104 }
4105 else if (yield->basic_errno == ERRNO_AUTHFAIL)
4106 printf("auth_failed ");
4107 else printf("* ");
4108
4109 for (r = yield->rules; r != NULL; r = r->next)
4110 {
4111 printf("%c,%s", r->rule, readconf_printtime(r->timeout)); /* Do not */
4112 printf(",%s", readconf_printtime(r->p1)); /* amalgamate */
4113