xref: /illumos-gate/usr/src/cmd/sendmail/src/queue.c (revision 3ee0e492)
1 /*
2  * Copyright (c) 1998-2006 Sendmail, Inc. and its suppliers.
3  *	All rights reserved.
4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
5  * Copyright (c) 1988, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * By using this file, you agree to the terms and conditions set
9  * forth in the LICENSE file which can be found at the top level of
10  * the sendmail distribution.
11  *
12  */
13 
14 #pragma ident	"%Z%%M%	%I%	%E% SMI"
15 
16 #include <sendmail.h>
17 #include <sm/sem.h>
18 
19 SM_RCSID("@(#)$Id: queue.c,v 8.954 2006/04/22 01:07:00 ca Exp $")
20 
21 #include <dirent.h>
22 
23 # define RELEASE_QUEUE	(void) 0
24 # define ST_INODE(st)	(st).st_ino
25 
26 #  define sm_file_exists(errno) ((errno) == EEXIST)
27 
28 # if HASFLOCK && defined(O_EXLOCK)
29 #   define SM_OPEN_EXLOCK 1
30 #   define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL|O_EXLOCK)
31 # else /* HASFLOCK && defined(O_EXLOCK) */
32 #  define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL)
33 # endif /* HASFLOCK && defined(O_EXLOCK) */
34 
35 #ifndef SM_OPEN_EXLOCK
36 # define SM_OPEN_EXLOCK 0
37 #endif /* ! SM_OPEN_EXLOCK */
38 
39 /*
40 **  Historical notes:
41 **	QF_VERSION == 4 was sendmail 8.10/8.11 without _FFR_QUEUEDELAY
42 **	QF_VERSION == 5 was sendmail 8.10/8.11 with    _FFR_QUEUEDELAY
43 **	QF_VERSION == 6 was sendmail 8.12      without _FFR_QUEUEDELAY
44 **	QF_VERSION == 7 was sendmail 8.12      with    _FFR_QUEUEDELAY
45 **	QF_VERSION == 8 is  sendmail 8.13
46 */
47 
48 #define QF_VERSION	8	/* version number of this queue format */
49 
50 static char	queue_letter __P((ENVELOPE *, int));
51 static bool	quarantine_queue_item __P((int, int, ENVELOPE *, char *));
52 
53 /* Naming convention: qgrp: index of queue group, qg: QUEUEGROUP */
54 
55 /*
56 **  Work queue.
57 */
58 
59 struct work
60 {
61 	char		*w_name;	/* name of control file */
62 	char		*w_host;	/* name of recipient host */
63 	bool		w_lock;		/* is message locked? */
64 	bool		w_tooyoung;	/* is it too young to run? */
65 	long		w_pri;		/* priority of message, see below */
66 	time_t		w_ctime;	/* creation time */
67 	time_t		w_mtime;	/* modification time */
68 	int		w_qgrp;		/* queue group located in */
69 	int		w_qdir;		/* queue directory located in */
70 	struct work	*w_next;	/* next in queue */
71 };
72 
73 typedef struct work	WORK;
74 
75 static WORK	*WorkQ;		/* queue of things to be done */
76 static int	NumWorkGroups;	/* number of work groups */
77 static time_t	Current_LA_time = 0;
78 
79 /* Get new load average every 30 seconds. */
80 #define GET_NEW_LA_TIME	30
81 
82 #define SM_GET_LA(now)	\
83 	do							\
84 	{							\
85 		now = curtime();				\
86 		if (Current_LA_time < now - GET_NEW_LA_TIME)	\
87 		{						\
88 			sm_getla();				\
89 			Current_LA_time = now;			\
90 		}						\
91 	} while (0)
92 
93 /*
94 **  DoQueueRun indicates that a queue run is needed.
95 **	Notice: DoQueueRun is modified in a signal handler!
96 */
97 
98 static bool	volatile DoQueueRun; /* non-interrupt time queue run needed */
99 
100 /*
101 **  Work group definition structure.
102 **	Each work group contains one or more queue groups. This is done
103 **	to manage the number of queue group runners active at the same time
104 **	to be within the constraints of MaxQueueChildren (if it is set).
105 **	The number of queue groups that can be run on the next work run
106 **	is kept track of. The queue groups are run in a round robin.
107 */
108 
109 struct workgrp
110 {
111 	int		wg_numqgrp;	/* number of queue groups in work grp */
112 	int		wg_runners;	/* total runners */
113 	int		wg_curqgrp;	/* current queue group */
114 	QUEUEGRP	**wg_qgs;	/* array of queue groups */
115 	int		wg_maxact;	/* max # of active runners */
116 	time_t		wg_lowqintvl;	/* lowest queue interval */
117 	int		wg_restart;	/* needs restarting? */
118 	int		wg_restartcnt;	/* count of times restarted */
119 };
120 
121 typedef struct workgrp WORKGRP;
122 
123 static WORKGRP	volatile WorkGrp[MAXWORKGROUPS + 1];	/* work groups */
124 
125 #if SM_HEAP_CHECK
126 static SM_DEBUG_T DebugLeakQ = SM_DEBUG_INITIALIZER("leak_q",
127 	"@(#)$Debug: leak_q - trace memory leaks during queue processing $");
128 #endif /* SM_HEAP_CHECK */
129 
130 /*
131 **  We use EmptyString instead of "" to avoid
132 **  'zero-length format string' warnings from gcc
133 */
134 
135 static const char EmptyString[] = "";
136 
137 static void	grow_wlist __P((int, int));
138 static int	multiqueue_cache __P((char *, int, QUEUEGRP *, int, unsigned int *));
139 static int	gatherq __P((int, int, bool, bool *, bool *));
140 static int	sortq __P((int));
141 static void	printctladdr __P((ADDRESS *, SM_FILE_T *));
142 static bool	readqf __P((ENVELOPE *, bool));
143 static void	restart_work_group __P((int));
144 static void	runner_work __P((ENVELOPE *, int, bool, int, int));
145 static void	schedule_queue_runs __P((bool, int, bool));
146 static char	*strrev __P((char *));
147 static ADDRESS	*setctluser __P((char *, int, ENVELOPE *));
148 #if _FFR_RHS
149 static int	sm_strshufflecmp __P((char *, char *));
150 static void	init_shuffle_alphabet __P(());
151 #endif /* _FFR_RHS */
152 static int	workcmpf0();
153 static int	workcmpf1();
154 static int	workcmpf2();
155 static int	workcmpf3();
156 static int	workcmpf4();
157 static int	randi = 3;	/* index for workcmpf5() */
158 static int	workcmpf5();
159 static int	workcmpf6();
160 #if _FFR_RHS
161 static int	workcmpf7();
162 #endif /* _FFR_RHS */
163 
164 #if RANDOMSHIFT
165 # define get_rand_mod(m)	((get_random() >> RANDOMSHIFT) % (m))
166 #else /* RANDOMSHIFT */
167 # define get_rand_mod(m)	(get_random() % (m))
168 #endif /* RANDOMSHIFT */
169 
170 /*
171 **  File system definition.
172 **	Used to keep track of how much free space is available
173 **	on a file system in which one or more queue directories reside.
174 */
175 
176 typedef struct filesys_shared	FILESYS;
177 
178 struct filesys_shared
179 {
180 	dev_t	fs_dev;		/* unique device id */
181 	long	fs_avail;	/* number of free blocks available */
182 	long	fs_blksize;	/* block size, in bytes */
183 };
184 
185 /* probably kept in shared memory */
186 static FILESYS	FileSys[MAXFILESYS];	/* queue file systems */
187 static char	*FSPath[MAXFILESYS];	/* pathnames for file systems */
188 
189 #if SM_CONF_SHM
190 
191 /*
192 **  Shared memory data
193 **
194 **  Current layout:
195 **	size -- size of shared memory segment
196 **	pid -- pid of owner, should be a unique id to avoid misinterpretations
197 **		by other processes.
198 **	tag -- should be a unique id to avoid misinterpretations by others.
199 **		idea: hash over configuration data that will be stored here.
200 **	NumFileSys -- number of file systems.
201 **	FileSys -- (arrary of) structure for used file systems.
202 **	RSATmpCnt -- counter for number of uses of ephemeral RSA key.
203 **	QShm -- (array of) structure for information about queue directories.
204 */
205 
206 /*
207 **  Queue data in shared memory
208 */
209 
210 typedef struct queue_shared	QUEUE_SHM_T;
211 
212 struct queue_shared
213 {
214 	int	qs_entries;	/* number of entries */
215 	/* XXX more to follow? */
216 };
217 
218 static void	*Pshm;		/* pointer to shared memory */
219 static FILESYS	*PtrFileSys;	/* pointer to queue file system array */
220 int		ShmId = SM_SHM_NO_ID;	/* shared memory id */
221 static QUEUE_SHM_T	*QShm;		/* pointer to shared queue data */
222 static size_t shms;
223 
224 # define SHM_OFF_PID(p)	(((char *) (p)) + sizeof(int))
225 # define SHM_OFF_TAG(p)	(((char *) (p)) + sizeof(pid_t) + sizeof(int))
226 # define SHM_OFF_HEAD	(sizeof(pid_t) + sizeof(int) * 2)
227 
228 /* how to access FileSys */
229 # define FILE_SYS(i)	(PtrFileSys[i])
230 
231 /* first entry is a tag, for now just the size */
232 # define OFF_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD)
233 
234 /* offset for PNumFileSys */
235 # define OFF_NUM_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys))
236 
237 /* offset for PRSATmpCnt */
238 # define OFF_RSA_TMP_CNT(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int))
239 int	*PRSATmpCnt;
240 
241 /* offset for queue_shm */
242 # define OFF_QUEUE_SHM(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
243 
244 # define QSHM_ENTRIES(i)	QShm[i].qs_entries
245 
246 /* basic size of shared memory segment */
247 # define SM_T_SIZE	(SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
248 
249 static unsigned int	hash_q __P((char *, unsigned int));
250 
251 /*
252 **  HASH_Q -- simple hash function
253 **
254 **	Parameters:
255 **		p -- string to hash.
256 **		h -- hash start value (from previous run).
257 **
258 **	Returns:
259 **		hash value.
260 */
261 
262 static unsigned int
263 hash_q(p, h)
264 	char *p;
265 	unsigned int h;
266 {
267 	int c, d;
268 
269 	while (*p != '\0')
270 	{
271 		d = *p++;
272 		c = d;
273 		c ^= c<<6;
274 		h += (c<<11) ^ (c>>1);
275 		h ^= (d<<14) + (d<<7) + (d<<4) + d;
276 	}
277 	return h;
278 }
279 
280 
281 #else /* SM_CONF_SHM */
282 # define FILE_SYS(i)	FileSys[i]
283 #endif /* SM_CONF_SHM */
284 
285 /* access to the various components of file system data */
286 #define FILE_SYS_NAME(i)	FSPath[i]
287 #define FILE_SYS_AVAIL(i)	FILE_SYS(i).fs_avail
288 #define FILE_SYS_BLKSIZE(i)	FILE_SYS(i).fs_blksize
289 #define FILE_SYS_DEV(i)	FILE_SYS(i).fs_dev
290 
291 
292 /*
293 **  Current qf file field assignments:
294 **
295 **	A	AUTH= parameter
296 **	B	body type
297 **	C	controlling user
298 **	D	data file name
299 **	d	data file directory name (added in 8.12)
300 **	E	error recipient
301 **	F	flag bits
302 **	G	free (was: queue delay algorithm if _FFR_QUEUEDELAY)
303 **	H	header
304 **	I	data file's inode number
305 **	K	time of last delivery attempt
306 **	L	Solaris Content-Length: header (obsolete)
307 **	M	message
308 **	N	number of delivery attempts
309 **	P	message priority
310 **	q	quarantine reason
311 **	Q	original recipient (ORCPT=)
312 **	r	final recipient (Final-Recipient: DSN field)
313 **	R	recipient
314 **	S	sender
315 **	T	init time
316 **	V	queue file version
317 **	X	free (was: character set if _FFR_SAVE_CHARSET)
318 **	Y	free (was: current delay if _FFR_QUEUEDELAY)
319 **	Z	original envelope id from ESMTP
320 **	!	deliver by (added in 8.12)
321 **	$	define macro
322 **	.	terminate file
323 */
324 
325 /*
326 **  QUEUEUP -- queue a message up for future transmission.
327 **
328 **	Parameters:
329 **		e -- the envelope to queue up.
330 **		announce -- if true, tell when you are queueing up.
331 **		msync -- if true, then fsync() if SuperSafe interactive mode.
332 **
333 **	Returns:
334 **		none.
335 **
336 **	Side Effects:
337 **		The current request is saved in a control file.
338 **		The queue file is left locked.
339 */
340 
341 void
342 queueup(e, announce, msync)
343 	register ENVELOPE *e;
344 	bool announce;
345 	bool msync;
346 {
347 	register SM_FILE_T *tfp;
348 	register HDR *h;
349 	register ADDRESS *q;
350 	int tfd = -1;
351 	int i;
352 	bool newid;
353 	register char *p;
354 	MAILER nullmailer;
355 	MCI mcibuf;
356 	char qf[MAXPATHLEN];
357 	char tf[MAXPATHLEN];
358 	char df[MAXPATHLEN];
359 	char buf[MAXLINE];
360 
361 	/*
362 	**  Create control file.
363 	*/
364 
365 #define OPEN_TF	do							\
366 		{							\
367 			MODE_T oldumask = 0;				\
368 									\
369 			if (bitset(S_IWGRP, QueueFileMode))		\
370 				oldumask = umask(002);			\
371 			tfd = open(tf, TF_OPEN_FLAGS, QueueFileMode);	\
372 			if (bitset(S_IWGRP, QueueFileMode))		\
373 				(void) umask(oldumask);			\
374 		} while (0)
375 
376 
377 	newid = (e->e_id == NULL) || !bitset(EF_INQUEUE, e->e_flags);
378 	(void) sm_strlcpy(tf, queuename(e, NEWQFL_LETTER), sizeof tf);
379 	tfp = e->e_lockfp;
380 	if (tfp == NULL && newid)
381 	{
382 		/*
383 		**  open qf file directly: this will give an error if the file
384 		**  already exists and hence prevent problems if a queue-id
385 		**  is reused (e.g., because the clock is set back).
386 		*/
387 
388 		(void) sm_strlcpy(tf, queuename(e, ANYQFL_LETTER), sizeof tf);
389 		OPEN_TF;
390 		if (tfd < 0 ||
391 #if !SM_OPEN_EXLOCK
392 		    !lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB) ||
393 #endif /* !SM_OPEN_EXLOCK */
394 		    (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
395 					 (void *) &tfd, SM_IO_WRONLY,
396 					 NULL)) == NULL)
397 		{
398 			int save_errno = errno;
399 
400 			printopenfds(true);
401 			errno = save_errno;
402 			syserr("!queueup: cannot create queue file %s, euid=%d, fd=%d, fp=%p",
403 				tf, (int) geteuid(), tfd, tfp);
404 			/* NOTREACHED */
405 		}
406 		e->e_lockfp = tfp;
407 		upd_qs(e, 1, 0, "queueup");
408 	}
409 
410 	/* if newid, write the queue file directly (instead of temp file) */
411 	if (!newid)
412 	{
413 		/* get a locked tf file */
414 		for (i = 0; i < 128; i++)
415 		{
416 			if (tfd < 0)
417 			{
418 				OPEN_TF;
419 				if (tfd < 0)
420 				{
421 					if (errno != EEXIST)
422 						break;
423 					if (LogLevel > 0 && (i % 32) == 0)
424 						sm_syslog(LOG_ALERT, e->e_id,
425 							  "queueup: cannot create %s, uid=%d: %s",
426 							  tf, (int) geteuid(),
427 							  sm_errstring(errno));
428 				}
429 #if SM_OPEN_EXLOCK
430 				else
431 					break;
432 #endif /* SM_OPEN_EXLOCK */
433 			}
434 			if (tfd >= 0)
435 			{
436 #if SM_OPEN_EXLOCK
437 				/* file is locked by open() */
438 				break;
439 #else /* SM_OPEN_EXLOCK */
440 				if (lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB))
441 					break;
442 				else
443 #endif /* SM_OPEN_EXLOCK */
444 				if (LogLevel > 0 && (i % 32) == 0)
445 					sm_syslog(LOG_ALERT, e->e_id,
446 						  "queueup: cannot lock %s: %s",
447 						  tf, sm_errstring(errno));
448 				if ((i % 32) == 31)
449 				{
450 					(void) close(tfd);
451 					tfd = -1;
452 				}
453 			}
454 
455 			if ((i % 32) == 31)
456 			{
457 				/* save the old temp file away */
458 				(void) rename(tf, queuename(e, TEMPQF_LETTER));
459 			}
460 			else
461 				(void) sleep(i % 32);
462 		}
463 		if (tfd < 0 || (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
464 						 (void *) &tfd, SM_IO_WRONLY_B,
465 						 NULL)) == NULL)
466 		{
467 			int save_errno = errno;
468 
469 			printopenfds(true);
470 			errno = save_errno;
471 			syserr("!queueup: cannot create queue temp file %s, uid=%d",
472 				tf, (int) geteuid());
473 		}
474 	}
475 
476 	if (tTd(40, 1))
477 		sm_dprintf("\n>>>>> queueing %s/%s%s >>>>>\n",
478 			   qid_printqueue(e->e_qgrp, e->e_qdir),
479 			   queuename(e, ANYQFL_LETTER),
480 			   newid ? " (new id)" : "");
481 	if (tTd(40, 3))
482 	{
483 		sm_dprintf("  e_flags=");
484 		printenvflags(e);
485 	}
486 	if (tTd(40, 32))
487 	{
488 		sm_dprintf("  sendq=");
489 		printaddr(sm_debug_file(), e->e_sendqueue, true);
490 	}
491 	if (tTd(40, 9))
492 	{
493 		sm_dprintf("  tfp=");
494 		dumpfd(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL), true, false);
495 		sm_dprintf("  lockfp=");
496 		if (e->e_lockfp == NULL)
497 			sm_dprintf("NULL\n");
498 		else
499 			dumpfd(sm_io_getinfo(e->e_lockfp, SM_IO_WHAT_FD, NULL),
500 			       true, false);
501 	}
502 
503 	/*
504 	**  If there is no data file yet, create one.
