xref: /freebsd/contrib/sendmail/src/deliver.c (revision a7623790fb345e6dc986dfd31df0ace115e6f2e4)
1 /*
2  * Copyright (c) 1998-2010, 2012 Proofpoint, Inc. and its suppliers.
3  *	All rights reserved.
4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
5  * Copyright (c) 1988, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * By using this file, you agree to the terms and conditions set
9  * forth in the LICENSE file which can be found at the top level of
10  * the sendmail distribution.
11  *
12  */
13 
14 #include <sendmail.h>
15 #include <sm/time.h>
16 
17 SM_RCSID("@(#)$Id: deliver.c,v 8.1030 2013-11-22 20:51:55 ca Exp $")
18 
19 #if HASSETUSERCONTEXT
20 # include <login_cap.h>
21 #endif
22 
23 #if NETINET || NETINET6
24 # include <arpa/inet.h>
25 #endif
26 
27 #if STARTTLS || SASL
28 # include "sfsasl.h"
29 # include "tls.h"
30 #endif
31 
32 static int	deliver __P((ENVELOPE *, ADDRESS *));
33 static void	dup_queue_file __P((ENVELOPE *, ENVELOPE *, int));
34 static void	mailfiletimeout __P((int));
35 static void	endwaittimeout __P((int));
36 static int	parse_hostsignature __P((char *, char **, MAILER *));
37 static void	sendenvelope __P((ENVELOPE *, int));
38 static int	coloncmp __P((const char *, const char *));
39 
40 #if STARTTLS
41 # include <openssl/err.h>
42 # if DANE
43 static int	starttls __P((MAILER *, MCI *, ENVELOPE *, dane_vrfy_ctx_P));
44 # else
45 static int	starttls __P((MAILER *, MCI *, ENVELOPE *));
46 # endif
47 static int	endtlsclt __P((MCI *));
48 #endif /* STARTTLS */
49 #if STARTTLS || SASL
50 static bool	iscltflgset __P((ENVELOPE *, int));
51 #endif
52 
53 #if _FFR_OCC
54 # include <ratectrl.h>
55 #endif
56 
57 /*
58 **  SENDALL -- actually send all the messages.
59 **
60 **	Parameters:
61 **		e -- the envelope to send.
62 **		mode -- the delivery mode to use.  If SM_DEFAULT, use
63 **			the current e->e_sendmode.
64 **
65 **	Returns:
66 **		none.
67 **
68 **	Side Effects:
69 **		Scans the send lists and sends everything it finds.
70 **		Delivers any appropriate error messages.
71 **		If we are running in a non-interactive mode, takes the
72 **			appropriate action.
73 */
74 
75 void
76 sendall(e, mode)
77 	ENVELOPE *e;
78 	int mode;
79 {
80 	register ADDRESS *q;
81 	char *owner;
82 	int otherowners;
83 	int save_errno;
84 	register ENVELOPE *ee;
85 	ENVELOPE *splitenv = NULL;
86 	int oldverbose = Verbose;
87 	bool somedeliveries = false, expensive = false;
88 	pid_t pid;
89 
90 	/*
91 	**  If this message is to be discarded, don't bother sending
92 	**  the message at all.
93 	*/
94 
95 	if (bitset(EF_DISCARD, e->e_flags))
96 	{
97 		if (tTd(13, 1))
98 			sm_dprintf("sendall: discarding id %s\n", e->e_id);
99 		e->e_flags |= EF_CLRQUEUE;
100 		if (LogLevel > 9)
101 			logundelrcpts(e, "discarded", 9, true);
102 		else if (LogLevel > 4)
103 			sm_syslog(LOG_INFO, e->e_id, "discarded");
104 		markstats(e, NULL, STATS_REJECT);
105 		return;
106 	}
107 
108 	/*
109 	**  If we have had global, fatal errors, don't bother sending
110 	**  the message at all if we are in SMTP mode.  Local errors
111 	**  (e.g., a single address failing) will still cause the other
112 	**  addresses to be sent.
