c990bc08ca4c22b1d1cf10599a614508cfe434d1
[exim.git] / src / src / exim.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8
9 /* The main function: entry point, initialization, and high-level control.
10 Also a few functions that don't naturally fit elsewhere. */
11
12
13 #include "exim.h"
14
15 #if defined(__GLIBC__) && !defined(__UCLIBC__)
16 # include <gnu/libc-version.h>
17 #endif
18
19 #ifdef USE_GNUTLS
20 # include <gnutls/gnutls.h>
21 # if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
22 # define DISABLE_OCSP
23 # endif
24 #endif
25
26 extern void init_lookup_list(void);
27
28
29
30 /*************************************************
31 * Function interface to store functions *
32 *************************************************/
33
34 /* We need some real functions to pass to the PCRE regular expression library
35 for store allocation via Exim's store manager. The normal calls are actually
36 macros that pass over location information to make tracing easier. These
37 functions just interface to the standard macro calls. A good compiler will
38 optimize out the tail recursion and so not make them too expensive. There
39 are two sets of functions; one for use when we want to retain the compiled
40 regular expression for a long time; the other for short-term use. */
41
42 static void *
43 function_store_get(size_t size)
44 {
45 return store_get((int)size);
46 }
47
48 static void
49 function_dummy_free(void *block) { block = block; }
50
51 static void *
52 function_store_malloc(size_t size)
53 {
54 return store_malloc((int)size);
55 }
56
57 static void
58 function_store_free(void *block)
59 {
60 store_free(block);
61 }
62
63
64
65
66 /*************************************************
67 * Enums for cmdline interface *
68 *************************************************/
69
70 enum commandline_info { CMDINFO_NONE=0,
71 CMDINFO_HELP, CMDINFO_SIEVE, CMDINFO_DSCP };
72
73
74
75
76 /*************************************************
77 * Compile regular expression and panic on fail *
78 *************************************************/
79
80 /* This function is called when failure to compile a regular expression leads
81 to a panic exit. In other cases, pcre_compile() is called directly. In many
82 cases where this function is used, the results of the compilation are to be
83 placed in long-lived store, so we temporarily reset the store management
84 functions that PCRE uses if the use_malloc flag is set.
85
86 Argument:
87 pattern the pattern to compile
88 caseless TRUE if caseless matching is required
89 use_malloc TRUE if compile into malloc store
90
91 Returns: pointer to the compiled pattern
92 */
93
94 const pcre *
95 regex_must_compile(const uschar *pattern, BOOL caseless, BOOL use_malloc)
96 {
97 int offset;
98 int options = PCRE_COPT;
99 const pcre *yield;
100 const uschar *error;
101 if (use_malloc)
102 {
103 pcre_malloc = function_store_malloc;
104 pcre_free = function_store_free;
105 }
106 if (caseless) options |= PCRE_CASELESS;
107 yield = pcre_compile(CCS pattern, options, (const char **)&error, &offset, NULL);
108 pcre_malloc = function_store_get;
109 pcre_free = function_dummy_free;
110 if (yield == NULL)
111 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "regular expression error: "
112 "%s at offset %d while compiling %s", error, offset, pattern);
113 return yield;
114 }
115
116
117
118
119 /*************************************************
120 * Execute regular expression and set strings *
121 *************************************************/
122
123 /* This function runs a regular expression match, and sets up the pointers to
124 the matched substrings.
125
126 Arguments:
127 re the compiled expression
128 subject the subject string
129 options additional PCRE options
130 setup if < 0 do full setup
131 if >= 0 setup from setup+1 onwards,
132 excluding the full matched string
133
134 Returns: TRUE or FALSE
135 */
136
137 BOOL
138 regex_match_and_setup(const pcre *re, const uschar *subject, int options, int setup)
139 {
140 int ovector[3*(EXPAND_MAXN+1)];
141 uschar * s = string_copy(subject); /* de-constifying */
142 int n = pcre_exec(re, NULL, CS s, Ustrlen(s), 0,
143 PCRE_EOPT | options, ovector, sizeof(ovector)/sizeof(int));
144 BOOL yield = n >= 0;
145 if (n == 0) n = EXPAND_MAXN + 1;
146 if (yield)
147 {
148 int nn;
149 expand_nmax = (setup < 0)? 0 : setup + 1;
150 for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
151 {
152 expand_nstring[expand_nmax] = s + ovector[nn];
153 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
154 }
155 expand_nmax--;
156 }
157 return yield;
158 }
159
160
161
162
163 /*************************************************
164 * Set up processing details *
165 *************************************************/
166
167 /* Save a text string for dumping when SIGUSR1 is received.
168 Do checks for overruns.
169
170 Arguments: format and arguments, as for printf()
171 Returns: nothing
172 */
173
174 void
175 set_process_info(const char *format, ...)
176 {
177 int len = sprintf(CS process_info, "%5d ", (int)getpid());
178 va_list ap;
179 va_start(ap, format);
180 if (!string_vformat(process_info + len, PROCESS_INFO_SIZE - len - 2, format, ap))
181 Ustrcpy(process_info + len, "**** string overflowed buffer ****");
182 len = Ustrlen(process_info);
183 process_info[len+0] = '\n';
184 process_info[len+1] = '\0';
185 process_info_len = len + 1;
186 DEBUG(D_process_info) debug_printf("set_process_info: %s", process_info);
187 va_end(ap);
188 }
189
190
191
192
193 /*************************************************
194 * Handler for SIGUSR1 *
195 *************************************************/
196
197 /* SIGUSR1 causes any exim process to write to the process log details of
198 what it is currently doing. It will only be used if the OS is capable of
199 setting up a handler that causes automatic restarting of any system call
200 that is in progress at the time.
201
202 This function takes care to be signal-safe.
203
204 Argument: the signal number (SIGUSR1)
205 Returns: nothing
206 */
207
208 static void
209 usr1_handler(int sig)
210 {
211 int fd;
212
213 os_restarting_signal(sig, usr1_handler);
214
215 fd = Uopen(process_log_path, O_APPEND|O_WRONLY, LOG_MODE);
216 if (fd < 0)
217 {
218 /* If we are already running as the Exim user, try to create it in the
219 current process (assuming spool_directory exists). Otherwise, if we are
220 root, do the creation in an exim:exim subprocess. */
221
222 int euid = geteuid();
223 if (euid == exim_uid)
224 fd = Uopen(process_log_path, O_CREAT|O_APPEND|O_WRONLY, LOG_MODE);
225 else if (euid == root_uid)
226 fd = log_create_as_exim(process_log_path);
227 }
228
229 /* If we are neither exim nor root, or if we failed to create the log file,
230 give up. There is not much useful we can do with errors, since we don't want
231 to disrupt whatever is going on outside the signal handler. */
232
233 if (fd < 0) return;
234
235 (void)write(fd, process_info, process_info_len);
236 (void)close(fd);
237 }
238
239
240
241 /*************************************************
242 * Timeout handler *
243 *************************************************/
244
245 /* This handler is enabled most of the time that Exim is running. The handler
246 doesn't actually get used unless alarm() has been called to set a timer, to
247 place a time limit on a system call of some kind. When the handler is run, it
248 re-enables itself.
249
250 There are some other SIGALRM handlers that are used in special cases when more
251 than just a flag setting is required; for example, when reading a message's
252 input. These are normally set up in the code module that uses them, and the
253 SIGALRM handler is reset to this one afterwards.
254
255 Argument: the signal value (SIGALRM)
256 Returns: nothing
257 */
258
259 void
260 sigalrm_handler(int sig)
261 {
262 sig = sig; /* Keep picky compilers happy */
263 sigalrm_seen = TRUE;
264 os_non_restarting_signal(SIGALRM, sigalrm_handler);
265 }
266
267
268
269 /*************************************************
270 * Sleep for a fractional time interval *
271 *************************************************/
272
273 /* This function is called by millisleep() and exim_wait_tick() to wait for a
274 period of time that may include a fraction of a second. The coding is somewhat
275 tedious. We do not expect setitimer() ever to fail, but if it does, the process
276 will wait for ever, so we panic in this instance. (There was a case of this
277 when a bug in a function that calls milliwait() caused it to pass invalid data.
278 That's when I added the check. :-)
279
280 We assume it to be not worth sleeping for under 100us; this value will
281 require revisiting as hardware advances. This avoids the issue of
282 a zero-valued timer setting meaning "never fire".
283
284 Argument: an itimerval structure containing the interval
285 Returns: nothing
286 */
287
288 static void
289 milliwait(struct itimerval *itval)
290 {
291 sigset_t sigmask;
292 sigset_t old_sigmask;
293
294 if (itval->it_value.tv_usec < 100 && itval->it_value.tv_sec == 0)
295 return;
296 (void)sigemptyset(&sigmask); /* Empty mask */
297 (void)sigaddset(&sigmask, SIGALRM); /* Add SIGALRM */
298 (void)sigprocmask(SIG_BLOCK, &sigmask, &old_sigmask); /* Block SIGALRM */
299 if (setitimer(ITIMER_REAL, itval, NULL) < 0) /* Start timer */
300 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
301 "setitimer() failed: %s", strerror(errno));
302 (void)sigfillset(&sigmask); /* All signals */
303 (void)sigdelset(&sigmask, SIGALRM); /* Remove SIGALRM */
304 (void)sigsuspend(&sigmask); /* Until SIGALRM */
305 (void)sigprocmask(SIG_SETMASK, &old_sigmask, NULL); /* Restore mask */
306 }
307
308
309
310
311 /*************************************************
312 * Millisecond sleep function *
313 *************************************************/
314
315 /* The basic sleep() function has a granularity of 1 second, which is too rough
316 in some cases - for example, when using an increasing delay to slow down
317 spammers.
318
319 Argument: number of millseconds
320 Returns: nothing
321 */
322
323 void
324 millisleep(int msec)
325 {
326 struct itimerval itval;
327 itval.it_interval.tv_sec = 0;
328 itval.it_interval.tv_usec = 0;
329 itval.it_value.tv_sec = msec/1000;
330 itval.it_value.tv_usec = (msec % 1000) * 1000;
331 milliwait(&itval);
332 }
333
334
335
336 /*************************************************
337 * Compare microsecond times *
338 *************************************************/
339
340 /*
341 Arguments:
342 tv1 the first time
343 tv2 the second time
344
345 Returns: -1, 0, or +1
346 */
347
348 static int
349 exim_tvcmp(struct timeval *t1, struct timeval *t2)
350 {
351 if (t1->tv_sec > t2->tv_sec) return +1;
352 if (t1->tv_sec < t2->tv_sec) return -1;
353 if (t1->tv_usec > t2->tv_usec) return +1;
354 if (t1->tv_usec < t2->tv_usec) return -1;
355 return 0;
356 }
357
358
359
360
361 /*************************************************
362 * Clock tick wait function *
363 *************************************************/
364
365 /* Exim uses a time + a pid to generate a unique identifier in two places: its
366 message IDs, and in file names for maildir deliveries. Because some OS now
367 re-use pids within the same second, sub-second times are now being used.
368 However, for absolute certainty, we must ensure the clock has ticked before
369 allowing the relevant process to complete. At the time of implementation of
370 this code (February 2003), the speed of processors is such that the clock will
371 invariably have ticked already by the time a process has done its job. This
372 function prepares for the time when things are faster - and it also copes with
373 clocks that go backwards.
374
375 Arguments:
376 then_tv A timeval which was used to create uniqueness; its usec field
377 has been rounded down to the value of the resolution.
378 We want to be sure the current time is greater than this.
379 resolution The resolution that was used to divide the microseconds
380 (1 for maildir, larger for message ids)
381
382 Returns: nothing
383 */
384
385 void
386 exim_wait_tick(struct timeval *then_tv, int resolution)
387 {
388 struct timeval now_tv;
389 long int now_true_usec;
390
391 (void)gettimeofday(&now_tv, NULL);
392 now_true_usec = now_tv.tv_usec;
393 now_tv.tv_usec = (now_true_usec/resolution) * resolution;
394
395 if (exim_tvcmp(&now_tv, then_tv) <= 0)
396 {
397 struct itimerval itval;
398 itval.it_interval.tv_sec = 0;
399 itval.it_interval.tv_usec = 0;
400 itval.it_value.tv_sec = then_tv->tv_sec - now_tv.tv_sec;
401 itval.it_value.tv_usec = then_tv->tv_usec + resolution - now_true_usec;
402
403 /* We know that, overall, "now" is less than or equal to "then". Therefore, a
404 negative value for the microseconds is possible only in the case when "now"
405 is more than a second less than "then". That means that itval.it_value.tv_sec
406 is greater than zero. The following correction is therefore safe. */
407
408 if (itval.it_value.tv_usec < 0)
409 {
410 itval.it_value.tv_usec += 1000000;
411 itval.it_value.tv_sec -= 1;
412 }
413
414 DEBUG(D_transport|D_receive)
415 {
416 if (!running_in_test_harness)
417 {
418 debug_printf("tick check: " TIME_T_FMT ".%06lu " TIME_T_FMT ".%06lu\n",
419 then_tv->tv_sec, (long) then_tv->tv_usec,
420 now_tv.tv_sec, (long) now_tv.tv_usec);
421 debug_printf("waiting " TIME_T_FMT ".%06lu\n",
422 itval.it_value.tv_sec, (long) itval.it_value.tv_usec);
423 }
424 }
425
426 milliwait(&itval);
427 }
428 }
429
430
431
432
433 /*************************************************
434 * Call fopen() with umask 777 and adjust mode *
435 *************************************************/
436
437 /* Exim runs with umask(0) so that files created with open() have the mode that
438 is specified in the open() call. However, there are some files, typically in
439 the spool directory, that are created with fopen(). They end up world-writeable
440 if no precautions are taken. Although the spool directory is not accessible to
441 the world, this is an untidiness. So this is a wrapper function for fopen()
442 that sorts out the mode of the created file.
443
444 Arguments:
445 filename the file name
446 options the fopen() options
447 mode the required mode
448
449 Returns: the fopened FILE or NULL
450 */
451
452 FILE *
453 modefopen(const uschar *filename, const char *options, mode_t mode)
454 {
455 mode_t saved_umask = umask(0777);
456 FILE *f = Ufopen(filename, options);
457 (void)umask(saved_umask);
458 if (f != NULL) (void)fchmod(fileno(f), mode);
459 return f;
460 }
461
462
463
464
465 /*************************************************
466 * Ensure stdin, stdout, and stderr exist *
467 *************************************************/
468
469 /* Some operating systems grumble if an exec() happens without a standard
470 input, output, and error (fds 0, 1, 2) being defined. The worry is that some
471 file will be opened and will use these fd values, and then some other bit of
472 code will assume, for example, that it can write error messages to stderr.
473 This function ensures that fds 0, 1, and 2 are open if they do not already
474 exist, by connecting them to /dev/null.
475
476 This function is also used to ensure that std{in,out,err} exist at all times,
477 so that if any library that Exim calls tries to use them, it doesn't crash.
478
479 Arguments: None
480 Returns: Nothing
481 */
482
483 void
484 exim_nullstd(void)
485 {
486 int i;
487 int devnull = -1;
488 struct stat statbuf;
489 for (i = 0; i <= 2; i++)
490 {
491 if (fstat(i, &statbuf) < 0 && errno == EBADF)
492 {
493 if (devnull < 0) devnull = open("/dev/null", O_RDWR);
494 if (devnull < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
495 string_open_failed(errno, "/dev/null"));
496 if (devnull != i) (void)dup2(devnull, i);
497 }
498 }
499 if (devnull > 2) (void)close(devnull);
500 }
501
502
503
504
505 /*************************************************
506 * Close unwanted file descriptors for delivery *
507 *************************************************/
508
509 /* This function is called from a new process that has been forked to deliver
510 an incoming message, either directly, or using exec.
511
512 We want any smtp input streams to be closed in this new process. However, it
513 has been observed that using fclose() here causes trouble. When reading in -bS
514 input, duplicate copies of messages have been seen. The files will be sharing a
515 file pointer with the parent process, and it seems that fclose() (at least on
516 some systems - I saw this on Solaris 2.5.1) messes with that file pointer, at
517 least sometimes. Hence we go for closing the underlying file descriptors.
518
519 If TLS is active, we want to shut down the TLS library, but without molesting
520 the parent's SSL connection.
521
522 For delivery of a non-SMTP message, we want to close stdin and stdout (and
523 stderr unless debugging) because the calling process might have set them up as
524 pipes and be waiting for them to close before it waits for the submission
525 process to terminate. If they aren't closed, they hold up the calling process
526 until the initial delivery process finishes, which is not what we want.
527
528 Exception: We do want it for synchronous delivery!
529
530 And notwithstanding all the above, if D_resolver is set, implying resolver
531 debugging, leave stdout open, because that's where the resolver writes its
532 debugging output.
533
534 When we close stderr (which implies we've also closed stdout), we also get rid
535 of any controlling terminal.
536
537 Arguments: None
538 Returns: Nothing
539 */
540
541 static void
542 close_unwanted(void)
543 {
544 if (smtp_input)
545 {
546 #ifdef SUPPORT_TLS
547 tls_close(TRUE, FALSE); /* Shut down the TLS library */
548 #endif
549 (void)close(fileno(smtp_in));
550 (void)close(fileno(smtp_out));
551 smtp_in = NULL;
552 }
553 else
554 {
555 (void)close(0); /* stdin */
556 if ((debug_selector & D_resolver) == 0) (void)close(1); /* stdout */
557 if (debug_selector == 0) /* stderr */
558 {
559 if (!synchronous_delivery)
560 {
561 (void)close(2);
562 log_stderr = NULL;
563 }
564 (void)setsid();
565 }
566 }
567 }
568
569
570
571
572 /*************************************************
573 * Set uid and gid *
574 *************************************************/
575
576 /* This function sets a new uid and gid permanently, optionally calling
577 initgroups() to set auxiliary groups. There are some special cases when running
578 Exim in unprivileged modes. In these situations the effective uid will not be
579 root; if we already have the right effective uid/gid, and don't need to
580 initialize any groups, leave things as they are.