505 	*/
506 
507 	(void) sm_strlcpy(df, queuename(e, DATAFL_LETTER), sizeof df);
508 	if (bitset(EF_HAS_DF, e->e_flags))
509 	{
510 		if (e->e_dfp != NULL &&
511 		    SuperSafe != SAFE_REALLY &&
512 		    SuperSafe != SAFE_REALLY_POSTMILTER &&
513 		    sm_io_setinfo(e->e_dfp, SM_BF_COMMIT, NULL) < 0 &&
514 		    errno != EINVAL)
515 		{
516 			syserr("!queueup: cannot commit data file %s, uid=%d",
517 			       queuename(e, DATAFL_LETTER), (int) geteuid());
518 		}
519 		if (e->e_dfp != NULL &&
520 		    SuperSafe == SAFE_INTERACTIVE && msync)
521 		{
522 			if (tTd(40,32))
523 				sm_syslog(LOG_INFO, e->e_id,
524 					  "queueup: fsync(e->e_dfp)");
525 
526 			if (fsync(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD,
527 						NULL)) < 0)
528 			{
529 				if (newid)
530 					syserr("!552 Error writing data file %s",
531 					       df);
532 				else
533 					syserr("!452 Error writing data file %s",
534 					       df);
535 			}
536 		}
537 	}
538 	else
539 	{
540 		int dfd;
541 		MODE_T oldumask = 0;
542 		register SM_FILE_T *dfp = NULL;
543 		struct stat stbuf;
544 
545 		if (e->e_dfp != NULL &&
546 		    sm_io_getinfo(e->e_dfp, SM_IO_WHAT_ISTYPE, BF_FILE_TYPE))
547 			syserr("committing over bf file");
548 
549 		if (bitset(S_IWGRP, QueueFileMode))
550 			oldumask = umask(002);
551 		dfd = open(df, O_WRONLY|O_CREAT|O_TRUNC|QF_O_EXTRA,
552 			   QueueFileMode);
553 		if (bitset(S_IWGRP, QueueFileMode))
554 			(void) umask(oldumask);
555 		if (dfd < 0 || (dfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
556 						 (void *) &dfd, SM_IO_WRONLY_B,
557 						 NULL)) == NULL)
558 			syserr("!queueup: cannot create data temp file %s, uid=%d",
559 				df, (int) geteuid());
560 		if (fstat(dfd, &stbuf) < 0)
561 			e->e_dfino = -1;
562 		else
563 		{
564 			e->e_dfdev = stbuf.st_dev;
565 			e->e_dfino = ST_INODE(stbuf);
566 		}
567 		e->e_flags |= EF_HAS_DF;
568 		memset(&mcibuf, '\0', sizeof mcibuf);
569 		mcibuf.mci_out = dfp;
570 		mcibuf.mci_mailer = FileMailer;
571 		(*e->e_putbody)(&mcibuf, e, NULL);
572 
573 		if (SuperSafe == SAFE_REALLY ||
574 		    SuperSafe == SAFE_REALLY_POSTMILTER ||
575 		    (SuperSafe == SAFE_INTERACTIVE && msync))
576 		{
577 			if (tTd(40,32))
578 				sm_syslog(LOG_INFO, e->e_id,
579 					  "queueup: fsync(dfp)");
580 
581 			if (fsync(sm_io_getinfo(dfp, SM_IO_WHAT_FD, NULL)) < 0)
582 			{
583 				if (newid)
584 					syserr("!552 Error writing data file %s",
585 					       df);
586 				else
587 					syserr("!452 Error writing data file %s",
588 					       df);
589 			}
590 		}
591 
592 		if (sm_io_close(dfp, SM_TIME_DEFAULT) < 0)
593 			syserr("!queueup: cannot save data temp file %s, uid=%d",
594 				df, (int) geteuid());
595 		e->e_putbody = putbody;
596 	}
597 
598 	/*
599 	**  Output future work requests.
600 	**	Priority and creation time should be first, since
601 	**	they are required by gatherq.
602 	*/
603 
604 	/* output queue version number (must be first!) */
605 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "V%d\n", QF_VERSION);
606 
607 	/* output creation time */
608 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "T%ld\n", (long) e->e_ctime);
609 
610 	/* output last delivery time */
611 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "K%ld\n", (long) e->e_dtime);
612 
613 	/* output number of delivery attempts */
614 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "N%d\n", e->e_ntries);
615 
616 	/* output message priority */
617 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "P%ld\n", e->e_msgpriority);
618 
619 	/*
620 	**  If data file is in a different directory than the queue file,
621 	**  output a "d" record naming the directory of the data file.
622 	*/
623 
624 	if (e->e_dfqgrp != e->e_qgrp)
625 	{
626 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "d%s\n",
627 			Queue[e->e_dfqgrp]->qg_qpaths[e->e_dfqdir].qp_name);
628 	}
629 
630 	/* output inode number of data file */
631 	/* XXX should probably include device major/minor too */
632 	if (e->e_dfino != -1)
633 	{
634 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "I%ld/%ld/%llu\n",
635 				     (long) major(e->e_dfdev),
636 				     (long) minor(e->e_dfdev),
637 				     (ULONGLONG_T) e->e_dfino);
638 	}
639 
640 	/* output body type */
641 	if (e->e_bodytype != NULL)
642 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "B%s\n",
643 				     denlstring(e->e_bodytype, true, false));
644 
645 	/* quarantine reason */
646 	if (e->e_quarmsg != NULL)
647 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "q%s\n",
648 				     denlstring(e->e_quarmsg, true, false));
649 
650 	/* message from envelope, if it exists */
651 	if (e->e_message != NULL)
652 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
653 				     denlstring(e->e_message, true, false));
654 
655 	/* send various flag bits through */
656 	p = buf;
657 	if (bitset(EF_WARNING, e->e_flags))
658 		*p++ = 'w';
659 	if (bitset(EF_RESPONSE, e->e_flags))
660 		*p++ = 'r';
661 	if (bitset(EF_HAS8BIT, e->e_flags))
662 		*p++ = '8';
663 	if (bitset(EF_DELETE_BCC, e->e_flags))
664 		*p++ = 'b';
665 	if (bitset(EF_RET_PARAM, e->e_flags))
666 		*p++ = 'd';
667 	if (bitset(EF_NO_BODY_RETN, e->e_flags))
668 		*p++ = 'n';
669 	if (bitset(EF_SPLIT, e->e_flags))
670 		*p++ = 's';
671 	*p++ = '\0';
672 	if (buf[0] != '\0')
673 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "F%s\n", buf);
674 
675 	/* save $={persistentMacros} macro values */
676 	queueup_macros(macid("{persistentMacros}"), tfp, e);
677 
678 	/* output name of sender */
679 	if (bitnset(M_UDBENVELOPE, e->e_from.q_mailer->m_flags))
680 		p = e->e_sender;
681 	else
682 		p = e->e_from.q_paddr;
683 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "S%s\n",
684 			     denlstring(p, true, false));
685 
686 	/* output ESMTP-supplied "original" information */
687 	if (e->e_envid != NULL)
688 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Z%s\n",
689 				     denlstring(e->e_envid, true, false));
690 
691 	/* output AUTH= parameter */
692 	if (e->e_auth_param != NULL)
693 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "A%s\n",
694 				     denlstring(e->e_auth_param, true, false));
695 	if (e->e_dlvr_flag != 0)
696 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "!%c %ld\n",
697 				     (char) e->e_dlvr_flag, e->e_deliver_by);
698 
699 	/* output list of recipient addresses */
700 	printctladdr(NULL, NULL);
701 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
702 	{
703 		if (!QS_IS_UNDELIVERED(q->q_state))
704 			continue;
705 
706 		/* message for this recipient, if it exists */
707 		if (q->q_message != NULL)
708 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
709 					     denlstring(q->q_message, true,
710 							false));
711 
712 		printctladdr(q, tfp);
713 		if (q->q_orcpt != NULL)
714 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Q%s\n",
715 					     denlstring(q->q_orcpt, true,
716 							false));
717 		if (q->q_finalrcpt != NULL)
718 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "r%s\n",
719 					     denlstring(q->q_finalrcpt, true,
720 							false));
721 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'R');
722 		if (bitset(QPRIMARY, q->q_flags))
723 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'P');
724 		if (bitset(QHASNOTIFY, q->q_flags))
725 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'N');
726 		if (bitset(QPINGONSUCCESS, q->q_flags))
727 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'S');
728 		if (bitset(QPINGONFAILURE, q->q_flags))
729 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'F');
730 		if (bitset(QPINGONDELAY, q->q_flags))
731 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'D');
732 		if (q->q_alias != NULL &&
733 		    bitset(QALIAS, q->q_alias->q_flags))
734 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'A');
735 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, ':');
736 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s\n",
737 				     denlstring(q->q_paddr, true, false));
738 		if (announce)
739 		{
740 			char *tag = "queued";
741 
742 			if (e->e_quarmsg != NULL)
743 				tag = "quarantined";
744 
745 			e->e_to = q->q_paddr;
746 			message(tag);
747 			if (LogLevel > 8)
748 				logdelivery(q->q_mailer, NULL, q->q_status,
749 					    tag, NULL, (time_t) 0, e);
750 			e->e_to = NULL;
751 		}
752 		if (tTd(40, 1))
753 		{
754 			sm_dprintf("queueing ");
755 			printaddr(sm_debug_file(), q, false);
756 		}
757 	}
758 
759 	/*
760 	**  Output headers for this message.
761 	**	Expand macros completely here.  Queue run will deal with
762 	**	everything as absolute headers.
763 	**		All headers that must be relative to the recipient
764 	**		can be cracked later.
765 	**	We set up a "null mailer" -- i.e., a mailer that will have
766 	**	no effect on the addresses as they are output.
767 	*/
768 
769 	memset((char *) &nullmailer, '\0', sizeof nullmailer);
770 	nullmailer.m_re_rwset = nullmailer.m_rh_rwset =
771 			nullmailer.m_se_rwset = nullmailer.m_sh_rwset = -1;
772 	nullmailer.m_eol = "\n";
773 	memset(&mcibuf, '\0', sizeof mcibuf);
774 	mcibuf.mci_mailer = &nullmailer;
775 	mcibuf.mci_out = tfp;
776 
777 	macdefine(&e->e_macro, A_PERM, 'g', "\201f");
778 	for (h = e->e_header; h != NULL; h = h->h_link)
779 	{
780 		if (h->h_value == NULL)
781 			continue;
782 
783 		/* don't output resent headers on non-resent messages */
784 		if (bitset(H_RESENT, h->h_flags) &&
785 		    !bitset(EF_RESENT, e->e_flags))
786 			continue;
787 
788 		/* expand macros; if null, don't output header at all */
789 		if (bitset(H_DEFAULT, h->h_flags))
790 		{
791 			(void) expand(h->h_value, buf, sizeof buf, e);
792 			if (buf[0] == '\0')
793 				continue;
794 		}
795 
796 		/* output this header */
797 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "H?");
798 
799 		/* output conditional macro if present */
800 		if (h->h_macro != '\0')
801 		{
802 			if (bitset(0200, h->h_macro))
803 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
804 						     "${%s}",
805 						      macname(bitidx(h->h_macro)));
806 			else
807 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
808 						     "$%c", h->h_macro);
809 		}
810 		else if (!bitzerop(h->h_mflags) &&
811 			 bitset(H_CHECK|H_ACHECK, h->h_flags))
812 		{
813 			int j;
814 
815 			/* if conditional, output the set of conditions */
816 			for (j = '\0'; j <= '\177'; j++)
817 				if (bitnset(j, h->h_mflags))
818 					(void) sm_io_putc(tfp, SM_TIME_DEFAULT,
819 							  j);
820 		}
821 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, '?');
822 
823 		/* output the header: expand macros, convert addresses */
824 		if (bitset(H_DEFAULT, h->h_flags) &&
825 		    !bitset(H_BINDLATE, h->h_flags))
826 		{
827 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s: %s\n",
828 					     h->h_field,
829 					     denlstring(buf, false, true));
830 		}
831 		else if (bitset(H_FROM|H_RCPT, h->h_flags) &&
832 			 !bitset(H_BINDLATE, h->h_flags))
833 		{
834 			bool oldstyle = bitset(EF_OLDSTYLE, e->e_flags);
835 			SM_FILE_T *savetrace = TrafficLogFile;
836 
837 			TrafficLogFile = NULL;
838 
839 			if (bitset(H_FROM, h->h_flags))
840 				oldstyle = false;
841 
842 			commaize(h, h->h_value, oldstyle, &mcibuf, e);
843 
844 			TrafficLogFile = savetrace;
845 		}
846 		else
847 		{
848 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s: %s\n",
849 					     h->h_field,
850 					     denlstring(h->h_value, false,
851 							true));
852 		}
853 	}
854 
855 	/*
856 	**  Clean up.
857 	**
858 	**	Write a terminator record -- this is to prevent
859 	**	scurrilous crackers from appending any data.
860 	*/
861 
862 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ".\n");
863 
864 	if (sm_io_flush(tfp, SM_TIME_DEFAULT) != 0 ||
865 	    ((SuperSafe == SAFE_REALLY ||
866 	      SuperSafe == SAFE_REALLY_POSTMILTER ||
867 	      (SuperSafe == SAFE_INTERACTIVE && msync)) &&
868 	     fsync(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL)) < 0) ||
869 	    sm_io_error(tfp))
870 	{
871 		if (newid)
872 			syserr("!552 Error writing control file %s", tf);
873 		else
874 			syserr("!452 Error writing control file %s", tf);
875 	}
876 
877 	if (!newid)
878 	{
879 		char new = queue_letter(e, ANYQFL_LETTER);
880 
881 		/* rename (locked) tf to be (locked) [qh]f */
882 		(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER),
883 				  sizeof qf);
884 		if (rename(tf, qf) < 0)
885 			syserr("cannot rename(%s, %s), uid=%d",
886 				tf, qf, (int) geteuid());
887 		else
888 		{
889 			/*
890 			**  Check if type has changed and only
891 			**  remove the old item if the rename above
892 			**  succeeded.
893 			*/
894 
895 			if (e->e_qfletter != '\0' &&
896 			    e->e_qfletter != new)
897 			{
898 				if (tTd(40, 5))
899 				{
900 					sm_dprintf("type changed from %c to %c\n",
901 						   e->e_qfletter, new);
902 				}
903 
904 				if (unlink(queuename(e, e->e_qfletter)) < 0)
905 				{
906 					/* XXX: something more drastic? */
907 					if (LogLevel > 0)
908 						sm_syslog(LOG_ERR, e->e_id,
909 							  "queueup: unlink(%s) failed: %s",
910 							  queuename(e, e->e_qfletter),
911 							  sm_errstring(errno));
912 				}
913 			}
914 		}
915 		e->e_qfletter = new;
916 
917 		/*
918 		**  fsync() after renaming to make sure metadata is
919 		**  written to disk on filesystems in which renames are
920 		**  not guaranteed.
921 		*/
922 
923 		if (SuperSafe != SAFE_NO)
924 		{
925 			/* for softupdates */
926 			if (tfd >= 0 && fsync(tfd) < 0)
927 			{
928 				syserr("!queueup: cannot fsync queue temp file %s",
929 				       tf);
930 			}
931 			SYNC_DIR(qf, true);
932 		}
933 
934 		/* close and unlock old (locked) queue file */
935 		if (e->e_lockfp != NULL)
936 			(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
937 		e->e_lockfp = tfp;
938 
939 		/* save log info */
940 		if (LogLevel > 79)
941 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", qf);
942 	}
943 	else
944 	{
945 		/* save log info */
946 		if (LogLevel > 79)
947 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", tf);
948 
949 		e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
950 	}
951 
952 	errno = 0;
953 	e->e_flags |= EF_INQUEUE;
954 
955 	if (tTd(40, 1))
956 		sm_dprintf("<<<<< done queueing %s <<<<<\n\n", e->e_id);
957 	return;
958 }
959 
960 /*
961 **  PRINTCTLADDR -- print control address to file.
962 **
963 **	Parameters:
964 **		a -- address.
965 **		tfp -- file pointer.
966 **
967 **	Returns:
968 **		none.
969 **
970 **	Side Effects:
971 **		The control address (if changed) is printed to the file.
972 **		The last control address and uid are saved.