113 	*/
114 
115 	if (bitset(EF_FATALERRS, e->e_flags) &&
116 	    (OpMode == MD_SMTP || OpMode == MD_DAEMON))
117 	{
118 		e->e_flags |= EF_CLRQUEUE;
119 		return;
120 	}
121 
122 	/* determine actual delivery mode */
123 	if (mode == SM_DEFAULT)
124 	{
125 		mode = e->e_sendmode;
126 		if (mode != SM_VERIFY && mode != SM_DEFER &&
127 		    shouldqueue(e->e_msgpriority, e->e_ctime))
128 			mode = SM_QUEUE;
129 	}
130 
131 	if (tTd(13, 1))
132 	{
133 		sm_dprintf("\n===== SENDALL: mode %c, id %s, e_from ",
134 			mode, e->e_id);
135 		printaddr(sm_debug_file(), &e->e_from, false);
136 		sm_dprintf("\te_flags = ");
137 		printenvflags(e);
138 		sm_dprintf("sendqueue:\n");
139 		printaddr(sm_debug_file(), e->e_sendqueue, true);
140 	}
141 
142 	/*
143 	**  Do any preprocessing necessary for the mode we are running.
144 	**	Check to make sure the hop count is reasonable.
145 	**	Delete sends to the sender in mailing lists.
146 	*/
147 
148 	CurEnv = e;
149 	if (tTd(62, 1))
150 		checkfds(NULL);
151 
152 	if (e->e_hopcount > MaxHopCount)
153 	{
154 		char *recip;
155 
156 		if (e->e_sendqueue != NULL &&
157 		    e->e_sendqueue->q_paddr != NULL)
158 			recip = e->e_sendqueue->q_paddr;
159 		else
160 			recip = "(nobody)";
161 
162 		errno = 0;
163 		queueup(e, WILL_BE_QUEUED(mode), false);
164 		e->e_flags |= EF_FATALERRS|EF_PM_NOTIFY|EF_CLRQUEUE;
165 		ExitStat = EX_UNAVAILABLE;
166 		syserr("554 5.4.6 Too many hops %d (%d max): from %s via %s, to %s",
167 		       e->e_hopcount, MaxHopCount, e->e_from.q_paddr,
168 		       RealHostName == NULL ? "localhost" : RealHostName,
169 		       recip);
170 		for (q = e->e_sendqueue; q != NULL; q = q->q_next)
171 		{
172 			if (QS_IS_DEAD(q->q_state))
173 				continue;
174 			q->q_state = QS_BADADDR;
175 			q->q_status = "5.4.6";
176 			q->q_rstatus = "554 5.4.6 Too many hops";
177 		}
178 		return;
179 	}
180 
181 	/*
182 	**  Do sender deletion.
183 	**
184 	**	If the sender should be queued up, skip this.
185 	**	This can happen if the name server is hosed when you
186 	**	are trying to send mail.  The result is that the sender
187 	**	is instantiated in the queue as a recipient.
188 	*/
189 
190 	if (!bitset(EF_METOO, e->e_flags) &&
191 	    !QS_IS_QUEUEUP(e->e_from.q_state))
192 	{
193 		if (tTd(13, 5))
194 		{
195 			sm_dprintf("sendall: QS_SENDER ");
196 			printaddr(sm_debug_file(), &e->e_from, false);
197 		}
198 		e->e_from.q_state = QS_SENDER;
199 		(void) recipient(&e->e_from, &e->e_sendqueue, 0, e);
200 	}
201 
202 	/*
203 	**  Handle alias owners.
204 	**
205 	**	We scan up the q_alias chain looking for owners.
206 	**	We discard owners that are the same as the return path.
