xref: /illumos-gate/usr/src/cmd/sendmail/src/queue.c (revision 1daa5768)
1 /*
2  * Copyright (c) 1998-2006 Sendmail, Inc. and its suppliers.
3  *	All rights reserved.
4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
5  * Copyright (c) 1988, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * By using this file, you agree to the terms and conditions set
9  * forth in the LICENSE file which can be found at the top level of
10  * the sendmail distribution.
11  *
12  */
13 
14 #pragma ident	"%Z%%M%	%I%	%E% SMI"
15 
16 #include <sendmail.h>
17 #include <sm/sem.h>
18 
19 SM_RCSID("@(#)$Id: queue.c,v 8.954.2.5 2006/07/31 21:44:18 ca Exp $")
20 
21 #include <dirent.h>
22 
23 # define RELEASE_QUEUE	(void) 0
24 # define ST_INODE(st)	(st).st_ino
25 
26 #  define sm_file_exists(errno) ((errno) == EEXIST)
27 
28 # if HASFLOCK && defined(O_EXLOCK)
29 #   define SM_OPEN_EXLOCK 1
30 #   define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL|O_EXLOCK)
31 # else /* HASFLOCK && defined(O_EXLOCK) */
32 #  define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL)
33 # endif /* HASFLOCK && defined(O_EXLOCK) */
34 
35 #ifndef SM_OPEN_EXLOCK
36 # define SM_OPEN_EXLOCK 0
37 #endif /* ! SM_OPEN_EXLOCK */
38 
39 /*
40 **  Historical notes:
41 **	QF_VERSION == 4 was sendmail 8.10/8.11 without _FFR_QUEUEDELAY
42 **	QF_VERSION == 5 was sendmail 8.10/8.11 with    _FFR_QUEUEDELAY
43 **	QF_VERSION == 6 was sendmail 8.12      without _FFR_QUEUEDELAY
44 **	QF_VERSION == 7 was sendmail 8.12      with    _FFR_QUEUEDELAY
45 **	QF_VERSION == 8 is  sendmail 8.13
46 */
47 
48 #define QF_VERSION	8	/* version number of this queue format */
49 
50 static char	queue_letter __P((ENVELOPE *, int));
51 static bool	quarantine_queue_item __P((int, int, ENVELOPE *, char *));
52 
53 /* Naming convention: qgrp: index of queue group, qg: QUEUEGROUP */
54 
55 /*
56 **  Work queue.
57 */
58 
59 struct work
60 {
61 	char		*w_name;	/* name of control file */
62 	char		*w_host;	/* name of recipient host */
63 	bool		w_lock;		/* is message locked? */
64 	bool		w_tooyoung;	/* is it too young to run? */
65 	long		w_pri;		/* priority of message, see below */
66 	time_t		w_ctime;	/* creation time */
67 	time_t		w_mtime;	/* modification time */
68 	int		w_qgrp;		/* queue group located in */
69 	int		w_qdir;		/* queue directory located in */
70 	struct work	*w_next;	/* next in queue */
71 };
72 
73 typedef struct work	WORK;
74 
75 static WORK	*WorkQ;		/* queue of things to be done */
76 static int	NumWorkGroups;	/* number of work groups */
77 static time_t	Current_LA_time = 0;
78 
79 /* Get new load average every 30 seconds. */
80 #define GET_NEW_LA_TIME	30
81 
82 #define SM_GET_LA(now)	\
83 	do							\
84 	{							\
85 		now = curtime();				\
86 		if (Current_LA_time < now - GET_NEW_LA_TIME)	\
87 		{						\
88 			sm_getla();				\
89 			Current_LA_time = now;			\
90 		}						\
91 	} while (0)
92 
93 /*
94 **  DoQueueRun indicates that a queue run is needed.
95 **	Notice: DoQueueRun is modified in a signal handler!
96 */
97 
98 static bool	volatile DoQueueRun; /* non-interrupt time queue run needed */
99 
100 /*
101 **  Work group definition structure.
102 **	Each work group contains one or more queue groups. This is done
103 **	to manage the number of queue group runners active at the same time
104 **	to be within the constraints of MaxQueueChildren (if it is set).
105 **	The number of queue groups that can be run on the next work run
106 **	is kept track of. The queue groups are run in a round robin.
107 */
108 
109 struct workgrp
110 {
111 	int		wg_numqgrp;	/* number of queue groups in work grp */
112 	int		wg_runners;	/* total runners */
113 	int		wg_curqgrp;	/* current queue group */
114 	QUEUEGRP	**wg_qgs;	/* array of queue groups */
115 	int		wg_maxact;	/* max # of active runners */
116 	time_t		wg_lowqintvl;	/* lowest queue interval */
117 	int		wg_restart;	/* needs restarting? */
118 	int		wg_restartcnt;	/* count of times restarted */
119 };
120 
121 typedef struct workgrp WORKGRP;
122 
123 static WORKGRP	volatile WorkGrp[MAXWORKGROUPS + 1];	/* work groups */
124 
125 #if SM_HEAP_CHECK
126 static SM_DEBUG_T DebugLeakQ = SM_DEBUG_INITIALIZER("leak_q",
127 	"@(#)$Debug: leak_q - trace memory leaks during queue processing $");
128 #endif /* SM_HEAP_CHECK */
129 
130 /*
131 **  We use EmptyString instead of "" to avoid
132 **  'zero-length format string' warnings from gcc
133 */
134 
135 static const char EmptyString[] = "";
136 
137 static void	grow_wlist __P((int, int));
138 static int	multiqueue_cache __P((char *, int, QUEUEGRP *, int, unsigned int *));
139 static int	gatherq __P((int, int, bool, bool *, bool *));
140 static int	sortq __P((int));
141 static void	printctladdr __P((ADDRESS *, SM_FILE_T *));
142 static bool	readqf __P((ENVELOPE *, bool));
143 static void	restart_work_group __P((int));
144 static void	runner_work __P((ENVELOPE *, int, bool, int, int));
145 static void	schedule_queue_runs __P((bool, int, bool));
146 static char	*strrev __P((char *));
147 static ADDRESS	*setctluser __P((char *, int, ENVELOPE *));
148 #if _FFR_RHS
149 static int	sm_strshufflecmp __P((char *, char *));
150 static void	init_shuffle_alphabet __P(());
151 #endif /* _FFR_RHS */
152 static int	workcmpf0();
153 static int	workcmpf1();
154 static int	workcmpf2();
155 static int	workcmpf3();
156 static int	workcmpf4();
157 static int	randi = 3;	/* index for workcmpf5() */
158 static int	workcmpf5();
159 static int	workcmpf6();
160 #if _FFR_RHS
161 static int	workcmpf7();
162 #endif /* _FFR_RHS */
163 
164 #if RANDOMSHIFT
165 # define get_rand_mod(m)	((get_random() >> RANDOMSHIFT) % (m))
166 #else /* RANDOMSHIFT */
167 # define get_rand_mod(m)	(get_random() % (m))
168 #endif /* RANDOMSHIFT */
169 
170 /*
171 **  File system definition.
172 **	Used to keep track of how much free space is available
173 **	on a file system in which one or more queue directories reside.
174 */
175 
176 typedef struct filesys_shared	FILESYS;
177 
178 struct filesys_shared
179 {
180 	dev_t	fs_dev;		/* unique device id */
181 	long	fs_avail;	/* number of free blocks available */
182 	long	fs_blksize;	/* block size, in bytes */
183 };
184 
185 /* probably kept in shared memory */
186 static FILESYS	FileSys[MAXFILESYS];	/* queue file systems */
187 static char	*FSPath[MAXFILESYS];	/* pathnames for file systems */
188 
189 #if SM_CONF_SHM
190 
191 /*
192 **  Shared memory data
193 **
194 **  Current layout:
195 **	size -- size of shared memory segment
196 **	pid -- pid of owner, should be a unique id to avoid misinterpretations
197 **		by other processes.
198 **	tag -- should be a unique id to avoid misinterpretations by others.
199 **		idea: hash over configuration data that will be stored here.
200 **	NumFileSys -- number of file systems.
201 **	FileSys -- (arrary of) structure for used file systems.
202 **	RSATmpCnt -- counter for number of uses of ephemeral RSA key.
203 **	QShm -- (array of) structure for information about queue directories.
204 */
205 
206 /*
207 **  Queue data in shared memory
208 */
209 
210 typedef struct queue_shared	QUEUE_SHM_T;
211 
212 struct queue_shared
213 {
214 	int	qs_entries;	/* number of entries */
215 	/* XXX more to follow? */
216 };
217 
218 static void	*Pshm;		/* pointer to shared memory */
219 static FILESYS	*PtrFileSys;	/* pointer to queue file system array */
220 int		ShmId = SM_SHM_NO_ID;	/* shared memory id */
221 static QUEUE_SHM_T	*QShm;		/* pointer to shared queue data */
222 static size_t shms;
223 
224 # define SHM_OFF_PID(p)	(((char *) (p)) + sizeof(int))
225 # define SHM_OFF_TAG(p)	(((char *) (p)) + sizeof(pid_t) + sizeof(int))
226 # define SHM_OFF_HEAD	(sizeof(pid_t) + sizeof(int) * 2)
227 
228 /* how to access FileSys */
229 # define FILE_SYS(i)	(PtrFileSys[i])
230 
231 /* first entry is a tag, for now just the size */
232 # define OFF_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD)
233 
234 /* offset for PNumFileSys */
235 # define OFF_NUM_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys))
236 
237 /* offset for PRSATmpCnt */
238 # define OFF_RSA_TMP_CNT(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int))
239 int	*PRSATmpCnt;
240 
241 /* offset for queue_shm */
242 # define OFF_QUEUE_SHM(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
243 
244 # define QSHM_ENTRIES(i)	QShm[i].qs_entries
245 
246 /* basic size of shared memory segment */
247 # define SM_T_SIZE	(SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
248 
249 static unsigned int	hash_q __P((char *, unsigned int));
250 
251 /*
252 **  HASH_Q -- simple hash function
253 **
254 **	Parameters:
255 **		p -- string to hash.
256 **		h -- hash start value (from previous run).
257 **
258 **	Returns:
259 **		hash value.
260 */
261 
262 static unsigned int
263 hash_q(p, h)
264 	char *p;
265 	unsigned int h;
266 {
267 	int c, d;
268 
269 	while (*p != '\0')
270 	{
271 		d = *p++;
272 		c = d;
273 		c ^= c<<6;
274 		h += (c<<11) ^ (c>>1);
275 		h ^= (d<<14) + (d<<7) + (d<<4) + d;
276 	}
277 	return h;
278 }
279 
280 
281 #else /* SM_CONF_SHM */
282 # define FILE_SYS(i)	FileSys[i]
283 #endif /* SM_CONF_SHM */
284 
285 /* access to the various components of file system data */
286 #define FILE_SYS_NAME(i)	FSPath[i]
287 #define FILE_SYS_AVAIL(i)	FILE_SYS(i).fs_avail
288 #define FILE_SYS_BLKSIZE(i)	FILE_SYS(i).fs_blksize
289 #define FILE_SYS_DEV(i)	FILE_SYS(i).fs_dev
290 
291 
292 /*
293 **  Current qf file field assignments:
294 **
295 **	A	AUTH= parameter
296 **	B	body type
297 **	C	controlling user
298 **	D	data file name
299 **	d	data file directory name (added in 8.12)
300 **	E	error recipient
301 **	F	flag bits
302 **	G	free (was: queue delay algorithm if _FFR_QUEUEDELAY)
303 **	H	header
304 **	I	data file's inode number
305 **	K	time of last delivery attempt
306 **	L	Solaris Content-Length: header (obsolete)
307 **	M	message
308 **	N	number of delivery attempts
309 **	P	message priority
310 **	q	quarantine reason
311 **	Q	original recipient (ORCPT=)
312 **	r	final recipient (Final-Recipient: DSN field)
313 **	R	recipient
314 **	S	sender
315 **	T	init time
316 **	V	queue file version
317 **	X	free (was: character set if _FFR_SAVE_CHARSET)
318 **	Y	free (was: current delay if _FFR_QUEUEDELAY)
319 **	Z	original envelope id from ESMTP
320 **	!	deliver by (added in 8.12)
321 **	$	define macro
322 **	.	terminate file
323 */
324 
325 /*
326 **  QUEUEUP -- queue a message up for future transmission.
327 **
328 **	Parameters:
329 **		e -- the envelope to queue up.
330 **		announce -- if true, tell when you are queueing up.
331 **		msync -- if true, then fsync() if SuperSafe interactive mode.
332 **
333 **	Returns:
334 **		none.
335 **
336 **	Side Effects:
337 **		The current request is saved in a control file.
338 **		The queue file is left locked.
339 */
340 
341 void
342 queueup(e, announce, msync)
343 	register ENVELOPE *e;
344 	bool announce;
345 	bool msync;
346 {
347 	register SM_FILE_T *tfp;
348 	register HDR *h;
349 	register ADDRESS *q;
350 	int tfd = -1;
351 	int i;
352 	bool newid;
353 	register char *p;
354 	MAILER nullmailer;
355 	MCI mcibuf;
356 	char qf[MAXPATHLEN];
357 	char tf[MAXPATHLEN];
358 	char df[MAXPATHLEN];
359 	char buf[MAXLINE];
360 
361 	/*
362 	**  Create control file.
363 	*/
364 
365 #define OPEN_TF	do							\
366 		{							\
367 			MODE_T oldumask = 0;				\
368 									\
369 			if (bitset(S_IWGRP, QueueFileMode))		\
370 				oldumask = umask(002);			\
371 			tfd = open(tf, TF_OPEN_FLAGS, QueueFileMode);	\
372 			if (bitset(S_IWGRP, QueueFileMode))		\
373 				(void) umask(oldumask);			\
374 		} while (0)
375 
376 
377 	newid = (e->e_id == NULL) || !bitset(EF_INQUEUE, e->e_flags);
378 	(void) sm_strlcpy(tf, queuename(e, NEWQFL_LETTER), sizeof tf);
379 	tfp = e->e_lockfp;
380 	if (tfp == NULL && newid)
381 	{
382 		/*
383 		**  open qf file directly: this will give an error if the file
384 		**  already exists and hence prevent problems if a queue-id
385 		**  is reused (e.g., because the clock is set back).
386 		*/
387 
388 		(void) sm_strlcpy(tf, queuename(e, ANYQFL_LETTER), sizeof tf);
389 		OPEN_TF;
390 		if (tfd < 0 ||
391 #if !SM_OPEN_EXLOCK
392 		    !lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB) ||
393 #endif /* !SM_OPEN_EXLOCK */
394 		    (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
395 					 (void *) &tfd, SM_IO_WRONLY,
396 					 NULL)) == NULL)
397 		{
398 			int save_errno = errno;
399 
400 			printopenfds(true);
401 			errno = save_errno;
402 			syserr("!queueup: cannot create queue file %s, euid=%d, fd=%d, fp=%p",
403 				tf, (int) geteuid(), tfd, tfp);
404 			/* NOTREACHED */
405 		}
406 		e->e_lockfp = tfp;
407 		upd_qs(e, 1, 0, "queueup");
408 	}
409 
410 	/* if newid, write the queue file directly (instead of temp file) */
411 	if (!newid)
412 	{
413 		/* get a locked tf file */
414 		for (i = 0; i < 128; i++)
415 		{
416 			if (tfd < 0)
417 			{
418 				OPEN_TF;
419 				if (tfd < 0)
420 				{
421 					if (errno != EEXIST)
422 						break;
423 					if (LogLevel > 0 && (i % 32) == 0)
424 						sm_syslog(LOG_ALERT, e->e_id,
425 							  "queueup: cannot create %s, uid=%d: %s",
426 							  tf, (int) geteuid(),
427 							  sm_errstring(errno));
428 				}
429 #if SM_OPEN_EXLOCK
430 				else
431 					break;
432 #endif /* SM_OPEN_EXLOCK */
433 			}
434 			if (tfd >= 0)
435 			{
436 #if SM_OPEN_EXLOCK
437 				/* file is locked by open() */
438 				break;
439 #else /* SM_OPEN_EXLOCK */
440 				if (lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB))
441 					break;
442 				else
443 #endif /* SM_OPEN_EXLOCK */
444 				if (LogLevel > 0 && (i % 32) == 0)
445 					sm_syslog(LOG_ALERT, e->e_id,
446 						  "queueup: cannot lock %s: %s",
447 						  tf, sm_errstring(errno));
448 				if ((i % 32) == 31)
449 				{
450 					(void) close(tfd);
451 					tfd = -1;
452 				}
453 			}
454 
455 			if ((i % 32) == 31)
456 			{
457 				/* save the old temp file away */
458 				(void) rename(tf, queuename(e, TEMPQF_LETTER));
459 			}
460 			else
461 				(void) sleep(i % 32);
462 		}
463 		if (tfd < 0 || (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
464 						 (void *) &tfd, SM_IO_WRONLY_B,
465 						 NULL)) == NULL)
466 		{
467 			int save_errno = errno;
468 
469 			printopenfds(true);
470 			errno = save_errno;
471 			syserr("!queueup: cannot create queue temp file %s, uid=%d",
472 				tf, (int) geteuid());
473 		}
474 	}
475 
476 	if (tTd(40, 1))
477 		sm_dprintf("\n>>>>> queueing %s/%s%s >>>>>\n",
478 			   qid_printqueue(e->e_qgrp, e->e_qdir),
479 			   queuename(e, ANYQFL_LETTER),
480 			   newid ? " (new id)" : "");
481 	if (tTd(40, 3))
482 	{
483 		sm_dprintf("  e_flags=");
484 		printenvflags(e);
485 	}
486 	if (tTd(40, 32))
487 	{
488 		sm_dprintf("  sendq=");
489 		printaddr(sm_debug_file(), e->e_sendqueue, true);
490 	}
491 	if (tTd(40, 9))
492 	{
493 		sm_dprintf("  tfp=");
494 		dumpfd(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL), true, false);
495 		sm_dprintf("  lockfp=");
496 		if (e->e_lockfp == NULL)
497 			sm_dprintf("NULL\n");
498 		else
499 			dumpfd(sm_io_getinfo(e->e_lockfp, SM_IO_WHAT_FD, NULL),
500 			       true, false);
501 	}
502 
503 	/*
504 	**  If there is no data file yet, create one.
505 	*/
506 
507 	(void) sm_strlcpy(df, queuename(e, DATAFL_LETTER), sizeof df);
508 	if (bitset(EF_HAS_DF, e->e_flags))
509 	{
510 		if (e->e_dfp != NULL &&
511 		    SuperSafe != SAFE_REALLY &&
512 		    SuperSafe != SAFE_REALLY_POSTMILTER &&
513 		    sm_io_setinfo(e->e_dfp, SM_BF_COMMIT, NULL) < 0 &&
514 		    errno != EINVAL)
515 		{
516 			syserr("!queueup: cannot commit data file %s, uid=%d",
517 			       queuename(e, DATAFL_LETTER), (int) geteuid());
518 		}
519 		if (e->e_dfp != NULL &&
520 		    SuperSafe == SAFE_INTERACTIVE && msync)
521 		{
522 			if (tTd(40,32))
523 				sm_syslog(LOG_INFO, e->e_id,
524 					  "queueup: fsync(e->e_dfp)");
525 
526 			if (fsync(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD,
527 						NULL)) < 0)
528 			{
529 				if (newid)
530 					syserr("!552 Error writing data file %s",
531 					       df);
532 				else
533 					syserr("!452 Error writing data file %s",
534 					       df);
535 			}
536 		}
537 	}
538 	else
539 	{
540 		int dfd;
541 		MODE_T oldumask = 0;
542 		register SM_FILE_T *dfp = NULL;
543 		struct stat stbuf;
544 
545 		if (e->e_dfp != NULL &&
546 		    sm_io_getinfo(e->e_dfp, SM_IO_WHAT_ISTYPE, BF_FILE_TYPE))
547 			syserr("committing over bf file");
548 
549 		if (bitset(S_IWGRP, QueueFileMode))
550 			oldumask = umask(002);
551 		dfd = open(df, O_WRONLY|O_CREAT|O_TRUNC|QF_O_EXTRA,
552 			   QueueFileMode);
553 		if (bitset(S_IWGRP, QueueFileMode))
554 			(void) umask(oldumask);
555 		if (dfd < 0 || (dfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
556 						 (void *) &dfd, SM_IO_WRONLY_B,
557 						 NULL)) == NULL)
558 			syserr("!queueup: cannot create data temp file %s, uid=%d",
559 				df, (int) geteuid());
560 		if (fstat(dfd, &stbuf) < 0)
561 			e->e_dfino = -1;
562 		else
563 		{
564 			e->e_dfdev = stbuf.st_dev;
565 			e->e_dfino = ST_INODE(stbuf);
566 		}
567 		e->e_flags |= EF_HAS_DF;
568 		memset(&mcibuf, '\0', sizeof mcibuf);
569 		mcibuf.mci_out = dfp;
570 		mcibuf.mci_mailer = FileMailer;
571 		(*e->e_putbody)(&mcibuf, e, NULL);
572 
573 		if (SuperSafe == SAFE_REALLY ||
574 		    SuperSafe == SAFE_REALLY_POSTMILTER ||
575 		    (SuperSafe == SAFE_INTERACTIVE && msync))
576 		{
577 			if (tTd(40,32))
578 				sm_syslog(LOG_INFO, e->e_id,
579 					  "queueup: fsync(dfp)");
580 
581 			if (fsync(sm_io_getinfo(dfp, SM_IO_WHAT_FD, NULL)) < 0)
582 			{
583 				if (newid)
584 					syserr("!552 Error writing data file %s",
585 					       df);
586 				else
587 					syserr("!452 Error writing data file %s",
588 					       df);
589 			}
590 		}
591 
592 		if (sm_io_close(dfp, SM_TIME_DEFAULT) < 0)
593 			syserr("!queueup: cannot save data temp file %s, uid=%d",
594 				df, (int) geteuid());
595 		e->e_putbody = putbody;
596 	}
597 
598 	/*
599 	**  Output future work requests.
600 	**	Priority and creation time should be first, since
601 	**	they are required by gatherq.
602 	*/
603 
604 	/* output queue version number (must be first!) */
605 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "V%d\n", QF_VERSION);
606 
607 	/* output creation time */
608 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "T%ld\n", (long) e->e_ctime);
609 
610 	/* output last delivery time */
611 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "K%ld\n", (long) e->e_dtime);
612 
613 	/* output number of delivery attempts */
614 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "N%d\n", e->e_ntries);
615 
616 	/* output message priority */
617 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "P%ld\n", e->e_msgpriority);
618 
619 	/*
620 	**  If data file is in a different directory than the queue file,
621 	**  output a "d" record naming the directory of the data file.
622 	*/
623 
624 	if (e->e_dfqgrp != e->e_qgrp)
625 	{
626 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "d%s\n",
627 			Queue[e->e_dfqgrp]->qg_qpaths[e->e_dfqdir].qp_name);
628 	}
629 
630 	/* output inode number of data file */
631 	/* XXX should probably include device major/minor too */
632 	if (e->e_dfino != -1)
633 	{
634 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "I%ld/%ld/%llu\n",
635 				     (long) major(e->e_dfdev),
636 				     (long) minor(e->e_dfdev),
637 				     (ULONGLONG_T) e->e_dfino);
638 	}
639 
640 	/* output body type */
641 	if (e->e_bodytype != NULL)
642 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "B%s\n",
643 				     denlstring(e->e_bodytype, true, false));
644 
645 	/* quarantine reason */
646 	if (e->e_quarmsg != NULL)
647 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "q%s\n",
648 				     denlstring(e->e_quarmsg, true, false));
649 
650 	/* message from envelope, if it exists */
651 	if (e->e_message != NULL)
652 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
653 				     denlstring(e->e_message, true, false));
654 
655 	/* send various flag bits through */
656 	p = buf;
657 	if (bitset(EF_WARNING, e->e_flags))
658 		*p++ = 'w';
659 	if (bitset(EF_RESPONSE, e->e_flags))
660 		*p++ = 'r';
661 	if (bitset(EF_HAS8BIT, e->e_flags))
662 		*p++ = '8';
663 	if (bitset(EF_DELETE_BCC, e->e_flags))
664 		*p++ = 'b';
665 	if (bitset(EF_RET_PARAM, e->e_flags))
666 		*p++ = 'd';
667 	if (bitset(EF_NO_BODY_RETN, e->e_flags))
668 		*p++ = 'n';
669 	if (bitset(EF_SPLIT, e->e_flags))
670 		*p++ = 's';
671 	*p++ = '\0';
672 	if (buf[0] != '\0')
673 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "F%s\n", buf);
674 
675 	/* save $={persistentMacros} macro values */
676 	queueup_macros(macid("{persistentMacros}"), tfp, e);
677 
678 	/* output name of sender */
679 	if (bitnset(M_UDBENVELOPE, e->e_from.q_mailer->m_flags))
680 		p = e->e_sender;
681 	else
682 		p = e->e_from.q_paddr;
683 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "S%s\n",
684 			     denlstring(p, true, false));
685 
686 	/* output ESMTP-supplied "original" information */
687 	if (e->e_envid != NULL)
688 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Z%s\n",
689 				     denlstring(e->e_envid, true, false));
690 
691 	/* output AUTH= parameter */
692 	if (e->e_auth_param != NULL)
693 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "A%s\n",
694 				     denlstring(e->e_auth_param, true, false));
695 	if (e->e_dlvr_flag != 0)
696 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "!%c %ld\n",
697 				     (char) e->e_dlvr_flag, e->e_deliver_by);
698 
699 	/* output list of recipient addresses */
700 	printctladdr(NULL, NULL);
701 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
702 	{
703 		if (!QS_IS_UNDELIVERED(q->q_state))
704 			continue;
705 
706 		/* message for this recipient, if it exists */
707 		if (q->q_message != NULL)
708 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
709 					     denlstring(q->q_message, true,
710 							false));
711 
712 		printctladdr(q, tfp);
713 		if (q->q_orcpt != NULL)
714 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Q%s\n",
715 					     denlstring(q->q_orcpt, true,
716 							false));
717 		if (q->q_finalrcpt != NULL)
718 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "r%s\n",
719 					     denlstring(q->q_finalrcpt, true,
720 							false));
721 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'R');
722 		if (bitset(QPRIMARY, q->q_flags))
723 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'P');
724 		if (bitset(QHASNOTIFY, q->q_flags))
725 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'N');
726 		if (bitset(QPINGONSUCCESS, q->q_flags))
727 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'S');
728 		if (bitset(QPINGONFAILURE, q->q_flags))
729 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'F');
730 		if (bitset(QPINGONDELAY, q->q_flags))
731 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'D');
732 		if (q->q_alias != NULL &&
733 		    bitset(QALIAS, q->q_alias->q_flags))
734 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'A');
735 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, ':');
736 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s\n",
737 				     denlstring(q->q_paddr, true, false));
738 		if (announce)
739 		{
740 			char *tag = "queued";
741 
742 			if (e->e_quarmsg != NULL)
743 				tag = "quarantined";
744 
745 			e->e_to = q->q_paddr;
746 			message(tag);
747 			if (LogLevel > 8)
748 				logdelivery(q->q_mailer, NULL, q->q_status,
749 					    tag, NULL, (time_t) 0, e);
750 			e->e_to = NULL;
751 		}
752 		if (tTd(40, 1))
753 		{
754 			sm_dprintf("queueing ");
755 			printaddr(sm_debug_file(), q, false);
756 		}
757 	}
758 
759 	/*
760 	**  Output headers for this message.
761 	**	Expand macros completely here.  Queue run will deal with
762 	**	everything as absolute headers.
763 	**		All headers that must be relative to the recipient
764 	**		can be cracked later.
765 	**	We set up a "null mailer" -- i.e., a mailer that will have
766 	**	no effect on the addresses as they are output.
767 	*/
768 
769 	memset((char *) &nullmailer, '\0', sizeof nullmailer);
770 	nullmailer.m_re_rwset = nullmailer.m_rh_rwset =
771 			nullmailer.m_se_rwset = nullmailer.m_sh_rwset = -1;
772 	nullmailer.m_eol = "\n";
773 	memset(&mcibuf, '\0', sizeof mcibuf);
774 	mcibuf.mci_mailer = &nullmailer;
775 	mcibuf.mci_out = tfp;
776 
777 	macdefine(&e->e_macro, A_PERM, 'g', "\201f");
778 	for (h = e->e_header; h != NULL; h = h->h_link)
779 	{
780 		if (h->h_value == NULL)
781 			continue;
782 
783 		/* don't output resent headers on non-resent messages */
784 		if (bitset(H_RESENT, h->h_flags) &&
785 		    !bitset(EF_RESENT, e->e_flags))
786 			continue;
787 
788 		/* expand macros; if null, don't output header at all */
789 		if (bitset(H_DEFAULT, h->h_flags))
790 		{
791 			(void) expand(h->h_value, buf, sizeof buf, e);
792 			if (buf[0] == '\0')
793 				continue;
794 		}
795 
796 		/* output this header */
797 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "H?");
798 
799 		/* output conditional macro if present */
800 		if (h->h_macro != '\0')
801 		{
802 			if (bitset(0200, h->h_macro))
803 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
804 						     "${%s}",
805 						      macname(bitidx(h->h_macro)));
806 			else
807 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
808 						     "$%c", h->h_macro);
809 		}
810 		else if (!bitzerop(h->h_mflags) &&
811 			 bitset(H_CHECK|H_ACHECK, h->h_flags))
812 		{
813 			int j;
814 
815 			/* if conditional, output the set of conditions */
816 			for (j = '\0'; j <= '\177'; j++)
817 				if (bitnset(j, h->h_mflags))
818 					(void) sm_io_putc(tfp, SM_TIME_DEFAULT,
819 							  j);
820 		}
821 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, '?');
822 
823 		/* output the header: expand macros, convert addresses */
824 		if (bitset(H_DEFAULT, h->h_flags) &&
825 		    !bitset(H_BINDLATE, h->h_flags))
826 		{
827 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s: %s\n",
828 					     h->h_field,
829 					     denlstring(buf, false, true));
830 		}
831 		else if (bitset(H_FROM|H_RCPT, h->h_flags) &&
832 			 !bitset(H_BINDLATE, h->h_flags))
833 		{
834 			bool oldstyle = bitset(EF_OLDSTYLE, e->e_flags);
835 			SM_FILE_T *savetrace = TrafficLogFile;
836 
837 			TrafficLogFile = NULL;
838 
839 			if (bitset(H_FROM, h->h_flags))
840 				oldstyle = false;
841 
842 			commaize(h, h->h_value, oldstyle, &mcibuf, e);
843 
844 			TrafficLogFile = savetrace;
845 		}
846 		else
847 		{
848 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s: %s\n",
849 					     h->h_field,
850 					     denlstring(h->h_value, false,
851 							true));
852 		}
853 	}
854 
855 	/*
856 	**  Clean up.
857 	**
858 	**	Write a terminator record -- this is to prevent
859 	**	scurrilous crackers from appending any data.
860 	*/
861 
862 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ".\n");
863 
864 	if (sm_io_flush(tfp, SM_TIME_DEFAULT) != 0 ||
865 	    ((SuperSafe == SAFE_REALLY ||
866 	      SuperSafe == SAFE_REALLY_POSTMILTER ||
867 	      (SuperSafe == SAFE_INTERACTIVE && msync)) &&
868 	     fsync(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL)) < 0) ||
869 	    sm_io_error(tfp))
870 	{
871 		if (newid)
872 			syserr("!552 Error writing control file %s", tf);
873 		else
874 			syserr("!452 Error writing control file %s", tf);
875 	}
876 
877 	if (!newid)
878 	{
879 		char new = queue_letter(e, ANYQFL_LETTER);
880 
881 		/* rename (locked) tf to be (locked) [qh]f */
882 		(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER),
883 				  sizeof qf);
884 		if (rename(tf, qf) < 0)
885 			syserr("cannot rename(%s, %s), uid=%d",
886 				tf, qf, (int) geteuid());
887 		else
888 		{
889 			/*
890 			**  Check if type has changed and only
891 			**  remove the old item if the rename above
892 			**  succeeded.
893 			*/
894 
895 			if (e->e_qfletter != '\0' &&
896 			    e->e_qfletter != new)
897 			{
898 				if (tTd(40, 5))
899 				{
900 					sm_dprintf("type changed from %c to %c\n",
901 						   e->e_qfletter, new);
902 				}
903 
904 				if (unlink(queuename(e, e->e_qfletter)) < 0)
905 				{
906 					/* XXX: something more drastic? */
907 					if (LogLevel > 0)
908 						sm_syslog(LOG_ERR, e->e_id,
909 							  "queueup: unlink(%s) failed: %s",
910 							  queuename(e, e->e_qfletter),
911 							  sm_errstring(errno));
912 				}
913 			}
914 		}
915 		e->e_qfletter = new;
916 
917 		/*
918 		**  fsync() after renaming to make sure metadata is
919 		**  written to disk on filesystems in which renames are
920 		**  not guaranteed.
921 		*/
922 
923 		if (SuperSafe != SAFE_NO)
924 		{
925 			/* for softupdates */
926 			if (tfd >= 0 && fsync(tfd) < 0)
927 			{
928 				syserr("!queueup: cannot fsync queue temp file %s",
929 				       tf);
930 			}
931 			SYNC_DIR(qf, true);
932 		}
933 
934 		/* close and unlock old (locked) queue file */
935 		if (e->e_lockfp != NULL)
936 			(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
937 		e->e_lockfp = tfp;
938 
939 		/* save log info */
940 		if (LogLevel > 79)
941 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", qf);
942 	}
943 	else
944 	{
945 		/* save log info */
946 		if (LogLevel > 79)
947 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", tf);
948 
949 		e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
950 	}
951 
952 	errno = 0;
953 	e->e_flags |= EF_INQUEUE;
954 
955 	if (tTd(40, 1))
956 		sm_dprintf("<<<<< done queueing %s <<<<<\n\n", e->e_id);
957 	return;
958 }
959 
960 /*
961 **  PRINTCTLADDR -- print control address to file.
962 **
963 **	Parameters:
964 **		a -- address.
965 **		tfp -- file pointer.
966 **
967 **	Returns:
968 **		none.
969 **
970 **	Side Effects:
971 **		The control address (if changed) is printed to the file.
972 **		The last control address and uid are saved.
973 */
974 
975 static void
976 printctladdr(a, tfp)
977 	register ADDRESS *a;
978 	SM_FILE_T *tfp;
979 {
980 	char *user;
981 	register ADDRESS *q;
982 	uid_t uid;
983 	gid_t gid;
984 	static ADDRESS *lastctladdr = NULL;
985 	static uid_t lastuid;
986 
987 	/* initialization */
988 	if (a == NULL || a->q_alias == NULL || tfp == NULL)
989 	{
990 		if (lastctladdr != NULL && tfp != NULL)
991 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C\n");
992 		lastctladdr = NULL;
993 		lastuid = 0;
994 		return;
995 	}
996 
997 	/* find the active uid */
998 	q = getctladdr(a);
999 	if (q == NULL)
1000 	{
1001 		user = NULL;
1002 		uid = 0;
1003 		gid = 0;
1004 	}
1005 	else
1006 	{
1007 		user = q->q_ruser != NULL ? q->q_ruser : q->q_user;
1008 		uid = q->q_uid;
1009 		gid = q->q_gid;
1010 	}
1011 	a = a->q_alias;
1012 
1013 	/* check to see if this is the same as last time */
1014 	if (lastctladdr != NULL && uid == lastuid &&
1015 	    strcmp(lastctladdr->q_paddr, a->q_paddr) == 0)
1016 		return;
1017 	lastuid = uid;
1018 	lastctladdr = a;
1019 
1020 	if (uid == 0 || user == NULL || user[0] == '\0')
1021 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C");
1022 	else
1023 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C%s:%ld:%ld",
1024 				     denlstring(user, true, false), (long) uid,
1025 				     (long) gid);
1026 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ":%s\n",
1027 			     denlstring(a->q_paddr, true, false));
1028 }
1029 
1030 /*
1031 **  RUNNERS_SIGTERM -- propagate a SIGTERM to queue runner process
1032 **
1033 **	This propagates the signal to the child processes that are queue
1034 **	runners. This is for a queue runner "cleanup". After all of the
1035 **	child queue runner processes are signaled (it should be SIGTERM
1036 **	being the sig) then the old signal handler (Oldsh) is called
1037 **	to handle any cleanup set for this process (provided it is not
1038 **	SIG_DFL or SIG_IGN). The signal may not be handled immediately
1039 **	if the BlockOldsh flag is set. If the current process doesn't
1040 **	have a parent then handle the signal immediately, regardless of
1041 **	BlockOldsh.
1042 **
1043 **	Parameters:
1044 **		sig -- the signal number being sent
1045 **
1046 **	Returns:
1047 **		none.
1048 **
1049 **	Side Effects:
1050 **		Sets the NoMoreRunners boolean to true to stop more runners
1051 **		from being started in runqueue().
1052 **
1053 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1054 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1055 **		DOING.
1056 */
1057 
1058 static bool		volatile NoMoreRunners = false;
1059 static sigfunc_t	Oldsh_term = SIG_DFL;
1060 static sigfunc_t	Oldsh_hup = SIG_DFL;
1061 static sigfunc_t	volatile Oldsh = SIG_DFL;
1062 static bool		BlockOldsh = false;
1063 static int		volatile Oldsig = 0;
1064 static SIGFUNC_DECL	runners_sigterm __P((int));
1065 static SIGFUNC_DECL	runners_sighup __P((int));
1066 
1067 static SIGFUNC_DECL
1068 runners_sigterm(sig)
1069 	int sig;
1070 {
1071 	int save_errno = errno;
1072 
1073 	FIX_SYSV_SIGNAL(sig, runners_sigterm);
1074 	errno = save_errno;
1075 	CHECK_CRITICAL(sig);
1076 	NoMoreRunners = true;
1077 	Oldsh = Oldsh_term;
1078 	Oldsig = sig;
1079 	proc_list_signal(PROC_QUEUE, sig);
1080 
1081 	if (!BlockOldsh || getppid() <= 1)
1082 	{
1083 		/* Check that a valid 'old signal handler' is callable */
1084 		if (Oldsh_term != SIG_DFL && Oldsh_term != SIG_IGN &&
1085 		    Oldsh_term != runners_sigterm)
1086 			(*Oldsh_term)(sig);
1087 	}
1088 	errno = save_errno;
1089 	return SIGFUNC_RETURN;
1090 }
1091 /*
1092 **  RUNNERS_SIGHUP -- propagate a SIGHUP to queue runner process
1093 **
1094 **	This propagates the signal to the child processes that are queue
1095 **	runners. This is for a queue runner "cleanup". After all of the
1096 **	child queue runner processes are signaled (it should be SIGHUP
1097 **	being the sig) then the old signal handler (Oldsh) is called to
1098 **	handle any cleanup set for this process (provided it is not SIG_DFL
1099 **	or SIG_IGN). The signal may not be handled immediately if the
1100 **	BlockOldsh flag is set. If the current process doesn't have
1101 **	a parent then handle the signal immediately, regardless of
1102 **	BlockOldsh.