973 */
974 
975 static void
976 printctladdr(a, tfp)
977 	register ADDRESS *a;
978 	SM_FILE_T *tfp;
979 {
980 	char *user;
981 	register ADDRESS *q;
982 	uid_t uid;
983 	gid_t gid;
984 	static ADDRESS *lastctladdr = NULL;
985 	static uid_t lastuid;
986 
987 	/* initialization */
988 	if (a == NULL || a->q_alias == NULL || tfp == NULL)
989 	{
990 		if (lastctladdr != NULL && tfp != NULL)
991 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C\n");
992 		lastctladdr = NULL;
993 		lastuid = 0;
994 		return;
995 	}
996 
997 	/* find the active uid */
998 	q = getctladdr(a);
999 	if (q == NULL)
1000 	{
1001 		user = NULL;
1002 		uid = 0;
1003 		gid = 0;
1004 	}
1005 	else
1006 	{
1007 		user = q->q_ruser != NULL ? q->q_ruser : q->q_user;
1008 		uid = q->q_uid;
1009 		gid = q->q_gid;
1010 	}
1011 	a = a->q_alias;
1012 
1013 	/* check to see if this is the same as last time */
1014 	if (lastctladdr != NULL && uid == lastuid &&
1015 	    strcmp(lastctladdr->q_paddr, a->q_paddr) == 0)
1016 		return;
1017 	lastuid = uid;
1018 	lastctladdr = a;
1019 
1020 	if (uid == 0 || user == NULL || user[0] == '\0')
1021 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C");
1022 	else
1023 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C%s:%ld:%ld",
1024 				     denlstring(user, true, false), (long) uid,
1025 				     (long) gid);
1026 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ":%s\n",
1027 			     denlstring(a->q_paddr, true, false));
1028 }
1029 
1030 /*
1031 **  RUNNERS_SIGTERM -- propagate a SIGTERM to queue runner process
1032 **
1033 **	This propagates the signal to the child processes that are queue
1034 **	runners. This is for a queue runner "cleanup". After all of the
1035 **	child queue runner processes are signaled (it should be SIGTERM
1036 **	being the sig) then the old signal handler (Oldsh) is called
1037 **	to handle any cleanup set for this process (provided it is not
1038 **	SIG_DFL or SIG_IGN). The signal may not be handled immediately
1039 **	if the BlockOldsh flag is set. If the current process doesn't
1040 **	have a parent then handle the signal immediately, regardless of
1041 **	BlockOldsh.
1042 **
1043 **	Parameters:
1044 **		sig -- the signal number being sent
1045 **
1046 **	Returns:
1047 **		none.
1048 **
1049 **	Side Effects:
1050 **		Sets the NoMoreRunners boolean to true to stop more runners
1051 **		from being started in runqueue().
1052 **
1053 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1054 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1055 **		DOING.
1056 */
1057 
1058 static bool		volatile NoMoreRunners = false;
1059 static sigfunc_t	Oldsh_term = SIG_DFL;
1060 static sigfunc_t	Oldsh_hup = SIG_DFL;
1061 static sigfunc_t	volatile Oldsh = SIG_DFL;
1062 static bool		BlockOldsh = false;
1063 static int		volatile Oldsig = 0;
1064 static SIGFUNC_DECL	runners_sigterm __P((int));
1065 static SIGFUNC_DECL	runners_sighup __P((int));
1066 
1067 static SIGFUNC_DECL
1068 runners_sigterm(sig)
1069 	int sig;
1070 {
1071 	int save_errno = errno;
1072 
1073 	FIX_SYSV_SIGNAL(sig, runners_sigterm);
1074 	errno = save_errno;
1075 	CHECK_CRITICAL(sig);
1076 	NoMoreRunners = true;
1077 	Oldsh = Oldsh_term;
1078 	Oldsig = sig;
1079 	proc_list_signal(PROC_QUEUE, sig);
1080 
1081 	if (!BlockOldsh || getppid() <= 1)
1082 	{
1083 		/* Check that a valid 'old signal handler' is callable */
1084 		if (Oldsh_term != SIG_DFL && Oldsh_term != SIG_IGN &&
1085 		    Oldsh_term != runners_sigterm)
1086 			(*Oldsh_term)(sig);
1087 	}
1088 	errno = save_errno;
1089 	return SIGFUNC_RETURN;
1090 }
1091 /*
1092 **  RUNNERS_SIGHUP -- propagate a SIGHUP to queue runner process
1093 **
1094 **	This propagates the signal to the child processes that are queue
1095 **	runners. This is for a queue runner "cleanup". After all of the
1096 **	child queue runner processes are signaled (it should be SIGHUP
1097 **	being the sig) then the old signal handler (Oldsh) is called to
1098 **	handle any cleanup set for this process (provided it is not SIG_DFL
1099 **	or SIG_IGN). The signal may not be handled immediately if the
1100 **	BlockOldsh flag is set. If the current process doesn't have
1101 **	a parent then handle the signal immediately, regardless of
1102 **	BlockOldsh.
1103 **
1104 **	Parameters:
1105 **		sig -- the signal number being sent
1106 **
1107 **	Returns:
1108 **		none.
1109 **
1110 **	Side Effects:
1111 **		Sets the NoMoreRunners boolean to true to stop more runners
1112 **		from being started in runqueue().
1113 **
1114 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1115 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1116 **		DOING.
1117 */
1118 
1119 static SIGFUNC_DECL
1120 runners_sighup(sig)
1121 	int sig;
1122 {
1123 	int save_errno = errno;
1124 
1125 	FIX_SYSV_SIGNAL(sig, runners_sighup);
1126 	errno = save_errno;
1127 	CHECK_CRITICAL(sig);
1128 	NoMoreRunners = true;
1129 	Oldsh = Oldsh_hup;
1130 	Oldsig = sig;
1131 	proc_list_signal(PROC_QUEUE, sig);
1132 
1133 	if (!BlockOldsh || getppid() <= 1)
1134 	{
1135 		/* Check that a valid 'old signal handler' is callable */
1136 		if (Oldsh_hup != SIG_DFL && Oldsh_hup != SIG_IGN &&
1137 		    Oldsh_hup != runners_sighup)
1138 			(*Oldsh_hup)(sig);
1139 	}
1140 	errno = save_errno;
1141 	return SIGFUNC_RETURN;
1142 }
1143 /*
1144 **  MARK_WORK_GROUP_RESTART -- mark a work group as needing a restart
1145 **
1146 **  Sets a workgroup for restarting.
1147 **
1148 **	Parameters:
1149 **		wgrp -- the work group id to restart.
1150 **		reason -- why (signal?), -1 to turn off restart
1151 **
1152 **	Returns:
1153 **		none.
1154 **
1155 **	Side effects:
1156 **		May set global RestartWorkGroup to true.
1157 **
1158 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1159 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1160 **		DOING.
1161 */
1162 
1163 void
1164 mark_work_group_restart(wgrp, reason)
1165 	int wgrp;
1166 	int reason;
1167 {
1168 	if (wgrp < 0 || wgrp > NumWorkGroups)
1169 		return;
1170 
1171 	WorkGrp[wgrp].wg_restart = reason;
1172 	if (reason >= 0)
1173 		RestartWorkGroup = true;
1174 }
1175 /*
1176 **  RESTART_MARKED_WORK_GROUPS -- restart work groups marked as needing restart
1177 **
1178 **  Restart any workgroup marked as needing a restart provided more
1179 **  runners are allowed.
1180 **
1181 **	Parameters:
1182 **		none.
1183 **
1184 **	Returns:
1185 **		none.
1186 **
1187 **	Side effects:
1188 **		Sets global RestartWorkGroup to false.
1189 */
1190 
1191 void
1192 restart_marked_work_groups()
1193 {
1194 	int i;
1195 	int wasblocked;
1196 
1197 	if (NoMoreRunners)
1198 		return;
1199 
1200 	/* Block SIGCHLD so reapchild() doesn't mess with us */
1201 	wasblocked = sm_blocksignal(SIGCHLD);
1202 
1203 	for (i = 0; i < NumWorkGroups; i++)
1204 	{
1205 		if (WorkGrp[i].wg_restart >= 0)
1206 		{
1207 			if (LogLevel > 8)
1208 				sm_syslog(LOG_ERR, NOQID,
1209 					  "restart queue runner=%d due to signal 0x%x",
1210 					  i, WorkGrp[i].wg_restart);
1211 			restart_work_group(i);
1212 		}
1213 	}
1214 	RestartWorkGroup = false;
1215 
1216 	if (wasblocked == 0)
1217 		(void) sm_releasesignal(SIGCHLD);
1218 }
1219 /*
1220 **  RESTART_WORK_GROUP -- restart a specific work group
1221 **
1222 **  Restart a specific workgroup provided more runners are allowed.
1223 **  If the requested work group has been restarted too many times log
1224 **  this and refuse to restart.
1225 **
1226 **	Parameters:
1227 **		wgrp -- the work group id to restart
1228 **
1229 **	Returns:
1230 **		none.
1231 **
1232 **	Side Effects:
1233 **		starts another process doing the work of wgrp
1234 */
1235 
1236 #define MAX_PERSIST_RESTART	10	/* max allowed number of restarts */
1237 
1238 static void
1239 restart_work_group(wgrp)
1240 	int wgrp;
1241 {
1242 	if (NoMoreRunners ||
1243 	    wgrp < 0 || wgrp > NumWorkGroups)
1244 		return;
1245 
1246 	WorkGrp[wgrp].wg_restart = -1;
1247 	if (WorkGrp[wgrp].wg_restartcnt < MAX_PERSIST_RESTART)
1248 	{
1249 		/* avoid overflow; increment here */
1250 		WorkGrp[wgrp].wg_restartcnt++;
1251 		(void) run_work_group(wgrp, RWG_FORK|RWG_PERSISTENT|RWG_RUNALL);
1252 	}
1253 	else
1254 	{
1255 		sm_syslog(LOG_ERR, NOQID,
1256 			  "ERROR: persistent queue runner=%d restarted too many times, queue runner lost",
1257 			  wgrp);
1258 	}
1259 }
1260 /*
1261 **  SCHEDULE_QUEUE_RUNS -- schedule the next queue run for a work group.
1262 **
1263 **	Parameters:
1264 **		runall -- schedule even if individual bit is not set.
1265 **		wgrp -- the work group id to schedule.
1266 **		didit -- the queue run was performed for this work group.
1267 **
1268 **	Returns:
1269 **		nothing
1270 */
1271 
1272 #define INCR_MOD(v, m)	if (++v >= m)	\
1273 				v = 0;	\
1274 			else
1275 
1276 static void
1277 schedule_queue_runs(runall, wgrp, didit)
1278 	bool runall;
1279 	int wgrp;
1280 	bool didit;
1281 {
1282 	int qgrp, cgrp, endgrp;
1283 #if _FFR_QUEUE_SCHED_DBG
1284 	time_t lastsched;
1285 	bool sched;
1286 #endif /* _FFR_QUEUE_SCHED_DBG */
1287 	time_t now;
1288 	time_t minqintvl;
1289 
1290 	/*
1291 	**  This is a bit ugly since we have to duplicate the
1292 	**  code that "walks" through a work queue group.
1293 	*/
1294 
1295 	now = curtime();
1296 	minqintvl = 0;
1297 	cgrp = endgrp = WorkGrp[wgrp].wg_curqgrp;
1298 	do
1299 	{
1300 		time_t qintvl;
1301 
1302 #if _FFR_QUEUE_SCHED_DBG
1303 		lastsched = 0;
1304 		sched = false;
1305 #endif /* _FFR_QUEUE_SCHED_DBG */
1306 		qgrp = WorkGrp[wgrp].wg_qgs[cgrp]->qg_index;
1307 		if (Queue[qgrp]->qg_queueintvl > 0)
1308 			qintvl = Queue[qgrp]->qg_queueintvl;
1309 		else if (QueueIntvl > 0)
1310 			qintvl = QueueIntvl;
1311 		else
1312 			qintvl = (time_t) 0;
1313 #if _FFR_QUEUE_SCHED_DBG
1314 		lastsched = Queue[qgrp]->qg_nextrun;
1315 #endif /* _FFR_QUEUE_SCHED_DBG */
1316 		if ((runall || Queue[qgrp]->qg_nextrun <= now) && qintvl > 0)
1317 		{
1318 #if _FFR_QUEUE_SCHED_DBG
1319 			sched = true;
1320 #endif /* _FFR_QUEUE_SCHED_DBG */
1321 			if (minqintvl == 0 || qintvl < minqintvl)
1322 				minqintvl = qintvl;
1323 
1324 			/*
1325 			**  Only set a new time if a queue run was performed
1326 			**  for this queue group.  If the queue was not run,
1327 			**  we could starve it by setting a new time on each
1328 			**  call.
1329 			*/
1330 
1331 			if (didit)
1332 				Queue[qgrp]->qg_nextrun += qintvl;
1333 		}
1334 #if _FFR_QUEUE_SCHED_DBG
1335 		if (tTd(69, 10))
1336 			sm_syslog(LOG_INFO, NOQID,
1337 				"sqr: wgrp=%d, cgrp=%d, qgrp=%d, intvl=%ld, QI=%ld, runall=%d, lastrun=%ld, nextrun=%ld, sched=%d",
1338 				wgrp, cgrp, qgrp, Queue[qgrp]->qg_queueintvl,
1339 				QueueIntvl, runall, lastsched,
1340 				Queue[qgrp]->qg_nextrun, sched);
1341 #endif /* _FFR_QUEUE_SCHED_DBG */
1342 		INCR_MOD(cgrp, WorkGrp[wgrp].wg_numqgrp);
1343 	} while (endgrp != cgrp);
1344 	if (minqintvl > 0)
1345 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1346 }
1347 
1348 #if _FFR_QUEUE_RUN_PARANOIA
1349 /*
1350 **  CHECKQUEUERUNNER -- check whether a queue group hasn't been run.
1351 **
1352 **	Use this if events may get lost and hence queue runners may not
1353 **	be started and mail will pile up in a queue.
1354 **
1355 **	Parameters:
1356 **		none.
1357 **
1358 **	Returns:
1359 **		true if a queue run is necessary.
1360 **
1361 **	Side Effects:
1362 **		may schedule a queue run.
1363 */
1364 
1365 bool
1366 checkqueuerunner()
1367 {
1368 	int qgrp;
1369 	time_t now, minqintvl;
1370 
1371 	now = curtime();
1372 	minqintvl = 0;
1373 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
1374 	{
1375 		time_t qintvl;
1376 
1377 		if (Queue[qgrp]->qg_queueintvl > 0)
1378 			qintvl = Queue[qgrp]->qg_queueintvl;
1379 		else if (QueueIntvl > 0)
1380 			qintvl = QueueIntvl;
1381 		else
1382 			qintvl = (time_t) 0;
1383 		if (Queue[qgrp]->qg_nextrun <= now - qintvl)
1384 		{
1385 			if (minqintvl == 0 || qintvl < minqintvl)
1386 				minqintvl = qintvl;
1387 			if (LogLevel > 1)
1388 				sm_syslog(LOG_WARNING, NOQID,
1389 					"checkqueuerunner: queue %d should have been run at %s, queue interval %ld",
1390 					qgrp,
1391 					arpadate(ctime(&Queue[qgrp]->qg_nextrun)),
1392 					qintvl);
1393 		}
1394 	}
1395 	if (minqintvl > 0)
1396 	{
1397 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1398 		return true;
1399 	}
1400 	return false;
1401 }
1402 #endif /* _FFR_QUEUE_RUN_PARANOIA */
1403 
1404 /*
1405 **  RUNQUEUE -- run the jobs in the queue.
1406 **
1407 **	Gets the stuff out of the queue in some presumably logical
1408 **	order and processes them.
1409 **
1410 **	Parameters:
1411 **		forkflag -- true if the queue scanning should be done in
1412 **			a child process.  We double-fork so it is not our
1413 **			child and we don't have to clean up after it.
1414 **			false can be ignored if we have multiple queues.
1415 **		verbose -- if true, print out status information.
1416 **		persistent -- persistent queue runner?
1417 **		runall -- run all groups or only a subset (DoQueueRun)?
1418 **
1419 **	Returns:
1420 **		true if the queue run successfully began.
1421 **
1422 **	Side Effects:
1423 **		runs things in the mail queue using run_work_group().
1424 **		maybe schedules next queue run.
1425 */
1426 
1427 static ENVELOPE	QueueEnvelope;		/* the queue run envelope */
1428 static time_t	LastQueueTime = 0;	/* last time a queue ID assigned */
1429 static pid_t	LastQueuePid = -1;	/* last PID which had a queue ID */
1430 
1431 /* values for qp_supdirs */
1432 #define QP_NOSUB	0x0000	/* No subdirectories */
1433 #define QP_SUBDF	0x0001	/* "df" subdirectory */
1434 #define QP_SUBQF	0x0002	/* "qf" subdirectory */
1435 #define QP_SUBXF	0x0004	/* "xf" subdirectory */
1436 
1437 bool
1438 runqueue(forkflag, verbose, persistent, runall)
1439 	bool forkflag;
1440 	bool verbose;
1441 	bool persistent;
1442 	bool runall;
1443 {
1444 	int i;
1445 	bool ret = true;
1446 	static int curnum = 0;
1447 	sigfunc_t cursh;
1448 #if SM_HEAP_CHECK
1449 	SM_NONVOLATILE int oldgroup = 0;
1450 
1451 	if (sm_debug_active(&DebugLeakQ, 1))
1452 	{
1453 		oldgroup = sm_heap_group();
1454 		sm_heap_newgroup();
1455 		sm_dprintf("runqueue() heap group #%d\n", sm_heap_group());
1456 	}
1457 #endif /* SM_HEAP_CHECK */
1458 
1459 	/* queue run has been started, don't do any more this time */
1460 	DoQueueRun = false;
1461 
1462 	/* more than one queue or more than one directory per queue */
1463 	if (!forkflag && !verbose &&
1464 	    (WorkGrp[0].wg_qgs[0]->qg_numqueues > 1 || NumWorkGroups > 1 ||
1465 	     WorkGrp[0].wg_numqgrp > 1))
1466 		forkflag = true;
1467 
1468 	/*
1469 	**  For controlling queue runners via signals sent to this process.
1470 	**  Oldsh* will get called too by runners_sig* (if it is not SIG_IGN
1471 	**  or SIG_DFL) to preserve cleanup behavior. Now that this process
1472 	**  will have children (and perhaps grandchildren) this handler will
1473 	**  be left in place. This is because this process, once it has
1474 	**  finished spinning off queue runners, may go back to doing something
1475 	**  else (like being a daemon). And we still want on a SIG{TERM,HUP} to
1476 	**  clean up the child queue runners. Only install 'runners_sig*' once
1477 	**  else we'll get stuck looping forever.