581
582 Arguments:
583 uid the uid
584 gid the gid
585 igflag TRUE if initgroups() wanted
586 msg text to use in debugging output and failure log
587
588 Returns: nothing; bombs out on failure
589 */
590
591 void
592 exim_setugid(uid_t uid, gid_t gid, BOOL igflag, uschar *msg)
593 {
594 uid_t euid = geteuid();
595 gid_t egid = getegid();
596
597 if (euid == root_uid || euid != uid || egid != gid || igflag)
598 {
599 /* At least one OS returns +1 for initgroups failure, so just check for
600 non-zero. */
601
602 if (igflag)
603 {
604 struct passwd *pw = getpwuid(uid);
605 if (pw != NULL)
606 {
607 if (initgroups(pw->pw_name, gid) != 0)
608 log_write(0,LOG_MAIN|LOG_PANIC_DIE,"initgroups failed for uid=%ld: %s",
609 (long int)uid, strerror(errno));
610 }
611 else log_write(0, LOG_MAIN|LOG_PANIC_DIE, "cannot run initgroups(): "
612 "no passwd entry for uid=%ld", (long int)uid);
613 }
614
615 if (setgid(gid) < 0 || setuid(uid) < 0)
616 {
617 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to set gid=%ld or uid=%ld "
618 "(euid=%ld): %s", (long int)gid, (long int)uid, (long int)euid, msg);
619 }
620 }
621
622 /* Debugging output included uid/gid and all groups */
623
624 DEBUG(D_uid)
625 {
626 int group_count, save_errno;
627 gid_t group_list[NGROUPS_MAX];
628 debug_printf("changed uid/gid: %s\n uid=%ld gid=%ld pid=%ld\n", msg,
629 (long int)geteuid(), (long int)getegid(), (long int)getpid());
630 group_count = getgroups(NGROUPS_MAX, group_list);
631 save_errno = errno;
632 debug_printf(" auxiliary group list:");
633 if (group_count > 0)
634 {
635 int i;
636 for (i = 0; i < group_count; i++) debug_printf(" %d", (int)group_list[i]);
637 }
638 else if (group_count < 0)
639 debug_printf(" <error: %s>", strerror(save_errno));
640 else debug_printf(" <none>");
641 debug_printf("\n");
642 }
643 }
644
645
646
647
648 /*************************************************
649 * Exit point *
650 *************************************************/
651
652 /* Exim exits via this function so that it always clears up any open
653 databases.
654
655 Arguments:
656 rc return code
657
658 Returns: does not return
659 */
660
661 void
662 exim_exit(int rc)
663 {
664 search_tidyup();
665 DEBUG(D_any)
666 debug_printf(">>>>>>>>>>>>>>>> Exim pid=%d terminating with rc=%d "
667 ">>>>>>>>>>>>>>>>\n", (int)getpid(), rc);
668 exit(rc);
669 }
670
671
672
673
674 /*************************************************
675 * Extract port from host address *
676 *************************************************/
677
678 /* Called to extract the port from the values given to -oMa and -oMi.
679 It also checks the syntax of the address, and terminates it before the
680 port data when a port is extracted.
681
682 Argument:
683 address the address, with possible port on the end
684
685 Returns: the port, or zero if there isn't one
686 bombs out on a syntax error
687 */
688
689 static int
690 check_port(uschar *address)
691 {
692 int port = host_address_extract_port(address);
693 if (string_is_ip_address(address, NULL) == 0)
694 {
695 fprintf(stderr, "exim abandoned: \"%s\" is not an IP address\n", address);
696 exit(EXIT_FAILURE);
697 }
698 return port;
699 }
700
701
702
703 /*************************************************
704 * Test/verify an address *
705 *************************************************/
706
707 /* This function is called by the -bv and -bt code. It extracts a working
708 address from a full RFC 822 address. This isn't really necessary per se, but it
709 has the effect of collapsing source routes.
710
711 Arguments:
712 s the address string
713 flags flag bits for verify_address()
714 exit_value to be set for failures
715
716 Returns: nothing
717 */
718
719 static void
720 test_address(uschar *s, int flags, int *exit_value)
721 {
722 int start, end, domain;
723 uschar *parse_error = NULL;
724 uschar *address = parse_extract_address(s, &parse_error, &start, &end, &domain,
725 FALSE);
726 if (address == NULL)
727 {
728 fprintf(stdout, "syntax error: %s\n", parse_error);
729 *exit_value = 2;
730 }
731 else
732 {
733 int rc = verify_address(deliver_make_addr(address,TRUE), stdout, flags, -1,
734 -1, -1, NULL, NULL, NULL);
735 if (rc == FAIL) *exit_value = 2;
736 else if (rc == DEFER && *exit_value == 0) *exit_value = 1;
737 }
738 }
739
740
741
742 /*************************************************
743 * Show supported features *
744 *************************************************/
745
746 /* This function is called for -bV/--version and for -d to output the optional
747 features of the current Exim binary.
748
749 Arguments: a FILE for printing
750 Returns: nothing
751 */
752
753 static void
754 show_whats_supported(FILE *f)
755 {
756 auth_info *authi;
757
758 #ifdef DB_VERSION_STRING
759 fprintf(f, "Berkeley DB: %s\n", DB_VERSION_STRING);
760 #elif defined(BTREEVERSION) && defined(HASHVERSION)
761 #ifdef USE_DB
762 fprintf(f, "Probably Berkeley DB version 1.8x (native mode)\n");
763 #else
764 fprintf(f, "Probably Berkeley DB version 1.8x (compatibility mode)\n");
765 #endif
766 #elif defined(_DBM_RDONLY) || defined(dbm_dirfno)
767 fprintf(f, "Probably ndbm\n");
768 #elif defined(USE_TDB)
769 fprintf(f, "Using tdb\n");
770 #else
771 #ifdef USE_GDBM
772 fprintf(f, "Probably GDBM (native mode)\n");
773 #else
774 fprintf(f, "Probably GDBM (compatibility mode)\n");
775 #endif
776 #endif
777
778 fprintf(f, "Support for:");
779 #ifdef SUPPORT_CRYPTEQ
780 fprintf(f, " crypteq");
781 #endif
782 #if HAVE_ICONV
783 fprintf(f, " iconv()");
784 #endif
785 #if HAVE_IPV6
786 fprintf(f, " IPv6");
787 #endif
788 #ifdef HAVE_SETCLASSRESOURCES
789 fprintf(f, " use_setclassresources");
790 #endif
791 #ifdef SUPPORT_PAM
792 fprintf(f, " PAM");
793 #endif
794 #ifdef EXIM_PERL
795 fprintf(f, " Perl");
796 #endif
797 #ifdef EXPAND_DLFUNC
798 fprintf(f, " Expand_dlfunc");
799 #endif
800 #ifdef USE_TCP_WRAPPERS
801 fprintf(f, " TCPwrappers");
802 #endif
803 #ifdef SUPPORT_TLS
804 #ifdef USE_GNUTLS
805 fprintf(f, " GnuTLS");
806 #else
807 fprintf(f, " OpenSSL");
808 #endif
809 #endif
810 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
811 fprintf(f, " translate_ip_address");
812 #endif
813 #ifdef SUPPORT_MOVE_FROZEN_MESSAGES
814 fprintf(f, " move_frozen_messages");
815 #endif
816 #ifdef WITH_CONTENT_SCAN
817 fprintf(f, " Content_Scanning");
818 #endif
819 #ifndef DISABLE_DKIM
820 fprintf(f, " DKIM");
821 #endif
822 #ifndef DISABLE_DNSSEC
823 fprintf(f, " DNSSEC");
824 #endif
825 #ifndef DISABLE_EVENT
826 fprintf(f, " Event");
827 #endif
828 #ifdef SUPPORT_I18N
829 fprintf(f, " I18N");
830 #endif
831 #ifndef DISABLE_OCSP
832 fprintf(f, " OCSP");
833 #endif
834 #ifndef DISABLE_PRDR
835 fprintf(f, " PRDR");
836 #endif
837 #ifdef SUPPORT_PROXY
838 fprintf(f, " PROXY");
839 #endif
840 #ifdef SUPPORT_SOCKS
841 fprintf(f, " SOCKS");
842 #endif
843 #ifdef TCP_FASTOPEN
844 fprintf(f, " TCP_Fast_Open");
845 #endif
846 #ifdef EXPERIMENTAL_LMDB
847 fprintf(f, " Experimental_LMDB");
848 #endif
849 #ifdef EXPERIMENTAL_QUEUEFILE
850 fprintf(f, " Experimental_QUEUEFILE");
851 #endif
852 #ifdef EXPERIMENTAL_SPF
853 fprintf(f, " Experimental_SPF");
854 #endif
855 #ifdef EXPERIMENTAL_SRS
856 fprintf(f, " Experimental_SRS");
857 #endif
858 #ifdef EXPERIMENTAL_BRIGHTMAIL
859 fprintf(f, " Experimental_Brightmail");
860 #endif
861 #ifdef EXPERIMENTAL_DANE
862 fprintf(f, " Experimental_DANE");
863 #endif
864 #ifdef EXPERIMENTAL_DCC
865 fprintf(f, " Experimental_DCC");
866 #endif
867 #ifdef EXPERIMENTAL_DMARC
868 fprintf(f, " Experimental_DMARC");
869 #endif
870 #ifdef EXPERIMENTAL_DSN_INFO
871 fprintf(f, " Experimental_DSN_info");
872 #endif
873 fprintf(f, "\n");
874
875 fprintf(f, "Lookups (built-in):");
876 #if defined(LOOKUP_LSEARCH) && LOOKUP_LSEARCH!=2
877 fprintf(f, " lsearch wildlsearch nwildlsearch iplsearch");
878 #endif
879 #if defined(LOOKUP_CDB) && LOOKUP_CDB!=2
880 fprintf(f, " cdb");
881 #endif
882 #if defined(LOOKUP_DBM) && LOOKUP_DBM!=2
883 fprintf(f, " dbm dbmjz dbmnz");
884 #endif
885 #if defined(LOOKUP_DNSDB) && LOOKUP_DNSDB!=2
886 fprintf(f, " dnsdb");
887 #endif
888 #if defined(LOOKUP_DSEARCH) && LOOKUP_DSEARCH!=2
889 fprintf(f, " dsearch");
890 #endif
891 #if defined(LOOKUP_IBASE) && LOOKUP_IBASE!=2
892 fprintf(f, " ibase");
893 #endif
894 #if defined(LOOKUP_LDAP) && LOOKUP_LDAP!=2
895 fprintf(f, " ldap ldapdn ldapm");
896 #endif
897 #ifdef EXPERIMENTAL_LMDB
898 fprintf(f, " lmdb");
899 #endif
900 #if defined(LOOKUP_MYSQL) && LOOKUP_MYSQL!=2
901 fprintf(f, " mysql");
902 #endif
903 #if defined(LOOKUP_NIS) && LOOKUP_NIS!=2
904 fprintf(f, " nis nis0");
905 #endif
906 #if defined(LOOKUP_NISPLUS) && LOOKUP_NISPLUS!=2
907 fprintf(f, " nisplus");
908 #endif
909 #if defined(LOOKUP_ORACLE) && LOOKUP_ORACLE!=2
910 fprintf(f, " oracle");
911 #endif
912 #if defined(LOOKUP_PASSWD) && LOOKUP_PASSWD!=2
913 fprintf(f, " passwd");
914 #endif
915 #if defined(LOOKUP_PGSQL) && LOOKUP_PGSQL!=2
916 fprintf(f, " pgsql");
917 #endif
918 #if defined(LOOKUP_REDIS) && LOOKUP_REDIS!=2
919 fprintf(f, " redis");
920 #endif
921 #if defined(LOOKUP_SQLITE) && LOOKUP_SQLITE!=2
922 fprintf(f, " sqlite");
923 #endif
924 #if defined(LOOKUP_TESTDB) && LOOKUP_TESTDB!=2
925 fprintf(f, " testdb");
926 #endif
927 #if defined(LOOKUP_WHOSON) && LOOKUP_WHOSON!=2
928 fprintf(f, " whoson");
929 #endif
930 fprintf(f, "\n");
931
932 fprintf(f, "Authenticators:");
933 #ifdef AUTH_CRAM_MD5
934 fprintf(f, " cram_md5");
935 #endif
936 #ifdef AUTH_CYRUS_SASL
937 fprintf(f, " cyrus_sasl");
938 #endif
939 #ifdef AUTH_DOVECOT
940 fprintf(f, " dovecot");
941 #endif
942 #ifdef AUTH_GSASL
943 fprintf(f, " gsasl");
944 #endif
945 #ifdef AUTH_HEIMDAL_GSSAPI
946 fprintf(f, " heimdal_gssapi");
947 #endif
948 #ifdef AUTH_PLAINTEXT
949 fprintf(f, " plaintext");
950 #endif
951 #ifdef AUTH_SPA
952 fprintf(f, " spa");
953 #endif
954 #ifdef AUTH_TLS
955 fprintf(f, " tls");
956 #endif
957 fprintf(f, "\n");
958
959 fprintf(f, "Routers:");
960 #ifdef ROUTER_ACCEPT
961 fprintf(f, " accept");
962 #endif
963 #ifdef ROUTER_DNSLOOKUP
964 fprintf(f, " dnslookup");
965 #endif
966 #ifdef ROUTER_IPLITERAL
967 fprintf(f, " ipliteral");
968 #endif
969 #ifdef ROUTER_IPLOOKUP
970 fprintf(f, " iplookup");
971 #endif
972 #ifdef ROUTER_MANUALROUTE
973 fprintf(f, " manualroute");
974 #endif
975 #ifdef ROUTER_QUERYPROGRAM
976 fprintf(f, " queryprogram");
977 #endif
978 #ifdef ROUTER_REDIRECT
979 fprintf(f, " redirect");
980 #endif
981 fprintf(f, "\n");
982
983 fprintf(f, "Transports:");
984 #ifdef TRANSPORT_APPENDFILE
985 fprintf(f, " appendfile");
986 #ifdef SUPPORT_MAILDIR
987 fprintf(f, "/maildir");
988 #endif
989 #ifdef SUPPORT_MAILSTORE
990 fprintf(f, "/mailstore");
991 #endif
992 #ifdef SUPPORT_MBX
993 fprintf(f, "/mbx");
994 #endif
995 #endif
996 #ifdef TRANSPORT_AUTOREPLY
997 fprintf(f, " autoreply");
998 #endif
999 #ifdef TRANSPORT_LMTP
1000 fprintf(f, " lmtp");
1001 #endif
1002 #ifdef TRANSPORT_PIPE
1003 fprintf(f, " pipe");
1004 #endif
1005 #ifdef EXPERIMENTAL_QUEUEFILE
1006 fprintf(f, " queuefile");
1007 #endif
1008 #ifdef TRANSPORT_SMTP
1009 fprintf(f, " smtp");
1010 #endif
1011 fprintf(f, "\n");
1012
1013 if (fixed_never_users[0] > 0)
1014 {
1015 int i;
1016 fprintf(f, "Fixed never_users: ");
1017 for (i = 1; i <= (int)fixed_never_users[0] - 1; i++)
1018 fprintf(f, "%d:", (unsigned int)fixed_never_users[i]);
1019 fprintf(f, "%d\n", (unsigned int)fixed_never_users[i]);
1020 }
1021
1022 fprintf(f, "Configure owner: %d:%d\n", config_uid, config_gid);
1023
1024 fprintf(f, "Size of off_t: " SIZE_T_FMT "\n", sizeof(off_t));
1025
1026 /* Everything else is details which are only worth reporting when debugging.
1027 Perhaps the tls_version_report should move into this too. */
1028 DEBUG(D_any) do {
1029
1030 int i;
1031
1032 /* clang defines __GNUC__ (at least, for me) so test for it first */
1033 #if defined(__clang__)
1034 fprintf(f, "Compiler: CLang [%s]\n", __clang_version__);
1035 #elif defined(__GNUC__)
1036 fprintf(f, "Compiler: GCC [%s]\n",
1037 # ifdef __VERSION__
1038 __VERSION__
1039 # else
1040 "? unknown version ?"
1041 # endif
1042 );
1043 #else
1044 fprintf(f, "Compiler: <unknown>\n");
1045 #endif
1046
1047 #if defined(__GLIBC__) && !defined(__UCLIBC__)
1048 fprintf(f, "Library version: Glibc: Compile: %d.%d\n",
1049 __GLIBC__, __GLIBC_MINOR__);
1050 if (__GLIBC_PREREQ(2, 1))
1051 fprintf(f, " Runtime: %s\n",
1052 gnu_get_libc_version());
1053 #endif
1054
1055 #ifdef SUPPORT_TLS
1056 tls_version_report(f);
1057 #endif
1058 #ifdef SUPPORT_I18N
1059 utf8_version_report(f);
1060 #endif
1061
1062 for (authi = auths_available; *authi->driver_name != '\0'; ++authi)
1063 if (authi->version_report)
1064 (*authi->version_report)(f);
1065
1066 /* PCRE_PRERELEASE is either defined and empty or a bare sequence of
1067 characters; unless it's an ancient version of PCRE in which case it
1068 is not defined. */
1069 #ifndef PCRE_PRERELEASE
1070 # define PCRE_PRERELEASE
1071 #endif
1072 #define QUOTE(X) #X
1073 #define EXPAND_AND_QUOTE(X) QUOTE(X)
1074 fprintf(f, "Library version: PCRE: Compile: %d.%d%s\n"
1075 " Runtime: %s\n",
1076 PCRE_MAJOR, PCRE_MINOR,
1077 EXPAND_AND_QUOTE(PCRE_PRERELEASE) "",
1078 pcre_version());
1079 #undef QUOTE
1080 #undef EXPAND_AND_QUOTE
1081
1082 init_lookup_list();
1083 for (i = 0; i < lookup_list_count; i++)
1084 if (lookup_list[i]->version_report)
1085 lookup_list[i]->version_report(f);
1086
1087 #ifdef WHITELIST_D_MACROS
1088 fprintf(f, "WHITELIST_D_MACROS: \"%s\"\n", WHITELIST_D_MACROS);
1089 #else
1090 fprintf(f, "WHITELIST_D_MACROS unset\n");
1091 #endif
1092 #ifdef TRUSTED_CONFIG_LIST
1093 fprintf(f, "TRUSTED_CONFIG_LIST: \"%s\"\n", TRUSTED_CONFIG_LIST);
1094 #else
1095 fprintf(f, "TRUSTED_CONFIG_LIST unset\n");
1096 #endif
1097
1098 } while (0);
1099 }
1100
1101
1102 /*************************************************
1103 * Show auxiliary information about Exim *
1104 *************************************************/
1105
1106 static void
1107 show_exim_information(enum commandline_info request, FILE *stream)
1108 {
1109 const uschar **pp;
1110
1111 switch(request)
1112 {
1113 case CMDINFO_NONE:
1114 fprintf(stream, "Oops, something went wrong.\n");
1115 return;
1116 case CMDINFO_HELP:
1117 fprintf(stream,
1118 "The -bI: flag takes a string indicating which information to provide.\n"
1119 "If the string is not recognised, you'll get this help (on stderr).\n"
1120 "\n"
1121 " exim -bI:help this information\n"
1122 " exim -bI:dscp dscp value keywords known\n"
1123 " exim -bI:sieve list of supported sieve extensions, one per line.\n"
1124 );
1125 return;
1126 case CMDINFO_SIEVE:
1127 for (pp = exim_sieve_extension_list; *pp; ++pp)
1128 fprintf(stream, "%s\n", *pp);
1129 return;
1130 case CMDINFO_DSCP:
1131 dscp_list_to_stream(stream);
1132 return;
1133 }
1134 }
1135
1136
1137 /*************************************************
1138 * Quote a local part *
1139 *************************************************/
1140
1141 /* This function is used when a sender address or a From: or Sender: header
1142 line is being created from the caller's login, or from an authenticated_id. It
1143 applies appropriate quoting rules for a local part.