207 	*/
208 
209 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
210 	{
211 		register struct address *a;
212 
213 		for (a = q; a != NULL && a->q_owner == NULL; a = a->q_alias)
214 			continue;
215 		if (a != NULL)
216 			q->q_owner = a->q_owner;
217 
218 		if (q->q_owner != NULL &&
219 		    !QS_IS_DEAD(q->q_state) &&
220 		    strcmp(q->q_owner, e->e_from.q_paddr) == 0)
221 			q->q_owner = NULL;
222 	}
223 
224 	if (tTd(13, 25))
225 	{
226 		sm_dprintf("\nAfter first owner pass, sendq =\n");
227 		printaddr(sm_debug_file(), e->e_sendqueue, true);
228 	}
229 
230 	owner = "";
231 	otherowners = 1;
232 	while (owner != NULL && otherowners > 0)
233 	{
234 		if (tTd(13, 28))
235 			sm_dprintf("owner = \"%s\", otherowners = %d\n",
236 				   owner, otherowners);
237 		owner = NULL;
238 		otherowners = bitset(EF_SENDRECEIPT, e->e_flags) ? 1 : 0;
239 
240 		for (q = e->e_sendqueue; q != NULL; q = q->q_next)
241 		{
242 			if (tTd(13, 30))
243 			{
244 				sm_dprintf("Checking ");
245 				printaddr(sm_debug_file(), q, false);
246 			}
247 			if (QS_IS_DEAD(q->q_state))
248 			{
249 				if (tTd(13, 30))
250 					sm_dprintf("    ... QS_IS_DEAD\n");
251 				continue;
252 			}
253 			if (tTd(13, 29) && !tTd(13, 30))
254 			{
255 				sm_dprintf("Checking ");
256 				printaddr(sm_debug_file(), q, false);
257 			}
258 
259 			if (q->q_owner != NULL)
260 			{
261 				if (owner == NULL)
262 				{
263 					if (tTd(13, 40))
264 						sm_dprintf("    ... First owner = \"%s\"\n",
265 							   q->q_owner);
266 					owner = q->q_owner;
267 				}
268 				else if (owner != q->q_owner)
269 				{
270 					if (strcmp(owner, q->q_owner) == 0)
271 					{
272 						if (tTd(13, 40))
273 							sm_dprintf("    ... Same owner = \"%s\"\n",
274 								   owner);
275 
276 						/* make future comparisons cheap */
277 						q->q_owner = owner;
278 					}
279 					else
280 					{
281 						if (tTd(13, 40))
282 							sm_dprintf("    ... Another owner \"%s\"\n",
283 								   q->q_owner);
284 						otherowners++;
285 					}
286 					owner = q->q_owner;
287 				}
288 				else if (tTd(13, 40))
289 					sm_dprintf("    ... Same owner = \"%s\"\n",
290 						   owner);
291 			}
292 			else
293 			{
294 				if (tTd(13, 40))
295 					sm_dprintf("    ... Null owner\n");
296 				otherowners++;
297 			}
298 
299 			if (QS_IS_BADADDR(q->q_state))
300 			{
301 				if (tTd(13, 30))
302 					sm_dprintf("    ... QS_IS_BADADDR\n");
303 				continue;
304 			}
305 
306 			if (QS_IS_QUEUEUP(q->q_state))
307 			{
308 				MAILER *m = q->q_mailer;
309 
310 				/*
311 				**  If we have temporary address failures
312 				**  (e.g., dns failure) and a fallback MX is
313 				**  set, send directly to the fallback MX host.