1103 **
1104 **	Parameters:
1105 **		sig -- the signal number being sent
1106 **
1107 **	Returns:
1108 **		none.
1109 **
1110 **	Side Effects:
1111 **		Sets the NoMoreRunners boolean to true to stop more runners
1112 **		from being started in runqueue().
1113 **
1114 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1115 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1116 **		DOING.
1117 */
1118 
1119 static SIGFUNC_DECL
1120 runners_sighup(sig)
1121 	int sig;
1122 {
1123 	int save_errno = errno;
1124 
1125 	FIX_SYSV_SIGNAL(sig, runners_sighup);
1126 	errno = save_errno;
1127 	CHECK_CRITICAL(sig);
1128 	NoMoreRunners = true;
1129 	Oldsh = Oldsh_hup;
1130 	Oldsig = sig;
1131 	proc_list_signal(PROC_QUEUE, sig);
1132 
1133 	if (!BlockOldsh || getppid() <= 1)
1134 	{
1135 		/* Check that a valid 'old signal handler' is callable */
1136 		if (Oldsh_hup != SIG_DFL && Oldsh_hup != SIG_IGN &&
1137 		    Oldsh_hup != runners_sighup)
1138 			(*Oldsh_hup)(sig);
1139 	}
1140 	errno = save_errno;
1141 	return SIGFUNC_RETURN;
1142 }
1143 /*
1144 **  MARK_WORK_GROUP_RESTART -- mark a work group as needing a restart
1145 **
1146 **  Sets a workgroup for restarting.
1147 **
1148 **	Parameters:
1149 **		wgrp -- the work group id to restart.
1150 **		reason -- why (signal?), -1 to turn off restart
1151 **
1152 **	Returns:
1153 **		none.
1154 **
1155 **	Side effects:
1156 **		May set global RestartWorkGroup to true.
1157 **
1158 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1159 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1160 **		DOING.
1161 */
1162 
1163 void
1164 mark_work_group_restart(wgrp, reason)
1165 	int wgrp;
1166 	int reason;
1167 {
1168 	if (wgrp < 0 || wgrp > NumWorkGroups)
1169 		return;
1170 
1171 	WorkGrp[wgrp].wg_restart = reason;
1172 	if (reason >= 0)
1173 		RestartWorkGroup = true;
1174 }
1175 /*
1176 **  RESTART_MARKED_WORK_GROUPS -- restart work groups marked as needing restart
1177 **
1178 **  Restart any workgroup marked as needing a restart provided more
1179 **  runners are allowed.
1180 **
1181 **	Parameters:
1182 **		none.
1183 **
1184 **	Returns:
1185 **		none.
1186 **
1187 **	Side effects:
1188 **		Sets global RestartWorkGroup to false.
1189 */
1190 
1191 void
1192 restart_marked_work_groups()
1193 {
1194 	int i;
1195 	int wasblocked;
1196 
1197 	if (NoMoreRunners)
1198 		return;
1199 
1200 	/* Block SIGCHLD so reapchild() doesn't mess with us */
1201 	wasblocked = sm_blocksignal(SIGCHLD);
1202 
1203 	for (i = 0; i < NumWorkGroups; i++)
1204 	{
1205 		if (WorkGrp[i].wg_restart >= 0)
1206 		{
1207 			if (LogLevel > 8)
1208 				sm_syslog(LOG_ERR, NOQID,
1209 					  "restart queue runner=%d due to signal 0x%x",
1210 					  i, WorkGrp[i].wg_restart);
1211 			restart_work_group(i);
1212 		}
1213 	}
1214 	RestartWorkGroup = false;
1215 
1216 	if (wasblocked == 0)
1217 		(void) sm_releasesignal(SIGCHLD);
1218 }
1219 /*
1220 **  RESTART_WORK_GROUP -- restart a specific work group
1221 **
1222 **  Restart a specific workgroup provided more runners are allowed.
1223 **  If the requested work group has been restarted too many times log
1224 **  this and refuse to restart.
1225 **
1226 **	Parameters:
1227 **		wgrp -- the work group id to restart
1228 **
1229 **	Returns:
1230 **		none.
1231 **
1232 **	Side Effects:
1233 **		starts another process doing the work of wgrp
1234 */
1235 
1236 #define MAX_PERSIST_RESTART	10	/* max allowed number of restarts */
1237 
1238 static void
1239 restart_work_group(wgrp)
1240 	int wgrp;
1241 {
1242 	if (NoMoreRunners ||
1243 	    wgrp < 0 || wgrp > NumWorkGroups)
1244 		return;
1245 
1246 	WorkGrp[wgrp].wg_restart = -1;
1247 	if (WorkGrp[wgrp].wg_restartcnt < MAX_PERSIST_RESTART)
1248 	{
1249 		/* avoid overflow; increment here */
1250 		WorkGrp[wgrp].wg_restartcnt++;
1251 		(void) run_work_group(wgrp, RWG_FORK|RWG_PERSISTENT|RWG_RUNALL);
1252 	}
1253 	else
1254 	{
1255 		sm_syslog(LOG_ERR, NOQID,
1256 			  "ERROR: persistent queue runner=%d restarted too many times, queue runner lost",
1257 			  wgrp);
1258 	}
1259 }
1260 /*
1261 **  SCHEDULE_QUEUE_RUNS -- schedule the next queue run for a work group.
1262 **
1263 **	Parameters:
1264 **		runall -- schedule even if individual bit is not set.
1265 **		wgrp -- the work group id to schedule.
1266 **		didit -- the queue run was performed for this work group.
1267 **
1268 **	Returns:
1269 **		nothing
1270 */
1271 
1272 #define INCR_MOD(v, m)	if (++v >= m)	\
1273 				v = 0;	\
1274 			else
1275 
1276 static void
1277 schedule_queue_runs(runall, wgrp, didit)
1278 	bool runall;
1279 	int wgrp;
1280 	bool didit;
1281 {
1282 	int qgrp, cgrp, endgrp;
1283 #if _FFR_QUEUE_SCHED_DBG
1284 	time_t lastsched;
1285 	bool sched;
1286 #endif /* _FFR_QUEUE_SCHED_DBG */
1287 	time_t now;
1288 	time_t minqintvl;
1289 
1290 	/*
1291 	**  This is a bit ugly since we have to duplicate the
1292 	**  code that "walks" through a work queue group.
1293 	*/
1294 
1295 	now = curtime();
1296 	minqintvl = 0;
1297 	cgrp = endgrp = WorkGrp[wgrp].wg_curqgrp;
1298 	do
1299 	{
1300 		time_t qintvl;
1301 
1302 #if _FFR_QUEUE_SCHED_DBG
1303 		lastsched = 0;
1304 		sched = false;
1305 #endif /* _FFR_QUEUE_SCHED_DBG */
1306 		qgrp = WorkGrp[wgrp].wg_qgs[cgrp]->qg_index;
1307 		if (Queue[qgrp]->qg_queueintvl > 0)
1308 			qintvl = Queue[qgrp]->qg_queueintvl;
1309 		else if (QueueIntvl > 0)
1310 			qintvl = QueueIntvl;
1311 		else
1312 			qintvl = (time_t) 0;
1313 #if _FFR_QUEUE_SCHED_DBG
1314 		lastsched = Queue[qgrp]->qg_nextrun;
1315 #endif /* _FFR_QUEUE_SCHED_DBG */
1316 		if ((runall || Queue[qgrp]->qg_nextrun <= now) && qintvl > 0)
1317 		{
1318 #if _FFR_QUEUE_SCHED_DBG
1319 			sched = true;
1320 #endif /* _FFR_QUEUE_SCHED_DBG */
1321 			if (minqintvl == 0 || qintvl < minqintvl)
1322 				minqintvl = qintvl;
1323 
1324 			/*
1325 			**  Only set a new time if a queue run was performed
1326 			**  for this queue group.  If the queue was not run,
1327 			**  we could starve it by setting a new time on each
1328 			**  call.
1329 			*/
1330 
1331 			if (didit)
1332 				Queue[qgrp]->qg_nextrun += qintvl;
1333 		}
1334 #if _FFR_QUEUE_SCHED_DBG
1335 		if (tTd(69, 10))
1336 			sm_syslog(LOG_INFO, NOQID,
1337 				"sqr: wgrp=%d, cgrp=%d, qgrp=%d, intvl=%ld, QI=%ld, runall=%d, lastrun=%ld, nextrun=%ld, sched=%d",
1338 				wgrp, cgrp, qgrp, Queue[qgrp]->qg_queueintvl,
1339 				QueueIntvl, runall, lastsched,
1340 				Queue[qgrp]->qg_nextrun, sched);
1341 #endif /* _FFR_QUEUE_SCHED_DBG */
1342 		INCR_MOD(cgrp, WorkGrp[wgrp].wg_numqgrp);
1343 	} while (endgrp != cgrp);
1344 	if (minqintvl > 0)
1345 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1346 }
1347 
1348 #if _FFR_QUEUE_RUN_PARANOIA
1349 /*
1350 **  CHECKQUEUERUNNER -- check whether a queue group hasn't been run.
1351 **
1352 **	Use this if events may get lost and hence queue runners may not
1353 **	be started and mail will pile up in a queue.
1354 **
1355 **	Parameters:
1356 **		none.
1357 **
1358 **	Returns:
1359 **		true if a queue run is necessary.
1360 **
1361 **	Side Effects:
1362 **		may schedule a queue run.
1363 */
1364 
1365 bool
1366 checkqueuerunner()
1367 {
1368 	int qgrp;
1369 	time_t now, minqintvl;
1370 
1371 	now = curtime();
1372 	minqintvl = 0;
1373 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
1374 	{
1375 		time_t qintvl;
1376 
1377 		if (Queue[qgrp]->qg_queueintvl > 0)
1378 			qintvl = Queue[qgrp]->qg_queueintvl;
1379 		else if (QueueIntvl > 0)
1380 			qintvl = QueueIntvl;
1381 		else
1382 			qintvl = (time_t) 0;
1383 		if (Queue[qgrp]->qg_nextrun <= now - qintvl)
1384 		{
1385 			if (minqintvl == 0 || qintvl < minqintvl)
1386 				minqintvl = qintvl;
1387 			if (LogLevel > 1)
1388 				sm_syslog(LOG_WARNING, NOQID,
1389 					"checkqueuerunner: queue %d should have been run at %s, queue interval %ld",
1390 					qgrp,
1391 					arpadate(ctime(&Queue[qgrp]->qg_nextrun)),
1392 					qintvl);
1393 		}
1394 	}
1395 	if (minqintvl > 0)
1396 	{
1397 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1398 		return true;
1399 	}
1400 	return false;
1401 }
1402 #endif /* _FFR_QUEUE_RUN_PARANOIA */
1403 
1404 /*
1405 **  RUNQUEUE -- run the jobs in the queue.
1406 **
1407 **	Gets the stuff out of the queue in some presumably logical
1408 **	order and processes them.
1409 **
1410 **	Parameters:
1411 **		forkflag -- true if the queue scanning should be done in
1412 **			a child process.  We double-fork so it is not our
1413 **			child and we don't have to clean up after it.
1414 **			false can be ignored if we have multiple queues.
1415 **		verbose -- if true, print out status information.
1416 **		persistent -- persistent queue runner?
1417 **		runall -- run all groups or only a subset (DoQueueRun)?
1418 **
1419 **	Returns:
1420 **		true if the queue run successfully began.
1421 **
1422 **	Side Effects:
1423 **		runs things in the mail queue using run_work_group().
1424 **		maybe schedules next queue run.
1425 */
1426 
1427 static ENVELOPE	QueueEnvelope;		/* the queue run envelope */
1428 static time_t	LastQueueTime = 0;	/* last time a queue ID assigned */
1429 static pid_t	LastQueuePid = -1;	/* last PID which had a queue ID */
1430 
1431 /* values for qp_supdirs */
1432 #define QP_NOSUB	0x0000	/* No subdirectories */
1433 #define QP_SUBDF	0x0001	/* "df" subdirectory */
1434 #define QP_SUBQF	0x0002	/* "qf" subdirectory */
1435 #define QP_SUBXF	0x0004	/* "xf" subdirectory */
1436 
1437 bool
1438 runqueue(forkflag, verbose, persistent, runall)
1439 	bool forkflag;
1440 	bool verbose;
1441 	bool persistent;
1442 	bool runall;
1443 {
1444 	int i;
1445 	bool ret = true;
1446 	static int curnum = 0;
1447 	sigfunc_t cursh;
1448 #if SM_HEAP_CHECK
1449 	SM_NONVOLATILE int oldgroup = 0;
1450 
1451 	if (sm_debug_active(&DebugLeakQ, 1))
1452 	{
1453 		oldgroup = sm_heap_group();
1454 		sm_heap_newgroup();
1455 		sm_dprintf("runqueue() heap group #%d\n", sm_heap_group());
1456 	}
1457 #endif /* SM_HEAP_CHECK */
1458 
1459 	/* queue run has been started, don't do any more this time */
1460 	DoQueueRun = false;
1461 
1462 	/* more than one queue or more than one directory per queue */
1463 	if (!forkflag && !verbose &&
1464 	    (WorkGrp[0].wg_qgs[0]->qg_numqueues > 1 || NumWorkGroups > 1 ||
1465 	     WorkGrp[0].wg_numqgrp > 1))
1466 		forkflag = true;
1467 
1468 	/*
1469 	**  For controlling queue runners via signals sent to this process.
1470 	**  Oldsh* will get called too by runners_sig* (if it is not SIG_IGN
1471 	**  or SIG_DFL) to preserve cleanup behavior. Now that this process
1472 	**  will have children (and perhaps grandchildren) this handler will
1473 	**  be left in place. This is because this process, once it has
1474 	**  finished spinning off queue runners, may go back to doing something
1475 	**  else (like being a daemon). And we still want on a SIG{TERM,HUP} to
1476 	**  clean up the child queue runners. Only install 'runners_sig*' once
1477 	**  else we'll get stuck looping forever.
1478 	*/
1479 
1480 	cursh = sm_signal(SIGTERM, runners_sigterm);
1481 	if (cursh != runners_sigterm)
1482 		Oldsh_term = cursh;
1483 	cursh = sm_signal(SIGHUP, runners_sighup);
1484 	if (cursh != runners_sighup)
1485 		Oldsh_hup = cursh;
1486 
1487 	for (i = 0; i < NumWorkGroups && !NoMoreRunners; i++)
1488 	{
1489 		int rwgflags = RWG_NONE;
1490 
1491 		/*
1492 		**  If MaxQueueChildren active then test whether the start
1493 		**  of the next queue group's additional queue runners (maximum)
1494 		**  will result in MaxQueueChildren being exceeded.
1495 		**
1496 		**  Note: do not use continue; even though another workgroup
1497 		**	may have fewer queue runners, this would be "unfair",
1498 		**	i.e., this work group might "starve" then.
1499 		*/
1500 
1501 #if _FFR_QUEUE_SCHED_DBG
1502 		if (tTd(69, 10))
1503 			sm_syslog(LOG_INFO, NOQID,
1504 				"rq: curnum=%d, MaxQueueChildren=%d, CurRunners=%d, WorkGrp[curnum].wg_maxact=%d",
1505 				curnum, MaxQueueChildren, CurRunners,
1506 				WorkGrp[curnum].wg_maxact);
1507 #endif /* _FFR_QUEUE_SCHED_DBG */
1508 		if (MaxQueueChildren > 0 &&
1509 		    CurRunners + WorkGrp[curnum].wg_maxact > MaxQueueChildren)
1510 			break;
1511 
1512 		/*
1513 		**  Pick up where we left off (curnum), in case we
1514 		**  used up all the children last time without finishing.
1515 		**  This give a round-robin fairness to queue runs.
1516 		**
1517 		**  Increment CurRunners before calling run_work_group()
1518 		**  to avoid a "race condition" with proc_list_drop() which
1519 		**  decrements CurRunners if the queue runners terminate.
1520 		**  Notice: CurRunners is an upper limit, in some cases
1521 		**  (too few jobs in the queue) this value is larger than
1522 		**  the actual number of queue runners. The discrepancy can
1523 		**  increase if some queue runners "hang" for a long time.
1524 		*/
1525 
1526 		CurRunners += WorkGrp[curnum].wg_maxact;
1527 		if (forkflag)
1528 			rwgflags |= RWG_FORK;
1529 		if (verbose)
1530 			rwgflags |= RWG_VERBOSE;
1531 		if (persistent)
1532 			rwgflags |= RWG_PERSISTENT;
1533 		if (runall)
1534 			rwgflags |= RWG_RUNALL;
1535 		ret = run_work_group(curnum, rwgflags);
1536 
1537 		/*
1538 		**  Failure means a message was printed for ETRN
1539 		**  and subsequent queues are likely to fail as well.
1540 		**  Decrement CurRunners in that case because
1541 		**  none have been started.
1542 		*/
1543 
1544 		if (!ret)
1545 		{
1546 			CurRunners -= WorkGrp[curnum].wg_maxact;
1547 			break;
1548 		}
1549 
1550 		if (!persistent)
1551 			schedule_queue_runs(runall, curnum, true);
1552 		INCR_MOD(curnum, NumWorkGroups);
1553 	}
1554 
1555 	/* schedule left over queue runs */
1556 	if (i < NumWorkGroups && !NoMoreRunners && !persistent)
1557 	{
1558 		int h;
1559 
1560 		for (h = curnum; i < NumWorkGroups; i++)
1561 		{
1562 			schedule_queue_runs(runall, h, false);
1563 			INCR_MOD(h, NumWorkGroups);
1564 		}
1565 	}
1566 
1567 
1568 #if SM_HEAP_CHECK
1569 	if (sm_debug_active(&DebugLeakQ, 1))
1570 		sm_heap_setgroup(oldgroup);
1571 #endif /* SM_HEAP_CHECK */
1572 	return ret;
1573 }
1574 
1575 #if _FFR_SKIP_DOMAINS
1576 /*
1577 **  SKIP_DOMAINS -- Skip 'skip' number of domains in the WorkQ.
1578 **
1579 **  Added by Stephen Frost <sfrost@snowman.net> to support
1580 **  having each runner process every N'th domain instead of
1581 **  every N'th message.
1582 **
1583 **	Parameters:
1584 **		skip -- number of domains in WorkQ to skip.
1585 **
1586 **	Returns:
1587 **		total number of messages skipped.
1588 **
1589 **	Side Effects:
1590 **		may change WorkQ
1591 */
1592 
1593 static int
1594 skip_domains(skip)
1595 	int skip;
1596 {
1597 	int n, seqjump;
1598 
1599 	for (n = 0, seqjump = 0; n < skip && WorkQ != NULL; seqjump++)
1600 	{
1601 		if (WorkQ->w_next != NULL)
1602 		{
1603 			if (WorkQ->w_host != NULL &&
1604 			    WorkQ->w_next->w_host != NULL)
1605 			{
1606 				if (sm_strcasecmp(WorkQ->w_host,
1607 						WorkQ->w_next->w_host) != 0)
1608 					n++;
1609 			}
1610 			else
1611 			{
1612 				if ((WorkQ->w_host != NULL &&
1613 				     WorkQ->w_next->w_host == NULL) ||
1614 				    (WorkQ->w_host == NULL &&
1615 				     WorkQ->w_next->w_host != NULL))
1616 					     n++;
1617 			}
1618 		}
1619 		WorkQ = WorkQ->w_next;
1620 	}
1621 	return seqjump;
1622 }
1623 #endif /* _FFR_SKIP_DOMAINS */
1624 
1625 /*
1626 **  RUNNER_WORK -- have a queue runner do its work
1627 **
1628 **  Have a queue runner do its work a list of entries.
1629 **  When work isn't directly being done then this process can take a signal
1630 **  and terminate immediately (in a clean fashion of course).
1631 **  When work is directly being done, it's not to be interrupted
1632 **  immediately: the work should be allowed to finish at a clean point
1633 **  before termination (in a clean fashion of course).
1634 **
1635 **	Parameters:
1636 **		e -- envelope.
1637 **		sequenceno -- 'th process to run WorkQ.
1638 **		didfork -- did the calling process fork()?
1639 **		skip -- process only each skip'th item.
1640 **		njobs -- number of jobs in WorkQ.
1641 **
1642 **	Returns:
1643 **		none.
1644 **
1645 **	Side Effects:
1646 **		runs things in the mail queue.
1647 */
1648 
1649 static void
1650 runner_work(e, sequenceno, didfork, skip, njobs)
1651 	register ENVELOPE *e;
1652 	int sequenceno;
1653 	bool didfork;
1654 	int skip;
1655 	int njobs;
1656 {
1657 	int n, seqjump;
1658 	WORK *w;
1659 	time_t now;
1660 
1661 	SM_GET_LA(now);
1662 
1663 	/*
1664 	**  Here we temporarily block the second calling of the handlers.
1665 	**  This allows us to handle the signal without terminating in the
1666 	**  middle of direct work. If a signal does come, the test for
1667 	**  NoMoreRunners will find it.
1668 	*/
1669 
1670 	BlockOldsh = true;
1671 	seqjump = skip;
1672 
1673 	/* process them once at a time */
1674 	while (WorkQ != NULL)
1675 	{
1676 #if SM_HEAP_CHECK
1677 		SM_NONVOLATILE int oldgroup = 0;
1678 
1679 		if (sm_debug_active(&DebugLeakQ, 1))
1680 		{
1681 			oldgroup = sm_heap_group();
1682 			sm_heap_newgroup();
1683 			sm_dprintf("run_queue_group() heap group #%d\n",
1684 				sm_heap_group());
1685 		}
1686 #endif /* SM_HEAP_CHECK */
1687 
1688 		/* do no more work */
1689 		if (NoMoreRunners)
1690 		{
1691 			/* Check that a valid signal handler is callable */
1692 			if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1693 			    Oldsh != runners_sighup &&
1694 			    Oldsh != runners_sigterm)
1695 				(*Oldsh)(Oldsig);
1696 			break;
1697 		}
1698 
1699 		w = WorkQ; /* assign current work item */
1700 
1701 		/*
1702 		**  Set the head of the WorkQ to the next work item.
1703 		**  It is set 'skip' ahead (the number of parallel queue
1704 		**  runners working on WorkQ together) since each runner
1705 		**  works on every 'skip'th (N-th) item.
1706 #if _FFR_SKIP_DOMAINS
1707 		**  In the case of the BYHOST Queue Sort Order, the 'item'
1708 		**  is a domain, so we work on every 'skip'th (N-th) domain.
1709 #endif * _FFR_SKIP_DOMAINS *
1710 		*/
1711 
1712 #if _FFR_SKIP_DOMAINS
1713 		if (QueueSortOrder == QSO_BYHOST)
1714 		{
1715 			seqjump = 1;
1716 			if (WorkQ->w_next != NULL)
1717 			{
1718 				if (WorkQ->w_host != NULL &&
1719 				    WorkQ->w_next->w_host != NULL)
1720 				{
1721 					if (sm_strcasecmp(WorkQ->w_host,
1722 							WorkQ->w_next->w_host)
1723 								!= 0)
1724 						seqjump = skip_domains(skip);
1725 					else
1726 						WorkQ = WorkQ->w_next;
1727 				}
1728 				else
1729 				{
1730 					if ((WorkQ->w_host != NULL &&
1731 					     WorkQ->w_next->w_host == NULL) ||
1732 					    (WorkQ->w_host == NULL &&
1733 					     WorkQ->w_next->w_host != NULL))
1734 						seqjump = skip_domains(skip);
1735 					else
1736 						WorkQ = WorkQ->w_next;
1737 				}
1738 			}
1739 			else
1740 				WorkQ = WorkQ->w_next;
1741 		}
1742 		else
1743 #endif /* _FFR_SKIP_DOMAINS */
1744 		{
1745 			for (n = 0; n < skip && WorkQ != NULL; n++)
1746 				WorkQ = WorkQ->w_next;
1747 		}
1748 
1749 		e->e_to = NULL;
1750 
1751 		/*
1752 		**  Ignore jobs that are too expensive for the moment.
1753 		**
1754 		**	Get new load average every GET_NEW_LA_TIME seconds.
1755 		*/
1756 
1757 		SM_GET_LA(now);
1758 		if (shouldqueue(WkRecipFact, Current_LA_time))
1759 		{
1760 			char *msg = "Aborting queue run: load average too high";
1761 
1762 			if (Verbose)
1763 				message("%s", msg);
1764 			if (LogLevel > 8)
1765 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1766 			break;
1767 		}
1768 		if (shouldqueue(w->w_pri, w->w_ctime))
1769 		{
1770 			if (Verbose)
1771 				message(EmptyString);
1772 			if (QueueSortOrder == QSO_BYPRIORITY)
1773 			{
1774 				if (Verbose)
1775 					message("Skipping %s/%s (sequence %d of %d) and flushing rest of queue",
1776 						qid_printqueue(w->w_qgrp,
1777 							       w->w_qdir),
1778 						w->w_name + 2, sequenceno,
1779 						njobs);
1780 				if (LogLevel > 8)
1781 					sm_syslog(LOG_INFO, NOQID,
1782 						  "runqueue: Flushing queue from %s/%s (pri %ld, LA %d, %d of %d)",
1783 						  qid_printqueue(w->w_qgrp,
1784 								 w->w_qdir),
1785 						  w->w_name + 2, w->w_pri,
1786 						  CurrentLA, sequenceno,
1787 						  njobs);
1788 				break;
1789 			}
1790 			else if (Verbose)
1791 				message("Skipping %s/%s (sequence %d of %d)",
1792 					qid_printqueue(w->w_qgrp, w->w_qdir),
1793 					w->w_name + 2, sequenceno, njobs);
1794 		}
1795 		else
1796 		{
1797 			if (Verbose)
1798 			{
1799 				message(EmptyString);
1800 				message("Running %s/%s (sequence %d of %d)",
1801 					qid_printqueue(w->w_qgrp, w->w_qdir),
1802 					w->w_name + 2, sequenceno, njobs);
1803 			}
1804 			if (didfork && MaxQueueChildren > 0)
1805 			{
1806 				sm_blocksignal(SIGCHLD);
1807 				(void) sm_signal(SIGCHLD, reapchild);
1808 			}
1809 			if (tTd(63, 100))
1810 				sm_syslog(LOG_DEBUG, NOQID,
1811 					  "runqueue %s dowork(%s)",
1812 					  qid_printqueue(w->w_qgrp, w->w_qdir),
1813 					  w->w_name + 2);
1814 
1815 			(void) dowork(w->w_qgrp, w->w_qdir, w->w_name + 2,
1816 				      ForkQueueRuns, false, e);
1817 			errno = 0;
1818 		}
1819 		sm_free(w->w_name); /* XXX */
1820 		if (w->w_host != NULL)
1821 			sm_free(w->w_host); /* XXX */
1822 		sm_free((char *) w); /* XXX */
1823 		sequenceno += seqjump; /* next sequence number */
1824 #if SM_HEAP_CHECK
1825 		if (sm_debug_active(&DebugLeakQ, 1))
1826 			sm_heap_setgroup(oldgroup);
1827 #endif /* SM_HEAP_CHECK */
1828 	}
1829 
1830 	BlockOldsh = false;
1831 
1832 	/* check the signals didn't happen during the revert */
1833 	if (NoMoreRunners)
1834 	{
1835 		/* Check that a valid signal handler is callable */
1836 		if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1837 		    Oldsh != runners_sighup && Oldsh != runners_sigterm)
1838 			(*Oldsh)(Oldsig);
1839 	}
1840 
1841 	Oldsh = SIG_DFL; /* after the NoMoreRunners check */
1842 }
1843 /*
1844 **  RUN_WORK_GROUP -- run the jobs in a queue group from a work group.
1845 **
1846 **	Gets the stuff out of the queue in some presumably logical
1847 **	order and processes them.
1848 **
1849 **	Parameters:
1850 **		wgrp -- work group to process.
1851 **		flags -- RWG_* flags
1852 **
1853 **	Returns:
1854 **		true if the queue run successfully began.
1855 **
1856 **	Side Effects:
1857 **		runs things in the mail queue.
1858 */
1859 
1860 /* Minimum sleep time for persistent queue runners */
1861 #define MIN_SLEEP_TIME	5
1862 
1863 bool
1864 run_work_group(wgrp, flags)
1865 	int wgrp;
1866 	int flags;
1867 {
1868 	register ENVELOPE *e;
1869 	int njobs, qdir;
1870 	int sequenceno = 1;
1871 	int qgrp, endgrp, h, i;
1872 	time_t now;
1873 	bool full, more;
1874 	SM_RPOOL_T *rpool;
1875 	extern void rmexpstab __P((void));
1876 	extern ENVELOPE BlankEnvelope;
1877 	extern SIGFUNC_DECL reapchild __P((int));
1878 
1879 	if (wgrp < 0)
1880 		return false;
1881 
1882 	/*
1883 	**  If no work will ever be selected, don't even bother reading
1884 	**  the queue.
1885 	*/
1886 
1887 	SM_GET_LA(now);
1888 
1889 	if (!bitset(RWG_PERSISTENT, flags) &&
1890 	    shouldqueue(WkRecipFact, Current_LA_time))
1891 	{
1892 		char *msg = "Skipping queue run -- load average too high";
1893 
1894 		if (bitset(RWG_VERBOSE, flags))
1895 			message("458 %s\n", msg);
1896 		if (LogLevel > 8)
1897 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1898 		return false;
1899 	}
1900 
1901 	/*
1902 	**  See if we already have too many children.
1903 	*/
1904 
1905 	if (bitset(RWG_FORK, flags) &&
1906 	    WorkGrp[wgrp].wg_lowqintvl > 0 &&
1907 	    !bitset(RWG_PERSISTENT, flags) &&
1908 	    MaxChildren > 0 && CurChildren >= MaxChildren)
1909 	{
1910 		char *msg = "Skipping queue run -- too many children";
1911 
1912 		if (bitset(RWG_VERBOSE, flags))
1913 			message("458 %s (%d)\n", msg, CurChildren);
1914 		if (LogLevel > 8)
1915 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s (%d)",
1916 				  msg, CurChildren);
1917 		return false;
1918 	}
1919 
1920 	/*
1921 	**  See if we want to go off and do other useful work.
1922 	*/
1923 
1924 	if (bitset(RWG_FORK, flags))
1925 	{
1926 		pid_t pid;
1927 
1928 		(void) sm_blocksignal(SIGCHLD);
1929 		(void) sm_signal(SIGCHLD, reapchild);
1930 
1931 		pid = dofork();
1932 		if (pid == -1)
1933 		{
1934 			const char *msg = "Skipping queue run -- fork() failed";
1935 			const char *err = sm_errstring(errno);
1936 
1937 			if (bitset(RWG_VERBOSE, flags))
1938 				message("458 %s: %s\n", msg, err);
1939 			if (LogLevel > 8)
1940 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s: %s",
1941 					  msg, err);
1942 			(void) sm_releasesignal(SIGCHLD);
1943 			return false;
1944 		}
1945 		if (pid != 0)
1946 		{
1947 			/* parent -- pick up intermediate zombie */
1948 			(void) sm_blocksignal(SIGALRM);
1949 
1950 			/* wgrp only used when queue runners are persistent */
1951 			proc_list_add(pid, "Queue runner", PROC_QUEUE,
1952 				      WorkGrp[wgrp].wg_maxact,
1953 				      bitset(RWG_PERSISTENT, flags) ? wgrp : -1,
1954 				      NULL);
1955 			(void) sm_releasesignal(SIGALRM);
1956 			(void) sm_releasesignal(SIGCHLD);
1957 			return true;
1958 		}
1959 
1960 		/* child -- clean up signals */
1961 
1962 		/* Reset global flags */
1963 		RestartRequest = NULL;
1964 		RestartWorkGroup = false;
1965 		ShutdownRequest = NULL;
1966 		PendingSignal = 0;
1967 		CurrentPid = getpid();
1968 		close_sendmail_pid();
1969 
1970 		/*
1971 		**  Initialize exception stack and default exception
1972 		**  handler for child process.
1973 		*/
1974 
1975 		sm_exc_newthread(fatal_error);
1976 		clrcontrol();
1977 		proc_list_clear();
1978 
1979 		/* Add parent process as first child item */
1980 		proc_list_add(CurrentPid, "Queue runner child process",
1981 			      PROC_QUEUE_CHILD, 0, -1, NULL);
1982 		(void) sm_releasesignal(SIGCHLD);
1983 		(void) sm_signal(SIGCHLD, SIG_DFL);
1984 		(void) sm_signal(SIGHUP, SIG_DFL);
1985 		(void) sm_signal(SIGTERM, intsig);
1986 	}
1987 
1988 	/*
1989 	**  Release any resources used by the daemon code.
1990 	*/
1991 
1992 	clrdaemon();
1993 
1994 	/* force it to run expensive jobs */
1995 	NoConnect = false;
1996 
1997 	/* drop privileges */
1998 	if (geteuid() == (uid_t) 0)
1999 		(void) drop_privileges(false);
2000 
2001 	/*
2002 	**  Create ourselves an envelope
2003 	*/
2004 
2005 	CurEnv = &QueueEnvelope;
2006 	rpool = sm_rpool_new_x(NULL);
2007 	e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2008 	e->e_flags = BlankEnvelope.e_flags;
2009 	e->e_parent = NULL;
2010 
2011 	/* make sure we have disconnected from parent */
2012 	if (bitset(RWG_FORK, flags))
2013 	{
2014 		disconnect(1, e);
2015 		QuickAbort = false;
2016 	}
2017 
2018 	/*
2019 	**  If we are running part of the queue, always ignore stored
2020 	**  host status.
2021 	*/
2022 
2023 	if (QueueLimitId != NULL || QueueLimitSender != NULL ||
2024 	    QueueLimitQuarantine != NULL ||
2025 	    QueueLimitRecipient != NULL)
2026 	{
2027 		IgnoreHostStatus = true;
2028 		MinQueueAge = 0;
2029 	}
2030 
2031 	/*
2032 	**  Here is where we choose the queue group from the work group.
2033 	**  The caller of the "domorework" label must setup a new envelope.
2034 	*/
2035 
2036 	endgrp = WorkGrp[wgrp].wg_curqgrp; /* to not spin endlessly */
2037 
2038   domorework:
2039 
2040 	/*
2041 	**  Run a queue group if:
2042 	**  RWG_RUNALL bit is set or the bit for this group is set.
2043 	*/
2044 
2045 	now = curtime();
2046 	for (;;)
2047 	{
2048 		/*
2049 		**  Find the next queue group within the work group that
2050 		**  has been marked as needing a run.
2051 		*/
2052 
2053 		qgrp = WorkGrp[wgrp].wg_qgs[WorkGrp[wgrp].wg_curqgrp]->qg_index;
2054 		WorkGrp[wgrp].wg_curqgrp++; /* advance */
2055 		WorkGrp[wgrp].wg_curqgrp %= WorkGrp[wgrp].wg_numqgrp; /* wrap */
2056 		if (bitset(RWG_RUNALL, flags) ||
2057 		    (Queue[qgrp]->qg_nextrun <= now &&
2058 		     Queue[qgrp]->qg_nextrun != (time_t) -1))
2059 			break;
2060 		if (endgrp == WorkGrp[wgrp].wg_curqgrp)
2061 		{
2062 			e->e_id = NULL;
2063 			if (bitset(RWG_FORK, flags))
2064 				finis(true, true, ExitStat);
2065 			return true; /* we're done */
2066 		}
2067 	}
2068 
2069 	qdir = Queue[qgrp]->qg_curnum; /* round-robin init of queue position */
2070 #if _FFR_QUEUE_SCHED_DBG
2071 	if (tTd(69, 12))
2072 		sm_syslog(LOG_INFO, NOQID,
2073 			"rwg: wgrp=%d, qgrp=%d, qdir=%d, name=%s, curqgrp=%d, numgrps=%d",
2074 			wgrp, qgrp, qdir, qid_printqueue(qgrp, qdir),
2075 			WorkGrp[wgrp].wg_curqgrp, WorkGrp[wgrp].wg_numqgrp);
2076 #endif /* _FFR_QUEUE_SCHED_DBG */
2077 
2078 #if HASNICE
2079 	/* tweak niceness of queue runs */
2080 	if (Queue[qgrp]->qg_nice > 0)
2081 		(void) nice(Queue[qgrp]->qg_nice);
2082 #endif /* HASNICE */
2083 
2084 	/* XXX running queue group... */
2085 	sm_setproctitle(true, CurEnv, "running queue: %s",
2086 			qid_printqueue(qgrp, qdir));
2087 
2088 	if (LogLevel > 69 || tTd(63, 99))
2089 		sm_syslog(LOG_DEBUG, NOQID,
2090 			  "runqueue %s, pid=%d, forkflag=%d",
2091 			  qid_printqueue(qgrp, qdir), (int) CurrentPid,
2092 			  bitset(RWG_FORK, flags));
2093 
2094 	/*
2095 	**  Start making passes through the queue.
2096 	**	First, read and sort the entire queue.
2097 	**	Then, process the work in that order.
2098 	**		But if you take too long, start over.
2099 	*/
2100 
2101 	for (i = 0; i < Queue[qgrp]->qg_numqueues; i++)
2102 	{
2103 		h = gatherq(qgrp, qdir, false, &full, &more);
2104 #if SM_CONF_SHM
2105 		if (ShmId != SM_SHM_NO_ID)
2106 			QSHM_ENTRIES(Queue[qgrp]->qg_qpaths[qdir].qp_idx) = h;
2107 #endif /* SM_CONF_SHM */
2108 		/* If there are no more items in this queue advance */
2109 		if (!more)
2110 		{
2111 			/* A round-robin advance */
2112 			qdir++;
2113 			qdir %= Queue[qgrp]->qg_numqueues;
2114 		}
2115 
2116 		/* Has the WorkList reached the limit? */
2117 		if (full)
2118 			break; /* don't try to gather more */
2119 	}
2120 
2121 	/* order the existing work requests */
2122 	njobs = sortq(Queue[qgrp]->qg_maxlist);
2123 	Queue[qgrp]->qg_curnum = qdir; /* update */
2124 
2125 
2126 	if (!Verbose && bitnset(QD_FORK, Queue[qgrp]->qg_flags))
2127 	{
2128 		int loop, maxrunners;
2129 		pid_t pid;
2130 
2131 		/*
2132 		**  For this WorkQ we want to fork off N children (maxrunners)
2133 		**  at this point. Each child has a copy of WorkQ. Each child
2134 		**  will process every N-th item. The parent will wait for all
2135 		**  of the children to finish before moving on to the next
2136 		**  queue group within the work group. This saves us forking
2137 		**  a new runner-child for each work item.