1144
1145 Argument: the local part
1146 Returns: the local part, quoted if necessary
1147 */
1148
1149 uschar *
1150 local_part_quote(uschar *lpart)
1151 {
1152 BOOL needs_quote = FALSE;
1153 int size, ptr;
1154 uschar *yield;
1155 uschar *t;
1156
1157 for (t = lpart; !needs_quote && *t != 0; t++)
1158 {
1159 needs_quote = !isalnum(*t) && strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
1160 (*t != '.' || t == lpart || t[1] == 0);
1161 }
1162
1163 if (!needs_quote) return lpart;
1164
1165 size = ptr = 0;
1166 yield = string_catn(NULL, &size, &ptr, US"\"", 1);
1167
1168 for (;;)
1169 {
1170 uschar *nq = US Ustrpbrk(lpart, "\\\"");
1171 if (nq == NULL)
1172 {
1173 yield = string_cat(yield, &size, &ptr, lpart);
1174 break;
1175 }
1176 yield = string_catn(yield, &size, &ptr, lpart, nq - lpart);
1177 yield = string_catn(yield, &size, &ptr, US"\\", 1);
1178 yield = string_catn(yield, &size, &ptr, nq, 1);
1179 lpart = nq + 1;
1180 }
1181
1182 yield = string_catn(yield, &size, &ptr, US"\"", 1);
1183 yield[ptr] = 0;
1184 return yield;
1185 }
1186
1187
1188
1189 #ifdef USE_READLINE
1190 /*************************************************
1191 * Load readline() functions *
1192 *************************************************/
1193
1194 /* This function is called from testing executions that read data from stdin,
1195 but only when running as the calling user. Currently, only -be does this. The
1196 function loads the readline() function library and passes back the functions.
1197 On some systems, it needs the curses library, so load that too, but try without
1198 it if loading fails. All this functionality has to be requested at build time.
1199
1200 Arguments:
1201 fn_readline_ptr pointer to where to put the readline pointer
1202 fn_addhist_ptr pointer to where to put the addhistory function
1203
1204 Returns: the dlopen handle or NULL on failure
1205 */
1206
1207 static void *
1208 set_readline(char * (**fn_readline_ptr)(const char *),
1209 void (**fn_addhist_ptr)(const char *))
1210 {
1211 void *dlhandle;
1212 void *dlhandle_curses = dlopen("libcurses." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_LAZY);
1213
1214 dlhandle = dlopen("libreadline." DYNLIB_FN_EXT, RTLD_GLOBAL|RTLD_NOW);
1215 if (dlhandle_curses != NULL) dlclose(dlhandle_curses);
1216
1217 if (dlhandle != NULL)
1218 {
1219 /* Checked manual pages; at least in GNU Readline 6.1, the prototypes are:
1220 * char * readline (const char *prompt);
1221 * void add_history (const char *string);
1222 */
1223 *fn_readline_ptr = (char *(*)(const char*))dlsym(dlhandle, "readline");
1224 *fn_addhist_ptr = (void(*)(const char*))dlsym(dlhandle, "add_history");
1225 }
1226 else
1227 {
1228 DEBUG(D_any) debug_printf("failed to load readline: %s\n", dlerror());
1229 }
1230
1231 return dlhandle;
1232 }
1233 #endif
1234
1235
1236
1237 /*************************************************
1238 * Get a line from stdin for testing things *
1239 *************************************************/
1240
1241 /* This function is called when running tests that can take a number of lines
1242 of input (for example, -be and -bt). It handles continuations and trailing
1243 spaces. And prompting and a blank line output on eof. If readline() is in use,
1244 the arguments are non-NULL and provide the relevant functions.
1245
1246 Arguments:
1247 fn_readline readline function or NULL
1248 fn_addhist addhist function or NULL
1249
1250 Returns: pointer to dynamic memory, or NULL at end of file
1251 */
1252
1253 static uschar *
1254 get_stdinput(char *(*fn_readline)(const char *), void(*fn_addhist)(const char *))
1255 {
1256 int i;
1257 int size = 0;
1258 int ptr = 0;
1259 uschar *yield = NULL;
1260
1261 if (fn_readline == NULL) { printf("> "); fflush(stdout); }
1262
1263 for (i = 0;; i++)
1264 {
1265 uschar buffer[1024];
1266 uschar *p, *ss;
1267
1268 #ifdef USE_READLINE
1269 char *readline_line = NULL;
1270 if (fn_readline != NULL)
1271 {
1272 if ((readline_line = fn_readline((i > 0)? "":"> ")) == NULL) break;
1273 if (*readline_line != 0 && fn_addhist != NULL) fn_addhist(readline_line);
1274 p = US readline_line;
1275 }
1276 else
1277 #endif
1278
1279 /* readline() not in use */
1280
1281 {
1282 if (Ufgets(buffer, sizeof(buffer), stdin) == NULL) break;
1283 p = buffer;
1284 }
1285
1286 /* Handle the line */
1287
1288 ss = p + (int)Ustrlen(p);
1289 while (ss > p && isspace(ss[-1])) ss--;
1290
1291 if (i > 0)
1292 {
1293 while (p < ss && isspace(*p)) p++; /* leading space after cont */
1294 }
1295
1296 yield = string_catn(yield, &size, &ptr, p, ss - p);
1297
1298 #ifdef USE_READLINE
1299 if (fn_readline != NULL) free(readline_line);
1300 #endif
1301
1302 /* yield can only be NULL if ss==p */
1303 if (ss == p || yield[ptr-1] != '\\')
1304 {
1305 if (yield) yield[ptr] = 0;
1306 break;
1307 }
1308 yield[--ptr] = 0;
1309 }
1310
1311 if (yield == NULL) printf("\n");
1312 return yield;
1313 }
1314
1315
1316
1317 /*************************************************
1318 * Output usage information for the program *
1319 *************************************************/
1320
1321 /* This function is called when there are no recipients
1322 or a specific --help argument was added.
1323
1324 Arguments:
1325 progname information on what name we were called by
1326
1327 Returns: DOES NOT RETURN
1328 */
1329
1330 static void
1331 exim_usage(uschar *progname)
1332 {
1333
1334 /* Handle specific program invocation variants */
1335 if (Ustrcmp(progname, US"-mailq") == 0)
1336 {
1337 fprintf(stderr,
1338 "mailq - list the contents of the mail queue\n\n"
1339 "For a list of options, see the Exim documentation.\n");
1340 exit(EXIT_FAILURE);
1341 }
1342
1343 /* Generic usage - we output this whatever happens */
1344 fprintf(stderr,
1345 "Exim is a Mail Transfer Agent. It is normally called by Mail User Agents,\n"
1346 "not directly from a shell command line. Options and/or arguments control\n"
1347 "what it does when called. For a list of options, see the Exim documentation.\n");
1348
1349 exit(EXIT_FAILURE);
1350 }
1351
1352
1353
1354 /*************************************************
1355 * Validate that the macros given are okay *
1356 *************************************************/
1357
1358 /* Typically, Exim will drop privileges if macros are supplied. In some
1359 cases, we want to not do so.
1360
1361 Arguments: opt_D_used - true if the commandline had a "-D" option
1362 Returns: true if trusted, false otherwise
1363 */
1364
1365 static BOOL
1366 macros_trusted(BOOL opt_D_used)
1367 {
1368 #ifdef WHITELIST_D_MACROS
1369 macro_item *m;
1370 uschar *whitelisted, *end, *p, **whites, **w;
1371 int white_count, i, n;
1372 size_t len;
1373 BOOL prev_char_item, found;
1374 #endif
1375
1376 if (!opt_D_used)
1377 return TRUE;
1378 #ifndef WHITELIST_D_MACROS
1379 return FALSE;
1380 #else
1381
1382 /* We only trust -D overrides for some invoking users:
1383 root, the exim run-time user, the optional config owner user.
1384 I don't know why config-owner would be needed, but since they can own the
1385 config files anyway, there's no security risk to letting them override -D. */
1386 if ( ! ((real_uid == root_uid)
1387 || (real_uid == exim_uid)
1388 #ifdef CONFIGURE_OWNER
1389 || (real_uid == config_uid)
1390 #endif
1391 ))
1392 {
1393 debug_printf("macros_trusted rejecting macros for uid %d\n", (int) real_uid);
1394 return FALSE;
1395 }
1396
1397 /* Get a list of macros which are whitelisted */
1398 whitelisted = string_copy_malloc(US WHITELIST_D_MACROS);
1399 prev_char_item = FALSE;
1400 white_count = 0;
1401 for (p = whitelisted; *p != '\0'; ++p)
1402 {
1403 if (*p == ':' || isspace(*p))
1404 {
1405 *p = '\0';
1406 if (prev_char_item)
1407 ++white_count;
1408 prev_char_item = FALSE;
1409 continue;
1410 }
1411 if (!prev_char_item)
1412 prev_char_item = TRUE;
1413 }
1414 end = p;
1415 if (prev_char_item)
1416 ++white_count;
1417 if (!white_count)
1418 return FALSE;
1419 whites = store_malloc(sizeof(uschar *) * (white_count+1));
1420 for (p = whitelisted, i = 0; (p != end) && (i < white_count); ++p)
1421 {
1422 if (*p != '\0')
1423 {
1424 whites[i++] = p;
1425 if (i == white_count)
1426 break;
1427 while (*p != '\0' && p < end)
1428 ++p;
1429 }
1430 }
1431 whites[i] = NULL;
1432
1433 /* The list of commandline macros should be very short.
1434 Accept the N*M complexity. */
1435 for (m = macros; m; m = m->next) if (m->command_line)
1436 {
1437 found = FALSE;
1438 for (w = whites; *w; ++w)
1439 if (Ustrcmp(*w, m->name) == 0)
1440 {
1441 found = TRUE;
1442 break;
1443 }
1444 if (!found)
1445 return FALSE;
1446 if (!m->replacement)
1447 continue;
1448 if ((len = m->replen) == 0)
1449 continue;
1450 n = pcre_exec(regex_whitelisted_macro, NULL, CS m->replacement, len,
1451 0, PCRE_EOPT, NULL, 0);
1452 if (n < 0)
1453 {
1454 if (n != PCRE_ERROR_NOMATCH)
1455 debug_printf("macros_trusted checking %s returned %d\n", m->name, n);
1456 return FALSE;
1457 }
1458 }
1459 DEBUG(D_any) debug_printf("macros_trusted overridden to true by whitelisting\n");
1460 return TRUE;
1461 #endif
1462 }
1463
1464
1465 /*************************************************
1466 * Entry point and high-level code *
1467 *************************************************/
1468
1469 /* Entry point for the Exim mailer. Analyse the arguments and arrange to take
1470 the appropriate action. All the necessary functions are present in the one
1471 binary. I originally thought one should split it up, but it turns out that so
1472 much of the apparatus is needed in each chunk that one might as well just have
1473 it all available all the time, which then makes the coding easier as well.
1474
1475 Arguments:
1476 argc count of entries in argv
1477 argv argument strings, with argv[0] being the program name
1478
1479 Returns: EXIT_SUCCESS if terminated successfully
1480 EXIT_FAILURE otherwise, except when a message has been sent
1481 to the sender, and -oee was given
1482 */
1483
1484 int
1485 main(int argc, char **cargv)
1486 {
1487 uschar **argv = USS cargv;
1488 int arg_receive_timeout = -1;
1489 int arg_smtp_receive_timeout = -1;
1490 int arg_error_handling = error_handling;
1491 int filter_sfd = -1;
1492 int filter_ufd = -1;
1493 int group_count;
1494 int i, rv;
1495 int list_queue_option = 0;
1496 int msg_action = 0;
1497 int msg_action_arg = -1;
1498 int namelen = (argv[0] == NULL)? 0 : Ustrlen(argv[0]);
1499 int queue_only_reason = 0;
1500 #ifdef EXIM_PERL
1501 int perl_start_option = 0;
1502 #endif
1503 int recipients_arg = argc;
1504 int sender_address_domain = 0;
1505 int test_retry_arg = -1;
1506 int test_rewrite_arg = -1;
1507 BOOL arg_queue_only = FALSE;
1508 BOOL bi_option = FALSE;
1509 BOOL checking = FALSE;
1510 BOOL count_queue = FALSE;
1511 BOOL expansion_test = FALSE;
1512 BOOL extract_recipients = FALSE;
1513 BOOL flag_G = FALSE;
1514 BOOL flag_n = FALSE;
1515 BOOL forced_delivery = FALSE;
1516 BOOL f_end_dot = FALSE;
1517 BOOL deliver_give_up = FALSE;
1518 BOOL list_queue = FALSE;
1519 BOOL list_options = FALSE;
1520 BOOL list_config = FALSE;
1521 BOOL local_queue_only;
1522 BOOL more = TRUE;
1523 BOOL one_msg_action = FALSE;
1524 BOOL opt_D_used = FALSE;
1525 BOOL queue_only_set = FALSE;
1526 BOOL receiving_message = TRUE;
1527 BOOL sender_ident_set = FALSE;
1528 BOOL session_local_queue_only;
1529 BOOL unprivileged;
1530 BOOL removed_privilege = FALSE;
1531 BOOL usage_wanted = FALSE;
1532 BOOL verify_address_mode = FALSE;
1533 BOOL verify_as_sender = FALSE;
1534 BOOL version_printed = FALSE;
1535 uschar *alias_arg = NULL;
1536 uschar *called_as = US"";
1537 uschar *cmdline_syslog_name = NULL;
1538 uschar *start_queue_run_id = NULL;
1539 uschar *stop_queue_run_id = NULL;
1540 uschar *expansion_test_message = NULL;
1541 uschar *ftest_domain = NULL;
1542 uschar *ftest_localpart = NULL;
1543 uschar *ftest_prefix = NULL;
1544 uschar *ftest_suffix = NULL;
1545 uschar *log_oneline = NULL;
1546 uschar *malware_test_file = NULL;
1547 uschar *real_sender_address;
1548 uschar *originator_home = US"/";
1549 size_t sz;
1550 void *reset_point;
1551
1552 struct passwd *pw;
1553 struct stat statbuf;
1554 pid_t passed_qr_pid = (pid_t)0;
1555 int passed_qr_pipe = -1;
1556 gid_t group_list[NGROUPS_MAX];
1557
1558 /* For the -bI: flag */
1559 enum commandline_info info_flag = CMDINFO_NONE;
1560 BOOL info_stdout = FALSE;
1561
1562 /* Possible options for -R and -S */
1563
1564 static uschar *rsopts[] = { US"f", US"ff", US"r", US"rf", US"rff" };
1565
1566 /* Need to define this in case we need to change the environment in order
1567 to get rid of a bogus time zone. We have to make it char rather than uschar
1568 because some OS define it in /usr/include/unistd.h. */
1569
1570 extern char **environ;
1571
1572 /* If the Exim user and/or group and/or the configuration file owner/group were
1573 defined by ref:name at build time, we must now find the actual uid/gid values.
1574 This is a feature to make the lives of binary distributors easier. */
1575
1576 #ifdef EXIM_USERNAME
1577 if (route_finduser(US EXIM_USERNAME, &pw, &exim_uid))
1578 {
1579 if (exim_uid == 0)
1580 {
1581 fprintf(stderr, "exim: refusing to run with uid 0 for \"%s\"\n",
1582 EXIM_USERNAME);
1583 exit(EXIT_FAILURE);
1584 }
1585 /* If ref:name uses a number as the name, route_finduser() returns
1586 TRUE with exim_uid set and pw coerced to NULL. */
1587 if (pw)
1588 exim_gid = pw->pw_gid;
1589 #ifndef EXIM_GROUPNAME
1590 else
1591 {
1592 fprintf(stderr,
1593 "exim: ref:name should specify a usercode, not a group.\n"
1594 "exim: can't let you get away with it unless you also specify a group.\n");
1595 exit(EXIT_FAILURE);
1596 }
1597 #endif
1598 }
1599 else
1600 {
1601 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1602 EXIM_USERNAME);
1603 exit(EXIT_FAILURE);
1604 }
1605 #endif
1606
1607 #ifdef EXIM_GROUPNAME
1608 if (!route_findgroup(US EXIM_GROUPNAME, &exim_gid))
1609 {
1610 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1611 EXIM_GROUPNAME);
1612 exit(EXIT_FAILURE);
1613 }
1614 #endif
1615
1616 #ifdef CONFIGURE_OWNERNAME
1617 if (!route_finduser(US CONFIGURE_OWNERNAME, NULL, &config_uid))
1618 {
1619 fprintf(stderr, "exim: failed to find uid for user name \"%s\"\n",
1620 CONFIGURE_OWNERNAME);
1621 exit(EXIT_FAILURE);
1622 }
1623 #endif
1624
1625 /* We default the system_filter_user to be the Exim run-time user, as a
1626 sane non-root value. */
1627 system_filter_uid = exim_uid;
1628
1629 #ifdef CONFIGURE_GROUPNAME
1630 if (!route_findgroup(US CONFIGURE_GROUPNAME, &config_gid))
1631 {
1632 fprintf(stderr, "exim: failed to find gid for group name \"%s\"\n",
1633 CONFIGURE_GROUPNAME);
1634 exit(EXIT_FAILURE);
1635 }
1636 #endif
1637
1638 /* In the Cygwin environment, some initialization used to need doing.