1478 	*/
1479 
1480 	cursh = sm_signal(SIGTERM, runners_sigterm);
1481 	if (cursh != runners_sigterm)
1482 		Oldsh_term = cursh;
1483 	cursh = sm_signal(SIGHUP, runners_sighup);
1484 	if (cursh != runners_sighup)
1485 		Oldsh_hup = cursh;
1486 
1487 	for (i = 0; i < NumWorkGroups && !NoMoreRunners; i++)
1488 	{
1489 		int rwgflags = RWG_NONE;
1490 
1491 		/*
1492 		**  If MaxQueueChildren active then test whether the start
1493 		**  of the next queue group's additional queue runners (maximum)
1494 		**  will result in MaxQueueChildren being exceeded.
1495 		**
1496 		**  Note: do not use continue; even though another workgroup
1497 		**	may have fewer queue runners, this would be "unfair",
1498 		**	i.e., this work group might "starve" then.
1499 		*/
1500 
1501 #if _FFR_QUEUE_SCHED_DBG
1502 		if (tTd(69, 10))
1503 			sm_syslog(LOG_INFO, NOQID,
1504 				"rq: curnum=%d, MaxQueueChildren=%d, CurRunners=%d, WorkGrp[curnum].wg_maxact=%d",
1505 				curnum, MaxQueueChildren, CurRunners,
1506 				WorkGrp[curnum].wg_maxact);
1507 #endif /* _FFR_QUEUE_SCHED_DBG */
1508 		if (MaxQueueChildren > 0 &&
1509 		    CurRunners + WorkGrp[curnum].wg_maxact > MaxQueueChildren)
1510 			break;
1511 
1512 		/*
1513 		**  Pick up where we left off (curnum), in case we
1514 		**  used up all the children last time without finishing.
1515 		**  This give a round-robin fairness to queue runs.
1516 		**
1517 		**  Increment CurRunners before calling run_work_group()
1518 		**  to avoid a "race condition" with proc_list_drop() which
1519 		**  decrements CurRunners if the queue runners terminate.
1520 		**  Notice: CurRunners is an upper limit, in some cases
1521 		**  (too few jobs in the queue) this value is larger than
1522 		**  the actual number of queue runners. The discrepancy can
1523 		**  increase if some queue runners "hang" for a long time.
1524 		*/
1525 
1526 		CurRunners += WorkGrp[curnum].wg_maxact;
1527 		if (forkflag)
1528 			rwgflags |= RWG_FORK;
1529 		if (verbose)
1530 			rwgflags |= RWG_VERBOSE;
1531 		if (persistent)
1532 			rwgflags |= RWG_PERSISTENT;
1533 		if (runall)
1534 			rwgflags |= RWG_RUNALL;
1535 		ret = run_work_group(curnum, rwgflags);
1536 
1537 		/*
1538 		**  Failure means a message was printed for ETRN
1539 		**  and subsequent queues are likely to fail as well.
1540 		**  Decrement CurRunners in that case because
1541 		**  none have been started.
1542 		*/
1543 
1544 		if (!ret)
1545 		{
1546 			CurRunners -= WorkGrp[curnum].wg_maxact;
1547 			break;
1548 		}
1549 
1550 		if (!persistent)
1551 			schedule_queue_runs(runall, curnum, true);
1552 		INCR_MOD(curnum, NumWorkGroups);
1553 	}
1554 
1555 	/* schedule left over queue runs */
1556 	if (i < NumWorkGroups && !NoMoreRunners && !persistent)
1557 	{
1558 		int h;
1559 
1560 		for (h = curnum; i < NumWorkGroups; i++)
1561 		{
1562 			schedule_queue_runs(runall, h, false);
1563 			INCR_MOD(h, NumWorkGroups);
1564 		}
1565 	}
1566 
1567 
1568 #if SM_HEAP_CHECK
1569 	if (sm_debug_active(&DebugLeakQ, 1))
1570 		sm_heap_setgroup(oldgroup);
1571 #endif /* SM_HEAP_CHECK */
1572 	return ret;
1573 }
1574 
1575 #if _FFR_SKIP_DOMAINS
1576 /*
1577 **  SKIP_DOMAINS -- Skip 'skip' number of domains in the WorkQ.
1578 **
1579 **  Added by Stephen Frost <sfrost@snowman.net> to support
1580 **  having each runner process every N'th domain instead of
1581 **  every N'th message.
1582 **
1583 **	Parameters:
1584 **		skip -- number of domains in WorkQ to skip.
1585 **
1586 **	Returns:
1587 **		total number of messages skipped.
1588 **
1589 **	Side Effects:
1590 **		may change WorkQ
1591 */
1592 
1593 static int
1594 skip_domains(skip)
1595 	int skip;
1596 {
1597 	int n, seqjump;
1598 
1599 	for (n = 0, seqjump = 0; n < skip && WorkQ != NULL; seqjump++)
1600 	{
1601 		if (WorkQ->w_next != NULL)
1602 		{
1603 			if (WorkQ->w_host != NULL &&
1604 			    WorkQ->w_next->w_host != NULL)
1605 			{
1606 				if (sm_strcasecmp(WorkQ->w_host,
1607 						WorkQ->w_next->w_host) != 0)
1608 					n++;
1609 			}
1610 			else
1611 			{
1612 				if ((WorkQ->w_host != NULL &&
1613 				     WorkQ->w_next->w_host == NULL) ||
1614 				    (WorkQ->w_host == NULL &&
1615 				     WorkQ->w_next->w_host != NULL))
1616 					     n++;
1617 			}
1618 		}
1619 		WorkQ = WorkQ->w_next;
1620 	}
1621 	return seqjump;
1622 }
1623 #endif /* _FFR_SKIP_DOMAINS */
1624 
1625 /*
1626 **  RUNNER_WORK -- have a queue runner do its work
1627 **
1628 **  Have a queue runner do its work a list of entries.
1629 **  When work isn't directly being done then this process can take a signal
1630 **  and terminate immediately (in a clean fashion of course).
1631 **  When work is directly being done, it's not to be interrupted
1632 **  immediately: the work should be allowed to finish at a clean point
1633 **  before termination (in a clean fashion of course).
1634 **
1635 **	Parameters:
1636 **		e -- envelope.
1637 **		sequenceno -- 'th process to run WorkQ.
1638 **		didfork -- did the calling process fork()?
1639 **		skip -- process only each skip'th item.
1640 **		njobs -- number of jobs in WorkQ.
1641 **
1642 **	Returns:
1643 **		none.
1644 **
1645 **	Side Effects:
1646 **		runs things in the mail queue.
1647 */
1648 
1649 static void
1650 runner_work(e, sequenceno, didfork, skip, njobs)
1651 	register ENVELOPE *e;
1652 	int sequenceno;
1653 	bool didfork;
1654 	int skip;
1655 	int njobs;
1656 {
1657 	int n, seqjump;
1658 	WORK *w;
1659 	time_t now;
1660 
1661 	SM_GET_LA(now);
1662 
1663 	/*
1664 	**  Here we temporarily block the second calling of the handlers.
1665 	**  This allows us to handle the signal without terminating in the
1666 	**  middle of direct work. If a signal does come, the test for
1667 	**  NoMoreRunners will find it.
1668 	*/
1669 
1670 	BlockOldsh = true;
1671 	seqjump = skip;
1672 
1673 	/* process them once at a time */
1674 	while (WorkQ != NULL)
1675 	{
1676 #if SM_HEAP_CHECK
1677 		SM_NONVOLATILE int oldgroup = 0;
1678 
1679 		if (sm_debug_active(&DebugLeakQ, 1))
1680 		{
1681 			oldgroup = sm_heap_group();
1682 			sm_heap_newgroup();
1683 			sm_dprintf("run_queue_group() heap group #%d\n",
1684 				sm_heap_group());
1685 		}
1686 #endif /* SM_HEAP_CHECK */
1687 
1688 		/* do no more work */
1689 		if (NoMoreRunners)
1690 		{
1691 			/* Check that a valid signal handler is callable */
1692 			if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1693 			    Oldsh != runners_sighup &&
1694 			    Oldsh != runners_sigterm)
1695 				(*Oldsh)(Oldsig);
1696 			break;
1697 		}
1698 
1699 		w = WorkQ; /* assign current work item */
1700 
1701 		/*
1702 		**  Set the head of the WorkQ to the next work item.
1703 		**  It is set 'skip' ahead (the number of parallel queue
1704 		**  runners working on WorkQ together) since each runner
1705 		**  works on every 'skip'th (N-th) item.
1706 #if _FFR_SKIP_DOMAINS
1707 		**  In the case of the BYHOST Queue Sort Order, the 'item'
1708 		**  is a domain, so we work on every 'skip'th (N-th) domain.
1709 #endif * _FFR_SKIP_DOMAINS *
1710 		*/
1711 
1712 #if _FFR_SKIP_DOMAINS
1713 		if (QueueSortOrder == QSO_BYHOST)
1714 		{
1715 			seqjump = 1;
1716 			if (WorkQ->w_next != NULL)
1717 			{
1718 				if (WorkQ->w_host != NULL &&
1719 				    WorkQ->w_next->w_host != NULL)
1720 				{
1721 					if (sm_strcasecmp(WorkQ->w_host,
1722 							WorkQ->w_next->w_host)
1723 								!= 0)
1724 						seqjump = skip_domains(skip);
1725 					else
1726 						WorkQ = WorkQ->w_next;
1727 				}
1728 				else
1729 				{
1730 					if ((WorkQ->w_host != NULL &&
1731 					     WorkQ->w_next->w_host == NULL) ||
1732 					    (WorkQ->w_host == NULL &&
1733 					     WorkQ->w_next->w_host != NULL))
1734 						seqjump = skip_domains(skip);
1735 					else
1736 						WorkQ = WorkQ->w_next;
1737 				}
1738 			}
1739 			else
1740 				WorkQ = WorkQ->w_next;
1741 		}
1742 		else
1743 #endif /* _FFR_SKIP_DOMAINS */
1744 		{
1745 			for (n = 0; n < skip && WorkQ != NULL; n++)
1746 				WorkQ = WorkQ->w_next;
1747 		}
1748 
1749 		e->e_to = NULL;
1750 
1751 		/*
1752 		**  Ignore jobs that are too expensive for the moment.
1753 		**
1754 		**	Get new load average every GET_NEW_LA_TIME seconds.
1755 		*/
1756 
1757 		SM_GET_LA(now);
1758 		if (shouldqueue(WkRecipFact, Current_LA_time))
1759 		{
1760 			char *msg = "Aborting queue run: load average too high";
1761 
1762 			if (Verbose)
1763 				message("%s", msg);
1764 			if (LogLevel > 8)
1765 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1766 			break;
1767 		}
1768 		if (shouldqueue(w->w_pri, w->w_ctime))
1769 		{
1770 			if (Verbose)
1771 				message(EmptyString);
1772 			if (QueueSortOrder == QSO_BYPRIORITY)
1773 			{
1774 				if (Verbose)
1775 					message("Skipping %s/%s (sequence %d of %d) and flushing rest of queue",
1776 						qid_printqueue(w->w_qgrp,
1777 							       w->w_qdir),
1778 						w->w_name + 2, sequenceno,
1779 						njobs);
1780 				if (LogLevel > 8)
1781 					sm_syslog(LOG_INFO, NOQID,
1782 						  "runqueue: Flushing queue from %s/%s (pri %ld, LA %d, %d of %d)",
1783 						  qid_printqueue(w->w_qgrp,
1784 								 w->w_qdir),
1785 						  w->w_name + 2, w->w_pri,
1786 						  CurrentLA, sequenceno,
1787 						  njobs);
1788 				break;
1789 			}
1790 			else if (Verbose)
1791 				message("Skipping %s/%s (sequence %d of %d)",
1792 					qid_printqueue(w->w_qgrp, w->w_qdir),
1793 					w->w_name + 2, sequenceno, njobs);
1794 		}
1795 		else
1796 		{
1797 			if (Verbose)
1798 			{
1799 				message(EmptyString);
1800 				message("Running %s/%s (sequence %d of %d)",
1801 					qid_printqueue(w->w_qgrp, w->w_qdir),
1802 					w->w_name + 2, sequenceno, njobs);
1803 			}
1804 			if (didfork && MaxQueueChildren > 0)
1805 			{
1806 				sm_blocksignal(SIGCHLD);
1807 				(void) sm_signal(SIGCHLD, reapchild);
1808 			}
1809 			if (tTd(63, 100))
1810 				sm_syslog(LOG_DEBUG, NOQID,
1811 					  "runqueue %s dowork(%s)",
1812 					  qid_printqueue(w->w_qgrp, w->w_qdir),
1813 					  w->w_name + 2);
1814 
1815 			(void) dowork(w->w_qgrp, w->w_qdir, w->w_name + 2,
1816 				      ForkQueueRuns, false, e);
1817 			errno = 0;
1818 		}
1819 		sm_free(w->w_name); /* XXX */
1820 		if (w->w_host != NULL)
1821 			sm_free(w->w_host); /* XXX */
1822 		sm_free((char *) w); /* XXX */
1823 		sequenceno += seqjump; /* next sequence number */
1824 #if SM_HEAP_CHECK
1825 		if (sm_debug_active(&DebugLeakQ, 1))
1826 			sm_heap_setgroup(oldgroup);
1827 #endif /* SM_HEAP_CHECK */
1828 	}
1829 
1830 	BlockOldsh = false;
1831 
1832 	/* check the signals didn't happen during the revert */
1833 	if (NoMoreRunners)
1834 	{
1835 		/* Check that a valid signal handler is callable */
1836 		if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1837 		    Oldsh != runners_sighup && Oldsh != runners_sigterm)
1838 			(*Oldsh)(Oldsig);
1839 	}
1840 
1841 	Oldsh = SIG_DFL; /* after the NoMoreRunners check */
1842 }
1843 /*
1844 **  RUN_WORK_GROUP -- run the jobs in a queue group from a work group.
1845 **
1846 **	Gets the stuff out of the queue in some presumably logical
1847 **	order and processes them.
1848 **
1849 **	Parameters:
1850 **		wgrp -- work group to process.
1851 **		flags -- RWG_* flags
1852 **
1853 **	Returns:
1854 **		true if the queue run successfully began.
1855 **
1856 **	Side Effects:
1857 **		runs things in the mail queue.
1858 */
1859 
1860 /* Minimum sleep time for persistent queue runners */
1861 #define MIN_SLEEP_TIME	5
1862 
1863 bool
1864 run_work_group(wgrp, flags)
1865 	int wgrp;
1866 	int flags;
1867 {
1868 	register ENVELOPE *e;
1869 	int njobs, qdir;
1870 	int sequenceno = 1;
1871 	int qgrp, endgrp, h, i;
1872 	time_t now;
1873 	bool full, more;
1874 	SM_RPOOL_T *rpool;
1875 	extern void rmexpstab __P((void));
1876 	extern ENVELOPE BlankEnvelope;
1877 	extern SIGFUNC_DECL reapchild __P((int));
1878 
1879 	if (wgrp < 0)
1880 		return false;
1881 
1882 	/*
1883 	**  If no work will ever be selected, don't even bother reading
1884 	**  the queue.
1885 	*/
1886 
1887 	SM_GET_LA(now);
1888 
1889 	if (!bitset(RWG_PERSISTENT, flags) &&
1890 	    shouldqueue(WkRecipFact, Current_LA_time))
1891 	{
1892 		char *msg = "Skipping queue run -- load average too high";
1893 
1894 		if (bitset(RWG_VERBOSE, flags))
1895 			message("458 %s\n", msg);
1896 		if (LogLevel > 8)
1897 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1898 		return false;
1899 	}
1900 
1901 	/*
1902 	**  See if we already have too many children.
1903 	*/
1904 
1905 	if (bitset(RWG_FORK, flags) &&
1906 	    WorkGrp[wgrp].wg_lowqintvl > 0 &&
1907 	    !bitset(RWG_PERSISTENT, flags) &&
1908 	    MaxChildren > 0 && CurChildren >= MaxChildren)
1909 	{
1910 		char *msg = "Skipping queue run -- too many children";
1911 
1912 		if (bitset(RWG_VERBOSE, flags))
1913 			message("458 %s (%d)\n", msg, CurChildren);
1914 		if (LogLevel > 8)
1915 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s (%d)",
1916 				  msg, CurChildren);
1917 		return false;
1918 	}
1919 
1920 	/*
1921 	**  See if we want to go off and do other useful work.
1922 	*/
1923 
1924 	if (bitset(RWG_FORK, flags))
1925 	{
1926 		pid_t pid;
1927 
1928 		(void) sm_blocksignal(SIGCHLD);
1929 		(void) sm_signal(SIGCHLD, reapchild);
1930 
1931 		pid = dofork();
1932 		if (pid == -1)
1933 		{
1934 			const char *msg = "Skipping queue run -- fork() failed";
1935 			const char *err = sm_errstring(errno);
1936 
1937 			if (bitset(RWG_VERBOSE, flags))
1938 				message("458 %s: %s\n", msg, err);
1939 			if (LogLevel > 8)
1940 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s: %s",
1941 					  msg, err);
1942 			(void) sm_releasesignal(SIGCHLD);
1943 			return false;
1944 		}
1945 		if (pid != 0)
1946 		{
1947 			/* parent -- pick up intermediate zombie */
1948 			(void) sm_blocksignal(SIGALRM);
1949 
1950 			/* wgrp only used when queue runners are persistent */
1951 			proc_list_add(pid, "Queue runner", PROC_QUEUE,
1952 				      WorkGrp[wgrp].wg_maxact,
1953 				      bitset(RWG_PERSISTENT, flags) ? wgrp : -1,
1954 				      NULL);
1955 			(void) sm_releasesignal(SIGALRM);
1956 			(void) sm_releasesignal(SIGCHLD);
1957 			return true;
1958 		}
1959 
1960 		/* child -- clean up signals */
1961 
1962 		/* Reset global flags */
1963 		RestartRequest = NULL;
1964 		RestartWorkGroup = false;
1965 		ShutdownRequest = NULL;
1966 		PendingSignal = 0;
1967 		CurrentPid = getpid();
1968 		close_sendmail_pid();
1969 
1970 		/*
1971 		**  Initialize exception stack and default exception
1972 		**  handler for child process.