2138 		**  It's valid for qg_maxqrun == 0 since this may be an
2139 		**  explicit "don't run this queue" setting.
2140 		*/
2141 
2142 		maxrunners = Queue[qgrp]->qg_maxqrun;
2143 
2144 		/* No need to have more runners then there are jobs */
2145 		if (maxrunners > njobs)
2146 			maxrunners = njobs;
2147 		for (loop = 0; loop < maxrunners; loop++)
2148 		{
2149 			/*
2150 			**  Since the delivery may happen in a child and the
2151 			**  parent does not wait, the parent may close the
2152 			**  maps thereby removing any shared memory used by
2153 			**  the map.  Therefore, close the maps now so the
2154 			**  child will dynamically open them if necessary.
2155 			*/
2156 
2157 			closemaps(false);
2158 
2159 			pid = fork();
2160 			if (pid < 0)
2161 			{
2162 				syserr("run_work_group: cannot fork");
2163 				return false;
2164 			}
2165 			else if (pid > 0)
2166 			{
2167 				/* parent -- clean out connection cache */
2168 				mci_flush(false, NULL);
2169 #if _FFR_SKIP_DOMAINS
2170 				if (QueueSortOrder == QSO_BYHOST)
2171 				{
2172 					sequenceno += skip_domains(1);
2173 				}
2174 				else
2175 #endif /* _FFR_SKIP_DOMAINS */
2176 				{
2177 					/* for the skip */
2178 					WorkQ = WorkQ->w_next;
2179 					sequenceno++;
2180 				}
2181 				proc_list_add(pid, "Queue child runner process",
2182 					      PROC_QUEUE_CHILD, 0, -1, NULL);
2183 
2184 				/* No additional work, no additional runners */
2185 				if (WorkQ == NULL)
2186 					break;
2187 			}
2188 			else
2189 			{
2190 				/* child -- Reset global flags */
2191 				RestartRequest = NULL;
2192 				RestartWorkGroup = false;
2193 				ShutdownRequest = NULL;
2194 				PendingSignal = 0;
2195 				CurrentPid = getpid();
2196 				close_sendmail_pid();
2197 
2198 				/*
2199 				**  Initialize exception stack and default
2200 				**  exception handler for child process.
2201 				**  When fork()'d the child now has a private
2202 				**  copy of WorkQ at its current position.
2203 				*/
2204 
2205 				sm_exc_newthread(fatal_error);
2206 
2207 				/*
2208 				**  SMTP processes (whether -bd or -bs) set
2209 				**  SIGCHLD to reapchild to collect
2210 				**  children status.  However, at delivery
2211 				**  time, that status must be collected
2212 				**  by sm_wait() to be dealt with properly
2213 				**  (check success of delivery based
2214 				**  on status code, etc).  Therefore, if we
2215 				**  are an SMTP process, reset SIGCHLD
2216 				**  back to the default so reapchild
2217 				**  doesn't collect status before
2218 				**  sm_wait().
2219 				*/
2220 
2221 				if (OpMode == MD_SMTP ||
2222 				    OpMode == MD_DAEMON ||
2223 				    MaxQueueChildren > 0)
2224 				{
2225 					proc_list_clear();
2226 					sm_releasesignal(SIGCHLD);
2227 					(void) sm_signal(SIGCHLD, SIG_DFL);
2228 				}
2229 
2230 				/* child -- error messages to the transcript */
2231 				QuickAbort = OnlyOneError = false;
2232 				runner_work(e, sequenceno, true,
2233 					    maxrunners, njobs);
2234 
2235 				/* This child is done */
2236 				finis(true, true, ExitStat);
2237 				/* NOTREACHED */
2238 			}
2239 		}
2240 
2241 		sm_releasesignal(SIGCHLD);
2242 
2243 		/*
2244 		**  Wait until all of the runners have completed before
2245 		**  seeing if there is another queue group in the
2246 		**  work group to process.
2247 		**  XXX Future enhancement: don't wait() for all children
2248 		**  here, just go ahead and make sure that overall the number
2249 		**  of children is not exceeded.
2250 		*/
2251 
2252 		while (CurChildren > 0)
2253 		{
2254 			int status;
2255 			pid_t ret;
2256 
2257 			while ((ret = sm_wait(&status)) <= 0)
2258 				continue;
2259 			proc_list_drop(ret, status, NULL);
2260 		}
2261 	}
2262 	else if (Queue[qgrp]->qg_maxqrun > 0 || bitset(RWG_FORCE, flags))
2263 	{
2264 		/*
2265 		**  When current process will not fork children to do the work,
2266 		**  it will do the work itself. The 'skip' will be 1 since
2267 		**  there are no child runners to divide the work across.
2268 		*/
2269 
2270 		runner_work(e, sequenceno, false, 1, njobs);
2271 	}
2272 
2273 	/* free memory allocated by newenvelope() above */
2274 	sm_rpool_free(rpool);
2275 	QueueEnvelope.e_rpool = NULL;
2276 
2277 	/* Are there still more queues in the work group to process? */
2278 	if (endgrp != WorkGrp[wgrp].wg_curqgrp)
2279 	{
2280 		rpool = sm_rpool_new_x(NULL);
2281 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2282 		e->e_flags = BlankEnvelope.e_flags;
2283 		goto domorework;
2284 	}
2285 
2286 	/* No more queues in work group to process. Now check persistent. */
2287 	if (bitset(RWG_PERSISTENT, flags))
2288 	{
2289 		sequenceno = 1;
2290 		sm_setproctitle(true, CurEnv, "running queue: %s",
2291 				qid_printqueue(qgrp, qdir));
2292 
2293 		/*
2294 		**  close bogus maps, i.e., maps which caused a tempfail,
2295 		**	so we get fresh map connections on the next lookup.
2296 		**  closemaps() is also called when children are started.
2297 		*/
2298 
2299 		closemaps(true);
2300 
2301 		/* Close any cached connections. */
2302 		mci_flush(true, NULL);
2303 
2304 		/* Clean out expired related entries. */
2305 		rmexpstab();
2306 
2307 #if NAMED_BIND
2308 		/* Update MX records for FallbackMX. */
2309 		if (FallbackMX != NULL)
2310 			(void) getfallbackmxrr(FallbackMX);
2311 #endif /* NAMED_BIND */
2312 
2313 #if USERDB
2314 		/* close UserDatabase */
2315 		_udbx_close();
2316 #endif /* USERDB */
2317 
2318 #if SM_HEAP_CHECK
2319 		if (sm_debug_active(&SmHeapCheck, 2)
2320 		    && access("memdump", F_OK) == 0
2321 		   )
2322 		{
2323 			SM_FILE_T *out;
2324 
2325 			remove("memdump");
2326 			out = sm_io_open(SmFtStdio, SM_TIME_DEFAULT,
2327 					 "memdump.out", SM_IO_APPEND, NULL);
2328 			if (out != NULL)
2329 			{
2330 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT, "----------------------\n");
2331 				sm_heap_report(out,
2332 					sm_debug_level(&SmHeapCheck) - 1);
2333 				(void) sm_io_close(out, SM_TIME_DEFAULT);
2334 			}
2335 		}
2336 #endif /* SM_HEAP_CHECK */
2337 
2338 		/* let me rest for a second to catch my breath */
2339 		if (njobs == 0 && WorkGrp[wgrp].wg_lowqintvl < MIN_SLEEP_TIME)
2340 			sleep(MIN_SLEEP_TIME);
2341 		else if (WorkGrp[wgrp].wg_lowqintvl <= 0)
2342 			sleep(QueueIntvl > 0 ? QueueIntvl : MIN_SLEEP_TIME);
2343 		else
2344 			sleep(WorkGrp[wgrp].wg_lowqintvl);
2345 
2346 		/*
2347 		**  Get the LA outside the WorkQ loop if necessary.
2348 		**  In a persistent queue runner the code is repeated over
2349 		**  and over but gatherq() may ignore entries due to
2350 		**  shouldqueue() (do we really have to do this twice?).
2351 		**  Hence the queue runners would just idle around when once
2352 		**  CurrentLA caused all entries in a queue to be ignored.
2353 		*/
2354 
2355 		if (njobs == 0)
2356 			SM_GET_LA(now);
2357 		rpool = sm_rpool_new_x(NULL);
2358 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2359 		e->e_flags = BlankEnvelope.e_flags;
2360 		goto domorework;
2361 	}
2362 
2363 	/* exit without the usual cleanup */
2364 	e->e_id = NULL;
2365 	if (bitset(RWG_FORK, flags))
2366 		finis(true, true, ExitStat);
2367 	/* NOTREACHED */
2368 	return true;
2369 }
2370 
2371 /*
2372 **  DOQUEUERUN -- do a queue run?
2373 */
2374 
2375 bool
2376 doqueuerun()
2377 {
2378 	return DoQueueRun;
2379 }
2380 
2381 /*
2382 **  RUNQUEUEEVENT -- Sets a flag to indicate that a queue run should be done.
2383 **
2384 **	Parameters:
2385 **		none.
2386 **
2387 **	Returns:
2388 **		none.
2389 **
2390 **	Side Effects:
2391 **		The invocation of this function via an alarm may interrupt
2392 **		a set of actions. Thus errno may be set in that context.
2393 **		We need to restore errno at the end of this function to ensure
2394 **		that any work done here that sets errno doesn't return a
2395 **		misleading/false errno value. Errno may	be EINTR upon entry to
2396 **		this function because of non-restartable/continuable system
2397 **		API was active. Iff this is true we will override errno as
2398 **		a timeout (as a more accurate error message).
2399 **
2400 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
2401 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
2402 **		DOING.
2403 */
2404 
2405 void
2406 runqueueevent(ignore)
2407 	int ignore;
2408 {
2409 	int save_errno = errno;
2410 
2411 	/*
2412 	**  Set the general bit that we want a queue run,
2413 	**  tested in doqueuerun()
2414 	*/
2415 
2416 	DoQueueRun = true;
2417 #if _FFR_QUEUE_SCHED_DBG
2418 	if (tTd(69, 10))
2419 		sm_syslog(LOG_INFO, NOQID, "rqe: done");
2420 #endif /* _FFR_QUEUE_SCHED_DBG */
2421 
2422 	errno = save_errno;
2423 	if (errno == EINTR)
2424 		errno = ETIMEDOUT;
2425 }
2426 /*
2427 **  GATHERQ -- gather messages from the message queue(s) the work queue.
2428 **
2429 **	Parameters:
2430 **		qgrp -- the index of the queue group.
2431 **		qdir -- the index of the queue directory.
2432 **		doall -- if set, include everything in the queue (even
2433 **			the jobs that cannot be run because the load
2434 **			average is too high, or MaxQueueRun is reached).
2435 **			Otherwise, exclude those jobs.
2436 **		full -- (optional) to be set 'true' if WorkList is full
2437 **		more -- (optional) to be set 'true' if there are still more
2438 **			messages in this queue not added to WorkList
2439 **
2440 **	Returns:
2441 **		The number of request in the queue (not necessarily
2442 **		the number of requests in WorkList however).
2443 **
2444 **	Side Effects:
2445 **		prepares available work into WorkList
2446 */
2447 
2448 #define NEED_P		0001	/* 'P': priority */
2449 #define NEED_T		0002	/* 'T': time */
2450 #define NEED_R		0004	/* 'R': recipient */
2451 #define NEED_S		0010	/* 'S': sender */
2452 #define NEED_H		0020	/* host */
2453 #define HAS_QUARANTINE	0040	/* has an unexpected 'q' line */
2454 #define NEED_QUARANTINE	0100	/* 'q': reason */
2455 
2456 static WORK	*WorkList = NULL;	/* list of unsort work */
2457 static int	WorkListSize = 0;	/* current max size of WorkList */
2458 static int	WorkListCount = 0;	/* # of work items in WorkList */
2459 
2460 static int
2461 gatherq(qgrp, qdir, doall, full, more)
2462 	int qgrp;
2463 	int qdir;
2464 	bool doall;
2465 	bool *full;
2466 	bool *more;
2467 {
2468 	register struct dirent *d;
2469 	register WORK *w;
2470 	register char *p;
2471 	DIR *f;
2472 	int i, num_ent;
2473 	int wn;
2474 	QUEUE_CHAR *check;
2475 	char qd[MAXPATHLEN];
2476 	char qf[MAXPATHLEN];
2477 
2478 	wn = WorkListCount - 1;
2479 	num_ent = 0;
2480 	if (qdir == NOQDIR)
2481 		(void) sm_strlcpy(qd, ".", sizeof qd);
2482 	else
2483 		(void) sm_strlcpyn(qd, sizeof qd, 2,
2484 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
2485 			(bitset(QP_SUBQF,
2486 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
2487 					? "/qf" : ""));
2488 
2489 	if (tTd(41, 1))
2490 	{
2491 		sm_dprintf("gatherq:\n");
2492 
2493 		check = QueueLimitId;
2494 		while (check != NULL)
2495 		{
2496 			sm_dprintf("\tQueueLimitId = %s%s\n",
2497 				check->queue_negate ? "!" : "",
2498 				check->queue_match);
2499 			check = check->queue_next;
2500 		}
2501 
2502 		check = QueueLimitSender;
2503 		while (check != NULL)
2504 		{
2505 			sm_dprintf("\tQueueLimitSender = %s%s\n",
2506 				check->queue_negate ? "!" : "",
2507 				check->queue_match);
2508 			check = check->queue_next;
2509 		}
2510 
2511 		check = QueueLimitRecipient;
2512 		while (check != NULL)
2513 		{
2514 			sm_dprintf("\tQueueLimitRecipient = %s%s\n",
2515 				check->queue_negate ? "!" : "",
2516 				check->queue_match);
2517 			check = check->queue_next;
2518 		}
2519 
2520 		if (QueueMode == QM_QUARANTINE)
2521 		{
2522 			check = QueueLimitQuarantine;
2523 			while (check != NULL)
2524 			{
2525 				sm_dprintf("\tQueueLimitQuarantine = %s%s\n",
2526 					   check->queue_negate ? "!" : "",
2527 					   check->queue_match);
2528 				check = check->queue_next;
2529 			}
2530 		}
2531 	}
2532 
2533 	/* open the queue directory */
2534 	f = opendir(qd);
2535 	if (f == NULL)
2536 	{
2537 		syserr("gatherq: cannot open \"%s\"",
2538 			qid_printqueue(qgrp, qdir));
2539 		if (full != NULL)
2540 			*full = WorkListCount >= MaxQueueRun && MaxQueueRun > 0;
2541 		if (more != NULL)
2542 			*more = false;
2543 		return 0;
2544 	}
2545 
2546 	/*
2547 	**  Read the work directory.
2548 	*/
2549 
2550 	while ((d = readdir(f)) != NULL)
2551 	{
2552 		SM_FILE_T *cf;
2553 		int qfver = 0;
2554 		char lbuf[MAXNAME + 1];
2555 		struct stat sbuf;
2556 
2557 		if (tTd(41, 50))
2558 			sm_dprintf("gatherq: checking %s..", d->d_name);
2559 
2560 		/* is this an interesting entry? */
2561 		if (!(((QueueMode == QM_NORMAL &&
2562 			d->d_name[0] == NORMQF_LETTER) ||
2563 		       (QueueMode == QM_QUARANTINE &&
2564 			d->d_name[0] == QUARQF_LETTER) ||
2565 		       (QueueMode == QM_LOST &&
2566 			d->d_name[0] == LOSEQF_LETTER)) &&
2567 		      d->d_name[1] == 'f'))
2568 		{
2569 			if (tTd(41, 50))
2570 				sm_dprintf("  skipping\n");
2571 			continue;
2572 		}
2573 		if (tTd(41, 50))
2574 			sm_dprintf("\n");
2575 
2576 		if (strlen(d->d_name) >= MAXQFNAME)
2577 		{
2578 			if (Verbose)
2579 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
2580 						     "gatherq: %s too long, %d max characters\n",
2581 						     d->d_name, MAXQFNAME);
2582 			if (LogLevel > 0)
2583 				sm_syslog(LOG_ALERT, NOQID,
2584 					  "gatherq: %s too long, %d max characters",
2585 					  d->d_name, MAXQFNAME);
2586 			continue;
2587 		}
2588 
2589 		check = QueueLimitId;
2590 		while (check != NULL)
2591 		{
2592 			if (strcontainedin(false, check->queue_match,
2593 					   d->d_name) != check->queue_negate)
2594 				break;
2595 			else
2596 				check = check->queue_next;
2597 		}
2598 		if (QueueLimitId != NULL && check == NULL)
2599 			continue;
2600 
2601 		/* grow work list if necessary */
2602 		if (++wn >= MaxQueueRun && MaxQueueRun > 0)
2603 		{
2604 			if (wn == MaxQueueRun && LogLevel > 0)
2605 				sm_syslog(LOG_WARNING, NOQID,
2606 					  "WorkList for %s maxed out at %d",
2607 					  qid_printqueue(qgrp, qdir),
2608 					  MaxQueueRun);
2609 			if (doall)
2610 				continue;	/* just count entries */
2611 			break;
2612 		}
2613 		if (wn >= WorkListSize)
2614 		{
2615 			grow_wlist(qgrp, qdir);
2616 			if (wn >= WorkListSize)
2617 				continue;
2618 		}
2619 		SM_ASSERT(wn >= 0);
2620 		w = &WorkList[wn];
2621 
2622 		(void) sm_strlcpyn(qf, sizeof qf, 3, qd, "/", d->d_name);
2623 		if (stat(qf, &sbuf) < 0)
2624 		{
2625 			if (errno != ENOENT)
2626 				sm_syslog(LOG_INFO, NOQID,
2627 					  "gatherq: can't stat %s/%s",
2628 					  qid_printqueue(qgrp, qdir),
2629 					  d->d_name);
2630 			wn--;
2631 			continue;
2632 		}
2633 		if (!bitset(S_IFREG, sbuf.st_mode))
2634 		{
2635 			/* Yikes!  Skip it or we will hang on open! */
2636 			if (!((d->d_name[0] == DATAFL_LETTER ||
2637 			       d->d_name[0] == NORMQF_LETTER ||
2638 			       d->d_name[0] == QUARQF_LETTER ||
2639 			       d->d_name[0] == LOSEQF_LETTER ||
2640 			       d->d_name[0] == XSCRPT_LETTER) &&
2641 			      d->d_name[1] == 'f' && d->d_name[2] == '\0'))
2642 				syserr("gatherq: %s/%s is not a regular file",
2643 				       qid_printqueue(qgrp, qdir), d->d_name);
2644 			wn--;
2645 			continue;
2646 		}
2647 
2648 		/* avoid work if possible */
2649 		if ((QueueSortOrder == QSO_BYFILENAME ||
2650 		     QueueSortOrder == QSO_BYMODTIME ||
2651 		     QueueSortOrder == QSO_NONE ||
2652 		     QueueSortOrder == QSO_RANDOM) &&
2653 		    QueueLimitQuarantine == NULL &&
2654 		    QueueLimitSender == NULL &&
2655 		    QueueLimitRecipient == NULL)
2656 		{
2657 			w->w_qgrp = qgrp;
2658 			w->w_qdir = qdir;
2659 			w->w_name = newstr(d->d_name);
2660 			w->w_host = NULL;
2661 			w->w_lock = w->w_tooyoung = false;
2662 			w->w_pri = 0;
2663 			w->w_ctime = 0;
2664 			w->w_mtime = sbuf.st_mtime;
2665 			++num_ent;
2666 			continue;
2667 		}
2668 
2669 		/* open control file */
2670 		cf = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
2671 				NULL);
2672 		if (cf == NULL && OpMode != MD_PRINT)
2673 		{
2674 			/* this may be some random person sending hir msgs */
2675 			if (tTd(41, 2))
2676 				sm_dprintf("gatherq: cannot open %s: %s\n",
2677 					d->d_name, sm_errstring(errno));
2678 			errno = 0;
2679 			wn--;
2680 			continue;
2681 		}
2682 		w->w_qgrp = qgrp;
2683 		w->w_qdir = qdir;
2684 		w->w_name = newstr(d->d_name);
2685 		w->w_host = NULL;
2686 		if (cf != NULL)
2687 		{
2688 			w->w_lock = !lockfile(sm_io_getinfo(cf, SM_IO_WHAT_FD,
2689 							    NULL),
2690 					      w->w_name, NULL,
2691 					      LOCK_SH|LOCK_NB);
2692 		}
2693 		w->w_tooyoung = false;
2694 
2695 		/* make sure jobs in creation don't clog queue */
2696 		w->w_pri = 0x7fffffff;
2697 		w->w_ctime = 0;
2698 		w->w_mtime = sbuf.st_mtime;
2699 
2700 		/* extract useful information */
2701 		i = NEED_P|NEED_T;
2702 		if (QueueSortOrder == QSO_BYHOST
2703 #if _FFR_RHS
2704 		    || QueueSortOrder == QSO_BYSHUFFLE
2705 #endif /* _FFR_RHS */
2706 		   )
2707 		{
2708 			/* need w_host set for host sort order */
2709 			i |= NEED_H;
2710 		}
2711 		if (QueueLimitSender != NULL)
2712 			i |= NEED_S;
2713 		if (QueueLimitRecipient != NULL)
2714 			i |= NEED_R;
2715 		if (QueueLimitQuarantine != NULL)
2716 			i |= NEED_QUARANTINE;
2717 		while (cf != NULL && i != 0 &&
2718 		       sm_io_fgets(cf, SM_TIME_DEFAULT, lbuf,
2719 				   sizeof lbuf) != NULL)
2720 		{
2721 			int c;
2722 			time_t age;
2723 
2724 			p = strchr(lbuf, '\n');
2725 			if (p != NULL)
2726 				*p = '\0';
2727 			else
2728 			{
2729 				/* flush rest of overly long line */
2730 				while ((c = sm_io_getc(cf, SM_TIME_DEFAULT))
2731 				       != SM_IO_EOF && c != '\n')
2732 					continue;
2733 			}
2734 
2735 			switch (lbuf[0])
2736 			{
2737 			  case 'V':
2738 				qfver = atoi(&lbuf[1]);
2739 				break;
2740 
2741 			  case 'P':
2742 				w->w_pri = atol(&lbuf[1]);
2743 				i &= ~NEED_P;
2744 				break;
2745 
2746 			  case 'T':
2747 				w->w_ctime = atol(&lbuf[1]);
2748 				i &= ~NEED_T;
2749 				break;
2750 
2751 			  case 'q':
2752 				if (QueueMode != QM_QUARANTINE &&
2753 				    QueueMode != QM_LOST)
2754 				{
2755 					if (tTd(41, 49))
2756 						sm_dprintf("%s not marked as quarantined but has a 'q' line\n",
2757 							   w->w_name);
2758 					i |= HAS_QUARANTINE;
2759 				}
2760 				else if (QueueMode == QM_QUARANTINE)
2761 				{
2762 					if (QueueLimitQuarantine == NULL)
2763 					{
2764 						i &= ~NEED_QUARANTINE;
2765 						break;
2766 					}
2767 					p = &lbuf[1];
2768 					check = QueueLimitQuarantine;
2769 					while (check != NULL)
2770 					{
2771 						if (strcontainedin(false,
2772 								   check->queue_match,
2773 								   p) !=
2774 						    check->queue_negate)
2775 							break;
2776 						else
2777 							check = check->queue_next;
2778 					}
2779 					if (check != NULL)
2780 						i &= ~NEED_QUARANTINE;
2781 				}
2782 				break;
2783 
2784 			  case 'R':
2785 				if (w->w_host == NULL &&
2786 				    (p = strrchr(&lbuf[1], '@')) != NULL)
2787 				{
2788 #if _FFR_RHS
2789 					if (QueueSortOrder == QSO_BYSHUFFLE)
2790 						w->w_host = newstr(&p[1]);
2791 					else
2792 #endif /* _FFR_RHS */
2793 						w->w_host = strrev(&p[1]);
2794 					makelower(w->w_host);
2795 					i &= ~NEED_H;
2796 				}
2797 				if (QueueLimitRecipient == NULL)
2798 				{
2799 					i &= ~NEED_R;
2800 					break;
2801 				}
2802 				if (qfver > 0)
2803 				{
2804 					p = strchr(&lbuf[1], ':');
2805 					if (p == NULL)
2806 						p = &lbuf[1];
2807 					else
2808 						++p; /* skip over ':' */
2809 				}
2810 				else
2811 					p = &lbuf[1];
2812 				check = QueueLimitRecipient;
2813 				while (check != NULL)
2814 				{
2815 					if (strcontainedin(true,
2816 							   check->queue_match,
2817 							   p) !=
2818 					    check->queue_negate)
2819 						break;
2820 					else
2821 						check = check->queue_next;
2822 				}
2823 				if (check != NULL)
2824 					i &= ~NEED_R;
2825 				break;
2826 
2827 			  case 'S':
2828 				check = QueueLimitSender;
2829 				while (check != NULL)
2830 				{
2831 					if (strcontainedin(true,
2832 							   check->queue_match,
2833 							   &lbuf[1]) !=
2834 					    check->queue_negate)
2835 						break;
2836 					else
2837 						check = check->queue_next;
2838 				}
2839 				if (check != NULL)
2840 					i &= ~NEED_S;
2841 				break;
2842 
2843 			  case 'K':
2844 				age = curtime() - (time_t) atol(&lbuf[1]);
2845 				if (age >= 0 && MinQueueAge > 0 &&
2846 				    age < MinQueueAge)
2847 					w->w_tooyoung = true;
2848 				break;
2849 
2850 			  case 'N':
2851 				if (atol(&lbuf[1]) == 0)
2852 					w->w_tooyoung = false;
2853 				break;
2854 			}
2855 		}
2856 		if (cf != NULL)
2857 			(void) sm_io_close(cf, SM_TIME_DEFAULT);
2858 
2859 		if ((!doall && (shouldqueue(w->w_pri, w->w_ctime) ||
2860 		    w->w_tooyoung)) ||
2861 		    bitset(HAS_QUARANTINE, i) ||
2862 		    bitset(NEED_QUARANTINE, i) ||
2863 		    bitset(NEED_R|NEED_S, i))
2864 		{
2865 			/* don't even bother sorting this job in */
2866 			if (tTd(41, 49))
2867 				sm_dprintf("skipping %s (%x)\n", w->w_name, i);
2868 			sm_free(w->w_name); /* XXX */
2869 			if (w->w_host != NULL)
2870 				sm_free(w->w_host); /* XXX */
2871 			wn--;
2872 		}
2873 		else
2874 			++num_ent;
2875 	}
2876 	(void) closedir(f);
2877 	wn++;
2878 
2879 	i = wn - WorkListCount;
2880 	WorkListCount += SM_MIN(num_ent, WorkListSize);
2881 
2882 	if (more != NULL)
2883 		*more = WorkListCount < wn;
2884 
2885 	if (full != NULL)
2886 		*full = (wn >= MaxQueueRun && MaxQueueRun > 0) ||
2887 			(WorkList == NULL && wn > 0);
2888 
2889 	return i;
2890 }
2891 /*
2892 **  SORTQ -- sort the work list
2893 **
2894 **	First the old WorkQ is cleared away. Then the WorkList is sorted
2895 **	for all items so that important (higher sorting value) items are not
2896 **	trunctated off. Then the most important items are moved from
2897 **	WorkList to WorkQ. The lower count of 'max' or MaxListCount items
2898 **	are moved.
2899 **
2900 **	Parameters:
2901 **		max -- maximum number of items to be placed in WorkQ
2902 **
2903 **	Returns:
2904 **		the number of items in WorkQ
2905 **
2906 **	Side Effects:
2907 **		WorkQ gets released and filled with new work. WorkList
2908 **		gets released. Work items get sorted in order.
2909 */
2910 
2911 static int
2912 sortq(max)
2913 	int max;
2914 {
2915 	register int i;			/* local counter */
2916 	register WORK *w;		/* tmp item pointer */
2917 	int wc = WorkListCount;		/* trim size for WorkQ */
2918 
2919 	if (WorkQ != NULL)
2920 	{
2921 		WORK *nw;
2922 
2923 		/* Clear out old WorkQ. */
2924 		for (w = WorkQ; w != NULL; w = nw)
2925 		{
2926 			nw = w->w_next;
2927 			sm_free(w->w_name); /* XXX */
2928 			if (w->w_host != NULL)
2929 				sm_free(w->w_host); /* XXX */
2930 			sm_free((char *) w); /* XXX */
2931 		}
2932 		WorkQ = NULL;
2933 	}
2934 
2935 	if (WorkList == NULL || wc <= 0)
2936 		return 0;
2937 
2938 	/*
2939 	**  The sort now takes place using all of the items in WorkList.
2940 	**  The list gets trimmed to the most important items after the sort.
2941 	**  If the trim were to happen before the sort then one or more
2942 	**  important items might get truncated off -- not what we want.
2943 	*/
2944 
2945 	if (QueueSortOrder == QSO_BYHOST)
2946 	{
2947 		/*
2948 		**  Sort the work directory for the first time,
2949 		**  based on host name, lock status, and priority.
2950 		*/
2951 
2952 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf1);
2953 
2954 		/*
2955 		**  If one message to host is locked, "lock" all messages
2956 		**  to that host.
2957 		*/
2958 
2959 		i = 0;
2960 		while (i < wc)
2961 		{
2962 			if (!WorkList[i].w_lock)
2963 			{
2964 				i++;
2965 				continue;
2966 			}
2967 			w = &WorkList[i];
2968 			while (++i < wc)
2969 			{
2970 				if (WorkList[i].w_host == NULL &&
2971 				    w->w_host == NULL)
2972 					WorkList[i].w_lock = true;
2973 				else if (WorkList[i].w_host != NULL &&
2974 					 w->w_host != NULL &&
2975 					 sm_strcasecmp(WorkList[i].w_host,
2976 						       w->w_host) == 0)
2977 					WorkList[i].w_lock = true;
2978 				else
2979 					break;
2980 			}
2981 		}
2982 
2983 		/*
2984 		**  Sort the work directory for the second time,
2985 		**  based on lock status, host name, and priority.
2986 		*/
2987 
2988 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf2);
2989 	}
2990 	else if (QueueSortOrder == QSO_BYTIME)
2991 	{
2992 		/*
2993 		**  Simple sort based on submission time only.
2994 		*/
2995 
2996 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf3);
2997 	}
2998 	else if (QueueSortOrder == QSO_BYFILENAME)
2999 	{
3000 		/*
3001 		**  Sort based on queue filename.
3002 		*/
3003 
3004 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf4);
3005 	}
3006 	else if (QueueSortOrder == QSO_RANDOM)
3007 	{
3008 		/*
3009 		**  Sort randomly.  To avoid problems with an instable sort,
3010 		**  use a random index into the queue file name to start
3011 		**  comparison.
3012 		*/
3013 
3014 		randi = get_rand_mod(MAXQFNAME);
3015 		if (randi < 2)
3016 			randi = 3;
3017 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf5);
3018 	}
3019 	else if (QueueSortOrder == QSO_BYMODTIME)
3020 	{
3021 		/*
3022 		**  Simple sort based on modification time of queue file.
3023 		**  This puts the oldest items first.
3024 		*/
3025 
3026 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf6);
3027 	}
3028 #if _FFR_RHS
3029 	else if (QueueSortOrder == QSO_BYSHUFFLE)
3030 	{
3031 		/*
3032 		**  Simple sort based on shuffled host name.
3033 		*/
3034 
3035 		init_shuffle_alphabet();
3036 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf7);
3037 	}
3038 #endif /* _FFR_RHS */
3039 	else if (QueueSortOrder == QSO_BYPRIORITY)
3040 	{
3041 		/*
3042 		**  Simple sort based on queue priority only.
3043 		*/
3044 
3045 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf0);
3046 	}
3047 	/* else don't sort at all */
3048 
3049 	/* Check if the per queue group item limit will be exceeded */
3050 	if (wc > max && max > 0)
3051 		wc = max;
3052 
3053 	/*
3054 	**  Convert the work list into canonical form.
3055 	**	Should be turning it into a list of envelopes here perhaps.
3056 	**  Only take the most important items up to the per queue group
3057 	**  maximum.
3058 	*/
3059 
3060 	for (i = wc; --i >= 0; )
3061 	{
3062 		w = (WORK *) xalloc(sizeof *w);
3063 		w->w_qgrp = WorkList[i].w_qgrp;
3064 		w->w_qdir = WorkList[i].w_qdir;
3065 		w->w_name = WorkList[i].w_name;
3066 		w->w_host = WorkList[i].w_host;
3067 		w->w_lock = WorkList[i].w_lock;
3068 		w->w_tooyoung = WorkList[i].w_tooyoung;
3069 		w->w_pri = WorkList[i].w_pri;
3070 		w->w_ctime = WorkList[i].w_ctime;
3071 		w->w_mtime = WorkList[i].w_mtime;
3072 		w->w_next = WorkQ;
3073 		WorkQ = w;
3074 	}
3075 
3076 	/* free the rest of the list */
3077 	for (i = WorkListCount; --i >= wc; )
3078 	{
3079 		sm_free(WorkList[i].w_name);
3080 		if (WorkList[i].w_host != NULL)
3081 			sm_free(WorkList[i].w_host);
3082 	}
3083 
3084 	if (WorkList != NULL)
3085 		sm_free(WorkList); /* XXX */
3086 	WorkList = NULL;
3087 	WorkListSize = 0;
3088 	WorkListCount = 0;
3089 
3090 	if (tTd(40, 1))
3091 	{
3092 		for (w = WorkQ; w != NULL; w = w->w_next)
3093 		{
3094 			if (w->w_host != NULL)
3095 				sm_dprintf("%22s: pri=%ld %s\n",
3096 					w->w_name, w->w_pri, w->w_host);
3097 			else
3098 				sm_dprintf("%32s: pri=%ld\n",
3099 					w->w_name, w->w_pri);
3100 		}
3101 	}
3102 
3103 	return wc; /* return number of WorkQ items */
3104 }
3105 /*
3106 **  GROW_WLIST -- make the work list larger
3107 **
3108 **	Parameters:
3109 **		qgrp -- the index for the queue group.
3110 **		qdir -- the index for the queue directory.
3111 **
3112 **	Returns:
3113 **		none.
3114 **
3115 **	Side Effects:
3116 **		Adds another QUEUESEGSIZE entries to WorkList if possible.
3117 **		It can fail if there isn't enough memory, so WorkListSize
3118 **		should be checked again upon return.
3119 */
3120 
3121 static void
3122 grow_wlist(qgrp, qdir)
3123 	int qgrp;
3124 	int qdir;
3125 {
3126 	if (tTd(41, 1))
3127 		sm_dprintf("grow_wlist: WorkListSize=%d\n", WorkListSize);
3128 	if (WorkList == NULL)
3129 	{
3130 		WorkList = (WORK *) xalloc((sizeof *WorkList) *
3131 					   (QUEUESEGSIZE + 1));
3132 		WorkListSize = QUEUESEGSIZE;
3133 	}
3134 	else
3135 	{
3136 		int newsize = WorkListSize + QUEUESEGSIZE;
3137 		WORK *newlist = (WORK *) sm_realloc((char *) WorkList,
3138 					  (unsigned) sizeof(WORK) * (newsize + 1));
3139 
3140 		if (newlist != NULL)
3141 		{
3142 			WorkListSize = newsize;
3143 			WorkList = newlist;
3144 			if (LogLevel > 1)
3145 			{
3146 				sm_syslog(LOG_INFO, NOQID,
3147 					  "grew WorkList for %s to %d",
3148 					  qid_printqueue(qgrp, qdir),
3149 					  WorkListSize);
3150 			}
3151 		}
3152 		else if (LogLevel > 0)
3153 		{
3154 			sm_syslog(LOG_ALERT, NOQID,
3155 				  "FAILED to grow WorkList for %s to %d",
3156 				  qid_printqueue(qgrp, qdir), newsize);
3157 		}
3158 	}
3159 	if (tTd(41, 1))
3160 		sm_dprintf("grow_wlist: WorkListSize now %d\n", WorkListSize);
3161 }
3162 /*
3163 **  WORKCMPF0 -- simple priority-only compare function.
3164 **
3165 **	Parameters:
3166 **		a -- the first argument.
3167 **		b -- the second argument.
3168 **
3169 **	Returns:
3170 **		-1 if a < b
3171 **		 0 if a == b
3172 **		+1 if a > b
3173 **
3174 */
3175 
3176 static int
3177 workcmpf0(a, b)
3178 	register WORK *a;
3179 	register WORK *b;
3180 {
3181 	long pa = a->w_pri;
3182 	long pb = b->w_pri;
3183 
3184 	if (pa == pb)
3185 		return 0;
3186 	else if (pa > pb)
3187 		return 1;
3188 	else
3189 		return -1;
3190 }
3191 /*
3192 **  WORKCMPF1 -- first compare function for ordering work based on host name.
3193 **
3194 **	Sorts on host name, lock status, and priority in that order.
3195 **
3196 **	Parameters:
3197 **		a -- the first argument.
3198 **		b -- the second argument.
3199 **
3200 **	Returns:
3201 **		<0 if a < b
3202 **		 0 if a == b
3203 **		>0 if a > b
3204 **
3205 */
3206 
3207 static int
3208 workcmpf1(a, b)
3209 	register WORK *a;
3210 	register WORK *b;
3211 {
3212 	int i;
3213 
3214 	/* host name */
3215 	if (a->w_host != NULL && b->w_host == NULL)
3216 		return 1;
3217 	else if (a->w_host == NULL && b->w_host != NULL)
3218 		return -1;
3219 	if (a->w_host != NULL && b->w_host != NULL &&
3220 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3221 		return i;
3222 
3223 	/* lock status */
3224 	if (a->w_lock != b->w_lock)
3225 		return b->w_lock - a->w_lock;
3226 
3227 	/* job priority */
3228 	return workcmpf0(a, b);
3229 }
3230 /*
3231 **  WORKCMPF2 -- second compare function for ordering work based on host name.
3232 **
3233 **	Sorts on lock status, host name, and priority in that order.
3234 **
3235 **	Parameters:
3236 **		a -- the first argument.
3237 **		b -- the second argument.
3238 **
3239 **	Returns:
3240 **		<0 if a < b
3241 **		 0 if a == b
3242 **		>0 if a > b
3243 **
3244 */
3245 
3246 static int
3247 workcmpf2(a, b)
3248 	register WORK *a;
3249 	register WORK *b;
3250 {
3251 	int i;
3252 
3253 	/* lock status */
3254 	if (a->w_lock != b->w_lock)
3255 		return a->w_lock - b->w_lock;
3256 
3257 	/* host name */
3258 	if (a->w_host != NULL && b->w_host == NULL)
3259 		return 1;
3260 	else if (a->w_host == NULL && b->w_host != NULL)
3261 		return -1;
3262 	if (a->w_host != NULL && b->w_host != NULL &&
3263 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3264 		return i;
3265 
3266 	/* job priority */
3267 	return workcmpf0(a, b);
3268 }
3269 /*
3270 **  WORKCMPF3 -- simple submission-time-only compare function.