1639 It was fudged in by means of this macro; now no longer but we'll leave
1640 it in case of others. */
1641
1642 #ifdef OS_INIT
1643 OS_INIT
1644 #endif
1645
1646 /* Check a field which is patched when we are running Exim within its
1647 testing harness; do a fast initial check, and then the whole thing. */
1648
1649 running_in_test_harness =
1650 *running_status == '<' && Ustrcmp(running_status, "<<<testing>>>") == 0;
1651
1652 /* The C standard says that the equivalent of setlocale(LC_ALL, "C") is obeyed
1653 at the start of a program; however, it seems that some environments do not
1654 follow this. A "strange" locale can affect the formatting of timestamps, so we
1655 make quite sure. */
1656
1657 setlocale(LC_ALL, "C");
1658
1659 /* Set up the default handler for timing using alarm(). */
1660
1661 os_non_restarting_signal(SIGALRM, sigalrm_handler);
1662
1663 /* Ensure we have a buffer for constructing log entries. Use malloc directly,
1664 because store_malloc writes a log entry on failure. */
1665
1666 if (!(log_buffer = US malloc(LOG_BUFFER_SIZE)))
1667 {
1668 fprintf(stderr, "exim: failed to get store for log buffer\n");
1669 exit(EXIT_FAILURE);
1670 }
1671
1672 /* Initialize the default log options. */
1673
1674 bits_set(log_selector, log_selector_size, log_default);
1675
1676 /* Set log_stderr to stderr, provided that stderr exists. This gets reset to
1677 NULL when the daemon is run and the file is closed. We have to use this
1678 indirection, because some systems don't allow writing to the variable "stderr".
1679 */
1680
1681 if (fstat(fileno(stderr), &statbuf) >= 0) log_stderr = stderr;
1682
1683 /* Arrange for the PCRE regex library to use our store functions. Note that
1684 the normal calls are actually macros that add additional arguments for
1685 debugging purposes so we have to assign specially constructed functions here.
1686 The default is to use store in the stacking pool, but this is overridden in the
1687 regex_must_compile() function. */
1688
1689 pcre_malloc = function_store_get;
1690 pcre_free = function_dummy_free;
1691
1692 /* Ensure there is a big buffer for temporary use in several places. It is put
1693 in malloc store so that it can be freed for enlargement if necessary. */
1694
1695 big_buffer = store_malloc(big_buffer_size);
1696
1697 /* Set up the handler for the data request signal, and set the initial
1698 descriptive text. */
1699
1700 set_process_info("initializing");
1701 os_restarting_signal(SIGUSR1, usr1_handler);
1702
1703 /* SIGHUP is used to get the daemon to reconfigure. It gets set as appropriate
1704 in the daemon code. For the rest of Exim's uses, we ignore it. */
1705
1706 signal(SIGHUP, SIG_IGN);
1707
1708 /* We don't want to die on pipe errors as the code is written to handle
1709 the write error instead. */
1710
1711 signal(SIGPIPE, SIG_IGN);
1712
1713 /* Under some circumstance on some OS, Exim can get called with SIGCHLD
1714 set to SIG_IGN. This causes subprocesses that complete before the parent
1715 process waits for them not to hang around, so when Exim calls wait(), nothing
1716 is there. The wait() code has been made robust against this, but let's ensure
1717 that SIGCHLD is set to SIG_DFL, because it's tidier to wait and get a process
1718 ending status. We use sigaction rather than plain signal() on those OS where
1719 SA_NOCLDWAIT exists, because we want to be sure it is turned off. (There was a
1720 problem on AIX with this.) */
1721
1722 #ifdef SA_NOCLDWAIT
1723 {
1724 struct sigaction act;
1725 act.sa_handler = SIG_DFL;
1726 sigemptyset(&(act.sa_mask));
1727 act.sa_flags = 0;
1728 sigaction(SIGCHLD, &act, NULL);
1729 }
1730 #else
1731 signal(SIGCHLD, SIG_DFL);
1732 #endif
1733
1734 /* Save the arguments for use if we re-exec exim as a daemon after receiving
1735 SIGHUP. */
1736
1737 sighup_argv = argv;
1738
1739 /* Set up the version number. Set up the leading 'E' for the external form of
1740 message ids, set the pointer to the internal form, and initialize it to
1741 indicate no message being processed. */
1742
1743 version_init();
1744 message_id_option[0] = '-';
1745 message_id_external = message_id_option + 1;
1746 message_id_external[0] = 'E';
1747 message_id = message_id_external + 1;
1748 message_id[0] = 0;
1749
1750 /* Set the umask to zero so that any files Exim creates using open() are
1751 created with the modes that it specifies. NOTE: Files created with fopen() have
1752 a problem, which was not recognized till rather late (February 2006). With this
1753 umask, such files will be world writeable. (They are all content scanning files
1754 in the spool directory, which isn't world-accessible, so this is not a
1755 disaster, but it's untidy.) I don't want to change this overall setting,
1756 however, because it will interact badly with the open() calls. Instead, there's
1757 now a function called modefopen() that fiddles with the umask while calling
1758 fopen(). */
1759
1760 (void)umask(0);
1761
1762 /* Precompile the regular expression for matching a message id. Keep this in
1763 step with the code that generates ids in the accept.c module. We need to do
1764 this here, because the -M options check their arguments for syntactic validity
1765 using mac_ismsgid, which uses this. */
1766
1767 regex_ismsgid =
1768 regex_must_compile(US"^(?:[^\\W_]{6}-){2}[^\\W_]{2}$", FALSE, TRUE);
1769
1770 /* Precompile the regular expression that is used for matching an SMTP error
1771 code, possibly extended, at the start of an error message. Note that the
1772 terminating whitespace character is included. */
1773
1774 regex_smtp_code =
1775 regex_must_compile(US"^\\d\\d\\d\\s(?:\\d\\.\\d\\d?\\d?\\.\\d\\d?\\d?\\s)?",
1776 FALSE, TRUE);
1777
1778 #ifdef WHITELIST_D_MACROS
1779 /* Precompile the regular expression used to filter the content of macros
1780 given to -D for permissibility. */
1781
1782 regex_whitelisted_macro =
1783 regex_must_compile(US"^[A-Za-z0-9_/.-]*$", FALSE, TRUE);
1784 #endif
1785
1786 for (i = 0; i < REGEX_VARS; i++) regex_vars[i] = NULL;
1787
1788 /* If the program is called as "mailq" treat it as equivalent to "exim -bp";
1789 this seems to be a generally accepted convention, since one finds symbolic
1790 links called "mailq" in standard OS configurations. */
1791
1792 if ((namelen == 5 && Ustrcmp(argv[0], "mailq") == 0) ||
1793 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/mailq", 6) == 0))
1794 {
1795 list_queue = TRUE;
1796 receiving_message = FALSE;
1797 called_as = US"-mailq";
1798 }
1799
1800 /* If the program is called as "rmail" treat it as equivalent to
1801 "exim -i -oee", thus allowing UUCP messages to be input using non-SMTP mode,
1802 i.e. preventing a single dot on a line from terminating the message, and
1803 returning with zero return code, even in cases of error (provided an error
1804 message has been sent). */
1805
1806 if ((namelen == 5 && Ustrcmp(argv[0], "rmail") == 0) ||
1807 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rmail", 6) == 0))
1808 {
1809 dot_ends = FALSE;
1810 called_as = US"-rmail";
1811 errors_sender_rc = EXIT_SUCCESS;
1812 }
1813
1814 /* If the program is called as "rsmtp" treat it as equivalent to "exim -bS";
1815 this is a smail convention. */
1816
1817 if ((namelen == 5 && Ustrcmp(argv[0], "rsmtp") == 0) ||
1818 (namelen > 5 && Ustrncmp(argv[0] + namelen - 6, "/rsmtp", 6) == 0))
1819 {
1820 smtp_input = smtp_batched_input = TRUE;
1821 called_as = US"-rsmtp";
1822 }
1823
1824 /* If the program is called as "runq" treat it as equivalent to "exim -q";
1825 this is a smail convention. */
1826
1827 if ((namelen == 4 && Ustrcmp(argv[0], "runq") == 0) ||
1828 (namelen > 4 && Ustrncmp(argv[0] + namelen - 5, "/runq", 5) == 0))
1829 {
1830 queue_interval = 0;
1831 receiving_message = FALSE;
1832 called_as = US"-runq";
1833 }
1834
1835 /* If the program is called as "newaliases" treat it as equivalent to
1836 "exim -bi"; this is a sendmail convention. */
1837
1838 if ((namelen == 10 && Ustrcmp(argv[0], "newaliases") == 0) ||
1839 (namelen > 10 && Ustrncmp(argv[0] + namelen - 11, "/newaliases", 11) == 0))
1840 {
1841 bi_option = TRUE;
1842 receiving_message = FALSE;
1843 called_as = US"-newaliases";
1844 }
1845
1846 /* Save the original effective uid for a couple of uses later. It should
1847 normally be root, but in some esoteric environments it may not be. */
1848
1849 original_euid = geteuid();
1850
1851 /* Get the real uid and gid. If the caller is root, force the effective uid/gid
1852 to be the same as the real ones. This makes a difference only if Exim is setuid
1853 (or setgid) to something other than root, which could be the case in some
1854 special configurations. */
1855
1856 real_uid = getuid();
1857 real_gid = getgid();
1858
1859 if (real_uid == root_uid)
1860 {
1861 rv = setgid(real_gid);
1862 if (rv)
1863 {
1864 fprintf(stderr, "exim: setgid(%ld) failed: %s\n",
1865 (long int)real_gid, strerror(errno));
1866 exit(EXIT_FAILURE);
1867 }
1868 rv = setuid(real_uid);
1869 if (rv)
1870 {
1871 fprintf(stderr, "exim: setuid(%ld) failed: %s\n",
1872 (long int)real_uid, strerror(errno));
1873 exit(EXIT_FAILURE);
1874 }
1875 }
1876
1877 /* If neither the original real uid nor the original euid was root, Exim is
1878 running in an unprivileged state. */
1879
1880 unprivileged = (real_uid != root_uid && original_euid != root_uid);
1881
1882 /* Scan the program's arguments. Some can be dealt with right away; others are
1883 simply recorded for checking and handling afterwards. Do a high-level switch
1884 on the second character (the one after '-'), to save some effort. */
1885
1886 for (i = 1; i < argc; i++)
1887 {
1888 BOOL badarg = FALSE;
1889 uschar *arg = argv[i];
1890 uschar *argrest;
1891 int switchchar;
1892
1893 /* An argument not starting with '-' is the start of a recipients list;
1894 break out of the options-scanning loop. */
1895
1896 if (arg[0] != '-')
1897 {
1898 recipients_arg = i;
1899 break;
1900 }
1901
1902 /* An option consisting of -- terminates the options */
1903
1904 if (Ustrcmp(arg, "--") == 0)
1905 {
1906 recipients_arg = i + 1;
1907 break;
1908 }
1909
1910 /* Handle flagged options */
1911
1912 switchchar = arg[1];
1913 argrest = arg+2;
1914
1915 /* Make all -ex options synonymous with -oex arguments, since that
1916 is assumed by various callers. Also make -qR options synonymous with -R
1917 options, as that seems to be required as well. Allow for -qqR too, and
1918 the same for -S options. */
1919
1920 if (Ustrncmp(arg+1, "oe", 2) == 0 ||
1921 Ustrncmp(arg+1, "qR", 2) == 0 ||
1922 Ustrncmp(arg+1, "qS", 2) == 0)
1923 {
1924 switchchar = arg[2];
1925 argrest++;
1926 }
1927 else if (Ustrncmp(arg+1, "qqR", 3) == 0 || Ustrncmp(arg+1, "qqS", 3) == 0)
1928 {
1929 switchchar = arg[3];
1930 argrest += 2;
1931 queue_2stage = TRUE;
1932 }
1933
1934 /* Make -r synonymous with -f, since it is a documented alias */
1935
1936 else if (arg[1] == 'r') switchchar = 'f';
1937
1938 /* Make -ov synonymous with -v */
1939
1940 else if (Ustrcmp(arg, "-ov") == 0)
1941 {
1942 switchchar = 'v';
1943 argrest++;
1944 }
1945
1946 /* deal with --option_aliases */
1947 else if (switchchar == '-')
1948 {
1949 if (Ustrcmp(argrest, "help") == 0)
1950 {
1951 usage_wanted = TRUE;
1952 break;
1953 }
1954 else if (Ustrcmp(argrest, "version") == 0)
1955 {
1956 switchchar = 'b';
1957 argrest = US"V";
1958 }
1959 }
1960
1961 /* High-level switch on active initial letter */
1962
1963 switch(switchchar)
1964 {
1965
1966 /* sendmail uses -Ac and -Am to control which .cf file is used;
1967 we ignore them. */
1968 case 'A':
1969 if (*argrest == '\0') { badarg = TRUE; break; }
1970 else
1971 {
1972 BOOL ignore = FALSE;
1973 switch (*argrest)
1974 {
1975 case 'c':
1976 case 'm':
1977 if (*(argrest + 1) == '\0')
1978 ignore = TRUE;
1979 break;
1980 }
1981 if (!ignore) { badarg = TRUE; break; }
1982 }
1983 break;
1984
1985 /* -Btype is a sendmail option for 7bit/8bit setting. Exim is 8-bit clean
1986 so has no need of it. */
1987
1988 case 'B':
1989 if (*argrest == 0) i++; /* Skip over the type */
1990 break;
1991
1992
1993 case 'b':
1994 receiving_message = FALSE; /* Reset TRUE for -bm, -bS, -bs below */
1995
1996 /* -bd: Run in daemon mode, awaiting SMTP connections.
1997 -bdf: Ditto, but in the foreground.
1998 */
1999
2000 if (*argrest == 'd')
2001 {
2002 daemon_listen = TRUE;
2003 if (*(++argrest) == 'f') background_daemon = FALSE;
2004 else if (*argrest != 0) { badarg = TRUE; break; }
2005 }
2006
2007 /* -be: Run in expansion test mode
2008 -bem: Ditto, but read a message from a file first
2009 */
2010
2011 else if (*argrest == 'e')
2012 {
2013 expansion_test = checking = TRUE;
2014 if (argrest[1] == 'm')
2015 {
2016 if (++i >= argc) { badarg = TRUE; break; }
2017 expansion_test_message = argv[i];
2018 argrest++;
2019 }
2020 if (argrest[1] != 0) { badarg = TRUE; break; }
2021 }
2022
2023 /* -bF: Run system filter test */
2024
2025 else if (*argrest == 'F')
2026 {
2027 filter_test |= checking = FTEST_SYSTEM;
2028 if (*(++argrest) != 0) { badarg = TRUE; break; }
2029 if (++i < argc) filter_test_sfile = argv[i]; else
2030 {
2031 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
2032 exit(EXIT_FAILURE);
2033 }
2034 }
2035
2036 /* -bf: Run user filter test
2037 -bfd: Set domain for filter testing
2038 -bfl: Set local part for filter testing
2039 -bfp: Set prefix for filter testing
2040 -bfs: Set suffix for filter testing
2041 */
2042
2043 else if (*argrest == 'f')
2044 {
2045 if (*(++argrest) == 0)
2046 {
2047 filter_test |= checking = FTEST_USER;
2048 if (++i < argc) filter_test_ufile = argv[i]; else
2049 {
2050 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
2051 exit(EXIT_FAILURE);
2052 }
2053 }
2054 else
2055 {
2056 if (++i >= argc)
2057 {
2058 fprintf(stderr, "exim: string expected after %s\n", arg);
2059 exit(EXIT_FAILURE);
2060 }
2061 if (Ustrcmp(argrest, "d") == 0) ftest_domain = argv[i];
2062 else if (Ustrcmp(argrest, "l") == 0) ftest_localpart = argv[i];
2063 else if (Ustrcmp(argrest, "p") == 0) ftest_prefix = argv[i];
2064 else if (Ustrcmp(argrest, "s") == 0) ftest_suffix = argv[i];
2065 else { badarg = TRUE; break; }
2066 }
2067 }
2068
2069 /* -bh: Host checking - an IP address must follow. */
2070
2071 else if (Ustrcmp(argrest, "h") == 0 || Ustrcmp(argrest, "hc") == 0)
2072 {
2073 if (++i >= argc) { badarg = TRUE; break; }
2074 sender_host_address = argv[i];
2075 host_checking = checking = log_testing_mode = TRUE;
2076 host_checking_callout = argrest[1] == 'c';
2077 message_logs = FALSE;
2078 }
2079
2080 /* -bi: This option is used by sendmail to initialize *the* alias file,
2081 though it has the -oA option to specify a different file. Exim has no
2082 concept of *the* alias file, but since Sun's YP make script calls
2083 sendmail this way, some support must be provided. */
2084
2085 else if (Ustrcmp(argrest, "i") == 0) bi_option = TRUE;
2086
2087 /* -bI: provide information, of the type to follow after a colon.
