contrib/sendmail/src/queue.c

   1 /*
   2  * Copyright (c) 1998-2007 Sendmail, Inc. and its suppliers.
   3  *      All rights reserved.
   4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
   5  * Copyright (c) 1988, 1993
   6  *      The Regents of the University of California.  All rights reserved.
   7  *
   8  * By using this file, you agree to the terms and conditions set
   9  * forth in the LICENSE file which can be found at the top level of
  10  * the sendmail distribution.
  11  *
  12  */
  13
  14 #include <sendmail.h>
  15 #include <sm/sem.h>
  16
  17 SM_RCSID("@(#)$Id: queue.c,v 8.972 2007/03/29 22:55:17 ca Exp $")
  18
  19 #include <dirent.h>
  20
  21 # define RELEASE_QUEUE  (void) 0
  22 # define ST_INODE(st)   (st).st_ino
  23
  24 #  define sm_file_exists(errno) ((errno) == EEXIST)
  25
  26 # if HASFLOCK && defined(O_EXLOCK)
  27 #   define SM_OPEN_EXLOCK 1
  28 #   define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL|O_EXLOCK)
  29 # else /* HASFLOCK && defined(O_EXLOCK) */
  30 #  define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL)
  31 # endif /* HASFLOCK && defined(O_EXLOCK) */
  32
  33 #ifndef SM_OPEN_EXLOCK
  34 # define SM_OPEN_EXLOCK 0
  35 #endif /* ! SM_OPEN_EXLOCK */
  36
  37 /*
  38 **  Historical notes:
  39 **      QF_VERSION == 4 was sendmail 8.10/8.11 without _FFR_QUEUEDELAY
  40 **      QF_VERSION == 5 was sendmail 8.10/8.11 with    _FFR_QUEUEDELAY
  41 **      QF_VERSION == 6 was sendmail 8.12      without _FFR_QUEUEDELAY
  42 **      QF_VERSION == 7 was sendmail 8.12      with    _FFR_QUEUEDELAY
  43 **      QF_VERSION == 8 is  sendmail 8.13
  44 */
  45
  46 #define QF_VERSION      8       /* version number of this queue format */
  47
  48 static char     queue_letter __P((ENVELOPE *, int));
  49 static bool     quarantine_queue_item __P((int, int, ENVELOPE *, char *));
  50
  51 /* Naming convention: qgrp: index of queue group, qg: QUEUEGROUP */
  52
  53 /*
  54 **  Work queue.
  55 */
  56
  57 struct work
  58 {
  59         char            *w_name;        /* name of control file */
  60         char            *w_host;        /* name of recipient host */
  61         bool            w_lock;         /* is message locked? */
  62         bool            w_tooyoung;     /* is it too young to run? */
  63         long            w_pri;          /* priority of message, see below */
  64         time_t          w_ctime;        /* creation time */
  65         time_t          w_mtime;        /* modification time */
  66         int             w_qgrp;         /* queue group located in */
  67         int             w_qdir;         /* queue directory located in */
  68         struct work     *w_next;        /* next in queue */
  69 };
  70
  71 typedef struct work     WORK;
  72
  73 static WORK     *WorkQ;         /* queue of things to be done */
  74 static int      NumWorkGroups;  /* number of work groups */
  75 static time_t   Current_LA_time = 0;
  76
  77 /* Get new load average every 30 seconds. */
  78 #define GET_NEW_LA_TIME 30
  79
  80 #define SM_GET_LA(now)  \
  81         do                                                      \
  82         {                                                       \
  83                 now = curtime();                                \
  84                 if (Current_LA_time < now - GET_NEW_LA_TIME)    \
  85                 {                                               \
  86                         sm_getla();                             \
  87                         Current_LA_time = now;                  \
  88                 }                                               \
  89         } while (0)
  90
  91 /*
  92 **  DoQueueRun indicates that a queue run is needed.
  93 **      Notice: DoQueueRun is modified in a signal handler!
  94 */
  95
  96 static bool     volatile DoQueueRun; /* non-interrupt time queue run needed */
  97
  98 /*
  99 **  Work group definition structure.
 100 **      Each work group contains one or more queue groups. This is done
 101 **      to manage the number of queue group runners active at the same time
 102 **      to be within the constraints of MaxQueueChildren (if it is set).
 103 **      The number of queue groups that can be run on the next work run
 104 **      is kept track of. The queue groups are run in a round robin.
 105 */
 106
 107 struct workgrp
 108 {
 109         int             wg_numqgrp;     /* number of queue groups in work grp */
 110         int             wg_runners;     /* total runners */
 111         int             wg_curqgrp;     /* current queue group */
 112         QUEUEGRP        **wg_qgs;       /* array of queue groups */
 113         int             wg_maxact;      /* max # of active runners */
 114         time_t          wg_lowqintvl;   /* lowest queue interval */
 115         int             wg_restart;     /* needs restarting? */
 116         int             wg_restartcnt;  /* count of times restarted */
 117 };
 118
 119 typedef struct workgrp WORKGRP;
 120
 121 static WORKGRP  volatile WorkGrp[MAXWORKGROUPS + 1];    /* work groups */
 122
 123 #if SM_HEAP_CHECK
 124 static SM_DEBUG_T DebugLeakQ = SM_DEBUG_INITIALIZER("leak_q",
 125         "@(#)$Debug: leak_q - trace memory leaks during queue processing $");
 126 #endif /* SM_HEAP_CHECK */
 127
 128 /*
 129 **  We use EmptyString instead of "" to avoid
 130 **  'zero-length format string' warnings from gcc
 131 */
 132
 133 static const char EmptyString[] = "";
 134
 135 static void     grow_wlist __P((int, int));
 136 static int      multiqueue_cache __P((char *, int, QUEUEGRP *, int, unsigned int *));
 137 static int      gatherq __P((int, int, bool, bool *, bool *));
 138 static int      sortq __P((int));
 139 static void     printctladdr __P((ADDRESS *, SM_FILE_T *));
 140 static bool     readqf __P((ENVELOPE *, bool));
 141 static void     restart_work_group __P((int));
 142 static void     runner_work __P((ENVELOPE *, int, bool, int, int));
 143 static void     schedule_queue_runs __P((bool, int, bool));
 144 static char     *strrev __P((char *));
 145 static ADDRESS  *setctluser __P((char *, int, ENVELOPE *));
 146 #if _FFR_RHS
 147 static int      sm_strshufflecmp __P((char *, char *));
 148 static void     init_shuffle_alphabet __P(());
 149 #endif /* _FFR_RHS */
 150
 151 /*
 152 **  Note: workcmpf?() don't use a prototype because it will cause a conflict
 153 **  with the qsort() call (which expects something like
 154 **  int (*compar)(const void *, const void *), not (WORK *, WORK *))
 155 */
 156
 157 static int      workcmpf0();
 158 static int      workcmpf1();
 159 static int      workcmpf2();
 160 static int      workcmpf3();
 161 static int      workcmpf4();
 162 static int      randi = 3;      /* index for workcmpf5() */
 163 static int      workcmpf5();
 164 static int      workcmpf6();
 165 #if _FFR_RHS
 166 static int      workcmpf7();
 167 #endif /* _FFR_RHS */
 168
 169 #if RANDOMSHIFT
 170 # define get_rand_mod(m)        ((get_random() >> RANDOMSHIFT) % (m))
 171 #else /* RANDOMSHIFT */
 172 # define get_rand_mod(m)        (get_random() % (m))
 173 #endif /* RANDOMSHIFT */
 174
 175 /*
 176 **  File system definition.
 177 **      Used to keep track of how much free space is available
 178 **      on a file system in which one or more queue directories reside.
 179 */
 180
 181 typedef struct filesys_shared   FILESYS;
 182
 183 struct filesys_shared
 184 {
 185         dev_t   fs_dev;         /* unique device id */
 186         long    fs_avail;       /* number of free blocks available */
 187         long    fs_blksize;     /* block size, in bytes */
 188 };
 189
 190 /* probably kept in shared memory */
 191 static FILESYS  FileSys[MAXFILESYS];    /* queue file systems */
 192 static const char *FSPath[MAXFILESYS];  /* pathnames for file systems */
 193
 194 #if SM_CONF_SHM
 195
 196 /*
 197 **  Shared memory data
 198 **
 199 **  Current layout:
 200 **      size -- size of shared memory segment
 201 **      pid -- pid of owner, should be a unique id to avoid misinterpretations
 202 **              by other processes.
 203 **      tag -- should be a unique id to avoid misinterpretations by others.
 204 **              idea: hash over configuration data that will be stored here.
 205 **      NumFileSys -- number of file systems.
 206 **      FileSys -- (arrary of) structure for used file systems.
 207 **      RSATmpCnt -- counter for number of uses of ephemeral RSA key.
 208 **      QShm -- (array of) structure for information about queue directories.
 209 */
 210
 211 /*
 212 **  Queue data in shared memory
 213 */
 214
 215 typedef struct queue_shared     QUEUE_SHM_T;
 216
 217 struct queue_shared
 218 {
 219         int     qs_entries;     /* number of entries */
 220         /* XXX more to follow? */
 221 };
 222
 223 static void     *Pshm;          /* pointer to shared memory */
 224 static FILESYS  *PtrFileSys;    /* pointer to queue file system array */
 225 int             ShmId = SM_SHM_NO_ID;   /* shared memory id */
 226 static QUEUE_SHM_T      *QShm;          /* pointer to shared queue data */
 227 static size_t shms;
 228
 229 # define SHM_OFF_PID(p) (((char *) (p)) + sizeof(int))
 230 # define SHM_OFF_TAG(p) (((char *) (p)) + sizeof(pid_t) + sizeof(int))
 231 # define SHM_OFF_HEAD   (sizeof(pid_t) + sizeof(int) * 2)
 232
 233 /* how to access FileSys */
 234 # define FILE_SYS(i)    (PtrFileSys[i])
 235
 236 /* first entry is a tag, for now just the size */
 237 # define OFF_FILE_SYS(p)        (((char *) (p)) + SHM_OFF_HEAD)
 238
 239 /* offset for PNumFileSys */
 240 # define OFF_NUM_FILE_SYS(p)    (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys))
 241
 242 /* offset for PRSATmpCnt */
 243 # define OFF_RSA_TMP_CNT(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int))
 244 int     *PRSATmpCnt;
 245
 246 /* offset for queue_shm */
 247 # define OFF_QUEUE_SHM(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
 248
 249 # define QSHM_ENTRIES(i)        QShm[i].qs_entries
 250
 251 /* basic size of shared memory segment */
 252 # define SM_T_SIZE      (SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
 253
 254 static unsigned int     hash_q __P((char *, unsigned int));
 255
 256 /*
 257 **  HASH_Q -- simple hash function
 258 **
 259 **      Parameters:
 260 **              p -- string to hash.
 261 **              h -- hash start value (from previous run).
 262 **
 263 **      Returns:
 264 **              hash value.
 265 */
 266
 267 static unsigned int
 268 hash_q(p, h)
 269         char *p;
 270         unsigned int h;
 271 {
 272         int c, d;
 273
 274         while (*p != '\0')
 275         {
 276                 d = *p++;
 277                 c = d;
 278                 c ^= c<<6;
 279                 h += (c<<11) ^ (c>>1);
 280                 h ^= (d<<14) + (d<<7) + (d<<4) + d;
 281         }
 282         return h;
 283 }
 284
 285
 286 #else /* SM_CONF_SHM */
 287 # define FILE_SYS(i)    FileSys[i]
 288 #endif /* SM_CONF_SHM */
 289
 290 /* access to the various components of file system data */
 291 #define FILE_SYS_NAME(i)        FSPath[i]
 292 #define FILE_SYS_AVAIL(i)       FILE_SYS(i).fs_avail
 293 #define FILE_SYS_BLKSIZE(i)     FILE_SYS(i).fs_blksize
 294 #define FILE_SYS_DEV(i) FILE_SYS(i).fs_dev
 295
 296
 297 /*
 298 **  Current qf file field assignments:
 299 **
 300 **      A       AUTH= parameter
 301 **      B       body type
 302 **      C       controlling user
 303 **      D       data file name
 304 **      d       data file directory name (added in 8.12)
 305 **      E       error recipient
 306 **      F       flag bits
 307 **      G       free (was: queue delay algorithm if _FFR_QUEUEDELAY)
 308 **      H       header
 309 **      I       data file's inode number
 310 **      K       time of last delivery attempt
 311 **      L       Solaris Content-Length: header (obsolete)
 312 **      M       message
 313 **      N       number of delivery attempts
 314 **      P       message priority
 315 **      q       quarantine reason
 316 **      Q       original recipient (ORCPT=)
 317 **      r       final recipient (Final-Recipient: DSN field)
 318 **      R       recipient
 319 **      S       sender
 320 **      T       init time
 321 **      V       queue file version
 322 **      X       free (was: character set if _FFR_SAVE_CHARSET)
 323 **      Y       free (was: current delay if _FFR_QUEUEDELAY)
 324 **      Z       original envelope id from ESMTP
 325 **      !       deliver by (added in 8.12)
 326 **      $       define macro
 327 **      .       terminate file
 328 */
 329
 330 /*
 331 **  QUEUEUP -- queue a message up for future transmission.
 332 **
 333 **      Parameters:
 334 **              e -- the envelope to queue up.
 335 **              announce -- if true, tell when you are queueing up.
 336 **              msync -- if true, then fsync() if SuperSafe interactive mode.
 337 **
 338 **      Returns:
 339 **              none.
 340 **
 341 **      Side Effects:
 342 **              The current request is saved in a control file.
 343 **              The queue file is left locked.
 344 */
 345
 346 void
 347 queueup(e, announce, msync)
 348         register ENVELOPE *e;
 349         bool announce;
 350         bool msync;
 351 {
 352         register SM_FILE_T *tfp;
 353         register HDR *h;
 354         register ADDRESS *q;
 355         int tfd = -1;
 356         int i;
 357         bool newid;
 358         register char *p;
 359         MAILER nullmailer;
 360         MCI mcibuf;
 361         char qf[MAXPATHLEN];
 362         char tf[MAXPATHLEN];
 363         char df[MAXPATHLEN];
 364         char buf[MAXLINE];
 365
 366         /*
 367         **  Create control file.
 368         */
 369
 370 #define OPEN_TF do                                                      \
 371                 {                                                       \
 372                         MODE_T oldumask = 0;                            \
 373                                                                         \
 374                         if (bitset(S_IWGRP, QueueFileMode))             \
 375                                 oldumask = umask(002);                  \
 376                         tfd = open(tf, TF_OPEN_FLAGS, QueueFileMode);   \
 377                         if (bitset(S_IWGRP, QueueFileMode))             \
 378                                 (void) umask(oldumask);                 \
 379                 } while (0)
 380
 381
 382         newid = (e->e_id == NULL) || !bitset(EF_INQUEUE, e->e_flags);
 383         (void) sm_strlcpy(tf, queuename(e, NEWQFL_LETTER), sizeof(tf));
 384         tfp = e->e_lockfp;
 385         if (tfp == NULL && newid)
 386         {
 387                 /*
 388                 **  open qf file directly: this will give an error if the file
 389                 **  already exists and hence prevent problems if a queue-id
 390                 **  is reused (e.g., because the clock is set back).
 391                 */
 392
 393                 (void) sm_strlcpy(tf, queuename(e, ANYQFL_LETTER), sizeof(tf));
 394                 OPEN_TF;
 395                 if (tfd < 0 ||
 396 #if !SM_OPEN_EXLOCK
 397                     !lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB) ||
 398 #endif /* !SM_OPEN_EXLOCK */
 399                     (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
 400                                          (void *) &tfd, SM_IO_WRONLY,
 401                                          NULL)) == NULL)
 402                 {
 403                         int save_errno = errno;
 404
 405                         printopenfds(true);
 406                         errno = save_errno;
 407                         syserr("!queueup: cannot create queue file %s, euid=%d, fd=%d, fp=%p",
 408                                 tf, (int) geteuid(), tfd, tfp);
 409                         /* NOTREACHED */
 410                 }
 411                 e->e_lockfp = tfp;
 412                 upd_qs(e, 1, 0, "queueup");
 413         }
 414
 415         /* if newid, write the queue file directly (instead of temp file) */
 416         if (!newid)
 417         {
 418                 /* get a locked tf file */
 419                 for (i = 0; i < 128; i++)
 420                 {
 421                         if (tfd < 0)
 422                         {
 423                                 OPEN_TF;
 424                                 if (tfd < 0)
 425                                 {
 426                                         if (errno != EEXIST)
 427                                                 break;
 428                                         if (LogLevel > 0 && (i % 32) == 0)
 429                                                 sm_syslog(LOG_ALERT, e->e_id,
 430                                                           "queueup: cannot create %s, uid=%d: %s",
 431                                                           tf, (int) geteuid(),
 432                                                           sm_errstring(errno));
 433                                 }
 434 #if SM_OPEN_EXLOCK
 435                                 else
 436                                         break;
 437 #endif /* SM_OPEN_EXLOCK */
 438                         }
 439                         if (tfd >= 0)
 440                         {
 441 #if SM_OPEN_EXLOCK
 442                                 /* file is locked by open() */
 443                                 break;
 444 #else /* SM_OPEN_EXLOCK */
 445                                 if (lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB))
 446                                         break;
 447                                 else
 448 #endif /* SM_OPEN_EXLOCK */
 449                                 if (LogLevel > 0 && (i % 32) == 0)
 450                                         sm_syslog(LOG_ALERT, e->e_id,
 451                                                   "queueup: cannot lock %s: %s",
 452                                                   tf, sm_errstring(errno));
 453                                 if ((i % 32) == 31)
 454                                 {
 455                                         (void) close(tfd);
 456                                         tfd = -1;
 457                                 }
 458                         }
 459
 460                         if ((i % 32) == 31)
 461                         {
 462                                 /* save the old temp file away */
 463                                 (void) rename(tf, queuename(e, TEMPQF_LETTER));
 464                         }
 465                         else
 466                                 (void) sleep(i % 32);
 467                 }
 468                 if (tfd < 0 || (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
 469                                                  (void *) &tfd, SM_IO_WRONLY_B,
 470                                                  NULL)) == NULL)
 471                 {
 472                         int save_errno = errno;
 473
 474                         printopenfds(true);
 475                         errno = save_errno;
 476                         syserr("!queueup: cannot create queue temp file %s, uid=%d",
 477                                 tf, (int) geteuid());
 478                 }
 479         }
 480
 481         if (tTd(40, 1))
 482                 sm_dprintf("\n>>>>> queueing %s/%s%s >>>>>\n",
 483                            qid_printqueue(e->e_qgrp, e->e_qdir),
 484                            queuename(e, ANYQFL_LETTER),
 485                            newid ? " (new id)" : "");
 486         if (tTd(40, 3))
 487         {
 488                 sm_dprintf("  e_flags=");
 489                 printenvflags(e);
 490         }
 491         if (tTd(40, 32))
 492         {
 493                 sm_dprintf("  sendq=");
 494                 printaddr(sm_debug_file(), e->e_sendqueue, true);
 495         }
 496         if (tTd(40, 9))
 497         {
 498                 sm_dprintf("  tfp=");
 499                 dumpfd(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL), true, false);
 500                 sm_dprintf("  lockfp=");
 501                 if (e->e_lockfp == NULL)
 502                         sm_dprintf("NULL\n");
 503                 else
 504                         dumpfd(sm_io_getinfo(e->e_lockfp, SM_IO_WHAT_FD, NULL),
 505                                true, false);
 506         }
 507
 508         /*
 509         **  If there is no data file yet, create one.
 510         */
 511
 512         (void) sm_strlcpy(df, queuename(e, DATAFL_LETTER), sizeof(df));
 513         if (bitset(EF_HAS_DF, e->e_flags))
 514         {
 515                 if (e->e_dfp != NULL &&
 516                     SuperSafe != SAFE_REALLY &&
 517                     SuperSafe != SAFE_REALLY_POSTMILTER &&
 518                     sm_io_setinfo(e->e_dfp, SM_BF_COMMIT, NULL) < 0 &&
 519                     errno != EINVAL)
 520                 {
 521                         syserr("!queueup: cannot commit data file %s, uid=%d",
 522                                queuename(e, DATAFL_LETTER), (int) geteuid());
 523                 }
 524                 if (e->e_dfp != NULL &&
 525                     SuperSafe == SAFE_INTERACTIVE && msync)
 526                 {
 527                         if (tTd(40,32))
 528                                 sm_syslog(LOG_INFO, e->e_id,
 529                                           "queueup: fsync(e->e_dfp)");
 530
 531                         if (fsync(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD,
 532                                                 NULL)) < 0)
 533                         {
 534                                 if (newid)
 535                                         syserr("!552 Error writing data file %s",
 536                                                df);
 537                                 else
 538                                         syserr("!452 Error writing data file %s",
 539                                                df);
 540                         }
 541                 }
 542         }
 543         else
 544         {
 545                 int dfd;
 546                 MODE_T oldumask = 0;
 547                 register SM_FILE_T *dfp = NULL;
 548                 struct stat stbuf;
 549
 550                 if (e->e_dfp != NULL &&
 551                     sm_io_getinfo(e->e_dfp, SM_IO_WHAT_ISTYPE, BF_FILE_TYPE))
 552                         syserr("committing over bf file");
 553
 554                 if (bitset(S_IWGRP, QueueFileMode))
 555                         oldumask = umask(002);
 556                 dfd = open(df, O_WRONLY|O_CREAT|O_TRUNC|QF_O_EXTRA,
 557                            QueueFileMode);
 558                 if (bitset(S_IWGRP, QueueFileMode))
 559                         (void) umask(oldumask);
 560                 if (dfd < 0 || (dfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
 561                                                  (void *) &dfd, SM_IO_WRONLY_B,
 562                                                  NULL)) == NULL)
 563                         syserr("!queueup: cannot create data temp file %s, uid=%d",
 564                                 df, (int) geteuid());
 565                 if (fstat(dfd, &stbuf) < 0)
 566                         e->e_dfino = -1;
 567                 else
 568                 {
 569                         e->e_dfdev = stbuf.st_dev;
 570                         e->e_dfino = ST_INODE(stbuf);
 571                 }
 572                 e->e_flags |= EF_HAS_DF;
 573                 memset(&mcibuf, '\0', sizeof(mcibuf));
 574                 mcibuf.mci_out = dfp;
 575                 mcibuf.mci_mailer = FileMailer;
 576                 (*e->e_putbody)(&mcibuf, e, NULL);
 577
 578                 if (SuperSafe == SAFE_REALLY ||
 579                     SuperSafe == SAFE_REALLY_POSTMILTER ||
 580                     (SuperSafe == SAFE_INTERACTIVE && msync))
 581                 {
 582                         if (tTd(40,32))
 583                                 sm_syslog(LOG_INFO, e->e_id,
 584                                           "queueup: fsync(dfp)");
 585
 586                         if (fsync(sm_io_getinfo(dfp, SM_IO_WHAT_FD, NULL)) < 0)
 587                         {
 588                                 if (newid)
 589                                         syserr("!552 Error writing data file %s",
 590                                                df);
 591                                 else
 592                                         syserr("!452 Error writing data file %s",
 593                                                df);
 594                         }
 595                 }
 596
 597                 if (sm_io_close(dfp, SM_TIME_DEFAULT) < 0)
 598                         syserr("!queueup: cannot save data temp file %s, uid=%d",
 599                                 df, (int) geteuid());
 600                 e->e_putbody = putbody;
 601         }
 602
 603         /*
 604         **  Output future work requests.
 605         **      Priority and creation time should be first, since
 606         **      they are required by gatherq.
 607         */
 608
 609         /* output queue version number (must be first!) */
 610         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "V%d\n", QF_VERSION);
 611
 612         /* output creation time */
 613         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "T%ld\n", (long) e->e_ctime);
 614
 615         /* output last delivery time */
 616         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "K%ld\n", (long) e->e_dtime);
 617
 618         /* output number of delivery attempts */
 619         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "N%d\n", e->e_ntries);
 620
 621         /* output message priority */
 622         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "P%ld\n", e->e_msgpriority);
 623
 624         /*
 625         **  If data file is in a different directory than the queue file,
 626         **  output a "d" record naming the directory of the data file.
 627         */
 628
 629         if (e->e_dfqgrp != e->e_qgrp)
 630         {
 631                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "d%s\n",
 632                         Queue[e->e_dfqgrp]->qg_qpaths[e->e_dfqdir].qp_name);
 633         }
 634
 635         /* output inode number of data file */
 636         /* XXX should probably include device major/minor too */
 637         if (e->e_dfino != -1)
 638         {
 639                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "I%ld/%ld/%llu\n",
 640                                      (long) major(e->e_dfdev),
 641                                      (long) minor(e->e_dfdev),
 642                                      (ULONGLONG_T) e->e_dfino);
 643         }
 644
 645         /* output body type */
 646         if (e->e_bodytype != NULL)
 647                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "B%s\n",
 648                                      denlstring(e->e_bodytype, true, false));
 649
 650         /* quarantine reason */
 651         if (e->e_quarmsg != NULL)
 652                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "q%s\n",
 653                                      denlstring(e->e_quarmsg, true, false));
 654
 655         /* message from envelope, if it exists */
 656         if (e->e_message != NULL)
 657                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
 658                                      denlstring(e->e_message, true, false));
 659
 660         /* send various flag bits through */
 661         p = buf;
 662         if (bitset(EF_WARNING, e->e_flags))
 663                 *p++ = 'w';
 664         if (bitset(EF_RESPONSE, e->e_flags))
 665                 *p++ = 'r';
 666         if (bitset(EF_HAS8BIT, e->e_flags))
 667                 *p++ = '8';
 668         if (bitset(EF_DELETE_BCC, e->e_flags))
 669                 *p++ = 'b';
 670         if (bitset(EF_RET_PARAM, e->e_flags))
 671                 *p++ = 'd';
 672         if (bitset(EF_NO_BODY_RETN, e->e_flags))
 673                 *p++ = 'n';
 674         if (bitset(EF_SPLIT, e->e_flags))
 675                 *p++ = 's';
 676         *p++ = '\0';
 677         if (buf[0] != '\0')
 678                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "F%s\n", buf);
 679
 680         /* save $={persistentMacros} macro values */
 681         queueup_macros(macid("{persistentMacros}"), tfp, e);
 682
 683         /* output name of sender */
 684         if (bitnset(M_UDBENVELOPE, e->e_from.q_mailer->m_flags))
 685                 p = e->e_sender;
 686         else
 687                 p = e->e_from.q_paddr;
 688         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "S%s\n",
 689                              denlstring(p, true, false));
 690
 691         /* output ESMTP-supplied "original" information */
 692         if (e->e_envid != NULL)
 693                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Z%s\n",
 694                                      denlstring(e->e_envid, true, false));
 695
 696         /* output AUTH= parameter */
 697         if (e->e_auth_param != NULL)
 698                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "A%s\n",
 699                                      denlstring(e->e_auth_param, true, false));
 700         if (e->e_dlvr_flag != 0)
 701                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "!%c %ld\n",
 702                                      (char) e->e_dlvr_flag, e->e_deliver_by);
 703
 704         /* output list of recipient addresses */
 705         printctladdr(NULL, NULL);
 706         for (q = e->e_sendqueue; q != NULL; q = q->q_next)
 707         {
 708                 if (!QS_IS_UNDELIVERED(q->q_state))
 709                         continue;
 710
 711                 /* message for this recipient, if it exists */
 712                 if (q->q_message != NULL)
 713                         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
 714                                              denlstring(q->q_message, true,
 715                                                         false));
 716
 717                 printctladdr(q, tfp);
 718                 if (q->q_orcpt != NULL)
 719                         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Q%s\n",
 720                                              denlstring(q->q_orcpt, true,
 721                                                         false));
 722                 if (q->q_finalrcpt != NULL)
 723                         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "r%s\n",
 724                                              denlstring(q->q_finalrcpt, true,
 725                                                         false));
 726                 (void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'R');
 727                 if (bitset(QPRIMARY, q->q_flags))
 728                         (void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'P');
 729                 if (bitset(QHASNOTIFY, q->q_flags))
 730                         (void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'N');
 731                 if (bitset(QPINGONSUCCESS, q->q_flags))
 732                         (void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'S');
 733                 if (bitset(QPINGONFAILURE, q->q_flags))
 734                         (void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'F');
 735                 if (bitset(QPINGONDELAY, q->q_flags))
 736                         (void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'D');
 737                 if (q->q_alias != NULL &&
 738                     bitset(QALIAS, q->q_alias->q_flags))
 739                         (void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'A');
 740                 (void) sm_io_putc(tfp, SM_TIME_DEFAULT, ':');
 741                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s\n",
 742                                      denlstring(q->q_paddr, true, false));
 743                 if (announce)
 744                 {
 745                         char *tag = "queued";
 746
 747                         if (e->e_quarmsg != NULL)
 748                                 tag = "quarantined";
 749
 750                         e->e_to = q->q_paddr;
 751                         message(tag);
 752                         if (LogLevel > 8)
 753                                 logdelivery(q->q_mailer, NULL, q->q_status,
 754                                             tag, NULL, (time_t) 0, e);
 755                         e->e_to = NULL;
 756                 }
 757                 if (tTd(40, 1))
 758                 {
 759                         sm_dprintf("queueing ");
 760                         printaddr(sm_debug_file(), q, false);
 761                 }
 762         }
 763
 764         /*
 765         **  Output headers for this message.
 766         **      Expand macros completely here.  Queue run will deal with
 767         **      everything as absolute headers.
 768         **              All headers that must be relative to the recipient
 769         **              can be cracked later.
 770         **      We set up a "null mailer" -- i.e., a mailer that will have
 771         **      no effect on the addresses as they are output.
 772         */
 773
 774         memset((char *) &nullmailer, '\0', sizeof(nullmailer));
 775         nullmailer.m_re_rwset = nullmailer.m_rh_rwset =
 776                         nullmailer.m_se_rwset = nullmailer.m_sh_rwset = -1;
 777         nullmailer.m_eol = "\n";
 778         memset(&mcibuf, '\0', sizeof(mcibuf));
 779         mcibuf.mci_mailer = &nullmailer;
 780         mcibuf.mci_out = tfp;
 781
 782         macdefine(&e->e_macro, A_PERM, 'g', "\201f");
 783         for (h = e->e_header; h != NULL; h = h->h_link)
 784         {
 785                 if (h->h_value == NULL)
 786                         continue;
 787
 788                 /* don't output resent headers on non-resent messages */
 789                 if (bitset(H_RESENT, h->h_flags) &&
 790                     !bitset(EF_RESENT, e->e_flags))
 791                         continue;
 792
 793                 /* expand macros; if null, don't output header at all */
 794                 if (bitset(H_DEFAULT, h->h_flags))
 795                 {
 796                         (void) expand(h->h_value, buf, sizeof(buf), e);
 797                         if (buf[0] == '\0')
 798                                 continue;
 799                         if (buf[0] == ' ' && buf[1] == '\0')
 800                                 continue;
 801                 }
 802
 803                 /* output this header */
 804                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "H?");
 805
 806                 /* output conditional macro if present */
 807                 if (h->h_macro != '\0')
 808                 {
 809                         if (bitset(0200, h->h_macro))
 810                                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
 811                                                      "${%s}",
 812                                                       macname(bitidx(h->h_macro)));
 813                         else
 814                                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
 815                                                      "$%c", h->h_macro);
 816                 }
 817                 else if (!bitzerop(h->h_mflags) &&
 818                          bitset(H_CHECK|H_ACHECK, h->h_flags))
 819                 {
 820                         int j;
 821
 822                         /* if conditional, output the set of conditions */
 823                         for (j = '\0'; j <= '\177'; j++)
 824                                 if (bitnset(j, h->h_mflags))
 825                                         (void) sm_io_putc(tfp, SM_TIME_DEFAULT,
 826                                                           j);
 827                 }
 828                 (void) sm_io_putc(tfp, SM_TIME_DEFAULT, '?');
 829
 830                 /* output the header: expand macros, convert addresses */
 831                 if (bitset(H_DEFAULT, h->h_flags) &&
 832                     !bitset(H_BINDLATE, h->h_flags))
 833                 {
 834                         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s:%s\n",
 835                                              h->h_field,
 836                                              denlstring(buf, false, true));
 837                 }
 838                 else if (bitset(H_FROM|H_RCPT, h->h_flags) &&
 839                          !bitset(H_BINDLATE, h->h_flags))
 840                 {
 841                         bool oldstyle = bitset(EF_OLDSTYLE, e->e_flags);
 842                         SM_FILE_T *savetrace = TrafficLogFile;
 843
 844                         TrafficLogFile = NULL;
 845
 846                         if (bitset(H_FROM, h->h_flags))
 847                                 oldstyle = false;
 848
 849                         commaize(h, h->h_value, oldstyle, &mcibuf, e);
 850
 851                         TrafficLogFile = savetrace;
 852                 }
 853                 else
 854                 {
 855                         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s:%s\n",
 856                                              h->h_field,
 857                                              denlstring(h->h_value, false,
 858                                                         true));
 859                 }
 860         }
 861
 862         /*
 863         **  Clean up.
 864         **
 865         **      Write a terminator record -- this is to prevent
 866         **      scurrilous crackers from appending any data.
 867         */
 868
 869         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ".\n");
 870
 871         if (sm_io_flush(tfp, SM_TIME_DEFAULT) != 0 ||
 872             ((SuperSafe == SAFE_REALLY ||
 873               SuperSafe == SAFE_REALLY_POSTMILTER ||
 874               (SuperSafe == SAFE_INTERACTIVE && msync)) &&
 875              fsync(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL)) < 0) ||
 876             sm_io_error(tfp))
 877         {
 878                 if (newid)
 879                         syserr("!552 Error writing control file %s", tf);
 880                 else
 881                         syserr("!452 Error writing control file %s", tf);
 882         }
 883
 884         if (!newid)
 885         {
 886                 char new = queue_letter(e, ANYQFL_LETTER);
 887
 888                 /* rename (locked) tf to be (locked) [qh]f */
 889                 (void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER),
 890                                   sizeof(qf));
 891                 if (rename(tf, qf) < 0)
 892                         syserr("cannot rename(%s, %s), uid=%d",
 893                                 tf, qf, (int) geteuid());
 894                 else
 895                 {
 896                         /*
 897                         **  Check if type has changed and only
 898                         **  remove the old item if the rename above
 899                         **  succeeded.
 900                         */
 901
 902                         if (e->e_qfletter != '\0' &&
 903                             e->e_qfletter != new)
 904                         {
 905                                 if (tTd(40, 5))
 906                                 {
 907                                         sm_dprintf("type changed from %c to %c\n",
 908                                                    e->e_qfletter, new);
 909                                 }
 910
 911                                 if (unlink(queuename(e, e->e_qfletter)) < 0)
 912                                 {
 913                                         /* XXX: something more drastic? */
 914                                         if (LogLevel > 0)
 915                                                 sm_syslog(LOG_ERR, e->e_id,
 916                                                           "queueup: unlink(%s) failed: %s",
 917                                                           queuename(e, e->e_qfletter),
 918                                                           sm_errstring(errno));
 919                                 }
 920                         }
 921                 }
 922                 e->e_qfletter = new;
 923
 924                 /*
 925                 **  fsync() after renaming to make sure metadata is
 926                 **  written to disk on filesystems in which renames are
 927                 **  not guaranteed.
 928                 */
 929
 930                 if (SuperSafe != SAFE_NO)
 931                 {
 932                         /* for softupdates */
 933                         if (tfd >= 0 && fsync(tfd) < 0)
 934                         {
 935                                 syserr("!queueup: cannot fsync queue temp file %s",
 936                                        tf);
 937                         }
 938                         SYNC_DIR(qf, true);
 939                 }
 940
 941                 /* close and unlock old (locked) queue file */
 942                 if (e->e_lockfp != NULL)
 943                         (void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
 944                 e->e_lockfp = tfp;
 945
 946                 /* save log info */
 947                 if (LogLevel > 79)
 948                         sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", qf);
 949         }
 950         else
 951         {
 952                 /* save log info */
 953                 if (LogLevel > 79)
 954                         sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", tf);
 955
 956                 e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
 957         }
 958
 959         errno = 0;
 960         e->e_flags |= EF_INQUEUE;
 961
 962         if (tTd(40, 1))
 963                 sm_dprintf("<<<<< done queueing %s <<<<<\n\n", e->e_id);
 964         return;
 965 }
 966
 967 /*
 968 **  PRINTCTLADDR -- print control address to file.
 969 **
 970 **      Parameters:
 971 **              a -- address.
 972 **              tfp -- file pointer.
 973 **
 974 **      Returns:
 975 **              none.
 976 **
 977 **      Side Effects:
 978 **              The control address (if changed) is printed to the file.
 979 **              The last control address and uid are saved.
 980 */
 981
 982 static void
 983 printctladdr(a, tfp)
 984         register ADDRESS *a;
 985         SM_FILE_T *tfp;
 986 {
 987         char *user;
 988         register ADDRESS *q;
 989         uid_t uid;
 990         gid_t gid;
 991         static ADDRESS *lastctladdr = NULL;
 992         static uid_t lastuid;
 993
 994         /* initialization */
 995         if (a == NULL || a->q_alias == NULL || tfp == NULL)
 996         {
 997                 if (lastctladdr != NULL && tfp != NULL)
 998                         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C\n");
 999                 lastctladdr = NULL;
1000                 lastuid = 0;
1001                 return;
1002         }
1003
1004         /* find the active uid */
1005         q = getctladdr(a);
1006         if (q == NULL)
1007         {
1008                 user = NULL;
1009                 uid = 0;
1010                 gid = 0;
1011         }
1012         else
1013         {
1014                 user = q->q_ruser != NULL ? q->q_ruser : q->q_user;
1015                 uid = q->q_uid;
1016                 gid = q->q_gid;
1017         }
1018         a = a->q_alias;
1019
1020         /* check to see if this is the same as last time */
1021         if (lastctladdr != NULL && uid == lastuid &&
1022             strcmp(lastctladdr->q_paddr, a->q_paddr) == 0)
1023                 return;
1024         lastuid = uid;
1025         lastctladdr = a;
1026
1027         if (uid == 0 || user == NULL || user[0] == '\0')
1028                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C");
1029         else
1030                 (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C%s:%ld:%ld",
1031                                      denlstring(user, true, false), (long) uid,
1032                                      (long) gid);
1033         (void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ":%s\n",
1034                              denlstring(a->q_paddr, true, false));
1035 }
1036
1037 /*
1038 **  RUNNERS_SIGTERM -- propagate a SIGTERM to queue runner process
1039 **
1040 **      This propagates the signal to the child processes that are queue
1041 **      runners. This is for a queue runner "cleanup". After all of the
1042 **      child queue runner processes are signaled (it should be SIGTERM
1043 **      being the sig) then the old signal handler (Oldsh) is called
1044 **      to handle any cleanup set for this process (provided it is not
1045 **      SIG_DFL or SIG_IGN). The signal may not be handled immediately
1046 **      if the BlockOldsh flag is set. If the current process doesn't
1047 **      have a parent then handle the signal immediately, regardless of
1048 **      BlockOldsh.