3271 **
3272 **	Parameters:
3273 **		a -- the first argument.
3274 **		b -- the second argument.
3275 **
3276 **	Returns:
3277 **		-1 if a < b
3278 **		 0 if a == b
3279 **		+1 if a > b
3280 **
3281 */
3282 
3283 static int
3284 workcmpf3(a, b)
3285 	register WORK *a;
3286 	register WORK *b;
3287 {
3288 	if (a->w_ctime > b->w_ctime)
3289 		return 1;
3290 	else if (a->w_ctime < b->w_ctime)
3291 		return -1;
3292 	else
3293 		return 0;
3294 }
3295 /*
3296 **  WORKCMPF4 -- compare based on file name
3297 **
3298 **	Parameters:
3299 **		a -- the first argument.
3300 **		b -- the second argument.
3301 **
3302 **	Returns:
3303 **		-1 if a < b
3304 **		 0 if a == b
3305 **		+1 if a > b
3306 **
3307 */
3308 
3309 static int
3310 workcmpf4(a, b)
3311 	register WORK *a;
3312 	register WORK *b;
3313 {
3314 	return strcmp(a->w_name, b->w_name);
3315 }
3316 /*
3317 **  WORKCMPF5 -- compare based on assigned random number
3318 **
3319 **	Parameters:
3320 **		a -- the first argument (ignored).
3321 **		b -- the second argument (ignored).
3322 **
3323 **	Returns:
3324 **		randomly 1/-1
3325 */
3326 
3327 /* ARGSUSED0 */
3328 static int
3329 workcmpf5(a, b)
3330 	register WORK *a;
3331 	register WORK *b;
3332 {
3333 	if (strlen(a->w_name) < randi || strlen(b->w_name) < randi)
3334 		return -1;
3335 	return a->w_name[randi] - b->w_name[randi];
3336 }
3337 /*
3338 **  WORKCMPF6 -- simple modification-time-only compare function.
3339 **
3340 **	Parameters:
3341 **		a -- the first argument.
3342 **		b -- the second argument.
3343 **
3344 **	Returns:
3345 **		-1 if a < b
3346 **		 0 if a == b
3347 **		+1 if a > b
3348 **
3349 */
3350 
3351 static int
3352 workcmpf6(a, b)
3353 	register WORK *a;
3354 	register WORK *b;
3355 {
3356 	if (a->w_mtime > b->w_mtime)
3357 		return 1;
3358 	else if (a->w_mtime < b->w_mtime)
3359 		return -1;
3360 	else
3361 		return 0;
3362 }
3363 #if _FFR_RHS
3364 /*
3365 **  WORKCMPF7 -- compare function for ordering work based on shuffled host name.
3366 **
3367 **	Sorts on lock status, host name, and priority in that order.
3368 **
3369 **	Parameters:
3370 **		a -- the first argument.
3371 **		b -- the second argument.
3372 **
3373 **	Returns:
3374 **		<0 if a < b
3375 **		 0 if a == b
3376 **		>0 if a > b
3377 **
3378 */
3379 
3380 static int
3381 workcmpf7(a, b)
3382 	register WORK *a;
3383 	register WORK *b;
3384 {
3385 	int i;
3386 
3387 	/* lock status */
3388 	if (a->w_lock != b->w_lock)
3389 		return a->w_lock - b->w_lock;
3390 
3391 	/* host name */
3392 	if (a->w_host != NULL && b->w_host == NULL)
3393 		return 1;
3394 	else if (a->w_host == NULL && b->w_host != NULL)
3395 		return -1;
3396 	if (a->w_host != NULL && b->w_host != NULL &&
3397 	    (i = sm_strshufflecmp(a->w_host, b->w_host)) != 0)
3398 		return i;
3399 
3400 	/* job priority */
3401 	return workcmpf0(a, b);
3402 }
3403 #endif /* _FFR_RHS */
3404 /*
3405 **  STRREV -- reverse string
3406 **
3407 **	Returns a pointer to a new string that is the reverse of
3408 **	the string pointed to by fwd.  The space for the new
3409 **	string is obtained using xalloc().
3410 **
3411 **	Parameters:
3412 **		fwd -- the string to reverse.
3413 **
3414 **	Returns:
3415 **		the reversed string.
3416 */
3417 
3418 static char *
3419 strrev(fwd)
3420 	char *fwd;
3421 {
3422 	char *rev = NULL;
3423 	int len, cnt;
3424 
3425 	len = strlen(fwd);
3426 	rev = xalloc(len + 1);
3427 	for (cnt = 0; cnt < len; ++cnt)
3428 		rev[cnt] = fwd[len - cnt - 1];
3429 	rev[len] = '\0';
3430 	return rev;
3431 }
3432 
3433 #if _FFR_RHS
3434 
3435 # define NASCII	128
3436 # define NCHAR	256
3437 
3438 static unsigned char ShuffledAlphabet[NCHAR];
3439 
3440 void
3441 init_shuffle_alphabet()
3442 {
3443 	static bool init = false;
3444 	int i;
3445 
3446 	if (init)
3447 		return;
3448 
3449 	/* fill the ShuffledAlphabet */
3450 	for (i = 0; i < NASCII; i++)
3451 		ShuffledAlphabet[i] = i;
3452 
3453 	/* mix it */
3454 	for (i = 1; i < NASCII; i++)
3455 	{
3456 		register int j = get_random() % NASCII;
3457 		register int tmp;
3458 
3459 		tmp = ShuffledAlphabet[j];
3460 		ShuffledAlphabet[j] = ShuffledAlphabet[i];
3461 		ShuffledAlphabet[i] = tmp;
3462 	}
3463 
3464 	/* make it case insensitive */
3465 	for (i = 'A'; i <= 'Z'; i++)
3466 		ShuffledAlphabet[i] = ShuffledAlphabet[i + 'a' - 'A'];
3467 
3468 	/* fill the upper part */
3469 	for (i = 0; i < NASCII; i++)
3470 		ShuffledAlphabet[i + NASCII] = ShuffledAlphabet[i];
3471 	init = true;
3472 }
3473 
3474 static int
3475 sm_strshufflecmp(a, b)
3476 	char *a;
3477 	char *b;
3478 {
3479 	const unsigned char *us1 = (const unsigned char *) a;
3480 	const unsigned char *us2 = (const unsigned char *) b;
3481 
3482 	while (ShuffledAlphabet[*us1] == ShuffledAlphabet[*us2++])
3483 	{
3484 		if (*us1++ == '\0')
3485 			return 0;
3486 	}
3487 	return (ShuffledAlphabet[*us1] - ShuffledAlphabet[*--us2]);
3488 }
3489 #endif /* _FFR_RHS */
3490 
3491 /*
3492 **  DOWORK -- do a work request.
3493 **
3494 **	Parameters:
3495 **		qgrp -- the index of the queue group for the job.
3496 **		qdir -- the index of the queue directory for the job.
3497 **		id -- the ID of the job to run.
3498 **		forkflag -- if set, run this in background.
3499 **		requeueflag -- if set, reinstantiate the queue quickly.
3500 **			This is used when expanding aliases in the queue.
3501 **			If forkflag is also set, it doesn't wait for the
3502 **			child.
3503 **		e - the envelope in which to run it.
3504 **
3505 **	Returns:
3506 **		process id of process that is running the queue job.
3507 **
3508 **	Side Effects:
3509 **		The work request is satisfied if possible.
3510 */
3511 
3512 pid_t
3513 dowork(qgrp, qdir, id, forkflag, requeueflag, e)
3514 	int qgrp;
3515 	int qdir;
3516 	char *id;
3517 	bool forkflag;
3518 	bool requeueflag;
3519 	register ENVELOPE *e;
3520 {
3521 	register pid_t pid;
3522 	SM_RPOOL_T *rpool;
3523 
3524 	if (tTd(40, 1))
3525 		sm_dprintf("dowork(%s/%s)\n", qid_printqueue(qgrp, qdir), id);
3526 
3527 	/*
3528 	**  Fork for work.
3529 	*/
3530 
3531 	if (forkflag)
3532 	{
3533 		/*
3534 		**  Since the delivery may happen in a child and the
3535 		**  parent does not wait, the parent may close the
3536 		**  maps thereby removing any shared memory used by
3537 		**  the map.  Therefore, close the maps now so the
3538 		**  child will dynamically open them if necessary.
3539 		*/
3540 
3541 		closemaps(false);
3542 
3543 		pid = fork();
3544 		if (pid < 0)
3545 		{
3546 			syserr("dowork: cannot fork");
3547 			return 0;
3548 		}
3549 		else if (pid > 0)
3550 		{
3551 			/* parent -- clean out connection cache */
3552 			mci_flush(false, NULL);
3553 		}
3554 		else
3555 		{
3556 			/*
3557 			**  Initialize exception stack and default exception
3558 			**  handler for child process.
3559 			*/
3560 
3561 			/* Reset global flags */
3562 			RestartRequest = NULL;
3563 			RestartWorkGroup = false;
3564 			ShutdownRequest = NULL;
3565 			PendingSignal = 0;
3566 			CurrentPid = getpid();
3567 			sm_exc_newthread(fatal_error);
3568 
3569 			/*
3570 			**  See note above about SMTP processes and SIGCHLD.
3571 			*/
3572 
3573 			if (OpMode == MD_SMTP ||
3574 			    OpMode == MD_DAEMON ||
3575 			    MaxQueueChildren > 0)
3576 			{
3577 				proc_list_clear();
3578 				sm_releasesignal(SIGCHLD);
3579 				(void) sm_signal(SIGCHLD, SIG_DFL);
3580 			}
3581 
3582 			/* child -- error messages to the transcript */
3583 			QuickAbort = OnlyOneError = false;
3584 		}
3585 	}
3586 	else
3587 	{
3588 		pid = 0;
3589 	}
3590 
3591 	if (pid == 0)
3592 	{
3593 		/*
3594 		**  CHILD
3595 		**	Lock the control file to avoid duplicate deliveries.
3596 		**		Then run the file as though we had just read it.
3597 		**	We save an idea of the temporary name so we
3598 		**		can recover on interrupt.
3599 		*/
3600 
3601 		if (forkflag)
3602 		{
3603 			/* Reset global flags */
3604 			RestartRequest = NULL;
3605 			RestartWorkGroup = false;
3606 			ShutdownRequest = NULL;
3607 			PendingSignal = 0;
3608 		}
3609 
3610 		/* set basic modes, etc. */
3611 		sm_clear_events();
3612 		clearstats();
3613 		rpool = sm_rpool_new_x(NULL);
3614 		clearenvelope(e, false, rpool);
3615 		e->e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3616 		set_delivery_mode(SM_DELIVER, e);
3617 		e->e_errormode = EM_MAIL;
3618 		e->e_id = id;
3619 		e->e_qgrp = qgrp;
3620 		e->e_qdir = qdir;
3621 		GrabTo = UseErrorsTo = false;
3622 		ExitStat = EX_OK;
3623 		if (forkflag)
3624 		{
3625 			disconnect(1, e);
3626 			set_op_mode(MD_QUEUERUN);
3627 		}
3628 		sm_setproctitle(true, e, "%s from queue", qid_printname(e));
3629 		if (LogLevel > 76)
3630 			sm_syslog(LOG_DEBUG, e->e_id, "dowork, pid=%d",
3631 				  (int) CurrentPid);
3632 
3633 		/* don't use the headers from sendmail.cf... */
3634 		e->e_header = NULL;
3635 
3636 		/* read the queue control file -- return if locked */
3637 		if (!readqf(e, false))
3638 		{
3639 			if (tTd(40, 4) && e->e_id != NULL)
3640 				sm_dprintf("readqf(%s) failed\n",
3641 					qid_printname(e));
3642 			e->e_id = NULL;
3643 			if (forkflag)
3644 				finis(false, true, EX_OK);
3645 			else
3646 			{
3647 				/* adding this frees 8 bytes */
3648 				clearenvelope(e, false, rpool);
3649 
3650 				/* adding this frees 12 bytes */
3651 				sm_rpool_free(rpool);
3652 				e->e_rpool = NULL;
3653 				return 0;
3654 			}
3655 		}
3656 
3657 		e->e_flags |= EF_INQUEUE;
3658 		eatheader(e, requeueflag, true);
3659 
3660 		if (requeueflag)
3661 			queueup(e, false, false);
3662 
3663 		/* do the delivery */
3664 		sendall(e, SM_DELIVER);
3665 
3666 		/* finish up and exit */
3667 		if (forkflag)
3668 			finis(true, true, ExitStat);
3669 		else
3670 		{
3671 			dropenvelope(e, true, false);
3672 			sm_rpool_free(rpool);
3673 			e->e_rpool = NULL;
3674 		}
3675 	}
3676 	e->e_id = NULL;
3677 	return pid;
3678 }
3679 
3680 /*
3681 **  DOWORKLIST -- process a list of envelopes as work requests
3682 **
3683 **	Similar to dowork(), except that after forking, it processes an
3684 **	envelope and its siblings, treating each envelope as a work request.
3685 **
3686 **	Parameters:
3687 **		el -- envelope to be processed including its siblings.
3688 **		forkflag -- if set, run this in background.
3689 **		requeueflag -- if set, reinstantiate the queue quickly.
3690 **			This is used when expanding aliases in the queue.
3691 **			If forkflag is also set, it doesn't wait for the
3692 **			child.
3693 **
3694 **	Returns:
3695 **		process id of process that is running the queue job.
3696 **
3697 **	Side Effects:
3698 **		The work request is satisfied if possible.
3699 */
3700 
3701 pid_t
3702 doworklist(el, forkflag, requeueflag)
3703 	ENVELOPE *el;
3704 	bool forkflag;
3705 	bool requeueflag;
3706 {
3707 	register pid_t pid;
3708 	ENVELOPE *ei;
3709 
3710 	if (tTd(40, 1))
3711 		sm_dprintf("doworklist()\n");
3712 
3713 	/*
3714 	**  Fork for work.
3715 	*/
3716 
3717 	if (forkflag)
3718 	{
3719 		/*
3720 		**  Since the delivery may happen in a child and the
3721 		**  parent does not wait, the parent may close the
3722 		**  maps thereby removing any shared memory used by
3723 		**  the map.  Therefore, close the maps now so the
3724 		**  child will dynamically open them if necessary.
3725 		*/
3726 
3727 		closemaps(false);
3728 
3729 		pid = fork();
3730 		if (pid < 0)
3731 		{
3732 			syserr("doworklist: cannot fork");
3733 			return 0;
3734 		}
3735 		else if (pid > 0)
3736 		{
3737 			/* parent -- clean out connection cache */
3738 			mci_flush(false, NULL);
3739 		}
3740 		else
3741 		{
3742 			/*
3743 			**  Initialize exception stack and default exception
3744 			**  handler for child process.
3745 			*/
3746 
3747 			/* Reset global flags */
3748 			RestartRequest = NULL;
3749 			RestartWorkGroup = false;
3750 			ShutdownRequest = NULL;
3751 			PendingSignal = 0;
3752 			CurrentPid = getpid();
3753 			sm_exc_newthread(fatal_error);
3754 
3755 			/*
3756 			**  See note above about SMTP processes and SIGCHLD.
3757 			*/
3758 
3759 			if (OpMode == MD_SMTP ||
3760 			    OpMode == MD_DAEMON ||
3761 			    MaxQueueChildren > 0)
3762 			{
3763 				proc_list_clear();
3764 				sm_releasesignal(SIGCHLD);
3765 				(void) sm_signal(SIGCHLD, SIG_DFL);
3766 			}
3767 
3768 			/* child -- error messages to the transcript */
3769 			QuickAbort = OnlyOneError = false;
3770 		}
3771 	}
3772 	else
3773 	{
3774 		pid = 0;
3775 	}
3776 
3777 	if (pid != 0)
3778 		return pid;
3779 
3780 	/*
3781 	**  IN CHILD
3782 	**	Lock the control file to avoid duplicate deliveries.
3783 	**		Then run the file as though we had just read it.
3784 	**	We save an idea of the temporary name so we
3785 	**		can recover on interrupt.
3786 	*/
3787 
3788 	if (forkflag)
3789 	{
3790 		/* Reset global flags */
3791 		RestartRequest = NULL;
3792 		RestartWorkGroup = false;
3793 		ShutdownRequest = NULL;
3794 		PendingSignal = 0;
3795 	}
3796 
3797 	/* set basic modes, etc. */
3798 	sm_clear_events();
3799 	clearstats();
3800 	GrabTo = UseErrorsTo = false;
3801 	ExitStat = EX_OK;
3802 	if (forkflag)
3803 	{
3804 		disconnect(1, el);
3805 		set_op_mode(MD_QUEUERUN);
3806 	}
3807 	if (LogLevel > 76)
3808 		sm_syslog(LOG_DEBUG, el->e_id, "doworklist, pid=%d",
3809 			  (int) CurrentPid);
3810 
3811 	for (ei = el; ei != NULL; ei = ei->e_sibling)
3812 	{
3813 		ENVELOPE e;
3814 		SM_RPOOL_T *rpool;
3815 
3816 		if (WILL_BE_QUEUED(ei->e_sendmode))
3817 			continue;
3818 		else if (QueueMode != QM_QUARANTINE &&
3819 			 ei->e_quarmsg != NULL)
3820 			continue;
3821 
3822 		rpool = sm_rpool_new_x(NULL);
3823 		clearenvelope(&e, true, rpool);
3824 		e.e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3825 		set_delivery_mode(SM_DELIVER, &e);
3826 		e.e_errormode = EM_MAIL;
3827 		e.e_id = ei->e_id;
3828 		e.e_qgrp = ei->e_qgrp;
3829 		e.e_qdir = ei->e_qdir;
3830 		openxscript(&e);
3831 		sm_setproctitle(true, &e, "%s from queue", qid_printname(&e));
3832 
3833 		/* don't use the headers from sendmail.cf... */
3834 		e.e_header = NULL;
3835 		CurEnv = &e;
3836 
3837 		/* read the queue control file -- return if locked */
3838 		if (readqf(&e, false))
3839 		{
3840 			e.e_flags |= EF_INQUEUE;
3841 			eatheader(&e, requeueflag, true);
3842 
3843 			if (requeueflag)
3844 				queueup(&e, false, false);
3845 
3846 			/* do the delivery */
3847 			sendall(&e, SM_DELIVER);
3848 			dropenvelope(&e, true, false);
3849 		}
3850 		else
3851 		{
3852 			if (tTd(40, 4) && e.e_id != NULL)
3853 				sm_dprintf("readqf(%s) failed\n",
3854 					qid_printname(&e));
3855 		}
3856 		sm_rpool_free(rpool);
3857 		ei->e_id = NULL;
3858 	}
3859 
3860 	/* restore CurEnv */
3861 	CurEnv = el;
3862 
3863 	/* finish up and exit */
3864 	if (forkflag)
3865 		finis(true, true, ExitStat);
3866 	return 0;
3867 }
3868 /*
3869 **  READQF -- read queue file and set up environment.
3870 **
3871 **	Parameters:
3872 **		e -- the envelope of the job to run.
3873 **		openonly -- only open the qf (returned as e_lockfp)
3874 **
3875 **	Returns:
3876 **		true if it successfully read the queue file.
3877 **		false otherwise.
3878 **
3879 **	Side Effects:
3880 **		The queue file is returned locked.
3881 */
3882 
3883 static bool
3884 readqf(e, openonly)
3885 	register ENVELOPE *e;
3886 	bool openonly;
3887 {
3888 	register SM_FILE_T *qfp;
3889 	ADDRESS *ctladdr;
3890 	struct stat st, stf;
3891 	char *bp;
3892 	int qfver = 0;
3893 	long hdrsize = 0;
3894 	register char *p;
3895 	char *frcpt = NULL;
3896 	char *orcpt = NULL;
3897 	bool nomore = false;
3898 	bool bogus = false;
3899 	MODE_T qsafe;
3900 	char *err;
3901 	char qf[MAXPATHLEN];
3902 	char buf[MAXLINE];
3903 
3904 	/*
3905 	**  Read and process the file.
3906 	*/
3907 
3908 	bp = NULL;
3909 	(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER), sizeof qf);
3910 	qfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDWR_B, NULL);
3911 	if (qfp == NULL)
3912 	{
3913 		int save_errno = errno;
3914 
3915 		if (tTd(40, 8))
3916 			sm_dprintf("readqf(%s): sm_io_open failure (%s)\n",
3917 				qf, sm_errstring(errno));
3918 		errno = save_errno;
3919 		if (errno != ENOENT
3920 		    )
3921 			syserr("readqf: no control file %s", qf);
3922 		RELEASE_QUEUE;
3923 		return false;
3924 	}
3925 
3926 	if (!lockfile(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), qf, NULL,
3927 		      LOCK_EX|LOCK_NB))
3928 	{
3929 		/* being processed by another queuer */
3930 		if (Verbose)
3931 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3932 					     "%s: locked\n", e->e_id);
3933 		if (tTd(40, 8))
3934 			sm_dprintf("%s: locked\n", e->e_id);
3935 		if (LogLevel > 19)
3936 			sm_syslog(LOG_DEBUG, e->e_id, "locked");
3937 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3938 		RELEASE_QUEUE;
3939 		return false;
3940 	}
3941 
3942 	RELEASE_QUEUE;
3943 
3944 	/*
3945 	**  Prevent locking race condition.
3946 	**
3947 	**  Process A: readqf(): qfp = fopen(qffile)
3948 	**  Process B: queueup(): rename(tf, qf)
3949 	**  Process B: unlocks(tf)
3950 	**  Process A: lockfile(qf);
3951 	**
3952 	**  Process A (us) has the old qf file (before the rename deleted
3953 	**  the directory entry) and will be delivering based on old data.
3954 	**  This can lead to multiple deliveries of the same recipients.
3955 	**
3956 	**  Catch this by checking if the underlying qf file has changed
3957 	**  *after* acquiring our lock and if so, act as though the file
3958 	**  was still locked (i.e., just return like the lockfile() case
3959 	**  above.
3960 	*/
3961 
3962 	if (stat(qf, &stf) < 0 ||
3963 	    fstat(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), &st) < 0)
3964 	{
3965 		/* must have been being processed by someone else */
3966 		if (tTd(40, 8))
3967 			sm_dprintf("readqf(%s): [f]stat failure (%s)\n",
3968 				qf, sm_errstring(errno));
3969 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3970 		return false;
3971 	}
3972 
3973 	if (st.st_nlink != stf.st_nlink ||
3974 	    st.st_dev != stf.st_dev ||
3975 	    ST_INODE(st) != ST_INODE(stf) ||
3976 #if HAS_ST_GEN && 0		/* AFS returns garbage in st_gen */
3977 	    st.st_gen != stf.st_gen ||
3978 #endif /* HAS_ST_GEN && 0 */
3979 	    st.st_uid != stf.st_uid ||
3980 	    st.st_gid != stf.st_gid ||
3981 	    st.st_size != stf.st_size)
3982 	{
3983 		/* changed after opened */
3984 		if (Verbose)
3985 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3986 					     "%s: changed\n", e->e_id);
3987 		if (tTd(40, 8))
3988 			sm_dprintf("%s: changed\n", e->e_id);
3989 		if (LogLevel > 19)
3990 			sm_syslog(LOG_DEBUG, e->e_id, "changed");
3991 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3992 		return false;
3993 	}
3994 
3995 	/*
3996 	**  Check the queue file for plausibility to avoid attacks.
3997 	*/
3998 
3999 	qsafe = S_IWOTH|S_IWGRP;
4000 	if (bitset(S_IWGRP, QueueFileMode))
4001 		qsafe &= ~S_IWGRP;
4002 
4003 	bogus = st.st_uid != geteuid() &&
4004 		st.st_uid != TrustedUid &&
4005 		geteuid() != RealUid;
4006 
4007 	/*
4008 	**  If this qf file results from a set-group-ID binary, then
4009 	**  we check whether the directory is group-writable,
4010 	**  the queue file mode contains the group-writable bit, and
4011 	**  the groups are the same.
4012 	**  Notice: this requires that the set-group-ID binary is used to
4013 	**  run the queue!
4014 	*/
4015 
4016 	if (bogus && st.st_gid == getegid() && UseMSP)
4017 	{
4018 		char delim;
4019 		struct stat dst;
4020 
4021 		bp = SM_LAST_DIR_DELIM(qf);
4022 		if (bp == NULL)
4023 			delim = '\0';
4024 		else
4025 		{
4026 			delim = *bp;
4027 			*bp = '\0';
4028 		}
4029 		if (stat(delim == '\0' ? "." : qf, &dst) < 0)
4030 			syserr("readqf: cannot stat directory %s",
4031 				delim == '\0' ? "." : qf);
4032 		else
4033 		{
4034 			bogus = !(bitset(S_IWGRP, QueueFileMode) &&
4035 				  bitset(S_IWGRP, dst.st_mode) &&
4036 				  dst.st_gid == st.st_gid);
4037 		}
4038 		if (delim != '\0')
4039 			*bp = delim;
4040 		bp = NULL;
4041 	}
4042 	if (!bogus)
4043 		bogus = bitset(qsafe, st.st_mode);
4044 	if (bogus)
4045 	{
4046 		if (LogLevel > 0)
4047 		{
4048 			sm_syslog(LOG_ALERT, e->e_id,
4049 				  "bogus queue file, uid=%d, gid=%d, mode=%o",
4050 				  st.st_uid, st.st_gid, st.st_mode);
4051 		}
4052 		if (tTd(40, 8))
4053 			sm_dprintf("readqf(%s): bogus file\n", qf);
4054 		e->e_flags |= EF_INQUEUE;
4055 		if (!openonly)
4056 			loseqfile(e, "bogus file uid/gid in mqueue");
4057 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4058 		return false;
4059 	}
4060 
4061 	if (st.st_size == 0)
4062 	{
4063 		/* must be a bogus file -- if also old, just remove it */
4064 		if (!openonly && st.st_ctime + 10 * 60 < curtime())
4065 		{
4066 			(void) xunlink(queuename(e, DATAFL_LETTER));
4067 			(void) xunlink(queuename(e, ANYQFL_LETTER));
4068 		}
4069 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4070 		return false;
4071 	}
4072 
4073 	if (st.st_nlink == 0)
4074 	{
4075 		/*
4076 		**  Race condition -- we got a file just as it was being
4077 		**  unlinked.  Just assume it is zero length.
4078 		*/
4079 
4080 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4081 		return false;
4082 	}
4083 
4084 #if _FFR_TRUSTED_QF
4085 	/*
4086 	**  If we don't own the file mark it as unsafe.
4087 	**  However, allow TrustedUser to own it as well
4088 	**  in case TrustedUser manipulates the queue.
4089 	*/
4090 
4091 	if (st.st_uid != geteuid() && st.st_uid != TrustedUid)
4092 		e->e_flags |= EF_UNSAFE;
4093 #else /* _FFR_TRUSTED_QF */
4094 	/* If we don't own the file mark it as unsafe */
4095 	if (st.st_uid != geteuid())
4096 		e->e_flags |= EF_UNSAFE;
4097 #endif /* _FFR_TRUSTED_QF */
4098 
4099 	/* good file -- save this lock */
4100 	e->e_lockfp = qfp;
4101 
4102 	/* Just wanted the open file */
4103 	if (openonly)
4104 		return true;
4105 
4106 	/* do basic system initialization */
4107 	initsys(e);
4108 	macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
4109 
4110 	LineNumber = 0;
4111 	e->e_flags |= EF_GLOBALERRS;
4112 	set_op_mode(MD_QUEUERUN);
4113 	ctladdr = NULL;
4114 	e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
4115 	e->e_dfqgrp = e->e_qgrp;
4116 	e->e_dfqdir = e->e_qdir;
4117 #if _FFR_QUEUE_MACRO
4118 	macdefine(&e->e_macro, A_TEMP, macid("{queue}"),
4119 		  qid_printqueue(e->e_qgrp, e->e_qdir));
4120 #endif /* _FFR_QUEUE_MACRO */
4121 	e->e_dfino = -1;
4122 	e->e_msgsize = -1;
4123 	while ((bp = fgetfolded(buf, sizeof buf, qfp)) != NULL)
4124 	{
4125 		unsigned long qflags;
4126 		ADDRESS *q;
4127 		int r;
4128 		time_t now;
4129 		auto char *ep;
4130 
4131 		if (tTd(40, 4))
4132 			sm_dprintf("+++++ %s\n", bp);
4133 		if (nomore)
4134 		{
4135 			/* hack attack */
4136   hackattack:
4137 			syserr("SECURITY ALERT: extra or bogus data in queue file: %s",
4138 			       bp);
4139 			err = "bogus queue line";
4140 			goto fail;
4141 		}
4142 		switch (bp[0])
4143 		{
4144 		  case 'A':		/* AUTH= parameter */
4145 			if (!xtextok(&bp[1]))
4146 				goto hackattack;
4147 			e->e_auth_param = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4148 			break;
4149 
4150 		  case 'B':		/* body type */
4151 			r = check_bodytype(&bp[1]);
4152 			if (!BODYTYPE_VALID(r))
4153 				goto hackattack;
4154 			e->e_bodytype = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4155 			break;
4156 
4157 		  case 'C':		/* specify controlling user */
4158 			ctladdr = setctluser(&bp[1], qfver, e);
4159 			break;
4160 
4161 		  case 'D':		/* data file name */
4162 			/* obsolete -- ignore */
4163 			break;
4164 
4165 		  case 'd':		/* data file directory name */
4166 			{
4167 				int qgrp, qdir;
4168 
4169 #if _FFR_MSP_PARANOIA
4170 				/* forbid queue groups in MSP? */
4171 				if (UseMSP)
4172 					goto hackattack;
4173 #endif /* _FFR_MSP_PARANOIA */
4174 				for (qgrp = 0;
4175 				     qgrp < NumQueue && Queue[qgrp] != NULL;
4176 				     ++qgrp)
4177 				{
4178 					for (qdir = 0;
4179 					     qdir < Queue[qgrp]->qg_numqueues;
4180 					     ++qdir)
4181 					{
4182 						if (strcmp(&bp[1],
4183 							   Queue[qgrp]->qg_qpaths[qdir].qp_name)
4184 						    == 0)
4185 						{
4186 							e->e_dfqgrp = qgrp;
4187 							e->e_dfqdir = qdir;
4188 							goto done;
4189 						}
4190 					}
4191 				}
4192 				err = "bogus queue file directory";
4193 				goto fail;
4194 			  done:
4195 				break;
4196 			}
4197 
4198 		  case 'E':		/* specify error recipient */
4199 			/* no longer used */
4200 			break;
4201 
4202 		  case 'F':		/* flag bits */
4203 			if (strncmp(bp, "From ", 5) == 0)
4204 			{
4205 				/* we are being spoofed! */
4206 				syserr("SECURITY ALERT: bogus qf line %s", bp);
4207 				err = "bogus queue line";
4208 				goto fail;
4209 			}
4210 			for (p = &bp[1]; *p != '\0'; p++)
4211 			{
4212 				switch (*p)
4213 				{
4214 				  case '8':	/* has 8 bit data */
4215 					e->e_flags |= EF_HAS8BIT;
4216 					break;
4217 
4218 				  case 'b':	/* delete Bcc: header */
4219 					e->e_flags |= EF_DELETE_BCC;
4220 					break;
4221 
4222 				  case 'd':	/* envelope has DSN RET= */
4223 					e->e_flags |= EF_RET_PARAM;
4224 					break;
4225 
4226 				  case 'n':	/* don't return body */
4227 					e->e_flags |= EF_NO_BODY_RETN;
4228 					break;
4229 
4230 				  case 'r':	/* response */
4231 					e->e_flags |= EF_RESPONSE;
4232 					break;
4233 
4234 				  case 's':	/* split */
4235 					e->e_flags |= EF_SPLIT;
4236 					break;
4237 
4238 				  case 'w':	/* warning sent */
4239 					e->e_flags |= EF_WARNING;
4240 					break;
4241 				}
4242 			}
4243 			break;
4244 
4245 		  case 'q':		/* quarantine reason */
4246 			e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4247 			macdefine(&e->e_macro, A_PERM,
4248 				  macid("{quarantine}"), e->e_quarmsg);
4249 			break;
4250 
4251 		  case 'H':		/* header */
4252 
4253 			/*
4254 			**  count size before chompheader() destroys the line.
4255 			**  this isn't accurate due to macro expansion, but
4256 			**  better than before. "-3" to skip H?? at least.
4257 			*/
4258 
4259 			hdrsize += strlen(bp) - 3;
4260 			(void) chompheader(&bp[1], CHHDR_QUEUE, NULL, e);
4261 			break;
4262 
4263 		  case 'I':		/* data file's inode number */
4264 			/* regenerated below */
4265 			break;
4266 
4267 		  case 'K':		/* time of last delivery attempt */
4268 			e->e_dtime = atol(&buf[1]);
4269 			break;
4270 
4271 		  case 'L':		/* Solaris Content-Length: */
4272 		  case 'M':		/* message */
4273 			/* ignore this; we want a new message next time */
4274 			break;
4275 
4276 		  case 'N':		/* number of delivery attempts */
4277 			e->e_ntries = atoi(&buf[1]);
4278 
4279 			/* if this has been tried recently, let it be */
4280 			now = curtime();
4281 			if (e->e_ntries > 0 && e->e_dtime <= now &&
4282 			    now < e->e_dtime + MinQueueAge)
4283 			{
4284 				char *howlong;
4285 
4286 				howlong = pintvl(now - e->e_dtime, true);
4287 				if (Verbose)
4288 					(void) sm_io_fprintf(smioout,
4289 							     SM_TIME_DEFAULT,
4290 							     "%s: too young (%s)\n",
4291 							     e->e_id, howlong);
4292 				if (tTd(40, 8))
4293 					sm_dprintf("%s: too young (%s)\n",
4294 						e->e_id, howlong);
4295 				if (LogLevel > 19)
4296 					sm_syslog(LOG_DEBUG, e->e_id,
4297 						  "too young (%s)",
4298 						  howlong);
4299 				e->e_id = NULL;
4300 				unlockqueue(e);
4301 				return false;
4302 			}
4303 			macdefine(&e->e_macro, A_TEMP,
4304 				macid("{ntries}"), &buf[1]);
4305 
4306 #if NAMED_BIND
4307 			/* adjust BIND parameters immediately */
4308 			if (e->e_ntries == 0)
4309 			{
4310 				_res.retry = TimeOuts.res_retry[RES_TO_FIRST];
4311 				_res.retrans = TimeOuts.res_retrans[RES_TO_FIRST];
4312 			}
4313 			else
4314 			{
4315 				_res.retry = TimeOuts.res_retry[RES_TO_NORMAL];
4316 				_res.retrans = TimeOuts.res_retrans[RES_TO_NORMAL];
4317 			}
4318 #endif /* NAMED_BIND */
4319 			break;
4320 
4321 		  case 'P':		/* message priority */
4322 			e->e_msgpriority = atol(&bp[1]) + WkTimeFact;
4323 			break;
4324 
4325 		  case 'Q':		/* original recipient */
4326 			orcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4327 			break;
4328 
4329 		  case 'r':		/* final recipient */
4330 			frcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4331 			break;
4332 
4333 		  case 'R':		/* specify recipient */
4334 			p = bp;
4335 			qflags = 0;
4336 			if (qfver >= 1)
4337 			{
4338 				/* get flag bits */
4339 				while (*++p != '\0' && *p != ':')
4340 				{
4341 					switch (*p)
4342 					{
4343 					  case 'N':
4344 						qflags |= QHASNOTIFY;
4345 						break;
4346 
4347 					  case 'S':
4348 						qflags |= QPINGONSUCCESS;
4349 						break;
4350 
4351 					  case 'F':
4352 						qflags |= QPINGONFAILURE;
4353 						break;
4354 
4355 					  case 'D':
4356 						qflags |= QPINGONDELAY;
4357 						break;
4358 
4359 					  case 'P':
4360 						qflags |= QPRIMARY;
4361 						break;
4362 
4363 					  case 'A':
4364 						if (ctladdr != NULL)
4365 							ctladdr->q_flags |= QALIAS;
4366 						break;
4367 
4368 					  default: /* ignore or complain? */
4369 						break;
4370 					}
4371 				}
4372 			}
4373 			else
4374 				qflags |= QPRIMARY;
4375 			macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4376 				"e r");
4377 			if (*p != '\0')
4378 				q = parseaddr(++p, NULLADDR, RF_COPYALL, '\0',
4379 						NULL, e, true);
4380 			else
4381 				q = NULL;
4382 			if (q != NULL)
4383 			{
4384 				/* make sure we keep the current qgrp */
4385 				if (ISVALIDQGRP(e->e_qgrp))
4386 					q->q_qgrp = e->e_qgrp;
4387 				q->q_alias = ctladdr;
4388 				if (qfver >= 1)
4389 					q->q_flags &= ~Q_PINGFLAGS;
4390 				q->q_flags |= qflags;
4391 				q->q_finalrcpt = frcpt;
4392 				q->q_orcpt = orcpt;
4393 				(void) recipient(q, &e->e_sendqueue, 0, e);
4394 			}
4395 			frcpt = NULL;
4396 			orcpt = NULL;
4397 			macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4398 				NULL);
4399 			break;
4400 
4401 		  case 'S':		/* sender */
4402 			setsender(sm_rpool_strdup_x(e->e_rpool, &bp[1]),
4403 				  e, NULL, '\0', true);
4404 			break;
4405 
4406 		  case 'T':		/* init time */
4407 			e->e_ctime = atol(&bp[1]);
4408 			break;
4409 
4410 		  case 'V':		/* queue file version number */
4411 			qfver = atoi(&bp[1]);
4412 			if (qfver <= QF_VERSION)
4413 				break;
4414 			syserr("Version number in queue file (%d) greater than max (%d)",
4415 				qfver, QF_VERSION);
4416 			err = "unsupported queue file version";
4417 			goto fail;
4418 			/* NOTREACHED */
4419 			break;
4420 
4421 		  case 'Z':		/* original envelope id from ESMTP */
4422 			e->e_envid = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4423 			macdefine(&e->e_macro, A_PERM,
4424 				macid("{dsn_envid}"), e->e_envid);
4425 			break;
4426 
4427 		  case '!':		/* deliver by */
4428 
4429 			/* format: flag (1 char) space long-integer */
4430 			e->e_dlvr_flag = buf[1];
4431 			e->e_deliver_by = strtol(&buf[3], NULL, 10);
4432 
4433 		  case '$':		/* define macro */
4434 			{
4435 				char *p;
4436 
4437 				/* XXX elimate p? */
4438 				r = macid_parse(&bp[1], &ep);
4439 				if (r == 0)
4440 					break;
4441 				p = sm_rpool_strdup_x(e->e_rpool, ep);
4442 				macdefine(&e->e_macro, A_PERM, r, p);
4443 			}
4444 			break;
4445 
4446 		  case '.':		/* terminate file */
4447 			nomore = true;
4448 			break;
4449 
4450 #if _FFR_QUEUEDELAY
4451 		  case 'G':
4452 		  case 'Y':
4453 
4454 			/*
4455 			**  Maintain backward compatibility for
4456 			**  users who defined _FFR_QUEUEDELAY in
4457 			**  previous releases.  Remove this
4458 			**  code in 8.14 or 8.15.