314 				*/
315 
316 				if (FallbackMX != NULL &&
317 				    !wordinclass(FallbackMX, 'w') &&
318 				    mode != SM_VERIFY &&
319 				    !bitnset(M_NOMX, m->m_flags) &&
320 				    strcmp(m->m_mailer, "[IPC]") == 0 &&
321 				    m->m_argv[0] != NULL &&
322 				    strcmp(m->m_argv[0], "TCP") == 0)
323 				{
324 					int len;
325 					char *p;
326 
327 					if (tTd(13, 30))
328 						sm_dprintf("    ... FallbackMX\n");
329 
330 					len = strlen(FallbackMX) + 1;
331 					p = sm_rpool_malloc_x(e->e_rpool, len);
332 					(void) sm_strlcpy(p, FallbackMX, len);
333 					q->q_state = QS_OK;
334 					q->q_host = p;
335 				}
336 				else
337 				{
338 					if (tTd(13, 30))
339 						sm_dprintf("    ... QS_IS_QUEUEUP\n");
340 					continue;
341 				}
342 			}
343 
344 			/*
345 			**  If this mailer is expensive, and if we don't
346 			**  want to make connections now, just mark these
347 			**  addresses and return.  This is useful if we
348 			**  want to batch connections to reduce load.  This
349 			**  will cause the messages to be queued up, and a
350 			**  daemon will come along to send the messages later.
351 			*/
352 
353 			if (NoConnect && !Verbose &&
354 			    bitnset(M_EXPENSIVE, q->q_mailer->m_flags))
355 			{
356 				if (tTd(13, 30))
357 					sm_dprintf("    ... expensive\n");
358 				q->q_state = QS_QUEUEUP;
359 				expensive = true;
360 			}
361 			else if (bitnset(M_HOLD, q->q_mailer->m_flags) &&
362 				 QueueLimitId == NULL &&
363 				 QueueLimitSender == NULL &&
364 				 QueueLimitRecipient == NULL)
365 			{
366 				if (tTd(13, 30))
367 					sm_dprintf("    ... hold\n");
368 				q->q_state = QS_QUEUEUP;
369 				expensive = true;
370 			}
371 			else if (QueueMode != QM_QUARANTINE &&
372 				 e->e_quarmsg != NULL)
373 			{
374 				if (tTd(13, 30))
375 					sm_dprintf("    ... quarantine: %s\n",
376 						   e->e_quarmsg);
377 				q->q_state = QS_QUEUEUP;
378 				expensive = true;
379 			}
380 			else
381 			{
382 				if (tTd(13, 30))
383 					sm_dprintf("    ... deliverable\n");
384 				somedeliveries = true;
385 			}
386 		}
387 
388 		if (owner != NULL && otherowners > 0)
389 		{
390 			/*
391 			**  Split this envelope into two.
392 			*/
393 
394 			ee = (ENVELOPE *) sm_rpool_malloc_x(e->e_rpool,
395 							    sizeof(*ee));
396 			STRUCTCOPY(*e, *ee);
397 			ee->e_message = NULL;
398 			ee->e_id = NULL;
399 			assign_queueid(ee);
400 
401 			if (tTd(13, 1))
402 				sm_dprintf("sendall: split %s into %s, owner = \"%s\", otherowners = %d\n",
403 					   e->e_id, ee->e_id, owner,
404 					   otherowners);
405 
406 			ee->e_header = copyheader(e->e_header, ee->e_rpool);
407 			ee->e_sendqueue = copyqueue(e->e_sendqueue,
408 						    ee->e_rpool);
409 			ee->e_errorqueue = copyqueue(e->e_errorqueue,
410 						     ee->e_rpool);
411 			ee->e_flags = e->e_flags & ~(EF_INQUEUE|EF_CLRQUEUE|EF_FATALERRS|EF_SENDRECEIPT|EF_RET_PARAM);
412 			ee->e_flags |= EF_NORECEIPT;
413 			setsender(owner, ee, NULL, '\0', true);
414 			if (tTd(13, 5))
415 			{
416 				sm_dprintf("sendall(split): QS_SENDER ");
417 				printaddr(sm_debug_file(), &ee->e_from, false);
418 			}
419 			ee->e_from.q_state = QS_SENDER;
420 			ee->e_dfp = NULL;