1049 **
1050 **      Parameters:
1051 **              sig -- the signal number being sent
1052 **
1053 **      Returns:
1054 **              none.
1055 **
1056 **      Side Effects:
1057 **              Sets the NoMoreRunners boolean to true to stop more runners
1058 **              from being started in runqueue().
1059 **
1060 **      NOTE:   THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1061 **              ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1062 **              DOING.
1063 */
1064
1065 static bool             volatile NoMoreRunners = false;
1066 static sigfunc_t        Oldsh_term = SIG_DFL;
1067 static sigfunc_t        Oldsh_hup = SIG_DFL;
1068 static sigfunc_t        volatile Oldsh = SIG_DFL;
1069 static bool             BlockOldsh = false;
1070 static int              volatile Oldsig = 0;
1071 static SIGFUNC_DECL     runners_sigterm __P((int));
1072 static SIGFUNC_DECL     runners_sighup __P((int));
1073
1074 static SIGFUNC_DECL
1075 runners_sigterm(sig)
1076         int sig;
1077 {
1078         int save_errno = errno;
1079
1080         FIX_SYSV_SIGNAL(sig, runners_sigterm);
1081         errno = save_errno;
1082         CHECK_CRITICAL(sig);
1083         NoMoreRunners = true;
1084         Oldsh = Oldsh_term;
1085         Oldsig = sig;
1086         proc_list_signal(PROC_QUEUE, sig);
1087
1088         if (!BlockOldsh || getppid() <= 1)
1089         {
1090                 /* Check that a valid 'old signal handler' is callable */
1091                 if (Oldsh_term != SIG_DFL && Oldsh_term != SIG_IGN &&
1092                     Oldsh_term != runners_sigterm)
1093                         (*Oldsh_term)(sig);
1094         }
1095         errno = save_errno;
1096         return SIGFUNC_RETURN;
1097 }
1098 /*
1099 **  RUNNERS_SIGHUP -- propagate a SIGHUP to queue runner process
1100 **
1101 **      This propagates the signal to the child processes that are queue
1102 **      runners. This is for a queue runner "cleanup". After all of the
1103 **      child queue runner processes are signaled (it should be SIGHUP
1104 **      being the sig) then the old signal handler (Oldsh) is called to
1105 **      handle any cleanup set for this process (provided it is not SIG_DFL
1106 **      or SIG_IGN). The signal may not be handled immediately if the
1107 **      BlockOldsh flag is set. If the current process doesn't have
1108 **      a parent then handle the signal immediately, regardless of
1109 **      BlockOldsh.
1110 **
1111 **      Parameters:
1112 **              sig -- the signal number being sent
1113 **
1114 **      Returns:
1115 **              none.
1116 **
1117 **      Side Effects:
1118 **              Sets the NoMoreRunners boolean to true to stop more runners
1119 **              from being started in runqueue().
1120 **
1121 **      NOTE:   THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1122 **              ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1123 **              DOING.
1124 */
1125
1126 static SIGFUNC_DECL
1127 runners_sighup(sig)
1128         int sig;
1129 {
1130         int save_errno = errno;
1131
1132         FIX_SYSV_SIGNAL(sig, runners_sighup);
1133         errno = save_errno;
1134         CHECK_CRITICAL(sig);
1135         NoMoreRunners = true;
1136         Oldsh = Oldsh_hup;
1137         Oldsig = sig;
1138         proc_list_signal(PROC_QUEUE, sig);
1139
1140         if (!BlockOldsh || getppid() <= 1)
1141         {
1142                 /* Check that a valid 'old signal handler' is callable */
1143                 if (Oldsh_hup != SIG_DFL && Oldsh_hup != SIG_IGN &&
1144                     Oldsh_hup != runners_sighup)
1145                         (*Oldsh_hup)(sig);
1146         }
1147         errno = save_errno;
1148         return SIGFUNC_RETURN;
1149 }
1150 /*
1151 **  MARK_WORK_GROUP_RESTART -- mark a work group as needing a restart
1152 **
1153 **  Sets a workgroup for restarting.
1154 **
1155 **      Parameters:
1156 **              wgrp -- the work group id to restart.
1157 **              reason -- why (signal?), -1 to turn off restart
1158 **
1159 **      Returns:
1160 **              none.
1161 **
1162 **      Side effects:
1163 **              May set global RestartWorkGroup to true.
1164 **
1165 **      NOTE:   THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1166 **              ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1167 **              DOING.
1168 */
1169
1170 void
1171 mark_work_group_restart(wgrp, reason)
1172         int wgrp;
1173         int reason;
1174 {
1175         if (wgrp < 0 || wgrp > NumWorkGroups)
1176                 return;
1177
1178         WorkGrp[wgrp].wg_restart = reason;
1179         if (reason >= 0)
1180                 RestartWorkGroup = true;
1181 }
1182 /*
1183 **  RESTART_MARKED_WORK_GROUPS -- restart work groups marked as needing restart
1184 **
1185 **  Restart any workgroup marked as needing a restart provided more
1186 **  runners are allowed.
1187 **
1188 **      Parameters:
1189 **              none.
1190 **
1191 **      Returns:
1192 **              none.
1193 **
1194 **      Side effects:
1195 **              Sets global RestartWorkGroup to false.
1196 */
1197
1198 void
1199 restart_marked_work_groups()
1200 {
1201         int i;
1202         int wasblocked;
1203
1204         if (NoMoreRunners)
1205                 return;
1206
1207         /* Block SIGCHLD so reapchild() doesn't mess with us */
1208         wasblocked = sm_blocksignal(SIGCHLD);
1209
1210         for (i = 0; i < NumWorkGroups; i++)
1211         {
1212                 if (WorkGrp[i].wg_restart >= 0)
1213                 {
1214                         if (LogLevel > 8)
1215                                 sm_syslog(LOG_ERR, NOQID,
1216                                           "restart queue runner=%d due to signal 0x%x",
1217                                           i, WorkGrp[i].wg_restart);
1218                         restart_work_group(i);
1219                 }
1220         }
1221         RestartWorkGroup = false;
1222
1223         if (wasblocked == 0)
1224                 (void) sm_releasesignal(SIGCHLD);
1225 }
1226 /*
1227 **  RESTART_WORK_GROUP -- restart a specific work group
1228 **
1229 **  Restart a specific workgroup provided more runners are allowed.
1230 **  If the requested work group has been restarted too many times log
1231 **  this and refuse to restart.
1232 **
1233 **      Parameters:
1234 **              wgrp -- the work group id to restart
1235 **
1236 **      Returns:
1237 **              none.
1238 **
1239 **      Side Effects:
1240 **              starts another process doing the work of wgrp
1241 */
1242
1243 #define MAX_PERSIST_RESTART     10      /* max allowed number of restarts */
1244
1245 static void
1246 restart_work_group(wgrp)
1247         int wgrp;
1248 {
1249         if (NoMoreRunners ||
1250             wgrp < 0 || wgrp > NumWorkGroups)
1251                 return;
1252
1253         WorkGrp[wgrp].wg_restart = -1;
1254         if (WorkGrp[wgrp].wg_restartcnt < MAX_PERSIST_RESTART)
1255         {
1256                 /* avoid overflow; increment here */
1257                 WorkGrp[wgrp].wg_restartcnt++;
1258                 (void) run_work_group(wgrp, RWG_FORK|RWG_PERSISTENT|RWG_RUNALL);
1259         }
1260         else
1261         {
1262                 sm_syslog(LOG_ERR, NOQID,
1263                           "ERROR: persistent queue runner=%d restarted too many times, queue runner lost",
1264                           wgrp);
1265         }
1266 }
1267 /*
1268 **  SCHEDULE_QUEUE_RUNS -- schedule the next queue run for a work group.
1269 **
1270 **      Parameters:
1271 **              runall -- schedule even if individual bit is not set.
1272 **              wgrp -- the work group id to schedule.
1273 **              didit -- the queue run was performed for this work group.
1274 **
1275 **      Returns:
1276 **              nothing
1277 */
1278
1279 #define INCR_MOD(v, m)  if (++v >= m)   \
1280                                 v = 0;  \
1281                         else
1282
1283 static void
1284 schedule_queue_runs(runall, wgrp, didit)
1285         bool runall;
1286         int wgrp;
1287         bool didit;
1288 {
1289         int qgrp, cgrp, endgrp;
1290 #if _FFR_QUEUE_SCHED_DBG
1291         time_t lastsched;
1292         bool sched;
1293 #endif /* _FFR_QUEUE_SCHED_DBG */
1294         time_t now;
1295         time_t minqintvl;
1296
1297         /*
1298         **  This is a bit ugly since we have to duplicate the
1299         **  code that "walks" through a work queue group.
1300         */
1301
1302         now = curtime();
1303         minqintvl = 0;
1304         cgrp = endgrp = WorkGrp[wgrp].wg_curqgrp;
1305         do
1306         {
1307                 time_t qintvl;
1308
1309 #if _FFR_QUEUE_SCHED_DBG
1310                 lastsched = 0;
1311                 sched = false;
1312 #endif /* _FFR_QUEUE_SCHED_DBG */
1313                 qgrp = WorkGrp[wgrp].wg_qgs[cgrp]->qg_index;
1314                 if (Queue[qgrp]->qg_queueintvl > 0)
1315                         qintvl = Queue[qgrp]->qg_queueintvl;
1316                 else if (QueueIntvl > 0)
1317                         qintvl = QueueIntvl;
1318                 else
1319                         qintvl = (time_t) 0;
1320 #if _FFR_QUEUE_SCHED_DBG
1321                 lastsched = Queue[qgrp]->qg_nextrun;
1322 #endif /* _FFR_QUEUE_SCHED_DBG */
1323                 if ((runall || Queue[qgrp]->qg_nextrun <= now) && qintvl > 0)
1324                 {
1325 #if _FFR_QUEUE_SCHED_DBG
1326                         sched = true;
1327 #endif /* _FFR_QUEUE_SCHED_DBG */
1328                         if (minqintvl == 0 || qintvl < minqintvl)
1329                                 minqintvl = qintvl;
1330
1331                         /*
1332                         **  Only set a new time if a queue run was performed
1333                         **  for this queue group.  If the queue was not run,
1334                         **  we could starve it by setting a new time on each
1335                         **  call.
1336                         */
1337
1338                         if (didit)
1339                                 Queue[qgrp]->qg_nextrun += qintvl;
1340                 }
1341 #if _FFR_QUEUE_SCHED_DBG
1342                 if (tTd(69, 10))
1343                         sm_syslog(LOG_INFO, NOQID,
1344                                 "sqr: wgrp=%d, cgrp=%d, qgrp=%d, intvl=%ld, QI=%ld, runall=%d, lastrun=%ld, nextrun=%ld, sched=%d",
1345                                 wgrp, cgrp, qgrp, Queue[qgrp]->qg_queueintvl,
1346                                 QueueIntvl, runall, lastsched,
1347                                 Queue[qgrp]->qg_nextrun, sched);
1348 #endif /* _FFR_QUEUE_SCHED_DBG */
1349                 INCR_MOD(cgrp, WorkGrp[wgrp].wg_numqgrp);
1350         } while (endgrp != cgrp);
1351         if (minqintvl > 0)
1352                 (void) sm_setevent(minqintvl, runqueueevent, 0);
1353 }
1354
1355 #if _FFR_QUEUE_RUN_PARANOIA
1356 /*
1357 **  CHECKQUEUERUNNER -- check whether a queue group hasn't been run.
1358 **
1359 **      Use this if events may get lost and hence queue runners may not
1360 **      be started and mail will pile up in a queue.
1361 **
1362 **      Parameters:
1363 **              none.
1364 **
1365 **      Returns:
1366 **              true if a queue run is necessary.
1367 **
1368 **      Side Effects:
1369 **              may schedule a queue run.
1370 */
1371
1372 bool
1373 checkqueuerunner()
1374 {
1375         int qgrp;
1376         time_t now, minqintvl;
1377
1378         now = curtime();
1379         minqintvl = 0;
1380         for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
1381         {
1382                 time_t qintvl;
1383
1384                 if (Queue[qgrp]->qg_queueintvl > 0)
1385                         qintvl = Queue[qgrp]->qg_queueintvl;
1386                 else if (QueueIntvl > 0)
1387                         qintvl = QueueIntvl;
1388                 else
1389                         qintvl = (time_t) 0;
1390                 if (Queue[qgrp]->qg_nextrun <= now - qintvl)
1391                 {
1392                         if (minqintvl == 0 || qintvl < minqintvl)
1393                                 minqintvl = qintvl;
1394                         if (LogLevel > 1)
1395                                 sm_syslog(LOG_WARNING, NOQID,
1396                                         "checkqueuerunner: queue %d should have been run at %s, queue interval %ld",
1397                                         qgrp,
1398                                         arpadate(ctime(&Queue[qgrp]->qg_nextrun)),
1399                                         qintvl);
1400                 }
1401         }
1402         if (minqintvl > 0)
1403         {
1404                 (void) sm_setevent(minqintvl, runqueueevent, 0);
1405                 return true;
1406         }
1407         return false;
1408 }
1409 #endif /* _FFR_QUEUE_RUN_PARANOIA */
1410
1411 /*
1412 **  RUNQUEUE -- run the jobs in the queue.
1413 **
1414 **      Gets the stuff out of the queue in some presumably logical
1415 **      order and processes them.
1416 **
1417 **      Parameters:
1418 **              forkflag -- true if the queue scanning should be done in
1419 **                      a child process.  We double-fork so it is not our
1420 **                      child and we don't have to clean up after it.
1421 **                      false can be ignored if we have multiple queues.
1422 **              verbose -- if true, print out status information.
1423 **              persistent -- persistent queue runner?
1424 **              runall -- run all groups or only a subset (DoQueueRun)?
1425 **
1426 **      Returns:
1427 **              true if the queue run successfully began.
1428 **
1429 **      Side Effects:
1430 **              runs things in the mail queue using run_work_group().
1431 **              maybe schedules next queue run.
1432 */
1433
1434 static ENVELOPE QueueEnvelope;          /* the queue run envelope */
1435 static time_t   LastQueueTime = 0;      /* last time a queue ID assigned */
1436 static pid_t    LastQueuePid = -1;      /* last PID which had a queue ID */
1437
1438 /* values for qp_supdirs */
1439 #define QP_NOSUB        0x0000  /* No subdirectories */
1440 #define QP_SUBDF        0x0001  /* "df" subdirectory */
1441 #define QP_SUBQF        0x0002  /* "qf" subdirectory */
1442 #define QP_SUBXF        0x0004  /* "xf" subdirectory */
1443
1444 bool
1445 runqueue(forkflag, verbose, persistent, runall)
1446         bool forkflag;
1447         bool verbose;
1448         bool persistent;
1449         bool runall;
1450 {
1451         int i;
1452         bool ret = true;
1453         static int curnum = 0;
1454         sigfunc_t cursh;
1455 #if SM_HEAP_CHECK
1456         SM_NONVOLATILE int oldgroup = 0;
1457
1458         if (sm_debug_active(&DebugLeakQ, 1))
1459         {
1460                 oldgroup = sm_heap_group();
1461                 sm_heap_newgroup();
1462                 sm_dprintf("runqueue() heap group #%d\n", sm_heap_group());
1463         }
1464 #endif /* SM_HEAP_CHECK */
1465
1466         /* queue run has been started, don't do any more this time */
1467         DoQueueRun = false;
1468
1469         /* more than one queue or more than one directory per queue */
1470         if (!forkflag && !verbose &&
1471             (WorkGrp[0].wg_qgs[0]->qg_numqueues > 1 || NumWorkGroups > 1 ||
1472              WorkGrp[0].wg_numqgrp > 1))
1473                 forkflag = true;
1474
1475         /*
1476         **  For controlling queue runners via signals sent to this process.
1477         **  Oldsh* will get called too by runners_sig* (if it is not SIG_IGN
1478         **  or SIG_DFL) to preserve cleanup behavior. Now that this process
1479         **  will have children (and perhaps grandchildren) this handler will
1480         **  be left in place. This is because this process, once it has
1481         **  finished spinning off queue runners, may go back to doing something
1482         **  else (like being a daemon). And we still want on a SIG{TERM,HUP} to
1483         **  clean up the child queue runners. Only install 'runners_sig*' once
1484         **  else we'll get stuck looping forever.
1485         */
1486
1487         cursh = sm_signal(SIGTERM, runners_sigterm);
1488         if (cursh != runners_sigterm)
1489                 Oldsh_term = cursh;
1490         cursh = sm_signal(SIGHUP, runners_sighup);
1491         if (cursh != runners_sighup)
1492                 Oldsh_hup = cursh;
1493
1494         for (i = 0; i < NumWorkGroups && !NoMoreRunners; i++)
1495         {
1496                 int rwgflags = RWG_NONE;
1497
1498                 /*
1499                 **  If MaxQueueChildren active then test whether the start
1500                 **  of the next queue group's additional queue runners (maximum)
1501                 **  will result in MaxQueueChildren being exceeded.
1502                 **
1503                 **  Note: do not use continue; even though another workgroup
1504                 **      may have fewer queue runners, this would be "unfair",
1505                 **      i.e., this work group might "starve" then.
1506                 */
1507
1508 #if _FFR_QUEUE_SCHED_DBG
1509                 if (tTd(69, 10))
1510                         sm_syslog(LOG_INFO, NOQID,
1511                                 "rq: curnum=%d, MaxQueueChildren=%d, CurRunners=%d, WorkGrp[curnum].wg_maxact=%d",
1512                                 curnum, MaxQueueChildren, CurRunners,
1513                                 WorkGrp[curnum].wg_maxact);
1514 #endif /* _FFR_QUEUE_SCHED_DBG */
1515                 if (MaxQueueChildren > 0 &&
1516                     CurRunners + WorkGrp[curnum].wg_maxact > MaxQueueChildren)
1517                         break;
1518
1519                 /*
1520                 **  Pick up where we left off (curnum), in case we
1521                 **  used up all the children last time without finishing.
1522                 **  This give a round-robin fairness to queue runs.
1523                 **
1524                 **  Increment CurRunners before calling run_work_group()
1525                 **  to avoid a "race condition" with proc_list_drop() which
1526                 **  decrements CurRunners if the queue runners terminate.
1527                 **  Notice: CurRunners is an upper limit, in some cases
1528                 **  (too few jobs in the queue) this value is larger than
1529                 **  the actual number of queue runners. The discrepancy can
1530                 **  increase if some queue runners "hang" for a long time.
1531                 */
1532
1533                 CurRunners += WorkGrp[curnum].wg_maxact;
1534                 if (forkflag)
1535                         rwgflags |= RWG_FORK;
1536                 if (verbose)
1537                         rwgflags |= RWG_VERBOSE;
1538                 if (persistent)
1539                         rwgflags |= RWG_PERSISTENT;
1540                 if (runall)
1541                         rwgflags |= RWG_RUNALL;
1542                 ret = run_work_group(curnum, rwgflags);
1543
1544                 /*
1545                 **  Failure means a message was printed for ETRN
1546                 **  and subsequent queues are likely to fail as well.
1547                 **  Decrement CurRunners in that case because
1548                 **  none have been started.
1549                 */
1550
1551                 if (!ret)
1552                 {
1553                         CurRunners -= WorkGrp[curnum].wg_maxact;
1554                         break;
1555                 }
1556
1557                 if (!persistent)
1558                         schedule_queue_runs(runall, curnum, true);
1559                 INCR_MOD(curnum, NumWorkGroups);
1560         }
1561
1562         /* schedule left over queue runs */
1563         if (i < NumWorkGroups && !NoMoreRunners && !persistent)
1564         {
1565                 int h;
1566
1567                 for (h = curnum; i < NumWorkGroups; i++)
1568                 {
1569                         schedule_queue_runs(runall, h, false);
1570                         INCR_MOD(h, NumWorkGroups);
1571                 }
1572         }
1573
1574
1575 #if SM_HEAP_CHECK
1576         if (sm_debug_active(&DebugLeakQ, 1))
1577                 sm_heap_setgroup(oldgroup);
1578 #endif /* SM_HEAP_CHECK */
1579         return ret;
1580 }
1581
1582 #if _FFR_SKIP_DOMAINS
1583 /*
1584 **  SKIP_DOMAINS -- Skip 'skip' number of domains in the WorkQ.
1585 **
1586 **  Added by Stephen Frost <sfrost@snowman.net> to support
1587 **  having each runner process every N'th domain instead of
1588 **  every N'th message.
1589 **
1590 **      Parameters:
1591 **              skip -- number of domains in WorkQ to skip.
1592 **
1593 **      Returns:
1594 **              total number of messages skipped.
1595 **
1596 **      Side Effects:
1597 **              may change WorkQ
1598 */
1599
1600 static int
1601 skip_domains(skip)
1602         int skip;
1603 {
1604         int n, seqjump;
1605
1606         for (n = 0, seqjump = 0; n < skip && WorkQ != NULL; seqjump++)
1607         {
1608                 if (WorkQ->w_next != NULL)
1609                 {
1610                         if (WorkQ->w_host != NULL &&
1611                             WorkQ->w_next->w_host != NULL)
1612                         {
1613                                 if (sm_strcasecmp(WorkQ->w_host,
1614                                                 WorkQ->w_next->w_host) != 0)
1615                                         n++;
1616                         }
1617                         else
1618                         {
1619                                 if ((WorkQ->w_host != NULL &&
1620                                      WorkQ->w_next->w_host == NULL) ||
1621                                     (WorkQ->w_host == NULL &&
1622                                      WorkQ->w_next->w_host != NULL))
1623                                              n++;
1624                         }
1625                 }
1626                 WorkQ = WorkQ->w_next;
1627         }
1628         return seqjump;
1629 }
1630 #endif /* _FFR_SKIP_DOMAINS */
1631
1632 /*
1633 **  RUNNER_WORK -- have a queue runner do its work
1634 **
1635 **  Have a queue runner do its work a list of entries.
1636 **  When work isn't directly being done then this process can take a signal
1637 **  and terminate immediately (in a clean fashion of course).
1638 **  When work is directly being done, it's not to be interrupted
1639 **  immediately: the work should be allowed to finish at a clean point
1640 **  before termination (in a clean fashion of course).
1641 **
1642 **      Parameters:
1643 **              e -- envelope.
1644 **              sequenceno -- 'th process to run WorkQ.
1645 **              didfork -- did the calling process fork()?
1646 **              skip -- process only each skip'th item.
1647 **              njobs -- number of jobs in WorkQ.
1648 **
1649 **      Returns:
1650 **              none.
1651 **
1652 **      Side Effects:
1653 **              runs things in the mail queue.
1654 */
1655
1656 static void
1657 runner_work(e, sequenceno, didfork, skip, njobs)
1658         register ENVELOPE *e;
1659         int sequenceno;
1660         bool didfork;
1661         int skip;
1662         int njobs;
1663 {
1664         int n, seqjump;
1665         WORK *w;
1666         time_t now;
1667
1668         SM_GET_LA(now);
1669
1670         /*
1671         **  Here we temporarily block the second calling of the handlers.
1672         **  This allows us to handle the signal without terminating in the
1673         **  middle of direct work. If a signal does come, the test for
1674         **  NoMoreRunners will find it.
1675         */
1676
1677         BlockOldsh = true;
1678         seqjump = skip;
1679
1680         /* process them once at a time */
1681         while (WorkQ != NULL)
1682         {
1683 #if SM_HEAP_CHECK
1684                 SM_NONVOLATILE int oldgroup = 0;
1685
1686                 if (sm_debug_active(&DebugLeakQ, 1))
1687                 {
1688                         oldgroup = sm_heap_group();
1689                         sm_heap_newgroup();
1690                         sm_dprintf("run_queue_group() heap group #%d\n",
1691                                 sm_heap_group());
1692                 }
1693 #endif /* SM_HEAP_CHECK */
1694
1695                 /* do no more work */
1696                 if (NoMoreRunners)
1697                 {
1698                         /* Check that a valid signal handler is callable */
1699                         if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1700                             Oldsh != runners_sighup &&
1701                             Oldsh != runners_sigterm)
1702                                 (*Oldsh)(Oldsig);
1703                         break;
1704                 }
1705
1706                 w = WorkQ; /* assign current work item */
1707
1708                 /*
1709                 **  Set the head of the WorkQ to the next work item.
1710                 **  It is set 'skip' ahead (the number of parallel queue
1711                 **  runners working on WorkQ together) since each runner
1712                 **  works on every 'skip'th (N-th) item.
1713 #if _FFR_SKIP_DOMAINS
1714                 **  In the case of the BYHOST Queue Sort Order, the 'item'
1715                 **  is a domain, so we work on every 'skip'th (N-th) domain.
1716 #endif * _FFR_SKIP_DOMAINS *
1717                 */
1718
1719 #if _FFR_SKIP_DOMAINS
1720                 if (QueueSortOrder == QSO_BYHOST)
1721                 {
1722                         seqjump = 1;
1723                         if (WorkQ->w_next != NULL)
1724                         {
1725                                 if (WorkQ->w_host != NULL &&
1726                                     WorkQ->w_next->w_host != NULL)
1727                                 {
1728                                         if (sm_strcasecmp(WorkQ->w_host,
1729                                                         WorkQ->w_next->w_host)
1730                                                                 != 0)
1731                                                 seqjump = skip_domains(skip);
1732                                         else
1733                                                 WorkQ = WorkQ->w_next;
1734                                 }
1735                                 else
1736                                 {
1737                                         if ((WorkQ->w_host != NULL &&
1738                                              WorkQ->w_next->w_host == NULL) ||
1739                                             (WorkQ->w_host == NULL &&
1740                                              WorkQ->w_next->w_host != NULL))
1741                                                 seqjump = skip_domains(skip);
1742                                         else
1743                                                 WorkQ = WorkQ->w_next;
1744                                 }
1745                         }
1746                         else
1747                                 WorkQ = WorkQ->w_next;
1748                 }
1749                 else
1750 #endif /* _FFR_SKIP_DOMAINS */
1751                 {
1752                         for (n = 0; n < skip && WorkQ != NULL; n++)
1753                                 WorkQ = WorkQ->w_next;
1754                 }
1755
1756                 e->e_to = NULL;
1757
1758                 /*
1759                 **  Ignore jobs that are too expensive for the moment.
1760                 **
1761                 **      Get new load average every GET_NEW_LA_TIME seconds.
1762                 */
1763
1764                 SM_GET_LA(now);
1765                 if (shouldqueue(WkRecipFact, Current_LA_time))
1766                 {
1767                         char *msg = "Aborting queue run: load average too high";
1768
1769                         if (Verbose)
1770                                 message("%s", msg);
1771                         if (LogLevel > 8)
1772                                 sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1773                         break;
1774                 }
1775                 if (shouldqueue(w->w_pri, w->w_ctime))
1776                 {
1777                         if (Verbose)
1778                                 message(EmptyString);
1779                         if (QueueSortOrder == QSO_BYPRIORITY)
1780                         {
1781                                 if (Verbose)
1782                                         message("Skipping %s/%s (sequence %d of %d) and flushing rest of queue",
1783                                                 qid_printqueue(w->w_qgrp,
1784                                                                w->w_qdir),
1785                                                 w->w_name + 2, sequenceno,
1786                                                 njobs);
1787                                 if (LogLevel > 8)
1788                                         sm_syslog(LOG_INFO, NOQID,
1789                                                   "runqueue: Flushing queue from %s/%s (pri %ld, LA %d, %d of %d)",
1790                                                   qid_printqueue(w->w_qgrp,
1791                                                                  w->w_qdir),
1792                                                   w->w_name + 2, w->w_pri,
1793                                                   CurrentLA, sequenceno,
1794                                                   njobs);
1795                                 break;
1796                         }
1797                         else if (Verbose)
1798                                 message("Skipping %s/%s (sequence %d of %d)",
1799                                         qid_printqueue(w->w_qgrp, w->w_qdir),
1800                                         w->w_name + 2, sequenceno, njobs);
1801                 }
1802                 else
1803                 {
1804                         if (Verbose)
1805                         {
1806                                 message(EmptyString);
1807                                 message("Running %s/%s (sequence %d of %d)",
1808                                         qid_printqueue(w->w_qgrp, w->w_qdir),
1809                                         w->w_name + 2, sequenceno, njobs);
1810                         }
1811                         if (didfork && MaxQueueChildren > 0)
1812                         {
1813                                 sm_blocksignal(SIGCHLD);
1814                                 (void) sm_signal(SIGCHLD, reapchild);
1815                         }
1816                         if (tTd(63, 100))
1817                                 sm_syslog(LOG_DEBUG, NOQID,
1818                                           "runqueue %s dowork(%s)",
1819                                           qid_printqueue(w->w_qgrp, w->w_qdir),
1820                                           w->w_name + 2);
1821
1822                         (void) dowork(w->w_qgrp, w->w_qdir, w->w_name + 2,
1823                                       ForkQueueRuns, false, e);
1824                         errno = 0;
1825                 }
1826                 sm_free(w->w_name); /* XXX */
1827                 if (w->w_host != NULL)
1828                         sm_free(w->w_host); /* XXX */
1829                 sm_free((char *) w); /* XXX */
1830                 sequenceno += seqjump; /* next sequence number */
1831 #if SM_HEAP_CHECK
1832                 if (sm_debug_active(&DebugLeakQ, 1))
1833                         sm_heap_setgroup(oldgroup);
1834 #endif /* SM_HEAP_CHECK */
1835         }
1836
1837         BlockOldsh = false;
1838
1839         /* check the signals didn't happen during the revert */
1840         if (NoMoreRunners)
1841         {
1842                 /* Check that a valid signal handler is callable */
1843                 if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1844                     Oldsh != runners_sighup && Oldsh != runners_sigterm)
1845                         (*Oldsh)(Oldsig);
1846         }
1847
1848         Oldsh = SIG_DFL; /* after the NoMoreRunners check */
1849 }
1850 /*
1851 **  RUN_WORK_GROUP -- run the jobs in a queue group from a work group.
1852 **
1853 **      Gets the stuff out of the queue in some presumably logical
1854 **      order and processes them.
1855 **
1856 **      Parameters:
1857 **              wgrp -- work group to process.
1858 **              flags -- RWG_* flags
1859 **
1860 **      Returns:
1861 **              true if the queue run successfully began.
1862 **
1863 **      Side Effects:
1864 **              runs things in the mail queue.
1865 */
1866
1867 /* Minimum sleep time for persistent queue runners */
1868 #define MIN_SLEEP_TIME  5
1869
1870 bool
1871 run_work_group(wgrp, flags)
1872         int wgrp;
1873         int flags;
1874 {
1875         register ENVELOPE *e;
1876         int njobs, qdir;
1877         int sequenceno = 1;
1878         int qgrp, endgrp, h, i;
1879         time_t now;
1880         bool full, more;
1881         SM_RPOOL_T *rpool;
1882         extern ENVELOPE BlankEnvelope;
1883         extern SIGFUNC_DECL reapchild __P((int));
1884
1885         if (wgrp < 0)
1886                 return false;
1887
1888         /*
1889         **  If no work will ever be selected, don't even bother reading
1890         **  the queue.
1891         */
1892
1893         SM_GET_LA(now);
1894
1895         if (!bitset(RWG_PERSISTENT, flags) &&
1896             shouldqueue(WkRecipFact, Current_LA_time))
1897         {
1898                 char *msg = "Skipping queue run -- load average too high";
1899
1900                 if (bitset(RWG_VERBOSE, flags))
1901                         message("458 %s\n", msg);
1902                 if (LogLevel > 8)
1903                         sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1904                 return false;
1905         }
1906
1907         /*
1908         **  See if we already have too many children.
1909         */
1910
1911         if (bitset(RWG_FORK, flags) &&
1912             WorkGrp[wgrp].wg_lowqintvl > 0 &&
1913             !bitset(RWG_PERSISTENT, flags) &&
1914             MaxChildren > 0 && CurChildren >= MaxChildren)
1915         {
1916                 char *msg = "Skipping queue run -- too many children";
1917
1918                 if (bitset(RWG_VERBOSE, flags))
1919                         message("458 %s (%d)\n", msg, CurChildren);
1920                 if (LogLevel > 8)
1921                         sm_syslog(LOG_INFO, NOQID, "runqueue: %s (%d)",
1922                                   msg, CurChildren);
1923                 return false;
1924         }
1925
1926         /*
1927         **  See if we want to go off and do other useful work.
1928         */
1929
1930         if (bitset(RWG_FORK, flags))
1931         {
1932                 pid_t pid;
1933
1934                 (void) sm_blocksignal(SIGCHLD);
1935                 (void) sm_signal(SIGCHLD, reapchild);
1936
1937                 pid = dofork();
1938                 if (pid == -1)
1939                 {
1940                         const char *msg = "Skipping queue run -- fork() failed";
1941                         const char *err = sm_errstring(errno);
1942
1943                         if (bitset(RWG_VERBOSE, flags))
1944                                 message("458 %s: %s\n", msg, err);
1945                         if (LogLevel > 8)
1946                                 sm_syslog(LOG_INFO, NOQID, "runqueue: %s: %s",
1947                                           msg, err);
1948                         (void) sm_releasesignal(SIGCHLD);
1949                         return false;
1950                 }
1951                 if (pid != 0)
1952                 {
1953                         /* parent -- pick up intermediate zombie */
1954                         (void) sm_blocksignal(SIGALRM);
1955
1956                         /* wgrp only used when queue runners are persistent */
1957                         proc_list_add(pid, "Queue runner", PROC_QUEUE,
1958                                       WorkGrp[wgrp].wg_maxact,
1959                                       bitset(RWG_PERSISTENT, flags) ? wgrp : -1,
1960                                       NULL);
1961                         (void) sm_releasesignal(SIGALRM);
1962                         (void) sm_releasesignal(SIGCHLD);
1963                         return true;
1964                 }
1965
1966                 /* child -- clean up signals */
1967
1968                 /* Reset global flags */
1969                 RestartRequest = NULL;
1970                 RestartWorkGroup = false;
1971                 ShutdownRequest = NULL;
1972                 PendingSignal = 0;
1973                 CurrentPid = getpid();
1974                 close_sendmail_pid();
1975
1976                 /*
1977                 **  Initialize exception stack and default exception
1978                 **  handler for child process.
1979                 */
1980
1981                 sm_exc_newthread(fatal_error);
1982                 clrcontrol();
1983                 proc_list_clear();
1984
1985                 /* Add parent process as first child item */
1986                 proc_list_add(CurrentPid, "Queue runner child process",
1987                               PROC_QUEUE_CHILD, 0, -1, NULL);
1988                 (void) sm_releasesignal(SIGCHLD);
1989                 (void) sm_signal(SIGCHLD, SIG_DFL);
1990                 (void) sm_signal(SIGHUP, SIG_DFL);
1991                 (void) sm_signal(SIGTERM, intsig);
1992         }
1993
1994         /*
1995         **  Release any resources used by the daemon code.
1996         */
1997
1998         clrdaemon();
1999
2000         /* force it to run expensive jobs */
2001         NoConnect = false;
2002
2003         /* drop privileges */
2004         if (geteuid() == (uid_t) 0)
2005                 (void) drop_privileges(false);
2006
2007         /*
2008         **  Create ourselves an envelope
2009         */
2010
2011         CurEnv = &QueueEnvelope;
2012         rpool = sm_rpool_new_x(NULL);
2013         e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2014         e->e_flags = BlankEnvelope.e_flags;
2015         e->e_parent = NULL;
2016
2017         /* make sure we have disconnected from parent */
2018         if (bitset(RWG_FORK, flags))
2019         {
2020                 disconnect(1, e);
2021                 QuickAbort = false;
2022         }
2023
2024         /*
2025         **  If we are running part of the queue, always ignore stored
2026         **  host status.
2027         */
2028
2029         if (QueueLimitId != NULL || QueueLimitSender != NULL ||
2030             QueueLimitQuarantine != NULL ||
2031             QueueLimitRecipient != NULL)
2032         {
2033                 IgnoreHostStatus = true;
2034                 MinQueueAge = 0;
2035         }
2036
2037         /*
2038         **  Here is where we choose the queue group from the work group.
2039         **  The caller of the "domorework" label must setup a new envelope.
2040         */
2041
2042         endgrp = WorkGrp[wgrp].wg_curqgrp; /* to not spin endlessly */
2043
2044   domorework:
2045
2046         /*
2047         **  Run a queue group if:
2048         **  RWG_RUNALL bit is set or the bit for this group is set.
2049         */
2050
2051         now = curtime();
2052         for (;;)
2053         {
2054                 /*
2055                 **  Find the next queue group within the work group that
2056                 **  has been marked as needing a run.
2057                 */
2058
2059                 qgrp = WorkGrp[wgrp].wg_qgs[WorkGrp[wgrp].wg_curqgrp]->qg_index;
2060                 WorkGrp[wgrp].wg_curqgrp++; /* advance */
2061                 WorkGrp[wgrp].wg_curqgrp %= WorkGrp[wgrp].wg_numqgrp; /* wrap */
2062                 if (bitset(RWG_RUNALL, flags) ||
2063                     (Queue[qgrp]->qg_nextrun <= now &&
2064                      Queue[qgrp]->qg_nextrun != (time_t) -1))
2065                         break;
2066                 if (endgrp == WorkGrp[wgrp].wg_curqgrp)
2067                 {
2068                         e->e_id = NULL;
2069                         if (bitset(RWG_FORK, flags))
2070                                 finis(true, true, ExitStat);
2071                         return true; /* we're done */
2072                 }
2073         }
2074
2075         qdir = Queue[qgrp]->qg_curnum; /* round-robin init of queue position */
2076 #if _FFR_QUEUE_SCHED_DBG
2077         if (tTd(69, 12))
2078                 sm_syslog(LOG_INFO, NOQID,
2079                         "rwg: wgrp=%d, qgrp=%d, qdir=%d, name=%s, curqgrp=%d, numgrps=%d",
2080                         wgrp, qgrp, qdir, qid_printqueue(qgrp, qdir),
2081                         WorkGrp[wgrp].wg_curqgrp, WorkGrp[wgrp].wg_numqgrp);
2082 #endif /* _FFR_QUEUE_SCHED_DBG */
2083
2084 #if HASNICE
2085         /* tweak niceness of queue runs */
2086         if (Queue[qgrp]->qg_nice > 0)
2087                 (void) nice(Queue[qgrp]->qg_nice);
2088 #endif /* HASNICE */
2089
2090         /* XXX running queue group... */
2091         sm_setproctitle(true, CurEnv, "running queue: %s",
2092                         qid_printqueue(qgrp, qdir));
2093
2094         if (LogLevel > 69 || tTd(63, 99))
2095                 sm_syslog(LOG_DEBUG, NOQID,
2096                           "runqueue %s, pid=%d, forkflag=%d",
2097                           qid_printqueue(qgrp, qdir), (int) CurrentPid,
2098                           bitset(RWG_FORK, flags));
2099
2100         /*
2101         **  Start making passes through the queue.