4459 			*/
4460 
4461 			if (qfver == 5 || qfver == 7)
4462 				break;
4463 
4464 			/* If not qfver 5 or 7, then 'G' or 'Y' is invalid */
4465 			/* FALLTHROUGH */
4466 #endif /* _FFR_QUEUEDELAY */
4467 
4468 		  default:
4469 			syserr("readqf: %s: line %d: bad line \"%s\"",
4470 				qf, LineNumber, shortenstring(bp, MAXSHORTSTR));
4471 			err = "unrecognized line";
4472 			goto fail;
4473 		}
4474 
4475 		if (bp != buf)
4476 		{
4477 			sm_free(bp); /* XXX */
4478 			bp = NULL;
4479 		}
4480 	}
4481 
4482 	/*
4483 	**  If we haven't read any lines, this queue file is empty.
4484 	**  Arrange to remove it without referencing any null pointers.
4485 	*/
4486 
4487 	if (LineNumber == 0)
4488 	{
4489 		errno = 0;
4490 		e->e_flags |= EF_CLRQUEUE|EF_FATALERRS|EF_RESPONSE;
4491 		return true;
4492 	}
4493 
4494 	/* Check to make sure we have a complete queue file read */
4495 	if (!nomore)
4496 	{
4497 		syserr("readqf: %s: incomplete queue file read", qf);
4498 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4499 		return false;
4500 	}
4501 
4502 	/* possibly set ${dsn_ret} macro */
4503 	if (bitset(EF_RET_PARAM, e->e_flags))
4504 	{
4505 		if (bitset(EF_NO_BODY_RETN, e->e_flags))
4506 			macdefine(&e->e_macro, A_PERM,
4507 				macid("{dsn_ret}"), "hdrs");
4508 		else
4509 			macdefine(&e->e_macro, A_PERM,
4510 				macid("{dsn_ret}"), "full");
4511 	}
4512 
4513 	/*
4514 	**  Arrange to read the data file.
4515 	*/
4516 
4517 	p = queuename(e, DATAFL_LETTER);
4518 	e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, p, SM_IO_RDONLY_B,
4519 			      NULL);
4520 	if (e->e_dfp == NULL)
4521 	{
4522 		syserr("readqf: cannot open %s", p);
4523 	}
4524 	else
4525 	{
4526 		e->e_flags |= EF_HAS_DF;
4527 		if (fstat(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD, NULL), &st)
4528 		    >= 0)
4529 		{
4530 			e->e_msgsize = st.st_size + hdrsize;
4531 			e->e_dfdev = st.st_dev;
4532 			e->e_dfino = ST_INODE(st);
4533 			(void) sm_snprintf(buf, sizeof buf, "%ld",
4534 					   e->e_msgsize);
4535 			macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"),
4536 				  buf);
4537 		}
4538 	}
4539 
4540 	return true;
4541 
4542   fail:
4543 	/*
4544 	**  There was some error reading the qf file (reason is in err var.)
4545 	**  Cleanup:
4546 	**	close file; clear e_lockfp since it is the same as qfp,
4547 	**	hence it is invalid (as file) after qfp is closed;
4548 	**	the qf file is on disk, so set the flag to avoid calling
4549 	**	queueup() with bogus data.
4550 	*/
4551 
4552 	if (bp != NULL && bp != buf)
4553 	{
4554 		sm_free(bp); /* XXX */
4555 		bp = NULL;
4556 	}
4557 	if (qfp != NULL)
4558 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4559 	e->e_lockfp = NULL;
4560 	e->e_flags |= EF_INQUEUE;
4561 	loseqfile(e, err);
4562 	return false;
4563 }
4564 /*
4565 **  PRTSTR -- print a string, "unprintable" characters are shown as \oct
4566 **
4567 **	Parameters:
4568 **		s -- string to print
4569 **		ml -- maximum length of output
4570 **
4571 **	Returns:
4572 **		number of entries
4573 **
4574 **	Side Effects:
4575 **		Prints a string on stdout.
4576 */
4577 
4578 static void
4579 prtstr(s, ml)
4580 	char *s;
4581 	int ml;
4582 {
4583 	int c;
4584 
4585 	if (s == NULL)
4586 		return;
4587 	while (ml-- > 0 && ((c = *s++) != '\0'))
4588 	{
4589 		if (c == '\\')
4590 		{
4591 			if (ml-- > 0)
4592 			{
4593 				(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4594 				(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4595 			}
4596 		}
4597 		else if (isascii(c) && isprint(c))
4598 			(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4599 		else
4600 		{
4601 			if ((ml -= 3) > 0)
4602 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4603 						     "\\%03o", c & 0xFF);
4604 		}
4605 	}
4606 }
4607 /*
4608 **  PRINTNQE -- print out number of entries in the mail queue
4609 **
4610 **	Parameters:
4611 **		out -- output file pointer.
4612 **		prefix -- string to output in front of each line.
4613 **
4614 **	Returns:
4615 **		none.
4616 */
4617 
4618 void
4619 printnqe(out, prefix)
4620 	SM_FILE_T *out;
4621 	char *prefix;
4622 {
4623 #if SM_CONF_SHM
4624 	int i, k = 0, nrequests = 0;
4625 	bool unknown = false;
4626 
4627 	if (ShmId == SM_SHM_NO_ID)
4628 	{
4629 		if (prefix == NULL)
4630 			(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4631 					"Data unavailable: shared memory not updated\n");
4632 		else
4633 			(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4634 					"%sNOTCONFIGURED:-1\r\n", prefix);
4635 		return;
4636 	}
4637 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4638 	{
4639 		int j;
4640 
4641 		k++;
4642 		for (j = 0; j < Queue[i]->qg_numqueues; j++)
4643 		{
4644 			int n;
4645 
4646 			if (StopRequest)
4647 				stop_sendmail();
4648 
4649 			n = QSHM_ENTRIES(Queue[i]->qg_qpaths[j].qp_idx);
4650 			if (prefix != NULL)
4651 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4652 					"%s%s:%d\r\n",
4653 					prefix, qid_printqueue(i, j), n);
4654 			else if (n < 0)
4655 			{
4656 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4657 					"%s: unknown number of entries\n",
4658 					qid_printqueue(i, j));
4659 				unknown = true;
4660 			}
4661 			else if (n == 0)
4662 			{
4663 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4664 					"%s is empty\n",
4665 					qid_printqueue(i, j));
4666 			}
4667 			else if (n > 0)
4668 			{
4669 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4670 					"%s: entries=%d\n",
4671 					qid_printqueue(i, j), n);
4672 				nrequests += n;
4673 				k++;
4674 			}
4675 		}
4676 	}
4677 	if (prefix == NULL && k > 1)
4678 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4679 				     "\t\tTotal requests: %d%s\n",
4680 				     nrequests, unknown ? " (about)" : "");
4681 #else /* SM_CONF_SHM */
4682 	if (prefix == NULL)
4683 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4684 			     "Data unavailable without shared memory support\n");
4685 	else
4686 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4687 			     "%sNOTAVAILABLE:-1\r\n", prefix);
4688 #endif /* SM_CONF_SHM */
4689 }
4690 /*
4691 **  PRINTQUEUE -- print out a representation of the mail queue
4692 **
4693 **	Parameters:
4694 **		none.
4695 **
4696 **	Returns:
4697 **		none.
4698 **
4699 **	Side Effects:
4700 **		Prints a listing of the mail queue on the standard output.
4701 */
4702 
4703 void
4704 printqueue()
4705 {
4706 	int i, k = 0, nrequests = 0;
4707 
4708 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4709 	{
4710 		int j;
4711 
4712 		k++;
4713 		for (j = 0; j < Queue[i]->qg_numqueues; j++)
4714 		{
4715 			if (StopRequest)
4716 				stop_sendmail();
4717 			nrequests += print_single_queue(i, j);
4718 			k++;
4719 		}
4720 	}
4721 	if (k > 1)
4722 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4723 				     "\t\tTotal requests: %d\n",
4724 				     nrequests);
4725 }
4726 /*
4727 **  PRINT_SINGLE_QUEUE -- print out a representation of a single mail queue
4728 **
4729 **	Parameters:
4730 **		qgrp -- the index of the queue group.
4731 **		qdir -- the queue directory.
4732 **
4733 **	Returns:
4734 **		number of requests in mail queue.
4735 **
4736 **	Side Effects:
4737 **		Prints a listing of the mail queue on the standard output.
4738 */
4739 
4740 int
4741 print_single_queue(qgrp, qdir)
4742 	int qgrp;
4743 	int qdir;
4744 {
4745 	register WORK *w;
4746 	SM_FILE_T *f;
4747 	int nrequests;
4748 	char qd[MAXPATHLEN];
4749 	char qddf[MAXPATHLEN];
4750 	char buf[MAXLINE];
4751 
4752 	if (qdir == NOQDIR)
4753 	{
4754 		(void) sm_strlcpy(qd, ".", sizeof qd);
4755 		(void) sm_strlcpy(qddf, ".", sizeof qddf);
4756 	}
4757 	else
4758 	{
4759 		(void) sm_strlcpyn(qd, sizeof qd, 2,
4760 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
4761 			(bitset(QP_SUBQF,
4762 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4763 					? "/qf" : ""));
4764 		(void) sm_strlcpyn(qddf, sizeof qddf, 2,
4765 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
4766 			(bitset(QP_SUBDF,
4767 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4768 					? "/df" : ""));
4769 	}
4770 
4771 	/*
4772 	**  Check for permission to print the queue
4773 	*/
4774 
4775 	if (bitset(PRIV_RESTRICTMAILQ, PrivacyFlags) && RealUid != 0)
4776 	{
4777 		struct stat st;
4778 #ifdef NGROUPS_MAX
4779 		int n;
4780 		extern GIDSET_T InitialGidSet[NGROUPS_MAX];
4781 #endif /* NGROUPS_MAX */
4782 
4783 		if (stat(qd, &st) < 0)
4784 		{
4785 			syserr("Cannot stat %s",
4786 				qid_printqueue(qgrp, qdir));
4787 			return 0;
4788 		}
4789 #ifdef NGROUPS_MAX
4790 		n = NGROUPS_MAX;
4791 		while (--n >= 0)
4792 		{
4793 			if (InitialGidSet[n] == st.st_gid)
4794 				break;
4795 		}
4796 		if (n < 0 && RealGid != st.st_gid)
4797 #else /* NGROUPS_MAX */
4798 		if (RealGid != st.st_gid)
4799 #endif /* NGROUPS_MAX */
4800 		{
4801 			usrerr("510 You are not permitted to see the queue");
4802 			setstat(EX_NOPERM);
4803 			return 0;
4804 		}
4805 	}
4806 
4807 	/*
4808 	**  Read and order the queue.
4809 	*/
4810 
4811 	nrequests = gatherq(qgrp, qdir, true, NULL, NULL);
4812 	(void) sortq(Queue[qgrp]->qg_maxlist);
4813 
4814 	/*
4815 	**  Print the work list that we have read.
4816 	*/
4817 
4818 	/* first see if there is anything */
4819 	if (nrequests <= 0)
4820 	{
4821 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%s is empty\n",
4822 				     qid_printqueue(qgrp, qdir));
4823 		return 0;
4824 	}
4825 
4826 	sm_getla();	/* get load average */
4827 
4828 	(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\t\t%s (%d request%s",
4829 			     qid_printqueue(qgrp, qdir),
4830 			     nrequests, nrequests == 1 ? "" : "s");
4831 	if (MaxQueueRun > 0 && nrequests > MaxQueueRun)
4832 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4833 				     ", only %d printed", MaxQueueRun);
4834 	if (Verbose)
4835 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4836 			")\n-----Q-ID----- --Size-- -Priority- ---Q-Time--- --------Sender/Recipient--------\n");
4837 	else
4838 		(void) sm_io_fprintf(smioout,  SM_TIME_DEFAULT,
4839 			")\n-----Q-ID----- --Size-- -----Q-Time----- ------------Sender/Recipient-----------\n");
4840 	for (w = WorkQ; w != NULL; w = w->w_next)
4841 	{
4842 		struct stat st;
4843 		auto time_t submittime = 0;
4844 		long dfsize;
4845 		int flags = 0;
4846 		int qfver;
4847 		char quarmsg[MAXLINE];
4848 		char statmsg[MAXLINE];
4849 		char bodytype[MAXNAME + 1];
4850 		char qf[MAXPATHLEN];
4851 
4852 		if (StopRequest)
4853 			stop_sendmail();
4854 
4855 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%13s",
4856 				     w->w_name + 2);
4857 		(void) sm_strlcpyn(qf, sizeof qf, 3, qd, "/", w->w_name);
4858 		f = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
4859 			       NULL);
4860 		if (f == NULL)
4861 		{
4862 			if (errno == EPERM)
4863 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4864 						     " (permission denied)\n");
4865 			else if (errno == ENOENT)
4866 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4867 						     " (job completed)\n");
4868 			else
4869 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4870 						     " (%s)\n",
4871 						     sm_errstring(errno));
4872 			errno = 0;
4873 			continue;
4874 		}
4875 		w->w_name[0] = DATAFL_LETTER;
4876 		(void) sm_strlcpyn(qf, sizeof qf, 3, qddf, "/", w->w_name);
4877 		if (stat(qf, &st) >= 0)
4878 			dfsize = st.st_size;
4879 		else
4880 		{
4881 			ENVELOPE e;
4882 
4883 			/*
4884 			**  Maybe the df file can't be statted because
4885 			**  it is in a different directory than the qf file.
4886 			**  In order to find out, we must read the qf file.
4887 			*/
4888 
4889 			newenvelope(&e, &BlankEnvelope, sm_rpool_new_x(NULL));
4890 			e.e_id = w->w_name + 2;
4891 			e.e_qgrp = qgrp;
4892 			e.e_qdir = qdir;
4893 			dfsize = -1;
4894 			if (readqf(&e, false))
4895 			{
4896 				char *df = queuename(&e, DATAFL_LETTER);
4897 				if (stat(df, &st) >= 0)
4898 					dfsize = st.st_size;
4899 			}
4900 			if (e.e_lockfp != NULL)
4901 			{
4902 				(void) sm_io_close(e.e_lockfp, SM_TIME_DEFAULT);
4903 				e.e_lockfp = NULL;
4904 			}
4905 			clearenvelope(&e, false, e.e_rpool);
4906 			sm_rpool_free(e.e_rpool);
4907 		}
4908 		if (w->w_lock)
4909 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "*");
4910 		else if (QueueMode == QM_LOST)
4911 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "?");
4912 		else if (w->w_tooyoung)
4913 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "-");
4914 		else if (shouldqueue(w->w_pri, w->w_ctime))
4915 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "X");
4916 		else
4917 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, " ");
4918 
4919 		errno = 0;
4920 
4921 		quarmsg[0] = '\0';
4922 		statmsg[0] = bodytype[0] = '\0';
4923 		qfver = 0;
4924 		while (sm_io_fgets(f, SM_TIME_DEFAULT, buf, sizeof buf) != NULL)
4925 		{
4926 			register int i;
4927 			register char *p;
4928 
4929 			if (StopRequest)
4930 				stop_sendmail();
4931 
4932 			fixcrlf(buf, true);
4933 			switch (buf[0])
4934 			{
4935 			  case 'V':	/* queue file version */
4936 				qfver = atoi(&buf[1]);
4937 				break;
4938 
4939 			  case 'M':	/* error message */
4940 				if ((i = strlen(&buf[1])) >= sizeof statmsg)
4941 					i = sizeof statmsg - 1;
4942 				memmove(statmsg, &buf[1], i);
4943 				statmsg[i] = '\0';
4944 				break;
4945 
4946 			  case 'q':	/* quarantine reason */
4947 				if ((i = strlen(&buf[1])) >= sizeof quarmsg)
4948 					i = sizeof quarmsg - 1;
4949 				memmove(quarmsg, &buf[1], i);
4950 				quarmsg[i] = '\0';
4951 				break;
4952 
4953 			  case 'B':	/* body type */
4954 				if ((i = strlen(&buf[1])) >= sizeof bodytype)
4955 					i = sizeof bodytype - 1;
4956 				memmove(bodytype, &buf[1], i);
4957 				bodytype[i] = '\0';
4958 				break;
4959 
4960 			  case 'S':	/* sender name */
4961 				if (Verbose)
4962 				{
4963 					(void) sm_io_fprintf(smioout,
4964 						SM_TIME_DEFAULT,
4965 						"%8ld %10ld%c%.12s ",
4966 						dfsize,
4967 						w->w_pri,
4968 						bitset(EF_WARNING, flags)
4969 							? '+' : ' ',
4970 						ctime(&submittime) + 4);
4971 					prtstr(&buf[1], 78);
4972 				}
4973 				else
4974 				{
4975 					(void) sm_io_fprintf(smioout,
4976 						SM_TIME_DEFAULT,
4977 						"%8ld %.16s ",
4978 						dfsize,
4979 						ctime(&submittime));
4980 					prtstr(&buf[1], 39);
4981 				}
4982 
4983 				if (quarmsg[0] != '\0')
4984 				{
4985 					(void) sm_io_fprintf(smioout,
4986 							     SM_TIME_DEFAULT,
4987 							     "\n     QUARANTINE: %.*s",
4988 							     Verbose ? 100 : 60,
4989 							     quarmsg);
4990 					quarmsg[0] = '\0';
4991 				}
4992 
4993 				if (statmsg[0] != '\0' || bodytype[0] != '\0')
4994 				{
4995 					(void) sm_io_fprintf(smioout,
4996 						SM_TIME_DEFAULT,
4997 						"\n    %10.10s",
4998 						bodytype);
4999 					if (statmsg[0] != '\0')
5000 						(void) sm_io_fprintf(smioout,
5001 							SM_TIME_DEFAULT,
5002 							"   (%.*s)",
5003 							Verbose ? 100 : 60,
5004 							statmsg);
5005 					statmsg[0] = '\0';
5006 				}
5007 				break;
5008 
5009 			  case 'C':	/* controlling user */
5010 				if (Verbose)
5011 					(void) sm_io_fprintf(smioout,
5012 						SM_TIME_DEFAULT,
5013 						"\n\t\t\t\t\t\t(---%.64s---)",
5014 						&buf[1]);
5015 				break;
5016 
5017 			  case 'R':	/* recipient name */
5018 				p = &buf[1];
5019 				if (qfver >= 1)
5020 				{
5021 					p = strchr(p, ':');
5022 					if (p == NULL)
5023 						break;
5024 					p++;
5025 				}
5026 				if (Verbose)
5027 				{
5028 					(void) sm_io_fprintf(smioout,
5029 							SM_TIME_DEFAULT,
5030 							"\n\t\t\t\t\t\t");
5031 					prtstr(p, 71);
5032 				}
5033 				else
5034 				{
5035 					(void) sm_io_fprintf(smioout,
5036 							SM_TIME_DEFAULT,
5037 							"\n\t\t\t\t\t ");
5038 					prtstr(p, 38);
5039 				}
5040 				if (Verbose && statmsg[0] != '\0')
5041 				{
5042 					(void) sm_io_fprintf(smioout,
5043 							SM_TIME_DEFAULT,
5044 							"\n\t\t (%.100s)",
5045 							statmsg);
5046 					statmsg[0] = '\0';
5047 				}
5048 				break;
5049 
5050 			  case 'T':	/* creation time */
5051 				submittime = atol(&buf[1]);
5052 				break;
5053 
5054 			  case 'F':	/* flag bits */
5055 				for (p = &buf[1]; *p != '\0'; p++)
5056 				{
5057 					switch (*p)
5058 					{
5059 					  case 'w':
5060 						flags |= EF_WARNING;
5061 						break;
5062 					}
5063 				}
5064 			}
5065 		}
5066 		if (submittime == (time_t) 0)
5067 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
5068 					     " (no control file)");
5069 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\n");
5070 		(void) sm_io_close(f, SM_TIME_DEFAULT);
5071 	}
5072 	return nrequests;
5073 }
5074 
5075 /*
5076 **  QUEUE_LETTER -- get the proper queue letter for the current QueueMode.
5077 **
5078 **	Parameters:
5079 **		e -- envelope to build it in/from.
5080 **		type -- the file type, used as the first character
5081 **			of the file name.
5082 **
5083 **	Returns:
5084 **		the letter to use
5085 */
5086 
5087 static char
5088 queue_letter(e, type)
5089 	ENVELOPE *e;
5090 	int type;
5091 {
5092 	/* Change type according to QueueMode */
5093 	if (type == ANYQFL_LETTER)
5094 	{
5095 		if (e->e_quarmsg != NULL)
5096 			type = QUARQF_LETTER;
5097 		else
5098 		{
5099 			switch (QueueMode)
5100 			{
5101 			  case QM_NORMAL:
5102 				type = NORMQF_LETTER;
5103 				break;
5104 
5105 			  case QM_QUARANTINE:
5106 				type = QUARQF_LETTER;
5107 				break;
5108 
5109 			  case QM_LOST:
5110 				type = LOSEQF_LETTER;
5111 				break;
5112 
5113 			  default:
5114 				/* should never happen */
5115 				abort();
5116 				/* NOTREACHED */
5117 			}
5118 		}
5119 	}
5120 	return type;
5121 }
5122 
5123 /*
5124 **  QUEUENAME -- build a file name in the queue directory for this envelope.
5125 **
5126 **	Parameters:
5127 **		e -- envelope to build it in/from.
5128 **		type -- the file type, used as the first character
5129 **			of the file name.
5130 **
5131 **	Returns:
5132 **		a pointer to the queue name (in a static buffer).
5133 **
5134 **	Side Effects:
5135 **		If no id code is already assigned, queuename() will
5136 **		assign an id code with assign_queueid().  If no queue
5137 **		directory is assigned, one will be set with setnewqueue().
5138 */
5139 
5140 char *
5141 queuename(e, type)
5142 	register ENVELOPE *e;
5143 	int type;
5144 {
5145 	int qd, qg;
5146 	char *sub = "/";
5147 	char pref[3];
5148 	static char buf[MAXPATHLEN];
5149 
5150 	/* Assign an ID if needed */
5151 	if (e->e_id == NULL)
5152 		assign_queueid(e);
5153 	type = queue_letter(e, type);
5154 
5155 	/* begin of filename */
5156 	pref[0] = (char) type;
5157 	pref[1] = 'f';
5158 	pref[2] = '\0';
5159 
5160 	/* Assign a queue group/directory if needed */
5161 	if (type == XSCRPT_LETTER)
5162 	{
5163 		/*
5164 		**  We don't want to call setnewqueue() if we are fetching
5165 		**  the pathname of the transcript file, because setnewqueue
5166 		**  chooses a queue, and sometimes we need to write to the
5167 		**  transcript file before we have gathered enough information
5168 		**  to choose a queue.
5169 		*/
5170 
5171 		if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5172 		{
5173 			if (e->e_qgrp != NOQGRP && e->e_qdir != NOQDIR)
5174 			{
5175 				e->e_xfqgrp = e->e_qgrp;
5176 				e->e_xfqdir = e->e_qdir;
5177 			}
5178 			else
5179 			{
5180 				e->e_xfqgrp = 0;
5181 				if (Queue[e->e_xfqgrp]->qg_numqueues <= 1)
5182 					e->e_xfqdir = 0;
5183 				else
5184 				{
5185 					e->e_xfqdir = get_rand_mod(
5186 					      Queue[e->e_xfqgrp]->qg_numqueues);
5187 				}
5188 			}
5189 		}
5190 		qd = e->e_xfqdir;
5191 		qg = e->e_xfqgrp;
5192 	}
5193 	else
5194 	{
5195 		if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
5196 			(void) setnewqueue(e);
5197 		if (type ==  DATAFL_LETTER)
5198 		{
5199 			qd = e->e_dfqdir;
5200 			qg = e->e_dfqgrp;
5201 		}
5202 		else
5203 		{
5204 			qd = e->e_qdir;
5205 			qg = e->e_qgrp;
5206 		}
5207 	}
5208 
5209 	/* xf files always have a valid qd and qg picked above */
5210 	if ((qd == NOQDIR || qg == NOQGRP) && type != XSCRPT_LETTER)
5211 		(void) sm_strlcpyn(buf, sizeof buf, 2, pref, e->e_id);
5212 	else
5213 	{
5214 		switch (type)
5215 		{
5216 		  case DATAFL_LETTER:
5217 			if (bitset(QP_SUBDF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5218 				sub = "/df/";
5219 			break;
5220 
5221 		  case QUARQF_LETTER:
5222 		  case TEMPQF_LETTER:
5223 		  case NEWQFL_LETTER:
5224 		  case LOSEQF_LETTER:
5225 		  case NORMQF_LETTER:
5226 			if (bitset(QP_SUBQF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5227 				sub = "/qf/";
5228 			break;
5229 
5230 		  case XSCRPT_LETTER:
5231 			if (bitset(QP_SUBXF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5232 				sub = "/xf/";
5233 			break;
5234 
5235 		  default:
5236 			sm_abort("queuename: bad queue file type %d", type);
5237 		}
5238 
5239 		(void) sm_strlcpyn(buf, sizeof buf, 4,
5240 				Queue[qg]->qg_qpaths[qd].qp_name,
5241 				sub, pref, e->e_id);
5242 	}
5243 
5244 	if (tTd(7, 2))
5245 		sm_dprintf("queuename: %s\n", buf);
5246 	return buf;
5247 }
5248 
5249 /*
5250 **  INIT_QID_ALG -- Initialize the (static) parameters that are used to
5251 **	generate a queue ID.
5252 **
5253 **	This function is called by the daemon to reset
5254 **	LastQueueTime and LastQueuePid which are used by assign_queueid().
5255 **	Otherwise the algorithm may cause problems because
5256 **	LastQueueTime and LastQueuePid are set indirectly by main()
5257 **	before the daemon process is started, hence LastQueuePid is not
5258 **	the pid of the daemon and therefore a child of the daemon can
5259 **	actually have the same pid as LastQueuePid which means the section
5260 **	in  assign_queueid():
5261 **	* see if we need to get a new base time/pid *
5262 **	is NOT triggered which will cause the same queue id to be generated.
5263 **
5264 **	Parameters:
5265 **		none
5266 **
5267 **	Returns:
5268 **		none.
5269 */
5270 
5271 void
5272 init_qid_alg()
5273 {
5274 	LastQueueTime = 0;
5275 	LastQueuePid = -1;
5276 }
5277 
5278 /*
5279 **  ASSIGN_QUEUEID -- assign a queue ID for this envelope.
5280 **
5281 **	Assigns an id code if one does not already exist.
5282 **	This code assumes that nothing will remain in the queue for
5283 **	longer than 60 years.  It is critical that files with the given
5284 **	name do not already exist in the queue.
5285 **	[No longer initializes e_qdir to NOQDIR.]
5286 **
5287 **	Parameters:
5288 **		e -- envelope to set it in.
5289 **
5290 **	Returns:
5291 **		none.
5292 */
5293 
5294 static const char QueueIdChars[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
5295 # define QIC_LEN	60
5296 # define QIC_LEN_R	62
5297 
5298 /*
5299 **  Note: the length is "officially" 60 because minutes and seconds are
5300 **	usually only 0-59.  However (Linux):
5301 **       tm_sec The number of seconds after the minute, normally in
5302 **		the range 0 to 59, but can be up to 61 to allow for
5303 **		leap seconds.
5304 **	Hence the real length of the string is 62 to take this into account.
5305 **	Alternatively % QIC_LEN can (should) be used for access everywhere.
5306 */
5307 
5308 # define queuenextid() CurrentPid
5309 
5310 
5311 void
5312 assign_queueid(e)
5313 	register ENVELOPE *e;
5314 {
5315 	pid_t pid = queuenextid();
5316 	static int cX = 0;
5317 	static long random_offset;
5318 	struct tm *tm;
5319 	char idbuf[MAXQFNAME - 2];
5320 	int seq;
5321 
5322 	if (e->e_id != NULL)
5323 		return;
5324 
5325 	/* see if we need to get a new base time/pid */
5326 	if (cX >= QIC_LEN * QIC_LEN || LastQueueTime == 0 ||
5327 	    LastQueuePid != pid)
5328 	{
5329 		time_t then = LastQueueTime;
5330 
5331 		/* if the first time through, pick a random offset */
5332 		if (LastQueueTime == 0)
5333 			random_offset = get_random();
5334 
5335 		while ((LastQueueTime = curtime()) == then &&
5336 		       LastQueuePid == pid)
5337 		{
5338 			(void) sleep(1);
5339 		}
5340 		LastQueuePid = queuenextid();
5341 		cX = 0;
5342 	}
5343 
5344 	/*
5345 	**  Generate a new sequence number between 0 and QIC_LEN*QIC_LEN-1.
5346 	**  This lets us generate up to QIC_LEN*QIC_LEN unique queue ids
5347 	**  per second, per process.  With envelope splitting,
5348 	**  a single message can consume many queue ids.
5349 	*/
5350 
5351 	seq = (int)((cX + random_offset) % (QIC_LEN * QIC_LEN));
5352 	++cX;
5353 	if (tTd(7, 50))
5354 		sm_dprintf("assign_queueid: random_offset = %ld (%d)\n",
5355 			random_offset, seq);
5356 
5357 	tm = gmtime(&LastQueueTime);
5358 	idbuf[0] = QueueIdChars[tm->tm_year % QIC_LEN];
5359 	idbuf[1] = QueueIdChars[tm->tm_mon];
5360 	idbuf[2] = QueueIdChars[tm->tm_mday];
5361 	idbuf[3] = QueueIdChars[tm->tm_hour];
5362 	idbuf[4] = QueueIdChars[tm->tm_min % QIC_LEN_R];
5363 	idbuf[5] = QueueIdChars[tm->tm_sec % QIC_LEN_R];
5364 	idbuf[6] = QueueIdChars[seq / QIC_LEN];
5365 	idbuf[7] = QueueIdChars[seq % QIC_LEN];
5366 	(void) sm_snprintf(&idbuf[8], sizeof idbuf - 8, "%06d",
5367 			   (int) LastQueuePid);
5368 	e->e_id = sm_rpool_strdup_x(e->e_rpool, idbuf);
5369 	macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
5370 #if 0
5371 	/* XXX: inherited from MainEnvelope */
5372 	e->e_qgrp = NOQGRP;  /* too early to do anything else */
5373 	e->e_qdir = NOQDIR;
5374 	e->e_xfqgrp = NOQGRP;
5375 #endif /* 0 */
5376 
5377 	/* New ID means it's not on disk yet */
5378 	e->e_qfletter = '\0';
5379 
5380 	if (tTd(7, 1))
5381 		sm_dprintf("assign_queueid: assigned id %s, e=%p\n",
5382 			e->e_id, e);
5383 	if (LogLevel > 93)
5384 		sm_syslog(LOG_DEBUG, e->e_id, "assigned id");
5385 }
5386 /*
5387 **  SYNC_QUEUE_TIME -- Assure exclusive PID in any given second
5388 **
5389 **	Make sure one PID can't be used by two processes in any one second.
5390 **
5391 **		If the system rotates PIDs fast enough, may get the
5392 **		same pid in the same second for two distinct processes.
5393 **		This will interfere with the queue file naming system.
5394 **
5395 **	Parameters:
5396 **		none
5397 **
5398 **	Returns:
5399 **		none
5400 */
5401 
5402 void
5403 sync_queue_time()
5404 {
5405 #if FAST_PID_RECYCLE
5406 	if (OpMode != MD_TEST &&
5407 	    OpMode != MD_VERIFY &&
5408 	    LastQueueTime > 0 &&
5409 	    LastQueuePid == CurrentPid &&
5410 	    curtime() == LastQueueTime)
5411 		(void) sleep(1);
5412 #endif /* FAST_PID_RECYCLE */
5413 }
5414 /*
5415 **  UNLOCKQUEUE -- unlock the queue entry for a specified envelope
5416 **
5417 **	Parameters:
5418 **		e -- the envelope to unlock.
5419 **
5420 **	Returns:
5421 **		none
5422 **
5423 **	Side Effects:
5424 **		unlocks the queue for `e'.
5425 */
5426 
5427 void
5428 unlockqueue(e)
5429 	ENVELOPE *e;
5430 {
5431 	if (tTd(51, 4))
5432 		sm_dprintf("unlockqueue(%s)\n",
5433 			e->e_id == NULL ? "NOQUEUE" : e->e_id);
5434 
5435 
5436 	/* if there is a lock file in the envelope, close it */
5437 	if (e->e_lockfp != NULL)
5438 		(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
5439 	e->e_lockfp = NULL;
5440 
5441 	/* don't create a queue id if we don't already have one */
5442 	if (e->e_id == NULL)
5443 		return;
5444 
5445 	/* remove the transcript */
5446 	if (LogLevel > 87)
5447 		sm_syslog(LOG_DEBUG, e->e_id, "unlock");
5448 	if (!tTd(51, 104))
5449 		(void) xunlink(queuename(e, XSCRPT_LETTER));
5450 }
5451 /*
5452 **  SETCTLUSER -- create a controlling address
5453 **
5454 **	Create a fake "address" given only a local login name; this is
5455 **	used as a "controlling user" for future recipient addresses.
5456 **
5457 **	Parameters:
5458 **		user -- the user name of the controlling user.
5459 **		qfver -- the version stamp of this queue file.
5460 **		e -- envelope
5461 **
5462 **	Returns:
5463 **		An address descriptor for the controlling user,
5464 **		using storage allocated from e->e_rpool.
5465 **
5466 */
5467 
5468 static ADDRESS *
5469 setctluser(user, qfver, e)
5470 	char *user;
5471 	int qfver;
5472 	ENVELOPE *e;
5473 {
5474 	register ADDRESS *a;
5475 	struct passwd *pw;
5476 	char *p;
5477 
5478 	/*
5479 	**  See if this clears our concept of controlling user.
5480 	*/
5481 
5482 	if (user == NULL || *user == '\0')
5483 		return NULL;
5484 
5485 	/*
5486 	**  Set up addr fields for controlling user.
5487 	*/
5488 
5489 	a = (ADDRESS *) sm_rpool_malloc_x(e->e_rpool, sizeof *a);
5490 	memset((char *) a, '\0', sizeof *a);
5491 
5492 	if (*user == ':')
5493 	{
5494 		p = &user[1];
5495 		a->q_user = sm_rpool_strdup_x(e->e_rpool, p);
5496 	}
5497 	else
5498 	{
5499 		p = strtok(user, ":");
5500 		a->q_user = sm_rpool_strdup_x(e->e_rpool, user);
5501 		if (qfver >= 2)
5502 		{
5503 			if ((p = strtok(NULL, ":")) != NULL)
5504 				a->q_uid = atoi(p);
5505 			if ((p = strtok(NULL, ":")) != NULL)
5506 				a->q_gid = atoi(p);
5507 			if ((p = strtok(NULL, ":")) != NULL)
5508 			{
5509 				char *o;
5510 
5511 				a->q_flags |= QGOODUID;
5512 
5513 				/* if there is another ':': restore it */
5514 				if ((o = strtok(NULL, ":")) != NULL && o > p)
5515 					o[-1] = ':';
5516 			}
5517 		}
5518 		else if ((pw = sm_getpwnam(user)) != NULL)
5519 		{
5520 			if (*pw->pw_dir == '\0')
5521 				a->q_home = NULL;
5522 			else if (strcmp(pw->pw_dir, "/") == 0)
5523 				a->q_home = "";
5524 			else
5525 				a->q_home = sm_rpool_strdup_x(e->e_rpool, pw->pw_dir);
5526 			a->q_uid = pw->pw_uid;
5527 			a->q_gid = pw->pw_gid;
5528 			a->q_flags |= QGOODUID;
5529 		}
5530 	}
5531 
5532 	a->q_flags |= QPRIMARY;		/* flag as a "ctladdr" */
5533 	a->q_mailer = LocalMailer;
5534 	if (p == NULL)
5535 		a->q_paddr = sm_rpool_strdup_x(e->e_rpool, a->q_user);
5536 	else
5537 		a->q_paddr = sm_rpool_strdup_x(e->e_rpool, p);
5538 	return a;
5539 }
5540 /*
5541 **  LOSEQFILE -- rename queue file with LOSEQF_LETTER & try to let someone know
5542 **
5543 **	Parameters:
5544 **		e -- the envelope (e->e_id will be used).
5545 **		why -- reported to whomever can hear.
5546 **
5547 **	Returns:
5548 **		none.
5549 */
5550 
5551 void
5552 loseqfile(e, why)
5553 	register ENVELOPE *e;
5554 	char *why;
5555 {
5556 	bool loseit = true;
5557 	char *p;
5558 	char buf[MAXPATHLEN];
5559 
5560 	if (e == NULL || e->e_id == NULL)
5561 		return;
5562 	p = queuename(e, ANYQFL_LETTER);
5563 	if (sm_strlcpy(buf, p, sizeof buf) >= sizeof buf)
5564 		return;
5565 	if (!bitset(EF_INQUEUE, e->e_flags))
5566 		queueup(e, false, true);
5567 	else if (QueueMode == QM_LOST)
5568 		loseit = false;
5569 
5570 	/* if already lost, no need to re-lose */
5571 	if (loseit)
5572 	{
5573 		p = queuename(e, LOSEQF_LETTER);
5574 		if (rename(buf, p) < 0)
5575 			syserr("cannot rename(%s, %s), uid=%d",
5576 			       buf, p, (int) geteuid());
5577 		else if (LogLevel > 0)
5578 			sm_syslog(LOG_ALERT, e->e_id,
5579 				  "Losing %s: %s", buf, why);
5580 	}
5581 	if (e->e_dfp != NULL)
5582 	{
5583 		(void) sm_io_close(e->e_dfp, SM_TIME_DEFAULT);
5584 		e->e_dfp = NULL;
5585 	}
5586 	e->e_flags &= ~EF_HAS_DF;
5587 }
5588 /*
5589 **  NAME2QID -- translate a queue group name to a queue group id
5590 **
5591 **	Parameters:
5592 **		queuename -- name of queue group.
5593 **
5594 **	Returns:
5595 **		queue group id if found.
5596 **		NOQGRP otherwise.
5597 */
5598 
5599 int
5600 name2qid(queuename)
5601 	char *queuename;
5602 {
5603 	register STAB *s;
5604 
5605 	s = stab(queuename, ST_QUEUE, ST_FIND);
5606 	if (s == NULL)
5607 		return NOQGRP;
5608 	return s->s_quegrp->qg_index;
5609 }
5610 /*
5611 **  QID_PRINTNAME -- create externally printable version of queue id
5612 **
5613 **	Parameters:
5614 **		e -- the envelope.