1973 		*/
1974 
1975 		sm_exc_newthread(fatal_error);
1976 		clrcontrol();
1977 		proc_list_clear();
1978 
1979 		/* Add parent process as first child item */
1980 		proc_list_add(CurrentPid, "Queue runner child process",
1981 			      PROC_QUEUE_CHILD, 0, -1, NULL);
1982 		(void) sm_releasesignal(SIGCHLD);
1983 		(void) sm_signal(SIGCHLD, SIG_DFL);
1984 		(void) sm_signal(SIGHUP, SIG_DFL);
1985 		(void) sm_signal(SIGTERM, intsig);
1986 	}
1987 
1988 	/*
1989 	**  Release any resources used by the daemon code.
1990 	*/
1991 
1992 	clrdaemon();
1993 
1994 	/* force it to run expensive jobs */
1995 	NoConnect = false;
1996 
1997 	/* drop privileges */
1998 	if (geteuid() == (uid_t) 0)
1999 		(void) drop_privileges(false);
2000 
2001 	/*
2002 	**  Create ourselves an envelope
2003 	*/
2004 
2005 	CurEnv = &QueueEnvelope;
2006 	rpool = sm_rpool_new_x(NULL);
2007 	e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2008 	e->e_flags = BlankEnvelope.e_flags;
2009 	e->e_parent = NULL;
2010 
2011 	/* make sure we have disconnected from parent */
2012 	if (bitset(RWG_FORK, flags))
2013 	{
2014 		disconnect(1, e);
2015 		QuickAbort = false;
2016 	}
2017 
2018 	/*
2019 	**  If we are running part of the queue, always ignore stored
2020 	**  host status.
2021 	*/
2022 
2023 	if (QueueLimitId != NULL || QueueLimitSender != NULL ||
2024 	    QueueLimitQuarantine != NULL ||
2025 	    QueueLimitRecipient != NULL)
2026 	{
2027 		IgnoreHostStatus = true;
2028 		MinQueueAge = 0;
2029 	}
2030 
2031 	/*
2032 	**  Here is where we choose the queue group from the work group.
2033 	**  The caller of the "domorework" label must setup a new envelope.
2034 	*/
2035 
2036 	endgrp = WorkGrp[wgrp].wg_curqgrp; /* to not spin endlessly */
2037 
2038   domorework:
2039 
2040 	/*
2041 	**  Run a queue group if:
2042 	**  RWG_RUNALL bit is set or the bit for this group is set.
2043 	*/
2044 
2045 	now = curtime();
2046 	for (;;)
2047 	{
2048 		/*
2049 		**  Find the next queue group within the work group that
2050 		**  has been marked as needing a run.
2051 		*/
2052 
2053 		qgrp = WorkGrp[wgrp].wg_qgs[WorkGrp[wgrp].wg_curqgrp]->qg_index;
2054 		WorkGrp[wgrp].wg_curqgrp++; /* advance */
2055 		WorkGrp[wgrp].wg_curqgrp %= WorkGrp[wgrp].wg_numqgrp; /* wrap */
2056 		if (bitset(RWG_RUNALL, flags) ||
2057 		    (Queue[qgrp]->qg_nextrun <= now &&
2058 		     Queue[qgrp]->qg_nextrun != (time_t) -1))
2059 			break;
2060 		if (endgrp == WorkGrp[wgrp].wg_curqgrp)
2061 		{
2062 			e->e_id = NULL;
2063 			if (bitset(RWG_FORK, flags))
2064 				finis(true, true, ExitStat);
2065 			return true; /* we're done */
2066 		}
2067 	}
2068 
2069 	qdir = Queue[qgrp]->qg_curnum; /* round-robin init of queue position */
2070 #if _FFR_QUEUE_SCHED_DBG
2071 	if (tTd(69, 12))
2072 		sm_syslog(LOG_INFO, NOQID,
2073 			"rwg: wgrp=%d, qgrp=%d, qdir=%d, name=%s, curqgrp=%d, numgrps=%d",
2074 			wgrp, qgrp, qdir, qid_printqueue(qgrp, qdir),
2075 			WorkGrp[wgrp].wg_curqgrp, WorkGrp[wgrp].wg_numqgrp);
2076 #endif /* _FFR_QUEUE_SCHED_DBG */
2077 
2078 #if HASNICE
2079 	/* tweak niceness of queue runs */
2080 	if (Queue[qgrp]->qg_nice > 0)
2081 		(void) nice(Queue[qgrp]->qg_nice);
2082 #endif /* HASNICE */
2083 
2084 	/* XXX running queue group... */
2085 	sm_setproctitle(true, CurEnv, "running queue: %s",
2086 			qid_printqueue(qgrp, qdir));
2087 
2088 	if (LogLevel > 69 || tTd(63, 99))
2089 		sm_syslog(LOG_DEBUG, NOQID,
2090 			  "runqueue %s, pid=%d, forkflag=%d",
2091 			  qid_printqueue(qgrp, qdir), (int) CurrentPid,
2092 			  bitset(RWG_FORK, flags));
2093 
2094 	/*
2095 	**  Start making passes through the queue.
2096 	**	First, read and sort the entire queue.
2097 	**	Then, process the work in that order.
2098 	**		But if you take too long, start over.
2099 	*/
2100 
2101 	for (i = 0; i < Queue[qgrp]->qg_numqueues; i++)
2102 	{
2103 		h = gatherq(qgrp, qdir, false, &full, &more);
2104 #if SM_CONF_SHM
2105 		if (ShmId != SM_SHM_NO_ID)
2106 			QSHM_ENTRIES(Queue[qgrp]->qg_qpaths[qdir].qp_idx) = h;
2107 #endif /* SM_CONF_SHM */
2108 		/* If there are no more items in this queue advance */
2109 		if (!more)
2110 		{
2111 			/* A round-robin advance */
2112 			qdir++;
2113 			qdir %= Queue[qgrp]->qg_numqueues;
2114 		}
2115 
2116 		/* Has the WorkList reached the limit? */
2117 		if (full)
2118 			break; /* don't try to gather more */
2119 	}
2120 
2121 	/* order the existing work requests */
2122 	njobs = sortq(Queue[qgrp]->qg_maxlist);
2123 	Queue[qgrp]->qg_curnum = qdir; /* update */
2124 
2125 
2126 	if (!Verbose && bitnset(QD_FORK, Queue[qgrp]->qg_flags))
2127 	{
2128 		int loop, maxrunners;
2129 		pid_t pid;
2130 
2131 		/*
2132 		**  For this WorkQ we want to fork off N children (maxrunners)
2133 		**  at this point. Each child has a copy of WorkQ. Each child
2134 		**  will process every N-th item. The parent will wait for all
2135 		**  of the children to finish before moving on to the next
2136 		**  queue group within the work group. This saves us forking
2137 		**  a new runner-child for each work item.
2138 		**  It's valid for qg_maxqrun == 0 since this may be an
2139 		**  explicit "don't run this queue" setting.
2140 		*/
2141 
2142 		maxrunners = Queue[qgrp]->qg_maxqrun;
2143 
2144 		/* No need to have more runners then there are jobs */
2145 		if (maxrunners > njobs)
2146 			maxrunners = njobs;
2147 		for (loop = 0; loop < maxrunners; loop++)
2148 		{
2149 			/*
2150 			**  Since the delivery may happen in a child and the
2151 			**  parent does not wait, the parent may close the
2152 			**  maps thereby removing any shared memory used by
2153 			**  the map.  Therefore, close the maps now so the
2154 			**  child will dynamically open them if necessary.
2155 			*/
2156 
2157 			closemaps(false);
2158 
2159 			pid = fork();
2160 			if (pid < 0)
2161 			{
2162 				syserr("run_work_group: cannot fork");
2163 				return false;
2164 			}
2165 			else if (pid > 0)
2166 			{
2167 				/* parent -- clean out connection cache */
2168 				mci_flush(false, NULL);
2169 #if _FFR_SKIP_DOMAINS
2170 				if (QueueSortOrder == QSO_BYHOST)
2171 				{
2172 					sequenceno += skip_domains(1);
2173 				}
2174 				else
2175 #endif /* _FFR_SKIP_DOMAINS */
2176 				{
2177 					/* for the skip */
2178 					WorkQ = WorkQ->w_next;
2179 					sequenceno++;
2180 				}
2181 				proc_list_add(pid, "Queue child runner process",
2182 					      PROC_QUEUE_CHILD, 0, -1, NULL);
2183 
2184 				/* No additional work, no additional runners */
2185 				if (WorkQ == NULL)
2186 					break;
2187 			}
2188 			else
2189 			{
2190 				/* child -- Reset global flags */
2191 				RestartRequest = NULL;
2192 				RestartWorkGroup = false;
2193 				ShutdownRequest = NULL;
2194 				PendingSignal = 0;
2195 				CurrentPid = getpid();
2196 				close_sendmail_pid();
2197 
2198 				/*
2199 				**  Initialize exception stack and default
2200 				**  exception handler for child process.
2201 				**  When fork()'d the child now has a private
2202 				**  copy of WorkQ at its current position.
2203 				*/
2204 
2205 				sm_exc_newthread(fatal_error);
2206 
2207 				/*
2208 				**  SMTP processes (whether -bd or -bs) set
2209 				**  SIGCHLD to reapchild to collect
2210 				**  children status.  However, at delivery
2211 				**  time, that status must be collected
2212 				**  by sm_wait() to be dealt with properly
2213 				**  (check success of delivery based
2214 				**  on status code, etc).  Therefore, if we
2215 				**  are an SMTP process, reset SIGCHLD
2216 				**  back to the default so reapchild
2217 				**  doesn't collect status before
2218 				**  sm_wait().
2219 				*/
2220 
2221 				if (OpMode == MD_SMTP ||
2222 				    OpMode == MD_DAEMON ||
2223 				    MaxQueueChildren > 0)
2224 				{
2225 					proc_list_clear();
2226 					sm_releasesignal(SIGCHLD);
2227 					(void) sm_signal(SIGCHLD, SIG_DFL);
2228 				}
2229 
2230 				/* child -- error messages to the transcript */
2231 				QuickAbort = OnlyOneError = false;
2232 				runner_work(e, sequenceno, true,
2233 					    maxrunners, njobs);
2234 
2235 				/* This child is done */
2236 				finis(true, true, ExitStat);
2237 				/* NOTREACHED */
2238 			}
2239 		}
2240 
2241 		sm_releasesignal(SIGCHLD);
2242 
2243 		/*
2244 		**  Wait until all of the runners have completed before
2245 		**  seeing if there is another queue group in the
2246 		**  work group to process.
2247 		**  XXX Future enhancement: don't wait() for all children
2248 		**  here, just go ahead and make sure that overall the number
2249 		**  of children is not exceeded.
2250 		*/
2251 
2252 		while (CurChildren > 0)
2253 		{
2254 			int status;
2255 			pid_t ret;
2256 
2257 			while ((ret = sm_wait(&status)) <= 0)
2258 				continue;
2259 			proc_list_drop(ret, status, NULL);
2260 		}
2261 	}
2262 	else if (Queue[qgrp]->qg_maxqrun > 0 || bitset(RWG_FORCE, flags))
2263 	{
2264 		/*
2265 		**  When current process will not fork children to do the work,
2266 		**  it will do the work itself. The 'skip' will be 1 since
2267 		**  there are no child runners to divide the work across.
2268 		*/
2269 
2270 		runner_work(e, sequenceno, false, 1, njobs);
2271 	}
2272 
2273 	/* free memory allocated by newenvelope() above */
2274 	sm_rpool_free(rpool);
2275 	QueueEnvelope.e_rpool = NULL;
2276 
2277 	/* Are there still more queues in the work group to process? */
2278 	if (endgrp != WorkGrp[wgrp].wg_curqgrp)
2279 	{
2280 		rpool = sm_rpool_new_x(NULL);
2281 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2282 		e->e_flags = BlankEnvelope.e_flags;
2283 		goto domorework;
2284 	}
2285 
2286 	/* No more queues in work group to process. Now check persistent. */
2287 	if (bitset(RWG_PERSISTENT, flags))
2288 	{
2289 		sequenceno = 1;
2290 		sm_setproctitle(true, CurEnv, "running queue: %s",
2291 				qid_printqueue(qgrp, qdir));
2292 
2293 		/*
2294 		**  close bogus maps, i.e., maps which caused a tempfail,
2295 		**	so we get fresh map connections on the next lookup.
2296 		**  closemaps() is also called when children are started.
2297 		*/
2298 
2299 		closemaps(true);
2300 
2301 		/* Close any cached connections. */
2302 		mci_flush(true, NULL);
2303 
2304 		/* Clean out expired related entries. */
2305 		rmexpstab();
2306 
2307 #if NAMED_BIND
2308 		/* Update MX records for FallbackMX. */
2309 		if (FallbackMX != NULL)
2310 			(void) getfallbackmxrr(FallbackMX);
2311 #endif /* NAMED_BIND */
2312 
2313 #if USERDB
2314 		/* close UserDatabase */
2315 		_udbx_close();
2316 #endif /* USERDB */
2317 
2318 #if SM_HEAP_CHECK
2319 		if (sm_debug_active(&SmHeapCheck, 2)
2320 		    && access("memdump", F_OK) == 0
2321 		   )
2322 		{
2323 			SM_FILE_T *out;
2324 
2325 			remove("memdump");
2326 			out = sm_io_open(SmFtStdio, SM_TIME_DEFAULT,
2327 					 "memdump.out", SM_IO_APPEND, NULL);
2328 			if (out != NULL)
2329 			{
2330 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT, "----------------------\n");
2331 				sm_heap_report(out,
2332 					sm_debug_level(&SmHeapCheck) - 1);
2333 				(void) sm_io_close(out, SM_TIME_DEFAULT);
2334 			}
2335 		}
2336 #endif /* SM_HEAP_CHECK */
2337 
2338 		/* let me rest for a second to catch my breath */
2339 		if (njobs == 0 && WorkGrp[wgrp].wg_lowqintvl < MIN_SLEEP_TIME)
2340 			sleep(MIN_SLEEP_TIME);
2341 		else if (WorkGrp[wgrp].wg_lowqintvl <= 0)
2342 			sleep(QueueIntvl > 0 ? QueueIntvl : MIN_SLEEP_TIME);
2343 		else
2344 			sleep(WorkGrp[wgrp].wg_lowqintvl);
2345 
2346 		/*
2347 		**  Get the LA outside the WorkQ loop if necessary.
2348 		**  In a persistent queue runner the code is repeated over
2349 		**  and over but gatherq() may ignore entries due to
2350 		**  shouldqueue() (do we really have to do this twice?).
2351 		**  Hence the queue runners would just idle around when once
2352 		**  CurrentLA caused all entries in a queue to be ignored.
2353 		*/
2354 
2355 		if (njobs == 0)
2356 			SM_GET_LA(now);
2357 		rpool = sm_rpool_new_x(NULL);
2358 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2359 		e->e_flags = BlankEnvelope.e_flags;
2360 		goto domorework;
2361 	}
2362 
2363 	/* exit without the usual cleanup */
2364 	e->e_id = NULL;
2365 	if (bitset(RWG_FORK, flags))
2366 		finis(true, true, ExitStat);
2367 	/* NOTREACHED */
2368 	return true;
2369 }
2370 
2371 /*
2372 **  DOQUEUERUN -- do a queue run?
2373 */
2374 
2375 bool
2376 doqueuerun()
2377 {
2378 	return DoQueueRun;
2379 }
2380 
2381 /*
2382 **  RUNQUEUEEVENT -- Sets a flag to indicate that a queue run should be done.
2383 **
2384 **	Parameters:
2385 **		none.
2386 **
2387 **	Returns:
2388 **		none.
2389 **
2390 **	Side Effects:
2391 **		The invocation of this function via an alarm may interrupt
2392 **		a set of actions. Thus errno may be set in that context.
2393 **		We need to restore errno at the end of this function to ensure
2394 **		that any work done here that sets errno doesn't return a
2395 **		misleading/false errno value. Errno may	be EINTR upon entry to
2396 **		this function because of non-restartable/continuable system
2397 **		API was active. Iff this is true we will override errno as
2398 **		a timeout (as a more accurate error message).
2399 **
2400 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
2401 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
2402 **		DOING.
2403 */
2404 
2405 void
2406 runqueueevent(ignore)
2407 	int ignore;
2408 {
2409 	int save_errno = errno;
2410 
2411 	/*
2412 	**  Set the general bit that we want a queue run,
2413 	**  tested in doqueuerun()
2414 	*/
2415 
2416 	DoQueueRun = true;
2417 #if _FFR_QUEUE_SCHED_DBG
2418 	if (tTd(69, 10))
2419 		sm_syslog(LOG_INFO, NOQID, "rqe: done");
2420 #endif /* _FFR_QUEUE_SCHED_DBG */
2421 
2422 	errno = save_errno;
2423 	if (errno == EINTR)
2424 		errno = ETIMEDOUT;
2425 }
2426 /*
2427 **  GATHERQ -- gather messages from the message queue(s) the work queue.