2102         **      First, read and sort the entire queue.
2103         **      Then, process the work in that order.
2104         **              But if you take too long, start over.
2105         */
2106
2107         for (i = 0; i < Queue[qgrp]->qg_numqueues; i++)
2108         {
2109                 h = gatherq(qgrp, qdir, false, &full, &more);
2110 #if SM_CONF_SHM
2111                 if (ShmId != SM_SHM_NO_ID)
2112                         QSHM_ENTRIES(Queue[qgrp]->qg_qpaths[qdir].qp_idx) = h;
2113 #endif /* SM_CONF_SHM */
2114                 /* If there are no more items in this queue advance */
2115                 if (!more)
2116                 {
2117                         /* A round-robin advance */
2118                         qdir++;
2119                         qdir %= Queue[qgrp]->qg_numqueues;
2120                 }
2121
2122                 /* Has the WorkList reached the limit? */
2123                 if (full)
2124                         break; /* don't try to gather more */
2125         }
2126
2127         /* order the existing work requests */
2128         njobs = sortq(Queue[qgrp]->qg_maxlist);
2129         Queue[qgrp]->qg_curnum = qdir; /* update */
2130
2131
2132         if (!Verbose && bitnset(QD_FORK, Queue[qgrp]->qg_flags))
2133         {
2134                 int loop, maxrunners;
2135                 pid_t pid;
2136
2137                 /*
2138                 **  For this WorkQ we want to fork off N children (maxrunners)
2139                 **  at this point. Each child has a copy of WorkQ. Each child
2140                 **  will process every N-th item. The parent will wait for all
2141                 **  of the children to finish before moving on to the next
2142                 **  queue group within the work group. This saves us forking
2143                 **  a new runner-child for each work item.
2144                 **  It's valid for qg_maxqrun == 0 since this may be an
2145                 **  explicit "don't run this queue" setting.
2146                 */
2147
2148                 maxrunners = Queue[qgrp]->qg_maxqrun;
2149
2150                 /* No need to have more runners then there are jobs */
2151                 if (maxrunners > njobs)
2152                         maxrunners = njobs;
2153                 for (loop = 0; loop < maxrunners; loop++)
2154                 {
2155                         /*
2156                         **  Since the delivery may happen in a child and the
2157                         **  parent does not wait, the parent may close the
2158                         **  maps thereby removing any shared memory used by
2159                         **  the map.  Therefore, close the maps now so the
2160                         **  child will dynamically open them if necessary.
2161                         */
2162
2163                         closemaps(false);
2164
2165                         pid = fork();
2166                         if (pid < 0)
2167                         {
2168                                 syserr("run_work_group: cannot fork");
2169                                 return false;
2170                         }
2171                         else if (pid > 0)
2172                         {
2173                                 /* parent -- clean out connection cache */
2174                                 mci_flush(false, NULL);
2175 #if _FFR_SKIP_DOMAINS
2176                                 if (QueueSortOrder == QSO_BYHOST)
2177                                 {
2178                                         sequenceno += skip_domains(1);
2179                                 }
2180                                 else
2181 #endif /* _FFR_SKIP_DOMAINS */
2182                                 {
2183                                         /* for the skip */
2184                                         WorkQ = WorkQ->w_next;
2185                                         sequenceno++;
2186                                 }
2187                                 proc_list_add(pid, "Queue child runner process",
2188                                               PROC_QUEUE_CHILD, 0, -1, NULL);
2189
2190                                 /* No additional work, no additional runners */
2191                                 if (WorkQ == NULL)
2192                                         break;
2193                         }
2194                         else
2195                         {
2196                                 /* child -- Reset global flags */
2197                                 RestartRequest = NULL;
2198                                 RestartWorkGroup = false;
2199                                 ShutdownRequest = NULL;
2200                                 PendingSignal = 0;
2201                                 CurrentPid = getpid();
2202                                 close_sendmail_pid();
2203
2204                                 /*
2205                                 **  Initialize exception stack and default
2206                                 **  exception handler for child process.
2207                                 **  When fork()'d the child now has a private
2208                                 **  copy of WorkQ at its current position.
2209                                 */
2210
2211                                 sm_exc_newthread(fatal_error);
2212
2213                                 /*
2214                                 **  SMTP processes (whether -bd or -bs) set
2215                                 **  SIGCHLD to reapchild to collect
2216                                 **  children status.  However, at delivery
2217                                 **  time, that status must be collected
2218                                 **  by sm_wait() to be dealt with properly
2219                                 **  (check success of delivery based
2220                                 **  on status code, etc).  Therefore, if we
2221                                 **  are an SMTP process, reset SIGCHLD
2222                                 **  back to the default so reapchild
2223                                 **  doesn't collect status before
2224                                 **  sm_wait().
2225                                 */
2226
2227                                 if (OpMode == MD_SMTP ||
2228                                     OpMode == MD_DAEMON ||
2229                                     MaxQueueChildren > 0)
2230                                 {
2231                                         proc_list_clear();
2232                                         sm_releasesignal(SIGCHLD);
2233                                         (void) sm_signal(SIGCHLD, SIG_DFL);
2234                                 }
2235
2236                                 /* child -- error messages to the transcript */
2237                                 QuickAbort = OnlyOneError = false;
2238                                 runner_work(e, sequenceno, true,
2239                                             maxrunners, njobs);
2240
2241                                 /* This child is done */
2242                                 finis(true, true, ExitStat);
2243                                 /* NOTREACHED */
2244                         }
2245                 }
2246
2247                 sm_releasesignal(SIGCHLD);
2248
2249                 /*
2250                 **  Wait until all of the runners have completed before
2251                 **  seeing if there is another queue group in the
2252                 **  work group to process.
2253                 **  XXX Future enhancement: don't wait() for all children
2254                 **  here, just go ahead and make sure that overall the number
2255                 **  of children is not exceeded.
2256                 */
2257
2258                 while (CurChildren > 0)
2259                 {
2260                         int status;
2261                         pid_t ret;
2262
2263                         while ((ret = sm_wait(&status)) <= 0)
2264                                 continue;
2265                         proc_list_drop(ret, status, NULL);
2266                 }
2267         }
2268         else if (Queue[qgrp]->qg_maxqrun > 0 || bitset(RWG_FORCE, flags))
2269         {
2270                 /*
2271                 **  When current process will not fork children to do the work,
2272                 **  it will do the work itself. The 'skip' will be 1 since
2273                 **  there are no child runners to divide the work across.
2274                 */
2275
2276                 runner_work(e, sequenceno, false, 1, njobs);
2277         }
2278
2279         /* free memory allocated by newenvelope() above */
2280         sm_rpool_free(rpool);
2281         QueueEnvelope.e_rpool = NULL;
2282
2283         /* Are there still more queues in the work group to process? */
2284         if (endgrp != WorkGrp[wgrp].wg_curqgrp)
2285         {
2286                 rpool = sm_rpool_new_x(NULL);
2287                 e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2288                 e->e_flags = BlankEnvelope.e_flags;
2289                 goto domorework;
2290         }
2291
2292         /* No more queues in work group to process. Now check persistent. */
2293         if (bitset(RWG_PERSISTENT, flags))
2294         {
2295                 sequenceno = 1;
2296                 sm_setproctitle(true, CurEnv, "running queue: %s",
2297                                 qid_printqueue(qgrp, qdir));
2298
2299                 /*
2300                 **  close bogus maps, i.e., maps which caused a tempfail,
2301                 **      so we get fresh map connections on the next lookup.
2302                 **  closemaps() is also called when children are started.
2303                 */
2304
2305                 closemaps(true);
2306
2307                 /* Close any cached connections. */
2308                 mci_flush(true, NULL);
2309
2310                 /* Clean out expired related entries. */
2311                 rmexpstab();
2312
2313 #if NAMED_BIND
2314                 /* Update MX records for FallbackMX. */
2315                 if (FallbackMX != NULL)
2316                         (void) getfallbackmxrr(FallbackMX);
2317 #endif /* NAMED_BIND */
2318
2319 #if USERDB
2320                 /* close UserDatabase */
2321                 _udbx_close();
2322 #endif /* USERDB */
2323
2324 #if SM_HEAP_CHECK
2325                 if (sm_debug_active(&SmHeapCheck, 2)
2326                     && access("memdump", F_OK) == 0
2327                    )
2328                 {
2329                         SM_FILE_T *out;
2330
2331                         remove("memdump");
2332                         out = sm_io_open(SmFtStdio, SM_TIME_DEFAULT,
2333                                          "memdump.out", SM_IO_APPEND, NULL);
2334                         if (out != NULL)
2335                         {
2336                                 (void) sm_io_fprintf(out, SM_TIME_DEFAULT, "----------------------\n");
2337                                 sm_heap_report(out,
2338                                         sm_debug_level(&SmHeapCheck) - 1);
2339                                 (void) sm_io_close(out, SM_TIME_DEFAULT);
2340                         }
2341                 }
2342 #endif /* SM_HEAP_CHECK */
2343
2344                 /* let me rest for a second to catch my breath */
2345                 if (njobs == 0 && WorkGrp[wgrp].wg_lowqintvl < MIN_SLEEP_TIME)
2346                         sleep(MIN_SLEEP_TIME);
2347                 else if (WorkGrp[wgrp].wg_lowqintvl <= 0)
2348                         sleep(QueueIntvl > 0 ? QueueIntvl : MIN_SLEEP_TIME);
2349                 else
2350                         sleep(WorkGrp[wgrp].wg_lowqintvl);
2351
2352                 /*
2353                 **  Get the LA outside the WorkQ loop if necessary.
2354                 **  In a persistent queue runner the code is repeated over
2355                 **  and over but gatherq() may ignore entries due to
2356                 **  shouldqueue() (do we really have to do this twice?).
2357                 **  Hence the queue runners would just idle around when once
2358                 **  CurrentLA caused all entries in a queue to be ignored.
2359                 */
2360
2361                 if (njobs == 0)
2362                         SM_GET_LA(now);
2363                 rpool = sm_rpool_new_x(NULL);
2364                 e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2365                 e->e_flags = BlankEnvelope.e_flags;
2366                 goto domorework;
2367         }
2368
2369         /* exit without the usual cleanup */
2370         e->e_id = NULL;
2371         if (bitset(RWG_FORK, flags))
2372                 finis(true, true, ExitStat);
2373         /* NOTREACHED */
2374         return true;
2375 }
2376
2377 /*
2378 **  DOQUEUERUN -- do a queue run?
2379 */
2380
2381 bool
2382 doqueuerun()
2383 {
2384         return DoQueueRun;
2385 }
2386
2387 /*
2388 **  RUNQUEUEEVENT -- Sets a flag to indicate that a queue run should be done.
2389 **
2390 **      Parameters:
2391 **              none.
2392 **
2393 **      Returns:
2394 **              none.
2395 **
2396 **      Side Effects:
2397 **              The invocation of this function via an alarm may interrupt
2398 **              a set of actions. Thus errno may be set in that context.
2399 **              We need to restore errno at the end of this function to ensure
2400 **              that any work done here that sets errno doesn't return a
2401 **              misleading/false errno value. Errno may be EINTR upon entry to
2402 **              this function because of non-restartable/continuable system
2403 **              API was active. Iff this is true we will override errno as
2404 **              a timeout (as a more accurate error message).
2405 **
2406 **      NOTE:   THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
2407 **              ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
2408 **              DOING.
2409 */
2410
2411 void
2412 runqueueevent(ignore)
2413         int ignore;
2414 {
2415         int save_errno = errno;
2416
2417         /*
2418         **  Set the general bit that we want a queue run,
2419         **  tested in doqueuerun()
2420         */
2421
2422         DoQueueRun = true;
2423 #if _FFR_QUEUE_SCHED_DBG
2424         if (tTd(69, 10))
2425                 sm_syslog(LOG_INFO, NOQID, "rqe: done");
2426 #endif /* _FFR_QUEUE_SCHED_DBG */
2427
2428         errno = save_errno;
2429         if (errno == EINTR)
2430                 errno = ETIMEDOUT;
2431 }
2432 /*
2433 **  GATHERQ -- gather messages from the message queue(s) the work queue.
2434 **
2435 **      Parameters:
2436 **              qgrp -- the index of the queue group.
2437 **              qdir -- the index of the queue directory.
2438 **              doall -- if set, include everything in the queue (even
2439 **                      the jobs that cannot be run because the load
2440 **                      average is too high, or MaxQueueRun is reached).
2441 **                      Otherwise, exclude those jobs.
2442 **              full -- (optional) to be set 'true' if WorkList is full
2443 **              more -- (optional) to be set 'true' if there are still more
2444 **                      messages in this queue not added to WorkList
2445 **
2446 **      Returns:
2447 **              The number of request in the queue (not necessarily
2448 **              the number of requests in WorkList however).
2449 **
2450 **      Side Effects:
2451 **              prepares available work into WorkList
2452 */
2453
2454 #define NEED_P          0001    /* 'P': priority */
2455 #define NEED_T          0002    /* 'T': time */
2456 #define NEED_R          0004    /* 'R': recipient */
2457 #define NEED_S          0010    /* 'S': sender */
2458 #define NEED_H          0020    /* host */
2459 #define HAS_QUARANTINE  0040    /* has an unexpected 'q' line */
2460 #define NEED_QUARANTINE 0100    /* 'q': reason */
2461
2462 static WORK     *WorkList = NULL;       /* list of unsort work */
2463 static int      WorkListSize = 0;       /* current max size of WorkList */
2464 static int      WorkListCount = 0;      /* # of work items in WorkList */
2465
2466 static int
2467 gatherq(qgrp, qdir, doall, full, more)
2468         int qgrp;
2469         int qdir;
2470         bool doall;
2471         bool *full;
2472         bool *more;
2473 {
2474         register struct dirent *d;
2475         register WORK *w;
2476         register char *p;
2477         DIR *f;
2478         int i, num_ent;
2479         int wn;
2480         QUEUE_CHAR *check;
2481         char qd[MAXPATHLEN];
2482         char qf[MAXPATHLEN];
2483
2484         wn = WorkListCount - 1;
2485         num_ent = 0;
2486         if (qdir == NOQDIR)
2487                 (void) sm_strlcpy(qd, ".", sizeof(qd));
2488         else
2489                 (void) sm_strlcpyn(qd, sizeof(qd), 2,
2490                         Queue[qgrp]->qg_qpaths[qdir].qp_name,
2491                         (bitset(QP_SUBQF,
2492                                 Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
2493                                         ? "/qf" : ""));
2494
2495         if (tTd(41, 1))
2496         {
2497                 sm_dprintf("gatherq:\n");
2498
2499                 check = QueueLimitId;
2500                 while (check != NULL)
2501                 {
2502                         sm_dprintf("\tQueueLimitId = %s%s\n",
2503                                 check->queue_negate ? "!" : "",
2504                                 check->queue_match);
2505                         check = check->queue_next;
2506                 }
2507
2508                 check = QueueLimitSender;
2509                 while (check != NULL)
2510                 {
2511                         sm_dprintf("\tQueueLimitSender = %s%s\n",
2512                                 check->queue_negate ? "!" : "",
2513                                 check->queue_match);
2514                         check = check->queue_next;
2515                 }
2516
2517                 check = QueueLimitRecipient;
2518                 while (check != NULL)
2519                 {
2520                         sm_dprintf("\tQueueLimitRecipient = %s%s\n",
2521                                 check->queue_negate ? "!" : "",
2522                                 check->queue_match);
2523                         check = check->queue_next;
2524                 }
2525
2526                 if (QueueMode == QM_QUARANTINE)
2527                 {
2528                         check = QueueLimitQuarantine;
2529                         while (check != NULL)
2530                         {
2531                                 sm_dprintf("\tQueueLimitQuarantine = %s%s\n",
2532                                            check->queue_negate ? "!" : "",
2533                                            check->queue_match);
2534                                 check = check->queue_next;
2535                         }
2536                 }
2537         }
2538
2539         /* open the queue directory */
2540         f = opendir(qd);
2541         if (f == NULL)
2542         {
2543                 syserr("gatherq: cannot open \"%s\"",
2544                         qid_printqueue(qgrp, qdir));
2545                 if (full != NULL)
2546                         *full = WorkListCount >= MaxQueueRun && MaxQueueRun > 0;
2547                 if (more != NULL)
2548                         *more = false;
2549                 return 0;
2550         }
2551
2552         /*
2553         **  Read the work directory.
2554         */
2555
2556         while ((d = readdir(f)) != NULL)
2557         {
2558                 SM_FILE_T *cf;
2559                 int qfver = 0;
2560                 char lbuf[MAXNAME + 1];
2561                 struct stat sbuf;
2562
2563                 if (tTd(41, 50))
2564                         sm_dprintf("gatherq: checking %s..", d->d_name);
2565
2566                 /* is this an interesting entry? */
2567                 if (!(((QueueMode == QM_NORMAL &&
2568                         d->d_name[0] == NORMQF_LETTER) ||
2569                        (QueueMode == QM_QUARANTINE &&
2570                         d->d_name[0] == QUARQF_LETTER) ||
2571                        (QueueMode == QM_LOST &&
2572                         d->d_name[0] == LOSEQF_LETTER)) &&
2573                       d->d_name[1] == 'f'))
2574                 {
2575                         if (tTd(41, 50))
2576                                 sm_dprintf("  skipping\n");
2577                         continue;
2578                 }
2579                 if (tTd(41, 50))
2580                         sm_dprintf("\n");
2581
2582                 if (strlen(d->d_name) >= MAXQFNAME)
2583                 {
2584                         if (Verbose)
2585                                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
2586                                                      "gatherq: %s too long, %d max characters\n",
2587                                                      d->d_name, MAXQFNAME);
2588                         if (LogLevel > 0)
2589                                 sm_syslog(LOG_ALERT, NOQID,
2590                                           "gatherq: %s too long, %d max characters",
2591                                           d->d_name, MAXQFNAME);
2592                         continue;
2593                 }
2594
2595                 check = QueueLimitId;
2596                 while (check != NULL)
2597                 {
2598                         if (strcontainedin(false, check->queue_match,
2599                                            d->d_name) != check->queue_negate)
2600                                 break;
2601                         else
2602                                 check = check->queue_next;
2603                 }
2604                 if (QueueLimitId != NULL && check == NULL)
2605                         continue;
2606
2607                 /* grow work list if necessary */
2608                 if (++wn >= MaxQueueRun && MaxQueueRun > 0)
2609                 {
2610                         if (wn == MaxQueueRun && LogLevel > 0)
2611                                 sm_syslog(LOG_WARNING, NOQID,
2612                                           "WorkList for %s maxed out at %d",
2613                                           qid_printqueue(qgrp, qdir),
2614                                           MaxQueueRun);
2615                         if (doall)
2616                                 continue;       /* just count entries */
2617                         break;
2618                 }
2619                 if (wn >= WorkListSize)
2620                 {
2621                         grow_wlist(qgrp, qdir);
2622                         if (wn >= WorkListSize)
2623                                 continue;
2624                 }
2625                 SM_ASSERT(wn >= 0);
2626                 w = &WorkList[wn];
2627
2628                 (void) sm_strlcpyn(qf, sizeof(qf), 3, qd, "/", d->d_name);
2629                 if (stat(qf, &sbuf) < 0)
2630                 {
2631                         if (errno != ENOENT)
2632                                 sm_syslog(LOG_INFO, NOQID,
2633                                           "gatherq: can't stat %s/%s",
2634                                           qid_printqueue(qgrp, qdir),
2635                                           d->d_name);
2636                         wn--;
2637                         continue;
2638                 }
2639                 if (!bitset(S_IFREG, sbuf.st_mode))
2640                 {
2641                         /* Yikes!  Skip it or we will hang on open! */
2642                         if (!((d->d_name[0] == DATAFL_LETTER ||
2643                                d->d_name[0] == NORMQF_LETTER ||
2644                                d->d_name[0] == QUARQF_LETTER ||
2645                                d->d_name[0] == LOSEQF_LETTER ||
2646                                d->d_name[0] == XSCRPT_LETTER) &&
2647                               d->d_name[1] == 'f' && d->d_name[2] == '\0'))
2648                                 syserr("gatherq: %s/%s is not a regular file",
2649                                        qid_printqueue(qgrp, qdir), d->d_name);
2650                         wn--;
2651                         continue;
2652                 }
2653
2654                 /* avoid work if possible */
2655                 if ((QueueSortOrder == QSO_BYFILENAME ||
2656                      QueueSortOrder == QSO_BYMODTIME ||
2657                      QueueSortOrder == QSO_NONE ||
2658                      QueueSortOrder == QSO_RANDOM) &&
2659                     QueueLimitQuarantine == NULL &&
2660                     QueueLimitSender == NULL &&
2661                     QueueLimitRecipient == NULL)
2662                 {
2663                         w->w_qgrp = qgrp;
2664                         w->w_qdir = qdir;
2665                         w->w_name = newstr(d->d_name);
2666                         w->w_host = NULL;
2667                         w->w_lock = w->w_tooyoung = false;
2668                         w->w_pri = 0;
2669                         w->w_ctime = 0;
2670                         w->w_mtime = sbuf.st_mtime;
2671                         ++num_ent;
2672                         continue;
2673                 }
2674
2675                 /* open control file */
2676                 cf = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
2677                                 NULL);
2678                 if (cf == NULL && OpMode != MD_PRINT)
2679                 {
2680                         /* this may be some random person sending hir msgs */
2681                         if (tTd(41, 2))
2682                                 sm_dprintf("gatherq: cannot open %s: %s\n",
2683                                         d->d_name, sm_errstring(errno));
2684                         errno = 0;
2685                         wn--;
2686                         continue;
2687                 }
2688                 w->w_qgrp = qgrp;
2689                 w->w_qdir = qdir;
2690                 w->w_name = newstr(d->d_name);
2691                 w->w_host = NULL;
2692                 if (cf != NULL)
2693                 {
2694                         w->w_lock = !lockfile(sm_io_getinfo(cf, SM_IO_WHAT_FD,
2695                                                             NULL),
2696                                               w->w_name, NULL,
2697                                               LOCK_SH|LOCK_NB);
2698                 }
2699                 w->w_tooyoung = false;
2700
2701                 /* make sure jobs in creation don't clog queue */
2702                 w->w_pri = 0x7fffffff;
2703                 w->w_ctime = 0;
2704                 w->w_mtime = sbuf.st_mtime;
2705
2706                 /* extract useful information */
2707                 i = NEED_P|NEED_T;
2708                 if (QueueSortOrder == QSO_BYHOST
2709 #if _FFR_RHS
2710                     || QueueSortOrder == QSO_BYSHUFFLE
2711 #endif /* _FFR_RHS */
2712                    )
2713                 {
2714                         /* need w_host set for host sort order */
2715                         i |= NEED_H;
2716                 }
2717                 if (QueueLimitSender != NULL)
2718                         i |= NEED_S;
2719                 if (QueueLimitRecipient != NULL)
2720                         i |= NEED_R;
2721                 if (QueueLimitQuarantine != NULL)
2722                         i |= NEED_QUARANTINE;
2723                 while (cf != NULL && i != 0 &&
2724                        sm_io_fgets(cf, SM_TIME_DEFAULT, lbuf,
2725                                    sizeof(lbuf)) != NULL)
2726                 {
2727                         int c;
2728                         time_t age;
2729
2730                         p = strchr(lbuf, '\n');
2731                         if (p != NULL)
2732                                 *p = '\0';
2733                         else
2734                         {
2735                                 /* flush rest of overly long line */
2736                                 while ((c = sm_io_getc(cf, SM_TIME_DEFAULT))
2737                                        != SM_IO_EOF && c != '\n')
2738                                         continue;
2739                         }
2740
2741                         switch (lbuf[0])
2742                         {
2743                           case 'V':
2744                                 qfver = atoi(&lbuf[1]);
2745                                 break;
2746
2747                           case 'P':
2748                                 w->w_pri = atol(&lbuf[1]);
2749                                 i &= ~NEED_P;
2750                                 break;
2751
2752                           case 'T':
2753                                 w->w_ctime = atol(&lbuf[1]);
2754                                 i &= ~NEED_T;
2755                                 break;
2756
2757                           case 'q':
2758                                 if (QueueMode != QM_QUARANTINE &&
2759                                     QueueMode != QM_LOST)
2760                                 {
2761                                         if (tTd(41, 49))
2762                                                 sm_dprintf("%s not marked as quarantined but has a 'q' line\n",
2763                                                            w->w_name);
2764                                         i |= HAS_QUARANTINE;
2765                                 }
2766                                 else if (QueueMode == QM_QUARANTINE)
2767                                 {
2768                                         if (QueueLimitQuarantine == NULL)
2769                                         {
2770                                                 i &= ~NEED_QUARANTINE;
2771                                                 break;
2772                                         }
2773                                         p = &lbuf[1];
2774                                         check = QueueLimitQuarantine;
2775                                         while (check != NULL)
2776                                         {
2777                                                 if (strcontainedin(false,
2778                                                                    check->queue_match,
2779                                                                    p) !=
2780                                                     check->queue_negate)
2781                                                         break;
2782                                                 else
2783                                                         check = check->queue_next;
2784                                         }
2785                                         if (check != NULL)
2786                                                 i &= ~NEED_QUARANTINE;
2787                                 }
2788                                 break;
2789
2790                           case 'R':
2791                                 if (w->w_host == NULL &&
2792                                     (p = strrchr(&lbuf[1], '@')) != NULL)
2793                                 {
2794 #if _FFR_RHS
2795                                         if (QueueSortOrder == QSO_BYSHUFFLE)
2796                                                 w->w_host = newstr(&p[1]);
2797                                         else
2798 #endif /* _FFR_RHS */
2799                                                 w->w_host = strrev(&p[1]);
2800                                         makelower(w->w_host);
2801                                         i &= ~NEED_H;
2802                                 }
2803                                 if (QueueLimitRecipient == NULL)
2804                                 {
2805                                         i &= ~NEED_R;
2806                                         break;
2807                                 }
2808                                 if (qfver > 0)
2809                                 {
2810                                         p = strchr(&lbuf[1], ':');
2811                                         if (p == NULL)
2812                                                 p = &lbuf[1];
2813                                         else
2814                                                 ++p; /* skip over ':' */
2815                                 }
2816                                 else
2817                                         p = &lbuf[1];
2818                                 check = QueueLimitRecipient;
2819                                 while (check != NULL)
2820                                 {
2821                                         if (strcontainedin(true,
2822                                                            check->queue_match,
2823                                                            p) !=
2824                                             check->queue_negate)
2825                                                 break;
2826                                         else
2827                                                 check = check->queue_next;
2828                                 }
2829                                 if (check != NULL)
2830                                         i &= ~NEED_R;
2831                                 break;
2832
2833                           case 'S':
2834                                 check = QueueLimitSender;
2835                                 while (check != NULL)
2836                                 {
2837                                         if (strcontainedin(true,
2838                                                            check->queue_match,
2839                                                            &lbuf[1]) !=
2840                                             check->queue_negate)
2841                                                 break;
2842                                         else
2843                                                 check = check->queue_next;
2844                                 }
2845                                 if (check != NULL)
2846                                         i &= ~NEED_S;
2847                                 break;
2848
2849                           case 'K':
2850                                 age = curtime() - (time_t) atol(&lbuf[1]);
2851                                 if (age >= 0 && MinQueueAge > 0 &&
2852                                     age < MinQueueAge)
2853                                         w->w_tooyoung = true;
2854                                 break;
2855
2856                           case 'N':
2857                                 if (atol(&lbuf[1]) == 0)
2858                                         w->w_tooyoung = false;
2859                                 break;
2860                         }
2861                 }
2862                 if (cf != NULL)
2863                         (void) sm_io_close(cf, SM_TIME_DEFAULT);
2864
2865                 if ((!doall && (shouldqueue(w->w_pri, w->w_ctime) ||
2866                     w->w_tooyoung)) ||
2867                     bitset(HAS_QUARANTINE, i) ||
2868                     bitset(NEED_QUARANTINE, i) ||
2869                     bitset(NEED_R|NEED_S, i))
2870                 {
2871                         /* don't even bother sorting this job in */
2872                         if (tTd(41, 49))
2873                                 sm_dprintf("skipping %s (%x)\n", w->w_name, i);
2874                         sm_free(w->w_name); /* XXX */
2875                         if (w->w_host != NULL)
2876                                 sm_free(w->w_host); /* XXX */
2877                         wn--;
2878                 }
2879                 else
2880                         ++num_ent;
2881         }
2882         (void) closedir(f);
2883         wn++;
2884
2885         i = wn - WorkListCount;
2886         WorkListCount += SM_MIN(num_ent, WorkListSize);
2887
2888         if (more != NULL)
2889                 *more = WorkListCount < wn;
2890
2891         if (full != NULL)
2892                 *full = (wn >= MaxQueueRun && MaxQueueRun > 0) ||
2893                         (WorkList == NULL && wn > 0);
2894
2895         return i;
2896 }
2897 /*
2898 **  SORTQ -- sort the work list
2899 **
2900 **      First the old WorkQ is cleared away. Then the WorkList is sorted
2901 **      for all items so that important (higher sorting value) items are not
2902 **      trunctated off. Then the most important items are moved from
2903 **      WorkList to WorkQ. The lower count of 'max' or MaxListCount items
2904 **      are moved.
2905 **
2906 **      Parameters:
2907 **              max -- maximum number of items to be placed in WorkQ
2908 **
2909 **      Returns:
2910 **              the number of items in WorkQ
2911 **
2912 **      Side Effects:
2913 **              WorkQ gets released and filled with new work. WorkList
2914 **              gets released. Work items get sorted in order.
2915 */
2916
2917 static int
2918 sortq(max)
2919         int max;
2920 {
2921         register int i;                 /* local counter */
2922         register WORK *w;               /* tmp item pointer */
2923         int wc = WorkListCount;         /* trim size for WorkQ */
2924
2925         if (WorkQ != NULL)
2926         {
2927                 WORK *nw;
2928
2929                 /* Clear out old WorkQ. */
2930                 for (w = WorkQ; w != NULL; w = nw)
2931                 {
2932                         nw = w->w_next;
2933                         sm_free(w->w_name); /* XXX */
2934                         if (w->w_host != NULL)
2935                                 sm_free(w->w_host); /* XXX */
2936                         sm_free((char *) w); /* XXX */
2937                 }
2938                 WorkQ = NULL;
2939         }
2940
2941         if (WorkList == NULL || wc <= 0)
2942                 return 0;
2943
2944         /*
2945         **  The sort now takes place using all of the items in WorkList.
2946         **  The list gets trimmed to the most important items after the sort.
2947         **  If the trim were to happen before the sort then one or more
2948         **  important items might get truncated off -- not what we want.
2949         */
2950
2951         if (QueueSortOrder == QSO_BYHOST)
2952         {
2953                 /*
2954                 **  Sort the work directory for the first time,
2955                 **  based on host name, lock status, and priority.
2956                 */
2957
2958                 qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf1);
2959
2960                 /*
2961                 **  If one message to host is locked, "lock" all messages
2962                 **  to that host.
2963                 */
2964
2965                 i = 0;
2966                 while (i < wc)
2967                 {
2968                         if (!WorkList[i].w_lock)
2969                         {
2970                                 i++;
2971                                 continue;
2972                         }
2973                         w = &WorkList[i];
2974                         while (++i < wc)
2975                         {
2976                                 if (WorkList[i].w_host == NULL &&
2977                                     w->w_host == NULL)
2978                                         WorkList[i].w_lock = true;
2979                                 else if (WorkList[i].w_host != NULL &&
2980                                          w->w_host != NULL &&
2981                                          sm_strcasecmp(WorkList[i].w_host,
2982                                                        w->w_host) == 0)
2983                                         WorkList[i].w_lock = true;
2984                                 else
2985                                         break;
2986                         }
2987                 }
2988
2989                 /*
2990                 **  Sort the work directory for the second time,
2991                 **  based on lock status, host name, and priority.
2992                 */
2993
2994                 qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf2);
2995         }
2996         else if (QueueSortOrder == QSO_BYTIME)
2997         {
2998                 /*
2999                 **  Simple sort based on submission time only.
3000                 */
3001
3002                 qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf3);
3003         }
3004         else if (QueueSortOrder == QSO_BYFILENAME)
3005         {
3006                 /*
3007                 **  Sort based on queue filename.
3008                 */
3009
3010                 qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf4);
3011         }
3012         else if (QueueSortOrder == QSO_RANDOM)
3013         {
3014                 /*
3015                 **  Sort randomly.  To avoid problems with an instable sort,
3016                 **  use a random index into the queue file name to start
3017                 **  comparison.
3018                 */
3019
3020                 randi = get_rand_mod(MAXQFNAME);
3021                 if (randi < 2)
3022                         randi = 3;
3023                 qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf5);
3024         }
3025         else if (QueueSortOrder == QSO_BYMODTIME)
3026         {
3027                 /*
3028                 **  Simple sort based on modification time of queue file.
3029                 **  This puts the oldest items first.
3030                 */
3031
3032                 qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf6);
3033         }
3034 #if _FFR_RHS
3035         else if (QueueSortOrder == QSO_BYSHUFFLE)
3036         {
3037                 /*
3038                 **  Simple sort based on shuffled host name.
3039                 */
3040
3041                 init_shuffle_alphabet();
3042                 qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf7);
3043         }
3044 #endif /* _FFR_RHS */
3045         else if (QueueSortOrder == QSO_BYPRIORITY)
3046         {
3047                 /*
3048                 **  Simple sort based on queue priority only.
3049                 */
3050
3051                 qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf0);
3052         }
3053         /* else don't sort at all */
3054
3055         /* Check if the per queue group item limit will be exceeded */
3056         if (wc > max && max > 0)
3057                 wc = max;
3058
3059         /*
3060         **  Convert the work list into canonical form.
3061         **      Should be turning it into a list of envelopes here perhaps.
3062         **  Only take the most important items up to the per queue group
3063         **  maximum.
3064         */
3065
3066         for (i = wc; --i >= 0; )
3067         {
3068                 w = (WORK *) xalloc(sizeof(*w));
3069                 w->w_qgrp = WorkList[i].w_qgrp;
3070                 w->w_qdir = WorkList[i].w_qdir;
3071                 w->w_name = WorkList[i].w_name;
3072                 w->w_host = WorkList[i].w_host;
3073                 w->w_lock = WorkList[i].w_lock;
3074                 w->w_tooyoung = WorkList[i].w_tooyoung;
3075                 w->w_pri = WorkList[i].w_pri;
3076                 w->w_ctime = WorkList[i].w_ctime;
3077                 w->w_mtime = WorkList[i].w_mtime;
3078                 w->w_next = WorkQ;
3079                 WorkQ = w;
3080         }
3081
3082         /* free the rest of the list */
3083         for (i = WorkListCount; --i >= wc; )
3084         {
3085                 sm_free(WorkList[i].w_name);
3086                 if (WorkList[i].w_host != NULL)
3087                         sm_free(WorkList[i].w_host);
3088         }
3089
3090         if (WorkList != NULL)
3091                 sm_free(WorkList); /* XXX */
3092         WorkList = NULL;
3093         WorkListSize = 0;
3094         WorkListCount = 0;
3095
3096         if (tTd(40, 1))
3097         {
3098                 for (w = WorkQ; w != NULL; w = w->w_next)
3099                 {
3100                         if (w->w_host != NULL)
3101                                 sm_dprintf("%22s: pri=%ld %s\n",
3102                                         w->w_name, w->w_pri, w->w_host);
3103                         else
3104                                 sm_dprintf("%32s: pri=%ld\n",
3105                                         w->w_name, w->w_pri);
3106                 }
3107         }
3108
3109         return wc; /* return number of WorkQ items */
3110 }
3111 /*
3112 **  GROW_WLIST -- make the work list larger
3113 **
3114 **      Parameters:
3115 **              qgrp -- the index for the queue group.
3116 **              qdir -- the index for the queue directory.
3117 **
3118 **      Returns:
3119 **              none.
3120 **
3121 **      Side Effects:
3122 **              Adds another QUEUESEGSIZE entries to WorkList if possible.
3123 **              It can fail if there isn't enough memory, so WorkListSize
3124 **              should be checked again upon return.
3125 */
3126
3127 static void
3128 grow_wlist(qgrp, qdir)
3129         int qgrp;
3130         int qdir;
3131 {
3132         if (tTd(41, 1))
3133                 sm_dprintf("grow_wlist: WorkListSize=%d\n", WorkListSize);
3134         if (WorkList == NULL)
3135         {
3136                 WorkList = (WORK *) xalloc((sizeof(*WorkList)) *
3137                                            (QUEUESEGSIZE + 1));
3138                 WorkListSize = QUEUESEGSIZE;
3139         }
3140         else
3141         {
3142                 int newsize = WorkListSize + QUEUESEGSIZE;
3143                 WORK *newlist = (WORK *) sm_realloc((char *) WorkList,
3144                                           (unsigned) sizeof(WORK) * (newsize + 1));
3145
3146                 if (newlist != NULL)
3147                 {
3148                         WorkListSize = newsize;
3149                         WorkList = newlist;
3150                         if (LogLevel > 1)
3151                         {
3152                                 sm_syslog(LOG_INFO, NOQID,
3153                                           "grew WorkList for %s to %d",
3154                                           qid_printqueue(qgrp, qdir),
3155                                           WorkListSize);
3156                         }
3157                 }
3158                 else if (LogLevel > 0)
3159                 {
3160                         sm_syslog(LOG_ALERT, NOQID,
3161                                   "FAILED to grow WorkList for %s to %d",
3162                                   qid_printqueue(qgrp, qdir), newsize);
3163                 }
3164         }
3165         if (tTd(41, 1))
3166                 sm_dprintf("grow_wlist: WorkListSize now %d\n", WorkListSize);
3167 }
3168 /*
3169 **  WORKCMPF0 -- simple priority-only compare function.
3170 **
3171 **      Parameters:
3172 **              a -- the first argument.
3173 **              b -- the second argument.
3174 **
3175 **      Returns:
3176 **              -1 if a < b
3177 **               0 if a == b
3178 **              +1 if a > b
3179 **
3180 */
3181
3182 static int
3183 workcmpf0(a, b)
3184         register WORK *a;
3185         register WORK *b;
3186 {
3187         long pa = a->w_pri;
3188         long pb = b->w_pri;
3189
3190         if (pa == pb)
3191                 return 0;
3192         else if (pa > pb)
3193                 return 1;
3194         else
3195                 return -1;
3196 }
3197 /*
3198 **  WORKCMPF1 -- first compare function for ordering work based on host name.
3199 **
3200 **      Sorts on host name, lock status, and priority in that order.
3201 **
3202 **      Parameters:
3203 **              a -- the first argument.
3204 **              b -- the second argument.