2088 This is an Exim flag. */
2089
2090 else if (argrest[0] == 'I' && Ustrlen(argrest) >= 2 && argrest[1] == ':')
2091 {
2092 uschar *p = &argrest[2];
2093 info_flag = CMDINFO_HELP;
2094 if (Ustrlen(p))
2095 {
2096 if (strcmpic(p, CUS"sieve") == 0)
2097 {
2098 info_flag = CMDINFO_SIEVE;
2099 info_stdout = TRUE;
2100 }
2101 else if (strcmpic(p, CUS"dscp") == 0)
2102 {
2103 info_flag = CMDINFO_DSCP;
2104 info_stdout = TRUE;
2105 }
2106 else if (strcmpic(p, CUS"help") == 0)
2107 {
2108 info_stdout = TRUE;
2109 }
2110 }
2111 }
2112
2113 /* -bm: Accept and deliver message - the default option. Reinstate
2114 receiving_message, which got turned off for all -b options. */
2115
2116 else if (Ustrcmp(argrest, "m") == 0) receiving_message = TRUE;
2117
2118 /* -bmalware: test the filename given for malware */
2119
2120 else if (Ustrcmp(argrest, "malware") == 0)
2121 {
2122 if (++i >= argc) { badarg = TRUE; break; }
2123 checking = TRUE;
2124 malware_test_file = argv[i];
2125 }
2126
2127 /* -bnq: For locally originating messages, do not qualify unqualified
2128 addresses. In the envelope, this causes errors; in header lines they
2129 just get left. */
2130
2131 else if (Ustrcmp(argrest, "nq") == 0)
2132 {
2133 allow_unqualified_sender = FALSE;
2134 allow_unqualified_recipient = FALSE;
2135 }
2136
2137 /* -bpxx: List the contents of the mail queue, in various forms. If
2138 the option is -bpc, just a queue count is needed. Otherwise, if the
2139 first letter after p is r, then order is random. */
2140
2141 else if (*argrest == 'p')
2142 {
2143 if (*(++argrest) == 'c')
2144 {
2145 count_queue = TRUE;
2146 if (*(++argrest) != 0) badarg = TRUE;
2147 break;
2148 }
2149
2150 if (*argrest == 'r')
2151 {
2152 list_queue_option = 8;
2153 argrest++;
2154 }
2155 else list_queue_option = 0;
2156
2157 list_queue = TRUE;
2158
2159 /* -bp: List the contents of the mail queue, top-level only */
2160
2161 if (*argrest == 0) {}
2162
2163 /* -bpu: List the contents of the mail queue, top-level undelivered */
2164
2165 else if (Ustrcmp(argrest, "u") == 0) list_queue_option += 1;
2166
2167 /* -bpa: List the contents of the mail queue, including all delivered */
2168
2169 else if (Ustrcmp(argrest, "a") == 0) list_queue_option += 2;
2170
2171 /* Unknown after -bp[r] */
2172
2173 else
2174 {
2175 badarg = TRUE;
2176 break;
2177 }
2178 }
2179
2180
2181 /* -bP: List the configuration variables given as the address list.
2182 Force -v, so configuration errors get displayed. */
2183
2184 else if (Ustrcmp(argrest, "P") == 0)
2185 {
2186 /* -bP config: we need to setup here, because later,
2187 * when list_options is checked, the config is read already */
2188 if (argv[i+1] && Ustrcmp(argv[i+1], "config") == 0)
2189 {
2190 list_config = TRUE;
2191 readconf_save_config(version_string);
2192 }
2193 else
2194 {
2195 list_options = TRUE;
2196 debug_selector |= D_v;
2197 debug_file = stderr;
2198 }
2199 }
2200
2201 /* -brt: Test retry configuration lookup */
2202
2203 else if (Ustrcmp(argrest, "rt") == 0)
2204 {
2205 checking = TRUE;
2206 test_retry_arg = i + 1;
2207 goto END_ARG;
2208 }
2209
2210 /* -brw: Test rewrite configuration */
2211
2212 else if (Ustrcmp(argrest, "rw") == 0)
2213 {
2214 checking = TRUE;
2215 test_rewrite_arg = i + 1;
2216 goto END_ARG;
2217 }
2218
2219 /* -bS: Read SMTP commands on standard input, but produce no replies -
2220 all errors are reported by sending messages. */
2221
2222 else if (Ustrcmp(argrest, "S") == 0)
2223 smtp_input = smtp_batched_input = receiving_message = TRUE;
2224
2225 /* -bs: Read SMTP commands on standard input and produce SMTP replies
2226 on standard output. */
2227
2228 else if (Ustrcmp(argrest, "s") == 0) smtp_input = receiving_message = TRUE;
2229
2230 /* -bt: address testing mode */
2231
2232 else if (Ustrcmp(argrest, "t") == 0)
2233 address_test_mode = checking = log_testing_mode = TRUE;
2234
2235 /* -bv: verify addresses */
2236
2237 else if (Ustrcmp(argrest, "v") == 0)
2238 verify_address_mode = checking = log_testing_mode = TRUE;
2239
2240 /* -bvs: verify sender addresses */
2241
2242 else if (Ustrcmp(argrest, "vs") == 0)
2243 {
2244 verify_address_mode = checking = log_testing_mode = TRUE;
2245 verify_as_sender = TRUE;
2246 }
2247
2248 /* -bV: Print version string and support details */
2249
2250 else if (Ustrcmp(argrest, "V") == 0)
2251 {
2252 printf("Exim version %s #%s built %s\n", version_string,
2253 version_cnumber, version_date);
2254 printf("%s\n", CS version_copyright);
2255 version_printed = TRUE;
2256 show_whats_supported(stdout);
2257 log_testing_mode = TRUE;
2258 }
2259
2260 /* -bw: inetd wait mode, accept a listening socket as stdin */
2261
2262 else if (*argrest == 'w')
2263 {
2264 inetd_wait_mode = TRUE;
2265 background_daemon = FALSE;
2266 daemon_listen = TRUE;
2267 if (*(++argrest) != '\0')
2268 {
2269 inetd_wait_timeout = readconf_readtime(argrest, 0, FALSE);
2270 if (inetd_wait_timeout <= 0)
2271 {
2272 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
2273 exit(EXIT_FAILURE);
2274 }
2275 }
2276 }
2277
2278 else badarg = TRUE;
2279 break;
2280
2281
2282 /* -C: change configuration file list; ignore if it isn't really
2283 a change! Enforce a prefix check if required. */
2284
2285 case 'C':
2286 if (*argrest == 0)
2287 {
2288 if(++i < argc) argrest = argv[i]; else
2289 { badarg = TRUE; break; }
2290 }
2291 if (Ustrcmp(config_main_filelist, argrest) != 0)
2292 {
2293 #ifdef ALT_CONFIG_PREFIX
2294 int sep = 0;
2295 int len = Ustrlen(ALT_CONFIG_PREFIX);
2296 const uschar *list = argrest;
2297 uschar *filename;
2298 while((filename = string_nextinlist(&list, &sep, big_buffer,
2299 big_buffer_size)) != NULL)
2300 {
2301 if ((Ustrlen(filename) < len ||
2302 Ustrncmp(filename, ALT_CONFIG_PREFIX, len) != 0 ||
2303 Ustrstr(filename, "/../") != NULL) &&
2304 (Ustrcmp(filename, "/dev/null") != 0 || real_uid != root_uid))
2305 {
2306 fprintf(stderr, "-C Permission denied\n");
2307 exit(EXIT_FAILURE);
2308 }
2309 }
2310 #endif
2311 if (real_uid != root_uid)
2312 {
2313 #ifdef TRUSTED_CONFIG_LIST
2314
2315 if (real_uid != exim_uid
2316 #ifdef CONFIGURE_OWNER
2317 && real_uid != config_uid
2318 #endif
2319 )
2320 trusted_config = FALSE;
2321 else
2322 {
2323 FILE *trust_list = Ufopen(TRUSTED_CONFIG_LIST, "rb");
2324 if (trust_list)
2325 {
2326 struct stat statbuf;
2327
2328 if (fstat(fileno(trust_list), &statbuf) != 0 ||
2329 (statbuf.st_uid != root_uid /* owner not root */
2330 #ifdef CONFIGURE_OWNER
2331 && statbuf.st_uid != config_uid /* owner not the special one */
2332 #endif
2333 ) || /* or */
2334 (statbuf.st_gid != root_gid /* group not root */
2335 #ifdef CONFIGURE_GROUP
2336 && statbuf.st_gid != config_gid /* group not the special one */
2337 #endif
2338 && (statbuf.st_mode & 020) != 0 /* group writeable */
2339 ) || /* or */
2340 (statbuf.st_mode & 2) != 0) /* world writeable */
2341 {
2342 trusted_config = FALSE;
2343 fclose(trust_list);
2344 }
2345 else
2346 {
2347 /* Well, the trust list at least is up to scratch... */
2348 void *reset_point = store_get(0);
2349 uschar *trusted_configs[32];
2350 int nr_configs = 0;
2351 int i = 0;
2352
2353 while (Ufgets(big_buffer, big_buffer_size, trust_list))
2354 {
2355 uschar *start = big_buffer, *nl;
2356 while (*start && isspace(*start))
2357 start++;
2358 if (*start != '/')
2359 continue;
2360 nl = Ustrchr(start, '\n');
2361 if (nl)
2362 *nl = 0;
2363 trusted_configs[nr_configs++] = string_copy(start);
2364 if (nr_configs == 32)
2365 break;
2366 }
2367 fclose(trust_list);
2368
2369 if (nr_configs)
2370 {
2371 int sep = 0;
2372 const uschar *list = argrest;
2373 uschar *filename;
2374 while (trusted_config && (filename = string_nextinlist(&list,
2375 &sep, big_buffer, big_buffer_size)) != NULL)
2376 {
2377 for (i=0; i < nr_configs; i++)
2378 {
2379 if (Ustrcmp(filename, trusted_configs[i]) == 0)
2380 break;
2381 }
2382 if (i == nr_configs)
2383 {
2384 trusted_config = FALSE;
2385 break;
2386 }
2387 }
2388 store_reset(reset_point);
2389 }
2390 else
2391 {
2392 /* No valid prefixes found in trust_list file. */
2393 trusted_config = FALSE;
2394 }
2395 }
2396 }
2397 else
2398 {
2399 /* Could not open trust_list file. */
2400 trusted_config = FALSE;
2401 }
2402 }
2403 #else
2404 /* Not root; don't trust config */
2405 trusted_config = FALSE;
2406 #endif
2407 }
2408
2409 config_main_filelist = argrest;
2410 config_changed = TRUE;
2411 }
2412 break;
2413
2414
2415 /* -D: set up a macro definition */
2416
2417 case 'D':
2418 #ifdef DISABLE_D_OPTION
2419 fprintf(stderr, "exim: -D is not available in this Exim binary\n");
2420 exit(EXIT_FAILURE);
2421 #else
2422 {
2423 int ptr = 0;
2424 macro_item *m;
2425 uschar name[24];
2426 uschar *s = argrest;
2427
2428 opt_D_used = TRUE;
2429 while (isspace(*s)) s++;
2430
2431 if (*s < 'A' || *s > 'Z')
2432 {
2433 fprintf(stderr, "exim: macro name set by -D must start with "
2434 "an upper case letter\n");
2435 exit(EXIT_FAILURE);
2436 }
2437
2438 while (isalnum(*s) || *s == '_')
2439 {
2440 if (ptr < sizeof(name)-1) name[ptr++] = *s;
2441 s++;
2442 }
2443 name[ptr] = 0;
2444 if (ptr == 0) { badarg = TRUE; break; }
2445 while (isspace(*s)) s++;
2446 if (*s != 0)
2447 {
2448 if (*s++ != '=') { badarg = TRUE; break; }
2449 while (isspace(*s)) s++;
2450 }
2451
2452 for (m = macros; m; m = m->next)
2453 if (Ustrcmp(m->name, name) == 0)
2454 {
2455 fprintf(stderr, "exim: duplicated -D in command line\n");
2456 exit(EXIT_FAILURE);
2457 }
2458
2459 m = macro_create(string_copy(name), string_copy(s), TRUE);
2460
2461 if (clmacro_count >= MAX_CLMACROS)
2462 {
2463 fprintf(stderr, "exim: too many -D options on command line\n");
2464 exit(EXIT_FAILURE);
2465 }
2466 clmacros[clmacro_count++] = string_sprintf("-D%s=%s", m->name,
2467 m->replacement);
2468 }
2469 #endif
2470 break;
2471
2472 /* -d: Set debug level (see also -v below) or set the drop_cr option.
2473 The latter is now a no-op, retained for compatibility only. If -dd is used,
2474 debugging subprocesses of the daemon is disabled. */
2475
2476 case 'd':
2477 if (Ustrcmp(argrest, "ropcr") == 0)
2478 {
2479 /* drop_cr = TRUE; */
2480 }
2481
2482 /* Use an intermediate variable so that we don't set debugging while
2483 decoding the debugging bits. */
2484
2485 else
2486 {
2487 unsigned int selector = D_default;
2488 debug_selector = 0;
2489 debug_file = NULL;
2490 if (*argrest == 'd')
2491 {
2492 debug_daemon = TRUE;
2493 argrest++;
2494 }
2495 if (*argrest != 0)
2496 decode_bits(&selector, 1, debug_notall, argrest,
2497 debug_options, debug_options_count, US"debug", 0);
2498 debug_selector = selector;
2499 }
2500 break;
2501
2502
2503 /* -E: This is a local error message. This option is not intended for
2504 external use at all, but is not restricted to trusted callers because it
2505 does no harm (just suppresses certain error messages) and if Exim is run
2506 not setuid root it won't always be trusted when it generates error
2507 messages using this option. If there is a message id following -E, point
2508 message_reference at it, for logging. */
2509
2510 case 'E':
2511 local_error_message = TRUE;
2512 if (mac_ismsgid(argrest)) message_reference = argrest;
2513 break;
2514
2515
2516 /* -ex: The vacation program calls sendmail with the undocumented "-eq"
2517 option, so it looks as if historically the -oex options are also callable
2518 without the leading -o. So we have to accept them. Before the switch,
2519 anything starting -oe has been converted to -e. Exim does not support all
2520 of the sendmail error options. */
2521
2522 case 'e':
2523 if (Ustrcmp(argrest, "e") == 0)
2524 {
2525 arg_error_handling = ERRORS_SENDER;
2526 errors_sender_rc = EXIT_SUCCESS;
2527 }
2528 else if (Ustrcmp(argrest, "m") == 0) arg_error_handling = ERRORS_SENDER;
2529 else if (Ustrcmp(argrest, "p") == 0) arg_error_handling = ERRORS_STDERR;
2530 else if (Ustrcmp(argrest, "q") == 0) arg_error_handling = ERRORS_STDERR;
2531 else if (Ustrcmp(argrest, "w") == 0) arg_error_handling = ERRORS_SENDER;
2532 else badarg = TRUE;
2533 break;
2534
2535
2536 /* -F: Set sender's full name, used instead of the gecos entry from
2537 the password file. Since users can usually alter their gecos entries,
2538 there's no security involved in using this instead. The data can follow
2539 the -F or be in the next argument. */
2540
2541 case 'F':
2542 if (*argrest == 0)
2543 {
2544 if(++i < argc) argrest = argv[i]; else
2545 { badarg = TRUE; break; }
2546 }
2547 originator_name = argrest;
2548 sender_name_forced = TRUE;
2549 break;
2550
2551
2552 /* -f: Set sender's address - this value is only actually used if Exim is
2553 run by a trusted user, or if untrusted_set_sender is set and matches the
2554 address, except that the null address can always be set by any user. The
2555 test for this happens later, when the value given here is ignored when not
2556 permitted. For an untrusted user, the actual sender is still put in Sender:
2557 if it doesn't match the From: header (unless no_local_from_check is set).
2558 The data can follow the -f or be in the next argument. The -r switch is an
2559 obsolete form of -f but since there appear to be programs out there that
2560 use anything that sendmail has ever supported, better accept it - the
2561 synonymizing is done before the switch above.
2562
2563 At this stage, we must allow domain literal addresses, because we don't
2564 know what the setting of allow_domain_literals is yet. Ditto for trailing
2565 dots and strip_trailing_dot. */
2566
2567 case 'f':
2568 {
2569 int dummy_start, dummy_end;
2570 uschar *errmess;
2571 if (*argrest == 0)
2572 {
2573 if (i+1 < argc) argrest = argv[++i]; else
2574 { badarg = TRUE; break; }
2575 }
2576 if (*argrest == 0)
2577 sender_address = string_sprintf(""); /* Ensure writeable memory */
2578 else
2579 {
2580 uschar *temp = argrest + Ustrlen(argrest) - 1;
2581 while (temp >= argrest && isspace(*temp)) temp--;
2582 if (temp >= argrest && *temp == '.') f_end_dot = TRUE;
2583 allow_domain_literals = TRUE;
2584 strip_trailing_dot = TRUE;
2585 #ifdef SUPPORT_I18N
2586 allow_utf8_domains = TRUE;
2587 #endif
2588 sender_address = parse_extract_address(argrest, &errmess,
2589 &dummy_start, &dummy_end, &sender_address_domain, TRUE);
2590 #ifdef SUPPORT_I18N
2591 message_smtputf8 = string_is_utf8(sender_address);
2592 allow_utf8_domains = FALSE;
2593 #endif
2594 allow_domain_literals = FALSE;
2595 strip_trailing_dot = FALSE;
2596 if (sender_address == NULL)
2597 {
2598 fprintf(stderr, "exim: bad -f address \"%s\": %s\n", argrest, errmess);
2599 return EXIT_FAILURE;
2600 }
2601 }
2602 sender_address_forced = TRUE;
2603 }
2604 break;
2605
2606 /* -G: sendmail invocation to specify that it's a gateway submission and
2607 sendmail may complain about problems instead of fixing them.
2608 We make it equivalent to an ACL "control = suppress_local_fixups" and do
2609 not at this time complain about problems. */
2610
2611 case 'G':
2612 flag_G = TRUE;
2613 break;
2614
2615 /* -h: Set the hop count for an incoming message. Exim does not currently
2616 support this; it always computes it by counting the Received: headers.