5615 **
5616 **	Returns:
5617 **		a printable version
5618 */
5619 
5620 char *
5621 qid_printname(e)
5622 	ENVELOPE *e;
5623 {
5624 	char *id;
5625 	static char idbuf[MAXQFNAME + 34];
5626 
5627 	if (e == NULL)
5628 		return "";
5629 
5630 	if (e->e_id == NULL)
5631 		id = "";
5632 	else
5633 		id = e->e_id;
5634 
5635 	if (e->e_qdir == NOQDIR)
5636 		return id;
5637 
5638 	(void) sm_snprintf(idbuf, sizeof idbuf, "%.32s/%s",
5639 			   Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_name,
5640 			   id);
5641 	return idbuf;
5642 }
5643 /*
5644 **  QID_PRINTQUEUE -- create full version of queue directory for data files
5645 **
5646 **	Parameters:
5647 **		qgrp -- index in queue group.
5648 **		qdir -- the short version of the queue directory
5649 **
5650 **	Returns:
5651 **		the full pathname to the queue (might point to a static var)
5652 */
5653 
5654 char *
5655 qid_printqueue(qgrp, qdir)
5656 	int qgrp;
5657 	int qdir;
5658 {
5659 	char *subdir;
5660 	static char dir[MAXPATHLEN];
5661 
5662 	if (qdir == NOQDIR)
5663 		return Queue[qgrp]->qg_qdir;
5664 
5665 	if (strcmp(Queue[qgrp]->qg_qpaths[qdir].qp_name, ".") == 0)
5666 		subdir = NULL;
5667 	else
5668 		subdir = Queue[qgrp]->qg_qpaths[qdir].qp_name;
5669 
5670 	(void) sm_strlcpyn(dir, sizeof dir, 4,
5671 			Queue[qgrp]->qg_qdir,
5672 			subdir == NULL ? "" : "/",
5673 			subdir == NULL ? "" : subdir,
5674 			(bitset(QP_SUBDF,
5675 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
5676 					? "/df" : ""));
5677 	return dir;
5678 }
5679 
5680 /*
5681 **  PICKQDIR -- Pick a queue directory from a queue group
5682 **
5683 **	Parameters:
5684 **		qg -- queue group
5685 **		fsize -- file size in bytes
5686 **		e -- envelope, or NULL
5687 **
5688 **	Result:
5689 **		NOQDIR if no queue directory in qg has enough free space to
5690 **		hold a file of size 'fsize', otherwise the index of
5691 **		a randomly selected queue directory which resides on a
5692 **		file system with enough disk space.
5693 **		XXX This could be extended to select a queuedir with
5694 **			a few (the fewest?) number of entries. That data
5695 **			is available if shared memory is used.
5696 **
5697 **	Side Effects:
5698 **		If the request fails and e != NULL then sm_syslog is called.
5699 */
5700 
5701 int
5702 pickqdir(qg, fsize, e)
5703 	QUEUEGRP *qg;
5704 	long fsize;
5705 	ENVELOPE *e;
5706 {
5707 	int qdir;
5708 	int i;
5709 	long avail = 0;
5710 
5711 	/* Pick a random directory, as a starting point. */
5712 	if (qg->qg_numqueues <= 1)
5713 		qdir = 0;
5714 	else
5715 		qdir = get_rand_mod(qg->qg_numqueues);
5716 
5717 	if (MinBlocksFree <= 0 && fsize <= 0)
5718 		return qdir;
5719 
5720 	/*
5721 	**  Now iterate over the queue directories,
5722 	**  looking for a directory with enough space for this message.
5723 	*/
5724 
5725 	i = qdir;
5726 	do
5727 	{
5728 		QPATHS *qp = &qg->qg_qpaths[i];
5729 		long needed = 0;
5730 		long fsavail = 0;
5731 
5732 		if (fsize > 0)
5733 			needed += fsize / FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5734 				  + ((fsize % FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5735 				      > 0) ? 1 : 0);
5736 		if (MinBlocksFree > 0)
5737 			needed += MinBlocksFree;
5738 		fsavail = FILE_SYS_AVAIL(qp->qp_fsysidx);
5739 #if SM_CONF_SHM
5740 		if (fsavail <= 0)
5741 		{
5742 			long blksize;
5743 
5744 			/*
5745 			**  might be not correctly updated,
5746 			**  let's try to get the info directly.
5747 			*/
5748 
5749 			fsavail = freediskspace(FILE_SYS_NAME(qp->qp_fsysidx),
5750 						&blksize);
5751 			if (fsavail < 0)
5752 				fsavail = 0;
5753 		}
5754 #endif /* SM_CONF_SHM */
5755 		if (needed <= fsavail)
5756 			return i;
5757 		if (avail < fsavail)
5758 			avail = fsavail;
5759 
5760 		if (qg->qg_numqueues > 0)
5761 			i = (i + 1) % qg->qg_numqueues;
5762 	} while (i != qdir);
5763 
5764 	if (e != NULL && LogLevel > 0)
5765 		sm_syslog(LOG_ALERT, e->e_id,
5766 			"low on space (%s needs %ld bytes + %ld blocks in %s), max avail: %ld",
5767 			CurHostName == NULL ? "SMTP-DAEMON" : CurHostName,
5768 			fsize, MinBlocksFree,
5769 			qg->qg_qdir, avail);
5770 	return NOQDIR;
5771 }
5772 /*
5773 **  SETNEWQUEUE -- Sets a new queue group and directory
5774 **
5775 **	Assign a queue group and directory to an envelope and store the
5776 **	directory in e->e_qdir.
5777 **
5778 **	Parameters:
5779 **		e -- envelope to assign a queue for.
5780 **
5781 **	Returns:
5782 **		true if successful
5783 **		false otherwise
5784 **
5785 **	Side Effects:
5786 **		On success, e->e_qgrp and e->e_qdir are non-negative.
5787 **		On failure (not enough disk space),
5788 **		e->qgrp = NOQGRP, e->e_qdir = NOQDIR
5789 **		and usrerr() is invoked (which could raise an exception).
5790 */
5791 
5792 bool
5793 setnewqueue(e)
5794 	ENVELOPE *e;
5795 {
5796 	if (tTd(41, 20))
5797 		sm_dprintf("setnewqueue: called\n");
5798 
5799 	/* not set somewhere else */
5800 	if (e->e_qgrp == NOQGRP)
5801 	{
5802 		ADDRESS *q;
5803 
5804 		/*
5805 		**  Use the queue group of the "first" recipient, as set by
5806 		**  the "queuegroup" rule set.  If that is not defined, then
5807 		**  use the queue group of the mailer of the first recipient.
5808 		**  If that is not defined either, then use the default
5809 		**  queue group.
5810 		**  Notice: "first" depends on the sorting of sendqueue
5811 		**  in recipient().
5812 		**  To avoid problems with "bad" recipients look
5813 		**  for a valid address first.
5814 		*/
5815 
5816 		q = e->e_sendqueue;
5817 		while (q != NULL &&
5818 		       (QS_IS_BADADDR(q->q_state) || QS_IS_DEAD(q->q_state)))
5819 		{
5820 			q = q->q_next;
5821 		}
5822 		if (q == NULL)
5823 			e->e_qgrp = 0;
5824 		else if (q->q_qgrp >= 0)
5825 			e->e_qgrp = q->q_qgrp;
5826 		else if (q->q_mailer != NULL &&
5827 			 ISVALIDQGRP(q->q_mailer->m_qgrp))
5828 			e->e_qgrp = q->q_mailer->m_qgrp;
5829 		else
5830 			e->e_qgrp = 0;
5831 		e->e_dfqgrp = e->e_qgrp;
5832 	}
5833 
5834 	if (ISVALIDQDIR(e->e_qdir) && ISVALIDQDIR(e->e_dfqdir))
5835 	{
5836 		if (tTd(41, 20))
5837 			sm_dprintf("setnewqueue: e_qdir already assigned (%s)\n",
5838 				qid_printqueue(e->e_qgrp, e->e_qdir));
5839 		return true;
5840 	}
5841 
5842 	filesys_update();
5843 	e->e_qdir = pickqdir(Queue[e->e_qgrp], e->e_msgsize, e);
5844 	if (e->e_qdir == NOQDIR)
5845 	{
5846 		e->e_qgrp = NOQGRP;
5847 		if (!bitset(EF_FATALERRS, e->e_flags))
5848 			usrerr("452 4.4.5 Insufficient disk space; try again later");
5849 		e->e_flags |= EF_FATALERRS;
5850 		return false;
5851 	}
5852 
5853 	if (tTd(41, 3))
5854 		sm_dprintf("setnewqueue: Assigned queue directory %s\n",
5855 			qid_printqueue(e->e_qgrp, e->e_qdir));
5856 
5857 	if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5858 	{
5859 		e->e_xfqgrp = e->e_qgrp;
5860 		e->e_xfqdir = e->e_qdir;
5861 	}
5862 	e->e_dfqdir = e->e_qdir;
5863 	return true;
5864 }
5865 /*
5866 **  CHKQDIR -- check a queue directory
5867 **
5868 **	Parameters:
5869 **		name -- name of queue directory
5870 **		sff -- flags for safefile()
5871 **
5872 **	Returns:
5873 **		is it a queue directory?
5874 */
5875 
5876 static bool
5877 chkqdir(name, sff)
5878 	char *name;
5879 	long sff;
5880 {
5881 	struct stat statb;
5882 	int i;
5883 
5884 	/* skip over . and .. directories */
5885 	if (name[0] == '.' &&
5886 	    (name[1] == '\0' || (name[1] == '.' && name[2] == '\0')))
5887 		return false;
5888 #if HASLSTAT
5889 	if (lstat(name, &statb) < 0)
5890 #else /* HASLSTAT */
5891 	if (stat(name, &statb) < 0)
5892 #endif /* HASLSTAT */
5893 	{
5894 		if (tTd(41, 2))
5895 			sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5896 				   name, sm_errstring(errno));
5897 		return false;
5898 	}
5899 #if HASLSTAT
5900 	if (S_ISLNK(statb.st_mode))
5901 	{
5902 		/*
5903 		**  For a symlink we need to make sure the
5904 		**  target is a directory
5905 		*/
5906 
5907 		if (stat(name, &statb) < 0)
5908 		{
5909 			if (tTd(41, 2))
5910 				sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5911 					   name, sm_errstring(errno));
5912 			return false;
5913 		}
5914 	}
5915 #endif /* HASLSTAT */
5916 
5917 	if (!S_ISDIR(statb.st_mode))
5918 	{
5919 		if (tTd(41, 2))
5920 			sm_dprintf("chkqdir: \"%s\": Not a directory\n",
5921 				name);
5922 		return false;
5923 	}
5924 
5925 	/* Print a warning if unsafe (but still use it) */
5926 	/* XXX do this only if we want the warning? */
5927 	i = safedirpath(name, RunAsUid, RunAsGid, NULL, sff, 0, 0);
5928 	if (i != 0)
5929 	{
5930 		if (tTd(41, 2))
5931 			sm_dprintf("chkqdir: \"%s\": Not safe: %s\n",
5932 				   name, sm_errstring(i));
5933 #if _FFR_CHK_QUEUE
5934 		if (LogLevel > 8)
5935 			sm_syslog(LOG_WARNING, NOQID,
5936 				  "queue directory \"%s\": Not safe: %s",
5937 				  name, sm_errstring(i));
5938 #endif /* _FFR_CHK_QUEUE */
5939 	}
5940 	return true;
5941 }
5942 /*
5943 **  MULTIQUEUE_CACHE -- cache a list of paths to queues.
5944 **
5945 **	Each potential queue is checked as the cache is built.
5946 **	Thereafter, each is blindly trusted.
5947 **	Note that we can be called again after a timeout to rebuild
5948 **	(although code for that is not ready yet).
5949 **
5950 **	Parameters:
5951 **		basedir -- base of all queue directories.
5952 **		blen -- strlen(basedir).
5953 **		qg -- queue group.
5954 **		qn -- number of queue directories already cached.
5955 **		phash -- pointer to hash value over queue dirs.
5956 #if SM_CONF_SHM
5957 **			only used if shared memory is active.
5958 #endif * SM_CONF_SHM *
5959 **
5960 **	Returns:
5961 **		new number of queue directories.
5962 */
5963 
5964 #define INITIAL_SLOTS	20
5965 #define ADD_SLOTS	10
5966 
5967 static int
5968 multiqueue_cache(basedir, blen, qg, qn, phash)
5969 	char *basedir;
5970 	int blen;
5971 	QUEUEGRP *qg;
5972 	int qn;
5973 	unsigned int *phash;
5974 {
5975 	char *cp;
5976 	int i, len;
5977 	int slotsleft = 0;
5978 	long sff = SFF_ANYFILE;
5979 	char qpath[MAXPATHLEN];
5980 	char subdir[MAXPATHLEN];
5981 	char prefix[MAXPATHLEN];	/* dir relative to basedir */
5982 
5983 	if (tTd(41, 20))
5984 		sm_dprintf("multiqueue_cache: called\n");
5985 
5986 	/* Initialize to current directory */
5987 	prefix[0] = '.';
5988 	prefix[1] = '\0';
5989 	if (qg->qg_numqueues != 0 && qg->qg_qpaths != NULL)
5990 	{
5991 		for (i = 0; i < qg->qg_numqueues; i++)
5992 		{
5993 			if (qg->qg_qpaths[i].qp_name != NULL)
5994 				(void) sm_free(qg->qg_qpaths[i].qp_name); /* XXX */
5995 		}
5996 		(void) sm_free((char *) qg->qg_qpaths); /* XXX */
5997 		qg->qg_qpaths = NULL;
5998 		qg->qg_numqueues = 0;
5999 	}
6000 
6001 	/* If running as root, allow safedirpath() checks to use privs */
6002 	if (RunAsUid == 0)
6003 		sff |= SFF_ROOTOK;
6004 #if _FFR_CHK_QUEUE
6005 	sff |= SFF_SAFEDIRPATH|SFF_NOWWFILES;
6006 	if (!UseMSP)
6007 		sff |= SFF_NOGWFILES;
6008 #endif /* _FFR_CHK_QUEUE */
6009 
6010 	if (!SM_IS_DIR_START(qg->qg_qdir))
6011 	{
6012 		/*
6013 		**  XXX we could add basedir, but then we have to realloc()
6014 		**  the string... Maybe another time.
6015 		*/
6016 
6017 		syserr("QueuePath %s not absolute", qg->qg_qdir);
6018 		ExitStat = EX_CONFIG;
6019 		return qn;
6020 	}
6021 
6022 	/* qpath: directory of current workgroup */
6023 	len = sm_strlcpy(qpath, qg->qg_qdir, sizeof qpath);
6024 	if (len >= sizeof qpath)
6025 	{
6026 		syserr("QueuePath %.256s too long (%d max)",
6027 		       qg->qg_qdir, (int) sizeof qpath);
6028 		ExitStat = EX_CONFIG;
6029 		return qn;
6030 	}
6031 
6032 	/* begin of qpath must be same as basedir */
6033 	if (strncmp(basedir, qpath, blen) != 0 &&
6034 	    (strncmp(basedir, qpath, blen - 1) != 0 || len != blen - 1))
6035 	{
6036 		syserr("QueuePath %s not subpath of QueueDirectory %s",
6037 			qpath, basedir);
6038 		ExitStat = EX_CONFIG;
6039 		return qn;
6040 	}
6041 
6042 	/* Do we have a nested subdirectory? */
6043 	if (blen < len && SM_FIRST_DIR_DELIM(qg->qg_qdir + blen) != NULL)
6044 	{
6045 
6046 		/* Copy subdirectory into prefix for later use */
6047 		if (sm_strlcpy(prefix, qg->qg_qdir + blen, sizeof prefix) >=
6048 		    sizeof prefix)
6049 		{
6050 			syserr("QueuePath %.256s too long (%d max)",
6051 				qg->qg_qdir, (int) sizeof qpath);
6052 			ExitStat = EX_CONFIG;
6053 			return qn;
6054 		}
6055 		cp = SM_LAST_DIR_DELIM(prefix);
6056 		SM_ASSERT(cp != NULL);
6057 		*cp = '\0';	/* cut off trailing / */
6058 	}
6059 
6060 	/* This is guaranteed by the basedir check above */
6061 	SM_ASSERT(len >= blen - 1);
6062 	cp = &qpath[len - 1];
6063 	if (*cp == '*')
6064 	{
6065 		register DIR *dp;
6066 		register struct dirent *d;
6067 		int off;
6068 		char *delim;
6069 		char relpath[MAXPATHLEN];
6070 
6071 		*cp = '\0';	/* Overwrite wildcard */
6072 		if ((cp = SM_LAST_DIR_DELIM(qpath)) == NULL)
6073 		{
6074 			syserr("QueueDirectory: can not wildcard relative path");
6075 			if (tTd(41, 2))
6076 				sm_dprintf("multiqueue_cache: \"%s*\": Can not wildcard relative path.\n",
6077 					qpath);
6078 			ExitStat = EX_CONFIG;
6079 			return qn;
6080 		}
6081 		if (cp == qpath)
6082 		{
6083 			/*
6084 			**  Special case of top level wildcard, like /foo*
6085 			**	Change to //foo*
6086 			*/
6087 
6088 			(void) sm_strlcpy(qpath + 1, qpath, sizeof qpath - 1);
6089 			++cp;
6090 		}
6091 		delim = cp;
6092 		*(cp++) = '\0';		/* Replace / with \0 */
6093 		len = strlen(cp);	/* Last component of queue directory */
6094 
6095 		/*
6096 		**  Path relative to basedir, with trailing /
6097 		**  It will be modified below to specify the subdirectories
6098 		**  so they can be opened without chdir().
6099 		*/
6100 
6101 		off = sm_strlcpyn(relpath, sizeof relpath, 2, prefix, "/");
6102 		SM_ASSERT(off < sizeof relpath);
6103 
6104 		if (tTd(41, 2))
6105 			sm_dprintf("multiqueue_cache: prefix=\"%s%s\"\n",
6106 				   relpath, cp);
6107 
6108 		/* It is always basedir: we don't need to store it per group */
6109 		/* XXX: optimize this! -> one more global? */
6110 		qg->qg_qdir = newstr(basedir);
6111 		qg->qg_qdir[blen - 1] = '\0';	/* cut off trailing / */
6112 
6113 		/*
6114 		**  XXX Should probably wrap this whole loop in a timeout
6115 		**  in case some wag decides to NFS mount the queues.
6116 		*/
6117 
6118 		/* Test path to get warning messages. */
6119 		if (qn == 0)
6120 		{
6121 			/*  XXX qg_runasuid and qg_runasgid for specials? */
6122 			i = safedirpath(basedir, RunAsUid, RunAsGid, NULL,
6123 					sff, 0, 0);
6124 			if (i != 0 && tTd(41, 2))
6125 				sm_dprintf("multiqueue_cache: \"%s\": Not safe: %s\n",
6126 					   basedir, sm_errstring(i));
6127 		}
6128 
6129 		if ((dp = opendir(prefix)) == NULL)
6130 		{
6131 			syserr("can not opendir(%s/%s)", qg->qg_qdir, prefix);
6132 			if (tTd(41, 2))
6133 				sm_dprintf("multiqueue_cache: opendir(\"%s/%s\"): %s\n",
6134 					   qg->qg_qdir, prefix,
6135 					   sm_errstring(errno));
6136 			ExitStat = EX_CONFIG;
6137 			return qn;
6138 		}
6139 		while ((d = readdir(dp)) != NULL)
6140 		{
6141 			i = strlen(d->d_name);
6142 			if (i < len || strncmp(d->d_name, cp, len) != 0)
6143 			{
6144 				if (tTd(41, 5))
6145 					sm_dprintf("multiqueue_cache: \"%s\", skipped\n",
6146 						d->d_name);
6147 				continue;
6148 			}
6149 
6150 			/* Create relative pathname: prefix + local directory */
6151 			i = sizeof(relpath) - off;
6152 			if (sm_strlcpy(relpath + off, d->d_name, i) >= i)
6153 				continue;	/* way too long */
6154 
6155 			if (!chkqdir(relpath, sff))
6156 				continue;
6157 
6158 			if (qg->qg_qpaths == NULL)
6159 			{
6160 				slotsleft = INITIAL_SLOTS;
6161 				qg->qg_qpaths = (QPATHS *)xalloc((sizeof *qg->qg_qpaths) *
6162 								slotsleft);
6163 				qg->qg_numqueues = 0;
6164 			}
6165 			else if (slotsleft < 1)
6166 			{
6167 				qg->qg_qpaths = (QPATHS *)sm_realloc((char *)qg->qg_qpaths,
6168 							  (sizeof *qg->qg_qpaths) *
6169 							  (qg->qg_numqueues +
6170 							   ADD_SLOTS));
6171 				if (qg->qg_qpaths == NULL)
6172 				{
6173 					(void) closedir(dp);
6174 					return qn;
6175 				}
6176 				slotsleft += ADD_SLOTS;
6177 			}
6178 
6179 			/* check subdirs */
6180 			qg->qg_qpaths[qg->qg_numqueues].qp_subdirs = QP_NOSUB;
6181 
6182 #define CHKRSUBDIR(name, flag)	\
6183 	(void) sm_strlcpyn(subdir, sizeof subdir, 3, relpath, "/", name); \
6184 	if (chkqdir(subdir, sff))	\
6185 		qg->qg_qpaths[qg->qg_numqueues].qp_subdirs |= flag;	\
6186 	else
6187 
6188 
6189 			CHKRSUBDIR("qf", QP_SUBQF);
6190 			CHKRSUBDIR("df", QP_SUBDF);
6191 			CHKRSUBDIR("xf", QP_SUBXF);
6192 
6193 			/* assert(strlen(d->d_name) < MAXPATHLEN - 14) */
6194 			/* maybe even - 17 (subdirs) */
6195 
6196 			if (prefix[0] != '.')
6197 				qg->qg_qpaths[qg->qg_numqueues].qp_name =
6198 					newstr(relpath);
6199 			else
6200 				qg->qg_qpaths[qg->qg_numqueues].qp_name =
6201 					newstr(d->d_name);
6202 
6203 			if (tTd(41, 2))
6204 				sm_dprintf("multiqueue_cache: %d: \"%s\" cached (%x).\n",
6205 					qg->qg_numqueues, relpath,
6206 					qg->qg_qpaths[qg->qg_numqueues].qp_subdirs);
6207 #if SM_CONF_SHM
6208 			qg->qg_qpaths[qg->qg_numqueues].qp_idx = qn;
6209 			*phash = hash_q(relpath, *phash);
6210 #endif /* SM_CONF_SHM */
6211 			qg->qg_numqueues++;
6212 			++qn;
6213 			slotsleft--;
6214 		}
6215 		(void) closedir(dp);
6216 
6217 		/* undo damage */
6218 		*delim = '/';
6219 	}
6220 	if (qg->qg_numqueues == 0)
6221 	{
6222 		qg->qg_qpaths = (QPATHS *) xalloc(sizeof *qg->qg_qpaths);
6223 
6224 		/* test path to get warning messages */
6225 		i = safedirpath(qpath, RunAsUid, RunAsGid, NULL, sff, 0, 0);
6226 		if (i == ENOENT)
6227 		{
6228 			syserr("can not opendir(%s)", qpath);
6229 			if (tTd(41, 2))
6230 				sm_dprintf("multiqueue_cache: opendir(\"%s\"): %s\n",
6231 					   qpath, sm_errstring(i));
6232 			ExitStat = EX_CONFIG;
6233 			return qn;
6234 		}
6235 
6236 		qg->qg_qpaths[0].qp_subdirs = QP_NOSUB;
6237 		qg->qg_numqueues = 1;
6238 
6239 		/* check subdirs */
6240 #define CHKSUBDIR(name, flag)	\
6241 	(void) sm_strlcpyn(subdir, sizeof subdir, 3, qg->qg_qdir, "/", name); \
6242 	if (chkqdir(subdir, sff))	\
6243 		qg->qg_qpaths[0].qp_subdirs |= flag;	\
6244 	else
6245 
6246 		CHKSUBDIR("qf", QP_SUBQF);
6247 		CHKSUBDIR("df", QP_SUBDF);
6248 		CHKSUBDIR("xf", QP_SUBXF);
6249 
6250 		if (qg->qg_qdir[blen - 1] != '\0' &&
6251 		    qg->qg_qdir[blen] != '\0')
6252 		{
6253 			/*
6254 			**  Copy the last component into qpaths and
6255 			**  cut off qdir
6256 			*/
6257 
6258 			qg->qg_qpaths[0].qp_name = newstr(qg->qg_qdir + blen);
6259 			qg->qg_qdir[blen - 1] = '\0';
6260 		}
6261 		else
6262 			qg->qg_qpaths[0].qp_name = newstr(".");
6263 
6264 #if SM_CONF_SHM
6265 		qg->qg_qpaths[0].qp_idx = qn;
6266 		*phash = hash_q(qg->qg_qpaths[0].qp_name, *phash);
6267 #endif /* SM_CONF_SHM */
6268 		++qn;
6269 	}
6270 	return qn;
6271 }
6272 
6273 /*
6274 **  FILESYS_FIND -- find entry in FileSys table, or add new one
6275 **
6276 **	Given the pathname of a directory, determine the file system
6277 **	in which that directory resides, and return a pointer to the
6278 **	entry in the FileSys table that describes the file system.
6279 **	A new entry is added if necessary (and requested).
6280 **	If the directory does not exist, -1 is returned.
6281 **
6282 **	Parameters:
6283 **		name -- name of directory (must be persistent!)
6284 **		path -- pathname of directory (name plus maybe "/df")
6285 **		add -- add to structure if not found.
6286 **
6287 **	Returns:
6288 **		>=0: found: index in file system table
6289 **		<0: some error, i.e.,
6290 **		FSF_TOO_MANY: too many filesystems (-> syserr())
6291 **		FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6292 **		FSF_NOT_FOUND: not in list
6293 */
6294 
6295 static short filesys_find __P((char *, char *, bool));
6296 
6297 #define FSF_NOT_FOUND	(-1)
6298 #define FSF_STAT_FAIL	(-2)
6299 #define FSF_TOO_MANY	(-3)
6300 
6301 static short
6302 filesys_find(name, path, add)
6303 	char *name;
6304 	char *path;
6305 	bool add;
6306 {
6307 	struct stat st;
6308 	short i;
6309 
6310 	if (stat(path, &st) < 0)
6311 	{
6312 		syserr("cannot stat queue directory %s", path);
6313 		return FSF_STAT_FAIL;
6314 	}
6315 	for (i = 0; i < NumFileSys; ++i)
6316 	{
6317 		if (FILE_SYS_DEV(i) == st.st_dev)
6318 		{
6319 			/*
6320 			**  Make sure the file system (FS) name is set:
6321 			**  even though the source code indicates that
6322 			**  FILE_SYS_DEV() is only set below, it could be
6323 			**  set via shared memory, hence we need to perform
6324 			**  this check/assignment here.
6325 			*/
6326 
6327 			if (NULL == FILE_SYS_NAME(i))
6328 				FILE_SYS_NAME(i) = name;
6329 			return i;
6330 		}
6331 	}
6332 	if (i >= MAXFILESYS)
6333 	{
6334 		syserr("too many queue file systems (%d max)", MAXFILESYS);
6335 		return FSF_TOO_MANY;
6336 	}
6337 	if (!add)
6338 		return FSF_NOT_FOUND;
6339 
6340 	++NumFileSys;
6341 	FILE_SYS_NAME(i) = name;
6342 	FILE_SYS_DEV(i) = st.st_dev;
6343 	FILE_SYS_AVAIL(i) = 0;
6344 	FILE_SYS_BLKSIZE(i) = 1024; /* avoid divide by zero */
6345 	return i;
6346 }
6347 
6348 /*
6349 **  FILESYS_SETUP -- set up mapping from queue directories to file systems
6350 **
6351 **	This data structure is used to efficiently check the amount of
6352 **	free space available in a set of queue directories.
6353 **
6354 **	Parameters:
6355 **		add -- initialize structure if necessary.
6356 **
6357 **	Returns:
6358 **		0: success
6359 **		<0: some error, i.e.,
6360 **		FSF_NOT_FOUND: not in list
6361 **		FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6362 **		FSF_TOO_MANY: too many filesystems (-> syserr())
6363 */
6364 
6365 static int filesys_setup __P((bool));
6366 
6367 static int
6368 filesys_setup(add)
6369 	bool add;
6370 {
6371 	int i, j;
6372 	short fs;
6373 	int ret;
6374 
6375 	ret = 0;
6376 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
6377 	{
6378 		for (j = 0; j < Queue[i]->qg_numqueues; ++j)
6379 		{
6380 			QPATHS *qp = &Queue[i]->qg_qpaths[j];
6381 			char qddf[MAXPATHLEN];
6382 
6383 			(void) sm_strlcpyn(qddf, sizeof qddf, 2, qp->qp_name,
6384 					(bitset(QP_SUBDF, qp->qp_subdirs)
6385 						? "/df" : ""));
6386 			fs = filesys_find(qp->qp_name, qddf, add);
6387 			if (fs >= 0)
6388 				qp->qp_fsysidx = fs;
6389 			else
6390 				qp->qp_fsysidx = 0;
6391 			if (fs < ret)
6392 				ret = fs;
6393 		}
6394 	}
6395 	return ret;
6396 }
6397 
6398 /*
6399 **  FILESYS_UPDATE -- update amount of free space on all file systems
6400 **
6401 **	The FileSys table is used to cache the amount of free space
6402 **	available on all queue directory file systems.
6403 **	This function updates the cached information if it has expired.
6404 **
6405 **	Parameters:
6406 **		none.
6407 **
6408 **	Returns:
6409 **		none.
6410 **
6411 **	Side Effects:
6412 **		Updates FileSys table.
6413 */
6414 
6415 void
6416 filesys_update()
6417 {
6418 	int i;
6419 	long avail, blksize;
6420 	time_t now;
6421 	static time_t nextupdate = 0;
6422 
6423 #if SM_CONF_SHM
6424 	if (ShmId != SM_SHM_NO_ID && DaemonPid != CurrentPid)
6425 		return;
6426 #endif /* SM_CONF_SHM */
6427 	now = curtime();
6428 	if (now < nextupdate)
6429 		return;
6430 	nextupdate = now + FILESYS_UPDATE_INTERVAL;
6431 	for (i = 0; i < NumFileSys; ++i)
6432 	{
6433 		FILESYS *fs = &FILE_SYS(i);
6434 
6435 		avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6436 		if (avail < 0 || blksize <= 0)
6437 		{
6438 			if (LogLevel > 5)
6439 				sm_syslog(LOG_ERR, NOQID,
6440 					"filesys_update failed: %s, fs=%s, avail=%ld, blocksize=%ld",
6441 					sm_errstring(errno),
6442 					FILE_SYS_NAME(i), avail, blksize);
6443 			fs->fs_avail = 0;
6444 			fs->fs_blksize = 1024; /* avoid divide by zero */
6445 			nextupdate = now + 2; /* let's do this soon again */
6446 		}
6447 		else
6448 		{
6449 			fs->fs_avail = avail;
6450 			fs->fs_blksize = blksize;
6451 		}
6452 	}
6453 }
6454 
6455 #if _FFR_ANY_FREE_FS
6456 /*
6457 **  FILESYS_FREE -- check whether there is at least one fs with enough space.
6458 **
6459 **	Parameters:
6460 **		fsize -- file size in bytes
6461 **
6462 **	Returns:
6463 **		true iff there is one fs with more than fsize bytes free.
6464 */
6465 
6466 bool
6467 filesys_free(fsize)
6468 	long fsize;
6469 {
6470 	int i;
6471 
6472 	if (fsize <= 0)
6473 		return true;
6474 	for (i = 0; i < NumFileSys; ++i)
6475 	{
6476 		long needed = 0;
6477 
6478 		if (FILE_SYS_AVAIL(i) < 0 || FILE_SYS_BLKSIZE(i) <= 0)
6479 			continue;
6480 		needed += fsize / FILE_SYS_BLKSIZE(i)
6481 			  + ((fsize % FILE_SYS_BLKSIZE(i)
6482 			      > 0) ? 1 : 0)
6483 			  + MinBlocksFree;
6484 		if (needed <= FILE_SYS_AVAIL(i))
6485 			return true;
6486 	}
6487 	return false;
6488 }
6489 #endif /* _FFR_ANY_FREE_FS */
6490 
6491 #if _FFR_CONTROL_MSTAT
6492 /*
6493 **  DISK_STATUS -- show amount of free space in queue directories
6494 **
6495 **	Parameters:
6496 **		out -- output file pointer.
6497 **		prefix -- string to output in front of each line.
6498 **
6499 **	Returns:
6500 **		none.
6501 */
6502 
6503 void
6504 disk_status(out, prefix)
6505 	SM_FILE_T *out;
6506 	char *prefix;
6507 {
6508 	int i;
6509 	long avail, blksize;
6510 	long free;
6511 
6512 	for (i = 0; i < NumFileSys; ++i)
6513 	{
6514 		avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6515 		if (avail >= 0 && blksize > 0)
6516 		{
6517 			free = (long)((double) avail *
6518 				((double) blksize / 1024));
6519 		}
6520 		else
6521 			free = -1;
6522 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
6523 				"%s%d/%s/%ld\r\n",
6524 				prefix, i,
6525 				FILE_SYS_NAME(i),
6526 					free);
6527 	}
6528 }
6529 #endif /* _FFR_CONTROL_MSTAT */
6530 
6531 #if SM_CONF_SHM
6532 
6533 /*
6534 **  INIT_SEM -- initialize semaphore system
6535 **
6536 **	Parameters:
6537 **		owner -- is this the owner of semaphores?
6538 **
6539 **	Returns:
6540 **		none.
6541 */
6542 
6543 #if _FFR_USE_SEM_LOCKING
6544 #if SM_CONF_SEM
6545 static int SemId = -1;		/* Semaphore Id */
6546 int SemKey = SM_SEM_KEY;
6547 #endif /* SM_CONF_SEM */
6548 #endif /* _FFR_USE_SEM_LOCKING */
6549 
6550 static void init_sem __P((bool));
6551 
6552 static void
6553 init_sem(owner)
6554 	bool owner;
6555 {
6556 #if _FFR_USE_SEM_LOCKING
6557 #if SM_CONF_SEM
6558 	SemId = sm_sem_start(SemKey, 1, 0, owner);
6559 	if (SemId < 0)
6560 	{
6561 		sm_syslog(LOG_ERR, NOQID,
6562 			"func=init_sem, sem_key=%ld, sm_sem_start=%d",
6563 			(long) SemKey, SemId);
6564 		return;
6565 	}
6566 #endif /* SM_CONF_SEM */
6567 #endif /* _FFR_USE_SEM_LOCKING */
6568 	return;
6569 }
6570 
6571 /*
6572 **  STOP_SEM -- stop semaphore system
6573 **
6574 **	Parameters:
6575 **		owner -- is this the owner of semaphores?
6576 **
6577 **	Returns:
6578 **		none.
6579 */
6580 
6581 static void stop_sem __P((bool));
6582 
6583 static void
6584 stop_sem(owner)
6585 	bool owner;
6586 {
6587 #if _FFR_USE_SEM_LOCKING
6588 #if SM_CONF_SEM
6589 	if (owner && SemId >= 0)
6590 		sm_sem_stop(SemId);
6591 #endif /* SM_CONF_SEM */
6592 #endif /* _FFR_USE_SEM_LOCKING */
6593 	return;
6594 }
6595 
6596 /*
6597 **  UPD_QS -- update information about queue when adding/deleting an entry
6598 **
6599 **	Parameters:
6600 **		e -- envelope.
6601 **		count -- add/remove entry (+1/0/-1: add/no change/remove)
6602 **		space -- update the space available as well.
6603 **			(>0/0/<0: add/no change/remove)
6604 **		where -- caller (for logging)
6605 **
6606 **	Returns:
6607 **		none.
6608 **
6609 **	Side Effects:
6610 **		Modifies available space in filesystem.
6611 **		Changes number of entries in queue directory.
6612 */
6613 
6614 void
6615 upd_qs(e, count, space, where)
6616 	ENVELOPE *e;
6617 	int count;
6618 	int space;
6619 	char *where;
6620 {
6621 	short fidx;
6622 	int idx;
6623 # if _FFR_USE_SEM_LOCKING
6624 	int r;
6625 # endif /* _FFR_USE_SEM_LOCKING */
6626 	long s;
6627 
6628 	if (ShmId == SM_SHM_NO_ID || e == NULL)
6629 		return;
6630 	if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
6631 		return;
6632 	idx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_idx;
6633 	if (tTd(73,2))
6634 		sm_dprintf("func=upd_qs, count=%d, space=%d, where=%s, idx=%d, entries=%d\n",
6635 			count, space, where, idx, QSHM_ENTRIES(idx));
6636 
6637 	/* XXX in theory this needs to be protected with a mutex */
6638 	if (QSHM_ENTRIES(idx) >= 0 && count != 0)
6639 	{
6640 # if _FFR_USE_SEM_LOCKING
6641 		r = sm_sem_acq(SemId, 0, 1);
6642 # endif /* _FFR_USE_SEM_LOCKING */
6643 		QSHM_ENTRIES(idx) += count;
6644 # if _FFR_USE_SEM_LOCKING
6645 		if (r >= 0)
6646 			r = sm_sem_rel(SemId, 0, 1);
6647 # endif /* _FFR_USE_SEM_LOCKING */
6648 	}
6649 
6650 	fidx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_fsysidx;
6651 	if (fidx < 0)
6652 		return;
6653 
6654 	/* update available space also?  (might be loseqfile) */
6655 	if (space == 0)
6656 		return;
6657 
6658 	/* convert size to blocks; this causes rounding errors */
6659 	s = e->e_msgsize / FILE_SYS_BLKSIZE(fidx);
6660 	if (s == 0)
6661 		return;
6662 
6663 	/* XXX in theory this needs to be protected with a mutex */
6664 	if (space > 0)
6665 		FILE_SYS_AVAIL(fidx) += s;
6666 	else
6667 		FILE_SYS_AVAIL(fidx) -= s;
6668 
6669 }
6670 
6671 #if _FFR_SELECT_SHM
6672 
6673 static bool write_key_file __P((char *, long));
6674 static long read_key_file __P((char *, long));
6675 
6676 /*
6677 **  WRITE_KEY_FILE -- record some key into a file.
6678 **
6679 **	Parameters:
6680 **		keypath -- file name.
6681 **		key -- key to write.
6682 **
6683 **	Returns:
6684 **		true iff file could be written.
6685 **
6686 **	Side Effects:
6687 **		writes file.