3205 **
3206 **      Returns:
3207 **              <0 if a < b
3208 **               0 if a == b
3209 **              >0 if a > b
3210 **
3211 */
3212
3213 static int
3214 workcmpf1(a, b)
3215         register WORK *a;
3216         register WORK *b;
3217 {
3218         int i;
3219
3220         /* host name */
3221         if (a->w_host != NULL && b->w_host == NULL)
3222                 return 1;
3223         else if (a->w_host == NULL && b->w_host != NULL)
3224                 return -1;
3225         if (a->w_host != NULL && b->w_host != NULL &&
3226             (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3227                 return i;
3228
3229         /* lock status */
3230         if (a->w_lock != b->w_lock)
3231                 return b->w_lock - a->w_lock;
3232
3233         /* job priority */
3234         return workcmpf0(a, b);
3235 }
3236 /*
3237 **  WORKCMPF2 -- second compare function for ordering work based on host name.
3238 **
3239 **      Sorts on lock status, host name, and priority in that order.
3240 **
3241 **      Parameters:
3242 **              a -- the first argument.
3243 **              b -- the second argument.
3244 **
3245 **      Returns:
3246 **              <0 if a < b
3247 **               0 if a == b
3248 **              >0 if a > b
3249 **
3250 */
3251
3252 static int
3253 workcmpf2(a, b)
3254         register WORK *a;
3255         register WORK *b;
3256 {
3257         int i;
3258
3259         /* lock status */
3260         if (a->w_lock != b->w_lock)
3261                 return a->w_lock - b->w_lock;
3262
3263         /* host name */
3264         if (a->w_host != NULL && b->w_host == NULL)
3265                 return 1;
3266         else if (a->w_host == NULL && b->w_host != NULL)
3267                 return -1;
3268         if (a->w_host != NULL && b->w_host != NULL &&
3269             (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3270                 return i;
3271
3272         /* job priority */
3273         return workcmpf0(a, b);
3274 }
3275 /*
3276 **  WORKCMPF3 -- simple submission-time-only compare function.
3277 **
3278 **      Parameters:
3279 **              a -- the first argument.
3280 **              b -- the second argument.
3281 **
3282 **      Returns:
3283 **              -1 if a < b
3284 **               0 if a == b
3285 **              +1 if a > b
3286 **
3287 */
3288
3289 static int
3290 workcmpf3(a, b)
3291         register WORK *a;
3292         register WORK *b;
3293 {
3294         if (a->w_ctime > b->w_ctime)
3295                 return 1;
3296         else if (a->w_ctime < b->w_ctime)
3297                 return -1;
3298         else
3299                 return 0;
3300 }
3301 /*
3302 **  WORKCMPF4 -- compare based on file name
3303 **
3304 **      Parameters:
3305 **              a -- the first argument.
3306 **              b -- the second argument.
3307 **
3308 **      Returns:
3309 **              -1 if a < b
3310 **               0 if a == b
3311 **              +1 if a > b
3312 **
3313 */
3314
3315 static int
3316 workcmpf4(a, b)
3317         register WORK *a;
3318         register WORK *b;
3319 {
3320         return strcmp(a->w_name, b->w_name);
3321 }
3322 /*
3323 **  WORKCMPF5 -- compare based on assigned random number
3324 **
3325 **      Parameters:
3326 **              a -- the first argument (ignored).
3327 **              b -- the second argument (ignored).
3328 **
3329 **      Returns:
3330 **              randomly 1/-1
3331 */
3332
3333 /* ARGSUSED0 */
3334 static int
3335 workcmpf5(a, b)
3336         register WORK *a;
3337         register WORK *b;
3338 {
3339         if (strlen(a->w_name) < randi || strlen(b->w_name) < randi)
3340                 return -1;
3341         return a->w_name[randi] - b->w_name[randi];
3342 }
3343 /*
3344 **  WORKCMPF6 -- simple modification-time-only compare function.
3345 **
3346 **      Parameters:
3347 **              a -- the first argument.
3348 **              b -- the second argument.
3349 **
3350 **      Returns:
3351 **              -1 if a < b
3352 **               0 if a == b
3353 **              +1 if a > b
3354 **
3355 */
3356
3357 static int
3358 workcmpf6(a, b)
3359         register WORK *a;
3360         register WORK *b;
3361 {
3362         if (a->w_mtime > b->w_mtime)
3363                 return 1;
3364         else if (a->w_mtime < b->w_mtime)
3365                 return -1;
3366         else
3367                 return 0;
3368 }
3369 #if _FFR_RHS
3370 /*
3371 **  WORKCMPF7 -- compare function for ordering work based on shuffled host name.
3372 **
3373 **      Sorts on lock status, host name, and priority in that order.
3374 **
3375 **      Parameters:
3376 **              a -- the first argument.
3377 **              b -- the second argument.
3378 **
3379 **      Returns:
3380 **              <0 if a < b
3381 **               0 if a == b
3382 **              >0 if a > b
3383 **
3384 */
3385
3386 static int
3387 workcmpf7(a, b)
3388         register WORK *a;
3389         register WORK *b;
3390 {
3391         int i;
3392
3393         /* lock status */
3394         if (a->w_lock != b->w_lock)
3395                 return a->w_lock - b->w_lock;
3396
3397         /* host name */
3398         if (a->w_host != NULL && b->w_host == NULL)
3399                 return 1;
3400         else if (a->w_host == NULL && b->w_host != NULL)
3401                 return -1;
3402         if (a->w_host != NULL && b->w_host != NULL &&
3403             (i = sm_strshufflecmp(a->w_host, b->w_host)) != 0)
3404                 return i;
3405
3406         /* job priority */
3407         return workcmpf0(a, b);
3408 }
3409 #endif /* _FFR_RHS */
3410 /*
3411 **  STRREV -- reverse string
3412 **
3413 **      Returns a pointer to a new string that is the reverse of
3414 **      the string pointed to by fwd.  The space for the new
3415 **      string is obtained using xalloc().
3416 **
3417 **      Parameters:
3418 **              fwd -- the string to reverse.
3419 **
3420 **      Returns:
3421 **              the reversed string.
3422 */
3423
3424 static char *
3425 strrev(fwd)
3426         char *fwd;
3427 {
3428         char *rev = NULL;
3429         int len, cnt;
3430
3431         len = strlen(fwd);
3432         rev = xalloc(len + 1);
3433         for (cnt = 0; cnt < len; ++cnt)
3434                 rev[cnt] = fwd[len - cnt - 1];
3435         rev[len] = '\0';
3436         return rev;
3437 }
3438
3439 #if _FFR_RHS
3440
3441 # define NASCII 128
3442 # define NCHAR  256
3443
3444 static unsigned char ShuffledAlphabet[NCHAR];
3445
3446 void
3447 init_shuffle_alphabet()
3448 {
3449         static bool init = false;
3450         int i;
3451
3452         if (init)
3453                 return;
3454
3455         /* fill the ShuffledAlphabet */
3456         for (i = 0; i < NASCII; i++)
3457                 ShuffledAlphabet[i] = i;
3458
3459         /* mix it */
3460         for (i = 1; i < NASCII; i++)
3461         {
3462                 register int j = get_random() % NASCII;
3463                 register int tmp;
3464
3465                 tmp = ShuffledAlphabet[j];
3466                 ShuffledAlphabet[j] = ShuffledAlphabet[i];
3467                 ShuffledAlphabet[i] = tmp;
3468         }
3469
3470         /* make it case insensitive */
3471         for (i = 'A'; i <= 'Z'; i++)
3472                 ShuffledAlphabet[i] = ShuffledAlphabet[i + 'a' - 'A'];
3473
3474         /* fill the upper part */
3475         for (i = 0; i < NASCII; i++)
3476                 ShuffledAlphabet[i + NASCII] = ShuffledAlphabet[i];
3477         init = true;
3478 }
3479
3480 static int
3481 sm_strshufflecmp(a, b)
3482         char *a;
3483         char *b;
3484 {
3485         const unsigned char *us1 = (const unsigned char *) a;
3486         const unsigned char *us2 = (const unsigned char *) b;
3487
3488         while (ShuffledAlphabet[*us1] == ShuffledAlphabet[*us2++])
3489         {
3490                 if (*us1++ == '\0')
3491                         return 0;
3492         }
3493         return (ShuffledAlphabet[*us1] - ShuffledAlphabet[*--us2]);
3494 }
3495 #endif /* _FFR_RHS */
3496
3497 /*
3498 **  DOWORK -- do a work request.
3499 **
3500 **      Parameters:
3501 **              qgrp -- the index of the queue group for the job.
3502 **              qdir -- the index of the queue directory for the job.
3503 **              id -- the ID of the job to run.
3504 **              forkflag -- if set, run this in background.
3505 **              requeueflag -- if set, reinstantiate the queue quickly.
3506 **                      This is used when expanding aliases in the queue.
3507 **                      If forkflag is also set, it doesn't wait for the
3508 **                      child.
3509 **              e - the envelope in which to run it.
3510 **
3511 **      Returns:
3512 **              process id of process that is running the queue job.
3513 **
3514 **      Side Effects:
3515 **              The work request is satisfied if possible.
3516 */
3517
3518 pid_t
3519 dowork(qgrp, qdir, id, forkflag, requeueflag, e)
3520         int qgrp;
3521         int qdir;
3522         char *id;
3523         bool forkflag;
3524         bool requeueflag;
3525         register ENVELOPE *e;
3526 {
3527         register pid_t pid;
3528         SM_RPOOL_T *rpool;
3529
3530         if (tTd(40, 1))
3531                 sm_dprintf("dowork(%s/%s)\n", qid_printqueue(qgrp, qdir), id);
3532
3533         /*
3534         **  Fork for work.
3535         */
3536
3537         if (forkflag)
3538         {
3539                 /*
3540                 **  Since the delivery may happen in a child and the
3541                 **  parent does not wait, the parent may close the
3542                 **  maps thereby removing any shared memory used by
3543                 **  the map.  Therefore, close the maps now so the
3544                 **  child will dynamically open them if necessary.
3545                 */
3546
3547                 closemaps(false);
3548
3549                 pid = fork();
3550                 if (pid < 0)
3551                 {
3552                         syserr("dowork: cannot fork");
3553                         return 0;
3554                 }
3555                 else if (pid > 0)
3556                 {
3557                         /* parent -- clean out connection cache */
3558                         mci_flush(false, NULL);
3559                 }
3560                 else
3561                 {
3562                         /*
3563                         **  Initialize exception stack and default exception
3564                         **  handler for child process.
3565                         */
3566
3567                         /* Reset global flags */
3568                         RestartRequest = NULL;
3569                         RestartWorkGroup = false;
3570                         ShutdownRequest = NULL;
3571                         PendingSignal = 0;
3572                         CurrentPid = getpid();
3573                         sm_exc_newthread(fatal_error);
3574
3575                         /*
3576                         **  See note above about SMTP processes and SIGCHLD.
3577                         */
3578
3579                         if (OpMode == MD_SMTP ||
3580                             OpMode == MD_DAEMON ||
3581                             MaxQueueChildren > 0)
3582                         {
3583                                 proc_list_clear();
3584                                 sm_releasesignal(SIGCHLD);
3585                                 (void) sm_signal(SIGCHLD, SIG_DFL);
3586                         }
3587
3588                         /* child -- error messages to the transcript */
3589                         QuickAbort = OnlyOneError = false;
3590                 }
3591         }
3592         else
3593         {
3594                 pid = 0;
3595         }
3596
3597         if (pid == 0)
3598         {
3599                 /*
3600                 **  CHILD
3601                 **      Lock the control file to avoid duplicate deliveries.
3602                 **              Then run the file as though we had just read it.
3603                 **      We save an idea of the temporary name so we
3604                 **              can recover on interrupt.
3605                 */
3606
3607                 if (forkflag)
3608                 {
3609                         /* Reset global flags */
3610                         RestartRequest = NULL;
3611                         RestartWorkGroup = false;
3612                         ShutdownRequest = NULL;
3613                         PendingSignal = 0;
3614                 }
3615
3616                 /* set basic modes, etc. */
3617                 sm_clear_events();
3618                 clearstats();
3619                 rpool = sm_rpool_new_x(NULL);
3620                 clearenvelope(e, false, rpool);
3621                 e->e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3622                 set_delivery_mode(SM_DELIVER, e);
3623                 e->e_errormode = EM_MAIL;
3624                 e->e_id = id;
3625                 e->e_qgrp = qgrp;
3626                 e->e_qdir = qdir;
3627                 GrabTo = UseErrorsTo = false;
3628                 ExitStat = EX_OK;
3629                 if (forkflag)
3630                 {
3631                         disconnect(1, e);
3632                         set_op_mode(MD_QUEUERUN);
3633                 }
3634                 sm_setproctitle(true, e, "%s from queue", qid_printname(e));
3635                 if (LogLevel > 76)
3636                         sm_syslog(LOG_DEBUG, e->e_id, "dowork, pid=%d",
3637                                   (int) CurrentPid);
3638
3639                 /* don't use the headers from sendmail.cf... */
3640                 e->e_header = NULL;
3641
3642                 /* read the queue control file -- return if locked */
3643                 if (!readqf(e, false))
3644                 {
3645                         if (tTd(40, 4) && e->e_id != NULL)
3646                                 sm_dprintf("readqf(%s) failed\n",
3647                                         qid_printname(e));
3648                         e->e_id = NULL;
3649                         if (forkflag)
3650                                 finis(false, true, EX_OK);
3651                         else
3652                         {
3653                                 /* adding this frees 8 bytes */
3654                                 clearenvelope(e, false, rpool);
3655
3656                                 /* adding this frees 12 bytes */
3657                                 sm_rpool_free(rpool);
3658                                 e->e_rpool = NULL;
3659                                 return 0;
3660                         }
3661                 }
3662
3663                 e->e_flags |= EF_INQUEUE;
3664                 eatheader(e, requeueflag, true);
3665
3666                 if (requeueflag)
3667                         queueup(e, false, false);
3668
3669                 /* do the delivery */
3670                 sendall(e, SM_DELIVER);
3671
3672                 /* finish up and exit */
3673                 if (forkflag)
3674                         finis(true, true, ExitStat);
3675                 else
3676                 {
3677                         dropenvelope(e, true, false);
3678                         sm_rpool_free(rpool);
3679                         e->e_rpool = NULL;
3680                 }
3681         }
3682         e->e_id = NULL;
3683         return pid;
3684 }
3685
3686 /*
3687 **  DOWORKLIST -- process a list of envelopes as work requests
3688 **
3689 **      Similar to dowork(), except that after forking, it processes an
3690 **      envelope and its siblings, treating each envelope as a work request.
3691 **
3692 **      Parameters:
3693 **              el -- envelope to be processed including its siblings.
3694 **              forkflag -- if set, run this in background.
3695 **              requeueflag -- if set, reinstantiate the queue quickly.
3696 **                      This is used when expanding aliases in the queue.
3697 **                      If forkflag is also set, it doesn't wait for the
3698 **                      child.
3699 **
3700 **      Returns:
3701 **              process id of process that is running the queue job.
3702 **
3703 **      Side Effects:
3704 **              The work request is satisfied if possible.
3705 */
3706
3707 pid_t
3708 doworklist(el, forkflag, requeueflag)
3709         ENVELOPE *el;
3710         bool forkflag;
3711         bool requeueflag;
3712 {
3713         register pid_t pid;
3714         ENVELOPE *ei;
3715
3716         if (tTd(40, 1))
3717                 sm_dprintf("doworklist()\n");
3718
3719         /*
3720         **  Fork for work.
3721         */
3722
3723         if (forkflag)
3724         {
3725                 /*
3726                 **  Since the delivery may happen in a child and the
3727                 **  parent does not wait, the parent may close the
3728                 **  maps thereby removing any shared memory used by
3729                 **  the map.  Therefore, close the maps now so the
3730                 **  child will dynamically open them if necessary.
3731                 */
3732
3733                 closemaps(false);
3734
3735                 pid = fork();
3736                 if (pid < 0)
3737                 {
3738                         syserr("doworklist: cannot fork");
3739                         return 0;
3740                 }
3741                 else if (pid > 0)
3742                 {
3743                         /* parent -- clean out connection cache */
3744                         mci_flush(false, NULL);
3745                 }
3746                 else
3747                 {
3748                         /*
3749                         **  Initialize exception stack and default exception
3750                         **  handler for child process.
3751                         */
3752
3753                         /* Reset global flags */
3754                         RestartRequest = NULL;
3755                         RestartWorkGroup = false;
3756                         ShutdownRequest = NULL;
3757                         PendingSignal = 0;
3758                         CurrentPid = getpid();
3759                         sm_exc_newthread(fatal_error);
3760
3761                         /*
3762                         **  See note above about SMTP processes and SIGCHLD.
3763                         */
3764
3765                         if (OpMode == MD_SMTP ||
3766                             OpMode == MD_DAEMON ||
3767                             MaxQueueChildren > 0)
3768                         {
3769                                 proc_list_clear();
3770                                 sm_releasesignal(SIGCHLD);
3771                                 (void) sm_signal(SIGCHLD, SIG_DFL);
3772                         }
3773
3774                         /* child -- error messages to the transcript */
3775                         QuickAbort = OnlyOneError = false;
3776                 }
3777         }
3778         else
3779         {
3780                 pid = 0;
3781         }
3782
3783         if (pid != 0)
3784                 return pid;
3785
3786         /*
3787         **  IN CHILD
3788         **      Lock the control file to avoid duplicate deliveries.
3789         **              Then run the file as though we had just read it.
3790         **      We save an idea of the temporary name so we
3791         **              can recover on interrupt.
3792         */
3793
3794         if (forkflag)
3795         {
3796                 /* Reset global flags */
3797                 RestartRequest = NULL;
3798                 RestartWorkGroup = false;
3799                 ShutdownRequest = NULL;
3800                 PendingSignal = 0;
3801         }
3802
3803         /* set basic modes, etc. */
3804         sm_clear_events();
3805         clearstats();
3806         GrabTo = UseErrorsTo = false;
3807         ExitStat = EX_OK;
3808         if (forkflag)
3809         {
3810                 disconnect(1, el);
3811                 set_op_mode(MD_QUEUERUN);
3812         }
3813         if (LogLevel > 76)
3814                 sm_syslog(LOG_DEBUG, el->e_id, "doworklist, pid=%d",
3815                           (int) CurrentPid);
3816
3817         for (ei = el; ei != NULL; ei = ei->e_sibling)
3818         {
3819                 ENVELOPE e;
3820                 SM_RPOOL_T *rpool;
3821
3822                 if (WILL_BE_QUEUED(ei->e_sendmode))
3823                         continue;
3824                 else if (QueueMode != QM_QUARANTINE &&
3825                          ei->e_quarmsg != NULL)
3826                         continue;
3827
3828                 rpool = sm_rpool_new_x(NULL);
3829                 clearenvelope(&e, true, rpool);
3830                 e.e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3831                 set_delivery_mode(SM_DELIVER, &e);
3832                 e.e_errormode = EM_MAIL;
3833                 e.e_id = ei->e_id;
3834                 e.e_qgrp = ei->e_qgrp;
3835                 e.e_qdir = ei->e_qdir;
3836                 openxscript(&e);
3837                 sm_setproctitle(true, &e, "%s from queue", qid_printname(&e));
3838
3839                 /* don't use the headers from sendmail.cf... */
3840                 e.e_header = NULL;
3841                 CurEnv = &e;
3842
3843                 /* read the queue control file -- return if locked */
3844                 if (readqf(&e, false))
3845                 {
3846                         e.e_flags |= EF_INQUEUE;
3847                         eatheader(&e, requeueflag, true);
3848
3849                         if (requeueflag)
3850                                 queueup(&e, false, false);
3851
3852                         /* do the delivery */
3853                         sendall(&e, SM_DELIVER);
3854                         dropenvelope(&e, true, false);
3855                 }
3856                 else
3857                 {
3858                         if (tTd(40, 4) && e.e_id != NULL)
3859                                 sm_dprintf("readqf(%s) failed\n",
3860                                         qid_printname(&e));
3861                 }
3862                 sm_rpool_free(rpool);
3863                 ei->e_id = NULL;
3864         }
3865
3866         /* restore CurEnv */
3867         CurEnv = el;
3868
3869         /* finish up and exit */
3870         if (forkflag)
3871                 finis(true, true, ExitStat);
3872         return 0;
3873 }
3874 /*
3875 **  READQF -- read queue file and set up environment.
3876 **
3877 **      Parameters:
3878 **              e -- the envelope of the job to run.
3879 **              openonly -- only open the qf (returned as e_lockfp)
3880 **
3881 **      Returns:
3882 **              true if it successfully read the queue file.
3883 **              false otherwise.
3884 **
3885 **      Side Effects:
3886 **              The queue file is returned locked.
3887 */
3888
3889 static bool
3890 readqf(e, openonly)
3891         register ENVELOPE *e;
3892         bool openonly;
3893 {
3894         register SM_FILE_T *qfp;
3895         ADDRESS *ctladdr;
3896         struct stat st, stf;
3897         char *bp;
3898         int qfver = 0;
3899         long hdrsize = 0;
3900         register char *p;
3901         char *frcpt = NULL;
3902         char *orcpt = NULL;
3903         bool nomore = false;
3904         bool bogus = false;
3905         MODE_T qsafe;
3906         char *err;
3907         char qf[MAXPATHLEN];
3908         char buf[MAXLINE];
3909         int bufsize;
3910
3911         /*
3912         **  Read and process the file.
3913         */
3914
3915         SM_REQUIRE(e != NULL);
3916         bp = NULL;
3917         (void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER), sizeof(qf));
3918         qfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDWR_B, NULL);
3919         if (qfp == NULL)
3920         {
3921                 int save_errno = errno;
3922
3923                 if (tTd(40, 8))
3924                         sm_dprintf("readqf(%s): sm_io_open failure (%s)\n",
3925                                 qf, sm_errstring(errno));
3926                 errno = save_errno;
3927                 if (errno != ENOENT
3928                     )
3929                         syserr("readqf: no control file %s", qf);
3930                 RELEASE_QUEUE;
3931                 return false;
3932         }
3933
3934         if (!lockfile(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), qf, NULL,
3935                       LOCK_EX|LOCK_NB))
3936         {
3937                 /* being processed by another queuer */
3938                 if (Verbose)
3939                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3940                                              "%s: locked\n", e->e_id);
3941                 if (tTd(40, 8))
3942                         sm_dprintf("%s: locked\n", e->e_id);
3943                 if (LogLevel > 19)
3944                         sm_syslog(LOG_DEBUG, e->e_id, "locked");
3945                 (void) sm_io_close(qfp, SM_TIME_DEFAULT);
3946                 RELEASE_QUEUE;
3947                 return false;
3948         }
3949
3950         RELEASE_QUEUE;
3951
3952         /*
3953         **  Prevent locking race condition.
3954         **
3955         **  Process A: readqf(): qfp = fopen(qffile)
3956         **  Process B: queueup(): rename(tf, qf)
3957         **  Process B: unlocks(tf)
3958         **  Process A: lockfile(qf);
3959         **
3960         **  Process A (us) has the old qf file (before the rename deleted
3961         **  the directory entry) and will be delivering based on old data.
3962         **  This can lead to multiple deliveries of the same recipients.
3963         **
3964         **  Catch this by checking if the underlying qf file has changed
3965         **  *after* acquiring our lock and if so, act as though the file
3966         **  was still locked (i.e., just return like the lockfile() case
3967         **  above.
3968         */
3969
3970         if (stat(qf, &stf) < 0 ||
3971             fstat(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), &st) < 0)
3972         {
3973                 /* must have been being processed by someone else */
3974                 if (tTd(40, 8))
3975                         sm_dprintf("readqf(%s): [f]stat failure (%s)\n",
3976                                 qf, sm_errstring(errno));
3977                 (void) sm_io_close(qfp, SM_TIME_DEFAULT);
3978                 return false;
3979         }
3980
3981         if (st.st_nlink != stf.st_nlink ||
3982             st.st_dev != stf.st_dev ||
3983             ST_INODE(st) != ST_INODE(stf) ||
3984 #if HAS_ST_GEN && 0             /* AFS returns garbage in st_gen */
3985             st.st_gen != stf.st_gen ||
3986 #endif /* HAS_ST_GEN && 0 */
3987             st.st_uid != stf.st_uid ||
3988             st.st_gid != stf.st_gid ||
3989             st.st_size != stf.st_size)
3990         {
3991                 /* changed after opened */
3992                 if (Verbose)
3993                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3994                                              "%s: changed\n", e->e_id);
3995                 if (tTd(40, 8))
3996                         sm_dprintf("%s: changed\n", e->e_id);
3997                 if (LogLevel > 19)
3998                         sm_syslog(LOG_DEBUG, e->e_id, "changed");
3999                 (void) sm_io_close(qfp, SM_TIME_DEFAULT);
4000                 return false;
4001         }
4002
4003         /*
4004         **  Check the queue file for plausibility to avoid attacks.
4005         */
4006
4007         qsafe = S_IWOTH|S_IWGRP;
4008         if (bitset(S_IWGRP, QueueFileMode))
4009                 qsafe &= ~S_IWGRP;
4010
4011         bogus = st.st_uid != geteuid() &&
4012                 st.st_uid != TrustedUid &&
4013                 geteuid() != RealUid;
4014
4015         /*
4016         **  If this qf file results from a set-group-ID binary, then
4017         **  we check whether the directory is group-writable,
4018         **  the queue file mode contains the group-writable bit, and
4019         **  the groups are the same.
4020         **  Notice: this requires that the set-group-ID binary is used to
4021         **  run the queue!
4022         */
4023
4024         if (bogus && st.st_gid == getegid() && UseMSP)
4025         {
4026                 char delim;
4027                 struct stat dst;
4028
4029                 bp = SM_LAST_DIR_DELIM(qf);
4030                 if (bp == NULL)
4031                         delim = '\0';
4032                 else
4033                 {
4034                         delim = *bp;
4035                         *bp = '\0';
4036                 }
4037                 if (stat(delim == '\0' ? "." : qf, &dst) < 0)
4038                         syserr("readqf: cannot stat directory %s",
4039                                 delim == '\0' ? "." : qf);
4040                 else
4041                 {
4042                         bogus = !(bitset(S_IWGRP, QueueFileMode) &&
4043                                   bitset(S_IWGRP, dst.st_mode) &&
4044                                   dst.st_gid == st.st_gid);
4045                 }
4046                 if (delim != '\0')
4047                         *bp = delim;
4048                 bp = NULL;
4049         }
4050         if (!bogus)
4051                 bogus = bitset(qsafe, st.st_mode);
4052         if (bogus)
4053         {
4054                 if (LogLevel > 0)
4055                 {
4056                         sm_syslog(LOG_ALERT, e->e_id,
4057                                   "bogus queue file, uid=%d, gid=%d, mode=%o",
4058                                   st.st_uid, st.st_gid, st.st_mode);
4059                 }
4060                 if (tTd(40, 8))
4061                         sm_dprintf("readqf(%s): bogus file\n", qf);
4062                 e->e_flags |= EF_INQUEUE;
4063                 if (!openonly)
4064                         loseqfile(e, "bogus file uid/gid in mqueue");
4065                 (void) sm_io_close(qfp, SM_TIME_DEFAULT);
4066                 return false;
4067         }
4068
4069         if (st.st_size == 0)
4070         {
4071                 /* must be a bogus file -- if also old, just remove it */
4072                 if (!openonly && st.st_ctime + 10 * 60 < curtime())
4073                 {
4074                         (void) xunlink(queuename(e, DATAFL_LETTER));
4075                         (void) xunlink(queuename(e, ANYQFL_LETTER));
4076                 }
4077                 (void) sm_io_close(qfp, SM_TIME_DEFAULT);
4078                 return false;
4079         }
4080
4081         if (st.st_nlink == 0)
4082         {
4083                 /*
4084                 **  Race condition -- we got a file just as it was being
4085                 **  unlinked.  Just assume it is zero length.
4086                 */
4087
4088                 (void) sm_io_close(qfp, SM_TIME_DEFAULT);
4089                 return false;
4090         }
4091
4092 #if _FFR_TRUSTED_QF
4093         /*
4094         **  If we don't own the file mark it as unsafe.
4095         **  However, allow TrustedUser to own it as well
4096         **  in case TrustedUser manipulates the queue.
4097         */
4098
4099         if (st.st_uid != geteuid() && st.st_uid != TrustedUid)
4100                 e->e_flags |= EF_UNSAFE;
4101 #else /* _FFR_TRUSTED_QF */
4102         /* If we don't own the file mark it as unsafe */
4103         if (st.st_uid != geteuid())
4104                 e->e_flags |= EF_UNSAFE;
4105 #endif /* _FFR_TRUSTED_QF */
4106
4107         /* good file -- save this lock */
4108         e->e_lockfp = qfp;
4109
4110         /* Just wanted the open file */
4111         if (openonly)
4112                 return true;
4113
4114         /* do basic system initialization */
4115         initsys(e);
4116         macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
4117
4118         LineNumber = 0;
4119         e->e_flags |= EF_GLOBALERRS;
4120         set_op_mode(MD_QUEUERUN);
4121         ctladdr = NULL;
4122         e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
4123         e->e_dfqgrp = e->e_qgrp;
4124         e->e_dfqdir = e->e_qdir;
4125 #if _FFR_QUEUE_MACRO
4126         macdefine(&e->e_macro, A_TEMP, macid("{queue}"),
4127                   qid_printqueue(e->e_qgrp, e->e_qdir));
4128 #endif /* _FFR_QUEUE_MACRO */
4129         e->e_dfino = -1;
4130         e->e_msgsize = -1;
4131         while (bufsize = sizeof(buf),
4132                (bp = fgetfolded(buf, &bufsize, qfp)) != NULL)
4133         {
4134                 unsigned long qflags;
4135                 ADDRESS *q;
4136                 int r;
4137                 time_t now;
4138                 auto char *ep;
4139
4140                 if (tTd(40, 4))
4141                         sm_dprintf("+++++ %s\n", bp);
4142                 if (nomore)
4143                 {
4144                         /* hack attack */
4145   hackattack:
4146                         syserr("SECURITY ALERT: extra or bogus data in queue file: %s",
4147                                bp);
4148                         err = "bogus queue line";
4149                         goto fail;
4150                 }
4151                 switch (bp[0])
4152                 {
4153                   case 'A':             /* AUTH= parameter */
4154                         if (!xtextok(&bp[1]))
4155                                 goto hackattack;
4156                         e->e_auth_param = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4157                         break;
4158
4159                   case 'B':             /* body type */
4160                         r = check_bodytype(&bp[1]);
4161                         if (!BODYTYPE_VALID(r))
4162                                 goto hackattack;
4163                         e->e_bodytype = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4164                         break;
4165
4166                   case 'C':             /* specify controlling user */
4167                         ctladdr = setctluser(&bp[1], qfver, e);
4168                         break;
4169
4170                   case 'D':             /* data file name */
4171                         /* obsolete -- ignore */
4172                         break;
4173
4174                   case 'd':             /* data file directory name */
4175                         {
4176                                 int qgrp, qdir;
4177
4178 #if _FFR_MSP_PARANOIA
4179                                 /* forbid queue groups in MSP? */
4180                                 if (UseMSP)
4181                                         goto hackattack;
4182 #endif /* _FFR_MSP_PARANOIA */
4183                                 for (qgrp = 0;
4184                                      qgrp < NumQueue && Queue[qgrp] != NULL;
4185                                      ++qgrp)
4186                                 {
4187                                         for (qdir = 0;
4188                                              qdir < Queue[qgrp]->qg_numqueues;
4189                                              ++qdir)
4190                                         {
4191                                                 if (strcmp(&bp[1],
4192                                                            Queue[qgrp]->qg_qpaths[qdir].qp_name)
4193                                                     == 0)
4194                                                 {
4195                                                         e->e_dfqgrp = qgrp;
4196                                                         e->e_dfqdir = qdir;
4197                                                         goto done;
4198                                                 }
4199                                         }
4200                                 }
4201                                 err = "bogus queue file directory";
4202                                 goto fail;
4203                           done:
4204                                 break;
4205                         }
4206
4207                   case 'E':             /* specify error recipient */
4208                         /* no longer used */
4209                         break;
4210
4211                   case 'F':             /* flag bits */
4212                         if (strncmp(bp, "From ", 5) == 0)
4213                         {
4214                                 /* we are being spoofed! */
4215                                 syserr("SECURITY ALERT: bogus qf line %s", bp);
4216                                 err = "bogus queue line";
4217                                 goto fail;
4218                         }
4219                         for (p = &bp[1]; *p != '\0'; p++)
4220                         {
4221                                 switch (*p)
4222                                 {
4223                                   case '8':     /* has 8 bit data */
4224                                         e->e_flags |= EF_HAS8BIT;
4225                                         break;
4226
4227                                   case 'b':     /* delete Bcc: header */
4228                                         e->e_flags |= EF_DELETE_BCC;
4229                                         break;
4230
4231                                   case 'd':     /* envelope has DSN RET= */
4232                                         e->e_flags |= EF_RET_PARAM;
4233                                         break;
4234
4235                                   case 'n':     /* don't return body */
4236                                         e->e_flags |= EF_NO_BODY_RETN;
4237                                         break;
4238
4239                                   case 'r':     /* response */
4240                                         e->e_flags |= EF_RESPONSE;
4241                                         break;
4242
4243                                   case 's':     /* split */
4244                                         e->e_flags |= EF_SPLIT;
4245                                         break;
4246
4247                                   case 'w':     /* warning sent */
4248                                         e->e_flags |= EF_WARNING;
4249                                         break;
4250                                 }
4251                         }
4252                         break;
4253
4254                   case 'q':             /* quarantine reason */
4255                         e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4256                         macdefine(&e->e_macro, A_PERM,
4257                                   macid("{quarantine}"), e->e_quarmsg);
4258                         break;
4259
4260                   case 'H':             /* header */
4261
4262                         /*
4263                         **  count size before chompheader() destroys the line.
4264                         **  this isn't accurate due to macro expansion, but
4265                         **  better than before. "-3" to skip H?? at least.
4266                         */
4267
4268                         hdrsize += strlen(bp) - 3;
4269                         (void) chompheader(&bp[1], CHHDR_QUEUE, NULL, e);
4270                         break;
4271
4272                   case 'I':             /* data file's inode number */
4273                         /* regenerated below */
4274                         break;
4275
4276                   case 'K':             /* time of last delivery attempt */
4277                         e->e_dtime = atol(&buf[1]);
4278                         break;
4279
4280                   case 'L':             /* Solaris Content-Length: */
4281                   case 'M':             /* message */
4282                         /* ignore this; we want a new message next time */
4283                         break;
4284
4285                   case 'N':             /* number of delivery attempts */
4286                         e->e_ntries = atoi(&buf[1]);
4287
4288                         /* if this has been tried recently, let it be */
4289                         now = curtime();
4290                         if (e->e_ntries > 0 && e->e_dtime <= now &&
4291                             now < e->e_dtime + MinQueueAge)
4292                         {
4293                                 char *howlong;
4294
4295                                 howlong = pintvl(now - e->e_dtime, true);
4296                                 if (Verbose)
4297                                         (void) sm_io_fprintf(smioout,
4298                                                              SM_TIME_DEFAULT,
4299                                                              "%s: too young (%s)\n",
4300                                                              e->e_id, howlong);
4301                                 if (tTd(40, 8))
4302                                         sm_dprintf("%s: too young (%s)\n",
4303                                                 e->e_id, howlong);
4304                                 if (LogLevel > 19)
4305                                         sm_syslog(LOG_DEBUG, e->e_id,
4306                                                   "too young (%s)",
4307                                                   howlong);
4308                                 e->e_id = NULL;
4309                                 unlockqueue(e);
4310                                 if (bp != buf)
4311                                         sm_free(bp);
4312                                 return false;
4313                         }
4314                         macdefine(&e->e_macro, A_TEMP,
4315                                 macid("{ntries}"), &buf[1]);
4316
4317 #if NAMED_BIND
4318                         /* adjust BIND parameters immediately */
4319                         if (e->e_ntries == 0)
4320                         {
4321                                 _res.retry = TimeOuts.res_retry[RES_TO_FIRST];
4322                                 _res.retrans = TimeOuts.res_retrans[RES_TO_FIRST];
4323                         }
4324                         else
4325                         {
4326                                 _res.retry = TimeOuts.res_retry[RES_TO_NORMAL];
4327                                 _res.retrans = TimeOuts.res_retrans[RES_TO_NORMAL];
4328                         }
4329 #endif /* NAMED_BIND */
4330                         break;
4331
4332                   case 'P':             /* message priority */
4333                         e->e_msgpriority = atol(&bp[1]) + WkTimeFact;
4334                         break;
4335
4336                   case 'Q':             /* original recipient */
4337                         orcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4338                         break;
4339
4340                   case 'r':             /* final recipient */
4341                         frcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4342                         break;
4343
4344                   case 'R':             /* specify recipient */
4345                         p = bp;
4346                         qflags = 0;
4347                         if (qfver >= 1)
4348                         {
4349                                 /* get flag bits */
4350                                 while (*++p != '\0' && *p != ':')
4351                                 {
4352                                         switch (*p)
4353                                         {
4354                                           case 'N':
4355                                                 qflags |= QHASNOTIFY;
4356                                                 break;
4357
4358                                           case 'S':
4359                                                 qflags |= QPINGONSUCCESS;
4360                                                 break;
4361
4362                                           case 'F':
4363                                                 qflags |= QPINGONFAILURE;
4364                                                 break;
4365
4366                                           case 'D':
4367                                                 qflags |= QPINGONDELAY;
4368                                                 break;
4369
4370                                           case 'P':
4371                                                 qflags |= QPRIMARY;
4372                                                 break;
4373
4374                                           case 'A':
4375                                                 if (ctladdr != NULL)
4376                                                         ctladdr->q_flags |= QALIAS;
4377                                                 break;
4378
4379                                           default: /* ignore or complain? */
4380                                                 break;
4381                                         }
4382                                 }
4383                         }
4384                         else
4385                                 qflags |= QPRIMARY;
4386                         macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4387                                 "e r");
4388                         if (*p != '\0')
4389                                 q = parseaddr(++p, NULLADDR, RF_COPYALL, '\0',
4390                                                 NULL, e, true);
4391                         else
4392                                 q = NULL;
4393                         if (q != NULL)
4394                         {
4395                                 /* make sure we keep the current qgrp */
4396                                 if (ISVALIDQGRP(e->e_qgrp))
4397                                         q->q_qgrp = e->e_qgrp;
4398                                 q->q_alias = ctladdr;
4399                                 if (qfver >= 1)
4400                                         q->q_flags &= ~Q_PINGFLAGS;
4401                                 q->q_flags |= qflags;
4402                                 q->q_finalrcpt = frcpt;
4403                                 q->q_orcpt = orcpt;
4404                                 (void) recipient(q, &e->e_sendqueue, 0, e);
4405                         }
4406                         frcpt = NULL;
4407                         orcpt = NULL;
4408                         macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4409                                 NULL);
4410                         break;
4411
4412                   case 'S':             /* sender */
4413                         setsender(sm_rpool_strdup_x(e->e_rpool, &bp[1]),
4414                                   e, NULL, '\0', true);
4415                         break;
4416
4417                   case 'T':             /* init time */
4418                         e->e_ctime = atol(&bp[1]);
4419                         break;
4420
4421                   case 'V':             /* queue file version number */
4422                         qfver = atoi(&bp[1]);
4423                         if (qfver <= QF_VERSION)
4424                                 break;
4425                         syserr("Version number in queue file (%d) greater than max (%d)",
4426                                 qfver, QF_VERSION);
4427                         err = "unsupported queue file version";
4428                         goto fail;
4429                         /* NOTREACHED */
4430                         break;
4431
4432                   case 'Z':             /* original envelope id from ESMTP */
4433                         e->e_envid = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4434                         macdefine(&e->e_macro, A_PERM,
4435                                 macid("{dsn_envid}"), e->e_envid);
4436                         break;
4437
4438                   case '!':             /* deliver by */
4439
4440                         /* format: flag (1 char) space long-integer */
4441                         e->e_dlvr_flag = buf[1];
4442                         e->e_deliver_by = strtol(&buf[3], NULL, 10);
4443
4444                   case '$':             /* define macro */
4445                         {
4446                                 char *p;
4447
4448                                 /* XXX elimate p? */
4449                                 r = macid_parse(&bp[1], &ep);
4450                                 if (r == 0)
4451                                         break;
4452                                 p = sm_rpool_strdup_x(e->e_rpool, ep);
4453                                 macdefine(&e->e_macro, A_PERM, r, p);
4454                         }
4455                         break;
4456
4457                   case '.':             /* terminate file */
4458                         nomore = true;
4459                         break;
4460
4461 #if _FFR_QUEUEDELAY
4462                   case 'G':
4463                   case 'Y':
4464
4465                         /*
4466                         **  Maintain backward compatibility for
4467                         **  users who defined _FFR_QUEUEDELAY in
4468                         **  previous releases.  Remove this
4469                         **  code in 8.14 or 8.15.