2617 To put it in will require a change to the spool header file format. */
2618
2619 case 'h':
2620 if (*argrest == 0)
2621 {
2622 if(++i < argc) argrest = argv[i]; else
2623 { badarg = TRUE; break; }
2624 }
2625 if (!isdigit(*argrest)) badarg = TRUE;
2626 break;
2627
2628
2629 /* -i: Set flag so dot doesn't end non-SMTP input (same as -oi, seems
2630 not to be documented for sendmail but mailx (at least) uses it) */
2631
2632 case 'i':
2633 if (*argrest == 0) dot_ends = FALSE; else badarg = TRUE;
2634 break;
2635
2636
2637 /* -L: set the identifier used for syslog; equivalent to setting
2638 syslog_processname in the config file, but needs to be an admin option. */
2639
2640 case 'L':
2641 if (*argrest == '\0')
2642 {
2643 if(++i < argc) argrest = argv[i]; else
2644 { badarg = TRUE; break; }
2645 }
2646 sz = Ustrlen(argrest);
2647 if (sz > 32)
2648 {
2649 fprintf(stderr, "exim: the -L syslog name is too long: \"%s\"\n", argrest);
2650 return EXIT_FAILURE;
2651 }
2652 if (sz < 1)
2653 {
2654 fprintf(stderr, "exim: the -L syslog name is too short\n");
2655 return EXIT_FAILURE;
2656 }
2657 cmdline_syslog_name = argrest;
2658 break;
2659
2660 case 'M':
2661 receiving_message = FALSE;
2662
2663 /* -MC: continue delivery of another message via an existing open
2664 file descriptor. This option is used for an internal call by the
2665 smtp transport when there is a pending message waiting to go to an
2666 address to which it has got a connection. Five subsequent arguments are
2667 required: transport name, host name, IP address, sequence number, and
2668 message_id. Transports may decline to create new processes if the sequence
2669 number gets too big. The channel is stdin. This (-MC) must be the last
2670 argument. There's a subsequent check that the real-uid is privileged.
2671
2672 If we are running in the test harness. delay for a bit, to let the process
2673 that set this one up complete. This makes for repeatability of the logging,
2674 etc. output. */
2675
2676 if (Ustrcmp(argrest, "C") == 0)
2677 {
2678 union sockaddr_46 interface_sock;
2679 EXIM_SOCKLEN_T size = sizeof(interface_sock);
2680
2681 if (argc != i + 6)
2682 {
2683 fprintf(stderr, "exim: too many or too few arguments after -MC\n");
2684 return EXIT_FAILURE;
2685 }
2686
2687 if (msg_action_arg >= 0)
2688 {
2689 fprintf(stderr, "exim: incompatible arguments\n");
2690 return EXIT_FAILURE;
2691 }
2692
2693 continue_transport = argv[++i];
2694 continue_hostname = argv[++i];
2695 continue_host_address = argv[++i];
2696 continue_sequence = Uatoi(argv[++i]);
2697 msg_action = MSG_DELIVER;
2698 msg_action_arg = ++i;
2699 forced_delivery = TRUE;
2700 queue_run_pid = passed_qr_pid;
2701 queue_run_pipe = passed_qr_pipe;
2702
2703 if (!mac_ismsgid(argv[i]))
2704 {
2705 fprintf(stderr, "exim: malformed message id %s after -MC option\n",
2706 argv[i]);
2707 return EXIT_FAILURE;
2708 }
2709
2710 /* Set up $sending_ip_address and $sending_port, unless proxied */
2711
2712 if (!continue_proxy_cipher)
2713 if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
2714 &size) == 0)
2715 sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
2716 &sending_port);
2717 else
2718 {
2719 fprintf(stderr, "exim: getsockname() failed after -MC option: %s\n",
2720 strerror(errno));
2721 return EXIT_FAILURE;
2722 }
2723
2724 if (running_in_test_harness) millisleep(500);
2725 break;
2726 }
2727
2728 else if (*argrest == 'C' && argrest[1] && !argrest[2])
2729 {
2730 switch(argrest[1])
2731 {
2732 /* -MCA: set the smtp_authenticated flag; this is useful only when it
2733 precedes -MC (see above). The flag indicates that the host to which
2734 Exim is connected has accepted an AUTH sequence. */
2735
2736 case 'A': smtp_authenticated = TRUE; break;
2737
2738 /* -MCD: set the smtp_use_dsn flag; this indicates that the host
2739 that exim is connected to supports the esmtp extension DSN */
2740
2741 case 'D': smtp_peer_options |= OPTION_DSN; break;
2742
2743 /* -MCG: set the queue name, to a non-default value */
2744
2745 case 'G': if (++i < argc) queue_name = string_copy(argv[i]);
2746 else badarg = TRUE;
2747 break;
2748
2749 /* -MCK: the peer offered CHUNKING. Must precede -MC */
2750
2751 case 'K': smtp_peer_options |= OPTION_CHUNKING; break;
2752
2753 /* -MCP: set the smtp_use_pipelining flag; this is useful only when
2754 it preceded -MC (see above) */
2755
2756 case 'P': smtp_peer_options |= OPTION_PIPE; break;
2757
2758 /* -MCQ: pass on the pid of the queue-running process that started
2759 this chain of deliveries and the fd of its synchronizing pipe; this
2760 is useful only when it precedes -MC (see above) */
2761
2762 case 'Q': if (++i < argc) passed_qr_pid = (pid_t)(Uatol(argv[i]));
2763 else badarg = TRUE;
2764 if (++i < argc) passed_qr_pipe = (int)(Uatol(argv[i]));
2765 else badarg = TRUE;
2766 break;
2767
2768 /* -MCS: set the smtp_use_size flag; this is useful only when it
2769 precedes -MC (see above) */
2770
2771 case 'S': smtp_peer_options |= OPTION_SIZE; break;
2772
2773 #ifdef SUPPORT_TLS
2774 /* -MCt: similar to -MCT below but the connection is still open
2775 via a proxy proces which handles the TLS context and coding.
2776 Require three arguments for the proxied local address and port,
2777 and the TLS cipher. */
2778
2779 case 't': if (++i < argc) sending_ip_address = argv[i];
2780 else badarg = TRUE;
2781 if (++i < argc) sending_port = (int)(Uatol(argv[i]));
2782 else badarg = TRUE;
2783 if (++i < argc) continue_proxy_cipher = argv[i];
2784 else badarg = TRUE;
2785 /*FALLTHROUGH*/
2786
2787 /* -MCT: set the tls_offered flag; this is useful only when it
2788 precedes -MC (see above). The flag indicates that the host to which
2789 Exim is connected has offered TLS support. */
2790
2791 case 'T': smtp_peer_options |= OPTION_TLS; break;
2792 #endif
2793
2794 default: badarg = TRUE; break;
2795 }
2796 break;
2797 }
2798
2799 /* -M[x]: various operations on the following list of message ids:
2800 -M deliver the messages, ignoring next retry times and thawing
2801 -Mc deliver the messages, checking next retry times, no thawing
2802 -Mf freeze the messages
2803 -Mg give up on the messages
2804 -Mt thaw the messages
2805 -Mrm remove the messages
2806 In the above cases, this must be the last option. There are also the
2807 following options which are followed by a single message id, and which
2808 act on that message. Some of them use the "recipient" addresses as well.
2809 -Mar add recipient(s)
2810 -Mmad mark all recipients delivered
2811 -Mmd mark recipients(s) delivered
2812 -Mes edit sender
2813 -Mset load a message for use with -be
2814 -Mvb show body
2815 -Mvc show copy (of whole message, in RFC 2822 format)
2816 -Mvh show header
2817 -Mvl show log
2818 */
2819
2820 else if (*argrest == 0)
2821 {
2822 msg_action = MSG_DELIVER;
2823 forced_delivery = deliver_force_thaw = TRUE;
2824 }
2825 else if (Ustrcmp(argrest, "ar") == 0)
2826 {
2827 msg_action = MSG_ADD_RECIPIENT;
2828 one_msg_action = TRUE;
2829 }
2830 else if (Ustrcmp(argrest, "c") == 0) msg_action = MSG_DELIVER;
2831 else if (Ustrcmp(argrest, "es") == 0)
2832 {
2833 msg_action = MSG_EDIT_SENDER;
2834 one_msg_action = TRUE;
2835 }
2836 else if (Ustrcmp(argrest, "f") == 0) msg_action = MSG_FREEZE;
2837 else if (Ustrcmp(argrest, "g") == 0)
2838 {
2839 msg_action = MSG_DELIVER;
2840 deliver_give_up = TRUE;
2841 }
2842 else if (Ustrcmp(argrest, "mad") == 0)
2843 {
2844 msg_action = MSG_MARK_ALL_DELIVERED;
2845 }
2846 else if (Ustrcmp(argrest, "md") == 0)
2847 {
2848 msg_action = MSG_MARK_DELIVERED;
2849 one_msg_action = TRUE;
2850 }
2851 else if (Ustrcmp(argrest, "rm") == 0) msg_action = MSG_REMOVE;
2852 else if (Ustrcmp(argrest, "set") == 0)
2853 {
2854 msg_action = MSG_LOAD;
2855 one_msg_action = TRUE;
2856 }
2857 else if (Ustrcmp(argrest, "t") == 0) msg_action = MSG_THAW;
2858 else if (Ustrcmp(argrest, "vb") == 0)
2859 {
2860 msg_action = MSG_SHOW_BODY;
2861 one_msg_action = TRUE;
2862 }
2863 else if (Ustrcmp(argrest, "vc") == 0)
2864 {
2865 msg_action = MSG_SHOW_COPY;
2866 one_msg_action = TRUE;
2867 }
2868 else if (Ustrcmp(argrest, "vh") == 0)
2869 {
2870 msg_action = MSG_SHOW_HEADER;
2871 one_msg_action = TRUE;
2872 }
2873 else if (Ustrcmp(argrest, "vl") == 0)
2874 {
2875 msg_action = MSG_SHOW_LOG;
2876 one_msg_action = TRUE;
2877 }
2878 else { badarg = TRUE; break; }
2879
2880 /* All the -Mxx options require at least one message id. */
2881
2882 msg_action_arg = i + 1;
2883 if (msg_action_arg >= argc)
2884 {
2885 fprintf(stderr, "exim: no message ids given after %s option\n", arg);
2886 return EXIT_FAILURE;
2887 }
2888
2889 /* Some require only message ids to follow */
2890
2891 if (!one_msg_action)
2892 {
2893 int j;
2894 for (j = msg_action_arg; j < argc; j++) if (!mac_ismsgid(argv[j]))
2895 {
2896 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2897 argv[j], arg);
2898 return EXIT_FAILURE;
2899 }
2900 goto END_ARG; /* Remaining args are ids */
2901 }
2902
2903 /* Others require only one message id, possibly followed by addresses,
2904 which will be handled as normal arguments. */
2905
2906 else
2907 {
2908 if (!mac_ismsgid(argv[msg_action_arg]))
2909 {
2910 fprintf(stderr, "exim: malformed message id %s after %s option\n",
2911 argv[msg_action_arg], arg);
2912 return EXIT_FAILURE;
2913 }
2914 i++;
2915 }
2916 break;
2917
2918
2919 /* Some programs seem to call the -om option without the leading o;
2920 for sendmail it askes for "me too". Exim always does this. */
2921
2922 case 'm':
2923 if (*argrest != 0) badarg = TRUE;
2924 break;
2925
2926
2927 /* -N: don't do delivery - a debugging option that stops transports doing
2928 their thing. It implies debugging at the D_v level. */
2929
2930 case 'N':
2931 if (*argrest == 0)
2932 {
2933 dont_deliver = TRUE;
2934 debug_selector |= D_v;
2935 debug_file = stderr;
2936 }
2937 else badarg = TRUE;
2938 break;
2939
2940
2941 /* -n: This means "don't alias" in sendmail, apparently.
2942 For normal invocations, it has no effect.
2943 It may affect some other options. */
2944
2945 case 'n':
2946 flag_n = TRUE;
2947 break;
2948
2949 /* -O: Just ignore it. In sendmail, apparently -O option=value means set
2950 option to the specified value. This form uses long names. We need to handle
2951 -O option=value and -Ooption=value. */
2952
2953 case 'O':
2954 if (*argrest == 0)
2955 {
2956 if (++i >= argc)
2957 {
2958 fprintf(stderr, "exim: string expected after -O\n");
2959 exit(EXIT_FAILURE);
2960 }
2961 }
2962 break;
2963
2964 case 'o':
2965
2966 /* -oA: Set an argument for the bi command (sendmail's "alternate alias
2967 file" option). */
2968
2969 if (*argrest == 'A')
2970 {
2971 alias_arg = argrest + 1;
2972 if (alias_arg[0] == 0)
2973 {
2974 if (i+1 < argc) alias_arg = argv[++i]; else
2975 {
2976 fprintf(stderr, "exim: string expected after -oA\n");
2977 exit(EXIT_FAILURE);
2978 }
2979 }
2980 }
2981
2982 /* -oB: Set a connection message max value for remote deliveries */
2983
2984 else if (*argrest == 'B')
2985 {
2986 uschar *p = argrest + 1;
2987 if (p[0] == 0)
2988 {
2989 if (i+1 < argc && isdigit((argv[i+1][0]))) p = argv[++i]; else
2990 {
2991 connection_max_messages = 1;
2992 p = NULL;
2993 }
2994 }
2995
2996 if (p != NULL)
2997 {
2998 if (!isdigit(*p))
2999 {
3000 fprintf(stderr, "exim: number expected after -oB\n");
3001 exit(EXIT_FAILURE);
3002 }
3003 connection_max_messages = Uatoi(p);
3004 }
3005 }
3006
3007 /* -odb: background delivery */
3008
3009 else if (Ustrcmp(argrest, "db") == 0)
3010 {
3011 synchronous_delivery = FALSE;
3012 arg_queue_only = FALSE;
3013 queue_only_set = TRUE;
3014 }
3015
3016 /* -odf: foreground delivery (smail-compatible option); same effect as
3017 -odi: interactive (synchronous) delivery (sendmail-compatible option)
3018 */
3019
3020 else if (Ustrcmp(argrest, "df") == 0 || Ustrcmp(argrest, "di") == 0)
3021 {
3022 synchronous_delivery = TRUE;
3023 arg_queue_only = FALSE;
3024 queue_only_set = TRUE;
3025 }
3026
3027 /* -odq: queue only */
3028
3029 else if (Ustrcmp(argrest, "dq") == 0)
3030 {
3031 synchronous_delivery = FALSE;
3032 arg_queue_only = TRUE;
3033 queue_only_set = TRUE;
3034 }
3035
3036 /* -odqs: queue SMTP only - do local deliveries and remote routing,
3037 but no remote delivery */
3038
3039 else if (Ustrcmp(argrest, "dqs") == 0)
3040 {
3041 queue_smtp = TRUE;
3042 arg_queue_only = FALSE;
3043 queue_only_set = TRUE;
3044 }
3045
3046 /* -oex: Sendmail error flags. As these are also accepted without the
3047 leading -o prefix, for compatibility with vacation and other callers,
3048 they are handled with -e above. */
3049
3050 /* -oi: Set flag so dot doesn't end non-SMTP input (same as -i)
3051 -oitrue: Another sendmail syntax for the same */
3052
3053 else if (Ustrcmp(argrest, "i") == 0 ||
3054 Ustrcmp(argrest, "itrue") == 0)
3055 dot_ends = FALSE;
3056
3057 /* -oM*: Set various characteristics for an incoming message; actually
3058 acted on for trusted callers only. */
3059
3060 else if (*argrest == 'M')
3061 {
3062 if (i+1 >= argc)
3063 {
3064 fprintf(stderr, "exim: data expected after -o%s\n", argrest);
3065 exit(EXIT_FAILURE);
3066 }
3067
3068 /* -oMa: Set sender host address */
3069
3070 if (Ustrcmp(argrest, "Ma") == 0) sender_host_address = argv[++i];
3071
3072 /* -oMaa: Set authenticator name */
3073
3074 else if (Ustrcmp(argrest, "Maa") == 0)
3075 sender_host_authenticated = argv[++i];
3076
3077 /* -oMas: setting authenticated sender */
3078
3079 else if (Ustrcmp(argrest, "Mas") == 0) authenticated_sender = argv[++i];
3080
3081 /* -oMai: setting authenticated id */
3082
3083 else if (Ustrcmp(argrest, "Mai") == 0) authenticated_id = argv[++i];
3084
3085 /* -oMi: Set incoming interface address */
3086
3087 else if (Ustrcmp(argrest, "Mi") == 0) interface_address = argv[++i];
3088
3089 /* -oMm: Message reference */
3090
3091 else if (Ustrcmp(argrest, "Mm") == 0)
3092 {
3093 if (!mac_ismsgid(argv[i+1]))
3094 {
3095 fprintf(stderr,"-oMm must be a valid message ID\n");
3096 exit(EXIT_FAILURE);
3097 }
3098 if (!trusted_config)
3099 {
3100 fprintf(stderr,"-oMm must be called by a trusted user/config\n");
3101 exit(EXIT_FAILURE);
3102 }
3103 message_reference = argv[++i];
3104 }
3105
3106 /* -oMr: Received protocol */
3107
3108 else if (Ustrcmp(argrest, "Mr") == 0)
3109
3110 if (received_protocol)
3111 {
3112 fprintf(stderr, "received_protocol is set already\n");
3113 exit(EXIT_FAILURE);
3114 }
3115 else received_protocol = argv[++i];
3116
3117 /* -oMs: Set sender host name */
3118
3119 else if (Ustrcmp(argrest, "Ms") == 0) sender_host_name = argv[++i];
3120
3121 /* -oMt: Set sender ident */
3122
3123 else if (Ustrcmp(argrest, "Mt") == 0)
3124 {
3125 sender_ident_set = TRUE;
3126 sender_ident = argv[++i];
3127 }
3128
3129 /* Else a bad argument */
3130
3131 else
3132 {
3133 badarg = TRUE;
3134 break;
3135 }
3136 }
3137
3138 /* -om: Me-too flag for aliases. Exim always does this. Some programs
3139 seem to call this as -m (undocumented), so that is also accepted (see
3140 above). */
3141
3142 else if (Ustrcmp(argrest, "m") == 0) {}
3143
3144 /* -oo: An ancient flag for old-style addresses which still seems to
3145 crop up in some calls (see in SCO). */
3146
3147 else if (Ustrcmp(argrest, "o") == 0) {}
3148
3149 /* -oP <name>: set pid file path for daemon */
3150
3151 else if (Ustrcmp(argrest, "P") == 0)
3152 override_pid_file_path = argv[++i];
3153
3154 /* -or <n>: set timeout for non-SMTP acceptance
3155 -os <n>: set timeout for SMTP acceptance */
3156
3157 else if (*argrest == 'r' || *argrest == 's')
3158 {
3159 int *tp = (*argrest == 'r')?