2428 **
2429 **	Parameters:
2430 **		qgrp -- the index of the queue group.
2431 **		qdir -- the index of the queue directory.
2432 **		doall -- if set, include everything in the queue (even
2433 **			the jobs that cannot be run because the load
2434 **			average is too high, or MaxQueueRun is reached).
2435 **			Otherwise, exclude those jobs.
2436 **		full -- (optional) to be set 'true' if WorkList is full
2437 **		more -- (optional) to be set 'true' if there are still more
2438 **			messages in this queue not added to WorkList
2439 **
2440 **	Returns:
2441 **		The number of request in the queue (not necessarily
2442 **		the number of requests in WorkList however).
2443 **
2444 **	Side Effects:
2445 **		prepares available work into WorkList
2446 */
2447 
2448 #define NEED_P		0001	/* 'P': priority */
2449 #define NEED_T		0002	/* 'T': time */
2450 #define NEED_R		0004	/* 'R': recipient */
2451 #define NEED_S		0010	/* 'S': sender */
2452 #define NEED_H		0020	/* host */
2453 #define HAS_QUARANTINE	0040	/* has an unexpected 'q' line */
2454 #define NEED_QUARANTINE	0100	/* 'q': reason */
2455 
2456 static WORK	*WorkList = NULL;	/* list of unsort work */
2457 static int	WorkListSize = 0;	/* current max size of WorkList */
2458 static int	WorkListCount = 0;	/* # of work items in WorkList */
2459 
2460 static int
2461 gatherq(qgrp, qdir, doall, full, more)
2462 	int qgrp;
2463 	int qdir;
2464 	bool doall;
2465 	bool *full;
2466 	bool *more;
2467 {
2468 	register struct dirent *d;
2469 	register WORK *w;
2470 	register char *p;
2471 	DIR *f;
2472 	int i, num_ent;
2473 	int wn;
2474 	QUEUE_CHAR *check;
2475 	char qd[MAXPATHLEN];
2476 	char qf[MAXPATHLEN];
2477 
2478 	wn = WorkListCount - 1;
2479 	num_ent = 0;
2480 	if (qdir == NOQDIR)
2481 		(void) sm_strlcpy(qd, ".", sizeof qd);
2482 	else
2483 		(void) sm_strlcpyn(qd, sizeof qd, 2,
2484 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
2485 			(bitset(QP_SUBQF,
2486 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
2487 					? "/qf" : ""));
2488 
2489 	if (tTd(41, 1))
2490 	{
2491 		sm_dprintf("gatherq:\n");
2492 
2493 		check = QueueLimitId;
2494 		while (check != NULL)
2495 		{
2496 			sm_dprintf("\tQueueLimitId = %s%s\n",
2497 				check->queue_negate ? "!" : "",
2498 				check->queue_match);
2499 			check = check->queue_next;
2500 		}
2501 
2502 		check = QueueLimitSender;
2503 		while (check != NULL)
2504 		{
2505 			sm_dprintf("\tQueueLimitSender = %s%s\n",
2506 				check->queue_negate ? "!" : "",
2507 				check->queue_match);
2508 			check = check->queue_next;
2509 		}
2510 
2511 		check = QueueLimitRecipient;
2512 		while (check != NULL)
2513 		{
2514 			sm_dprintf("\tQueueLimitRecipient = %s%s\n",
2515 				check->queue_negate ? "!" : "",
2516 				check->queue_match);
2517 			check = check->queue_next;
2518 		}
2519 
2520 		if (QueueMode == QM_QUARANTINE)
2521 		{
2522 			check = QueueLimitQuarantine;
2523 			while (check != NULL)
2524 			{
2525 				sm_dprintf("\tQueueLimitQuarantine = %s%s\n",
2526 					   check->queue_negate ? "!" : "",
2527 					   check->queue_match);
2528 				check = check->queue_next;
2529 			}
2530 		}
2531 	}
2532 
2533 	/* open the queue directory */
2534 	f = opendir(qd);
2535 	if (f == NULL)
2536 	{
2537 		syserr("gatherq: cannot open \"%s\"",
2538 			qid_printqueue(qgrp, qdir));
2539 		if (full != NULL)
2540 			*full = WorkListCount >= MaxQueueRun && MaxQueueRun > 0;
2541 		if (more != NULL)
2542 			*more = false;
2543 		return 0;
2544 	}
2545 
2546 	/*
2547 	**  Read the work directory.
2548 	*/
2549 
2550 	while ((d = readdir(f)) != NULL)
2551 	{
2552 		SM_FILE_T *cf;
2553 		int qfver = 0;
2554 		char lbuf[MAXNAME + 1];
2555 		struct stat sbuf;
2556 
2557 		if (tTd(41, 50))
2558 			sm_dprintf("gatherq: checking %s..", d->d_name);
2559 
2560 		/* is this an interesting entry? */
2561 		if (!(((QueueMode == QM_NORMAL &&
2562 			d->d_name[0] == NORMQF_LETTER) ||
2563 		       (QueueMode == QM_QUARANTINE &&
2564 			d->d_name[0] == QUARQF_LETTER) ||
2565 		       (QueueMode == QM_LOST &&
2566 			d->d_name[0] == LOSEQF_LETTER)) &&
2567 		      d->d_name[1] == 'f'))
2568 		{
2569 			if (tTd(41, 50))
2570 				sm_dprintf("  skipping\n");
2571 			continue;
2572 		}
2573 		if (tTd(41, 50))
2574 			sm_dprintf("\n");
2575 
2576 		if (strlen(d->d_name) >= MAXQFNAME)
2577 		{
2578 			if (Verbose)
2579 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
2580 						     "gatherq: %s too long, %d max characters\n",
2581 						     d->d_name, MAXQFNAME);
2582 			if (LogLevel > 0)
2583 				sm_syslog(LOG_ALERT, NOQID,
2584 					  "gatherq: %s too long, %d max characters",
2585 					  d->d_name, MAXQFNAME);
2586 			continue;
2587 		}
2588 
2589 		check = QueueLimitId;
2590 		while (check != NULL)
2591 		{
2592 			if (strcontainedin(false, check->queue_match,
2593 					   d->d_name) != check->queue_negate)
2594 				break;
2595 			else
2596 				check = check->queue_next;
2597 		}
2598 		if (QueueLimitId != NULL && check == NULL)
2599 			continue;
2600 
2601 		/* grow work list if necessary */
2602 		if (++wn >= MaxQueueRun && MaxQueueRun > 0)
2603 		{
2604 			if (wn == MaxQueueRun && LogLevel > 0)
2605 				sm_syslog(LOG_WARNING, NOQID,
2606 					  "WorkList for %s maxed out at %d",
2607 					  qid_printqueue(qgrp, qdir),
2608 					  MaxQueueRun);
2609 			if (doall)
2610 				continue;	/* just count entries */
2611 			break;
2612 		}
2613 		if (wn >= WorkListSize)
2614 		{
2615 			grow_wlist(qgrp, qdir);
2616 			if (wn >= WorkListSize)
2617 				continue;
2618 		}
2619 		SM_ASSERT(wn >= 0);
2620 		w = &WorkList[wn];
2621 
2622 		(void) sm_strlcpyn(qf, sizeof qf, 3, qd, "/", d->d_name);
2623 		if (stat(qf, &sbuf) < 0)
2624 		{
2625 			if (errno != ENOENT)
2626 				sm_syslog(LOG_INFO, NOQID,
2627 					  "gatherq: can't stat %s/%s",
2628 					  qid_printqueue(qgrp, qdir),
2629 					  d->d_name);
2630 			wn--;
2631 			continue;
2632 		}
2633 		if (!bitset(S_IFREG, sbuf.st_mode))
2634 		{
2635 			/* Yikes!  Skip it or we will hang on open! */
2636 			if (!((d->d_name[0] == DATAFL_LETTER ||
2637 			       d->d_name[0] == NORMQF_LETTER ||
2638 			       d->d_name[0] == QUARQF_LETTER ||
2639 			       d->d_name[0] == LOSEQF_LETTER ||
2640 			       d->d_name[0] == XSCRPT_LETTER) &&
2641 			      d->d_name[1] == 'f' && d->d_name[2] == '\0'))
2642 				syserr("gatherq: %s/%s is not a regular file",
2643 				       qid_printqueue(qgrp, qdir), d->d_name);
2644 			wn--;
2645 			continue;
2646 		}
2647 
2648 		/* avoid work if possible */
2649 		if ((QueueSortOrder == QSO_BYFILENAME ||
2650 		     QueueSortOrder == QSO_BYMODTIME ||
2651 		     QueueSortOrder == QSO_RANDOM) &&
2652 		    QueueLimitQuarantine == NULL &&
2653 		    QueueLimitSender == NULL &&
2654 		    QueueLimitRecipient == NULL)
2655 		{
2656 			w->w_qgrp = qgrp;
2657 			w->w_qdir = qdir;
2658 			w->w_name = newstr(d->d_name);
2659 			w->w_host = NULL;
2660 			w->w_lock = w->w_tooyoung = false;
2661 			w->w_pri = 0;
2662 			w->w_ctime = 0;
2663 			w->w_mtime = sbuf.st_mtime;
2664 			++num_ent;
2665 			continue;
2666 		}
2667 
2668 		/* open control file */
2669 		cf = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
2670 				NULL);
2671 		if (cf == NULL && OpMode != MD_PRINT)
2672 		{
2673 			/* this may be some random person sending hir msgs */
2674 			if (tTd(41, 2))
2675 				sm_dprintf("gatherq: cannot open %s: %s\n",
2676 					d->d_name, sm_errstring(errno));
2677 			errno = 0;
2678 			wn--;
2679 			continue;
2680 		}
2681 		w->w_qgrp = qgrp;
2682 		w->w_qdir = qdir;
2683 		w->w_name = newstr(d->d_name);
2684 		w->w_host = NULL;
2685 		if (cf != NULL)
2686 		{
2687 			w->w_lock = !lockfile(sm_io_getinfo(cf, SM_IO_WHAT_FD,
2688 							    NULL),
2689 					      w->w_name, NULL,
2690 					      LOCK_SH|LOCK_NB);
2691 		}
2692 		w->w_tooyoung = false;
2693 
2694 		/* make sure jobs in creation don't clog queue */
2695 		w->w_pri = 0x7fffffff;
2696 		w->w_ctime = 0;
2697 		w->w_mtime = sbuf.st_mtime;
2698 
2699 		/* extract useful information */
2700 		i = NEED_P|NEED_T;
2701 		if (QueueSortOrder == QSO_BYHOST
2702 #if _FFR_RHS
2703 		    || QueueSortOrder == QSO_BYSHUFFLE
2704 #endif /* _FFR_RHS */
2705 		   )
2706 		{
2707 			/* need w_host set for host sort order */
2708 			i |= NEED_H;
2709 		}
2710 		if (QueueLimitSender != NULL)
2711 			i |= NEED_S;
2712 		if (QueueLimitRecipient != NULL)
2713 			i |= NEED_R;
2714 		if (QueueLimitQuarantine != NULL)
2715 			i |= NEED_QUARANTINE;
2716 		while (cf != NULL && i != 0 &&
2717 		       sm_io_fgets(cf, SM_TIME_DEFAULT, lbuf,
2718 				   sizeof lbuf) != NULL)
2719 		{
2720 			int c;
2721 			time_t age;
2722 
2723 			p = strchr(lbuf, '\n');
2724 			if (p != NULL)
2725 				*p = '\0';
2726 			else
2727 			{
2728 				/* flush rest of overly long line */
2729 				while ((c = sm_io_getc(cf, SM_TIME_DEFAULT))
2730 				       != SM_IO_EOF && c != '\n')
2731 					continue;
2732 			}
2733 
2734 			switch (lbuf[0])
2735 			{
2736 			  case 'V':
2737 				qfver = atoi(&lbuf[1]);
2738 				break;
2739 
2740 			  case 'P':
2741 				w->w_pri = atol(&lbuf[1]);
2742 				i &= ~NEED_P;
2743 				break;
2744 
2745 			  case 'T':
2746 				w->w_ctime = atol(&lbuf[1]);
2747 				i &= ~NEED_T;
2748 				break;
2749 
2750 			  case 'q':
2751 				if (QueueMode != QM_QUARANTINE &&
2752 				    QueueMode != QM_LOST)
2753 				{
2754 					if (tTd(41, 49))
2755 						sm_dprintf("%s not marked as quarantined but has a 'q' line\n",
2756 							   w->w_name);
2757 					i |= HAS_QUARANTINE;
2758 				}
2759 				else if (QueueMode == QM_QUARANTINE)
2760 				{
2761 					if (QueueLimitQuarantine == NULL)
2762 					{
2763 						i &= ~NEED_QUARANTINE;
2764 						break;
2765 					}
2766 					p = &lbuf[1];
2767 					check = QueueLimitQuarantine;
2768 					while (check != NULL)
2769 					{
2770 						if (strcontainedin(false,
2771 								   check->queue_match,
2772 								   p) !=
2773 						    check->queue_negate)
2774 							break;
2775 						else
2776 							check = check->queue_next;
2777 					}
2778 					if (check != NULL)
2779 						i &= ~NEED_QUARANTINE;
2780 				}
2781 				break;
2782 
2783 			  case 'R':
2784 				if (w->w_host == NULL &&
2785 				    (p = strrchr(&lbuf[1], '@')) != NULL)
2786 				{
2787 #if _FFR_RHS
2788 					if (QueueSortOrder == QSO_BYSHUFFLE)
2789 						w->w_host = newstr(&p[1]);
2790 					else
2791 #endif /* _FFR_RHS */
2792 						w->w_host = strrev(&p[1]);
2793 					makelower(w->w_host);
2794 					i &= ~NEED_H;
2795 				}
2796 				if (QueueLimitRecipient == NULL)
2797 				{
2798 					i &= ~NEED_R;
2799 					break;
2800 				}
2801 				if (qfver > 0)
2802 				{
2803 					p = strchr(&lbuf[1], ':');
2804 					if (p == NULL)
2805 						p = &lbuf[1];
2806 					else
2807 						++p; /* skip over ':' */
2808 				}
2809 				else
2810 					p = &lbuf[1];
2811 				check = QueueLimitRecipient;
2812 				while (check != NULL)
2813 				{
2814 					if (strcontainedin(true,
2815 							   check->queue_match,
2816 							   p) !=
2817 					    check->queue_negate)
2818 						break;
2819 					else
2820 						check = check->queue_next;
2821 				}
2822 				if (check != NULL)
2823 					i &= ~NEED_R;
2824 				break;
2825 
2826 			  case 'S':
2827 				check = QueueLimitSender;
2828 				while (check != NULL)
2829 				{
2830 					if (strcontainedin(true,
2831 							   check->queue_match,
2832 							   &lbuf[1]) !=
2833 					    check->queue_negate)
2834 						break;
2835 					else
2836 						check = check->queue_next;
2837 				}
2838 				if (check != NULL)
2839 					i &= ~NEED_S;
2840 				break;
2841 
2842 			  case 'K':
2843 				age = curtime() - (time_t) atol(&lbuf[1]);
2844 				if (age >= 0 && MinQueueAge > 0 &&
2845 				    age < MinQueueAge)
2846 					w->w_tooyoung = true;
2847 				break;
2848 
2849 			  case 'N':
2850 				if (atol(&lbuf[1]) == 0)
2851 					w->w_tooyoung = false;
2852 				break;
2853 			}
2854 		}
2855 		if (cf != NULL)
2856 			(void) sm_io_close(cf, SM_TIME_DEFAULT);
2857 
2858 		if ((!doall && (shouldqueue(w->w_pri, w->w_ctime) ||
2859 		    w->w_tooyoung)) ||
2860 		    bitset(HAS_QUARANTINE, i) ||
2861 		    bitset(NEED_QUARANTINE, i) ||
2862 		    bitset(NEED_R|NEED_S, i))
2863 		{
2864 			/* don't even bother sorting this job in */
2865 			if (tTd(41, 49))
2866 				sm_dprintf("skipping %s (%x)\n", w->w_name, i);
2867 			sm_free(w->w_name); /* XXX */
2868 			if (w->w_host != NULL)
2869 				sm_free(w->w_host); /* XXX */
2870 			wn--;
2871 		}
2872 		else
2873 			++num_ent;
2874 	}
2875 	(void) closedir(f);
2876 	wn++;
2877 
2878 	i = wn - WorkListCount;
2879 	WorkListCount += SM_MIN(num_ent, WorkListSize);
2880 
2881 	if (more != NULL)
2882 		*more = WorkListCount < wn;
2883 
2884 	if (full != NULL)
2885 		*full = (wn >= MaxQueueRun && MaxQueueRun > 0) ||
2886 			(WorkList == NULL && wn > 0);
2887 
2888 	return i;
2889 }
2890 /*
2891 **  SORTQ -- sort the work list
2892 **
2893 **	First the old WorkQ is cleared away. Then the WorkList is sorted
2894 **	for all items so that important (higher sorting value) items are not
2895 **	trunctated off. Then the most important items are moved from
2896 **	WorkList to WorkQ. The lower count of 'max' or MaxListCount items
2897 **	are moved.
2898 **
2899 **	Parameters:
2900 **		max -- maximum number of items to be placed in WorkQ
2901 **
2902 **	Returns:
2903 **		the number of items in WorkQ
2904 **
2905 **	Side Effects:
2906 **		WorkQ gets released and filled with new work. WorkList
2907 **		gets released. Work items get sorted in order.