4470                         */
4471
4472                         if (qfver == 5 || qfver == 7)
4473                                 break;
4474
4475                         /* If not qfver 5 or 7, then 'G' or 'Y' is invalid */
4476                         /* FALLTHROUGH */
4477 #endif /* _FFR_QUEUEDELAY */
4478
4479                   default:
4480                         syserr("readqf: %s: line %d: bad line \"%s\"",
4481                                 qf, LineNumber, shortenstring(bp, MAXSHORTSTR));
4482                         err = "unrecognized line";
4483                         goto fail;
4484                 }
4485
4486                 if (bp != buf)
4487                         SM_FREE(bp);
4488         }
4489
4490         /*
4491         **  If we haven't read any lines, this queue file is empty.
4492         **  Arrange to remove it without referencing any null pointers.
4493         */
4494
4495         if (LineNumber == 0)
4496         {
4497                 errno = 0;
4498                 e->e_flags |= EF_CLRQUEUE|EF_FATALERRS|EF_RESPONSE;
4499                 return true;
4500         }
4501
4502         /* Check to make sure we have a complete queue file read */
4503         if (!nomore)
4504         {
4505                 syserr("readqf: %s: incomplete queue file read", qf);
4506                 (void) sm_io_close(qfp, SM_TIME_DEFAULT);
4507                 return false;
4508         }
4509
4510 #if _FFR_QF_PARANOIA
4511         /* Check to make sure key fields were read */
4512         if (e->e_from.q_mailer == NULL)
4513         {
4514                 syserr("readqf: %s: sender not specified in queue file", qf);
4515                 (void) sm_io_close(qfp, SM_TIME_DEFAULT);
4516                 return false;
4517         }
4518         /* other checks? */
4519 #endif /* _FFR_QF_PARANOIA */
4520
4521         /* possibly set ${dsn_ret} macro */
4522         if (bitset(EF_RET_PARAM, e->e_flags))
4523         {
4524                 if (bitset(EF_NO_BODY_RETN, e->e_flags))
4525                         macdefine(&e->e_macro, A_PERM,
4526                                 macid("{dsn_ret}"), "hdrs");
4527                 else
4528                         macdefine(&e->e_macro, A_PERM,
4529                                 macid("{dsn_ret}"), "full");
4530         }
4531
4532         /*
4533         **  Arrange to read the data file.
4534         */
4535
4536         p = queuename(e, DATAFL_LETTER);
4537         e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, p, SM_IO_RDONLY_B,
4538                               NULL);
4539         if (e->e_dfp == NULL)
4540         {
4541                 syserr("readqf: cannot open %s", p);
4542         }
4543         else
4544         {
4545                 e->e_flags |= EF_HAS_DF;
4546                 if (fstat(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD, NULL), &st)
4547                     >= 0)
4548                 {
4549                         e->e_msgsize = st.st_size + hdrsize;
4550                         e->e_dfdev = st.st_dev;
4551                         e->e_dfino = ST_INODE(st);
4552                         (void) sm_snprintf(buf, sizeof(buf), "%ld",
4553                                            e->e_msgsize);
4554                         macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"),
4555                                   buf);
4556                 }
4557         }
4558
4559         return true;
4560
4561   fail:
4562         /*
4563         **  There was some error reading the qf file (reason is in err var.)
4564         **  Cleanup:
4565         **      close file; clear e_lockfp since it is the same as qfp,
4566         **      hence it is invalid (as file) after qfp is closed;
4567         **      the qf file is on disk, so set the flag to avoid calling
4568         **      queueup() with bogus data.
4569         */
4570
4571         if (bp != buf)
4572                 SM_FREE(bp);
4573         if (qfp != NULL)
4574                 (void) sm_io_close(qfp, SM_TIME_DEFAULT);
4575         e->e_lockfp = NULL;
4576         e->e_flags |= EF_INQUEUE;
4577         loseqfile(e, err);
4578         return false;
4579 }
4580 /*
4581 **  PRTSTR -- print a string, "unprintable" characters are shown as \oct
4582 **
4583 **      Parameters:
4584 **              s -- string to print
4585 **              ml -- maximum length of output
4586 **
4587 **      Returns:
4588 **              number of entries
4589 **
4590 **      Side Effects:
4591 **              Prints a string on stdout.
4592 */
4593
4594 static void prtstr __P((char *, int));
4595
4596 static void
4597 prtstr(s, ml)
4598         char *s;
4599         int ml;
4600 {
4601         int c;
4602
4603         if (s == NULL)
4604                 return;
4605         while (ml-- > 0 && ((c = *s++) != '\0'))
4606         {
4607                 if (c == '\\')
4608                 {
4609                         if (ml-- > 0)
4610                         {
4611                                 (void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4612                                 (void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4613                         }
4614                 }
4615                 else if (isascii(c) && isprint(c))
4616                         (void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4617                 else
4618                 {
4619                         if ((ml -= 3) > 0)
4620                                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4621                                                      "\\%03o", c & 0xFF);
4622                 }
4623         }
4624 }
4625 /*
4626 **  PRINTNQE -- print out number of entries in the mail queue
4627 **
4628 **      Parameters:
4629 **              out -- output file pointer.
4630 **              prefix -- string to output in front of each line.
4631 **
4632 **      Returns:
4633 **              none.
4634 */
4635
4636 void
4637 printnqe(out, prefix)
4638         SM_FILE_T *out;
4639         char *prefix;
4640 {
4641 #if SM_CONF_SHM
4642         int i, k = 0, nrequests = 0;
4643         bool unknown = false;
4644
4645         if (ShmId == SM_SHM_NO_ID)
4646         {
4647                 if (prefix == NULL)
4648                         (void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4649                                         "Data unavailable: shared memory not updated\n");
4650                 else
4651                         (void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4652                                         "%sNOTCONFIGURED:-1\r\n", prefix);
4653                 return;
4654         }
4655         for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4656         {
4657                 int j;
4658
4659                 k++;
4660                 for (j = 0; j < Queue[i]->qg_numqueues; j++)
4661                 {
4662                         int n;
4663
4664                         if (StopRequest)
4665                                 stop_sendmail();
4666
4667                         n = QSHM_ENTRIES(Queue[i]->qg_qpaths[j].qp_idx);
4668                         if (prefix != NULL)
4669                                 (void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4670                                         "%s%s:%d\r\n",
4671                                         prefix, qid_printqueue(i, j), n);
4672                         else if (n < 0)
4673                         {
4674                                 (void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4675                                         "%s: unknown number of entries\n",
4676                                         qid_printqueue(i, j));
4677                                 unknown = true;
4678                         }
4679                         else if (n == 0)
4680                         {
4681                                 (void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4682                                         "%s is empty\n",
4683                                         qid_printqueue(i, j));
4684                         }
4685                         else if (n > 0)
4686                         {
4687                                 (void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4688                                         "%s: entries=%d\n",
4689                                         qid_printqueue(i, j), n);
4690                                 nrequests += n;
4691                                 k++;
4692                         }
4693                 }
4694         }
4695         if (prefix == NULL && k > 1)
4696                 (void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4697                                      "\t\tTotal requests: %d%s\n",
4698                                      nrequests, unknown ? " (about)" : "");
4699 #else /* SM_CONF_SHM */
4700         if (prefix == NULL)
4701                 (void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4702                              "Data unavailable without shared memory support\n");
4703         else
4704                 (void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4705                              "%sNOTAVAILABLE:-1\r\n", prefix);
4706 #endif /* SM_CONF_SHM */
4707 }
4708 /*
4709 **  PRINTQUEUE -- print out a representation of the mail queue
4710 **
4711 **      Parameters:
4712 **              none.
4713 **
4714 **      Returns:
4715 **              none.
4716 **
4717 **      Side Effects:
4718 **              Prints a listing of the mail queue on the standard output.
4719 */
4720
4721 void
4722 printqueue()
4723 {
4724         int i, k = 0, nrequests = 0;
4725
4726         for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4727         {
4728                 int j;
4729
4730                 k++;
4731                 for (j = 0; j < Queue[i]->qg_numqueues; j++)
4732                 {
4733                         if (StopRequest)
4734                                 stop_sendmail();
4735                         nrequests += print_single_queue(i, j);
4736                         k++;
4737                 }
4738         }
4739         if (k > 1)
4740                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4741                                      "\t\tTotal requests: %d\n",
4742                                      nrequests);
4743 }
4744 /*
4745 **  PRINT_SINGLE_QUEUE -- print out a representation of a single mail queue
4746 **
4747 **      Parameters:
4748 **              qgrp -- the index of the queue group.
4749 **              qdir -- the queue directory.
4750 **
4751 **      Returns:
4752 **              number of requests in mail queue.
4753 **
4754 **      Side Effects:
4755 **              Prints a listing of the mail queue on the standard output.
4756 */
4757
4758 int
4759 print_single_queue(qgrp, qdir)
4760         int qgrp;
4761         int qdir;
4762 {
4763         register WORK *w;
4764         SM_FILE_T *f;
4765         int nrequests;
4766         char qd[MAXPATHLEN];
4767         char qddf[MAXPATHLEN];
4768         char buf[MAXLINE];
4769
4770         if (qdir == NOQDIR)
4771         {
4772                 (void) sm_strlcpy(qd, ".", sizeof(qd));
4773                 (void) sm_strlcpy(qddf, ".", sizeof(qddf));
4774         }
4775         else
4776         {
4777                 (void) sm_strlcpyn(qd, sizeof(qd), 2,
4778                         Queue[qgrp]->qg_qpaths[qdir].qp_name,
4779                         (bitset(QP_SUBQF,
4780                                 Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4781                                         ? "/qf" : ""));
4782                 (void) sm_strlcpyn(qddf, sizeof(qddf), 2,
4783                         Queue[qgrp]->qg_qpaths[qdir].qp_name,
4784                         (bitset(QP_SUBDF,
4785                                 Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4786                                         ? "/df" : ""));
4787         }
4788
4789         /*
4790         **  Check for permission to print the queue
4791         */
4792
4793         if (bitset(PRIV_RESTRICTMAILQ, PrivacyFlags) && RealUid != 0)
4794         {
4795                 struct stat st;
4796 #ifdef NGROUPS_MAX
4797                 int n;
4798                 extern GIDSET_T InitialGidSet[NGROUPS_MAX];
4799 #endif /* NGROUPS_MAX */
4800
4801                 if (stat(qd, &st) < 0)
4802                 {
4803                         syserr("Cannot stat %s",
4804                                 qid_printqueue(qgrp, qdir));
4805                         return 0;
4806                 }
4807 #ifdef NGROUPS_MAX
4808                 n = NGROUPS_MAX;
4809                 while (--n >= 0)
4810                 {
4811                         if (InitialGidSet[n] == st.st_gid)
4812                                 break;
4813                 }
4814                 if (n < 0 && RealGid != st.st_gid)
4815 #else /* NGROUPS_MAX */
4816                 if (RealGid != st.st_gid)
4817 #endif /* NGROUPS_MAX */
4818                 {
4819                         usrerr("510 You are not permitted to see the queue");
4820                         setstat(EX_NOPERM);
4821                         return 0;
4822                 }
4823         }
4824
4825         /*
4826         **  Read and order the queue.
4827         */
4828
4829         nrequests = gatherq(qgrp, qdir, true, NULL, NULL);
4830         (void) sortq(Queue[qgrp]->qg_maxlist);
4831
4832         /*
4833         **  Print the work list that we have read.
4834         */
4835
4836         /* first see if there is anything */
4837         if (nrequests <= 0)
4838         {
4839                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%s is empty\n",
4840                                      qid_printqueue(qgrp, qdir));
4841                 return 0;
4842         }
4843
4844         sm_getla();     /* get load average */
4845
4846         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\t\t%s (%d request%s",
4847                              qid_printqueue(qgrp, qdir),
4848                              nrequests, nrequests == 1 ? "" : "s");
4849         if (MaxQueueRun > 0 && nrequests > MaxQueueRun)
4850                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4851                                      ", only %d printed", MaxQueueRun);
4852         if (Verbose)
4853                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4854                         ")\n-----Q-ID----- --Size-- -Priority- ---Q-Time--- --------Sender/Recipient--------\n");
4855         else
4856                 (void) sm_io_fprintf(smioout,  SM_TIME_DEFAULT,
4857                         ")\n-----Q-ID----- --Size-- -----Q-Time----- ------------Sender/Recipient-----------\n");
4858         for (w = WorkQ; w != NULL; w = w->w_next)
4859         {
4860                 struct stat st;
4861                 auto time_t submittime = 0;
4862                 long dfsize;
4863                 int flags = 0;
4864                 int qfver;
4865                 char quarmsg[MAXLINE];
4866                 char statmsg[MAXLINE];
4867                 char bodytype[MAXNAME + 1];
4868                 char qf[MAXPATHLEN];
4869
4870                 if (StopRequest)
4871                         stop_sendmail();
4872
4873                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%13s",
4874                                      w->w_name + 2);
4875                 (void) sm_strlcpyn(qf, sizeof(qf), 3, qd, "/", w->w_name);
4876                 f = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
4877                                NULL);
4878                 if (f == NULL)
4879                 {
4880                         if (errno == EPERM)
4881                                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4882                                                      " (permission denied)\n");
4883                         else if (errno == ENOENT)
4884                                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4885                                                      " (job completed)\n");
4886                         else
4887                                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4888                                                      " (%s)\n",
4889                                                      sm_errstring(errno));
4890                         errno = 0;
4891                         continue;
4892                 }
4893                 w->w_name[0] = DATAFL_LETTER;
4894                 (void) sm_strlcpyn(qf, sizeof(qf), 3, qddf, "/", w->w_name);
4895                 if (stat(qf, &st) >= 0)
4896                         dfsize = st.st_size;
4897                 else
4898                 {
4899                         ENVELOPE e;
4900
4901                         /*
4902                         **  Maybe the df file can't be statted because
4903                         **  it is in a different directory than the qf file.
4904                         **  In order to find out, we must read the qf file.
4905                         */
4906
4907                         newenvelope(&e, &BlankEnvelope, sm_rpool_new_x(NULL));
4908                         e.e_id = w->w_name + 2;
4909                         e.e_qgrp = qgrp;
4910                         e.e_qdir = qdir;
4911                         dfsize = -1;
4912                         if (readqf(&e, false))
4913                         {
4914                                 char *df = queuename(&e, DATAFL_LETTER);
4915                                 if (stat(df, &st) >= 0)
4916                                         dfsize = st.st_size;
4917                         }
4918                         if (e.e_lockfp != NULL)
4919                         {
4920                                 (void) sm_io_close(e.e_lockfp, SM_TIME_DEFAULT);
4921                                 e.e_lockfp = NULL;
4922                         }
4923                         clearenvelope(&e, false, e.e_rpool);
4924                         sm_rpool_free(e.e_rpool);
4925                 }
4926                 if (w->w_lock)
4927                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "*");
4928                 else if (QueueMode == QM_LOST)
4929                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "?");
4930                 else if (w->w_tooyoung)
4931                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "-");
4932                 else if (shouldqueue(w->w_pri, w->w_ctime))
4933                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "X");
4934                 else
4935                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, " ");
4936
4937                 errno = 0;
4938
4939                 quarmsg[0] = '\0';
4940                 statmsg[0] = bodytype[0] = '\0';
4941                 qfver = 0;
4942                 while (sm_io_fgets(f, SM_TIME_DEFAULT, buf, sizeof(buf)) != NULL)
4943                 {
4944                         register int i;
4945                         register char *p;
4946
4947                         if (StopRequest)
4948                                 stop_sendmail();
4949
4950                         fixcrlf(buf, true);
4951                         switch (buf[0])
4952                         {
4953                           case 'V':     /* queue file version */
4954                                 qfver = atoi(&buf[1]);
4955                                 break;
4956
4957                           case 'M':     /* error message */
4958                                 if ((i = strlen(&buf[1])) >= sizeof(statmsg))
4959                                         i = sizeof(statmsg) - 1;
4960                                 memmove(statmsg, &buf[1], i);
4961                                 statmsg[i] = '\0';
4962                                 break;
4963
4964                           case 'q':     /* quarantine reason */
4965                                 if ((i = strlen(&buf[1])) >= sizeof(quarmsg))
4966                                         i = sizeof(quarmsg) - 1;
4967                                 memmove(quarmsg, &buf[1], i);
4968                                 quarmsg[i] = '\0';
4969                                 break;
4970
4971                           case 'B':     /* body type */
4972                                 if ((i = strlen(&buf[1])) >= sizeof(bodytype))
4973                                         i = sizeof(bodytype) - 1;
4974                                 memmove(bodytype, &buf[1], i);
4975                                 bodytype[i] = '\0';
4976                                 break;
4977
4978                           case 'S':     /* sender name */
4979                                 if (Verbose)
4980                                 {
4981                                         (void) sm_io_fprintf(smioout,
4982                                                 SM_TIME_DEFAULT,
4983                                                 "%8ld %10ld%c%.12s ",
4984                                                 dfsize,
4985                                                 w->w_pri,
4986                                                 bitset(EF_WARNING, flags)
4987                                                         ? '+' : ' ',
4988                                                 ctime(&submittime) + 4);
4989                                         prtstr(&buf[1], 78);
4990                                 }
4991                                 else
4992                                 {
4993                                         (void) sm_io_fprintf(smioout,
4994                                                 SM_TIME_DEFAULT,
4995                                                 "%8ld %.16s ",
4996                                                 dfsize,
4997                                                 ctime(&submittime));
4998                                         prtstr(&buf[1], 39);
4999                                 }
5000
5001                                 if (quarmsg[0] != '\0')
5002                                 {
5003                                         (void) sm_io_fprintf(smioout,
5004                                                              SM_TIME_DEFAULT,
5005                                                              "\n     QUARANTINE: %.*s",
5006                                                              Verbose ? 100 : 60,
5007                                                              quarmsg);
5008                                         quarmsg[0] = '\0';
5009                                 }
5010
5011                                 if (statmsg[0] != '\0' || bodytype[0] != '\0')
5012                                 {
5013                                         (void) sm_io_fprintf(smioout,
5014                                                 SM_TIME_DEFAULT,
5015                                                 "\n    %10.10s",
5016                                                 bodytype);
5017                                         if (statmsg[0] != '\0')
5018                                                 (void) sm_io_fprintf(smioout,
5019                                                         SM_TIME_DEFAULT,
5020                                                         "   (%.*s)",
5021                                                         Verbose ? 100 : 60,
5022                                                         statmsg);
5023                                         statmsg[0] = '\0';
5024                                 }
5025                                 break;
5026
5027                           case 'C':     /* controlling user */
5028                                 if (Verbose)
5029                                         (void) sm_io_fprintf(smioout,
5030                                                 SM_TIME_DEFAULT,
5031                                                 "\n\t\t\t\t\t\t(---%.64s---)",
5032                                                 &buf[1]);
5033                                 break;
5034
5035                           case 'R':     /* recipient name */
5036                                 p = &buf[1];
5037                                 if (qfver >= 1)
5038                                 {
5039                                         p = strchr(p, ':');
5040                                         if (p == NULL)
5041                                                 break;
5042                                         p++;
5043                                 }
5044                                 if (Verbose)
5045                                 {
5046                                         (void) sm_io_fprintf(smioout,
5047                                                         SM_TIME_DEFAULT,
5048                                                         "\n\t\t\t\t\t\t");
5049                                         prtstr(p, 71);
5050                                 }
5051                                 else
5052                                 {
5053                                         (void) sm_io_fprintf(smioout,
5054                                                         SM_TIME_DEFAULT,
5055                                                         "\n\t\t\t\t\t ");
5056                                         prtstr(p, 38);
5057                                 }
5058                                 if (Verbose && statmsg[0] != '\0')
5059                                 {
5060                                         (void) sm_io_fprintf(smioout,
5061                                                         SM_TIME_DEFAULT,
5062                                                         "\n\t\t (%.100s)",
5063                                                         statmsg);
5064                                         statmsg[0] = '\0';
5065                                 }
5066                                 break;
5067
5068                           case 'T':     /* creation time */
5069                                 submittime = atol(&buf[1]);
5070                                 break;
5071
5072                           case 'F':     /* flag bits */
5073                                 for (p = &buf[1]; *p != '\0'; p++)
5074                                 {
5075                                         switch (*p)
5076                                         {
5077                                           case 'w':
5078                                                 flags |= EF_WARNING;
5079                                                 break;
5080                                         }
5081                                 }
5082                         }
5083                 }
5084                 if (submittime == (time_t) 0)
5085                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
5086                                              " (no control file)");
5087                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\n");
5088                 (void) sm_io_close(f, SM_TIME_DEFAULT);
5089         }
5090         return nrequests;
5091 }
5092
5093 /*
5094 **  QUEUE_LETTER -- get the proper queue letter for the current QueueMode.
5095 **
5096 **      Parameters:
5097 **              e -- envelope to build it in/from.
5098 **              type -- the file type, used as the first character
5099 **                      of the file name.
5100 **
5101 **      Returns:
5102 **              the letter to use
5103 */
5104
5105 static char
5106 queue_letter(e, type)
5107         ENVELOPE *e;
5108         int type;
5109 {
5110         /* Change type according to QueueMode */
5111         if (type == ANYQFL_LETTER)
5112         {
5113                 if (e->e_quarmsg != NULL)
5114                         type = QUARQF_LETTER;
5115                 else
5116                 {
5117                         switch (QueueMode)
5118                         {
5119                           case QM_NORMAL:
5120                                 type = NORMQF_LETTER;
5121                                 break;
5122
5123                           case QM_QUARANTINE:
5124                                 type = QUARQF_LETTER;
5125                                 break;
5126
5127                           case QM_LOST:
5128                                 type = LOSEQF_LETTER;
5129                                 break;
5130
5131                           default:
5132                                 /* should never happen */
5133                                 abort();
5134                                 /* NOTREACHED */
5135                         }
5136                 }
5137         }
5138         return type;
5139 }
5140
5141 /*
5142 **  QUEUENAME -- build a file name in the queue directory for this envelope.
5143 **
5144 **      Parameters:
5145 **              e -- envelope to build it in/from.
5146 **              type -- the file type, used as the first character
5147 **                      of the file name.
5148 **
5149 **      Returns:
5150 **              a pointer to the queue name (in a static buffer).
5151 **
5152 **      Side Effects:
5153 **              If no id code is already assigned, queuename() will
5154 **              assign an id code with assign_queueid().  If no queue
5155 **              directory is assigned, one will be set with setnewqueue().
5156 */
5157
5158 char *
5159 queuename(e, type)
5160         register ENVELOPE *e;
5161         int type;
5162 {
5163         int qd, qg;
5164         char *sub = "/";
5165         char pref[3];
5166         static char buf[MAXPATHLEN];
5167
5168         /* Assign an ID if needed */
5169         if (e->e_id == NULL)
5170                 assign_queueid(e);
5171         type = queue_letter(e, type);
5172
5173         /* begin of filename */
5174         pref[0] = (char) type;
5175         pref[1] = 'f';
5176         pref[2] = '\0';
5177
5178         /* Assign a queue group/directory if needed */
5179         if (type == XSCRPT_LETTER)
5180         {
5181                 /*
5182                 **  We don't want to call setnewqueue() if we are fetching
5183                 **  the pathname of the transcript file, because setnewqueue
5184                 **  chooses a queue, and sometimes we need to write to the
5185                 **  transcript file before we have gathered enough information
5186                 **  to choose a queue.
5187                 */
5188
5189                 if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5190                 {
5191                         if (e->e_qgrp != NOQGRP && e->e_qdir != NOQDIR)
5192                         {
5193                                 e->e_xfqgrp = e->e_qgrp;
5194                                 e->e_xfqdir = e->e_qdir;
5195                         }
5196                         else
5197                         {
5198                                 e->e_xfqgrp = 0;
5199                                 if (Queue[e->e_xfqgrp]->qg_numqueues <= 1)
5200                                         e->e_xfqdir = 0;
5201                                 else
5202                                 {
5203                                         e->e_xfqdir = get_rand_mod(
5204                                               Queue[e->e_xfqgrp]->qg_numqueues);
5205                                 }
5206                         }
5207                 }
5208                 qd = e->e_xfqdir;
5209                 qg = e->e_xfqgrp;
5210         }
5211         else
5212         {
5213                 if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
5214                         (void) setnewqueue(e);
5215                 if (type ==  DATAFL_LETTER)
5216                 {
5217                         qd = e->e_dfqdir;
5218                         qg = e->e_dfqgrp;
5219                 }
5220                 else
5221                 {
5222                         qd = e->e_qdir;
5223                         qg = e->e_qgrp;
5224                 }
5225         }
5226
5227         /* xf files always have a valid qd and qg picked above */
5228         if ((qd == NOQDIR || qg == NOQGRP) && type != XSCRPT_LETTER)
5229                 (void) sm_strlcpyn(buf, sizeof(buf), 2, pref, e->e_id);
5230         else
5231         {
5232                 switch (type)
5233                 {
5234                   case DATAFL_LETTER:
5235                         if (bitset(QP_SUBDF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5236                                 sub = "/df/";
5237                         break;
5238
5239                   case QUARQF_LETTER:
5240                   case TEMPQF_LETTER:
5241                   case NEWQFL_LETTER:
5242                   case LOSEQF_LETTER:
5243                   case NORMQF_LETTER:
5244                         if (bitset(QP_SUBQF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5245                                 sub = "/qf/";
5246                         break;
5247
5248                   case XSCRPT_LETTER:
5249                         if (bitset(QP_SUBXF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5250                                 sub = "/xf/";
5251                         break;
5252
5253                   default:
5254                         sm_abort("queuename: bad queue file type %d", type);
5255                 }
5256
5257                 (void) sm_strlcpyn(buf, sizeof(buf), 4,
5258                                 Queue[qg]->qg_qpaths[qd].qp_name,
5259                                 sub, pref, e->e_id);
5260         }
5261
5262         if (tTd(7, 2))
5263                 sm_dprintf("queuename: %s\n", buf);
5264         return buf;
5265 }
5266
5267 /*
5268 **  INIT_QID_ALG -- Initialize the (static) parameters that are used to
5269 **      generate a queue ID.
5270 **
5271 **      This function is called by the daemon to reset
5272 **      LastQueueTime and LastQueuePid which are used by assign_queueid().
5273 **      Otherwise the algorithm may cause problems because
5274 **      LastQueueTime and LastQueuePid are set indirectly by main()
5275 **      before the daemon process is started, hence LastQueuePid is not
5276 **      the pid of the daemon and therefore a child of the daemon can
5277 **      actually have the same pid as LastQueuePid which means the section
5278 **      in  assign_queueid():
5279 **      * see if we need to get a new base time/pid *
5280 **      is NOT triggered which will cause the same queue id to be generated.
5281 **
5282 **      Parameters:
5283 **              none
5284 **
5285 **      Returns:
5286 **              none.
5287 */
5288
5289 void
5290 init_qid_alg()
5291 {
5292         LastQueueTime = 0;
5293         LastQueuePid = -1;
5294 }
5295
5296 /*
5297 **  ASSIGN_QUEUEID -- assign a queue ID for this envelope.
5298 **
5299 **      Assigns an id code if one does not already exist.
5300 **      This code assumes that nothing will remain in the queue for
5301 **      longer than 60 years.  It is critical that files with the given
5302 **      name do not already exist in the queue.
5303 **      [No longer initializes e_qdir to NOQDIR.]
5304 **
5305 **      Parameters:
5306 **              e -- envelope to set it in.
5307 **
5308 **      Returns:
5309 **              none.
5310 */
5311
5312 static const char QueueIdChars[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
5313 # define QIC_LEN        60
5314 # define QIC_LEN_R      62
5315
5316 /*
5317 **  Note: the length is "officially" 60 because minutes and seconds are
5318 **      usually only 0-59.  However (Linux):
5319 **       tm_sec The number of seconds after the minute, normally in
5320 **              the range 0 to 59, but can be up to 61 to allow for
5321 **              leap seconds.
5322 **      Hence the real length of the string is 62 to take this into account.
5323 **      Alternatively % QIC_LEN can (should) be used for access everywhere.
5324 */
5325
5326 # define queuenextid() CurrentPid
5327
5328
5329 void
5330 assign_queueid(e)
5331         register ENVELOPE *e;
5332 {
5333         pid_t pid = queuenextid();
5334         static int cX = 0;
5335         static long random_offset;
5336         struct tm *tm;
5337         char idbuf[MAXQFNAME - 2];
5338         int seq;
5339
5340         if (e->e_id != NULL)
5341                 return;
5342
5343         /* see if we need to get a new base time/pid */
5344         if (cX >= QIC_LEN * QIC_LEN || LastQueueTime == 0 ||
5345             LastQueuePid != pid)
5346         {
5347                 time_t then = LastQueueTime;
5348
5349                 /* if the first time through, pick a random offset */
5350                 if (LastQueueTime == 0)
5351                         random_offset = get_random();
5352
5353                 while ((LastQueueTime = curtime()) == then &&
5354                        LastQueuePid == pid)
5355                 {
5356                         (void) sleep(1);
5357                 }
5358                 LastQueuePid = queuenextid();
5359                 cX = 0;
5360         }
5361
5362         /*
5363         **  Generate a new sequence number between 0 and QIC_LEN*QIC_LEN-1.
5364         **  This lets us generate up to QIC_LEN*QIC_LEN unique queue ids
5365         **  per second, per process.  With envelope splitting,
5366         **  a single message can consume many queue ids.
5367         */
5368
5369         seq = (int)((cX + random_offset) % (QIC_LEN * QIC_LEN));
5370         ++cX;
5371         if (tTd(7, 50))
5372                 sm_dprintf("assign_queueid: random_offset = %ld (%d)\n",
5373                         random_offset, seq);
5374
5375         tm = gmtime(&LastQueueTime);
5376         idbuf[0] = QueueIdChars[tm->tm_year % QIC_LEN];
5377         idbuf[1] = QueueIdChars[tm->tm_mon];
5378         idbuf[2] = QueueIdChars[tm->tm_mday];
5379         idbuf[3] = QueueIdChars[tm->tm_hour];
5380         idbuf[4] = QueueIdChars[tm->tm_min % QIC_LEN_R];
5381         idbuf[5] = QueueIdChars[tm->tm_sec % QIC_LEN_R];
5382         idbuf[6] = QueueIdChars[seq / QIC_LEN];
5383         idbuf[7] = QueueIdChars[seq % QIC_LEN];
5384         (void) sm_snprintf(&idbuf[8], sizeof(idbuf) - 8, "%06d",
5385                            (int) LastQueuePid);
5386         e->e_id = sm_rpool_strdup_x(e->e_rpool, idbuf);
5387         macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
5388 #if 0
5389         /* XXX: inherited from MainEnvelope */
5390         e->e_qgrp = NOQGRP;  /* too early to do anything else */
5391         e->e_qdir = NOQDIR;
5392         e->e_xfqgrp = NOQGRP;
5393 #endif /* 0 */
5394
5395         /* New ID means it's not on disk yet */
5396         e->e_qfletter = '\0';
5397
5398         if (tTd(7, 1))
5399                 sm_dprintf("assign_queueid: assigned id %s, e=%p\n",
5400                         e->e_id, e);
5401         if (LogLevel > 93)
5402                 sm_syslog(LOG_DEBUG, e->e_id, "assigned id");
5403 }
5404 /*
5405 **  SYNC_QUEUE_TIME -- Assure exclusive PID in any given second
5406 **
5407 **      Make sure one PID can't be used by two processes in any one second.
5408 **
5409 **              If the system rotates PIDs fast enough, may get the
5410 **              same pid in the same second for two distinct processes.
5411 **              This will interfere with the queue file naming system.
5412 **
5413 **      Parameters:
5414 **              none
5415 **
5416 **      Returns:
5417 **              none
5418 */
5419
5420 void
5421 sync_queue_time()
5422 {
5423 #if FAST_PID_RECYCLE
5424         if (OpMode != MD_TEST &&
5425             OpMode != MD_VERIFY &&
5426             LastQueueTime > 0 &&
5427             LastQueuePid == CurrentPid &&
5428             curtime() == LastQueueTime)
5429                 (void) sleep(1);
5430 #endif /* FAST_PID_RECYCLE */
5431 }
5432 /*
5433 **  UNLOCKQUEUE -- unlock the queue entry for a specified envelope
5434 **
5435 **      Parameters:
5436 **              e -- the envelope to unlock.
5437 **
5438 **      Returns:
5439 **              none
5440 **
5441 **      Side Effects:
5442 **              unlocks the queue for `e'.
5443 */
5444
5445 void
5446 unlockqueue(e)
5447         ENVELOPE *e;
5448 {
5449         if (tTd(51, 4))
5450                 sm_dprintf("unlockqueue(%s)\n",
5451                         e->e_id == NULL ? "NOQUEUE" : e->e_id);
5452
5453
5454         /* if there is a lock file in the envelope, close it */
5455         if (e->e_lockfp != NULL)
5456                 (void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
5457         e->e_lockfp = NULL;
5458
5459         /* don't create a queue id if we don't already have one */
5460         if (e->e_id == NULL)
5461                 return;
5462
5463         /* remove the transcript */
5464         if (LogLevel > 87)
5465                 sm_syslog(LOG_DEBUG, e->e_id, "unlock");
5466         if (!tTd(51, 104))
5467                 (void) xunlink(queuename(e, XSCRPT_LETTER));
5468 }
5469 /*
5470 **  SETCTLUSER -- create a controlling address
5471 **
5472 **      Create a fake "address" given only a local login name; this is
5473 **      used as a "controlling user" for future recipient addresses.
5474 **
5475 **      Parameters:
5476 **              user -- the user name of the controlling user.
5477 **              qfver -- the version stamp of this queue file.
5478 **              e -- envelope
5479 **
5480 **      Returns:
5481 **              An address descriptor for the controlling user,
5482 **              using storage allocated from e->e_rpool.
5483 **
5484 */
5485
5486 static ADDRESS *
5487 setctluser(user, qfver, e)
5488         char *user;
5489         int qfver;
5490         ENVELOPE *e;
5491 {
5492         register ADDRESS *a;
5493         struct passwd *pw;
5494         char *p;
5495
5496         /*
5497         **  See if this clears our concept of controlling user.
5498         */
5499
5500         if (user == NULL || *user == '\0')
5501                 return NULL;
5502
5503         /*
5504         **  Set up addr fields for controlling user.
5505         */
5506
5507         a = (ADDRESS *) sm_rpool_malloc_x(e->e_rpool, sizeof(*a));
5508         memset((char *) a, '\0', sizeof(*a));
5509
5510         if (*user == ':')
5511         {
5512                 p = &user[1];
5513                 a->q_user = sm_rpool_strdup_x(e->e_rpool, p);
5514         }
5515         else
5516         {
5517                 p = strtok(user, ":");
5518                 a->q_user = sm_rpool_strdup_x(e->e_rpool, user);
5519                 if (qfver >= 2)
5520                 {
5521                         if ((p = strtok(NULL, ":")) != NULL)
5522                                 a->q_uid = atoi(p);
5523                         if ((p = strtok(NULL, ":")) != NULL)
5524                                 a->q_gid = atoi(p);
5525                         if ((p = strtok(NULL, ":")) != NULL)
5526                         {
5527                                 char *o;
5528
5529                                 a->q_flags |= QGOODUID;
5530
5531                                 /* if there is another ':': restore it */
5532                                 if ((o = strtok(NULL, ":")) != NULL && o > p)
5533                                         o[-1] = ':';
5534                         }
5535                 }
5536                 else if ((pw = sm_getpwnam(user)) != NULL)
5537                 {
5538                         if (*pw->pw_dir == '\0')
5539                                 a->q_home = NULL;
5540                         else if (strcmp(pw->pw_dir, "/") == 0)
5541                                 a->q_home = "";
5542                         else
5543                                 a->q_home = sm_rpool_strdup_x(e->e_rpool, pw->pw_dir);
5544                         a->q_uid = pw->pw_uid;
5545                         a->q_gid = pw->pw_gid;
5546                         a->q_flags |= QGOODUID;
5547                 }
5548         }
5549
5550         a->q_flags |= QPRIMARY;         /* flag as a "ctladdr" */
5551         a->q_mailer = LocalMailer;
5552         if (p == NULL)
5553                 a->q_paddr = sm_rpool_strdup_x(e->e_rpool, a->q_user);
5554         else
5555                 a->q_paddr = sm_rpool_strdup_x(e->e_rpool, p);
5556         return a;
5557 }
5558 /*
5559 **  LOSEQFILE -- rename queue file with LOSEQF_LETTER & try to let someone know
5560 **
5561 **      Parameters:
5562 **              e -- the envelope (e->e_id will be used).
5563 **              why -- reported to whomever can hear.
5564 **
5565 **      Returns:
5566 **              none.