6688 */
6689 
6690 static bool
6691 write_key_file(keypath, key)
6692 	char *keypath;
6693 	long key;
6694 {
6695 	bool ok;
6696 	long sff;
6697 	SM_FILE_T *keyf;
6698 
6699 	ok = false;
6700 	if (keypath == NULL || *keypath == '\0')
6701 		return ok;
6702 	sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY|SFF_CREAT;
6703 	if (TrustedUid != 0 && RealUid == TrustedUid)
6704 		sff |= SFF_OPENASROOT;
6705 	keyf = safefopen(keypath, O_WRONLY|O_TRUNC, FileMode, sff);
6706 	if (keyf == NULL)
6707 	{
6708 		sm_syslog(LOG_ERR, NOQID, "unable to write %s: %s",
6709 			  keypath, sm_errstring(errno));
6710 	}
6711 	else
6712 	{
6713 		if (geteuid() == 0 && RunAsUid != 0)
6714 		{
6715 #  if HASFCHOWN
6716 			int fd;
6717 
6718 			fd = keyf->f_file;
6719 			if (fd >= 0 && fchown(fd, RunAsUid, -1) < 0)
6720 			{
6721 				int err = errno;
6722 
6723 				sm_syslog(LOG_ALERT, NOQID,
6724 					  "ownership change on %s to %d failed: %s",
6725 					  keypath, RunAsUid, sm_errstring(err));
6726 			}
6727 #  endif /* HASFCHOWN */
6728 		}
6729 		ok = sm_io_fprintf(keyf, SM_TIME_DEFAULT, "%ld\n", key) !=
6730 		     SM_IO_EOF;
6731 		ok = (sm_io_close(keyf, SM_TIME_DEFAULT) != SM_IO_EOF) && ok;
6732 	}
6733 	return ok;
6734 }
6735 
6736 /*
6737 **  READ_KEY_FILE -- read a key from a file.
6738 **
6739 **	Parameters:
6740 **		keypath -- file name.
6741 **		key -- default key.
6742 **
6743 **	Returns:
6744 **		key.
6745 */
6746 
6747 static long
6748 read_key_file(keypath, key)
6749 	char *keypath;
6750 	long key;
6751 {
6752 	int r;
6753 	long sff, n;
6754 	SM_FILE_T *keyf;
6755 
6756 	if (keypath == NULL || *keypath == '\0')
6757 		return key;
6758 	sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY;
6759 	if (RealUid == 0 || (TrustedUid != 0 && RealUid == TrustedUid))
6760 		sff |= SFF_OPENASROOT;
6761 	keyf = safefopen(keypath, O_RDONLY, FileMode, sff);
6762 	if (keyf == NULL)
6763 	{
6764 		sm_syslog(LOG_ERR, NOQID, "unable to read %s: %s",
6765 			  keypath, sm_errstring(errno));
6766 	}
6767 	else
6768 	{
6769 		r = sm_io_fscanf(keyf, SM_TIME_DEFAULT, "%ld", &n);
6770 		if (r == 1)
6771 			key = n;
6772 		(void) sm_io_close(keyf, SM_TIME_DEFAULT);
6773 	}
6774 	return key;
6775 }
6776 #endif /* _FFR_SELECT_SHM */
6777 
6778 /*
6779 **  INIT_SHM -- initialize shared memory structure
6780 **
6781 **	Initialize or attach to shared memory segment.
6782 **	Currently it is not a fatal error if this doesn't work.
6783 **	However, it causes us to have a "fallback" storage location
6784 **	for everything that is supposed to be in the shared memory,
6785 **	which makes the code slightly ugly.
6786 **
6787 **	Parameters:
6788 **		qn -- number of queue directories.
6789 **		owner -- owner of shared memory.
6790 **		hash -- identifies data that is stored in shared memory.
6791 **
6792 **	Returns:
6793 **		none.
6794 */
6795 
6796 static void init_shm __P((int, bool, unsigned int));
6797 
6798 static void
6799 init_shm(qn, owner, hash)
6800 	int qn;
6801 	bool owner;
6802 	unsigned int hash;
6803 {
6804 	int i;
6805 	int count;
6806 	int save_errno;
6807 #if _FFR_SELECT_SHM
6808 	bool keyselect;
6809 #endif /* _FFR_SELECT_SHM */
6810 
6811 	PtrFileSys = &FileSys[0];
6812 	PNumFileSys = &Numfilesys;
6813 #if _FFR_SELECT_SHM
6814 /* if this "key" is specified: select one yourself */
6815 # define SEL_SHM_KEY	((key_t) -1)
6816 # define FIRST_SHM_KEY	25
6817 #endif /* _FFR_SELECT_SHM */
6818 
6819 	/* This allows us to disable shared memory at runtime. */
6820 	if (ShmKey == 0)
6821 		return;
6822 
6823 	count = 0;
6824 	shms = SM_T_SIZE + qn * sizeof(QUEUE_SHM_T);
6825 #if _FFR_SELECT_SHM
6826 	keyselect = ShmKey == SEL_SHM_KEY;
6827 	if (keyselect)
6828 	{
6829 		if (owner)
6830 			ShmKey = FIRST_SHM_KEY;
6831 		else
6832 		{
6833 			ShmKey = read_key_file(ShmKeyFile, ShmKey);
6834 			keyselect = false;
6835 			if (ShmKey == SEL_SHM_KEY)
6836 				goto error;
6837 		}
6838 	}
6839 #endif /* _FFR_SELECT_SHM */
6840 	for (;;)
6841 	{
6842 		/* allow read/write access for group? */
6843 		Pshm = sm_shmstart(ShmKey, shms,
6844 				SHM_R|SHM_W|(SHM_R>>3)|(SHM_W>>3),
6845 				&ShmId, owner);
6846 		save_errno = errno;
6847 		if (Pshm != NULL || !sm_file_exists(save_errno))
6848 			break;
6849 		if (++count >= 3)
6850 		{
6851 #if _FFR_SELECT_SHM
6852 			if (keyselect)
6853 			{
6854 				++ShmKey;
6855 
6856 				/* back where we started? */
6857 				if (ShmKey == SEL_SHM_KEY)
6858 					break;
6859 				continue;
6860 			}
6861 #endif /* _FFR_SELECT_SHM */
6862 			break;
6863 		}
6864 #if _FFR_SELECT_SHM
6865 		/* only sleep if we are at the first key */
6866 		if (!keyselect || ShmKey == SEL_SHM_KEY)
6867 #endif /* _FFR_SELECT_SHM */
6868 		sleep(count);
6869 	}
6870 	if (Pshm != NULL)
6871 	{
6872 		int *p;
6873 
6874 #if _FFR_SELECT_SHM
6875 		if (keyselect)
6876 			(void) write_key_file(ShmKeyFile, (long) ShmKey);
6877 #endif /* _FFR_SELECT_SHM */
6878 		if (owner && RunAsUid != 0)
6879 		{
6880 			i = sm_shmsetowner(ShmId, RunAsUid, RunAsGid, 0660);
6881 			if (i != 0)
6882 				sm_syslog(LOG_ERR, NOQID,
6883 					"key=%ld, sm_shmsetowner=%d, RunAsUid=%d, RunAsGid=%d",
6884 					(long) ShmKey, i, RunAsUid, RunAsGid);
6885 		}
6886 		p = (int *) Pshm;
6887 		if (owner)
6888 		{
6889 			*p = (int) shms;
6890 			*((pid_t *) SHM_OFF_PID(Pshm)) = CurrentPid;
6891 			p = (int *) SHM_OFF_TAG(Pshm);
6892 			*p = hash;
6893 		}
6894 		else
6895 		{
6896 			if (*p != (int) shms)
6897 			{
6898 				save_errno = EINVAL;
6899 				cleanup_shm(false);
6900 				goto error;
6901 			}
6902 			p = (int *) SHM_OFF_TAG(Pshm);
6903 			if (*p != (int) hash)
6904 			{
6905 				save_errno = EINVAL;
6906 				cleanup_shm(false);
6907 				goto error;
6908 			}
6909 
6910 			/*
6911 			**  XXX how to check the pid?
6912 			**  Read it from the pid-file? That does
6913 			**  not need to exist.
6914 			**  We could disable shm if we can't confirm
6915 			**  that it is the right one.
6916 			*/
6917 		}
6918 
6919 		PtrFileSys = (FILESYS *) OFF_FILE_SYS(Pshm);
6920 		PNumFileSys = (int *) OFF_NUM_FILE_SYS(Pshm);
6921 		QShm = (QUEUE_SHM_T *) OFF_QUEUE_SHM(Pshm);
6922 		PRSATmpCnt = (int *) OFF_RSA_TMP_CNT(Pshm);
6923 		*PRSATmpCnt = 0;
6924 		if (owner)
6925 		{
6926 			/* initialize values in shared memory */
6927 			NumFileSys = 0;
6928 			for (i = 0; i < qn; i++)
6929 				QShm[i].qs_entries = -1;
6930 		}
6931 		init_sem(owner);
6932 		return;
6933 	}
6934   error:
6935 	if (LogLevel > (owner ? 8 : 11))
6936 	{
6937 		sm_syslog(owner ? LOG_ERR : LOG_NOTICE, NOQID,
6938 			  "can't %s shared memory, key=%ld: %s",
6939 			  owner ? "initialize" : "attach to",
6940 			  (long) ShmKey, sm_errstring(save_errno));
6941 	}
6942 }
6943 #endif /* SM_CONF_SHM */
6944 
6945 
6946 /*
6947 **  SETUP_QUEUES -- setup all queue groups
6948 **
6949 **	Parameters:
6950 **		owner -- owner of shared memory.
6951 **
6952 **	Returns:
6953 **		none.
6954 **
6955 #if SM_CONF_SHM
6956 **	Side Effects:
6957 **		attaches shared memory.
6958 #endif * SM_CONF_SHM *
6959 */
6960 
6961 void
6962 setup_queues(owner)
6963 	bool owner;
6964 {
6965 	int i, qn, len;
6966 	unsigned int hashval;
6967 	time_t now;
6968 	char basedir[MAXPATHLEN];
6969 	struct stat st;
6970 
6971 	/*
6972 	**  Determine basedir for all queue directories.
6973 	**  All queue directories must be (first level) subdirectories
6974 	**  of the basedir.  The basedir is the QueueDir
6975 	**  without wildcards, but with trailing /
6976 	*/
6977 
6978 	hashval = 0;
6979 	errno = 0;
6980 	len = sm_strlcpy(basedir, QueueDir, sizeof basedir);
6981 
6982 	/* Provide space for trailing '/' */
6983 	if (len >= sizeof basedir - 1)
6984 	{
6985 		syserr("QueueDirectory: path too long: %d,  max %d",
6986 			len, (int) sizeof basedir - 1);
6987 		ExitStat = EX_CONFIG;
6988 		return;
6989 	}
6990 	SM_ASSERT(len > 0);
6991 	if (basedir[len - 1] == '*')
6992 	{
6993 		char *cp;
6994 
6995 		cp = SM_LAST_DIR_DELIM(basedir);
6996 		if (cp == NULL)
6997 		{
6998 			syserr("QueueDirectory: can not wildcard relative path \"%s\"",
6999 				QueueDir);
7000 			if (tTd(41, 2))
7001 				sm_dprintf("setup_queues: \"%s\": Can not wildcard relative path.\n",
7002 					QueueDir);
7003 			ExitStat = EX_CONFIG;
7004 			return;
7005 		}
7006 
7007 		/* cut off wildcard pattern */
7008 		*++cp = '\0';
7009 		len = cp - basedir;
7010 	}
7011 	else if (!SM_IS_DIR_DELIM(basedir[len - 1]))
7012 	{
7013 		/* append trailing slash since it is a directory */
7014 		basedir[len] = '/';
7015 		basedir[++len] = '\0';
7016 	}
7017 
7018 	/* len counts up to the last directory delimiter */
7019 	SM_ASSERT(basedir[len - 1] == '/');
7020 
7021 	if (chdir(basedir) < 0)
7022 	{
7023 		int save_errno = errno;
7024 
7025 		syserr("can not chdir(%s)", basedir);
7026 		if (save_errno == EACCES)
7027 			(void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT,
7028 				"Program mode requires special privileges, e.g., root or TrustedUser.\n");
7029 		if (tTd(41, 2))
7030 			sm_dprintf("setup_queues: \"%s\": %s\n",
7031 				   basedir, sm_errstring(errno));
7032 		ExitStat = EX_CONFIG;
7033 		return;
7034 	}
7035 #if SM_CONF_SHM
7036 	hashval = hash_q(basedir, hashval);
7037 #endif /* SM_CONF_SHM */
7038 
7039 	/* initialize for queue runs */
7040 	DoQueueRun = false;
7041 	now = curtime();
7042 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
7043 		Queue[i]->qg_nextrun = now;
7044 
7045 
7046 	if (UseMSP && OpMode != MD_TEST)
7047 	{
7048 		long sff = SFF_CREAT;
7049 
7050 		if (stat(".", &st) < 0)
7051 		{
7052 			syserr("can not stat(%s)", basedir);
7053 			if (tTd(41, 2))
7054 				sm_dprintf("setup_queues: \"%s\": %s\n",
7055 					   basedir, sm_errstring(errno));
7056 			ExitStat = EX_CONFIG;
7057 			return;
7058 		}
7059 		if (RunAsUid == 0)
7060 			sff |= SFF_ROOTOK;
7061 
7062 		/*
7063 		**  Check queue directory permissions.
7064 		**	Can we write to a group writable queue directory?
7065 		*/
7066 
7067 		if (bitset(S_IWGRP, QueueFileMode) &&
7068 		    bitset(S_IWGRP, st.st_mode) &&
7069 		    safefile(" ", RunAsUid, RunAsGid, RunAsUserName, sff,
7070 			     QueueFileMode, NULL) != 0)
7071 		{
7072 			syserr("can not write to queue directory %s (RunAsGid=%d, required=%d)",
7073 				basedir, (int) RunAsGid, (int) st.st_gid);
7074 		}
7075 		if (bitset(S_IWOTH|S_IXOTH, st.st_mode))
7076 		{
7077 #if _FFR_MSP_PARANOIA
7078 			syserr("dangerous permissions=%o on queue directory %s",
7079 				(int) st.st_mode, basedir);
7080 #else /* _FFR_MSP_PARANOIA */
7081 			if (LogLevel > 0)
7082 				sm_syslog(LOG_ERR, NOQID,
7083 					  "dangerous permissions=%o on queue directory %s",
7084 					  (int) st.st_mode, basedir);
7085 #endif /* _FFR_MSP_PARANOIA */
7086 		}
7087 #if _FFR_MSP_PARANOIA
7088 		if (NumQueue > 1)
7089 			syserr("can not use multiple queues for MSP");
7090 #endif /* _FFR_MSP_PARANOIA */
7091 	}
7092 
7093 	/* initial number of queue directories */
7094 	qn = 0;
7095 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
7096 		qn = multiqueue_cache(basedir, len, Queue[i], qn, &hashval);
7097 
7098 #if SM_CONF_SHM
7099 	init_shm(qn, owner, hashval);
7100 	i = filesys_setup(owner || ShmId == SM_SHM_NO_ID);
7101 	if (i == FSF_NOT_FOUND)
7102 	{
7103 		/*
7104 		**  We didn't get the right filesystem data
7105 		**  This may happen if we don't have the right shared memory.
7106 		**  So let's do this without shared memory.
7107 		*/
7108 
7109 		SM_ASSERT(!owner);
7110 		cleanup_shm(false);	/* release shared memory */
7111 		i = filesys_setup(false);
7112 		if (i < 0)
7113 			syserr("filesys_setup failed twice, result=%d", i);
7114 		else if (LogLevel > 8)
7115 			sm_syslog(LOG_WARNING, NOQID,
7116 				  "shared memory does not contain expected data, ignored");
7117 	}
7118 #else /* SM_CONF_SHM */
7119 	i = filesys_setup(true);
7120 #endif /* SM_CONF_SHM */
7121 	if (i < 0)
7122 		ExitStat = EX_CONFIG;
7123 }
7124 
7125 #if SM_CONF_SHM
7126 /*
7127 **  CLEANUP_SHM -- do some cleanup work for shared memory etc
7128 **
7129 **	Parameters:
7130 **		owner -- owner of shared memory?
7131 **
7132 **	Returns:
7133 **		none.
7134 **
7135 **	Side Effects:
7136 **		detaches shared memory.
7137 */
7138 
7139 void
7140 cleanup_shm(owner)
7141 	bool owner;
7142 {
7143 	if (ShmId != SM_SHM_NO_ID)
7144 	{
7145 		if (sm_shmstop(Pshm, ShmId, owner) < 0 && LogLevel > 8)
7146 			sm_syslog(LOG_INFO, NOQID, "sm_shmstop failed=%s",
7147 				  sm_errstring(errno));
7148 		Pshm = NULL;
7149 		ShmId = SM_SHM_NO_ID;
7150 	}
7151 	stop_sem(owner);
7152 }
7153 #endif /* SM_CONF_SHM */
7154 
7155 /*
7156 **  CLEANUP_QUEUES -- do some cleanup work for queues
7157 **
7158 **	Parameters:
7159 **		none.
7160 **
7161 **	Returns:
7162 **		none.
7163 **
7164 */
7165 
7166 void
7167 cleanup_queues()
7168 {
7169 	sync_queue_time();
7170 }
7171 /*
7172 **  SET_DEF_QUEUEVAL -- set default values for a queue group.
7173 **
7174 **	Parameters:
7175 **		qg -- queue group
7176 **		all -- set all values (true for default group)?
7177 **
7178 **	Returns:
7179 **		none.
7180 **
7181 **	Side Effects:
7182 **		sets default values for the queue group.
7183 */
7184 
7185 void
7186 set_def_queueval(qg, all)
7187 	QUEUEGRP *qg;
7188 	bool all;
7189 {
7190 	if (bitnset(QD_DEFINED, qg->qg_flags))
7191 		return;
7192 	if (all)
7193 		qg->qg_qdir = QueueDir;
7194 #if _FFR_QUEUE_GROUP_SORTORDER
7195 	qg->qg_sortorder = QueueSortOrder;
7196 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7197 	qg->qg_maxqrun = all ? MaxRunnersPerQueue : -1;
7198 	qg->qg_nice = NiceQueueRun;
7199 }
7200 /*
7201 **  MAKEQUEUE -- define a new queue.
7202 **
7203 **	Parameters:
7204 **		line -- description of queue.  This is in labeled fields.
7205 **			The fields are:
7206 **			   F -- the flags associated with the queue
7207 **			   I -- the interval between running the queue
7208 **			   J -- the maximum # of jobs in work list
7209 **			   [M -- the maximum # of jobs in a queue run]
7210 **			   N -- the niceness at which to run
7211 **			   P -- the path to the queue
7212 **			   S -- the queue sorting order
7213 **			   R -- number of parallel queue runners
7214 **			   r -- max recipients per envelope
7215 **			The first word is the canonical name of the queue.
7216 **		qdef -- this is a 'Q' definition from .cf
7217 **
7218 **	Returns:
7219 **		none.
7220 **
7221 **	Side Effects:
7222 **		enters the queue into the queue table.
7223 */
7224 
7225 void
7226 makequeue(line, qdef)
7227 	char *line;
7228 	bool qdef;
7229 {
7230 	register char *p;
7231 	register QUEUEGRP *qg;
7232 	register STAB *s;
7233 	int i;
7234 	char fcode;
7235 
7236 	/* allocate a queue and set up defaults */
7237 	qg = (QUEUEGRP *) xalloc(sizeof *qg);
7238 	memset((char *) qg, '\0', sizeof *qg);
7239 
7240 	if (line[0] == '\0')
7241 	{
7242 		syserr("name required for queue");
7243 		return;
7244 	}
7245 
7246 	/* collect the queue name */
7247 	for (p = line;
7248 	     *p != '\0' && *p != ',' && !(isascii(*p) && isspace(*p));
7249 	     p++)
7250 		continue;
7251 	if (*p != '\0')
7252 		*p++ = '\0';
7253 	qg->qg_name = newstr(line);
7254 
7255 	/* set default values, can be overridden below */
7256 	set_def_queueval(qg, false);
7257 
7258 	/* now scan through and assign info from the fields */
7259 	while (*p != '\0')
7260 	{
7261 		auto char *delimptr;
7262 
7263 		while (*p != '\0' &&
7264 		       (*p == ',' || (isascii(*p) && isspace(*p))))
7265 			p++;
7266 
7267 		/* p now points to field code */
7268 		fcode = *p;
7269 		while (*p != '\0' && *p != '=' && *p != ',')
7270 			p++;
7271 		if (*p++ != '=')
7272 		{
7273 			syserr("queue %s: `=' expected", qg->qg_name);
7274 			return;
7275 		}
7276 		while (isascii(*p) && isspace(*p))
7277 			p++;
7278 
7279 		/* p now points to the field body */
7280 		p = munchstring(p, &delimptr, ',');
7281 
7282 		/* install the field into the queue struct */
7283 		switch (fcode)
7284 		{
7285 		  case 'P':		/* pathname */
7286 			if (*p == '\0')
7287 				syserr("queue %s: empty path name",
7288 					qg->qg_name);
7289 			else
7290 				qg->qg_qdir = newstr(p);
7291 			break;
7292 
7293 		  case 'F':		/* flags */
7294 			for (; *p != '\0'; p++)
7295 				if (!(isascii(*p) && isspace(*p)))
7296 					setbitn(*p, qg->qg_flags);
7297 			break;
7298 
7299 			/*
7300 			**  Do we need two intervals here:
7301 			**  One for persistent queue runners,
7302 			**  one for "normal" queue runs?
7303 			*/
7304 
7305 		  case 'I':	/* interval between running the queue */
7306 			qg->qg_queueintvl = convtime(p, 'm');
7307 			break;
7308 
7309 		  case 'N':		/* run niceness */
7310 			qg->qg_nice = atoi(p);
7311 			break;
7312 
7313 		  case 'R':		/* maximum # of runners for the group */
7314 			i = atoi(p);
7315 
7316 			/* can't have more runners than allowed total */
7317 			if (MaxQueueChildren > 0 && i > MaxQueueChildren)
7318 			{
7319 				qg->qg_maxqrun = MaxQueueChildren;
7320 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7321 						     "Q=%s: R=%d exceeds MaxQueueChildren=%d, set to MaxQueueChildren\n",
7322 						     qg->qg_name, i,
7323 						     MaxQueueChildren);
7324 			}
7325 			else
7326 				qg->qg_maxqrun = i;
7327 			break;
7328 
7329 		  case 'J':		/* maximum # of jobs in work list */
7330 			qg->qg_maxlist = atoi(p);
7331 			break;
7332 
7333 		  case 'r':		/* max recipients per envelope */
7334 			qg->qg_maxrcpt = atoi(p);
7335 			break;
7336 
7337 #if _FFR_QUEUE_GROUP_SORTORDER
7338 		  case 'S':		/* queue sorting order */
7339 			switch (*p)
7340 			{
7341 			  case 'h':	/* Host first */
7342 			  case 'H':
7343 				qg->qg_sortorder = QSO_BYHOST;
7344 				break;
7345 
7346 			  case 'p':	/* Priority order */
7347 			  case 'P':
7348 				qg->qg_sortorder = QSO_BYPRIORITY;
7349 				break;
7350 
7351 			  case 't':	/* Submission time */
7352 			  case 'T':
7353 				qg->qg_sortorder = QSO_BYTIME;
7354 				break;
7355 
7356 			  case 'f':	/* File name */
7357 			  case 'F':
7358 				qg->qg_sortorder = QSO_BYFILENAME;
7359 				break;
7360 
7361 			  case 'm':	/* Modification time */
7362 			  case 'M':
7363 				qg->qg_sortorder = QSO_BYMODTIME;
7364 				break;
7365 
7366 			  case 'r':	/* Random */
7367 			  case 'R':
7368 				qg->qg_sortorder = QSO_RANDOM;
7369 				break;
7370 
7371 # if _FFR_RHS
7372 			  case 's':	/* Shuffled host name */
7373 			  case 'S':
7374 				qg->qg_sortorder = QSO_BYSHUFFLE;
7375 				break;
7376 # endif /* _FFR_RHS */
7377 
7378 			  case 'n':	/* none */
7379 			  case 'N':
7380 				qg->qg_sortorder = QSO_NONE;
7381 				break;
7382 
7383 			  default:
7384 				syserr("Invalid queue sort order \"%s\"", p);
7385 			}
7386 			break;
7387 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7388 
7389 		  default:
7390 			syserr("Q%s: unknown queue equate %c=",
7391 			       qg->qg_name, fcode);
7392 			break;
7393 		}
7394 
7395 		p = delimptr;
7396 	}
7397 
7398 #if !HASNICE
7399 	if (qg->qg_nice != NiceQueueRun)
7400 	{
7401 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7402 				     "Q%s: Warning: N= set on system that doesn't support nice()\n",
7403 				     qg->qg_name);
7404 	}
7405 #endif /* !HASNICE */
7406 
7407 	/* do some rationality checking */
7408 	if (NumQueue >= MAXQUEUEGROUPS)
7409 	{
7410 		syserr("too many queue groups defined (%d max)",
7411 			MAXQUEUEGROUPS);
7412 		return;
7413 	}
7414 
7415 	if (qg->qg_qdir == NULL)
7416 	{
7417 		if (QueueDir == NULL || *QueueDir == '\0')
7418 		{
7419 			syserr("QueueDir must be defined before queue groups");
7420 			return;
7421 		}
7422 		qg->qg_qdir = newstr(QueueDir);
7423 	}
7424 
7425 	if (qg->qg_maxqrun > 1 && !bitnset(QD_FORK, qg->qg_flags))
7426 	{
7427 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7428 				     "Warning: Q=%s: R=%d: multiple queue runners specified\n\tbut flag '%c' is not set\n",
7429 				     qg->qg_name, qg->qg_maxqrun, QD_FORK);
7430 	}
7431 
7432 	/* enter the queue into the symbol table */
7433 	if (tTd(37, 8))
7434 		sm_syslog(LOG_INFO, NOQID,
7435 			  "Adding %s to stab, path: %s", qg->qg_name,
7436 			  qg->qg_qdir);
7437 	s = stab(qg->qg_name, ST_QUEUE, ST_ENTER);
7438 	if (s->s_quegrp != NULL)
7439 	{
7440 		i = s->s_quegrp->qg_index;
7441 
7442 		/* XXX what about the pointers inside this struct? */
7443 		sm_free(s->s_quegrp); /* XXX */
7444 	}
7445 	else
7446 		i = NumQueue++;
7447 	Queue[i] = s->s_quegrp = qg;
7448 	qg->qg_index = i;
7449 
7450 	/* set default value for max queue runners */
7451 	if (qg->qg_maxqrun < 0)
7452 	{
7453 		if (MaxRunnersPerQueue > 0)
7454 			qg->qg_maxqrun = MaxRunnersPerQueue;
7455 		else
7456 			qg->qg_maxqrun = 1;
7457 	}
7458 	if (qdef)
7459 		setbitn(QD_DEFINED, qg->qg_flags);
7460 }
7461 #if 0
7462 /*
7463 **  HASHFQN -- calculate a hash value for a fully qualified host name
7464 **
7465 **	Arguments:
7466 **		fqn -- an all lower-case host.domain string
7467 **		buckets -- the number of buckets (queue directories)
7468 **
7469 **	Returns:
7470 **		a bucket number (signed integer)
7471 **		-1 on error
7472 **
7473 **	Contributed by Exactis.com, Inc.
7474 */
7475 
7476 int
7477 hashfqn(fqn, buckets)
7478 	register char *fqn;
7479 	int buckets;
7480 {
7481 	register char *p;
7482 	register int h = 0, hash, cnt;
7483 
7484 	if (fqn == NULL)
7485 		return -1;
7486 
7487 	/*
7488 	**  A variation on the gdb hash
7489 	**  This is the best as of Feb 19, 1996 --bcx
7490 	*/
7491 
7492 	p = fqn;
7493 	h = 0x238F13AF * strlen(p);
7494 	for (cnt = 0; *p != 0; ++p, cnt++)
7495 	{
7496 		h = (h + (*p << (cnt * 5 % 24))) & 0x7FFFFFFF;
7497 	}
7498 	h = (1103515243 * h + 12345) & 0x7FFFFFFF;
7499 	if (buckets < 2)
7500 		hash = 0;
7501 	else
7502 		hash = (h % buckets);
7503 
7504 	return hash;
7505 }
7506 #endif /* 0 */
7507 
7508 /*
7509 **  A structure for sorting Queue according to maxqrun without
7510 **	screwing up Queue itself.
7511 */
7512 
7513 struct sortqgrp
7514 {
7515 	int sg_idx;		/* original index */
7516 	int sg_maxqrun;		/* max queue runners */
7517 };
7518 typedef struct sortqgrp	SORTQGRP_T;
7519 static int cmpidx __P((const void *, const void *));
7520 
7521 static int
7522 cmpidx(a, b)
7523 	const void *a;
7524 	const void *b;
7525 {
7526 	/* The sort is highest to lowest, so the comparison is reversed */
7527 	if (((SORTQGRP_T *)a)->sg_maxqrun < ((SORTQGRP_T *)b)->sg_maxqrun)
7528 		return 1;
7529 	else if (((SORTQGRP_T *)a)->sg_maxqrun > ((SORTQGRP_T *)b)->sg_maxqrun)
7530 		return -1;
7531 	else
7532 		return 0;
7533 }
7534 
7535 /*
7536 **  MAKEWORKGROUP -- balance queue groups into work groups per MaxQueueChildren
7537 **
7538 **  Take the now defined queue groups and assign them to work groups.
7539 **  This is done to balance out the number of concurrently active
7540 **  queue runners such that MaxQueueChildren is not exceeded. This may
7541 **  result in more than one queue group per work group. In such a case
7542 **  the number of running queue groups in that work group will have no
7543 **  more than the work group maximum number of runners (a "fair" portion
7544 **  of MaxQueueRunners). All queue groups within a work group will get a
7545 **  chance at running.
7546 **
7547 **	Parameters:
7548 **		none.
7549 **
7550 **	Returns:
7551 **		nothing.
7552 **
7553 **	Side Effects:
7554 **		Sets up WorkGrp structure.
7555 */
7556 
7557 void
7558 makeworkgroups()
7559 {
7560 	int i, j, total_runners, dir, h;
7561 	SORTQGRP_T si[MAXQUEUEGROUPS + 1];
7562 
7563 	total_runners = 0;
7564 	if (NumQueue == 1 && strcmp(Queue[0]->qg_name, "mqueue") == 0)
7565 	{
7566 		/*
7567 		**  There is only the "mqueue" queue group (a default)
7568 		**  containing all of the queues. We want to provide to
7569 		**  this queue group the maximum allowable queue runners.
7570 		**  To match older behavior (8.10/8.11) we'll try for
7571 		**  1 runner per queue capping it at MaxQueueChildren.
7572 		**  So if there are N queues, then there will be N runners
7573 		**  for the "mqueue" queue group (where N is kept less than
7574 		**  MaxQueueChildren).
7575 		*/
7576 
7577 		NumWorkGroups = 1;
7578 		WorkGrp[0].wg_numqgrp = 1;
7579 		WorkGrp[0].wg_qgs = (QUEUEGRP **) xalloc(sizeof(QUEUEGRP *));
7580 		WorkGrp[0].wg_qgs[0] = Queue[0];
7581 		if (MaxQueueChildren > 0 &&
7582 		    Queue[0]->qg_numqueues > MaxQueueChildren)
7583 			WorkGrp[0].wg_runners = MaxQueueChildren;
7584 		else
7585 			WorkGrp[0].wg_runners = Queue[0]->qg_numqueues;
7586 
7587 		Queue[0]->qg_wgrp = 0;
7588 
7589 		/* can't have more runners than allowed total */
7590 		if (MaxQueueChildren > 0 &&
7591 		    Queue[0]->qg_maxqrun > MaxQueueChildren)
7592 			Queue[0]->qg_maxqrun = MaxQueueChildren;
7593 		WorkGrp[0].wg_maxact = Queue[0]->qg_maxqrun;
7594 		WorkGrp[0].wg_lowqintvl = Queue[0]->qg_queueintvl;
7595 		return;
7596 	}
7597 
7598 	for (i = 0; i < NumQueue; i++)
7599 	{
7600 		si[i].sg_maxqrun = Queue[i]->qg_maxqrun;
7601 		si[i].sg_idx = i;
7602 	}
7603 	qsort(si, NumQueue, sizeof(si[0]), cmpidx);
7604 
7605 	NumWorkGroups = 0;
7606 	for (i = 0; i < NumQueue; i++)
7607 	{
7608 		total_runners += si[i].sg_maxqrun;
7609 		if (MaxQueueChildren <= 0 || total_runners <= MaxQueueChildren)
7610 			NumWorkGroups++;
7611 		else
7612 			break;
7613 	}
7614 
7615 	if (NumWorkGroups < 1)
7616 		NumWorkGroups = 1; /* gotta have one at least */
7617 	else if (NumWorkGroups > MAXWORKGROUPS)
7618 		NumWorkGroups = MAXWORKGROUPS; /* the limit */
7619 
7620 	/*
7621 	**  We now know the number of work groups to pack the queue groups
7622 	**  into. The queue groups in 'Queue' are sorted from highest
7623 	**  to lowest for the number of runners per queue group.
7624 	**  We put the queue groups with the largest number of runners
7625 	**  into work groups first. Then the smaller ones are fitted in
7626 	**  where it looks best.
7627 	*/
7628 
7629 	j = 0;
7630 	dir = 1;
7631 	for (i = 0; i < NumQueue; i++)
7632 	{
7633 		/* a to-and-fro packing scheme, continue from last position */
7634 		if (j >= NumWorkGroups)
7635 		{
7636 			dir = -1;
7637 			j = NumWorkGroups - 1;
7638 		}
7639 		else if (j < 0)
7640 		{
7641 			j = 0;
7642 			dir = 1;
7643 		}
7644 
7645 		if (WorkGrp[j].wg_qgs == NULL)
7646 			WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_malloc(sizeof(QUEUEGRP *) *
7647 							(WorkGrp[j].wg_numqgrp + 1));
7648 		else
7649 			WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_realloc(WorkGrp[j].wg_qgs,
7650 							sizeof(QUEUEGRP *) *
7651 							(WorkGrp[j].wg_numqgrp + 1));
7652 		if (WorkGrp[j].wg_qgs == NULL)
7653 		{
7654 			syserr("!cannot allocate memory for work queues, need %d bytes",
7655 			       (int) (sizeof(QUEUEGRP *) *
7656 				      (WorkGrp[j].wg_numqgrp + 1)));
7657 		}
7658 
7659 		h = si[i].sg_idx;
7660 		WorkGrp[j].wg_qgs[WorkGrp[j].wg_numqgrp] = Queue[h];
7661 		WorkGrp[j].wg_numqgrp++;
7662 		WorkGrp[j].wg_runners += Queue[h]->qg_maxqrun;
7663 		Queue[h]->qg_wgrp = j;
7664 
7665 		if (WorkGrp[j].wg_maxact == 0)
7666 		{
7667 			/* can't have more runners than allowed total */
7668 			if (MaxQueueChildren > 0 &&
7669 			    Queue[h]->qg_maxqrun > MaxQueueChildren)
7670 				Queue[h]->qg_maxqrun = MaxQueueChildren;
7671 			WorkGrp[j].wg_maxact = Queue[h]->qg_maxqrun;
7672 		}
7673 
7674 		/*
7675 		**  XXX: must wg_lowqintvl be the GCD?
7676 		**  qg1: 2m, qg2: 3m, minimum: 2m, when do queue runs for
7677 		**  qg2 occur?
7678 		*/
7679 
7680 		/* keep track of the lowest interval for a persistent runner */
7681 		if (Queue[h]->qg_queueintvl > 0 &&
7682 		    WorkGrp[j].wg_lowqintvl < Queue[h]->qg_queueintvl)
7683 			WorkGrp[j].wg_lowqintvl = Queue[h]->qg_queueintvl;
7684 		j += dir;
7685 	}
7686 	if (tTd(41, 9))
7687 	{
7688 		for (i = 0; i < NumWorkGroups; i++)
7689 		{
7690 			sm_dprintf("Workgroup[%d]=", i);
7691 			for (j = 0; j < WorkGrp[i].wg_numqgrp; j++)
7692 			{
7693 				sm_dprintf("%s, ",
7694 					WorkGrp[i].wg_qgs[j]->qg_name);
7695 			}
7696 			sm_dprintf("\n");
7697 		}
7698 	}
7699 }
7700 
7701 /*
7702 **  DUP_DF -- duplicate envelope data file
7703 **
7704 **	Copy the data file from the 'old' envelope to the 'new' envelope
7705 **	in the most efficient way possible.
7706 **
7707 **	Create a hard link from the 'old' data file to the 'new' data file.
7708 **	If the old and new queue directories are on different file systems,
7709 **	then the new data file link is created in the old queue directory,
7710 **	and the new queue file will contain a 'd' record pointing to the
7711 **	directory containing the new data file.
7712 **
7713 **	Parameters:
7714 **		old -- old envelope.
7715 **		new -- new envelope.
7716 **
7717 **	Results:
7718 **		Returns true on success, false on failure.
7719 **
7720 **	Side Effects:
7721 **		On success, the new data file is created.
7722 **		On fatal failure, EF_FATALERRS is set in old->e_flags.
7723 */
7724 
7725 static bool	dup_df __P((ENVELOPE *, ENVELOPE *));
7726 
7727 static bool
7728 dup_df(old, new)
7729 	ENVELOPE *old;
7730 	ENVELOPE *new;
7731 {
7732 	int ofs, nfs, r;
7733 	char opath[MAXPATHLEN];
7734 	char npath[MAXPATHLEN];
7735 
7736 	if (!bitset(EF_HAS_DF, old->e_flags))
7737 	{
7738 		/*
7739 		**  this can happen if: SuperSafe != True
7740 		**  and a bounce mail is sent that is split.
7741 		*/
7742 
7743 		queueup(old, false, true);
7744 	}
7745 	SM_REQUIRE(ISVALIDQGRP(old->e_qgrp) && ISVALIDQDIR(old->e_qdir));
7746 	SM_REQUIRE(ISVALIDQGRP(new->e_qgrp) && ISVALIDQDIR(new->e_qdir));
7747 
7748 	(void) sm_strlcpy(opath, queuename(old, DATAFL_LETTER), sizeof opath);
7749 	(void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof npath);
7750 
7751 	if (old->e_dfp != NULL)
7752 	{
7753 		r = sm_io_setinfo(old->e_dfp, SM_BF_COMMIT, NULL);
7754 		if (r < 0 && errno != EINVAL)
7755 		{
7756 			syserr("@can't commit %s", opath);
7757 			old->e_flags |= EF_FATALERRS;
7758 			return false;
7759 		}
7760 	}
7761 
7762 	/*
7763 	**  Attempt to create a hard link, if we think both old and new
7764 	**  are on the same file system, otherwise copy the file.
7765 	**
7766 	**  Don't waste time attempting a hard link unless old and new
7767 	**  are on the same file system.