421 			ee->e_lockfp = NULL;
422 			ee->e_xfp = NULL;
423 			ee->e_qgrp = e->e_qgrp;
424 			ee->e_qdir = e->e_qdir;
425 			ee->e_errormode = EM_MAIL;
426 			ee->e_sibling = splitenv;
427 			ee->e_statmsg = NULL;
428 			if (e->e_quarmsg != NULL)
429 				ee->e_quarmsg = sm_rpool_strdup_x(ee->e_rpool,
430 								  e->e_quarmsg);
431 			splitenv = ee;
432 
433 			for (q = e->e_sendqueue; q != NULL; q = q->q_next)
434 			{
435 				if (q->q_owner == owner)
436 				{
437 					q->q_state = QS_CLONED;
438 					if (tTd(13, 6))
439 						sm_dprintf("\t... stripping %s from original envelope\n",
440 							   q->q_paddr);
441 				}
442 			}
443 			for (q = ee->e_sendqueue; q != NULL; q = q->q_next)
444 			{
445 				if (q->q_owner != owner)
446 				{
447 					q->q_state = QS_CLONED;
448 					if (tTd(13, 6))
449 						sm_dprintf("\t... dropping %s from cloned envelope\n",
450 							   q->q_paddr);
451 				}
452 				else
453 				{
454 					/* clear DSN parameters */
455 					q->q_flags &= ~(QHASNOTIFY|Q_PINGFLAGS);
456 					q->q_flags |= DefaultNotify & ~QPINGONSUCCESS;
457 					if (tTd(13, 6))
458 						sm_dprintf("\t... moving %s to cloned envelope\n",
459 							   q->q_paddr);
460 				}
461 			}
462 
463 			if (mode != SM_VERIFY && bitset(EF_HAS_DF, e->e_flags))
464 				dup_queue_file(e, ee, DATAFL_LETTER);
465 
466 			/*
467 			**  Give the split envelope access to the parent
468 			**  transcript file for errors obtained while
469 			**  processing the recipients (done before the
470 			**  envelope splitting).
471 			*/
472 
473 			if (e->e_xfp != NULL)
474 				ee->e_xfp = sm_io_dup(e->e_xfp);
475 
476 			/* failed to dup e->e_xfp, start a new transcript */
477 			if (ee->e_xfp == NULL)
478 				openxscript(ee);
479 
480 			if (mode != SM_VERIFY && LogLevel > 4)
481 				sm_syslog(LOG_INFO, e->e_id,
482 					  "%s: clone: owner=%s",
483 					  ee->e_id, owner);
484 		}
485 	}
486 
487 	if (owner != NULL)
488 	{
489 		setsender(owner, e, NULL, '\0', true);
490 		if (tTd(13, 5))
491 		{
492 			sm_dprintf("sendall(owner): QS_SENDER ");
493 			printaddr(sm_debug_file(), &e->e_from, false);
494 		}
495 		e->e_from.q_state = QS_SENDER;
496 		e->e_errormode = EM_MAIL;
497 		e->e_flags |= EF_NORECEIPT;
498 		e->e_flags &= ~EF_FATALERRS;
499 	}
500 
501 	/* if nothing to be delivered, just queue up everything */
502 	if (!somedeliveries && !WILL_BE_QUEUED(mode) &&
503 	    mode != SM_VERIFY)
504 	{
505 		time_t now;
506 
507 		if (tTd(13, 29))
508 			sm_dprintf("No deliveries: auto-queueing\n");
509 		mode = SM_QUEUE;
510 		now = curtime();
511 
512 		/* treat this as a delivery in terms of counting tries */
513 		e->e_dtime = now;
514 		if (!expensive)
515 			e->e_ntries++;
516 		for (ee = splitenv; ee != NULL; ee = ee->e_sibling)
517 		{
518 			ee->e_dtime = now;
519 			if (!expensive)
520 				ee->e_ntries++;
521 		}
522 	}
523 
524 	if ((WILL_BE_QUEUED(mode) || mode == SM_FORK ||
525 	     (mode != SM_VERIFY &&
526 	      (SuperSafe == SAFE_REALLY ||
527 	       SuperSafe == SAFE_REALLY_POSTMILTER))) &&
528 	    (!bitset(EF_INQUEUE, e->e_flags) || splitenv != NULL))
529 	{
530 		bool msync;
531 
532 		/*
533 		**  Be sure everything is instantiated in the queue.