3160 &arg_receive_timeout : &arg_smtp_receive_timeout;
3161 if (argrest[1] == 0)
3162 {
3163 if (i+1 < argc) *tp= readconf_readtime(argv[++i], 0, FALSE);
3164 }
3165 else *tp = readconf_readtime(argrest + 1, 0, FALSE);
3166 if (*tp < 0)
3167 {
3168 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3169 exit(EXIT_FAILURE);
3170 }
3171 }
3172
3173 /* -oX <list>: Override local_interfaces and/or default daemon ports */
3174
3175 else if (Ustrcmp(argrest, "X") == 0)
3176 override_local_interfaces = argv[++i];
3177
3178 /* Unknown -o argument */
3179
3180 else badarg = TRUE;
3181 break;
3182
3183
3184 /* -ps: force Perl startup; -pd force delayed Perl startup */
3185
3186 case 'p':
3187 #ifdef EXIM_PERL
3188 if (*argrest == 's' && argrest[1] == 0)
3189 {
3190 perl_start_option = 1;
3191 break;
3192 }
3193 if (*argrest == 'd' && argrest[1] == 0)
3194 {
3195 perl_start_option = -1;
3196 break;
3197 }
3198 #endif
3199
3200 /* -panythingelse is taken as the Sendmail-compatible argument -prval:sval,
3201 which sets the host protocol and host name */
3202
3203 if (*argrest == 0)
3204 {
3205 if (i+1 < argc) argrest = argv[++i]; else
3206 { badarg = TRUE; break; }
3207 }
3208
3209 if (*argrest != 0)
3210 {
3211 uschar *hn;
3212
3213 if (received_protocol)
3214 {
3215 fprintf(stderr, "received_protocol is set already\n");
3216 exit(EXIT_FAILURE);
3217 }
3218
3219 hn = Ustrchr(argrest, ':');
3220 if (hn == NULL)
3221 {
3222 received_protocol = argrest;
3223 }
3224 else
3225 {
3226 int old_pool = store_pool;
3227 store_pool = POOL_PERM;
3228 received_protocol = string_copyn(argrest, hn - argrest);
3229 store_pool = old_pool;
3230 sender_host_name = hn + 1;
3231 }
3232 }
3233 break;
3234
3235
3236 case 'q':
3237 receiving_message = FALSE;
3238 if (queue_interval >= 0)
3239 {
3240 fprintf(stderr, "exim: -q specified more than once\n");
3241 exit(EXIT_FAILURE);
3242 }
3243
3244 /* -qq...: Do queue runs in a 2-stage manner */
3245
3246 if (*argrest == 'q')
3247 {
3248 queue_2stage = TRUE;
3249 argrest++;
3250 }
3251
3252 /* -qi...: Do only first (initial) deliveries */
3253
3254 if (*argrest == 'i')
3255 {
3256 queue_run_first_delivery = TRUE;
3257 argrest++;
3258 }
3259
3260 /* -qf...: Run the queue, forcing deliveries
3261 -qff..: Ditto, forcing thawing as well */
3262
3263 if (*argrest == 'f')
3264 {
3265 queue_run_force = TRUE;
3266 if (*++argrest == 'f')
3267 {
3268 deliver_force_thaw = TRUE;
3269 argrest++;
3270 }
3271 }
3272
3273 /* -q[f][f]l...: Run the queue only on local deliveries */
3274
3275 if (*argrest == 'l')
3276 {
3277 queue_run_local = TRUE;
3278 argrest++;
3279 }
3280
3281 /* -q[f][f][l][G<name>]... Work on the named queue */
3282
3283 if (*argrest == 'G')
3284 {
3285 int i;
3286 for (argrest++, i = 0; argrest[i] && argrest[i] != '/'; ) i++;
3287 queue_name = string_copyn(argrest, i);
3288 argrest += i;
3289 if (*argrest == '/') argrest++;
3290 }
3291
3292 /* -q[f][f][l][G<name>]: Run the queue, optionally forced, optionally local
3293 only, optionally named, optionally starting from a given message id. */
3294
3295 if (*argrest == 0 &&
3296 (i + 1 >= argc || argv[i+1][0] == '-' || mac_ismsgid(argv[i+1])))
3297 {
3298 queue_interval = 0;
3299 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3300 start_queue_run_id = argv[++i];
3301 if (i+1 < argc && mac_ismsgid(argv[i+1]))
3302 stop_queue_run_id = argv[++i];
3303 }
3304
3305 /* -q[f][f][l][G<name>/]<n>: Run the queue at regular intervals, optionally
3306 forced, optionally local only, optionally named. */
3307
3308 else if ((queue_interval = readconf_readtime(*argrest ? argrest : argv[++i],
3309 0, FALSE)) <= 0)
3310 {
3311 fprintf(stderr, "exim: bad time value %s: abandoned\n", argv[i]);
3312 exit(EXIT_FAILURE);
3313 }
3314 break;
3315
3316
3317 case 'R': /* Synonymous with -qR... */
3318 receiving_message = FALSE;
3319
3320 /* -Rf: As -R (below) but force all deliveries,
3321 -Rff: Ditto, but also thaw all frozen messages,
3322 -Rr: String is regex
3323 -Rrf: Regex and force
3324 -Rrff: Regex and force and thaw
3325
3326 in all cases provided there are no further characters in this
3327 argument. */
3328
3329 if (*argrest != 0)
3330 {
3331 int i;
3332 for (i = 0; i < nelem(rsopts); i++)
3333 if (Ustrcmp(argrest, rsopts[i]) == 0)
3334 {
3335 if (i != 2) queue_run_force = TRUE;
3336 if (i >= 2) deliver_selectstring_regex = TRUE;
3337 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3338 argrest += Ustrlen(rsopts[i]);
3339 }
3340 }
3341
3342 /* -R: Set string to match in addresses for forced queue run to
3343 pick out particular messages. */
3344
3345 if (*argrest)
3346 deliver_selectstring = argrest;
3347 else if (i+1 < argc)
3348 deliver_selectstring = argv[++i];
3349 else
3350 {
3351 fprintf(stderr, "exim: string expected after -R\n");
3352 exit(EXIT_FAILURE);
3353 }
3354 break;
3355
3356
3357 /* -r: an obsolete synonym for -f (see above) */
3358
3359
3360 /* -S: Like -R but works on sender. */
3361
3362 case 'S': /* Synonymous with -qS... */
3363 receiving_message = FALSE;
3364
3365 /* -Sf: As -S (below) but force all deliveries,
3366 -Sff: Ditto, but also thaw all frozen messages,
3367 -Sr: String is regex
3368 -Srf: Regex and force
3369 -Srff: Regex and force and thaw
3370
3371 in all cases provided there are no further characters in this
3372 argument. */
3373
3374 if (*argrest)
3375 {
3376 int i;
3377 for (i = 0; i < nelem(rsopts); i++)
3378 if (Ustrcmp(argrest, rsopts[i]) == 0)
3379 {
3380 if (i != 2) queue_run_force = TRUE;
3381 if (i >= 2) deliver_selectstring_sender_regex = TRUE;
3382 if (i == 1 || i == 4) deliver_force_thaw = TRUE;
3383 argrest += Ustrlen(rsopts[i]);
3384 }
3385 }
3386
3387 /* -S: Set string to match in addresses for forced queue run to
3388 pick out particular messages. */
3389
3390 if (*argrest)
3391 deliver_selectstring_sender = argrest;
3392 else if (i+1 < argc)
3393 deliver_selectstring_sender = argv[++i];
3394 else
3395 {
3396 fprintf(stderr, "exim: string expected after -S\n");
3397 exit(EXIT_FAILURE);
3398 }
3399 break;
3400
3401 /* -Tqt is an option that is exclusively for use by the testing suite.
3402 It is not recognized in other circumstances. It allows for the setting up
3403 of explicit "queue times" so that various warning/retry things can be
3404 tested. Otherwise variability of clock ticks etc. cause problems. */
3405
3406 case 'T':
3407 if (running_in_test_harness && Ustrcmp(argrest, "qt") == 0)
3408 fudged_queue_times = argv[++i];
3409 else badarg = TRUE;
3410 break;
3411
3412
3413 /* -t: Set flag to extract recipients from body of message. */
3414
3415 case 't':
3416 if (*argrest == 0) extract_recipients = TRUE;
3417
3418 /* -ti: Set flag to extract recipients from body of message, and also
3419 specify that dot does not end the message. */
3420
3421 else if (Ustrcmp(argrest, "i") == 0)
3422 {
3423 extract_recipients = TRUE;
3424 dot_ends = FALSE;
3425 }
3426
3427 /* -tls-on-connect: don't wait for STARTTLS (for old clients) */
3428
3429 #ifdef SUPPORT_TLS
3430 else if (Ustrcmp(argrest, "ls-on-connect") == 0) tls_in.on_connect = TRUE;
3431 #endif
3432
3433 else badarg = TRUE;
3434 break;
3435
3436
3437 /* -U: This means "initial user submission" in sendmail, apparently. The
3438 doc claims that in future sendmail may refuse syntactically invalid
3439 messages instead of fixing them. For the moment, we just ignore it. */
3440
3441 case 'U':
3442 break;
3443
3444
3445 /* -v: verify things - this is a very low-level debugging */
3446
3447 case 'v':
3448 if (*argrest == 0)
3449 {
3450 debug_selector |= D_v;
3451 debug_file = stderr;
3452 }
3453 else badarg = TRUE;
3454 break;
3455
3456
3457 /* -x: AIX uses this to indicate some fancy 8-bit character stuff:
3458
3459 The -x flag tells the sendmail command that mail from a local
3460 mail program has National Language Support (NLS) extended characters
3461 in the body of the mail item. The sendmail command can send mail with
3462 extended NLS characters across networks that normally corrupts these
3463 8-bit characters.
3464
3465 As Exim is 8-bit clean, it just ignores this flag. */
3466
3467 case 'x':
3468 if (*argrest != 0) badarg = TRUE;
3469 break;
3470
3471 /* -X: in sendmail: takes one parameter, logfile, and sends debugging
3472 logs to that file. We swallow the parameter and otherwise ignore it. */
3473
3474 case 'X':
3475 if (*argrest == '\0')
3476 if (++i >= argc)
3477 {
3478 fprintf(stderr, "exim: string expected after -X\n");
3479 exit(EXIT_FAILURE);
3480 }
3481 break;
3482
3483 case 'z':
3484 if (*argrest == '\0')
3485 if (++i < argc) log_oneline = argv[i]; else
3486 {
3487 fprintf(stderr, "exim: file name expected after %s\n", argv[i-1]);
3488 exit(EXIT_FAILURE);
3489 }
3490 break;
3491
3492 /* All other initial characters are errors */
3493
3494 default:
3495 badarg = TRUE;
3496 break;
3497 } /* End of high-level switch statement */
3498
3499 /* Failed to recognize the option, or syntax error */
3500
3501 if (badarg)
3502 {
3503 fprintf(stderr, "exim abandoned: unknown, malformed, or incomplete "
3504 "option %s\n", arg);
3505 exit(EXIT_FAILURE);
3506 }
3507 }
3508
3509
3510 /* If -R or -S have been specified without -q, assume a single queue run. */
3511
3512 if ( (deliver_selectstring || deliver_selectstring_sender)
3513 && queue_interval < 0)
3514 queue_interval = 0;
3515
3516
3517 END_ARG:
3518 /* If usage_wanted is set we call the usage function - which never returns */
3519 if (usage_wanted) exim_usage(called_as);
3520
3521 /* Arguments have been processed. Check for incompatibilities. */
3522 if ((
3523 (smtp_input || extract_recipients || recipients_arg < argc) &&
3524 (daemon_listen || queue_interval >= 0 || bi_option ||
3525 test_retry_arg >= 0 || test_rewrite_arg >= 0 ||
3526 filter_test != FTEST_NONE || (msg_action_arg > 0 && !one_msg_action))
3527 ) ||
3528 (
3529 msg_action_arg > 0 &&
3530 (daemon_listen || queue_interval > 0 || list_options ||
3531 (checking && msg_action != MSG_LOAD) ||
3532 bi_option || test_retry_arg >= 0 || test_rewrite_arg >= 0)
3533 ) ||
3534 (
3535 (daemon_listen || queue_interval > 0) &&
3536 (sender_address != NULL || list_options || list_queue || checking ||
3537 bi_option)
3538 ) ||
3539 (
3540 daemon_listen && queue_interval == 0
3541 ) ||
3542 (
3543 inetd_wait_mode && queue_interval >= 0
3544 ) ||
3545 (
3546 list_options &&
3547 (checking || smtp_input || extract_recipients ||
3548 filter_test != FTEST_NONE || bi_option)
3549 ) ||
3550 (
3551 verify_address_mode &&
3552 (address_test_mode || smtp_input || extract_recipients ||
3553 filter_test != FTEST_NONE || bi_option)
3554 ) ||
3555 (
3556 address_test_mode && (smtp_input || extract_recipients ||
3557 filter_test != FTEST_NONE || bi_option)
3558 ) ||
3559 (
3560 smtp_input && (sender_address != NULL || filter_test != FTEST_NONE ||
3561 extract_recipients)
3562 ) ||
3563 (
3564 deliver_selectstring != NULL && queue_interval < 0
3565 ) ||
3566 (
3567 msg_action == MSG_LOAD &&
3568 (!expansion_test || expansion_test_message != NULL)
3569 )
3570 )
3571 {
3572 fprintf(stderr, "exim: incompatible command-line options or arguments\n");
3573 exit(EXIT_FAILURE);
3574 }
3575
3576 /* If debugging is set up, set the file and the file descriptor to pass on to
3577 child processes. It should, of course, be 2 for stderr. Also, force the daemon
3578 to run in the foreground. */
3579
3580 if (debug_selector != 0)
3581 {
3582 debug_file = stderr;
3583 debug_fd = fileno(debug_file);
3584 background_daemon = FALSE;
3585 if (running_in_test_harness) millisleep(100); /* lets caller finish */
3586 if (debug_selector != D_v) /* -v only doesn't show this */
3587 {
3588 debug_printf("Exim version %s uid=%ld gid=%ld pid=%d D=%x\n",
3589 version_string, (long int)real_uid, (long int)real_gid, (int)getpid(),
3590 debug_selector);
3591 if (!version_printed)
3592 show_whats_supported(stderr);
3593 }
3594 }
3595
3596 /* When started with root privilege, ensure that the limits on the number of
3597 open files and the number of processes (where that is accessible) are
3598 sufficiently large, or are unset, in case Exim has been called from an
3599 environment where the limits are screwed down. Not all OS have the ability to
3600 change some of these limits. */
3601
3602 if (unprivileged)
3603 {
3604 DEBUG(D_any) debug_print_ids(US"Exim has no root privilege:");
3605 }
3606 else
3607 {
3608 struct rlimit rlp;
3609
3610 #ifdef RLIMIT_NOFILE
3611 if (getrlimit(RLIMIT_NOFILE, &rlp) < 0)
3612 {
3613 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NOFILE) failed: %s",
3614 strerror(errno));
3615 rlp.rlim_cur = rlp.rlim_max = 0;
3616 }
3617
3618 /* I originally chose 1000 as a nice big number that was unlikely to
3619 be exceeded. It turns out that some older OS have a fixed upper limit of
3620 256. */
3621
3622 if (rlp.rlim_cur < 1000)
3623 {
3624 rlp.rlim_cur = rlp.rlim_max = 1000;
3625 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3626 {
3627 rlp.rlim_cur = rlp.rlim_max = 256;
3628 if (setrlimit(RLIMIT_NOFILE, &rlp) < 0)
3629 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NOFILE) failed: %s",
3630 strerror(errno));
3631 }
3632 }
3633 #endif
3634
3635 #ifdef RLIMIT_NPROC
3636 if (getrlimit(RLIMIT_NPROC, &rlp) < 0)
3637 {
3638 log_write(0, LOG_MAIN|LOG_PANIC, "getrlimit(RLIMIT_NPROC) failed: %s",
3639 strerror(errno));
3640 rlp.rlim_cur = rlp.rlim_max = 0;
3641 }
3642
3643 #ifdef RLIM_INFINITY
3644 if (rlp.rlim_cur != RLIM_INFINITY && rlp.rlim_cur < 1000)
3645 {
3646 rlp.rlim_cur = rlp.rlim_max = RLIM_INFINITY;
3647 #else
3648 if (rlp.rlim_cur < 1000)
3649 {
3650 rlp.rlim_cur = rlp.rlim_max = 1000;
3651 #endif
3652 if (setrlimit(RLIMIT_NPROC, &rlp) < 0)
3653 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_NPROC) failed: %s",
3654 strerror(errno));
3655 }
3656 #endif
3657 }
3658
3659 /* Exim is normally entered as root (but some special configurations are
3660 possible that don't do this). However, it always spins off sub-processes that
3661 set their uid and gid as required for local delivery. We don't want to pass on
3662 any extra groups that root may belong to, so we want to get rid of them all at
3663 this point.
3664
3665 We need to obey setgroups() at this stage, before possibly giving up root
3666 privilege for a changed configuration file, but later on we might need to
3667 check on the additional groups for the admin user privilege - can't do that
3668 till after reading the config, which might specify the exim gid. Therefore,
3669 save the group list here first. */
3670
3671 group_count = getgroups(NGROUPS_MAX, group_list);
3672 if (group_count < 0)
3673 {
3674 fprintf(stderr, "exim: getgroups() failed: %s\n", strerror(errno));
3675 exit(EXIT_FAILURE);
3676 }
3677
3678 /* There is a fundamental difference in some BSD systems in the matter of
3679 groups. FreeBSD and BSDI are known to be different; NetBSD and OpenBSD are
3680 known not to be different. On the "different" systems there is a single group
3681 list, and the first entry in it is the current group. On all other versions of
3682 Unix there is a supplementary group list, which is in *addition* to the current
3683 group. Consequently, to get rid of all extraneous groups on a "standard" system
3684 you pass over 0 groups to setgroups(), while on a "different" system you pass
3685 over a single group - the current group, which is always the first group in the
3686 list. Calling setgroups() with zero groups on a "different" system results in
3687 an error return. The following code should cope with both types of system.