5567 */
5568
5569 void
5570 loseqfile(e, why)
5571         register ENVELOPE *e;
5572         char *why;
5573 {
5574         bool loseit = true;
5575         char *p;
5576         char buf[MAXPATHLEN];
5577
5578         if (e == NULL || e->e_id == NULL)
5579                 return;
5580         p = queuename(e, ANYQFL_LETTER);
5581         if (sm_strlcpy(buf, p, sizeof(buf)) >= sizeof(buf))
5582                 return;
5583         if (!bitset(EF_INQUEUE, e->e_flags))
5584                 queueup(e, false, true);
5585         else if (QueueMode == QM_LOST)
5586                 loseit = false;
5587
5588         /* if already lost, no need to re-lose */
5589         if (loseit)
5590         {
5591                 p = queuename(e, LOSEQF_LETTER);
5592                 if (rename(buf, p) < 0)
5593                         syserr("cannot rename(%s, %s), uid=%d",
5594                                buf, p, (int) geteuid());
5595                 else if (LogLevel > 0)
5596                         sm_syslog(LOG_ALERT, e->e_id,
5597                                   "Losing %s: %s", buf, why);
5598         }
5599         if (e->e_dfp != NULL)
5600         {
5601                 (void) sm_io_close(e->e_dfp, SM_TIME_DEFAULT);
5602                 e->e_dfp = NULL;
5603         }
5604         e->e_flags &= ~EF_HAS_DF;
5605 }
5606 /*
5607 **  NAME2QID -- translate a queue group name to a queue group id
5608 **
5609 **      Parameters:
5610 **              queuename -- name of queue group.
5611 **
5612 **      Returns:
5613 **              queue group id if found.
5614 **              NOQGRP otherwise.
5615 */
5616
5617 int
5618 name2qid(queuename)
5619         char *queuename;
5620 {
5621         register STAB *s;
5622
5623         s = stab(queuename, ST_QUEUE, ST_FIND);
5624         if (s == NULL)
5625                 return NOQGRP;
5626         return s->s_quegrp->qg_index;
5627 }
5628 /*
5629 **  QID_PRINTNAME -- create externally printable version of queue id
5630 **
5631 **      Parameters:
5632 **              e -- the envelope.
5633 **
5634 **      Returns:
5635 **              a printable version
5636 */
5637
5638 char *
5639 qid_printname(e)
5640         ENVELOPE *e;
5641 {
5642         char *id;
5643         static char idbuf[MAXQFNAME + 34];
5644
5645         if (e == NULL)
5646                 return "";
5647
5648         if (e->e_id == NULL)
5649                 id = "";
5650         else
5651                 id = e->e_id;
5652
5653         if (e->e_qdir == NOQDIR)
5654                 return id;
5655
5656         (void) sm_snprintf(idbuf, sizeof(idbuf), "%.32s/%s",
5657                            Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_name,
5658                            id);
5659         return idbuf;
5660 }
5661 /*
5662 **  QID_PRINTQUEUE -- create full version of queue directory for data files
5663 **
5664 **      Parameters:
5665 **              qgrp -- index in queue group.
5666 **              qdir -- the short version of the queue directory
5667 **
5668 **      Returns:
5669 **              the full pathname to the queue (might point to a static var)
5670 */
5671
5672 char *
5673 qid_printqueue(qgrp, qdir)
5674         int qgrp;
5675         int qdir;
5676 {
5677         char *subdir;
5678         static char dir[MAXPATHLEN];
5679
5680         if (qdir == NOQDIR)
5681                 return Queue[qgrp]->qg_qdir;
5682
5683         if (strcmp(Queue[qgrp]->qg_qpaths[qdir].qp_name, ".") == 0)
5684                 subdir = NULL;
5685         else
5686                 subdir = Queue[qgrp]->qg_qpaths[qdir].qp_name;
5687
5688         (void) sm_strlcpyn(dir, sizeof(dir), 4,
5689                         Queue[qgrp]->qg_qdir,
5690                         subdir == NULL ? "" : "/",
5691                         subdir == NULL ? "" : subdir,
5692                         (bitset(QP_SUBDF,
5693                                 Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
5694                                         ? "/df" : ""));
5695         return dir;
5696 }
5697
5698 /*
5699 **  PICKQDIR -- Pick a queue directory from a queue group
5700 **
5701 **      Parameters:
5702 **              qg -- queue group
5703 **              fsize -- file size in bytes
5704 **              e -- envelope, or NULL
5705 **
5706 **      Result:
5707 **              NOQDIR if no queue directory in qg has enough free space to
5708 **              hold a file of size 'fsize', otherwise the index of
5709 **              a randomly selected queue directory which resides on a
5710 **              file system with enough disk space.
5711 **              XXX This could be extended to select a queuedir with
5712 **                      a few (the fewest?) number of entries. That data
5713 **                      is available if shared memory is used.
5714 **
5715 **      Side Effects:
5716 **              If the request fails and e != NULL then sm_syslog is called.
5717 */
5718
5719 int
5720 pickqdir(qg, fsize, e)
5721         QUEUEGRP *qg;
5722         long fsize;
5723         ENVELOPE *e;
5724 {
5725         int qdir;
5726         int i;
5727         long avail = 0;
5728
5729         /* Pick a random directory, as a starting point. */
5730         if (qg->qg_numqueues <= 1)
5731                 qdir = 0;
5732         else
5733                 qdir = get_rand_mod(qg->qg_numqueues);
5734
5735         if (MinBlocksFree <= 0 && fsize <= 0)
5736                 return qdir;
5737
5738         /*
5739         **  Now iterate over the queue directories,
5740         **  looking for a directory with enough space for this message.
5741         */
5742
5743         i = qdir;
5744         do
5745         {
5746                 QPATHS *qp = &qg->qg_qpaths[i];
5747                 long needed = 0;
5748                 long fsavail = 0;
5749
5750                 if (fsize > 0)
5751                         needed += fsize / FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5752                                   + ((fsize % FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5753                                       > 0) ? 1 : 0);
5754                 if (MinBlocksFree > 0)
5755                         needed += MinBlocksFree;
5756                 fsavail = FILE_SYS_AVAIL(qp->qp_fsysidx);
5757 #if SM_CONF_SHM
5758                 if (fsavail <= 0)
5759                 {
5760                         long blksize;
5761
5762                         /*
5763                         **  might be not correctly updated,
5764                         **  let's try to get the info directly.
5765                         */
5766
5767                         fsavail = freediskspace(FILE_SYS_NAME(qp->qp_fsysidx),
5768                                                 &blksize);
5769                         if (fsavail < 0)
5770                                 fsavail = 0;
5771                 }
5772 #endif /* SM_CONF_SHM */
5773                 if (needed <= fsavail)
5774                         return i;
5775                 if (avail < fsavail)
5776                         avail = fsavail;
5777
5778                 if (qg->qg_numqueues > 0)
5779                         i = (i + 1) % qg->qg_numqueues;
5780         } while (i != qdir);
5781
5782         if (e != NULL && LogLevel > 0)
5783                 sm_syslog(LOG_ALERT, e->e_id,
5784                         "low on space (%s needs %ld bytes + %ld blocks in %s), max avail: %ld",
5785                         CurHostName == NULL ? "SMTP-DAEMON" : CurHostName,
5786                         fsize, MinBlocksFree,
5787                         qg->qg_qdir, avail);
5788         return NOQDIR;
5789 }
5790 /*
5791 **  SETNEWQUEUE -- Sets a new queue group and directory
5792 **
5793 **      Assign a queue group and directory to an envelope and store the
5794 **      directory in e->e_qdir.
5795 **
5796 **      Parameters:
5797 **              e -- envelope to assign a queue for.
5798 **
5799 **      Returns:
5800 **              true if successful
5801 **              false otherwise
5802 **
5803 **      Side Effects:
5804 **              On success, e->e_qgrp and e->e_qdir are non-negative.
5805 **              On failure (not enough disk space),
5806 **              e->qgrp = NOQGRP, e->e_qdir = NOQDIR
5807 **              and usrerr() is invoked (which could raise an exception).
5808 */
5809
5810 bool
5811 setnewqueue(e)
5812         ENVELOPE *e;
5813 {
5814         if (tTd(41, 20))
5815                 sm_dprintf("setnewqueue: called\n");
5816
5817         /* not set somewhere else */
5818         if (e->e_qgrp == NOQGRP)
5819         {
5820                 ADDRESS *q;
5821
5822                 /*
5823                 **  Use the queue group of the "first" recipient, as set by
5824                 **  the "queuegroup" rule set.  If that is not defined, then
5825                 **  use the queue group of the mailer of the first recipient.
5826                 **  If that is not defined either, then use the default
5827                 **  queue group.
5828                 **  Notice: "first" depends on the sorting of sendqueue
5829                 **  in recipient().
5830                 **  To avoid problems with "bad" recipients look
5831                 **  for a valid address first.
5832                 */
5833
5834                 q = e->e_sendqueue;
5835                 while (q != NULL &&
5836                        (QS_IS_BADADDR(q->q_state) || QS_IS_DEAD(q->q_state)))
5837                 {
5838                         q = q->q_next;
5839                 }
5840                 if (q == NULL)
5841                         e->e_qgrp = 0;
5842                 else if (q->q_qgrp >= 0)
5843                         e->e_qgrp = q->q_qgrp;
5844                 else if (q->q_mailer != NULL &&
5845                          ISVALIDQGRP(q->q_mailer->m_qgrp))
5846                         e->e_qgrp = q->q_mailer->m_qgrp;
5847                 else
5848                         e->e_qgrp = 0;
5849                 e->e_dfqgrp = e->e_qgrp;
5850         }
5851
5852         if (ISVALIDQDIR(e->e_qdir) && ISVALIDQDIR(e->e_dfqdir))
5853         {
5854                 if (tTd(41, 20))
5855                         sm_dprintf("setnewqueue: e_qdir already assigned (%s)\n",
5856                                 qid_printqueue(e->e_qgrp, e->e_qdir));
5857                 return true;
5858         }
5859
5860         filesys_update();
5861         e->e_qdir = pickqdir(Queue[e->e_qgrp], e->e_msgsize, e);
5862         if (e->e_qdir == NOQDIR)
5863         {
5864                 e->e_qgrp = NOQGRP;
5865                 if (!bitset(EF_FATALERRS, e->e_flags))
5866                         usrerr("452 4.4.5 Insufficient disk space; try again later");
5867                 e->e_flags |= EF_FATALERRS;
5868                 return false;
5869         }
5870
5871         if (tTd(41, 3))
5872                 sm_dprintf("setnewqueue: Assigned queue directory %s\n",
5873                         qid_printqueue(e->e_qgrp, e->e_qdir));
5874
5875         if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5876         {
5877                 e->e_xfqgrp = e->e_qgrp;
5878                 e->e_xfqdir = e->e_qdir;
5879         }
5880         e->e_dfqdir = e->e_qdir;
5881         return true;
5882 }
5883 /*
5884 **  CHKQDIR -- check a queue directory
5885 **
5886 **      Parameters:
5887 **              name -- name of queue directory
5888 **              sff -- flags for safefile()
5889 **
5890 **      Returns:
5891 **              is it a queue directory?
5892 */
5893
5894 static bool chkqdir __P((char *, long));
5895
5896 static bool
5897 chkqdir(name, sff)
5898         char *name;
5899         long sff;
5900 {
5901         struct stat statb;
5902         int i;
5903
5904         /* skip over . and .. directories */
5905         if (name[0] == '.' &&
5906             (name[1] == '\0' || (name[1] == '.' && name[2] == '\0')))
5907                 return false;
5908 #if HASLSTAT
5909         if (lstat(name, &statb) < 0)
5910 #else /* HASLSTAT */
5911         if (stat(name, &statb) < 0)
5912 #endif /* HASLSTAT */
5913         {
5914                 if (tTd(41, 2))
5915                         sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5916                                    name, sm_errstring(errno));
5917                 return false;
5918         }
5919 #if HASLSTAT
5920         if (S_ISLNK(statb.st_mode))
5921         {
5922                 /*
5923                 **  For a symlink we need to make sure the
5924                 **  target is a directory
5925                 */
5926
5927                 if (stat(name, &statb) < 0)
5928                 {
5929                         if (tTd(41, 2))
5930                                 sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5931                                            name, sm_errstring(errno));
5932                         return false;
5933                 }
5934         }
5935 #endif /* HASLSTAT */
5936
5937         if (!S_ISDIR(statb.st_mode))
5938         {
5939                 if (tTd(41, 2))
5940                         sm_dprintf("chkqdir: \"%s\": Not a directory\n",
5941                                 name);
5942                 return false;
5943         }
5944
5945         /* Print a warning if unsafe (but still use it) */
5946         /* XXX do this only if we want the warning? */
5947         i = safedirpath(name, RunAsUid, RunAsGid, NULL, sff, 0, 0);
5948         if (i != 0)
5949         {
5950                 if (tTd(41, 2))
5951                         sm_dprintf("chkqdir: \"%s\": Not safe: %s\n",
5952                                    name, sm_errstring(i));
5953 #if _FFR_CHK_QUEUE
5954                 if (LogLevel > 8)
5955                         sm_syslog(LOG_WARNING, NOQID,
5956                                   "queue directory \"%s\": Not safe: %s",
5957                                   name, sm_errstring(i));
5958 #endif /* _FFR_CHK_QUEUE */
5959         }
5960         return true;
5961 }
5962 /*
5963 **  MULTIQUEUE_CACHE -- cache a list of paths to queues.
5964 **
5965 **      Each potential queue is checked as the cache is built.
5966 **      Thereafter, each is blindly trusted.
5967 **      Note that we can be called again after a timeout to rebuild
5968 **      (although code for that is not ready yet).
5969 **
5970 **      Parameters:
5971 **              basedir -- base of all queue directories.
5972 **              blen -- strlen(basedir).
5973 **              qg -- queue group.
5974 **              qn -- number of queue directories already cached.
5975 **              phash -- pointer to hash value over queue dirs.
5976 #if SM_CONF_SHM
5977 **                      only used if shared memory is active.
5978 #endif * SM_CONF_SHM *
5979 **
5980 **      Returns:
5981 **              new number of queue directories.
5982 */
5983
5984 #define INITIAL_SLOTS   20
5985 #define ADD_SLOTS       10
5986
5987 static int
5988 multiqueue_cache(basedir, blen, qg, qn, phash)
5989         char *basedir;
5990         int blen;
5991         QUEUEGRP *qg;
5992         int qn;
5993         unsigned int *phash;
5994 {
5995         char *cp;
5996         int i, len;
5997         int slotsleft = 0;
5998         long sff = SFF_ANYFILE;
5999         char qpath[MAXPATHLEN];
6000         char subdir[MAXPATHLEN];
6001         char prefix[MAXPATHLEN];        /* dir relative to basedir */
6002
6003         if (tTd(41, 20))
6004                 sm_dprintf("multiqueue_cache: called\n");
6005
6006         /* Initialize to current directory */
6007         prefix[0] = '.';
6008         prefix[1] = '\0';
6009         if (qg->qg_numqueues != 0 && qg->qg_qpaths != NULL)
6010         {
6011                 for (i = 0; i < qg->qg_numqueues; i++)
6012                 {
6013                         if (qg->qg_qpaths[i].qp_name != NULL)
6014                                 (void) sm_free(qg->qg_qpaths[i].qp_name); /* XXX */
6015                 }
6016                 (void) sm_free((char *) qg->qg_qpaths); /* XXX */
6017                 qg->qg_qpaths = NULL;
6018                 qg->qg_numqueues = 0;
6019         }
6020
6021         /* If running as root, allow safedirpath() checks to use privs */
6022         if (RunAsUid == 0)
6023                 sff |= SFF_ROOTOK;
6024 #if _FFR_CHK_QUEUE
6025         sff |= SFF_SAFEDIRPATH|SFF_NOWWFILES;
6026         if (!UseMSP)
6027                 sff |= SFF_NOGWFILES;
6028 #endif /* _FFR_CHK_QUEUE */
6029
6030         if (!SM_IS_DIR_START(qg->qg_qdir))
6031         {
6032                 /*
6033                 **  XXX we could add basedir, but then we have to realloc()
6034                 **  the string... Maybe another time.
6035                 */
6036
6037                 syserr("QueuePath %s not absolute", qg->qg_qdir);
6038                 ExitStat = EX_CONFIG;
6039                 return qn;
6040         }
6041
6042         /* qpath: directory of current workgroup */
6043         len = sm_strlcpy(qpath, qg->qg_qdir, sizeof(qpath));
6044         if (len >= sizeof(qpath))
6045         {
6046                 syserr("QueuePath %.256s too long (%d max)",
6047                        qg->qg_qdir, (int) sizeof(qpath));
6048                 ExitStat = EX_CONFIG;
6049                 return qn;
6050         }
6051
6052         /* begin of qpath must be same as basedir */
6053         if (strncmp(basedir, qpath, blen) != 0 &&
6054             (strncmp(basedir, qpath, blen - 1) != 0 || len != blen - 1))
6055         {
6056                 syserr("QueuePath %s not subpath of QueueDirectory %s",
6057                         qpath, basedir);
6058                 ExitStat = EX_CONFIG;
6059                 return qn;
6060         }
6061
6062         /* Do we have a nested subdirectory? */
6063         if (blen < len && SM_FIRST_DIR_DELIM(qg->qg_qdir + blen) != NULL)
6064         {
6065
6066                 /* Copy subdirectory into prefix for later use */
6067                 if (sm_strlcpy(prefix, qg->qg_qdir + blen, sizeof(prefix)) >=
6068                     sizeof(prefix))
6069                 {
6070                         syserr("QueuePath %.256s too long (%d max)",
6071                                 qg->qg_qdir, (int) sizeof(qpath));
6072                         ExitStat = EX_CONFIG;
6073                         return qn;
6074                 }
6075                 cp = SM_LAST_DIR_DELIM(prefix);
6076                 SM_ASSERT(cp != NULL);
6077                 *cp = '\0';     /* cut off trailing / */
6078         }
6079
6080         /* This is guaranteed by the basedir check above */
6081         SM_ASSERT(len >= blen - 1);
6082         cp = &qpath[len - 1];
6083         if (*cp == '*')
6084         {
6085                 register DIR *dp;
6086                 register struct dirent *d;
6087                 int off;
6088                 char *delim;
6089                 char relpath[MAXPATHLEN];
6090
6091                 *cp = '\0';     /* Overwrite wildcard */
6092                 if ((cp = SM_LAST_DIR_DELIM(qpath)) == NULL)
6093                 {
6094                         syserr("QueueDirectory: can not wildcard relative path");
6095                         if (tTd(41, 2))
6096                                 sm_dprintf("multiqueue_cache: \"%s*\": Can not wildcard relative path.\n",
6097                                         qpath);
6098                         ExitStat = EX_CONFIG;
6099                         return qn;
6100                 }
6101                 if (cp == qpath)
6102                 {
6103                         /*
6104                         **  Special case of top level wildcard, like /foo*
6105                         **      Change to //foo*
6106                         */
6107
6108                         (void) sm_strlcpy(qpath + 1, qpath, sizeof(qpath) - 1);
6109                         ++cp;
6110                 }
6111                 delim = cp;
6112                 *(cp++) = '\0';         /* Replace / with \0 */
6113                 len = strlen(cp);       /* Last component of queue directory */
6114
6115                 /*
6116                 **  Path relative to basedir, with trailing /
6117                 **  It will be modified below to specify the subdirectories
6118                 **  so they can be opened without chdir().
6119                 */
6120
6121                 off = sm_strlcpyn(relpath, sizeof(relpath), 2, prefix, "/");
6122                 SM_ASSERT(off < sizeof(relpath));
6123
6124                 if (tTd(41, 2))
6125                         sm_dprintf("multiqueue_cache: prefix=\"%s%s\"\n",
6126                                    relpath, cp);
6127
6128                 /* It is always basedir: we don't need to store it per group */
6129                 /* XXX: optimize this! -> one more global? */
6130                 qg->qg_qdir = newstr(basedir);
6131                 qg->qg_qdir[blen - 1] = '\0';   /* cut off trailing / */
6132
6133                 /*
6134                 **  XXX Should probably wrap this whole loop in a timeout
6135                 **  in case some wag decides to NFS mount the queues.
6136                 */
6137
6138                 /* Test path to get warning messages. */
6139                 if (qn == 0)
6140                 {
6141                         /*  XXX qg_runasuid and qg_runasgid for specials? */
6142                         i = safedirpath(basedir, RunAsUid, RunAsGid, NULL,
6143                                         sff, 0, 0);
6144                         if (i != 0 && tTd(41, 2))
6145                                 sm_dprintf("multiqueue_cache: \"%s\": Not safe: %s\n",
6146                                            basedir, sm_errstring(i));
6147                 }
6148
6149                 if ((dp = opendir(prefix)) == NULL)
6150                 {
6151                         syserr("can not opendir(%s/%s)", qg->qg_qdir, prefix);
6152                         if (tTd(41, 2))
6153                                 sm_dprintf("multiqueue_cache: opendir(\"%s/%s\"): %s\n",
6154                                            qg->qg_qdir, prefix,
6155                                            sm_errstring(errno));
6156                         ExitStat = EX_CONFIG;
6157                         return qn;
6158                 }
6159                 while ((d = readdir(dp)) != NULL)
6160                 {
6161                         /* Skip . and .. directories */
6162                         if (strcmp(d->d_name, ".") == 0 ||
6163                             strcmp(d->d_name, "..") == 0)
6164                                 continue;
6165
6166                         i = strlen(d->d_name);
6167                         if (i < len || strncmp(d->d_name, cp, len) != 0)
6168                         {
6169                                 if (tTd(41, 5))
6170                                         sm_dprintf("multiqueue_cache: \"%s\", skipped\n",
6171                                                 d->d_name);
6172                                 continue;
6173                         }
6174
6175                         /* Create relative pathname: prefix + local directory */
6176                         i = sizeof(relpath) - off;
6177                         if (sm_strlcpy(relpath + off, d->d_name, i) >= i)
6178                                 continue;       /* way too long */
6179
6180                         if (!chkqdir(relpath, sff))
6181                                 continue;
6182
6183                         if (qg->qg_qpaths == NULL)
6184                         {
6185                                 slotsleft = INITIAL_SLOTS;
6186                                 qg->qg_qpaths = (QPATHS *)xalloc((sizeof(*qg->qg_qpaths)) *
6187                                                                 slotsleft);
6188                                 qg->qg_numqueues = 0;
6189                         }
6190                         else if (slotsleft < 1)
6191                         {
6192                                 qg->qg_qpaths = (QPATHS *)sm_realloc((char *)qg->qg_qpaths,
6193                                                           (sizeof(*qg->qg_qpaths)) *
6194                                                           (qg->qg_numqueues +
6195                                                            ADD_SLOTS));
6196                                 if (qg->qg_qpaths == NULL)
6197                                 {
6198                                         (void) closedir(dp);
6199                                         return qn;
6200                                 }
6201                                 slotsleft += ADD_SLOTS;
6202                         }
6203
6204                         /* check subdirs */
6205                         qg->qg_qpaths[qg->qg_numqueues].qp_subdirs = QP_NOSUB;
6206
6207 #define CHKRSUBDIR(name, flag)  \
6208         (void) sm_strlcpyn(subdir, sizeof(subdir), 3, relpath, "/", name); \
6209         if (chkqdir(subdir, sff))       \
6210                 qg->qg_qpaths[qg->qg_numqueues].qp_subdirs |= flag;     \
6211         else
6212
6213
6214                         CHKRSUBDIR("qf", QP_SUBQF);
6215                         CHKRSUBDIR("df", QP_SUBDF);
6216                         CHKRSUBDIR("xf", QP_SUBXF);
6217
6218                         /* assert(strlen(d->d_name) < MAXPATHLEN - 14) */
6219                         /* maybe even - 17 (subdirs) */
6220
6221                         if (prefix[0] != '.')
6222                                 qg->qg_qpaths[qg->qg_numqueues].qp_name =
6223                                         newstr(relpath);
6224                         else
6225                                 qg->qg_qpaths[qg->qg_numqueues].qp_name =
6226                                         newstr(d->d_name);
6227
6228                         if (tTd(41, 2))
6229                                 sm_dprintf("multiqueue_cache: %d: \"%s\" cached (%x).\n",
6230                                         qg->qg_numqueues, relpath,
6231                                         qg->qg_qpaths[qg->qg_numqueues].qp_subdirs);
6232 #if SM_CONF_SHM
6233                         qg->qg_qpaths[qg->qg_numqueues].qp_idx = qn;
6234                         *phash = hash_q(relpath, *phash);
6235 #endif /* SM_CONF_SHM */
6236                         qg->qg_numqueues++;
6237                         ++qn;
6238                         slotsleft--;
6239                 }
6240                 (void) closedir(dp);
6241
6242                 /* undo damage */
6243                 *delim = '/';
6244         }
6245         if (qg->qg_numqueues == 0)
6246         {
6247                 qg->qg_qpaths = (QPATHS *) xalloc(sizeof(*qg->qg_qpaths));
6248
6249                 /* test path to get warning messages */
6250                 i = safedirpath(qpath, RunAsUid, RunAsGid, NULL, sff, 0, 0);
6251                 if (i == ENOENT)
6252                 {
6253                         syserr("can not opendir(%s)", qpath);
6254                         if (tTd(41, 2))
6255                                 sm_dprintf("multiqueue_cache: opendir(\"%s\"): %s\n",
6256                                            qpath, sm_errstring(i));
6257                         ExitStat = EX_CONFIG;
6258                         return qn;
6259                 }
6260
6261                 qg->qg_qpaths[0].qp_subdirs = QP_NOSUB;
6262                 qg->qg_numqueues = 1;
6263
6264                 /* check subdirs */
6265 #define CHKSUBDIR(name, flag)   \
6266         (void) sm_strlcpyn(subdir, sizeof(subdir), 3, qg->qg_qdir, "/", name); \
6267         if (chkqdir(subdir, sff))       \
6268                 qg->qg_qpaths[0].qp_subdirs |= flag;    \
6269         else
6270
6271                 CHKSUBDIR("qf", QP_SUBQF);
6272                 CHKSUBDIR("df", QP_SUBDF);
6273                 CHKSUBDIR("xf", QP_SUBXF);
6274
6275                 if (qg->qg_qdir[blen - 1] != '\0' &&
6276                     qg->qg_qdir[blen] != '\0')
6277                 {
6278                         /*
6279                         **  Copy the last component into qpaths and
6280                         **  cut off qdir
6281                         */
6282
6283                         qg->qg_qpaths[0].qp_name = newstr(qg->qg_qdir + blen);
6284                         qg->qg_qdir[blen - 1] = '\0';
6285                 }
6286                 else
6287                         qg->qg_qpaths[0].qp_name = newstr(".");
6288
6289 #if SM_CONF_SHM
6290                 qg->qg_qpaths[0].qp_idx = qn;
6291                 *phash = hash_q(qg->qg_qpaths[0].qp_name, *phash);
6292 #endif /* SM_CONF_SHM */
6293                 ++qn;
6294         }
6295         return qn;
6296 }
6297
6298 /*
6299 **  FILESYS_FIND -- find entry in FileSys table, or add new one
6300 **
6301 **      Given the pathname of a directory, determine the file system
6302 **      in which that directory resides, and return a pointer to the
6303 **      entry in the FileSys table that describes the file system.
6304 **      A new entry is added if necessary (and requested).
6305 **      If the directory does not exist, -1 is returned.
6306 **
6307 **      Parameters:
6308 **              name -- name of directory (must be persistent!)
6309 **              path -- pathname of directory (name plus maybe "/df")
6310 **              add -- add to structure if not found.
6311 **
6312 **      Returns:
6313 **              >=0: found: index in file system table
6314 **              <0: some error, i.e.,
6315 **              FSF_TOO_MANY: too many filesystems (-> syserr())
6316 **              FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6317 **              FSF_NOT_FOUND: not in list
6318 */
6319
6320 static short filesys_find __P((const char *, const char *, bool));
6321
6322 #define FSF_NOT_FOUND   (-1)
6323 #define FSF_STAT_FAIL   (-2)
6324 #define FSF_TOO_MANY    (-3)
6325
6326 static short
6327 filesys_find(name, path, add)
6328         const char *name;
6329         const char *path;
6330         bool add;
6331 {
6332         struct stat st;
6333         short i;
6334
6335         if (stat(path, &st) < 0)
6336         {
6337                 syserr("cannot stat queue directory %s", path);
6338                 return FSF_STAT_FAIL;
6339         }
6340         for (i = 0; i < NumFileSys; ++i)
6341         {
6342                 if (FILE_SYS_DEV(i) == st.st_dev)
6343                 {
6344                         /*
6345                         **  Make sure the file system (FS) name is set:
6346                         **  even though the source code indicates that
6347                         **  FILE_SYS_DEV() is only set below, it could be
6348                         **  set via shared memory, hence we need to perform
6349                         **  this check/assignment here.
6350                         */
6351
6352                         if (NULL == FILE_SYS_NAME(i))
6353                                 FILE_SYS_NAME(i) = name;
6354                         return i;
6355                 }
6356         }
6357         if (i >= MAXFILESYS)
6358         {
6359                 syserr("too many queue file systems (%d max)", MAXFILESYS);
6360                 return FSF_TOO_MANY;
6361         }
6362         if (!add)
6363                 return FSF_NOT_FOUND;
6364
6365         ++NumFileSys;
6366         FILE_SYS_NAME(i) = name;
6367         FILE_SYS_DEV(i) = st.st_dev;
6368         FILE_SYS_AVAIL(i) = 0;
6369         FILE_SYS_BLKSIZE(i) = 1024; /* avoid divide by zero */
6370         return i;
6371 }
6372
6373 /*
6374 **  FILESYS_SETUP -- set up mapping from queue directories to file systems
6375 **
6376 **      This data structure is used to efficiently check the amount of
6377 **      free space available in a set of queue directories.
6378 **
6379 **      Parameters:
6380 **              add -- initialize structure if necessary.
6381 **
6382 **      Returns:
6383 **              0: success
6384 **              <0: some error, i.e.,
6385 **              FSF_NOT_FOUND: not in list
6386 **              FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6387 **              FSF_TOO_MANY: too many filesystems (-> syserr())
6388 */
6389
6390 static int filesys_setup __P((bool));
6391
6392 static int
6393 filesys_setup(add)
6394         bool add;
6395 {
6396         int i, j;
6397         short fs;
6398         int ret;
6399
6400         ret = 0;
6401         for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
6402         {
6403                 for (j = 0; j < Queue[i]->qg_numqueues; ++j)
6404                 {
6405                         QPATHS *qp = &Queue[i]->qg_qpaths[j];
6406                         char qddf[MAXPATHLEN];
6407
6408                         (void) sm_strlcpyn(qddf, sizeof(qddf), 2, qp->qp_name,
6409                                         (bitset(QP_SUBDF, qp->qp_subdirs)
6410                                                 ? "/df" : ""));
6411                         fs = filesys_find(qp->qp_name, qddf, add);
6412                         if (fs >= 0)
6413                                 qp->qp_fsysidx = fs;
6414                         else
6415                                 qp->qp_fsysidx = 0;
6416                         if (fs < ret)
6417                                 ret = fs;
6418                 }
6419         }
6420         return ret;
6421 }
6422
6423 /*
6424 **  FILESYS_UPDATE -- update amount of free space on all file systems
6425 **
6426 **      The FileSys table is used to cache the amount of free space
6427 **      available on all queue directory file systems.
6428 **      This function updates the cached information if it has expired.
6429 **
6430 **      Parameters:
6431 **              none.
6432 **
6433 **      Returns:
6434 **              none.
6435 **
6436 **      Side Effects:
6437 **              Updates FileSys table.
6438 */
6439
6440 void
6441 filesys_update()
6442 {
6443         int i;
6444         long avail, blksize;
6445         time_t now;
6446         static time_t nextupdate = 0;
6447
6448 #if SM_CONF_SHM
6449         /*
6450         **  Only the daemon updates the shared memory, i.e.,
6451         **  if shared memory is available but the pid is not the
6452         **  one of the daemon, then don't do anything.
6453         */
6454
6455         if (ShmId != SM_SHM_NO_ID && DaemonPid != CurrentPid)
6456                 return;
6457 #endif /* SM_CONF_SHM */
6458         now = curtime();
6459         if (now < nextupdate)
6460                 return;
6461         nextupdate = now + FILESYS_UPDATE_INTERVAL;
6462         for (i = 0; i < NumFileSys; ++i)
6463         {
6464                 FILESYS *fs = &FILE_SYS(i);
6465
6466                 avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6467                 if (avail < 0 || blksize <= 0)
6468                 {
6469                         if (LogLevel > 5)
6470                                 sm_syslog(LOG_ERR, NOQID,
6471                                         "filesys_update failed: %s, fs=%s, avail=%ld, blocksize=%ld",
6472                                         sm_errstring(errno),
6473                                         FILE_SYS_NAME(i), avail, blksize);
6474                         fs->fs_avail = 0;
6475                         fs->fs_blksize = 1024; /* avoid divide by zero */
6476                         nextupdate = now + 2; /* let's do this soon again */
6477                 }
6478                 else
6479                 {
6480                         fs->fs_avail = avail;
6481                         fs->fs_blksize = blksize;
6482                 }
6483         }
6484 }
6485
6486 #if _FFR_ANY_FREE_FS
6487 /*
6488 **  FILESYS_FREE -- check whether there is at least one fs with enough space.
6489 **
6490 **      Parameters:
6491 **              fsize -- file size in bytes
6492 **
6493 **      Returns:
6494 **              true iff there is one fs with more than fsize bytes free.
6495 */
6496
6497 bool
6498 filesys_free(fsize)
6499         long fsize;
6500 {
6501         int i;
6502
6503         if (fsize <= 0)
6504                 return true;
6505         for (i = 0; i < NumFileSys; ++i)
6506         {
6507                 long needed = 0;
6508
6509                 if (FILE_SYS_AVAIL(i) < 0 || FILE_SYS_BLKSIZE(i) <= 0)
6510                         continue;
6511                 needed += fsize / FILE_SYS_BLKSIZE(i)
6512                           + ((fsize % FILE_SYS_BLKSIZE(i)
6513                               > 0) ? 1 : 0)
6514                           + MinBlocksFree;
6515                 if (needed <= FILE_SYS_AVAIL(i))
6516                         return true;
6517         }
6518         return false;
6519 }
6520 #endif /* _FFR_ANY_FREE_FS */
6521
6522 /*
6523 **  DISK_STATUS -- show amount of free space in queue directories
6524 **
6525 **      Parameters:
6526 **              out -- output file pointer.
6527 **              prefix -- string to output in front of each line.
6528 **
6529 **      Returns:
6530 **              none.
6531 */
6532
6533 void
6534 disk_status(out, prefix)
6535         SM_FILE_T *out;
6536         char *prefix;
6537 {
6538         int i;
6539         long avail, blksize;
6540         long free;
6541
6542         for (i = 0; i < NumFileSys; ++i)
6543         {
6544                 avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6545                 if (avail >= 0 && blksize > 0)
6546                 {
6547                         free = (long)((double) avail *
6548                                 ((double) blksize / 1024));
6549                 }
6550                 else
6551                         free = -1;
6552                 (void) sm_io_fprintf(out, SM_TIME_DEFAULT,
6553                                 "%s%d/%s/%ld\r\n",
6554                                 prefix, i,
6555                                 FILE_SYS_NAME(i),
6556                                         free);
6557         }
6558 }
6559
6560 #if SM_CONF_SHM
6561
6562 /*
6563 **  INIT_SEM -- initialize semaphore system
6564 **
6565 **      Parameters:
6566 **              owner -- is this the owner of semaphores?
6567 **
6568 **      Returns:
6569 **              none.
6570 */
6571
6572 #if _FFR_USE_SEM_LOCKING
6573 #if SM_CONF_SEM
6574 static int SemId = -1;          /* Semaphore Id */
6575 int SemKey = SM_SEM_KEY;
6576 #endif /* SM_CONF_SEM */
6577 #endif /* _FFR_USE_SEM_LOCKING */
6578
6579 static void init_sem __P((bool));
6580
6581 static void
6582 init_sem(owner)
6583         bool owner;
6584 {
6585 #if _FFR_USE_SEM_LOCKING
6586 #if SM_CONF_SEM
6587         SemId = sm_sem_start(SemKey, 1, 0, owner);
6588         if (SemId < 0)
6589         {
6590                 sm_syslog(LOG_ERR, NOQID,
6591                         "func=init_sem, sem_key=%ld, sm_sem_start=%d",
6592                         (long) SemKey, SemId);
6593                 return;
6594         }
6595 #endif /* SM_CONF_SEM */
6596 #endif /* _FFR_USE_SEM_LOCKING */
6597         return;
6598 }
6599
6600 /*
6601 **  STOP_SEM -- stop semaphore system
6602 **
6603 **      Parameters:
6604 **              owner -- is this the owner of semaphores?
6605 **
6606 **      Returns:
6607 **              none.
6608 */
6609
6610 static void stop_sem __P((bool));
6611
6612 static void
6613 stop_sem(owner)
6614         bool owner;
6615 {
6616 #if _FFR_USE_SEM_LOCKING
6617 #if SM_CONF_SEM
6618         if (owner && SemId >= 0)
6619                 sm_sem_stop(SemId);
6620 #endif /* SM_CONF_SEM */
6621 #endif /* _FFR_USE_SEM_LOCKING */
6622         return;
6623 }
6624
6625 /*
6626 **  UPD_QS -- update information about queue when adding/deleting an entry
6627 **
6628 **      Parameters:
6629 **              e -- envelope.
6630 **              count -- add/remove entry (+1/0/-1: add/no change/remove)
6631 **              space -- update the space available as well.
6632 **                      (>0/0/<0: add/no change/remove)
6633 **              where -- caller (for logging)
6634 **
6635 **      Returns:
6636 **              none.
6637 **
6638 **      Side Effects:
6639 **              Modifies available space in filesystem.
6640 **              Changes number of entries in queue directory.