534 		**  Split envelopes first in case the machine crashes.
535 		**  If the original were done first, we may lose
536 		**  recipients.
537 		*/
538 
539 #if !HASFLOCK
540 		msync = false;
541 #else
542 		msync = mode == SM_FORK;
543 #endif
544 
545 		for (ee = splitenv; ee != NULL; ee = ee->e_sibling)
546 			queueup(ee, WILL_BE_QUEUED(mode), msync);
547 		queueup(e, WILL_BE_QUEUED(mode), msync);
548 	}
549 
550 	if (tTd(62, 10))
551 		checkfds("after envelope splitting");
552 
553 	/*
554 	**  If we belong in background, fork now.
555 	*/
556 
557 	if (tTd(13, 20))
558 	{
559 		sm_dprintf("sendall: final mode = %c\n", mode);
560 		if (tTd(13, 21))
561 		{
562 			sm_dprintf("\n================ Final Send Queue(s) =====================\n");
563 			sm_dprintf("\n  *** Envelope %s, e_from=%s ***\n",
564 				   e->e_id, e->e_from.q_paddr);
565 			printaddr(sm_debug_file(), e->e_sendqueue, true);
566 			for (ee = splitenv; ee != NULL; ee = ee->e_sibling)
567 			{
568 				sm_dprintf("\n  *** Envelope %s, e_from=%s ***\n",
569 					   ee->e_id, ee->e_from.q_paddr);
570 				printaddr(sm_debug_file(), ee->e_sendqueue, true);
571 			}
572 			sm_dprintf("==========================================================\n\n");
573 		}
574 	}
575 	switch (mode)
576 	{
577 	  case SM_VERIFY:
578 		Verbose = 2;
579 		break;
580 
581 	  case SM_QUEUE:
582 	  case SM_DEFER:
583 #if HASFLOCK
584   queueonly:
585 #endif
586 		if (e->e_nrcpts > 0)
587 			e->e_flags |= EF_INQUEUE;
588 		(void) dropenvelope(e, splitenv != NULL, true);
589 		for (ee = splitenv; ee != NULL; ee = ee->e_sibling)
590 		{
591 			if (ee->e_nrcpts > 0)
592 				ee->e_flags |= EF_INQUEUE;
593 			(void) dropenvelope(ee, false, true);
594 		}
595 		return;
596 
597 	  case SM_FORK:
598 		if (e->e_xfp != NULL)
599 			(void) sm_io_flush(e->e_xfp, SM_TIME_DEFAULT);
600 
601 #if !HASFLOCK
602 		/*
603 		**  Since fcntl locking has the interesting semantic that
604 		**  the lock is owned by a process, not by an open file
605 		**  descriptor, we have to flush this to the queue, and
606 		**  then restart from scratch in the child.
607 		*/
608 
609 		{
610 			/* save id for future use */
611 			char *qid = e->e_id;
612 
613 			/* now drop the envelope in the parent */
614 			e->e_flags |= EF_INQUEUE;
615 			(void) dropenvelope(e, splitenv != NULL, false);
616 
617 			/* arrange to reacquire lock after fork */
618 			e->e_id = qid;
619 		}
620 
621 		for (ee = splitenv; ee != NULL; ee = ee->e_sibling)
622 		{
623 			/* save id for future use */
624 			char *qid = ee->e_id;
625 
626 			/* drop envelope in parent */
627 			ee->e_flags |= EF_INQUEUE;
628 			(void) dropenvelope(ee, false, false);
629 
630 			/* and save qid for reacquisition */
631 			ee->e_id = qid;
632 		}
633 
634 #endif /* !HASFLOCK */
635 
636 		/*
637 		**  Since the delivery may happen in a child and the parent
638 		**  does not wait, the parent may close the maps thereby
639 		**  removing any shared memory used by the map.  Therefore,
640 		**  close the maps now so the child will dynamically open
641 		**  them if necessary.