2908 */
2909 
2910 static int
2911 sortq(max)
2912 	int max;
2913 {
2914 	register int i;			/* local counter */
2915 	register WORK *w;		/* tmp item pointer */
2916 	int wc = WorkListCount;		/* trim size for WorkQ */
2917 
2918 	if (WorkQ != NULL)
2919 	{
2920 		WORK *nw;
2921 
2922 		/* Clear out old WorkQ. */
2923 		for (w = WorkQ; w != NULL; w = nw)
2924 		{
2925 			nw = w->w_next;
2926 			sm_free(w->w_name); /* XXX */
2927 			if (w->w_host != NULL)
2928 				sm_free(w->w_host); /* XXX */
2929 			sm_free((char *) w); /* XXX */
2930 		}
2931 		WorkQ = NULL;
2932 	}
2933 
2934 	if (WorkList == NULL || wc <= 0)
2935 		return 0;
2936 
2937 	/*
2938 	**  The sort now takes place using all of the items in WorkList.
2939 	**  The list gets trimmed to the most important items after the sort.
2940 	**  If the trim were to happen before the sort then one or more
2941 	**  important items might get truncated off -- not what we want.
2942 	*/
2943 
2944 	if (QueueSortOrder == QSO_BYHOST)
2945 	{
2946 		/*
2947 		**  Sort the work directory for the first time,
2948 		**  based on host name, lock status, and priority.
2949 		*/
2950 
2951 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf1);
2952 
2953 		/*
2954 		**  If one message to host is locked, "lock" all messages
2955 		**  to that host.
2956 		*/
2957 
2958 		i = 0;
2959 		while (i < wc)
2960 		{
2961 			if (!WorkList[i].w_lock)
2962 			{
2963 				i++;
2964 				continue;
2965 			}
2966 			w = &WorkList[i];
2967 			while (++i < wc)
2968 			{
2969 				if (WorkList[i].w_host == NULL &&
2970 				    w->w_host == NULL)
2971 					WorkList[i].w_lock = true;
2972 				else if (WorkList[i].w_host != NULL &&
2973 					 w->w_host != NULL &&
2974 					 sm_strcasecmp(WorkList[i].w_host,
2975 						       w->w_host) == 0)
2976 					WorkList[i].w_lock = true;
2977 				else
2978 					break;
2979 			}
2980 		}
2981 
2982 		/*
2983 		**  Sort the work directory for the second time,
2984 		**  based on lock status, host name, and priority.
2985 		*/
2986 
2987 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf2);
2988 	}
2989 	else if (QueueSortOrder == QSO_BYTIME)
2990 	{
2991 		/*
2992 		**  Simple sort based on submission time only.
2993 		*/
2994 
2995 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf3);
2996 	}
2997 	else if (QueueSortOrder == QSO_BYFILENAME)
2998 	{
2999 		/*
3000 		**  Sort based on queue filename.
3001 		*/
3002 
3003 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf4);
3004 	}
3005 	else if (QueueSortOrder == QSO_RANDOM)
3006 	{
3007 		/*
3008 		**  Sort randomly.  To avoid problems with an instable sort,
3009 		**  use a random index into the queue file name to start
3010 		**  comparison.
3011 		*/
3012 
3013 		randi = get_rand_mod(MAXQFNAME);
3014 		if (randi < 2)
3015 			randi = 3;
3016 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf5);
3017 	}
3018 	else if (QueueSortOrder == QSO_BYMODTIME)
3019 	{
3020 		/*
3021 		**  Simple sort based on modification time of queue file.
3022 		**  This puts the oldest items first.
3023 		*/
3024 
3025 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf6);
3026 	}
3027 #if _FFR_RHS
3028 	else if (QueueSortOrder == QSO_BYSHUFFLE)
3029 	{
3030 		/*
3031 		**  Simple sort based on shuffled host name.
3032 		*/
3033 
3034 		init_shuffle_alphabet();
3035 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf7);
3036 	}
3037 #endif /* _FFR_RHS */
3038 	else if (QueueSortOrder == QSO_BYPRIORITY)
3039 	{
3040 		/*
3041 		**  Simple sort based on queue priority only.
3042 		*/
3043 
3044 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf0);
3045 	}
3046 	/* else don't sort at all */
3047 
3048 	/* Check if the per queue group item limit will be exceeded */
3049 	if (wc > max && max > 0)
3050 		wc = max;
3051 
3052 	/*
3053 	**  Convert the work list into canonical form.
3054 	**	Should be turning it into a list of envelopes here perhaps.
3055 	**  Only take the most important items up to the per queue group
3056 	**  maximum.
3057 	*/
3058 
3059 	for (i = wc; --i >= 0; )
3060 	{
3061 		w = (WORK *) xalloc(sizeof *w);
3062 		w->w_qgrp = WorkList[i].w_qgrp;
3063 		w->w_qdir = WorkList[i].w_qdir;
3064 		w->w_name = WorkList[i].w_name;
3065 		w->w_host = WorkList[i].w_host;
3066 		w->w_lock = WorkList[i].w_lock;
3067 		w->w_tooyoung = WorkList[i].w_tooyoung;
3068 		w->w_pri = WorkList[i].w_pri;
3069 		w->w_ctime = WorkList[i].w_ctime;
3070 		w->w_mtime = WorkList[i].w_mtime;
3071 		w->w_next = WorkQ;
3072 		WorkQ = w;
3073 	}
3074 
3075 	/* free the rest of the list */
3076 	for (i = WorkListCount; --i >= wc; )
3077 	{
3078 		sm_free(WorkList[i].w_name);
3079 		if (WorkList[i].w_host != NULL)
3080 			sm_free(WorkList[i].w_host);
3081 	}
3082 
3083 	if (WorkList != NULL)
3084 		sm_free(WorkList); /* XXX */
3085 	WorkList = NULL;
3086 	WorkListSize = 0;
3087 	WorkListCount = 0;
3088 
3089 	if (tTd(40, 1))
3090 	{
3091 		for (w = WorkQ; w != NULL; w = w->w_next)
3092 		{
3093 			if (w->w_host != NULL)
3094 				sm_dprintf("%22s: pri=%ld %s\n",
3095 					w->w_name, w->w_pri, w->w_host);
3096 			else
3097 				sm_dprintf("%32s: pri=%ld\n",
3098 					w->w_name, w->w_pri);
3099 		}
3100 	}
3101 
3102 	return wc; /* return number of WorkQ items */
3103 }
3104 /*
3105 **  GROW_WLIST -- make the work list larger
3106 **
3107 **	Parameters:
3108 **		qgrp -- the index for the queue group.
3109 **		qdir -- the index for the queue directory.
3110 **
3111 **	Returns:
3112 **		none.
3113 **
3114 **	Side Effects:
3115 **		Adds another QUEUESEGSIZE entries to WorkList if possible.
3116 **		It can fail if there isn't enough memory, so WorkListSize
3117 **		should be checked again upon return.
3118 */
3119 
3120 static void
3121 grow_wlist(qgrp, qdir)
3122 	int qgrp;
3123 	int qdir;
3124 {
3125 	if (tTd(41, 1))
3126 		sm_dprintf("grow_wlist: WorkListSize=%d\n", WorkListSize);
3127 	if (WorkList == NULL)
3128 	{
3129 		WorkList = (WORK *) xalloc((sizeof *WorkList) *
3130 					   (QUEUESEGSIZE + 1));
3131 		WorkListSize = QUEUESEGSIZE;
3132 	}
3133 	else
3134 	{
3135 		int newsize = WorkListSize + QUEUESEGSIZE;
3136 		WORK *newlist = (WORK *) sm_realloc((char *) WorkList,
3137 					  (unsigned) sizeof(WORK) * (newsize + 1));
3138 
3139 		if (newlist != NULL)
3140 		{
3141 			WorkListSize = newsize;
3142 			WorkList = newlist;
3143 			if (LogLevel > 1)
3144 			{
3145 				sm_syslog(LOG_INFO, NOQID,
3146 					  "grew WorkList for %s to %d",
3147 					  qid_printqueue(qgrp, qdir),
3148 					  WorkListSize);
3149 			}
3150 		}
3151 		else if (LogLevel > 0)
3152 		{
3153 			sm_syslog(LOG_ALERT, NOQID,
3154 				  "FAILED to grow WorkList for %s to %d",
3155 				  qid_printqueue(qgrp, qdir), newsize);
3156 		}
3157 	}
3158 	if (tTd(41, 1))
3159 		sm_dprintf("grow_wlist: WorkListSize now %d\n", WorkListSize);
3160 }
3161 /*
3162 **  WORKCMPF0 -- simple priority-only compare function.
3163 **
3164 **	Parameters:
3165 **		a -- the first argument.
3166 **		b -- the second argument.
3167 **
3168 **	Returns:
3169 **		-1 if a < b
3170 **		 0 if a == b
3171 **		+1 if a > b
3172 **
3173 */
3174 
3175 static int
3176 workcmpf0(a, b)
3177 	register WORK *a;
3178 	register WORK *b;
3179 {
3180 	long pa = a->w_pri;
3181 	long pb = b->w_pri;
3182 
3183 	if (pa == pb)
3184 		return 0;
3185 	else if (pa > pb)
3186 		return 1;
3187 	else
3188 		return -1;
3189 }
3190 /*
3191 **  WORKCMPF1 -- first compare function for ordering work based on host name.
3192 **
3193 **	Sorts on host name, lock status, and priority in that order.
3194 **
3195 **	Parameters:
3196 **		a -- the first argument.
3197 **		b -- the second argument.
3198 **
3199 **	Returns:
3200 **		<0 if a < b
3201 **		 0 if a == b
3202 **		>0 if a > b
3203 **
3204 */
3205 
3206 static int
3207 workcmpf1(a, b)
3208 	register WORK *a;
3209 	register WORK *b;
3210 {
3211 	int i;
3212 
3213 	/* host name */
3214 	if (a->w_host != NULL && b->w_host == NULL)
3215 		return 1;
3216 	else if (a->w_host == NULL && b->w_host != NULL)
3217 		return -1;
3218 	if (a->w_host != NULL && b->w_host != NULL &&
3219 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3220 		return i;
3221 
3222 	/* lock status */
3223 	if (a->w_lock != b->w_lock)
3224 		return b->w_lock - a->w_lock;
3225 
3226 	/* job priority */
3227 	return workcmpf0(a, b);
3228 }
3229 /*
3230 **  WORKCMPF2 -- second compare function for ordering work based on host name.
3231 **
3232 **	Sorts on lock status, host name, and priority in that order.
3233 **
3234 **	Parameters:
3235 **		a -- the first argument.
3236 **		b -- the second argument.
3237 **
3238 **	Returns:
3239 **		<0 if a < b
3240 **		 0 if a == b
3241 **		>0 if a > b
3242 **
3243 */
3244 
3245 static int
3246 workcmpf2(a, b)
3247 	register WORK *a;
3248 	register WORK *b;
3249 {
3250 	int i;
3251 
3252 	/* lock status */
3253 	if (a->w_lock != b->w_lock)
3254 		return a->w_lock - b->w_lock;
3255 
3256 	/* host name */
3257 	if (a->w_host != NULL && b->w_host == NULL)
3258 		return 1;
3259 	else if (a->w_host == NULL && b->w_host != NULL)
3260 		return -1;
3261 	if (a->w_host != NULL && b->w_host != NULL &&
3262 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3263 		return i;
3264 
3265 	/* job priority */
3266 	return workcmpf0(a, b);
3267 }
3268 /*
3269 **  WORKCMPF3 -- simple submission-time-only compare function.
3270 **
3271 **	Parameters:
3272 **		a -- the first argument.
3273 **		b -- the second argument.
3274 **
3275 **	Returns:
3276 **		-1 if a < b
3277 **		 0 if a == b
3278 **		+1 if a > b
3279 **
3280 */
3281 
3282 static int
3283 workcmpf3(a, b)
3284 	register WORK *a;
3285 	register WORK *b;
3286 {
3287 	if (a->w_ctime > b->w_ctime)
3288 		return 1;
3289 	else if (a->w_ctime < b->w_ctime)
3290 		return -1;
3291 	else
3292 		return 0;
3293 }
3294 /*
3295 **  WORKCMPF4 -- compare based on file name
3296 **
3297 **	Parameters:
3298 **		a -- the first argument.
3299 **		b -- the second argument.
3300 **
3301 **	Returns:
3302 **		-1 if a < b
3303 **		 0 if a == b
3304 **		+1 if a > b
3305 **
3306 */
3307 
3308 static int
3309 workcmpf4(a, b)
3310 	register WORK *a;
3311 	register WORK *b;
3312 {
3313 	return strcmp(a->w_name, b->w_name);
3314 }
3315 /*
3316 **  WORKCMPF5 -- compare based on assigned random number
3317 **
3318 **	Parameters:
3319 **		a -- the first argument (ignored).
3320 **		b -- the second argument (ignored).
3321 **
3322 **	Returns:
3323 **		randomly 1/-1
3324 */
3325 
3326 /* ARGSUSED0 */
3327 static int
3328 workcmpf5(a, b)
3329 	register WORK *a;
3330 	register WORK *b;
3331 {
3332 	if (strlen(a->w_name) < randi || strlen(b->w_name) < randi)
3333 		return -1;
3334 	return a->w_name[randi] - b->w_name[randi];
3335 }
3336 /*
3337 **  WORKCMPF6 -- simple modification-time-only compare function.
3338 **
3339 **	Parameters:
3340 **		a -- the first argument.
3341 **		b -- the second argument.
3342 **
3343 **	Returns:
3344 **		-1 if a < b
3345 **		 0 if a == b
3346 **		+1 if a > b
3347 **
3348 */
3349 
3350 static int
3351 workcmpf6(a, b)
3352 	register WORK *a;
3353 	register WORK *b;
3354 {
3355 	if (a->w_mtime > b->w_mtime)
3356 		return 1;
3357 	else if (a->w_mtime < b->w_mtime)
3358 		return -1;
3359 	else
3360 		return 0;
3361 }
3362 #if _FFR_RHS
3363 /*
3364 **  WORKCMPF7 -- compare function for ordering work based on shuffled host name.
3365 **
3366 **	Sorts on lock status, host name, and priority in that order.
3367 **
3368 **	Parameters:
3369 **		a -- the first argument.
3370 **		b -- the second argument.
3371 **
3372 **	Returns:
3373 **		<0 if a < b
3374 **		 0 if a == b
3375 **		>0 if a > b
3376 **
3377 */
3378 
3379 static int
3380 workcmpf7(a, b)
3381 	register WORK *a;
3382 	register WORK *b;
3383 {
3384 	int i;
3385 
3386 	/* lock status */
3387 	if (a->w_lock != b->w_lock)
3388 		return a->w_lock - b->w_lock;
3389 
3390 	/* host name */
3391 	if (a->w_host != NULL && b->w_host == NULL)
3392 		return 1;
3393 	else if (a->w_host == NULL && b->w_host != NULL)
3394 		return -1;
3395 	if (a->w_host != NULL && b->w_host != NULL &&
3396 	    (i = sm_strshufflecmp(a->w_host, b->w_host)) != 0)
3397 		return i;
3398 
3399 	/* job priority */
3400 	return workcmpf0(a, b);
3401 }
3402 #endif /* _FFR_RHS */
3403 /*
3404 **  STRREV -- reverse string
3405 **
3406 **	Returns a pointer to a new string that is the reverse of
3407 **	the string pointed to by fwd.  The space for the new
3408 **	string is obtained using xalloc().
3409 **
3410 **	Parameters:
3411 **		fwd -- the string to reverse.
3412 **
3413 **	Returns:
3414 **		the reversed string.
3415 */
3416 
3417 static char *
3418 strrev(fwd)
3419 	char *fwd;
3420 {
3421 	char *rev = NULL;
3422 	int len, cnt;
3423 
3424 	len = strlen(fwd);
3425 	rev = xalloc(len + 1);
3426 	for (cnt = 0; cnt < len; ++cnt)
3427 		rev[cnt] = fwd[len - cnt - 1];
3428 	rev[len] = '\0';
3429 	return rev;
3430 }
3431 
3432 #if _FFR_RHS
3433 
3434 # define NASCII	128
3435 # define NCHAR	256
3436 
3437 static unsigned char ShuffledAlphabet[NCHAR];
3438 
3439 void
3440 init_shuffle_alphabet()
3441 {
3442 	static bool init = false;
3443 	int i;
3444 
3445 	if (init)
3446 		return;
3447 
3448 	/* fill the ShuffledAlphabet */
3449 	for (i = 0; i < NASCII; i++)
3450 		ShuffledAlphabet[i] = i;
3451 
3452 	/* mix it */
3453 	for (i = 1; i < NASCII; i++)
3454 	{
3455 		register int j = get_random() % NASCII;
3456 		register int tmp;
3457 
3458 		tmp = ShuffledAlphabet[j];
3459 		ShuffledAlphabet[j] = ShuffledAlphabet[i];
3460 		ShuffledAlphabet[i] = tmp;
3461 	}
3462 
3463 	/* make it case insensitive */
3464 	for (i = 'A'; i <= 'Z'; i++)
3465 		ShuffledAlphabet[i] = ShuffledAlphabet[i + 'a' - 'A'];
3466 
3467 	/* fill the upper part */
3468 	for (i = 0; i < NASCII; i++)
3469 		ShuffledAlphabet[i + NASCII] = ShuffledAlphabet[i];
3470 	init = true;
3471 }
3472 
3473 static int
3474 sm_strshufflecmp(a, b)
3475 	char *a;
3476 	char *b;
3477 {
3478 	const unsigned char *us1 = (const unsigned char *) a;
3479 	const unsigned char *us2 = (const unsigned char *) b;
3480 
3481 	while (ShuffledAlphabet[*us1] == ShuffledAlphabet[*us2++])
3482 	{
3483 		if (*us1++ == '\0')
3484 			return 0;
3485 	}
3486 	return (ShuffledAlphabet[*us1] - ShuffledAlphabet[*--us2]);
3487 }
3488 #endif /* _FFR_RHS */
3489 
3490 /*
3491 **  DOWORK -- do a work request.