7768 	*/
7769 
7770 	SM_REQUIRE(ISVALIDQGRP(old->e_dfqgrp) && ISVALIDQDIR(old->e_dfqdir));
7771 	SM_REQUIRE(ISVALIDQGRP(new->e_dfqgrp) && ISVALIDQDIR(new->e_dfqdir));
7772 
7773 	ofs = Queue[old->e_dfqgrp]->qg_qpaths[old->e_dfqdir].qp_fsysidx;
7774 	nfs = Queue[new->e_dfqgrp]->qg_qpaths[new->e_dfqdir].qp_fsysidx;
7775 	if (FILE_SYS_DEV(ofs) == FILE_SYS_DEV(nfs))
7776 	{
7777 		if (link(opath, npath) == 0)
7778 		{
7779 			new->e_flags |= EF_HAS_DF;
7780 			SYNC_DIR(npath, true);
7781 			return true;
7782 		}
7783 		goto error;
7784 	}
7785 
7786 	/*
7787 	**  Can't link across queue directories, so try to create a hard
7788 	**  link in the same queue directory as the old df file.
7789 	**  The qf file will refer to the new df file using a 'd' record.
7790 	*/
7791 
7792 	new->e_dfqgrp = old->e_dfqgrp;
7793 	new->e_dfqdir = old->e_dfqdir;
7794 	(void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof npath);
7795 	if (link(opath, npath) == 0)
7796 	{
7797 		new->e_flags |= EF_HAS_DF;
7798 		SYNC_DIR(npath, true);
7799 		return true;
7800 	}
7801 
7802   error:
7803 	if (LogLevel > 0)
7804 		sm_syslog(LOG_ERR, old->e_id,
7805 			  "dup_df: can't link %s to %s, error=%s, envelope splitting failed",
7806 			  opath, npath, sm_errstring(errno));
7807 	return false;
7808 }
7809 
7810 /*
7811 **  SPLIT_ENV -- Allocate a new envelope based on a given envelope.
7812 **
7813 **	Parameters:
7814 **		e -- envelope.
7815 **		sendqueue -- sendqueue for new envelope.
7816 **		qgrp -- index of queue group.
7817 **		qdir -- queue directory.
7818 **
7819 **	Results:
7820 **		new envelope.
7821 **
7822 */
7823 
7824 static ENVELOPE	*split_env __P((ENVELOPE *, ADDRESS *, int, int));
7825 
7826 static ENVELOPE *
7827 split_env(e, sendqueue, qgrp, qdir)
7828 	ENVELOPE *e;
7829 	ADDRESS *sendqueue;
7830 	int qgrp;
7831 	int qdir;
7832 {
7833 	ENVELOPE *ee;
7834 
7835 	ee = (ENVELOPE *) sm_rpool_malloc_x(e->e_rpool, sizeof *ee);
7836 	STRUCTCOPY(*e, *ee);
7837 	ee->e_message = NULL;	/* XXX use original message? */
7838 	ee->e_id = NULL;
7839 	assign_queueid(ee);
7840 	ee->e_sendqueue = sendqueue;
7841 	ee->e_flags &= ~(EF_INQUEUE|EF_CLRQUEUE|EF_FATALERRS
7842 			 |EF_SENDRECEIPT|EF_RET_PARAM|EF_HAS_DF);
7843 	ee->e_flags |= EF_NORECEIPT;	/* XXX really? */
7844 	ee->e_from.q_state = QS_SENDER;
7845 	ee->e_dfp = NULL;
7846 	ee->e_lockfp = NULL;
7847 	if (e->e_xfp != NULL)
7848 		ee->e_xfp = sm_io_dup(e->e_xfp);
7849 
7850 	/* failed to dup e->e_xfp, start a new transcript */
7851 	if (ee->e_xfp == NULL)
7852 		openxscript(ee);
7853 
7854 	ee->e_qgrp = ee->e_dfqgrp = qgrp;
7855 	ee->e_qdir = ee->e_dfqdir = qdir;
7856 	ee->e_errormode = EM_MAIL;
7857 	ee->e_statmsg = NULL;
7858 	if (e->e_quarmsg != NULL)
7859 		ee->e_quarmsg = sm_rpool_strdup_x(ee->e_rpool,
7860 						  e->e_quarmsg);
7861 
7862 	/*
7863 	**  XXX Not sure if this copying is necessary.
7864 	**  sendall() does this copying, but I (dm) don't know if that is
7865 	**  because of the storage management discipline we were using
7866 	**  before rpools were introduced, or if it is because these lists
7867 	**  can be modified later.
7868 	*/
7869 
7870 	ee->e_header = copyheader(e->e_header, ee->e_rpool);
7871 	ee->e_errorqueue = copyqueue(e->e_errorqueue, ee->e_rpool);
7872 
7873 	return ee;
7874 }
7875 
7876 /* return values from split functions, check also below! */
7877 #define SM_SPLIT_FAIL	(0)
7878 #define SM_SPLIT_NONE	(1)
7879 #define SM_SPLIT_NEW(n)	(1 + (n))
7880 
7881 /*
7882 **  SPLIT_ACROSS_QUEUE_GROUPS
7883 **
7884 **	This function splits an envelope across multiple queue groups
7885 **	based on the queue group of each recipient.
7886 **
7887 **	Parameters:
7888 **		e -- envelope.
7889 **
7890 **	Results:
7891 **		SM_SPLIT_FAIL on failure
7892 **		SM_SPLIT_NONE if no splitting occurred,
7893 **		or 1 + the number of additional envelopes created.
7894 **
7895 **	Side Effects:
7896 **		On success, e->e_sibling points to a list of zero or more
7897 **		additional envelopes, and the associated data files exist
7898 **		on disk.  But the queue files are not created.
7899 **
7900 **		On failure, e->e_sibling is not changed.
7901 **		The order of recipients in e->e_sendqueue is permuted.
7902 **		Abandoned data files for additional envelopes that failed
7903 **		to be created may exist on disk.
7904 */
7905 
7906 static int	q_qgrp_compare __P((const void *, const void *));
7907 static int	e_filesys_compare __P((const void *, const void *));
7908 
7909 static int
7910 q_qgrp_compare(p1, p2)
7911 	const void *p1;
7912 	const void *p2;
7913 {
7914 	ADDRESS **pq1 = (ADDRESS **) p1;
7915 	ADDRESS **pq2 = (ADDRESS **) p2;
7916 
7917 	return (*pq1)->q_qgrp - (*pq2)->q_qgrp;
7918 }
7919 
7920 static int
7921 e_filesys_compare(p1, p2)
7922 	const void *p1;
7923 	const void *p2;
7924 {
7925 	ENVELOPE **pe1 = (ENVELOPE **) p1;
7926 	ENVELOPE **pe2 = (ENVELOPE **) p2;
7927 	int fs1, fs2;
7928 
7929 	fs1 = Queue[(*pe1)->e_qgrp]->qg_qpaths[(*pe1)->e_qdir].qp_fsysidx;
7930 	fs2 = Queue[(*pe2)->e_qgrp]->qg_qpaths[(*pe2)->e_qdir].qp_fsysidx;
7931 	if (FILE_SYS_DEV(fs1) < FILE_SYS_DEV(fs2))
7932 		return -1;
7933 	if (FILE_SYS_DEV(fs1) > FILE_SYS_DEV(fs2))
7934 		return 1;
7935 	return 0;
7936 }
7937 
7938 static int
7939 split_across_queue_groups(e)
7940 	ENVELOPE *e;
7941 {
7942 	int naddrs, nsplits, i;
7943 	bool changed;
7944 	char **pvp;
7945 	ADDRESS *q, **addrs;
7946 	ENVELOPE *ee, *es;
7947 	ENVELOPE *splits[MAXQUEUEGROUPS];
7948 	char pvpbuf[PSBUFSIZE];
7949 
7950 	SM_REQUIRE(ISVALIDQGRP(e->e_qgrp));
7951 
7952 	/* Count addresses and assign queue groups. */
7953 	naddrs = 0;
7954 	changed = false;
7955 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
7956 	{
7957 		if (QS_IS_DEAD(q->q_state))
7958 			continue;
7959 		++naddrs;
7960 
7961 		/* bad addresses and those already sent stay put */
7962 		if (QS_IS_BADADDR(q->q_state) ||
7963 		    QS_IS_SENT(q->q_state))
7964 			q->q_qgrp = e->e_qgrp;
7965 		else if (!ISVALIDQGRP(q->q_qgrp))
7966 		{
7967 			/* call ruleset which should return a queue group */
7968 			i = rscap(RS_QUEUEGROUP, q->q_user, NULL, e, &pvp,
7969 				  pvpbuf, sizeof(pvpbuf));
7970 			if (i == EX_OK &&
7971 			    pvp != NULL && pvp[0] != NULL &&
7972 			    (pvp[0][0] & 0377) == CANONNET &&
7973 			    pvp[1] != NULL && pvp[1][0] != '\0')
7974 			{
7975 				i = name2qid(pvp[1]);
7976 				if (ISVALIDQGRP(i))
7977 				{
7978 					q->q_qgrp = i;
7979 					changed = true;
7980 					if (tTd(20, 4))
7981 						sm_syslog(LOG_INFO, NOQID,
7982 							"queue group name %s -> %d",
7983 							pvp[1], i);
7984 					continue;
7985 				}
7986 				else if (LogLevel > 10)
7987 					sm_syslog(LOG_INFO, NOQID,
7988 						"can't find queue group name %s, selection ignored",
7989 						pvp[1]);
7990 			}
7991 			if (q->q_mailer != NULL &&
7992 			    ISVALIDQGRP(q->q_mailer->m_qgrp))
7993 			{
7994 				changed = true;
7995 				q->q_qgrp = q->q_mailer->m_qgrp;
7996 			}
7997 			else if (ISVALIDQGRP(e->e_qgrp))
7998 				q->q_qgrp = e->e_qgrp;
7999 			else
8000 				q->q_qgrp = 0;
8001 		}
8002 	}
8003 
8004 	/* only one address? nothing to split. */
8005 	if (naddrs <= 1 && !changed)
8006 		return SM_SPLIT_NONE;
8007 
8008 	/* sort the addresses by queue group */
8009 	addrs = sm_rpool_malloc_x(e->e_rpool, naddrs * sizeof(ADDRESS *));
8010 	for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8011 	{
8012 		if (QS_IS_DEAD(q->q_state))
8013 			continue;
8014 		addrs[i++] = q;
8015 	}
8016 	qsort(addrs, naddrs, sizeof(ADDRESS *), q_qgrp_compare);
8017 
8018 	/* split into multiple envelopes, by queue group */
8019 	nsplits = 0;
8020 	es = NULL;
8021 	e->e_sendqueue = NULL;
8022 	for (i = 0; i < naddrs; ++i)
8023 	{
8024 		if (i == naddrs - 1 || addrs[i]->q_qgrp != addrs[i + 1]->q_qgrp)
8025 			addrs[i]->q_next = NULL;
8026 		else
8027 			addrs[i]->q_next = addrs[i + 1];
8028 
8029 		/* same queue group as original envelope? */
8030 		if (addrs[i]->q_qgrp == e->e_qgrp)
8031 		{
8032 			if (e->e_sendqueue == NULL)
8033 				e->e_sendqueue = addrs[i];
8034 			continue;
8035 		}
8036 
8037 		/* different queue group than original envelope */
8038 		if (es == NULL || addrs[i]->q_qgrp != es->e_qgrp)
8039 		{
8040 			ee = split_env(e, addrs[i], addrs[i]->q_qgrp, NOQDIR);
8041 			es = ee;
8042 			splits[nsplits++] = ee;
8043 		}
8044 	}
8045 
8046 	/* no splits? return right now. */
8047 	if (nsplits <= 0)
8048 		return SM_SPLIT_NONE;
8049 
8050 	/* assign a queue directory to each additional envelope */
8051 	for (i = 0; i < nsplits; ++i)
8052 	{
8053 		es = splits[i];
8054 #if 0
8055 		es->e_qdir = pickqdir(Queue[es->e_qgrp], es->e_msgsize, es);
8056 #endif /* 0 */
8057 		if (!setnewqueue(es))
8058 			goto failure;
8059 	}
8060 
8061 	/* sort the additional envelopes by queue file system */
8062 	qsort(splits, nsplits, sizeof(ENVELOPE *), e_filesys_compare);
8063 
8064 	/* create data files for each additional envelope */
8065 	if (!dup_df(e, splits[0]))
8066 	{
8067 		i = 0;
8068 		goto failure;
8069 	}
8070 	for (i = 1; i < nsplits; ++i)
8071 	{
8072 		/* copy or link to the previous data file */
8073 		if (!dup_df(splits[i - 1], splits[i]))
8074 			goto failure;
8075 	}
8076 
8077 	/* success: prepend the new envelopes to the e->e_sibling list */
8078 	for (i = 0; i < nsplits; ++i)
8079 	{
8080 		es = splits[i];
8081 		es->e_sibling = e->e_sibling;
8082 		e->e_sibling = es;
8083 	}
8084 	return SM_SPLIT_NEW(nsplits);
8085 
8086 	/* failure: clean up */
8087   failure:
8088 	if (i > 0)
8089 	{
8090 		int j;
8091 
8092 		for (j = 0; j < i; j++)
8093 			(void) unlink(queuename(splits[j], DATAFL_LETTER));
8094 	}
8095 	e->e_sendqueue = addrs[0];
8096 	for (i = 0; i < naddrs - 1; ++i)
8097 		addrs[i]->q_next = addrs[i + 1];
8098 	addrs[naddrs - 1]->q_next = NULL;
8099 	return SM_SPLIT_FAIL;
8100 }
8101 
8102 /*
8103 **  SPLIT_WITHIN_QUEUE
8104 **
8105 **	Split an envelope with multiple recipients into several
8106 **	envelopes within the same queue directory, if the number of
8107 **	recipients exceeds the limit for the queue group.
8108 **
8109 **	Parameters:
8110 **		e -- envelope.
8111 **
8112 **	Results:
8113 **		SM_SPLIT_FAIL on failure
8114 **		SM_SPLIT_NONE if no splitting occurred,
8115 **		or 1 + the number of additional envelopes created.
8116 */
8117 
8118 #define SPLIT_LOG_LEVEL	8
8119 
8120 static int	split_within_queue __P((ENVELOPE *));
8121 
8122 static int
8123 split_within_queue(e)
8124 	ENVELOPE *e;
8125 {
8126 	int maxrcpt, nrcpt, ndead, nsplit, i;
8127 	int j, l;
8128 	char *lsplits;
8129 	ADDRESS *q, **addrs;
8130 	ENVELOPE *ee, *firstsibling;
8131 
8132 	if (!ISVALIDQGRP(e->e_qgrp) || bitset(EF_SPLIT, e->e_flags))
8133 		return SM_SPLIT_NONE;
8134 
8135 	/* don't bother if there is no recipient limit */
8136 	maxrcpt = Queue[e->e_qgrp]->qg_maxrcpt;
8137 	if (maxrcpt <= 0)
8138 		return SM_SPLIT_NONE;
8139 
8140 	/* count recipients */
8141 	nrcpt = 0;
8142 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
8143 	{
8144 		if (QS_IS_DEAD(q->q_state))
8145 			continue;
8146 		++nrcpt;
8147 	}
8148 	if (nrcpt <= maxrcpt)
8149 		return SM_SPLIT_NONE;
8150 
8151 	/*
8152 	**  Preserve the recipient list
8153 	**  so that we can restore it in case of error.
8154 	**  (But we discard dead addresses.)
8155 	*/
8156 
8157 	addrs = sm_rpool_malloc_x(e->e_rpool, nrcpt * sizeof(ADDRESS *));
8158 	for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8159 	{
8160 		if (QS_IS_DEAD(q->q_state))
8161 			continue;
8162 		addrs[i++] = q;
8163 	}
8164 
8165 	/*
8166 	**  Partition the recipient list so that bad and sent addresses
8167 	**  come first. These will go with the original envelope, and
8168 	**  do not count towards the maxrcpt limit.
8169 	**  addrs[] does not contain QS_IS_DEAD() addresses.
8170 	*/
8171 
8172 	ndead = 0;
8173 	for (i = 0; i < nrcpt; ++i)
8174 	{
8175 		if (QS_IS_BADADDR(addrs[i]->q_state) ||
8176 		    QS_IS_SENT(addrs[i]->q_state) ||
8177 		    QS_IS_DEAD(addrs[i]->q_state)) /* for paranoia's sake */
8178 		{
8179 			if (i > ndead)
8180 			{
8181 				ADDRESS *tmp = addrs[i];
8182 
8183 				addrs[i] = addrs[ndead];
8184 				addrs[ndead] = tmp;
8185 			}
8186 			++ndead;
8187 		}
8188 	}
8189 
8190 	/* Check if no splitting required. */
8191 	if (nrcpt - ndead <= maxrcpt)
8192 		return SM_SPLIT_NONE;
8193 
8194 	/* fix links */
8195 	for (i = 0; i < nrcpt - 1; ++i)
8196 		addrs[i]->q_next = addrs[i + 1];
8197 	addrs[nrcpt - 1]->q_next = NULL;
8198 	e->e_sendqueue = addrs[0];
8199 
8200 	/* prepare buffer for logging */
8201 	if (LogLevel > SPLIT_LOG_LEVEL)
8202 	{
8203 		l = MAXLINE;
8204 		lsplits = sm_malloc(l);
8205 		if (lsplits != NULL)
8206 			*lsplits = '\0';
8207 		j = 0;
8208 	}
8209 	else
8210 	{
8211 		/* get rid of stupid compiler warnings */
8212 		lsplits = NULL;
8213 		j = l = 0;
8214 	}
8215 
8216 	/* split the envelope */
8217 	firstsibling = e->e_sibling;
8218 	i = maxrcpt + ndead;
8219 	nsplit = 0;
8220 	for (;;)
8221 	{
8222 		addrs[i - 1]->q_next = NULL;
8223 		ee = split_env(e, addrs[i], e->e_qgrp, e->e_qdir);
8224 		if (!dup_df(e, ee))
8225 		{
8226 
8227 			ee = firstsibling;
8228 			while (ee != NULL)
8229 			{
8230 				(void) unlink(queuename(ee, DATAFL_LETTER));
8231 				ee = ee->e_sibling;
8232 			}
8233 
8234 			/* Error.  Restore e's sibling & recipient lists. */
8235 			e->e_sibling = firstsibling;
8236 			for (i = 0; i < nrcpt - 1; ++i)
8237 				addrs[i]->q_next = addrs[i + 1];
8238 			if (lsplits != NULL)
8239 				sm_free(lsplits);
8240 			return SM_SPLIT_FAIL;
8241 		}
8242 
8243 		/* prepend the new envelope to e->e_sibling */
8244 		ee->e_sibling = e->e_sibling;
8245 		e->e_sibling = ee;
8246 		++nsplit;
8247 		if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8248 		{
8249 			if (j >= l - strlen(ee->e_id) - 3)
8250 			{
8251 				char *p;
8252 
8253 				l += MAXLINE;
8254 				p = sm_realloc(lsplits, l);
8255 				if (p == NULL)
8256 				{
8257 					/* let's try to get this done */
8258 					sm_free(lsplits);
8259 					lsplits = NULL;
8260 				}
8261 				else
8262 					lsplits = p;
8263 			}
8264 			if (lsplits != NULL)
8265 			{
8266 				if (j == 0)
8267 					j += sm_strlcat(lsplits + j,
8268 							ee->e_id,
8269 							l - j);
8270 				else
8271 					j += sm_strlcat2(lsplits + j,
8272 							 "; ",
8273 							 ee->e_id,
8274 							 l - j);
8275 				SM_ASSERT(j < l);
8276 			}
8277 		}
8278 		if (nrcpt - i <= maxrcpt)
8279 			break;
8280 		i += maxrcpt;
8281 	}
8282 	if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8283 	{
8284 		if (nsplit > 0)
8285 		{
8286 			sm_syslog(LOG_NOTICE, e->e_id,
8287 				  "split: maxrcpts=%d, rcpts=%d, count=%d, id%s=%s",
8288 				  maxrcpt, nrcpt - ndead, nsplit,
8289 				  nsplit > 1 ? "s" : "", lsplits);
8290 		}
8291 		sm_free(lsplits);
8292 	}
8293 	return SM_SPLIT_NEW(nsplit);
8294 }
8295 /*
8296 **  SPLIT_BY_RECIPIENT
8297 **
8298 **	Split an envelope with multiple recipients into multiple
8299 **	envelopes as required by the sendmail configuration.
8300 **
8301 **	Parameters:
8302 **		e -- envelope.
8303 **
8304 **	Results:
8305 **		Returns true on success, false on failure.
8306 **
8307 **	Side Effects:
8308 **		see split_across_queue_groups(), split_within_queue(e)
8309 */
8310 
8311 bool
8312 split_by_recipient(e)
8313 	ENVELOPE *e;
8314 {
8315 	int split, n, i, j, l;
8316 	char *lsplits;
8317 	ENVELOPE *ee, *next, *firstsibling;
8318 
8319 	if (OpMode == SM_VERIFY || !ISVALIDQGRP(e->e_qgrp) ||
8320 	    bitset(EF_SPLIT, e->e_flags))
8321 		return true;
8322 	n = split_across_queue_groups(e);
8323 	if (n == SM_SPLIT_FAIL)
8324 		return false;
8325 	firstsibling = ee = e->e_sibling;
8326 	if (n > 1 && LogLevel > SPLIT_LOG_LEVEL)
8327 	{
8328 		l = MAXLINE;
8329 		lsplits = sm_malloc(l);
8330 		if (lsplits != NULL)
8331 			*lsplits = '\0';
8332 		j = 0;
8333 	}
8334 	else
8335 	{
8336 		/* get rid of stupid compiler warnings */
8337 		lsplits = NULL;
8338 		j = l = 0;
8339 	}
8340 	for (i = 1; i < n; ++i)
8341 	{
8342 		next = ee->e_sibling;
8343 		if (split_within_queue(ee) == SM_SPLIT_FAIL)
8344 		{
8345 			e->e_sibling = firstsibling;
8346 			return false;
8347 		}
8348 		ee->e_flags |= EF_SPLIT;
8349 		if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8350 		{
8351 			if (j >= l - strlen(ee->e_id) - 3)
8352 			{
8353 				char *p;
8354 
8355 				l += MAXLINE;
8356 				p = sm_realloc(lsplits, l);
8357 				if (p == NULL)
8358 				{
8359 					/* let's try to get this done */
8360 					sm_free(lsplits);
8361 					lsplits = NULL;
8362 				}
8363 				else
8364 					lsplits = p;
8365 			}
8366 			if (lsplits != NULL)
8367 			{
8368 				if (j == 0)
8369 					j += sm_strlcat(lsplits + j,
8370 							ee->e_id, l - j);
8371 				else
8372 					j += sm_strlcat2(lsplits + j, "; ",
8373 							 ee->e_id, l - j);
8374 				SM_ASSERT(j < l);
8375 			}
8376 		}
8377 		ee = next;
8378 	}
8379 	if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL && n > 1)
8380 	{
8381 		sm_syslog(LOG_NOTICE, e->e_id, "split: count=%d, id%s=%s",
8382 			  n - 1, n > 2 ? "s" : "", lsplits);
8383 		sm_free(lsplits);
8384 	}
8385 	split = split_within_queue(e) != SM_SPLIT_FAIL;
8386 	if (split)
8387 		e->e_flags |= EF_SPLIT;
8388 	return split;
8389 }
8390 
8391 /*
8392 **  QUARANTINE_QUEUE_ITEM -- {un,}quarantine a single envelope
8393 **
8394 **	Add/remove quarantine reason and requeue appropriately.
8395 **
8396 **	Parameters:
8397 **		qgrp -- queue group for the item
8398 **		qdir -- queue directory in the given queue group
8399 **		e -- envelope information for the item
8400 **		reason -- quarantine reason, NULL means unquarantine.
8401 **
8402 **	Results:
8403 **		true if item changed, false otherwise
8404 **
8405 **	Side Effects:
8406 **		Changes quarantine tag in queue file and renames it.
8407 */
8408 
8409 static bool
8410 quarantine_queue_item(qgrp, qdir, e, reason)
8411 	int qgrp;
8412 	int qdir;
8413 	ENVELOPE *e;
8414 	char *reason;
8415 {
8416 	bool dirty = false;
8417 	bool failing = false;
8418 	bool foundq = false;
8419 	bool finished = false;
8420 	int fd;
8421 	int flags;
8422 	int oldtype;
8423 	int newtype;
8424 	int save_errno;
8425 	MODE_T oldumask = 0;
8426 	SM_FILE_T *oldqfp, *tempqfp;
8427 	char *bp;
8428 	char oldqf[MAXPATHLEN];
8429 	char tempqf[MAXPATHLEN];
8430 	char newqf[MAXPATHLEN];
8431 	char buf[MAXLINE];
8432 
8433 	oldtype = queue_letter(e, ANYQFL_LETTER);
8434 	(void) sm_strlcpy(oldqf, queuename(e, ANYQFL_LETTER), sizeof oldqf);
8435 	(void) sm_strlcpy(tempqf, queuename(e, NEWQFL_LETTER), sizeof tempqf);
8436 
8437 	/*
8438 	**  Instead of duplicating all the open
8439 	**  and lock code here, tell readqf() to
8440 	**  do that work and return the open
8441 	**  file pointer in e_lockfp.  Note that
8442 	**  we must release the locks properly when
8443 	**  we are done.
8444 	*/
8445 
8446 	if (!readqf(e, true))
8447 	{
8448 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8449 				     "Skipping %s\n", qid_printname(e));
8450 		return false;
8451 	}
8452 	oldqfp = e->e_lockfp;
8453 
8454 	/* open the new queue file */
8455 	flags = O_CREAT|O_WRONLY|O_EXCL;
8456 	if (bitset(S_IWGRP, QueueFileMode))
8457 		oldumask = umask(002);
8458 	fd = open(tempqf, flags, QueueFileMode);
8459 	if (bitset(S_IWGRP, QueueFileMode))
8460 		(void) umask(oldumask);
8461 	RELEASE_QUEUE;
8462 
8463 	if (fd < 0)
8464 	{
8465 		save_errno = errno;
8466 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8467 				     "Skipping %s: Could not open %s: %s\n",
8468 				     qid_printname(e), tempqf,
8469 				     sm_errstring(save_errno));
8470 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8471 		return false;
8472 	}
8473 	if (!lockfile(fd, tempqf, NULL, LOCK_EX|LOCK_NB))
8474 	{
8475 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8476 				     "Skipping %s: Could not lock %s\n",
8477 				     qid_printname(e), tempqf);
8478 		(void) close(fd);
8479 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8480 		return false;
8481 	}
8482 
8483 	tempqfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT, (void *) &fd,
8484 			     SM_IO_WRONLY_B, NULL);
8485 	if (tempqfp == NULL)
8486 	{
8487 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8488 				     "Skipping %s: Could not lock %s\n",
8489 				     qid_printname(e), tempqf);
8490 		(void) close(fd);
8491 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8492 		return false;
8493 	}
8494 
8495 	/* Copy the data over, changing the quarantine reason */
8496 	while ((bp = fgetfolded(buf, sizeof buf, oldqfp)) != NULL)
8497 	{
8498 		if (tTd(40, 4))
8499 			sm_dprintf("+++++ %s\n", bp);
8500 		switch (bp[0])
8501 		{
8502 		  case 'q':		/* quarantine reason */
8503 			foundq = true;
8504 			if (reason == NULL)
8505 			{
8506 				if (Verbose)
8507 				{
8508 					(void) sm_io_fprintf(smioout,
8509 							     SM_TIME_DEFAULT,
8510 							     "%s: Removed quarantine of \"%s\"\n",
8511 							     e->e_id, &bp[1]);
8512 				}
8513 				sm_syslog(LOG_INFO, e->e_id, "unquarantine");
8514 				dirty = true;
8515 				continue;
8516 			}
8517 			else if (strcmp(reason, &bp[1]) == 0)
8518 			{
8519 				if (Verbose)
8520 				{
8521 					(void) sm_io_fprintf(smioout,
8522 							     SM_TIME_DEFAULT,
8523 							     "%s: Already quarantined with \"%s\"\n",
8524 							     e->e_id, reason);
8525 				}
8526 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8527 						     "q%s\n", reason);
8528 			}
8529 			else
8530 			{
8531 				if (Verbose)
8532 				{
8533 					(void) sm_io_fprintf(smioout,
8534 							     SM_TIME_DEFAULT,
8535 							     "%s: Quarantine changed from \"%s\" to \"%s\"\n",
8536 							     e->e_id, &bp[1],
8537 							     reason);
8538 				}
8539 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8540 						     "q%s\n", reason);
8541 				sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8542 					  reason);
8543 				dirty = true;
8544 			}
8545 			break;
8546 
8547 		  case 'S':
8548 			/*
8549 			**  If we are quarantining an unquarantined item,
8550 			**  need to put in a new 'q' line before it's
8551 			**  too late.
8552 			*/
8553 
8554 			if (!foundq && reason != NULL)
8555 			{
8556 				if (Verbose)
8557 				{
8558 					(void) sm_io_fprintf(smioout,
8559 							     SM_TIME_DEFAULT,
8560 							     "%s: Quarantined with \"%s\"\n",
8561 							     e->e_id, reason);
8562 				}
8563 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8564 						     "q%s\n", reason);
8565 				sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8566 					  reason);
8567 				foundq = true;
8568 				dirty = true;
8569 			}
8570 
8571 			/* Copy the line to the new file */
8572 			(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8573 					     "%s\n", bp);
8574 			break;
8575 
8576 		  case '.':
8577 			finished = true;
8578 			/* FALLTHROUGH */
8579 
8580 		  default:
8581 			/* Copy the line to the new file */
8582 			(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8583 					     "%s\n", bp);
8584 			break;
8585 		}
8586 	}
8587 
8588 	/* Make sure we read the whole old file */
8589 	errno = sm_io_error(tempqfp);
8590 	if (errno != 0 && errno != SM_IO_EOF)
8591 	{
8592 		save_errno = errno;
8593 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8594 				     "Skipping %s: Error reading %s: %s\n",
8595 				     qid_printname(e), oldqf,
8596 				     sm_errstring(save_errno));
8597 		failing = true;
8598 	}
8599 
8600 	if (!failing && !finished)
8601 	{
8602 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8603 				     "Skipping %s: Incomplete file: %s\n",
8604 				     qid_printname(e), oldqf);
8605 		failing = true;
8606 	}
8607 
8608 	/* Check if we actually changed anything or we can just bail now */
8609 	if (!dirty)
8610 	{
8611 		/* pretend we failed, even though we technically didn't */
8612 		failing = true;
8613 	}
8614 
8615 	/* Make sure we wrote things out safely */
8616 	if (!failing &&
8617 	    (sm_io_flush(tempqfp, SM_TIME_DEFAULT) != 0 ||
8618 	     ((SuperSafe == SAFE_REALLY ||
8619 	       SuperSafe == SAFE_REALLY_POSTMILTER ||
8620 	       SuperSafe == SAFE_INTERACTIVE) &&
8621 	      fsync(sm_io_getinfo(tempqfp, SM_IO_WHAT_FD, NULL)) < 0) ||
8622 	     ((errno = sm_io_error(tempqfp)) != 0)))
8623 	{
8624 		save_errno = errno;
8625 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8626 				     "Skipping %s: Error writing %s: %s\n",
8627 				     qid_printname(e), tempqf,
8628 				     sm_errstring(save_errno));
8629 		failing = true;
8630 	}
8631 
8632 
8633 	/* Figure out the new filename */
8634 	newtype = (reason == NULL ? NORMQF_LETTER : QUARQF_LETTER);
8635 	if (oldtype == newtype)
8636 	{
8637 		/* going to rename tempqf to oldqf */
8638 		(void) sm_strlcpy(newqf, oldqf, sizeof newqf);
8639 	}
8640 	else
8641 	{
8642 		/* going to rename tempqf to new name based on newtype */
8643 		(void) sm_strlcpy(newqf, queuename(e, newtype), sizeof newqf);
8644 	}
8645 
8646 	save_errno = 0;
8647 
8648 	/* rename tempqf to newqf */
8649 	if (!failing &&
8650 	    rename(tempqf, newqf) < 0)
8651 		save_errno = (errno == 0) ? EINVAL : errno;
8652 
8653 	/* Check rename() success */
8654 	if (!failing && save_errno != 0)
8655 	{
8656 		sm_syslog(LOG_DEBUG, e->e_id,
8657 			  "quarantine_queue_item: rename(%s, %s): %s",
8658 			  tempqf, newqf, sm_errstring(save_errno));
8659 
8660 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8661 				     "Error renaming %s to %s: %s\n",
8662 				     tempqf, newqf,
8663 				     sm_errstring(save_errno));
8664 		if (oldtype == newtype)
8665 		{
8666 			/*
8667 			**  Bail here since we don't know the state of
8668 			**  the filesystem and may need to keep tempqf
8669 			**  for the user to rescue us.
8670 			*/
8671 
8672 			RELEASE_QUEUE;
8673 			errno = save_errno;
8674 			syserr("!452 Error renaming control file %s", tempqf);
8675 			/* NOTREACHED */
8676 		}
8677 		else
8678 		{
8679 			/* remove new file (if rename() half completed) */
8680 			if (xunlink(newqf) < 0)
8681 			{
8682 				save_errno = errno;
8683 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8684 						     "Error removing %s: %s\n",
8685 						     newqf,
8686 						     sm_errstring(save_errno));
8687 			}
8688 
8689 			/* tempqf removed below */
8690 			failing = true;
8691 		}
8692 
8693 	}
8694 
8695 	/* If changing file types, need to remove old type */
8696 	if (!failing && oldtype != newtype)
8697 	{
8698 		if (xunlink(oldqf) < 0)
8699 		{
8700 			save_errno = errno;
8701 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8702 					     "Error removing %s: %s\n",
8703 					     oldqf, sm_errstring(save_errno));
8704 		}
8705 	}
8706 
8707 	/* see if anything above failed */
8708 	if (failing)
8709 	{
8710 		/* Something failed: remove new file, old file still there */
8711 		(void) xunlink(tempqf);
8712 	}
8713 
8714 	/*
8715 	**  fsync() after file operations to make sure metadata is
8716 	**  written to disk on filesystems in which renames are
8717 	**  not guaranteed.  It's ok if they fail, mail won't be lost.
8718 	*/
8719 
8720 	if (SuperSafe != SAFE_NO)
8721 	{
8722 		/* for soft-updates */
8723 		(void) fsync(sm_io_getinfo(tempqfp,
8724 					   SM_IO_WHAT_FD, NULL));
8725 
8726 		if (!failing)
8727 		{
8728 			/* for soft-updates */
8729 			(void) fsync(sm_io_getinfo(oldqfp,
8730 						   SM_IO_WHAT_FD, NULL));
8731 		}
8732 
8733 		/* for other odd filesystems */
8734 		SYNC_DIR(tempqf, false);
8735 	}
8736 
8737 	/* Close up shop */
8738 	RELEASE_QUEUE;
8739 	if (tempqfp != NULL)
8740 		(void) sm_io_close(tempqfp, SM_TIME_DEFAULT);
8741 	if (oldqfp != NULL)
8742 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8743 
8744 	/* All went well */
8745 	return !failing;
8746 }
8747 
8748 /*
8749 **  QUARANTINE_QUEUE -- {un,}quarantine matching items in the queue
8750 **
8751 **	Read all matching queue items, add/remove quarantine
8752 **	reason, and requeue appropriately.
8753 **
8754 **	Parameters:
8755 **		reason -- quarantine reason, "." means unquarantine.
8756 **		qgrplimit -- limit to single queue group unless NOQGRP
8757 **
8758 **	Results:
8759 **		none.
8760 **
8761 **	Side Effects:
8762 **		Lots of changes to the queue.
8763 */
8764 
8765 void
8766 quarantine_queue(reason, qgrplimit)
8767 	char *reason;
8768 	int qgrplimit;
8769 {
8770 	int changed = 0;
8771 	int qgrp;
8772 
8773 	/* Convert internal representation of unquarantine */
8774 	if (reason != NULL && reason[0] == '.' && reason[1] == '\0')
8775 		reason = NULL;
8776 
8777 	if (reason != NULL)
8778 	{
8779 		/* clean it */
8780 		reason = newstr(denlstring(reason, true, true));
8781 	}
8782 
8783 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
8784 	{
8785 		int qdir;
8786 
8787 		if (qgrplimit != NOQGRP && qgrplimit != qgrp)
8788 			continue;
8789 
8790 		for (qdir = 0; qdir < Queue[qgrp]->qg_numqueues; qdir++)
8791 		{
8792 			int i;
8793 			int nrequests;
8794 
8795 			if (StopRequest)
8796 				stop_sendmail();
8797 
8798 			nrequests = gatherq(qgrp, qdir, true, NULL, NULL);
8799 
8800 			/* first see if there is anything */
8801 			if (nrequests <= 0)
8802 			{
8803 				if (Verbose)
8804 				{
8805 					(void) sm_io_fprintf(smioout,
8806 							     SM_TIME_DEFAULT, "%s: no matches\n",
8807 							     qid_printqueue(qgrp, qdir));
8808 				}
8809 				continue;
8810 			}
8811 
8812 			if (Verbose)
8813 			{
8814 				(void) sm_io_fprintf(smioout,
8815 						     SM_TIME_DEFAULT, "Processing %s:\n",
8816 						     qid_printqueue(qgrp, qdir));
8817 			}
8818 
8819 			for (i = 0; i < WorkListCount; i++)
8820 			{
8821 				ENVELOPE e;
8822 
8823 				if (StopRequest)
8824 					stop_sendmail();
8825 
8826 				/* setup envelope */
8827 				clearenvelope(&e, true, sm_rpool_new_x(NULL));
8828 				e.e_id = WorkList[i].w_name + 2;
8829 				e.e_qgrp = qgrp;
8830 				e.e_qdir = qdir;
8831 
8832 				if (tTd(70, 101))
8833 				{
8834 					sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8835 						      "Would do %s\n", e.e_id);
8836 					changed++;
8837 				}
8838 				else if (quarantine_queue_item(qgrp, qdir,
8839 							       &e, reason))
8840 					changed++;
8841 
8842 				/* clean up */
8843 				sm_rpool_free(e.e_rpool);
8844 				e.e_rpool = NULL;
8845 			}
8846 			if (WorkList != NULL)
8847 				sm_free(WorkList); /* XXX */
8848 			WorkList = NULL;
8849 			WorkListSize = 0;
8850 			WorkListCount = 0;
8851 		}
8852 	}
8853 	if (Verbose)
8854 	{
8855 		if (changed == 0)
8856 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8857 					     "No changes\n");
8858 		else
8859 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8860 					     "%d change%s\n",
8861 					     changed,
8862 					     changed == 1 ? "" : "s");
8863 	}
8864 }
8865