642 		*/
643 
644 		closemaps(false);
645 
646 		pid = fork();
647 		if (pid < 0)
648 		{
649 			syserr("deliver: fork 1");
650 #if HASFLOCK
651 			goto queueonly;
652 #else /* HASFLOCK */
653 			e->e_id = NULL;
654 			for (ee = splitenv; ee != NULL; ee = ee->e_sibling)
655 				ee->e_id = NULL;
656 			return;
657 #endif /* HASFLOCK */
658 		}
659 		else if (pid > 0)
660 		{
661 #if HASFLOCK
662 			/* be sure we leave the temp files to our child */
663 			/* close any random open files in the envelope */
664 			closexscript(e);
665 			if (e->e_dfp != NULL)
666 				(void) sm_io_close(e->e_dfp, SM_TIME_DEFAULT);
667 			e->e_dfp = NULL;
668 			e->e_flags &= ~EF_HAS_DF;
669 
670 			/* can't call unlockqueue to avoid unlink of xfp */
671 			if (e->e_lockfp != NULL)
672 				(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
673 			else
674 				syserr("%s: sendall: null lockfp", e->e_id);
675 			e->e_lockfp = NULL;
676 #endif /* HASFLOCK */
677 
678 			/* make sure the parent doesn't own the envelope */
679 			e->e_id = NULL;
680 
681 #if USE_DOUBLE_FORK
682 			/* catch intermediate zombie */
683 			(void) waitfor(pid);
684 #endif
685 			return;
686 		}
687 
688 		/* Reset global flags */
689 		RestartRequest = NULL;
690 		RestartWorkGroup = false;
691 		ShutdownRequest = NULL;
692 		PendingSignal = 0;
693 
694 		/*
695 		**  Initialize exception stack and default exception
696 		**  handler for child process.
697 		*/
698 
699 		sm_exc_newthread(fatal_error);
700 
701 		/*
702 		**  Since we have accepted responsbility for the message,
703 		**  change the SIGTERM handler.  intsig() (the old handler)
704 		**  would remove the envelope if this was a command line
705 		**  message submission.
706 		*/
707 
708 		(void) sm_signal(SIGTERM, SIG_DFL);
709 
710 #if USE_DOUBLE_FORK
711 		/* double fork to avoid zombies */
712 		pid = fork();
713 		if (pid > 0)
714 			exit(EX_OK);
715 		save_errno = errno;
716 #endif /* USE_DOUBLE_FORK */
717 
718 		CurrentPid = getpid();
719 
720 		/* be sure we are immune from the terminal */
721 		disconnect(2, e);
722 		clearstats();
723 
724 		/* prevent parent from waiting if there was an error */
725 		if (pid < 0)
726 		{
727 			errno = save_errno;
728 			syserr("deliver: fork 2");
729 #if HASFLOCK
730 			e->e_flags |= EF_INQUEUE;
731 #else
732 			e->e_id = NULL;
733 #endif
734 			finis(true, true, ExitStat);
735 		}
736 
737 		/* be sure to give error messages in child */
738 		QuickAbort = false;
739 
740 		/*
741 		**  Close any cached connections.
742 		**
743 		**	We don't send the QUIT protocol because the parent
744 		**	still knows about the connection.
745 		**
746 		**	This should only happen when delivering an error
747 		**	message.
748 		*/
749 
750 		mci_flush(false, NULL);
751 
752 #if HASFLOCK
753 		break;
754 #else /* HASFLOCK */
755 
756 		/*
757 		**  Now reacquire and run the various queue files.