6641 */
6642
6643 void
6644 upd_qs(e, count, space, where)
6645         ENVELOPE *e;
6646         int count;
6647         int space;
6648         char *where;
6649 {
6650         short fidx;
6651         int idx;
6652 # if _FFR_USE_SEM_LOCKING
6653         int r;
6654 # endif /* _FFR_USE_SEM_LOCKING */
6655         long s;
6656
6657         if (ShmId == SM_SHM_NO_ID || e == NULL)
6658                 return;
6659         if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
6660                 return;
6661         idx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_idx;
6662         if (tTd(73,2))
6663                 sm_dprintf("func=upd_qs, count=%d, space=%d, where=%s, idx=%d, entries=%d\n",
6664                         count, space, where, idx, QSHM_ENTRIES(idx));
6665
6666         /* XXX in theory this needs to be protected with a mutex */
6667         if (QSHM_ENTRIES(idx) >= 0 && count != 0)
6668         {
6669 # if _FFR_USE_SEM_LOCKING
6670                 r = sm_sem_acq(SemId, 0, 1);
6671 # endif /* _FFR_USE_SEM_LOCKING */
6672                 QSHM_ENTRIES(idx) += count;
6673 # if _FFR_USE_SEM_LOCKING
6674                 if (r >= 0)
6675                         r = sm_sem_rel(SemId, 0, 1);
6676 # endif /* _FFR_USE_SEM_LOCKING */
6677         }
6678
6679         fidx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_fsysidx;
6680         if (fidx < 0)
6681                 return;
6682
6683         /* update available space also?  (might be loseqfile) */
6684         if (space == 0)
6685                 return;
6686
6687         /* convert size to blocks; this causes rounding errors */
6688         s = e->e_msgsize / FILE_SYS_BLKSIZE(fidx);
6689         if (s == 0)
6690                 return;
6691
6692         /* XXX in theory this needs to be protected with a mutex */
6693         if (space > 0)
6694                 FILE_SYS_AVAIL(fidx) += s;
6695         else
6696                 FILE_SYS_AVAIL(fidx) -= s;
6697
6698 }
6699
6700 static bool write_key_file __P((char *, long));
6701 static long read_key_file __P((char *, long));
6702
6703 /*
6704 **  WRITE_KEY_FILE -- record some key into a file.
6705 **
6706 **      Parameters:
6707 **              keypath -- file name.
6708 **              key -- key to write.
6709 **
6710 **      Returns:
6711 **              true iff file could be written.
6712 **
6713 **      Side Effects:
6714 **              writes file.
6715 */
6716
6717 static bool
6718 write_key_file(keypath, key)
6719         char *keypath;
6720         long key;
6721 {
6722         bool ok;
6723         long sff;
6724         SM_FILE_T *keyf;
6725
6726         ok = false;
6727         if (keypath == NULL || *keypath == '\0')
6728                 return ok;
6729         sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY|SFF_CREAT;
6730         if (TrustedUid != 0 && RealUid == TrustedUid)
6731                 sff |= SFF_OPENASROOT;
6732         keyf = safefopen(keypath, O_WRONLY|O_TRUNC, FileMode, sff);
6733         if (keyf == NULL)
6734         {
6735                 sm_syslog(LOG_ERR, NOQID, "unable to write %s: %s",
6736                           keypath, sm_errstring(errno));
6737         }
6738         else
6739         {
6740                 if (geteuid() == 0 && RunAsUid != 0)
6741                 {
6742 #  if HASFCHOWN
6743                         int fd;
6744
6745                         fd = keyf->f_file;
6746                         if (fd >= 0 && fchown(fd, RunAsUid, -1) < 0)
6747                         {
6748                                 int err = errno;
6749
6750                                 sm_syslog(LOG_ALERT, NOQID,
6751                                           "ownership change on %s to %d failed: %s",
6752                                           keypath, RunAsUid, sm_errstring(err));
6753                         }
6754 #  endif /* HASFCHOWN */
6755                 }
6756                 ok = sm_io_fprintf(keyf, SM_TIME_DEFAULT, "%ld\n", key) !=
6757                      SM_IO_EOF;
6758                 ok = (sm_io_close(keyf, SM_TIME_DEFAULT) != SM_IO_EOF) && ok;
6759         }
6760         return ok;
6761 }
6762
6763 /*
6764 **  READ_KEY_FILE -- read a key from a file.
6765 **
6766 **      Parameters:
6767 **              keypath -- file name.
6768 **              key -- default key.
6769 **
6770 **      Returns:
6771 **              key.
6772 */
6773
6774 static long
6775 read_key_file(keypath, key)
6776         char *keypath;
6777         long key;
6778 {
6779         int r;
6780         long sff, n;
6781         SM_FILE_T *keyf;
6782
6783         if (keypath == NULL || *keypath == '\0')
6784                 return key;
6785         sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY;
6786         if (RealUid == 0 || (TrustedUid != 0 && RealUid == TrustedUid))
6787                 sff |= SFF_OPENASROOT;
6788         keyf = safefopen(keypath, O_RDONLY, FileMode, sff);
6789         if (keyf == NULL)
6790         {
6791                 sm_syslog(LOG_ERR, NOQID, "unable to read %s: %s",
6792                           keypath, sm_errstring(errno));
6793         }
6794         else
6795         {
6796                 r = sm_io_fscanf(keyf, SM_TIME_DEFAULT, "%ld", &n);
6797                 if (r == 1)
6798                         key = n;
6799                 (void) sm_io_close(keyf, SM_TIME_DEFAULT);
6800         }
6801         return key;
6802 }
6803
6804 /*
6805 **  INIT_SHM -- initialize shared memory structure
6806 **
6807 **      Initialize or attach to shared memory segment.
6808 **      Currently it is not a fatal error if this doesn't work.
6809 **      However, it causes us to have a "fallback" storage location
6810 **      for everything that is supposed to be in the shared memory,
6811 **      which makes the code slightly ugly.
6812 **
6813 **      Parameters:
6814 **              qn -- number of queue directories.
6815 **              owner -- owner of shared memory.
6816 **              hash -- identifies data that is stored in shared memory.
6817 **
6818 **      Returns:
6819 **              none.
6820 */
6821
6822 static void init_shm __P((int, bool, unsigned int));
6823
6824 static void
6825 init_shm(qn, owner, hash)
6826         int qn;
6827         bool owner;
6828         unsigned int hash;
6829 {
6830         int i;
6831         int count;
6832         int save_errno;
6833         bool keyselect;
6834
6835         PtrFileSys = &FileSys[0];
6836         PNumFileSys = &Numfilesys;
6837 /* if this "key" is specified: select one yourself */
6838 #define SEL_SHM_KEY     ((key_t) -1)
6839 #define FIRST_SHM_KEY   25
6840
6841         /* This allows us to disable shared memory at runtime. */
6842         if (ShmKey == 0)
6843                 return;
6844
6845         count = 0;
6846         shms = SM_T_SIZE + qn * sizeof(QUEUE_SHM_T);
6847         keyselect = ShmKey == SEL_SHM_KEY;
6848         if (keyselect)
6849         {
6850                 if (owner)
6851                         ShmKey = FIRST_SHM_KEY;
6852                 else
6853                 {
6854                         errno = 0;
6855                         ShmKey = read_key_file(ShmKeyFile, ShmKey);
6856                         keyselect = false;
6857                         if (ShmKey == SEL_SHM_KEY)
6858                         {
6859                                 save_errno = (errno != 0) ? errno : EINVAL;
6860                                 goto error;
6861                         }
6862                 }
6863         }
6864         for (;;)
6865         {
6866                 /* allow read/write access for group? */
6867                 Pshm = sm_shmstart(ShmKey, shms,
6868                                 SHM_R|SHM_W|(SHM_R>>3)|(SHM_W>>3),
6869                                 &ShmId, owner);
6870                 save_errno = errno;
6871                 if (Pshm != NULL || !sm_file_exists(save_errno))
6872                         break;
6873                 if (++count >= 3)
6874                 {
6875                         if (keyselect)
6876                         {
6877                                 ++ShmKey;
6878
6879                                 /* back where we started? */
6880                                 if (ShmKey == SEL_SHM_KEY)
6881                                         break;
6882                                 continue;
6883                         }
6884                         break;
6885                 }
6886
6887                 /* only sleep if we are at the first key */
6888                 if (!keyselect || ShmKey == SEL_SHM_KEY)
6889                         sleep(count);
6890         }
6891         if (Pshm != NULL)
6892         {
6893                 int *p;
6894
6895                 if (keyselect)
6896                         (void) write_key_file(ShmKeyFile, (long) ShmKey);
6897                 if (owner && RunAsUid != 0)
6898                 {
6899                         i = sm_shmsetowner(ShmId, RunAsUid, RunAsGid, 0660);
6900                         if (i != 0)
6901                                 sm_syslog(LOG_ERR, NOQID,
6902                                         "key=%ld, sm_shmsetowner=%d, RunAsUid=%d, RunAsGid=%d",
6903                                         (long) ShmKey, i, RunAsUid, RunAsGid);
6904                 }
6905                 p = (int *) Pshm;
6906                 if (owner)
6907                 {
6908                         *p = (int) shms;
6909                         *((pid_t *) SHM_OFF_PID(Pshm)) = CurrentPid;
6910                         p = (int *) SHM_OFF_TAG(Pshm);
6911                         *p = hash;
6912                 }
6913                 else
6914                 {
6915                         if (*p != (int) shms)
6916                         {
6917                                 save_errno = EINVAL;
6918                                 cleanup_shm(false);
6919                                 goto error;
6920                         }
6921                         p = (int *) SHM_OFF_TAG(Pshm);
6922                         if (*p != (int) hash)
6923                         {
6924                                 save_errno = EINVAL;
6925                                 cleanup_shm(false);
6926                                 goto error;
6927                         }
6928
6929                         /*
6930                         **  XXX how to check the pid?
6931                         **  Read it from the pid-file? That does
6932                         **  not need to exist.
6933                         **  We could disable shm if we can't confirm
6934                         **  that it is the right one.
6935                         */
6936                 }
6937
6938                 PtrFileSys = (FILESYS *) OFF_FILE_SYS(Pshm);
6939                 PNumFileSys = (int *) OFF_NUM_FILE_SYS(Pshm);
6940                 QShm = (QUEUE_SHM_T *) OFF_QUEUE_SHM(Pshm);
6941                 PRSATmpCnt = (int *) OFF_RSA_TMP_CNT(Pshm);
6942                 *PRSATmpCnt = 0;
6943                 if (owner)
6944                 {
6945                         /* initialize values in shared memory */
6946                         NumFileSys = 0;
6947                         for (i = 0; i < qn; i++)
6948                                 QShm[i].qs_entries = -1;
6949                 }
6950                 init_sem(owner);
6951                 return;
6952         }
6953   error:
6954         if (LogLevel > (owner ? 8 : 11))
6955         {
6956                 sm_syslog(owner ? LOG_ERR : LOG_NOTICE, NOQID,
6957                           "can't %s shared memory, key=%ld: %s",
6958                           owner ? "initialize" : "attach to",
6959                           (long) ShmKey, sm_errstring(save_errno));
6960         }
6961 }
6962 #endif /* SM_CONF_SHM */
6963
6964
6965 /*
6966 **  SETUP_QUEUES -- set up all queue groups
6967 **
6968 **      Parameters:
6969 **              owner -- owner of shared memory?
6970 **
6971 **      Returns:
6972 **              none.
6973 **
6974 #if SM_CONF_SHM
6975 **      Side Effects:
6976 **              attaches shared memory.
6977 #endif * SM_CONF_SHM *
6978 */
6979
6980 void
6981 setup_queues(owner)
6982         bool owner;
6983 {
6984         int i, qn, len;
6985         unsigned int hashval;
6986         time_t now;
6987         char basedir[MAXPATHLEN];
6988         struct stat st;
6989
6990         /*
6991         **  Determine basedir for all queue directories.
6992         **  All queue directories must be (first level) subdirectories
6993         **  of the basedir.  The basedir is the QueueDir
6994         **  without wildcards, but with trailing /
6995         */
6996
6997         hashval = 0;
6998         errno = 0;
6999         len = sm_strlcpy(basedir, QueueDir, sizeof(basedir));
7000
7001         /* Provide space for trailing '/' */
7002         if (len >= sizeof(basedir) - 1)
7003         {
7004                 syserr("QueueDirectory: path too long: %d,  max %d",
7005                         len, (int) sizeof(basedir) - 1);
7006                 ExitStat = EX_CONFIG;
7007                 return;
7008         }
7009         SM_ASSERT(len > 0);
7010         if (basedir[len - 1] == '*')
7011         {
7012                 char *cp;
7013
7014                 cp = SM_LAST_DIR_DELIM(basedir);
7015                 if (cp == NULL)
7016                 {
7017                         syserr("QueueDirectory: can not wildcard relative path \"%s\"",
7018                                 QueueDir);
7019                         if (tTd(41, 2))
7020                                 sm_dprintf("setup_queues: \"%s\": Can not wildcard relative path.\n",
7021                                         QueueDir);
7022                         ExitStat = EX_CONFIG;
7023                         return;
7024                 }
7025
7026                 /* cut off wildcard pattern */
7027                 *++cp = '\0';
7028                 len = cp - basedir;
7029         }
7030         else if (!SM_IS_DIR_DELIM(basedir[len - 1]))
7031         {
7032                 /* append trailing slash since it is a directory */
7033                 basedir[len] = '/';
7034                 basedir[++len] = '\0';
7035         }
7036
7037         /* len counts up to the last directory delimiter */
7038         SM_ASSERT(basedir[len - 1] == '/');
7039
7040         if (chdir(basedir) < 0)
7041         {
7042                 int save_errno = errno;
7043
7044                 syserr("can not chdir(%s)", basedir);
7045                 if (save_errno == EACCES)
7046                         (void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT,
7047                                 "Program mode requires special privileges, e.g., root or TrustedUser.\n");
7048                 if (tTd(41, 2))
7049                         sm_dprintf("setup_queues: \"%s\": %s\n",
7050                                    basedir, sm_errstring(errno));
7051                 ExitStat = EX_CONFIG;
7052                 return;
7053         }
7054 #if SM_CONF_SHM
7055         hashval = hash_q(basedir, hashval);
7056 #endif /* SM_CONF_SHM */
7057
7058         /* initialize for queue runs */
7059         DoQueueRun = false;
7060         now = curtime();
7061         for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
7062                 Queue[i]->qg_nextrun = now;
7063
7064
7065         if (UseMSP && OpMode != MD_TEST)
7066         {
7067                 long sff = SFF_CREAT;
7068
7069                 if (stat(".", &st) < 0)
7070                 {
7071                         syserr("can not stat(%s)", basedir);
7072                         if (tTd(41, 2))
7073                                 sm_dprintf("setup_queues: \"%s\": %s\n",
7074                                            basedir, sm_errstring(errno));
7075                         ExitStat = EX_CONFIG;
7076                         return;
7077                 }
7078                 if (RunAsUid == 0)
7079                         sff |= SFF_ROOTOK;
7080
7081                 /*
7082                 **  Check queue directory permissions.
7083                 **      Can we write to a group writable queue directory?
7084                 */
7085
7086                 if (bitset(S_IWGRP, QueueFileMode) &&
7087                     bitset(S_IWGRP, st.st_mode) &&
7088                     safefile(" ", RunAsUid, RunAsGid, RunAsUserName, sff,
7089                              QueueFileMode, NULL) != 0)
7090                 {
7091                         syserr("can not write to queue directory %s (RunAsGid=%d, required=%d)",
7092                                 basedir, (int) RunAsGid, (int) st.st_gid);
7093                 }
7094                 if (bitset(S_IWOTH|S_IXOTH, st.st_mode))
7095                 {
7096 #if _FFR_MSP_PARANOIA
7097                         syserr("dangerous permissions=%o on queue directory %s",
7098                                 (int) st.st_mode, basedir);
7099 #else /* _FFR_MSP_PARANOIA */
7100                         if (LogLevel > 0)
7101                                 sm_syslog(LOG_ERR, NOQID,
7102                                           "dangerous permissions=%o on queue directory %s",
7103                                           (int) st.st_mode, basedir);
7104 #endif /* _FFR_MSP_PARANOIA */
7105                 }
7106 #if _FFR_MSP_PARANOIA
7107                 if (NumQueue > 1)
7108                         syserr("can not use multiple queues for MSP");
7109 #endif /* _FFR_MSP_PARANOIA */
7110         }
7111
7112         /* initial number of queue directories */
7113         qn = 0;
7114         for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
7115                 qn = multiqueue_cache(basedir, len, Queue[i], qn, &hashval);
7116
7117 #if SM_CONF_SHM
7118         init_shm(qn, owner, hashval);
7119         i = filesys_setup(owner || ShmId == SM_SHM_NO_ID);
7120         if (i == FSF_NOT_FOUND)
7121         {
7122                 /*
7123                 **  We didn't get the right filesystem data
7124                 **  This may happen if we don't have the right shared memory.
7125                 **  So let's do this without shared memory.
7126                 */
7127
7128                 SM_ASSERT(!owner);
7129                 cleanup_shm(false);     /* release shared memory */
7130                 i = filesys_setup(false);
7131                 if (i < 0)
7132                         syserr("filesys_setup failed twice, result=%d", i);
7133                 else if (LogLevel > 8)
7134                         sm_syslog(LOG_WARNING, NOQID,
7135                                   "shared memory does not contain expected data, ignored");
7136         }
7137 #else /* SM_CONF_SHM */
7138         i = filesys_setup(true);
7139 #endif /* SM_CONF_SHM */
7140         if (i < 0)
7141                 ExitStat = EX_CONFIG;
7142 }
7143
7144 #if SM_CONF_SHM
7145 /*
7146 **  CLEANUP_SHM -- do some cleanup work for shared memory etc
7147 **
7148 **      Parameters:
7149 **              owner -- owner of shared memory?
7150 **
7151 **      Returns:
7152 **              none.
7153 **
7154 **      Side Effects:
7155 **              detaches shared memory.
7156 */
7157
7158 void
7159 cleanup_shm(owner)
7160         bool owner;
7161 {
7162         if (ShmId != SM_SHM_NO_ID)
7163         {
7164                 if (sm_shmstop(Pshm, ShmId, owner) < 0 && LogLevel > 8)
7165                         sm_syslog(LOG_INFO, NOQID, "sm_shmstop failed=%s",
7166                                   sm_errstring(errno));
7167                 Pshm = NULL;
7168                 ShmId = SM_SHM_NO_ID;
7169         }
7170         stop_sem(owner);
7171 }
7172 #endif /* SM_CONF_SHM */
7173
7174 /*
7175 **  CLEANUP_QUEUES -- do some cleanup work for queues
7176 **
7177 **      Parameters:
7178 **              none.
7179 **
7180 **      Returns:
7181 **              none.
7182 **
7183 */
7184
7185 void
7186 cleanup_queues()
7187 {
7188         sync_queue_time();
7189 }
7190 /*
7191 **  SET_DEF_QUEUEVAL -- set default values for a queue group.
7192 **
7193 **      Parameters:
7194 **              qg -- queue group
7195 **              all -- set all values (true for default group)?
7196 **
7197 **      Returns:
7198 **              none.
7199 **
7200 **      Side Effects:
7201 **              sets default values for the queue group.
7202 */
7203
7204 void
7205 set_def_queueval(qg, all)
7206         QUEUEGRP *qg;
7207         bool all;
7208 {
7209         if (bitnset(QD_DEFINED, qg->qg_flags))
7210                 return;
7211         if (all)
7212                 qg->qg_qdir = QueueDir;
7213 #if _FFR_QUEUE_GROUP_SORTORDER
7214         qg->qg_sortorder = QueueSortOrder;
7215 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7216         qg->qg_maxqrun = all ? MaxRunnersPerQueue : -1;
7217         qg->qg_nice = NiceQueueRun;
7218 }
7219 /*
7220 **  MAKEQUEUE -- define a new queue.
7221 **
7222 **      Parameters:
7223 **              line -- description of queue.  This is in labeled fields.
7224 **                      The fields are:
7225 **                         F -- the flags associated with the queue
7226 **                         I -- the interval between running the queue
7227 **                         J -- the maximum # of jobs in work list
7228 **                         [M -- the maximum # of jobs in a queue run]
7229 **                         N -- the niceness at which to run
7230 **                         P -- the path to the queue
7231 **                         S -- the queue sorting order
7232 **                         R -- number of parallel queue runners
7233 **                         r -- max recipients per envelope
7234 **                      The first word is the canonical name of the queue.
7235 **              qdef -- this is a 'Q' definition from .cf
7236 **
7237 **      Returns:
7238 **              none.
7239 **
7240 **      Side Effects:
7241 **              enters the queue into the queue table.
7242 */
7243
7244 void
7245 makequeue(line, qdef)
7246         char *line;
7247         bool qdef;
7248 {
7249         register char *p;
7250         register QUEUEGRP *qg;
7251         register STAB *s;
7252         int i;
7253         char fcode;
7254
7255         /* allocate a queue and set up defaults */
7256         qg = (QUEUEGRP *) xalloc(sizeof(*qg));
7257         memset((char *) qg, '\0', sizeof(*qg));
7258
7259         if (line[0] == '\0')
7260         {
7261                 syserr("name required for queue");
7262                 return;
7263         }
7264
7265         /* collect the queue name */
7266         for (p = line;
7267              *p != '\0' && *p != ',' && !(isascii(*p) && isspace(*p));
7268              p++)
7269                 continue;
7270         if (*p != '\0')
7271                 *p++ = '\0';
7272         qg->qg_name = newstr(line);
7273
7274         /* set default values, can be overridden below */
7275         set_def_queueval(qg, false);
7276
7277         /* now scan through and assign info from the fields */
7278         while (*p != '\0')
7279         {
7280                 auto char *delimptr;
7281
7282                 while (*p != '\0' &&
7283                        (*p == ',' || (isascii(*p) && isspace(*p))))
7284                         p++;
7285
7286                 /* p now points to field code */
7287                 fcode = *p;
7288                 while (*p != '\0' && *p != '=' && *p != ',')
7289                         p++;
7290                 if (*p++ != '=')
7291                 {
7292                         syserr("queue %s: `=' expected", qg->qg_name);
7293                         return;
7294                 }
7295                 while (isascii(*p) && isspace(*p))
7296                         p++;
7297
7298                 /* p now points to the field body */
7299                 p = munchstring(p, &delimptr, ',');
7300
7301                 /* install the field into the queue struct */
7302                 switch (fcode)
7303                 {
7304                   case 'P':             /* pathname */
7305                         if (*p == '\0')
7306                                 syserr("queue %s: empty path name",
7307                                         qg->qg_name);
7308                         else
7309                                 qg->qg_qdir = newstr(p);
7310                         break;
7311
7312                   case 'F':             /* flags */
7313                         for (; *p != '\0'; p++)
7314                                 if (!(isascii(*p) && isspace(*p)))
7315                                         setbitn(*p, qg->qg_flags);
7316                         break;
7317
7318                         /*
7319                         **  Do we need two intervals here:
7320                         **  One for persistent queue runners,
7321                         **  one for "normal" queue runs?
7322                         */
7323
7324                   case 'I':     /* interval between running the queue */
7325                         qg->qg_queueintvl = convtime(p, 'm');
7326                         break;
7327
7328                   case 'N':             /* run niceness */
7329                         qg->qg_nice = atoi(p);
7330                         break;
7331
7332                   case 'R':             /* maximum # of runners for the group */
7333                         i = atoi(p);
7334
7335                         /* can't have more runners than allowed total */
7336                         if (MaxQueueChildren > 0 && i > MaxQueueChildren)
7337                         {
7338                                 qg->qg_maxqrun = MaxQueueChildren;
7339                                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7340                                                      "Q=%s: R=%d exceeds MaxQueueChildren=%d, set to MaxQueueChildren\n",
7341                                                      qg->qg_name, i,
7342                                                      MaxQueueChildren);
7343                         }
7344                         else
7345                                 qg->qg_maxqrun = i;
7346                         break;
7347
7348                   case 'J':             /* maximum # of jobs in work list */
7349                         qg->qg_maxlist = atoi(p);
7350                         break;
7351
7352                   case 'r':             /* max recipients per envelope */
7353                         qg->qg_maxrcpt = atoi(p);
7354                         break;
7355
7356 #if _FFR_QUEUE_GROUP_SORTORDER
7357                   case 'S':             /* queue sorting order */
7358                         switch (*p)
7359                         {
7360                           case 'h':     /* Host first */
7361                           case 'H':
7362                                 qg->qg_sortorder = QSO_BYHOST;
7363                                 break;
7364
7365                           case 'p':     /* Priority order */
7366                           case 'P':
7367                                 qg->qg_sortorder = QSO_BYPRIORITY;
7368                                 break;
7369
7370                           case 't':     /* Submission time */
7371                           case 'T':
7372                                 qg->qg_sortorder = QSO_BYTIME;
7373                                 break;
7374
7375                           case 'f':     /* File name */
7376                           case 'F':
7377                                 qg->qg_sortorder = QSO_BYFILENAME;
7378                                 break;
7379
7380                           case 'm':     /* Modification time */
7381                           case 'M':
7382                                 qg->qg_sortorder = QSO_BYMODTIME;
7383                                 break;
7384
7385                           case 'r':     /* Random */
7386                           case 'R':
7387                                 qg->qg_sortorder = QSO_RANDOM;
7388                                 break;
7389
7390 # if _FFR_RHS
7391                           case 's':     /* Shuffled host name */
7392                           case 'S':
7393                                 qg->qg_sortorder = QSO_BYSHUFFLE;
7394                                 break;
7395 # endif /* _FFR_RHS */
7396
7397                           case 'n':     /* none */
7398                           case 'N':
7399                                 qg->qg_sortorder = QSO_NONE;
7400                                 break;
7401
7402                           default:
7403                                 syserr("Invalid queue sort order \"%s\"", p);
7404                         }
7405                         break;
7406 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7407
7408                   default:
7409                         syserr("Q%s: unknown queue equate %c=",
7410                                qg->qg_name, fcode);
7411                         break;
7412                 }
7413
7414                 p = delimptr;
7415         }
7416
7417 #if !HASNICE
7418         if (qg->qg_nice != NiceQueueRun)
7419         {
7420                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7421                                      "Q%s: Warning: N= set on system that doesn't support nice()\n",
7422                                      qg->qg_name);
7423         }
7424 #endif /* !HASNICE */
7425
7426         /* do some rationality checking */
7427         if (NumQueue >= MAXQUEUEGROUPS)
7428         {
7429                 syserr("too many queue groups defined (%d max)",
7430                         MAXQUEUEGROUPS);
7431                 return;
7432         }
7433
7434         if (qg->qg_qdir == NULL)
7435         {
7436                 if (QueueDir == NULL || *QueueDir == '\0')
7437                 {
7438                         syserr("QueueDir must be defined before queue groups");
7439                         return;
7440                 }
7441                 qg->qg_qdir = newstr(QueueDir);
7442         }
7443
7444         if (qg->qg_maxqrun > 1 && !bitnset(QD_FORK, qg->qg_flags))
7445         {
7446                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7447                                      "Warning: Q=%s: R=%d: multiple queue runners specified\n\tbut flag '%c' is not set\n",
7448                                      qg->qg_name, qg->qg_maxqrun, QD_FORK);
7449         }
7450
7451         /* enter the queue into the symbol table */
7452         if (tTd(37, 8))
7453                 sm_syslog(LOG_INFO, NOQID,
7454                           "Adding %s to stab, path: %s", qg->qg_name,
7455                           qg->qg_qdir);
7456         s = stab(qg->qg_name, ST_QUEUE, ST_ENTER);
7457         if (s->s_quegrp != NULL)
7458         {
7459                 i = s->s_quegrp->qg_index;
7460
7461                 /* XXX what about the pointers inside this struct? */
7462                 sm_free(s->s_quegrp); /* XXX */
7463         }
7464         else
7465                 i = NumQueue++;
7466         Queue[i] = s->s_quegrp = qg;
7467         qg->qg_index = i;
7468
7469         /* set default value for max queue runners */
7470         if (qg->qg_maxqrun < 0)
7471         {
7472                 if (MaxRunnersPerQueue > 0)
7473                         qg->qg_maxqrun = MaxRunnersPerQueue;
7474                 else
7475                         qg->qg_maxqrun = 1;
7476         }
7477         if (qdef)
7478                 setbitn(QD_DEFINED, qg->qg_flags);
7479 }
7480 #if 0
7481 /*
7482 **  HASHFQN -- calculate a hash value for a fully qualified host name
7483 **
7484 **      Arguments:
7485 **              fqn -- an all lower-case host.domain string
7486 **              buckets -- the number of buckets (queue directories)
7487 **
7488 **      Returns:
7489 **              a bucket number (signed integer)
7490 **              -1 on error
7491 **
7492 **      Contributed by Exactis.com, Inc.
7493 */
7494
7495 int
7496 hashfqn(fqn, buckets)
7497         register char *fqn;
7498         int buckets;
7499 {
7500         register char *p;
7501         register int h = 0, hash, cnt;
7502
7503         if (fqn == NULL)
7504                 return -1;
7505
7506         /*
7507         **  A variation on the gdb hash
7508         **  This is the best as of Feb 19, 1996 --bcx
7509         */
7510
7511         p = fqn;
7512         h = 0x238F13AF * strlen(p);
7513         for (cnt = 0; *p != 0; ++p, cnt++)
7514         {
7515                 h = (h + (*p << (cnt * 5 % 24))) & 0x7FFFFFFF;
7516         }
7517         h = (1103515243 * h + 12345) & 0x7FFFFFFF;
7518         if (buckets < 2)
7519                 hash = 0;
7520         else
7521                 hash = (h % buckets);
7522
7523         return hash;
7524 }
7525 #endif /* 0 */
7526
7527 /*
7528 **  A structure for sorting Queue according to maxqrun without
7529 **      screwing up Queue itself.
7530 */
7531
7532 struct sortqgrp
7533 {
7534         int sg_idx;             /* original index */
7535         int sg_maxqrun;         /* max queue runners */
7536 };
7537 typedef struct sortqgrp SORTQGRP_T;
7538 static int cmpidx __P((const void *, const void *));
7539
7540 static int
7541 cmpidx(a, b)
7542         const void *a;
7543         const void *b;
7544 {
7545         /* The sort is highest to lowest, so the comparison is reversed */
7546         if (((SORTQGRP_T *)a)->sg_maxqrun < ((SORTQGRP_T *)b)->sg_maxqrun)
7547                 return 1;
7548         else if (((SORTQGRP_T *)a)->sg_maxqrun > ((SORTQGRP_T *)b)->sg_maxqrun)
7549                 return -1;
7550         else
7551                 return 0;
7552 }
7553
7554 /*
7555 **  MAKEWORKGROUP -- balance queue groups into work groups per MaxQueueChildren
7556 **
7557 **  Take the now defined queue groups and assign them to work groups.
7558 **  This is done to balance out the number of concurrently active
7559 **  queue runners such that MaxQueueChildren is not exceeded. This may
7560 **  result in more than one queue group per work group. In such a case
7561 **  the number of running queue groups in that work group will have no
7562 **  more than the work group maximum number of runners (a "fair" portion
7563 **  of MaxQueueRunners). All queue groups within a work group will get a
7564 **  chance at running.
7565 **
7566 **      Parameters:
7567 **              none.
7568 **
7569 **      Returns:
7570 **              nothing.
7571 **
7572 **      Side Effects:
7573 **              Sets up WorkGrp structure.
7574 */
7575
7576 void
7577 makeworkgroups()
7578 {
7579         int i, j, total_runners, dir, h;
7580         SORTQGRP_T si[MAXQUEUEGROUPS + 1];
7581
7582         total_runners = 0;
7583         if (NumQueue == 1 && strcmp(Queue[0]->qg_name, "mqueue") == 0)
7584         {
7585                 /*
7586                 **  There is only the "mqueue" queue group (a default)
7587                 **  containing all of the queues. We want to provide to
7588                 **  this queue group the maximum allowable queue runners.
7589                 **  To match older behavior (8.10/8.11) we'll try for
7590                 **  1 runner per queue capping it at MaxQueueChildren.
7591                 **  So if there are N queues, then there will be N runners
7592                 **  for the "mqueue" queue group (where N is kept less than
7593                 **  MaxQueueChildren).
7594                 */
7595
7596                 NumWorkGroups = 1;
7597                 WorkGrp[0].wg_numqgrp = 1;
7598                 WorkGrp[0].wg_qgs = (QUEUEGRP **) xalloc(sizeof(QUEUEGRP *));
7599                 WorkGrp[0].wg_qgs[0] = Queue[0];
7600                 if (MaxQueueChildren > 0 &&
7601                     Queue[0]->qg_numqueues > MaxQueueChildren)
7602                         WorkGrp[0].wg_runners = MaxQueueChildren;
7603                 else
7604                         WorkGrp[0].wg_runners = Queue[0]->qg_numqueues;
7605
7606                 Queue[0]->qg_wgrp = 0;
7607
7608                 /* can't have more runners than allowed total */
7609                 if (MaxQueueChildren > 0 &&
7610                     Queue[0]->qg_maxqrun > MaxQueueChildren)
7611                         Queue[0]->qg_maxqrun = MaxQueueChildren;
7612                 WorkGrp[0].wg_maxact = Queue[0]->qg_maxqrun;
7613                 WorkGrp[0].wg_lowqintvl = Queue[0]->qg_queueintvl;
7614                 return;
7615         }
7616
7617         for (i = 0; i < NumQueue; i++)
7618         {
7619                 si[i].sg_maxqrun = Queue[i]->qg_maxqrun;
7620                 si[i].sg_idx = i;
7621         }
7622         qsort(si, NumQueue, sizeof(si[0]), cmpidx);
7623
7624         NumWorkGroups = 0;
7625         for (i = 0; i < NumQueue; i++)
7626         {
7627                 total_runners += si[i].sg_maxqrun;
7628                 if (MaxQueueChildren <= 0 || total_runners <= MaxQueueChildren)
7629                         NumWorkGroups++;
7630                 else
7631                         break;
7632         }
7633
7634         if (NumWorkGroups < 1)
7635                 NumWorkGroups = 1; /* gotta have one at least */
7636         else if (NumWorkGroups > MAXWORKGROUPS)
7637                 NumWorkGroups = MAXWORKGROUPS; /* the limit */
7638
7639         /*
7640         **  We now know the number of work groups to pack the queue groups
7641         **  into. The queue groups in 'Queue' are sorted from highest
7642         **  to lowest for the number of runners per queue group.
7643         **  We put the queue groups with the largest number of runners
7644         **  into work groups first. Then the smaller ones are fitted in
7645         **  where it looks best.
7646         */
7647
7648         j = 0;
7649         dir = 1;
7650         for (i = 0; i < NumQueue; i++)
7651         {
7652                 /* a to-and-fro packing scheme, continue from last position */
7653                 if (j >= NumWorkGroups)
7654                 {
7655                         dir = -1;
7656                         j = NumWorkGroups - 1;
7657                 }
7658                 else if (j < 0)
7659                 {
7660                         j = 0;
7661                         dir = 1;
7662                 }
7663
7664                 if (WorkGrp[j].wg_qgs == NULL)
7665                         WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_malloc(sizeof(QUEUEGRP *) *
7666                                                         (WorkGrp[j].wg_numqgrp + 1));
7667                 else
7668                         WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_realloc(WorkGrp[j].wg_qgs,
7669                                                         sizeof(QUEUEGRP *) *
7670                                                         (WorkGrp[j].wg_numqgrp + 1));
7671                 if (WorkGrp[j].wg_qgs == NULL)
7672                 {
7673                         syserr("!cannot allocate memory for work queues, need %d bytes",
7674                                (int) (sizeof(QUEUEGRP *) *
7675                                       (WorkGrp[j].wg_numqgrp + 1)));
7676                 }
7677
7678                 h = si[i].sg_idx;
7679                 WorkGrp[j].wg_qgs[WorkGrp[j].wg_numqgrp] = Queue[h];
7680                 WorkGrp[j].wg_numqgrp++;
7681                 WorkGrp[j].wg_runners += Queue[h]->qg_maxqrun;
7682                 Queue[h]->qg_wgrp = j;
7683
7684                 if (WorkGrp[j].wg_maxact == 0)
7685                 {
7686                         /* can't have more runners than allowed total */
7687                         if (MaxQueueChildren > 0 &&
7688                             Queue[h]->qg_maxqrun > MaxQueueChildren)
7689                                 Queue[h]->qg_maxqrun = MaxQueueChildren;
7690                         WorkGrp[j].wg_maxact = Queue[h]->qg_maxqrun;
7691                 }
7692
7693                 /*
7694                 **  XXX: must wg_lowqintvl be the GCD?
7695                 **  qg1: 2m, qg2: 3m, minimum: 2m, when do queue runs for
7696                 **  qg2 occur?
7697                 */
7698
7699                 /* keep track of the lowest interval for a persistent runner */
7700                 if (Queue[h]->qg_queueintvl > 0 &&
7701                     WorkGrp[j].wg_lowqintvl < Queue[h]->qg_queueintvl)
7702                         WorkGrp[j].wg_lowqintvl = Queue[h]->qg_queueintvl;
7703                 j += dir;
7704         }
7705         if (tTd(41, 9))
7706         {
7707                 for (i = 0; i < NumWorkGroups; i++)
7708                 {
7709                         sm_dprintf("Workgroup[%d]=", i);
7710                         for (j = 0; j < WorkGrp[i].wg_numqgrp; j++)
7711                         {
7712                                 sm_dprintf("%s, ",
7713                                         WorkGrp[i].wg_qgs[j]->qg_name);
7714                         }
7715                         sm_dprintf("\n");
7716                 }
7717         }
7718 }
7719
7720 /*
7721 **  DUP_DF -- duplicate envelope data file
7722 **
7723 **      Copy the data file from the 'old' envelope to the 'new' envelope
7724 **      in the most efficient way possible.
7725 **
7726 **      Create a hard link from the 'old' data file to the 'new' data file.
7727 **      If the old and new queue directories are on different file systems,
7728 **      then the new data file link is created in the old queue directory,
7729 **      and the new queue file will contain a 'd' record pointing to the
7730 **      directory containing the new data file.
7731 **
7732 **      Parameters:
7733 **              old -- old envelope.
7734 **              new -- new envelope.
7735 **
7736 **      Results:
7737 **              Returns true on success, false on failure.
7738 **
7739 **      Side Effects:
7740 **              On success, the new data file is created.
7741 **              On fatal failure, EF_FATALERRS is set in old->e_flags.
7742 */
7743
7744 static bool     dup_df __P((ENVELOPE *, ENVELOPE *));
7745
7746 static bool
7747 dup_df(old, new)
7748         ENVELOPE *old;
7749         ENVELOPE *new;
7750 {
7751         int ofs, nfs, r;
7752         char opath[MAXPATHLEN];
7753         char npath[MAXPATHLEN];
7754
7755         if (!bitset(EF_HAS_DF, old->e_flags))
7756         {
7757                 /*
7758                 **  this can happen if: SuperSafe != True
7759                 **  and a bounce mail is sent that is split.
7760                 */
7761
7762                 queueup(old, false, true);
7763         }
7764         SM_REQUIRE(ISVALIDQGRP(old->e_qgrp) && ISVALIDQDIR(old->e_qdir));
7765         SM_REQUIRE(ISVALIDQGRP(new->e_qgrp) && ISVALIDQDIR(new->e_qdir));
7766
7767         (void) sm_strlcpy(opath, queuename(old, DATAFL_LETTER), sizeof(opath));
7768         (void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof(npath));
7769
7770         if (old->e_dfp != NULL)
7771         {
7772                 r = sm_io_setinfo(old->e_dfp, SM_BF_COMMIT, NULL);
7773                 if (r < 0 && errno != EINVAL)
7774                 {
7775                         syserr("@can't commit %s", opath);
7776                         old->e_flags |= EF_FATALERRS;
7777                         return false;
7778                 }
7779         }
7780
7781         /*
7782         **  Attempt to create a hard link, if we think both old and new
7783         **  are on the same file system, otherwise copy the file.