3492 **
3493 **	Parameters:
3494 **		qgrp -- the index of the queue group for the job.
3495 **		qdir -- the index of the queue directory for the job.
3496 **		id -- the ID of the job to run.
3497 **		forkflag -- if set, run this in background.
3498 **		requeueflag -- if set, reinstantiate the queue quickly.
3499 **			This is used when expanding aliases in the queue.
3500 **			If forkflag is also set, it doesn't wait for the
3501 **			child.
3502 **		e - the envelope in which to run it.
3503 **
3504 **	Returns:
3505 **		process id of process that is running the queue job.
3506 **
3507 **	Side Effects:
3508 **		The work request is satisfied if possible.
3509 */
3510 
3511 pid_t
3512 dowork(qgrp, qdir, id, forkflag, requeueflag, e)
3513 	int qgrp;
3514 	int qdir;
3515 	char *id;
3516 	bool forkflag;
3517 	bool requeueflag;
3518 	register ENVELOPE *e;
3519 {
3520 	register pid_t pid;
3521 	SM_RPOOL_T *rpool;
3522 
3523 	if (tTd(40, 1))
3524 		sm_dprintf("dowork(%s/%s)\n", qid_printqueue(qgrp, qdir), id);
3525 
3526 	/*
3527 	**  Fork for work.
3528 	*/
3529 
3530 	if (forkflag)
3531 	{
3532 		/*
3533 		**  Since the delivery may happen in a child and the
3534 		**  parent does not wait, the parent may close the
3535 		**  maps thereby removing any shared memory used by
3536 		**  the map.  Therefore, close the maps now so the
3537 		**  child will dynamically open them if necessary.
3538 		*/
3539 
3540 		closemaps(false);
3541 
3542 		pid = fork();
3543 		if (pid < 0)
3544 		{
3545 			syserr("dowork: cannot fork");
3546 			return 0;
3547 		}
3548 		else if (pid > 0)
3549 		{
3550 			/* parent -- clean out connection cache */
3551 			mci_flush(false, NULL);
3552 		}
3553 		else
3554 		{
3555 			/*
3556 			**  Initialize exception stack and default exception
3557 			**  handler for child process.
3558 			*/
3559 
3560 			/* Reset global flags */
3561 			RestartRequest = NULL;
3562 			RestartWorkGroup = false;
3563 			ShutdownRequest = NULL;
3564 			PendingSignal = 0;
3565 			CurrentPid = getpid();
3566 			sm_exc_newthread(fatal_error);
3567 
3568 			/*
3569 			**  See note above about SMTP processes and SIGCHLD.
3570 			*/
3571 
3572 			if (OpMode == MD_SMTP ||
3573 			    OpMode == MD_DAEMON ||
3574 			    MaxQueueChildren > 0)
3575 			{
3576 				proc_list_clear();
3577 				sm_releasesignal(SIGCHLD);
3578 				(void) sm_signal(SIGCHLD, SIG_DFL);
3579 			}
3580 
3581 			/* child -- error messages to the transcript */
3582 			QuickAbort = OnlyOneError = false;
3583 		}
3584 	}
3585 	else
3586 	{
3587 		pid = 0;
3588 	}
3589 
3590 	if (pid == 0)
3591 	{
3592 		/*
3593 		**  CHILD
3594 		**	Lock the control file to avoid duplicate deliveries.
3595 		**		Then run the file as though we had just read it.
3596 		**	We save an idea of the temporary name so we
3597 		**		can recover on interrupt.
3598 		*/
3599 
3600 		if (forkflag)
3601 		{
3602 			/* Reset global flags */
3603 			RestartRequest = NULL;
3604 			RestartWorkGroup = false;
3605 			ShutdownRequest = NULL;
3606 			PendingSignal = 0;
3607 		}
3608 
3609 		/* set basic modes, etc. */
3610 		sm_clear_events();
3611 		clearstats();
3612 		rpool = sm_rpool_new_x(NULL);
3613 		clearenvelope(e, false, rpool);
3614 		e->e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3615 		set_delivery_mode(SM_DELIVER, e);
3616 		e->e_errormode = EM_MAIL;
3617 		e->e_id = id;
3618 		e->e_qgrp = qgrp;
3619 		e->e_qdir = qdir;
3620 		GrabTo = UseErrorsTo = false;
3621 		ExitStat = EX_OK;
3622 		if (forkflag)
3623 		{
3624 			disconnect(1, e);
3625 			set_op_mode(MD_QUEUERUN);
3626 		}
3627 		sm_setproctitle(true, e, "%s from queue", qid_printname(e));
3628 		if (LogLevel > 76)
3629 			sm_syslog(LOG_DEBUG, e->e_id, "dowork, pid=%d",
3630 				  (int) CurrentPid);
3631 
3632 		/* don't use the headers from sendmail.cf... */
3633 		e->e_header = NULL;
3634 
3635 		/* read the queue control file -- return if locked */
3636 		if (!readqf(e, false))
3637 		{
3638 			if (tTd(40, 4) && e->e_id != NULL)
3639 				sm_dprintf("readqf(%s) failed\n",
3640 					qid_printname(e));
3641 			e->e_id = NULL;
3642 			if (forkflag)
3643 				finis(false, true, EX_OK);
3644 			else
3645 			{
3646 				/* adding this frees 8 bytes */
3647 				clearenvelope(e, false, rpool);
3648 
3649 				/* adding this frees 12 bytes */
3650 				sm_rpool_free(rpool);
3651 				e->e_rpool = NULL;
3652 				return 0;
3653 			}
3654 		}
3655 
3656 		e->e_flags |= EF_INQUEUE;
3657 		eatheader(e, requeueflag, true);
3658 
3659 		if (requeueflag)
3660 			queueup(e, false, false);
3661 
3662 		/* do the delivery */
3663 		sendall(e, SM_DELIVER);
3664 
3665 		/* finish up and exit */
3666 		if (forkflag)
3667 			finis(true, true, ExitStat);
3668 		else
3669 		{
3670 			dropenvelope(e, true, false);
3671 			sm_rpool_free(rpool);
3672 			e->e_rpool = NULL;
3673 		}
3674 	}
3675 	e->e_id = NULL;
3676 	return pid;
3677 }
3678 
3679 /*
3680 **  DOWORKLIST -- process a list of envelopes as work requests
3681 **
3682 **	Similar to dowork(), except that after forking, it processes an
3683 **	envelope and its siblings, treating each envelope as a work request.
3684 **
3685 **	Parameters:
3686 **		el -- envelope to be processed including its siblings.
3687 **		forkflag -- if set, run this in background.
3688 **		requeueflag -- if set, reinstantiate the queue quickly.
3689 **			This is used when expanding aliases in the queue.
3690 **			If forkflag is also set, it doesn't wait for the
3691 **			child.
3692 **
3693 **	Returns:
3694 **		process id of process that is running the queue job.
3695 **
3696 **	Side Effects:
3697 **		The work request is satisfied if possible.
3698 */
3699 
3700 pid_t
3701 doworklist(el, forkflag, requeueflag)
3702 	ENVELOPE *el;
3703 	bool forkflag;
3704 	bool requeueflag;
3705 {
3706 	register pid_t pid;
3707 	ENVELOPE *ei;
3708 
3709 	if (tTd(40, 1))
3710 		sm_dprintf("doworklist()\n");
3711 
3712 	/*
3713 	**  Fork for work.
3714 	*/
3715 
3716 	if (forkflag)
3717 	{
3718 		/*
3719 		**  Since the delivery may happen in a child and the
3720 		**  parent does not wait, the parent may close the
3721 		**  maps thereby removing any shared memory used by
3722 		**  the map.  Therefore, close the maps now so the
3723 		**  child will dynamically open them if necessary.
3724 		*/
3725 
3726 		closemaps(false);
3727 
3728 		pid = fork();
3729 		if (pid < 0)
3730 		{
3731 			syserr("doworklist: cannot fork");
3732 			return 0;
3733 		}
3734 		else if (pid > 0)
3735 		{
3736 			/* parent -- clean out connection cache */
3737 			mci_flush(false, NULL);
3738 		}
3739 		else
3740 		{
3741 			/*
3742 			**  Initialize exception stack and default exception
3743 			**  handler for child process.
3744 			*/
3745 
3746 			/* Reset global flags */
3747 			RestartRequest = NULL;
3748 			RestartWorkGroup = false;
3749 			ShutdownRequest = NULL;
3750 			PendingSignal = 0;
3751 			CurrentPid = getpid();
3752 			sm_exc_newthread(fatal_error);
3753 
3754 			/*
3755 			**  See note above about SMTP processes and SIGCHLD.
3756 			*/
3757 
3758 			if (OpMode == MD_SMTP ||
3759 			    OpMode == MD_DAEMON ||
3760 			    MaxQueueChildren > 0)
3761 			{
3762 				proc_list_clear();
3763 				sm_releasesignal(SIGCHLD);
3764 				(void) sm_signal(SIGCHLD, SIG_DFL);
3765 			}
3766 
3767 			/* child -- error messages to the transcript */
3768 			QuickAbort = OnlyOneError = false;
3769 		}
3770 	}
3771 	else
3772 	{
3773 		pid = 0;
3774 	}
3775 
3776 	if (pid != 0)
3777 		return pid;
3778 
3779 	/*
3780 	**  IN CHILD
3781 	**	Lock the control file to avoid duplicate deliveries.
3782 	**		Then run the file as though we had just read it.
3783 	**	We save an idea of the temporary name so we
3784 	**		can recover on interrupt.
3785 	*/
3786 
3787 	if (forkflag)
3788 	{
3789 		/* Reset global flags */
3790 		RestartRequest = NULL;
3791 		RestartWorkGroup = false;
3792 		ShutdownRequest = NULL;
3793 		PendingSignal = 0;
3794 	}
3795 
3796 	/* set basic modes, etc. */
3797 	sm_clear_events();
3798 	clearstats();
3799 	GrabTo = UseErrorsTo = false;
3800 	ExitStat = EX_OK;
3801 	if (forkflag)
3802 	{
3803 		disconnect(1, el);
3804 		set_op_mode(MD_QUEUERUN);
3805 	}
3806 	if (LogLevel > 76)
3807 		sm_syslog(LOG_DEBUG, el->e_id, "doworklist, pid=%d",
3808 			  (int) CurrentPid);
3809 
3810 	for (ei = el; ei != NULL; ei = ei->e_sibling)
3811 	{
3812 		ENVELOPE e;
3813 		SM_RPOOL_T *rpool;
3814 
3815 		if (WILL_BE_QUEUED(ei->e_sendmode))
3816 			continue;
3817 		else if (QueueMode != QM_QUARANTINE &&
3818 			 ei->e_quarmsg != NULL)
3819 			continue;
3820 
3821 		rpool = sm_rpool_new_x(NULL);
3822 		clearenvelope(&e, true, rpool);
3823 		e.e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3824 		set_delivery_mode(SM_DELIVER, &e);
3825 		e.e_errormode = EM_MAIL;
3826 		e.e_id = ei->e_id;
3827 		e.e_qgrp = ei->e_qgrp;
3828 		e.e_qdir = ei->e_qdir;
3829 		openxscript(&e);
3830 		sm_setproctitle(true, &e, "%s from queue", qid_printname(&e));
3831 
3832 		/* don't use the headers from sendmail.cf... */
3833 		e.e_header = NULL;
3834 		CurEnv = &e;
3835 
3836 		/* read the queue control file -- return if locked */
3837 		if (readqf(&e, false))
3838 		{
3839 			e.e_flags |= EF_INQUEUE;
3840 			eatheader(&e, requeueflag, true);
3841 
3842 			if (requeueflag)
3843 				queueup(&e, false, false);
3844 
3845 			/* do the delivery */
3846 			sendall(&e, SM_DELIVER);
3847 			dropenvelope(&e, true, false);
3848 		}
3849 		else
3850 		{
3851 			if (tTd(40, 4) && e.e_id != NULL)
3852 				sm_dprintf("readqf(%s) failed\n",
3853 					qid_printname(&e));
3854 		}
3855 		sm_rpool_free(rpool);
3856 		ei->e_id = NULL;
3857 	}
3858 
3859 	/* restore CurEnv */
3860 	CurEnv = el;
3861 
3862 	/* finish up and exit */
3863 	if (forkflag)
3864 		finis(true, true, ExitStat);
3865 	return 0;
3866 }
3867 /*
3868 **  READQF -- read queue file and set up environment.
3869 **
3870 **	Parameters:
3871 **		e -- the envelope of the job to run.
3872 **		openonly -- only open the qf (returned as e_lockfp)
3873 **
3874 **	Returns:
3875 **		true if it successfully read the queue file.
3876 **		false otherwise.
3877 **
3878 **	Side Effects:
3879 **		The queue file is returned locked.
3880 */
3881 
3882 static bool
3883 readqf(e, openonly)
3884 	register ENVELOPE *e;
3885 	bool openonly;
3886 {
3887 	register SM_FILE_T *qfp;
3888 	ADDRESS *ctladdr;
3889 	struct stat st, stf;
3890 	char *bp;
3891 	int qfver = 0;
3892 	long hdrsize = 0;
3893 	register char *p;
3894 	char *frcpt = NULL;
3895 	char *orcpt = NULL;
3896 	bool nomore = false;
3897 	bool bogus = false;
3898 	MODE_T qsafe;
3899 	char *err;
3900 	char qf[MAXPATHLEN];
3901 	char buf[MAXLINE];
3902 
3903 	/*
3904 	**  Read and process the file.
3905 	*/
3906 
3907 	bp = NULL;
3908 	(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER), sizeof qf);
3909 	qfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDWR_B, NULL);
3910 	if (qfp == NULL)
3911 	{
3912 		int save_errno = errno;
3913 
3914 		if (tTd(40, 8))
3915 			sm_dprintf("readqf(%s): sm_io_open failure (%s)\n",
3916 				qf, sm_errstring(errno));
3917 		errno = save_errno;
3918 		if (errno != ENOENT
3919 		    )
3920 			syserr("readqf: no control file %s", qf);
3921 		RELEASE_QUEUE;
3922 		return false;
3923 	}
3924 
3925 	if (!lockfile(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), qf, NULL,
3926 		      LOCK_EX|LOCK_NB))
3927 	{
3928 		/* being processed by another queuer */
3929 		if (Verbose)
3930 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3931 					     "%s: locked\n", e->e_id);
3932 		if (tTd(40, 8))
3933 			sm_dprintf("%s: locked\n", e->e_id);
3934 		if (LogLevel > 19)
3935 			sm_syslog(LOG_DEBUG, e->e_id, "locked");
3936 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3937 		RELEASE_QUEUE;
3938 		return false;
3939 	}
3940 
3941 	RELEASE_QUEUE;
3942 
3943 	/*
3944 	**  Prevent locking race condition.
3945 	**
3946 	**  Process A: readqf(): qfp = fopen(qffile)
3947 	**  Process B: queueup(): rename(tf, qf)
3948 	**  Process B: unlocks(tf)
3949 	**  Process A: lockfile(qf);
3950 	**
3951 	**  Process A (us) has the old qf file (before the rename deleted
3952 	**  the directory entry) and will be delivering based on old data.
3953 	**  This can lead to multiple deliveries of the same recipients.
3954 	**
3955 	**  Catch this by checking if the underlying qf file has changed
3956 	**  *after* acquiring our lock and if so, act as though the file
3957 	**  was still locked (i.e., just return like the lockfile() case
3958 	**  above.
3959 	*/
3960 
3961 	if (stat(qf, &stf) < 0 ||
3962 	    fstat(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), &st) < 0)
3963 	{
3964 		/* must have been being processed by someone else */
3965 		if (tTd(40, 8))
3966 			sm_dprintf("readqf(%s): [f]stat failure (%s)\n",
3967 				qf, sm_errstring(errno));
3968 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3969 		return false;
3970 	}
3971 
3972 	if (st.st_nlink != stf.st_nlink ||
3973 	    st.st_dev != stf.st_dev ||
3974 	    ST_INODE(st) != ST_INODE(stf) ||
3975 #if HAS_ST_GEN && 0		/* AFS returns garbage in st_gen */
3976 	    st.st_gen != stf.st_gen ||
3977 #endif /* HAS_ST_GEN && 0 */
3978 	    st.st_uid != stf.st_uid ||
3979 	    st.st_gid != stf.st_gid ||
3980 	    st.st_size != stf.st_size)
3981 	{
3982 		/* changed after opened */
3983 		if (Verbose)
3984 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3985 					     "%s: changed\n", e->e_id);
3986 		if (tTd(40, 8))
3987 			sm_dprintf("%s: changed\n", e->e_id);
3988 		if (LogLevel > 19)
3989 			sm_syslog(LOG_DEBUG, e->e_id, "changed");
3990 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3991 		return false;
3992 	}
3993 
3994 	/*
3995 	**  Check the queue file for plausibility to avoid attacks.
3996 	*/
3997 
3998 	qsafe = S_IWOTH|S_IWGRP;
3999 	if (bitset(S_IWGRP, QueueFileMode))
4000 		qsafe &= ~S_IWGRP;
4001 
4002 	bogus = st.st_uid != geteuid() &&
4003 		st.st_uid != TrustedUid &&
4004 		geteuid() != RealUid;
4005 
4006 	/*
4007 	**  If this qf file results from a set-group-ID binary, then
4008 	**  we check whether the directory is group-writable,
4009 	**  the queue file mode contains the group-writable bit, and
4010 	**  the groups are the same.
4011 	**  Notice: this requires that the set-group-ID binary is used to
4012 	**  run the queue!
4013 	*/
4014 
4015<