3688
3689 However, if this process isn't running as root, setgroups() can't be used
3690 since you have to be root to run it, even if throwing away groups. Not being
3691 root here happens only in some unusual configurations. We just ignore the
3692 error. */
3693
3694 if (setgroups(0, NULL) != 0)
3695 {
3696 if (setgroups(1, group_list) != 0 && !unprivileged)
3697 {
3698 fprintf(stderr, "exim: setgroups() failed: %s\n", strerror(errno));
3699 exit(EXIT_FAILURE);
3700 }
3701 }
3702
3703 /* If the configuration file name has been altered by an argument on the
3704 command line (either a new file name or a macro definition) and the caller is
3705 not root, or if this is a filter testing run, remove any setuid privilege the
3706 program has and run as the underlying user.
3707
3708 The exim user is locked out of this, which severely restricts the use of -C
3709 for some purposes.
3710
3711 Otherwise, set the real ids to the effective values (should be root unless run
3712 from inetd, which it can either be root or the exim uid, if one is configured).
3713
3714 There is a private mechanism for bypassing some of this, in order to make it
3715 possible to test lots of configurations automatically, without having either to
3716 recompile each time, or to patch in an actual configuration file name and other
3717 values (such as the path name). If running in the test harness, pretend that
3718 configuration file changes and macro definitions haven't happened. */
3719
3720 if (( /* EITHER */
3721 (!trusted_config || /* Config changed, or */
3722 !macros_trusted(opt_D_used)) && /* impermissible macros and */
3723 real_uid != root_uid && /* Not root, and */
3724 !running_in_test_harness /* Not fudged */
3725 ) || /* OR */
3726 expansion_test /* expansion testing */
3727 || /* OR */
3728 filter_test != FTEST_NONE) /* Filter testing */
3729 {
3730 setgroups(group_count, group_list);
3731 exim_setugid(real_uid, real_gid, FALSE,
3732 US"-C, -D, -be or -bf forces real uid");
3733 removed_privilege = TRUE;
3734
3735 /* In the normal case when Exim is called like this, stderr is available
3736 and should be used for any logging information because attempts to write
3737 to the log will usually fail. To arrange this, we unset really_exim. However,
3738 if no stderr is available there is no point - we might as well have a go
3739 at the log (if it fails, syslog will be written).
3740
3741 Note that if the invoker is Exim, the logs remain available. Messing with
3742 this causes unlogged successful deliveries. */
3743
3744 if ((log_stderr != NULL) && (real_uid != exim_uid))
3745 really_exim = FALSE;
3746 }
3747
3748 /* Privilege is to be retained for the moment. It may be dropped later,
3749 depending on the job that this Exim process has been asked to do. For now, set
3750 the real uid to the effective so that subsequent re-execs of Exim are done by a
3751 privileged user. */
3752
3753 else exim_setugid(geteuid(), getegid(), FALSE, US"forcing real = effective");
3754
3755 /* If testing a filter, open the file(s) now, before wasting time doing other
3756 setups and reading the message. */
3757
3758 if ((filter_test & FTEST_SYSTEM) != 0)
3759 {
3760 filter_sfd = Uopen(filter_test_sfile, O_RDONLY, 0);
3761 if (filter_sfd < 0)
3762 {
3763 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_sfile,
3764 strerror(errno));
3765 return EXIT_FAILURE;
3766 }
3767 }
3768
3769 if ((filter_test & FTEST_USER) != 0)
3770 {
3771 filter_ufd = Uopen(filter_test_ufile, O_RDONLY, 0);
3772 if (filter_ufd < 0)
3773 {
3774 fprintf(stderr, "exim: failed to open %s: %s\n", filter_test_ufile,
3775 strerror(errno));
3776 return EXIT_FAILURE;
3777 }
3778 }
3779
3780 /* Initialise lookup_list
3781 If debugging, already called above via version reporting.
3782 In either case, we initialise the list of available lookups while running
3783 as root. All dynamically modules are loaded from a directory which is
3784 hard-coded into the binary and is code which, if not a module, would be
3785 part of Exim already. Ability to modify the content of the directory
3786 is equivalent to the ability to modify a setuid binary!
3787
3788 This needs to happen before we read the main configuration. */
3789 init_lookup_list();
3790
3791 #ifdef SUPPORT_I18N
3792 if (running_in_test_harness) smtputf8_advertise_hosts = NULL;
3793 #endif
3794
3795 /* Read the main runtime configuration data; this gives up if there
3796 is a failure. It leaves the configuration file open so that the subsequent
3797 configuration data for delivery can be read if needed.
3798
3799 NOTE: immediatly after opening the configuration file we change the working
3800 directory to "/"! Later we change to $spool_directory. We do it there, because
3801 during readconf_main() some expansion takes place already. */
3802
3803 /* Store the initial cwd before we change directories */
3804 if ((initial_cwd = os_getcwd(NULL, 0)) == NULL)
3805 {
3806 perror("exim: can't get the current working directory");
3807 exit(EXIT_FAILURE);
3808 }
3809
3810 /* checking:
3811 -be[m] expansion test -
3812 -b[fF] filter test new
3813 -bh[c] host test -
3814 -bmalware malware_test_file new
3815 -brt retry test new
3816 -brw rewrite test new
3817 -bt address test -
3818 -bv[s] address verify -
3819 list_options:
3820 -bP <option> (except -bP config, which sets list_config)
3821
3822 If any of these options is set, we suppress warnings about configuration
3823 issues (currently about tls_advertise_hosts and keep_environment not being
3824 defined) */
3825
3826 readconf_main(checking || list_options);
3827
3828 if (builtin_macros_create_trigger) DEBUG(D_any)
3829 debug_printf("Builtin macros created (expensive) due to config line '%.*s'\n",
3830 Ustrlen(builtin_macros_create_trigger)-1, builtin_macros_create_trigger);
3831
3832 /* Now in directory "/" */
3833
3834 if (cleanup_environment() == FALSE)
3835 log_write(0, LOG_PANIC_DIE, "Can't cleanup environment");
3836
3837
3838 /* If an action on specific messages is requested, or if a daemon or queue
3839 runner is being started, we need to know if Exim was called by an admin user.
3840 This is the case if the real user is root or exim, or if the real group is
3841 exim, or if one of the supplementary groups is exim or a group listed in
3842 admin_groups. We don't fail all message actions immediately if not admin_user,
3843 since some actions can be performed by non-admin users. Instead, set admin_user
3844 for later interrogation. */
3845
3846 if (real_uid == root_uid || real_uid == exim_uid || real_gid == exim_gid)
3847 admin_user = TRUE;
3848 else
3849 {
3850 int i, j;
3851 for (i = 0; i < group_count && !admin_user; i++)
3852 if (group_list[i] == exim_gid)
3853 admin_user = TRUE;
3854 else if (admin_groups)
3855 for (j = 1; j <= (int)admin_groups[0] && !admin_user; j++)
3856 if (admin_groups[j] == group_list[i])
3857 admin_user = TRUE;
3858 }
3859
3860 /* Another group of privileged users are the trusted users. These are root,
3861 exim, and any caller matching trusted_users or trusted_groups. Trusted callers
3862 are permitted to specify sender_addresses with -f on the command line, and
3863 other message parameters as well. */
3864
3865 if (real_uid == root_uid || real_uid == exim_uid)
3866 trusted_caller = TRUE;
3867 else
3868 {
3869 int i, j;
3870
3871 if (trusted_users)
3872 for (i = 1; i <= (int)trusted_users[0] && !trusted_caller; i++)
3873 if (trusted_users[i] == real_uid)
3874 trusted_caller = TRUE;
3875
3876 if (trusted_groups)
3877 for (i = 1; i <= (int)trusted_groups[0] && !trusted_caller; i++)
3878 if (trusted_groups[i] == real_gid)
3879 trusted_caller = TRUE;
3880 else for (j = 0; j < group_count && !trusted_caller; j++)
3881 if (trusted_groups[i] == group_list[j])
3882 trusted_caller = TRUE;
3883 }
3884
3885 /* At this point, we know if the user is privileged and some command-line
3886 options become possibly imperssible, depending upon the configuration file. */
3887
3888 if (checking && commandline_checks_require_admin && !admin_user) {
3889 fprintf(stderr, "exim: those command-line flags are set to require admin\n");
3890 exit(EXIT_FAILURE);
3891 }
3892
3893 /* Handle the decoding of logging options. */
3894
3895 decode_bits(log_selector, log_selector_size, log_notall,
3896 log_selector_string, log_options, log_options_count, US"log", 0);
3897
3898 DEBUG(D_any)
3899 {
3900 int i;
3901 debug_printf("configuration file is %s\n", config_main_filename);
3902 debug_printf("log selectors =");
3903 for (i = 0; i < log_selector_size; i++)
3904 debug_printf(" %08x", log_selector[i]);
3905 debug_printf("\n");
3906 }
3907
3908 /* If domain literals are not allowed, check the sender address that was
3909 supplied with -f. Ditto for a stripped trailing dot. */
3910
3911 if (sender_address != NULL)
3912 {
3913 if (sender_address[sender_address_domain] == '[' && !allow_domain_literals)
3914 {
3915 fprintf(stderr, "exim: bad -f address \"%s\": domain literals not "
3916 "allowed\n", sender_address);
3917 return EXIT_FAILURE;
3918 }
3919 if (f_end_dot && !strip_trailing_dot)
3920 {
3921 fprintf(stderr, "exim: bad -f address \"%s.\": domain is malformed "
3922 "(trailing dot not allowed)\n", sender_address);
3923 return EXIT_FAILURE;
3924 }
3925 }
3926
3927 /* See if an admin user overrode our logging. */
3928
3929 if (cmdline_syslog_name != NULL)
3930 {
3931 if (admin_user)
3932 {
3933 syslog_processname = cmdline_syslog_name;
3934 log_file_path = string_copy(CUS"syslog");
3935 }
3936 else
3937 {
3938 /* not a panic, non-privileged users should not be able to spam paniclog */
3939 fprintf(stderr,
3940 "exim: you lack sufficient privilege to specify syslog process name\n");
3941 return EXIT_FAILURE;
3942 }
3943 }
3944
3945 /* Paranoia check of maximum lengths of certain strings. There is a check
3946 on the length of the log file path in log.c, which will come into effect
3947 if there are any calls to write the log earlier than this. However, if we
3948 get this far but the string is very long, it is better to stop now than to
3949 carry on and (e.g.) receive a message and then have to collapse. The call to
3950 log_write() from here will cause the ultimate panic collapse if the complete
3951 file name exceeds the buffer length. */
3952
3953 if (Ustrlen(log_file_path) > 200)
3954 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3955 "log_file_path is longer than 200 chars: aborting");
3956
3957 if (Ustrlen(pid_file_path) > 200)
3958 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3959 "pid_file_path is longer than 200 chars: aborting");
3960
3961 if (Ustrlen(spool_directory) > 200)
3962 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3963 "spool_directory is longer than 200 chars: aborting");
3964
3965 /* Length check on the process name given to syslog for its TAG field,
3966 which is only permitted to be 32 characters or less. See RFC 3164. */
3967
3968 if (Ustrlen(syslog_processname) > 32)
3969 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3970 "syslog_processname is longer than 32 chars: aborting");
3971
3972 if (log_oneline)
3973 if (admin_user)
3974 {
3975 log_write(0, LOG_MAIN, "%s", log_oneline);
3976 return EXIT_SUCCESS;
3977 }
3978 else
3979 return EXIT_FAILURE;
3980
3981 /* In some operating systems, the environment variable TMPDIR controls where
3982 temporary files are created; Exim doesn't use these (apart from when delivering
3983 to MBX mailboxes), but called libraries such as DBM libraries may require them.
3984 If TMPDIR is found in the environment, reset it to the value defined in the
3985 EXIM_TMPDIR macro, if this macro is defined. For backward compatibility this
3986 macro may be called TMPDIR in old "Local/Makefile"s. It's converted to
3987 EXIM_TMPDIR by the build scripts.
3988 */
3989
3990 #ifdef EXIM_TMPDIR
3991 {
3992 uschar **p;
3993 if (environ) for (p = USS environ; *p; p++)
3994 if (Ustrncmp(*p, "TMPDIR=", 7) == 0 && Ustrcmp(*p+7, EXIM_TMPDIR) != 0)
3995 {
3996 uschar * newp = store_malloc(Ustrlen(EXIM_TMPDIR) + 8);
3997 sprintf(CS newp, "TMPDIR=%s", EXIM_TMPDIR);
3998 *p = newp;
3999 DEBUG(D_any) debug_printf("reset TMPDIR=%s in environment\n", EXIM_TMPDIR);
4000 }
4001 }
4002 #endif
4003
4004 /* Timezone handling. If timezone_string is "utc", set a flag to cause all
4005 timestamps to be in UTC (gmtime() is used instead of localtime()). Otherwise,
4006 we may need to get rid of a bogus timezone setting. This can arise when Exim is
4007 called by a user who has set the TZ variable. This then affects the timestamps
4008 in log files and in Received: headers, and any created Date: header lines. The
4009 required timezone is settable in the configuration file, so nothing can be done
4010 about this earlier - but hopefully nothing will normally be logged earlier than
4011 this. We have to make a new environment if TZ is wrong, but don't bother if
4012 timestamps_utc is set, because then all times are in UTC anyway. */
4013
4014 if (timezone_string && strcmpic(timezone_string, US"UTC") == 0)
4015 timestamps_utc = TRUE;
4016 else
4017 {
4018 uschar *envtz = US getenv("TZ");
4019 if (envtz
4020 ? !timezone_string || Ustrcmp(timezone_string, envtz) != 0
4021 : timezone_string != NULL
4022 )
4023 {
4024 uschar **p = USS environ;
4025 uschar **new;
4026 uschar **newp;
4027 int count = 0;
4028 if (environ) while (*p++) count++;
4029 if (!envtz) count++;
4030 newp = new = store_malloc(sizeof(uschar *) * (count + 1));
4031 if (environ) for (p = USS environ; *p; p++)
4032 if (Ustrncmp(*p, "TZ=", 3) != 0) *newp++ = *p;
4033 if (timezone_string)
4034 {
4035 *newp = store_malloc(Ustrlen(timezone_string) + 4);
4036 sprintf(CS *newp++, "TZ=%s", timezone_string);
4037 }
4038 *newp = NULL;
4039 environ = CSS new;
4040 tzset();
4041 DEBUG(D_any) debug_printf("Reset TZ to %s: time is %s\n", timezone_string,
4042 tod_stamp(tod_log));
4043 }
4044 }
4045
4046 /* Handle the case when we have removed the setuid privilege because of -C or
4047 -D. This means that the caller of Exim was not root.
4048
4049 There is a problem if we were running as the Exim user. The sysadmin may
4050 expect this case to retain privilege because "the binary was called by the
4051 Exim user", but it hasn't, because either the -D option set macros, or the
4052 -C option set a non-trusted configuration file. There are two possibilities:
4053
4054 (1) If deliver_drop_privilege is set, Exim is not going to re-exec in order
4055 to do message deliveries. Thus, the fact that it is running as a
4056 non-privileged user is plausible, and might be wanted in some special
4057 configurations. However, really_exim will have been set false when
4058 privilege was dropped, to stop Exim trying to write to its normal log
4059 files. Therefore, re-enable normal log processing, assuming the sysadmin
4060 has set up the log directory correctly.
4061
4062 (2) If deliver_drop_privilege is not set, the configuration won't work as
4063 apparently intended, and so we log a panic message. In order to retain
4064 root for -C or -D, the caller must either be root or be invoking a
4065 trusted configuration file (when deliver_drop_privilege is false). */
4066
4067 if ( removed_privilege
4068 && (!trusted_config || opt_D_used)
4069 && real_uid == exim_uid)
4070 if (deliver_drop_privilege)
4071 really_exim = TRUE; /* let logging work normally */
4072 else
4073 log_write(0, LOG_MAIN|LOG_PANIC,
4074 "exim user lost privilege for using %s option",
4075 trusted_config? "-D" : "-C");
4076
4077 /* Start up Perl interpreter if Perl support is configured and there is a
4078 perl_startup option, and the configuration or the command line specifies
4079 initializing starting. Note that the global variables are actually called
4080 opt_perl_xxx to avoid clashing with perl's namespace (perl_*). */
4081
4082 #ifdef EXIM_PERL
4083 if (perl_start_option != 0)
4084 opt_perl_at_start = (perl_start_option > 0);
4085 if (opt_perl_at_start && opt_perl_startup != NULL)
4086 {
4087 uschar *errstr;
4088 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
4089 errstr = init_perl(opt_perl_startup);
4090 if (errstr != NULL)
4091 {
4092 fprintf(stderr, "exim: error in perl_startup code: %s\n", errstr);
4093 return EXIT_FAILURE;
4094 }
4095 opt_perl_started = TRUE;
4096 }
4097 #endif /* EXIM_PERL */
4098
4099 /* Log the arguments of the call if the configuration file said so. This is
4100 a debugging feature for finding out what arguments certain MUAs actually use.
4101 Don't attempt it if logging is disabled, or if listing variables or if
4102 verifying/testing addresses or expansions. */
4103
4104 if (((debug_selector & D_any) != 0 || LOGGING(arguments))
4105 && really_exim && !list_options && !checking)
4106 {
4107 int i;
4108 uschar *p = big_buffer;
4109 Ustrcpy(p, "cwd= (failed)");
4110
4111 Ustrncpy(p + 4, initial_cwd, big_buffer_size-5);
4112
4113 while (*p) p++;
4114 (void)string_format(p, big_buffer_size - (p - big_buffer), " %d args:", argc);
4115 while (*p) p++;
4116 for (i = 0; i < argc; i++)
4117 {
4118 int len = Ustrlen(argv[i]);
4119 const uschar *printing;
4120 uschar *quote;
4121 if (p + len + 8 >= big_buffer + big_buffer_size)
4122 {
4123 Ustrcpy(p, " ...");
4124 log_write(0, LOG_MAIN, "%s", big_buffer);
4125 Ustrcpy(big_buffer, "...");
4126 p = big_buffer + 3;
4127 }
4128 printing = string_printing(argv[i]);
4129 if (printing[0] == 0) quote = US"\""; else
4130 {
4131 const uschar *pp = printing;
4132 quote = US"";
4133 while (*pp != 0) if (isspace(*pp++)) { quote = US"\""; break; }
4134 }
4135 p += sprintf(CS p, " %s%.*s%s"