7784         **
7785         **  Don't waste time attempting a hard link unless old and new
7786         **  are on the same file system.
7787         */
7788
7789         SM_REQUIRE(ISVALIDQGRP(old->e_dfqgrp) && ISVALIDQDIR(old->e_dfqdir));
7790         SM_REQUIRE(ISVALIDQGRP(new->e_dfqgrp) && ISVALIDQDIR(new->e_dfqdir));
7791
7792         ofs = Queue[old->e_dfqgrp]->qg_qpaths[old->e_dfqdir].qp_fsysidx;
7793         nfs = Queue[new->e_dfqgrp]->qg_qpaths[new->e_dfqdir].qp_fsysidx;
7794         if (FILE_SYS_DEV(ofs) == FILE_SYS_DEV(nfs))
7795         {
7796                 if (link(opath, npath) == 0)
7797                 {
7798                         new->e_flags |= EF_HAS_DF;
7799                         SYNC_DIR(npath, true);
7800                         return true;
7801                 }
7802                 goto error;
7803         }
7804
7805         /*
7806         **  Can't link across queue directories, so try to create a hard
7807         **  link in the same queue directory as the old df file.
7808         **  The qf file will refer to the new df file using a 'd' record.
7809         */
7810
7811         new->e_dfqgrp = old->e_dfqgrp;
7812         new->e_dfqdir = old->e_dfqdir;
7813         (void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof(npath));
7814         if (link(opath, npath) == 0)
7815         {
7816                 new->e_flags |= EF_HAS_DF;
7817                 SYNC_DIR(npath, true);
7818                 return true;
7819         }
7820
7821   error:
7822         if (LogLevel > 0)
7823                 sm_syslog(LOG_ERR, old->e_id,
7824                           "dup_df: can't link %s to %s, error=%s, envelope splitting failed",
7825                           opath, npath, sm_errstring(errno));
7826         return false;
7827 }
7828
7829 /*
7830 **  SPLIT_ENV -- Allocate a new envelope based on a given envelope.
7831 **
7832 **      Parameters:
7833 **              e -- envelope.
7834 **              sendqueue -- sendqueue for new envelope.
7835 **              qgrp -- index of queue group.
7836 **              qdir -- queue directory.
7837 **
7838 **      Results:
7839 **              new envelope.
7840 **
7841 */
7842
7843 static ENVELOPE *split_env __P((ENVELOPE *, ADDRESS *, int, int));
7844
7845 static ENVELOPE *
7846 split_env(e, sendqueue, qgrp, qdir)
7847         ENVELOPE *e;
7848         ADDRESS *sendqueue;
7849         int qgrp;
7850         int qdir;
7851 {
7852         ENVELOPE *ee;
7853
7854         ee = (ENVELOPE *) sm_rpool_malloc_x(e->e_rpool, sizeof(*ee));
7855         STRUCTCOPY(*e, *ee);
7856         ee->e_message = NULL;   /* XXX use original message? */
7857         ee->e_id = NULL;
7858         assign_queueid(ee);
7859         ee->e_sendqueue = sendqueue;
7860         ee->e_flags &= ~(EF_INQUEUE|EF_CLRQUEUE|EF_FATALERRS
7861                          |EF_SENDRECEIPT|EF_RET_PARAM|EF_HAS_DF);
7862         ee->e_flags |= EF_NORECEIPT;    /* XXX really? */
7863         ee->e_from.q_state = QS_SENDER;
7864         ee->e_dfp = NULL;
7865         ee->e_lockfp = NULL;
7866         if (e->e_xfp != NULL)
7867                 ee->e_xfp = sm_io_dup(e->e_xfp);
7868
7869         /* failed to dup e->e_xfp, start a new transcript */
7870         if (ee->e_xfp == NULL)
7871                 openxscript(ee);
7872
7873         ee->e_qgrp = ee->e_dfqgrp = qgrp;
7874         ee->e_qdir = ee->e_dfqdir = qdir;
7875         ee->e_errormode = EM_MAIL;
7876         ee->e_statmsg = NULL;
7877         if (e->e_quarmsg != NULL)
7878                 ee->e_quarmsg = sm_rpool_strdup_x(ee->e_rpool,
7879                                                   e->e_quarmsg);
7880
7881         /*
7882         **  XXX Not sure if this copying is necessary.
7883         **  sendall() does this copying, but I (dm) don't know if that is
7884         **  because of the storage management discipline we were using
7885         **  before rpools were introduced, or if it is because these lists
7886         **  can be modified later.
7887         */
7888
7889         ee->e_header = copyheader(e->e_header, ee->e_rpool);
7890         ee->e_errorqueue = copyqueue(e->e_errorqueue, ee->e_rpool);
7891
7892         return ee;
7893 }
7894
7895 /* return values from split functions, check also below! */
7896 #define SM_SPLIT_FAIL   (0)
7897 #define SM_SPLIT_NONE   (1)
7898 #define SM_SPLIT_NEW(n) (1 + (n))
7899
7900 /*
7901 **  SPLIT_ACROSS_QUEUE_GROUPS
7902 **
7903 **      This function splits an envelope across multiple queue groups
7904 **      based on the queue group of each recipient.
7905 **
7906 **      Parameters:
7907 **              e -- envelope.
7908 **
7909 **      Results:
7910 **              SM_SPLIT_FAIL on failure
7911 **              SM_SPLIT_NONE if no splitting occurred,
7912 **              or 1 + the number of additional envelopes created.
7913 **
7914 **      Side Effects:
7915 **              On success, e->e_sibling points to a list of zero or more
7916 **              additional envelopes, and the associated data files exist
7917 **              on disk.  But the queue files are not created.
7918 **
7919 **              On failure, e->e_sibling is not changed.
7920 **              The order of recipients in e->e_sendqueue is permuted.
7921 **              Abandoned data files for additional envelopes that failed
7922 **              to be created may exist on disk.
7923 */
7924
7925 static int      q_qgrp_compare __P((const void *, const void *));
7926 static int      e_filesys_compare __P((const void *, const void *));
7927
7928 static int
7929 q_qgrp_compare(p1, p2)
7930         const void *p1;
7931         const void *p2;
7932 {
7933         ADDRESS **pq1 = (ADDRESS **) p1;
7934         ADDRESS **pq2 = (ADDRESS **) p2;
7935
7936         return (*pq1)->q_qgrp - (*pq2)->q_qgrp;
7937 }
7938
7939 static int
7940 e_filesys_compare(p1, p2)
7941         const void *p1;
7942         const void *p2;
7943 {
7944         ENVELOPE **pe1 = (ENVELOPE **) p1;
7945         ENVELOPE **pe2 = (ENVELOPE **) p2;
7946         int fs1, fs2;
7947
7948         fs1 = Queue[(*pe1)->e_qgrp]->qg_qpaths[(*pe1)->e_qdir].qp_fsysidx;
7949         fs2 = Queue[(*pe2)->e_qgrp]->qg_qpaths[(*pe2)->e_qdir].qp_fsysidx;
7950         if (FILE_SYS_DEV(fs1) < FILE_SYS_DEV(fs2))
7951                 return -1;
7952         if (FILE_SYS_DEV(fs1) > FILE_SYS_DEV(fs2))
7953                 return 1;
7954         return 0;
7955 }
7956
7957 static int split_across_queue_groups __P((ENVELOPE *));
7958 static int
7959 split_across_queue_groups(e)
7960         ENVELOPE *e;
7961 {
7962         int naddrs, nsplits, i;
7963         bool changed;
7964         char **pvp;
7965         ADDRESS *q, **addrs;
7966         ENVELOPE *ee, *es;
7967         ENVELOPE *splits[MAXQUEUEGROUPS];
7968         char pvpbuf[PSBUFSIZE];
7969
7970         SM_REQUIRE(ISVALIDQGRP(e->e_qgrp));
7971
7972         /* Count addresses and assign queue groups. */
7973         naddrs = 0;
7974         changed = false;
7975         for (q = e->e_sendqueue; q != NULL; q = q->q_next)
7976         {
7977                 if (QS_IS_DEAD(q->q_state))
7978                         continue;
7979                 ++naddrs;
7980
7981                 /* bad addresses and those already sent stay put */
7982                 if (QS_IS_BADADDR(q->q_state) ||
7983                     QS_IS_SENT(q->q_state))
7984                         q->q_qgrp = e->e_qgrp;
7985                 else if (!ISVALIDQGRP(q->q_qgrp))
7986                 {
7987                         /* call ruleset which should return a queue group */
7988                         i = rscap(RS_QUEUEGROUP, q->q_user, NULL, e, &pvp,
7989                                   pvpbuf, sizeof(pvpbuf));
7990                         if (i == EX_OK &&
7991                             pvp != NULL && pvp[0] != NULL &&
7992                             (pvp[0][0] & 0377) == CANONNET &&
7993                             pvp[1] != NULL && pvp[1][0] != '\0')
7994                         {
7995                                 i = name2qid(pvp[1]);
7996                                 if (ISVALIDQGRP(i))
7997                                 {
7998                                         q->q_qgrp = i;
7999                                         changed = true;
8000                                         if (tTd(20, 4))
8001                                                 sm_syslog(LOG_INFO, NOQID,
8002                                                         "queue group name %s -> %d",
8003                                                         pvp[1], i);
8004                                         continue;
8005                                 }
8006                                 else if (LogLevel > 10)
8007                                         sm_syslog(LOG_INFO, NOQID,
8008                                                 "can't find queue group name %s, selection ignored",
8009                                                 pvp[1]);
8010                         }
8011                         if (q->q_mailer != NULL &&
8012                             ISVALIDQGRP(q->q_mailer->m_qgrp))
8013                         {
8014                                 changed = true;
8015                                 q->q_qgrp = q->q_mailer->m_qgrp;
8016                         }
8017                         else if (ISVALIDQGRP(e->e_qgrp))
8018                                 q->q_qgrp = e->e_qgrp;
8019                         else
8020                                 q->q_qgrp = 0;
8021                 }
8022         }
8023
8024         /* only one address? nothing to split. */
8025         if (naddrs <= 1 && !changed)
8026                 return SM_SPLIT_NONE;
8027
8028         /* sort the addresses by queue group */
8029         addrs = sm_rpool_malloc_x(e->e_rpool, naddrs * sizeof(ADDRESS *));
8030         for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8031         {
8032                 if (QS_IS_DEAD(q->q_state))
8033                         continue;
8034                 addrs[i++] = q;
8035         }
8036         qsort(addrs, naddrs, sizeof(ADDRESS *), q_qgrp_compare);
8037
8038         /* split into multiple envelopes, by queue group */
8039         nsplits = 0;
8040         es = NULL;
8041         e->e_sendqueue = NULL;
8042         for (i = 0; i < naddrs; ++i)
8043         {
8044                 if (i == naddrs - 1 || addrs[i]->q_qgrp != addrs[i + 1]->q_qgrp)
8045                         addrs[i]->q_next = NULL;
8046                 else
8047                         addrs[i]->q_next = addrs[i + 1];
8048
8049                 /* same queue group as original envelope? */
8050                 if (addrs[i]->q_qgrp == e->e_qgrp)
8051                 {
8052                         if (e->e_sendqueue == NULL)
8053                                 e->e_sendqueue = addrs[i];
8054                         continue;
8055                 }
8056
8057                 /* different queue group than original envelope */
8058                 if (es == NULL || addrs[i]->q_qgrp != es->e_qgrp)
8059                 {
8060                         ee = split_env(e, addrs[i], addrs[i]->q_qgrp, NOQDIR);
8061                         es = ee;
8062                         splits[nsplits++] = ee;
8063                 }
8064         }
8065
8066         /* no splits? return right now. */
8067         if (nsplits <= 0)
8068                 return SM_SPLIT_NONE;
8069
8070         /* assign a queue directory to each additional envelope */
8071         for (i = 0; i < nsplits; ++i)
8072         {
8073                 es = splits[i];
8074 #if 0
8075                 es->e_qdir = pickqdir(Queue[es->e_qgrp], es->e_msgsize, es);
8076 #endif /* 0 */
8077                 if (!setnewqueue(es))
8078                         goto failure;
8079         }
8080
8081         /* sort the additional envelopes by queue file system */
8082         qsort(splits, nsplits, sizeof(ENVELOPE *), e_filesys_compare);
8083
8084         /* create data files for each additional envelope */
8085         if (!dup_df(e, splits[0]))
8086         {
8087                 i = 0;
8088                 goto failure;
8089         }
8090         for (i = 1; i < nsplits; ++i)
8091         {
8092                 /* copy or link to the previous data file */
8093                 if (!dup_df(splits[i - 1], splits[i]))
8094                         goto failure;
8095         }
8096
8097         /* success: prepend the new envelopes to the e->e_sibling list */
8098         for (i = 0; i < nsplits; ++i)
8099         {
8100                 es = splits[i];
8101                 es->e_sibling = e->e_sibling;
8102                 e->e_sibling = es;
8103         }
8104         return SM_SPLIT_NEW(nsplits);
8105
8106         /* failure: clean up */
8107   failure:
8108         if (i > 0)
8109         {
8110                 int j;
8111
8112                 for (j = 0; j < i; j++)
8113                         (void) unlink(queuename(splits[j], DATAFL_LETTER));
8114         }
8115         e->e_sendqueue = addrs[0];
8116         for (i = 0; i < naddrs - 1; ++i)
8117                 addrs[i]->q_next = addrs[i + 1];
8118         addrs[naddrs - 1]->q_next = NULL;
8119         return SM_SPLIT_FAIL;
8120 }
8121
8122 /*
8123 **  SPLIT_WITHIN_QUEUE
8124 **
8125 **      Split an envelope with multiple recipients into several
8126 **      envelopes within the same queue directory, if the number of
8127 **      recipients exceeds the limit for the queue group.
8128 **
8129 **      Parameters:
8130 **              e -- envelope.
8131 **
8132 **      Results:
8133 **              SM_SPLIT_FAIL on failure
8134 **              SM_SPLIT_NONE if no splitting occurred,
8135 **              or 1 + the number of additional envelopes created.
8136 */
8137
8138 #define SPLIT_LOG_LEVEL 8
8139
8140 static int      split_within_queue __P((ENVELOPE *));
8141
8142 static int
8143 split_within_queue(e)
8144         ENVELOPE *e;
8145 {
8146         int maxrcpt, nrcpt, ndead, nsplit, i;
8147         int j, l;
8148         char *lsplits;
8149         ADDRESS *q, **addrs;
8150         ENVELOPE *ee, *firstsibling;
8151
8152         if (!ISVALIDQGRP(e->e_qgrp) || bitset(EF_SPLIT, e->e_flags))
8153                 return SM_SPLIT_NONE;
8154
8155         /* don't bother if there is no recipient limit */
8156         maxrcpt = Queue[e->e_qgrp]->qg_maxrcpt;
8157         if (maxrcpt <= 0)
8158                 return SM_SPLIT_NONE;
8159
8160         /* count recipients */
8161         nrcpt = 0;
8162         for (q = e->e_sendqueue; q != NULL; q = q->q_next)
8163         {
8164                 if (QS_IS_DEAD(q->q_state))
8165                         continue;
8166                 ++nrcpt;
8167         }
8168         if (nrcpt <= maxrcpt)
8169                 return SM_SPLIT_NONE;
8170
8171         /*
8172         **  Preserve the recipient list
8173         **  so that we can restore it in case of error.
8174         **  (But we discard dead addresses.)
8175         */
8176
8177         addrs = sm_rpool_malloc_x(e->e_rpool, nrcpt * sizeof(ADDRESS *));
8178         for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8179         {
8180                 if (QS_IS_DEAD(q->q_state))
8181                         continue;
8182                 addrs[i++] = q;
8183         }
8184
8185         /*
8186         **  Partition the recipient list so that bad and sent addresses
8187         **  come first. These will go with the original envelope, and
8188         **  do not count towards the maxrcpt limit.
8189         **  addrs[] does not contain QS_IS_DEAD() addresses.
8190         */
8191
8192         ndead = 0;
8193         for (i = 0; i < nrcpt; ++i)
8194         {
8195                 if (QS_IS_BADADDR(addrs[i]->q_state) ||
8196                     QS_IS_SENT(addrs[i]->q_state) ||
8197                     QS_IS_DEAD(addrs[i]->q_state)) /* for paranoia's sake */
8198                 {
8199                         if (i > ndead)
8200                         {
8201                                 ADDRESS *tmp = addrs[i];
8202
8203                                 addrs[i] = addrs[ndead];
8204                                 addrs[ndead] = tmp;
8205                         }
8206                         ++ndead;
8207                 }
8208         }
8209
8210         /* Check if no splitting required. */
8211         if (nrcpt - ndead <= maxrcpt)
8212                 return SM_SPLIT_NONE;
8213
8214         /* fix links */
8215         for (i = 0; i < nrcpt - 1; ++i)
8216                 addrs[i]->q_next = addrs[i + 1];
8217         addrs[nrcpt - 1]->q_next = NULL;
8218         e->e_sendqueue = addrs[0];
8219
8220         /* prepare buffer for logging */
8221         if (LogLevel > SPLIT_LOG_LEVEL)
8222         {
8223                 l = MAXLINE;
8224                 lsplits = sm_malloc(l);
8225                 if (lsplits != NULL)
8226                         *lsplits = '\0';
8227                 j = 0;
8228         }
8229         else
8230         {
8231                 /* get rid of stupid compiler warnings */
8232                 lsplits = NULL;
8233                 j = l = 0;
8234         }
8235
8236         /* split the envelope */
8237         firstsibling = e->e_sibling;
8238         i = maxrcpt + ndead;
8239         nsplit = 0;
8240         for (;;)
8241         {
8242                 addrs[i - 1]->q_next = NULL;
8243                 ee = split_env(e, addrs[i], e->e_qgrp, e->e_qdir);
8244                 if (!dup_df(e, ee))
8245                 {
8246
8247                         ee = firstsibling;
8248                         while (ee != NULL)
8249                         {
8250                                 (void) unlink(queuename(ee, DATAFL_LETTER));
8251                                 ee = ee->e_sibling;
8252                         }
8253
8254                         /* Error.  Restore e's sibling & recipient lists. */
8255                         e->e_sibling = firstsibling;
8256                         for (i = 0; i < nrcpt - 1; ++i)
8257                                 addrs[i]->q_next = addrs[i + 1];
8258                         if (lsplits != NULL)
8259                                 sm_free(lsplits);
8260                         return SM_SPLIT_FAIL;
8261                 }
8262
8263                 /* prepend the new envelope to e->e_sibling */
8264                 ee->e_sibling = e->e_sibling;
8265                 e->e_sibling = ee;
8266                 ++nsplit;
8267                 if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8268                 {
8269                         if (j >= l - strlen(ee->e_id) - 3)
8270                         {
8271                                 char *p;
8272
8273                                 l += MAXLINE;
8274                                 p = sm_realloc(lsplits, l);
8275                                 if (p == NULL)
8276                                 {
8277                                         /* let's try to get this done */
8278                                         sm_free(lsplits);
8279                                         lsplits = NULL;
8280                                 }
8281                                 else
8282                                         lsplits = p;
8283                         }
8284                         if (lsplits != NULL)
8285                         {
8286                                 if (j == 0)
8287                                         j += sm_strlcat(lsplits + j,
8288                                                         ee->e_id,
8289                                                         l - j);
8290                                 else
8291                                         j += sm_strlcat2(lsplits + j,
8292                                                          "; ",
8293                                                          ee->e_id,
8294                                                          l - j);
8295                                 SM_ASSERT(j < l);
8296                         }
8297                 }
8298                 if (nrcpt - i <= maxrcpt)
8299                         break;
8300                 i += maxrcpt;
8301         }
8302         if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8303         {
8304                 if (nsplit > 0)
8305                 {
8306                         sm_syslog(LOG_NOTICE, e->e_id,
8307                                   "split: maxrcpts=%d, rcpts=%d, count=%d, id%s=%s",
8308                                   maxrcpt, nrcpt - ndead, nsplit,
8309                                   nsplit > 1 ? "s" : "", lsplits);
8310                 }
8311                 sm_free(lsplits);
8312         }
8313         return SM_SPLIT_NEW(nsplit);
8314 }
8315 /*
8316 **  SPLIT_BY_RECIPIENT
8317 **
8318 **      Split an envelope with multiple recipients into multiple
8319 **      envelopes as required by the sendmail configuration.
8320 **
8321 **      Parameters:
8322 **              e -- envelope.
8323 **
8324 **      Results:
8325 **              Returns true on success, false on failure.
8326 **
8327 **      Side Effects:
8328 **              see split_across_queue_groups(), split_within_queue(e)
8329 */
8330
8331 bool
8332 split_by_recipient(e)
8333         ENVELOPE *e;
8334 {
8335         int split, n, i, j, l;
8336         char *lsplits;
8337         ENVELOPE *ee, *next, *firstsibling;
8338
8339         if (OpMode == SM_VERIFY || !ISVALIDQGRP(e->e_qgrp) ||
8340             bitset(EF_SPLIT, e->e_flags))
8341                 return true;
8342         n = split_across_queue_groups(e);
8343         if (n == SM_SPLIT_FAIL)
8344                 return false;
8345         firstsibling = ee = e->e_sibling;
8346         if (n > 1 && LogLevel > SPLIT_LOG_LEVEL)
8347         {
8348                 l = MAXLINE;
8349                 lsplits = sm_malloc(l);
8350                 if (lsplits != NULL)
8351                         *lsplits = '\0';
8352                 j = 0;
8353         }
8354         else
8355         {
8356                 /* get rid of stupid compiler warnings */
8357                 lsplits = NULL;
8358                 j = l = 0;
8359         }
8360         for (i = 1; i < n; ++i)
8361         {
8362                 next = ee->e_sibling;
8363                 if (split_within_queue(ee) == SM_SPLIT_FAIL)
8364                 {
8365                         e->e_sibling = firstsibling;
8366                         return false;
8367                 }
8368                 ee->e_flags |= EF_SPLIT;
8369                 if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8370                 {
8371                         if (j >= l - strlen(ee->e_id) - 3)
8372                         {
8373                                 char *p;
8374
8375                                 l += MAXLINE;
8376                                 p = sm_realloc(lsplits, l);
8377                                 if (p == NULL)
8378                                 {
8379                                         /* let's try to get this done */
8380                                         sm_free(lsplits);
8381                                         lsplits = NULL;
8382                                 }
8383                                 else
8384                                         lsplits = p;
8385                         }
8386                         if (lsplits != NULL)
8387                         {
8388                                 if (j == 0)
8389                                         j += sm_strlcat(lsplits + j,
8390                                                         ee->e_id, l - j);
8391                                 else
8392                                         j += sm_strlcat2(lsplits + j, "; ",
8393                                                          ee->e_id, l - j);
8394                                 SM_ASSERT(j < l);
8395                         }
8396                 }
8397                 ee = next;
8398         }
8399         if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL && n > 1)
8400         {
8401                 sm_syslog(LOG_NOTICE, e->e_id, "split: count=%d, id%s=%s",
8402                           n - 1, n > 2 ? "s" : "", lsplits);
8403                 sm_free(lsplits);
8404         }
8405         split = split_within_queue(e) != SM_SPLIT_FAIL;
8406         if (split)
8407                 e->e_flags |= EF_SPLIT;
8408         return split;
8409 }
8410
8411 /*
8412 **  QUARANTINE_QUEUE_ITEM -- {un,}quarantine a single envelope
8413 **
8414 **      Add/remove quarantine reason and requeue appropriately.
8415 **
8416 **      Parameters:
8417 **              qgrp -- queue group for the item
8418 **              qdir -- queue directory in the given queue group
8419 **              e -- envelope information for the item
8420 **              reason -- quarantine reason, NULL means unquarantine.
8421 **
8422 **      Results:
8423 **              true if item changed, false otherwise
8424 **
8425 **      Side Effects:
8426 **              Changes quarantine tag in queue file and renames it.
8427 */
8428
8429 static bool
8430 quarantine_queue_item(qgrp, qdir, e, reason)
8431         int qgrp;
8432         int qdir;
8433         ENVELOPE *e;
8434         char *reason;
8435 {
8436         bool dirty = false;
8437         bool failing = false;
8438         bool foundq = false;
8439         bool finished = false;
8440         int fd;
8441         int flags;
8442         int oldtype;
8443         int newtype;
8444         int save_errno;
8445         MODE_T oldumask = 0;
8446         SM_FILE_T *oldqfp, *tempqfp;
8447         char *bp;
8448         int bufsize;
8449         char oldqf[MAXPATHLEN];
8450         char tempqf[MAXPATHLEN];
8451         char newqf[MAXPATHLEN];
8452         char buf[MAXLINE];
8453
8454         oldtype = queue_letter(e, ANYQFL_LETTER);
8455         (void) sm_strlcpy(oldqf, queuename(e, ANYQFL_LETTER), sizeof(oldqf));
8456         (void) sm_strlcpy(tempqf, queuename(e, NEWQFL_LETTER), sizeof(tempqf));
8457
8458         /*
8459         **  Instead of duplicating all the open
8460         **  and lock code here, tell readqf() to
8461         **  do that work and return the open
8462         **  file pointer in e_lockfp.  Note that
8463         **  we must release the locks properly when
8464         **  we are done.
8465         */
8466
8467         if (!readqf(e, true))
8468         {
8469                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8470                                      "Skipping %s\n", qid_printname(e));
8471                 return false;
8472         }
8473         oldqfp = e->e_lockfp;
8474
8475         /* open the new queue file */
8476         flags = O_CREAT|O_WRONLY|O_EXCL;
8477         if (bitset(S_IWGRP, QueueFileMode))
8478                 oldumask = umask(002);
8479         fd = open(tempqf, flags, QueueFileMode);
8480         if (bitset(S_IWGRP, QueueFileMode))
8481                 (void) umask(oldumask);
8482         RELEASE_QUEUE;
8483
8484         if (fd < 0)
8485         {
8486                 save_errno = errno;
8487                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8488                                      "Skipping %s: Could not open %s: %s\n",
8489                                      qid_printname(e), tempqf,
8490                                      sm_errstring(save_errno));
8491                 (void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8492                 return false;
8493         }
8494         if (!lockfile(fd, tempqf, NULL, LOCK_EX|LOCK_NB))
8495         {
8496                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8497                                      "Skipping %s: Could not lock %s\n",
8498                                      qid_printname(e), tempqf);
8499                 (void) close(fd);
8500                 (void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8501                 return false;
8502         }
8503
8504         tempqfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT, (void *) &fd,
8505                              SM_IO_WRONLY_B, NULL);
8506         if (tempqfp == NULL)
8507         {
8508                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8509                                      "Skipping %s: Could not lock %s\n",
8510                                      qid_printname(e), tempqf);
8511                 (void) close(fd);
8512                 (void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8513                 return false;
8514         }
8515
8516         /* Copy the data over, changing the quarantine reason */
8517         while (bufsize = sizeof(buf),
8518                (bp = fgetfolded(buf, &bufsize, oldqfp)) != NULL)
8519         {
8520                 if (tTd(40, 4))
8521                         sm_dprintf("+++++ %s\n", bp);
8522                 switch (bp[0])
8523                 {
8524                   case 'q':             /* quarantine reason */
8525                         foundq = true;
8526                         if (reason == NULL)
8527                         {
8528                                 if (Verbose)
8529                                 {
8530                                         (void) sm_io_fprintf(smioout,
8531                                                              SM_TIME_DEFAULT,
8532                                                              "%s: Removed quarantine of \"%s\"\n",
8533                                                              e->e_id, &bp[1]);
8534                                 }
8535                                 sm_syslog(LOG_INFO, e->e_id, "unquarantine");
8536                                 dirty = true;
8537                         }
8538                         else if (strcmp(reason, &bp[1]) == 0)
8539                         {
8540                                 if (Verbose)
8541                                 {
8542                                         (void) sm_io_fprintf(smioout,
8543                                                              SM_TIME_DEFAULT,
8544                                                              "%s: Already quarantined with \"%s\"\n",
8545                                                              e->e_id, reason);
8546                                 }
8547                                 (void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8548                                                      "q%s\n", reason);
8549                         }
8550                         else
8551                         {
8552                                 if (Verbose)
8553                                 {
8554                                         (void) sm_io_fprintf(smioout,
8555                                                              SM_TIME_DEFAULT,
8556                                                              "%s: Quarantine changed from \"%s\" to \"%s\"\n",
8557                                                              e->e_id, &bp[1],
8558                                                              reason);
8559                                 }
8560                                 (void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8561                                                      "q%s\n", reason);
8562                                 sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8563                                           reason);
8564                                 dirty = true;
8565                         }
8566                         break;
8567
8568                   case 'S':
8569                         /*
8570                         **  If we are quarantining an unquarantined item,
8571                         **  need to put in a new 'q' line before it's
8572                         **  too late.
8573                         */
8574
8575                         if (!foundq && reason != NULL)
8576                         {
8577                                 if (Verbose)
8578                                 {
8579                                         (void) sm_io_fprintf(smioout,
8580                                                              SM_TIME_DEFAULT,
8581                                                              "%s: Quarantined with \"%s\"\n",
8582                                                              e->e_id, reason);
8583                                 }
8584                                 (void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8585                                                      "q%s\n", reason);
8586                                 sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8587                                           reason);
8588                                 foundq = true;
8589                                 dirty = true;
8590                         }
8591
8592                         /* Copy the line to the new file */
8593                         (void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8594                                              "%s\n", bp);
8595                         break;
8596
8597                   case '.':
8598                         finished = true;
8599                         /* FALLTHROUGH */
8600
8601                   default:
8602                         /* Copy the line to the new file */
8603                         (void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8604                                              "%s\n", bp);
8605                         break;
8606                 }
8607                 if (bp != buf)
8608                         sm_free(bp);
8609         }
8610
8611         /* Make sure we read the whole old file */
8612         errno = sm_io_error(tempqfp);
8613         if (errno != 0 && errno != SM_IO_EOF)
8614         {
8615                 save_errno = errno;
8616                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8617                                      "Skipping %s: Error reading %s: %s\n",
8618                                      qid_printname(e), oldqf,
8619                                      sm_errstring(save_errno));
8620                 failing = true;
8621         }
8622
8623         if (!failing && !finished)
8624         {
8625                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8626                                      "Skipping %s: Incomplete file: %s\n",
8627                                      qid_printname(e), oldqf);
8628                 failing = true;
8629         }
8630
8631         /* Check if we actually changed anything or we can just bail now */
8632         if (!dirty)
8633         {
8634                 /* pretend we failed, even though we technically didn't */
8635                 failing = true;
8636         }
8637
8638         /* Make sure we wrote things out safely */
8639         if (!failing &&
8640             (sm_io_flush(tempqfp, SM_TIME_DEFAULT) != 0 ||
8641              ((SuperSafe == SAFE_REALLY ||
8642                SuperSafe == SAFE_REALLY_POSTMILTER ||
8643                SuperSafe == SAFE_INTERACTIVE) &&
8644               fsync(sm_io_getinfo(tempqfp, SM_IO_WHAT_FD, NULL)) < 0) ||
8645              ((errno = sm_io_error(tempqfp)) != 0)))
8646         {
8647                 save_errno = errno;
8648                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8649                                      "Skipping %s: Error writing %s: %s\n",
8650                                      qid_printname(e), tempqf,
8651                                      sm_errstring(save_errno));
8652                 failing = true;
8653         }
8654
8655
8656         /* Figure out the new filename */
8657         newtype = (reason == NULL ? NORMQF_LETTER : QUARQF_LETTER);
8658         if (oldtype == newtype)
8659         {
8660                 /* going to rename tempqf to oldqf */
8661                 (void) sm_strlcpy(newqf, oldqf, sizeof(newqf));
8662         }
8663         else
8664         {
8665                 /* going to rename tempqf to new name based on newtype */
8666                 (void) sm_strlcpy(newqf, queuename(e, newtype), sizeof(newqf));
8667         }
8668
8669         save_errno = 0;
8670
8671         /* rename tempqf to newqf */
8672         if (!failing &&
8673             rename(tempqf, newqf) < 0)
8674                 save_errno = (errno == 0) ? EINVAL : errno;
8675
8676         /* Check rename() success */
8677         if (!failing && save_errno != 0)
8678         {
8679                 sm_syslog(LOG_DEBUG, e->e_id,
8680                           "quarantine_queue_item: rename(%s, %s): %s",
8681                           tempqf, newqf, sm_errstring(save_errno));
8682
8683                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8684                                      "Error renaming %s to %s: %s\n",
8685                                      tempqf, newqf,
8686                                      sm_errstring(save_errno));
8687                 if (oldtype == newtype)
8688                 {
8689                         /*
8690                         **  Bail here since we don't know the state of
8691                         **  the filesystem and may need to keep tempqf
8692                         **  for the user to rescue us.
8693                         */
8694
8695                         RELEASE_QUEUE;
8696                         errno = save_errno;
8697                         syserr("!452 Error renaming control file %s", tempqf);
8698                         /* NOTREACHED */
8699                 }
8700                 else
8701                 {
8702                         /* remove new file (if rename() half completed) */
8703                         if (xunlink(newqf) < 0)
8704                         {
8705                                 save_errno = errno;
8706                                 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8707                                                      "Error removing %s: %s\n",
8708                                                      newqf,
8709                                                      sm_errstring(save_errno));
8710                         }
8711
8712                         /* tempqf removed below */
8713                         failing = true;
8714                 }
8715
8716         }
8717
8718         /* If changing file types, need to remove old type */
8719         if (!failing && oldtype != newtype)
8720         {
8721                 if (xunlink(oldqf) < 0)
8722                 {
8723                         save_errno = errno;
8724                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8725                                              "Error removing %s: %s\n",
8726                                              oldqf, sm_errstring(save_errno));
8727                 }
8728         }
8729
8730         /* see if anything above failed */
8731         if (failing)
8732         {
8733                 /* Something failed: remove new file, old file still there */
8734                 (void) xunlink(tempqf);
8735         }
8736
8737         /*
8738         **  fsync() after file operations to make sure metadata is
8739         **  written to disk on filesystems in which renames are
8740         **  not guaranteed.  It's ok if they fail, mail won't be lost.
8741         */
8742
8743         if (SuperSafe != SAFE_NO)
8744         {
8745                 /* for soft-updates */
8746                 (void) fsync(sm_io_getinfo(tempqfp,
8747                                            SM_IO_WHAT_FD, NULL));
8748
8749                 if (!failing)
8750                 {
8751                         /* for soft-updates */
8752                         (void) fsync(sm_io_getinfo(oldqfp,
8753                                                    SM_IO_WHAT_FD, NULL));
8754                 }
8755
8756                 /* for other odd filesystems */
8757                 SYNC_DIR(tempqf, false);
8758         }
8759
8760         /* Close up shop */
8761         RELEASE_QUEUE;
8762         if (tempqfp != NULL)
8763                 (void) sm_io_close(tempqfp, SM_TIME_DEFAULT);
8764         if (oldqfp != NULL)
8765                 (void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8766
8767         /* All went well */
8768         return !failing;
8769 }
8770
8771 /*
8772 **  QUARANTINE_QUEUE -- {un,}quarantine matching items in the queue
8773 **
8774 **      Read all matching queue items, add/remove quarantine
8775 **      reason, and requeue appropriately.
8776 **
8777 **      Parameters:
8778 **              reason -- quarantine reason, "." means unquarantine.
8779 **              qgrplimit -- limit to single queue group unless NOQGRP
8780 **
8781 **      Results:
8782 **              none.
8783 **
8784 **      Side Effects:
8785 **              Lots of changes to the queue.
8786 */
8787
8788 void
8789 quarantine_queue(reason, qgrplimit)
8790         char *reason;
8791         int qgrplimit;
8792 {
8793         int changed = 0;
8794         int qgrp;
8795
8796         /* Convert internal representation of unquarantine */
8797         if (reason != NULL && reason[0] == '.' && reason[1] == '\0')
8798                 reason = NULL;
8799
8800         if (reason != NULL)
8801         {
8802                 /* clean it */
8803                 reason = newstr(denlstring(reason, true, true));
8804         }
8805
8806         for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
8807         {
8808                 int qdir;
8809
8810                 if (qgrplimit != NOQGRP && qgrplimit != qgrp)
8811                         continue;
8812
8813                 for (qdir = 0; qdir < Queue[qgrp]->qg_numqueues; qdir++)
8814                 {
8815                         int i;
8816                         int nrequests;
8817
8818                         if (StopRequest)
8819                                 stop_sendmail();
8820
8821                         nrequests = gatherq(qgrp, qdir, true, NULL, NULL);
8822
8823                         /* first see if there is anything */
8824                         if (nrequests <= 0)
8825                         {
8826                                 if (Verbose)
8827                                 {
8828                                         (void) sm_io_fprintf(smioout,
8829                                                              SM_TIME_DEFAULT, "%s: no matches\n",
8830                                                              qid_printqueue(qgrp, qdir));
8831                                 }
8832                                 continue;
8833                         }
8834
8835                         if (Verbose)
8836                         {
8837                                 (void) sm_io_fprintf(smioout,
8838                                                      SM_TIME_DEFAULT, "Processing %s:\n",
8839                                                      qid_printqueue(qgrp, qdir));
8840                         }
8841
8842                         for (i = 0; i < WorkListCount; i++)
8843                         {
8844                                 ENVELOPE e;
8845
8846                                 if (StopRequest)
8847                                         stop_sendmail();
8848
8849                                 /* setup envelope */
8850                                 clearenvelope(&e, true, sm_rpool_new_x(NULL));
8851                                 e.e_id = WorkList[i].w_name + 2;
8852                                 e.e_qgrp = qgrp;
8853                                 e.e_qdir = qdir;
8854
8855                                 if (tTd(70, 101))
8856                                 {
8857                                         sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8858                                                       "Would do %s\n", e.e_id);
8859                                         changed++;
8860                                 }
8861                                 else if (quarantine_queue_item(qgrp, qdir,
8862                                                                &e, reason))
8863                                         changed++;
8864
8865                                 /* clean up */
8866                                 sm_rpool_free(e.e_rpool);
8867                                 e.e_rpool = NULL;
8868                         }
8869                         if (WorkList != NULL)
8870                                 sm_free(WorkList); /* XXX */
8871                         WorkList = NULL;
8872                         WorkListSize = 0;
8873                         WorkListCount = 0;
8874                 }
8875         }
8876         if (Verbose)
8877         {
8878                 if (changed == 0)
8879                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8880                                              "No changes\n");
8881                 else
8882                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8883                                              "%d change%s\n",
8884                                              changed,
8885                                              changed == 1 ? "" : "s");
8886         }
8887 }