758 		*/
759 
760 		for (ee = splitenv; ee != NULL; ee = ee->e_sibling)
761 		{
762 			ENVELOPE *sibling = ee->e_sibling;
763 
764 			(void) dowork(ee->e_qgrp, ee->e_qdir, ee->e_id,
765 				      false, false, ee);
766 			ee->e_sibling = sibling;
767 		}
768 		(void) dowork(e->e_qgrp, e->e_qdir, e->e_id,
769 			      false, false, e);
770 		finis(true, true, ExitStat);
771 #endif /* HASFLOCK */
772 	}
773 
774 	sendenvelope(e, mode);
775 	(void) dropenvelope(e, true, true);
776 	for (ee = splitenv; ee != NULL; ee = ee->e_sibling)
777 	{
778 		CurEnv = ee;
779 		if (mode != SM_VERIFY)
780 			openxscript(ee);
781 		sendenvelope(ee, mode);
782 		(void) dropenvelope(ee, true, true);
783 	}
784 	CurEnv = e;
785 
786 	Verbose = oldverbose;
787 	if (mode == SM_FORK)
788 		finis(true, true, ExitStat);
789 }
790 
791 static void
792 sendenvelope(e, mode)
793 	register ENVELOPE *e;
794 	int mode;
795 {
796 	register ADDRESS *q;
797 	bool didany;
798 
799 	if (tTd(13, 10))
800 		sm_dprintf("sendenvelope(%s) e_flags=0x%lx\n",
801 			   e->e_id == NULL ? "[NOQUEUE]" : e->e_id,
802 			   e->e_flags);
803 	if (LogLevel > 80)
804 		sm_syslog(LOG_DEBUG, e->e_id,
805 			  "sendenvelope, flags=0x%lx",
806 			  e->e_flags);
807 
808 	/*
809 	**  If we have had global, fatal errors, don't bother sending
810 	**  the message at all if we are in SMTP mode.  Local errors
811 	**  (e.g., a single address failing) will still cause the other
812 	**  addresses to be sent.
813 	*/
814 
815 	if (bitset(EF_FATALERRS, e->e_flags) &&
816 	    (OpMode == MD_SMTP || OpMode == MD_DAEMON))
817 	{
818 		e->e_flags |= EF_CLRQUEUE;
819 		return;
820 	}
821 
822 	/*
823 	**  Don't attempt deliveries if we want to bounce now
824 	**  or if deliver-by time is exceeded.
825 	*/
826 
827 	if (!bitset(EF_RESPONSE, e->e_flags) &&
828 	    (TimeOuts.to_q_return[e->e_timeoutclass] == NOW ||
829 	     (IS_DLVR_RETURN(e) && e->e_deliver_by > 0 &&
830 	      curtime() > e->e_ctime + e->e_deliver_by)))
831 		return;
832 
833 	/*
834 	**  Run through the list and send everything.
835 	**
836 	**	Set EF_GLOBALERRS so that error messages during delivery
837 	**	result in returned mail.
838 	*/
839 
840 	e->e_nsent = 0;
841 	e->e_flags |= EF_GLOBALERRS;
842 
843 	macdefine(&e->e_macro, A_PERM, macid("{envid}"), e->e_envid);
844 	macdefine(&e->e_macro, A_PERM, macid("{bodytype}"), e->e_bodytype);
845 	didany = false;
846 
847 	if (!bitset(EF_SPLIT, e->e_flags))
848 	{
849 		ENVELOPE *oldsib;
850 		ENVELOPE *ee;
851 
852 		/*
853 		**  Save old sibling and set it to NULL to avoid
854 		**  queueing up the same envelopes again.
855 		**  This requires that envelopes in that list have
856 		**  been take care of before (or at some other place).
857 		*/
858 
859 		oldsib = e->e_sibling;
860 		e->e_sibling = NULL;
861 		if (!split_by_recipient(e) &&
862 		    bitset(EF_FATALERRS, e->e_flags))
863 		{
864 			if (OpMode == MD_SMTP || OpMode == MD_DAEMON)
865 				e->e_flags |= EF_CLRQUEUE;
866 			return;
867 		}
868 		for (ee = e->e_sibling; ee != NULL; ee = ee->e_sibling)
869 			queueup(ee, false, true);
870 
871 		/* clean up */
872 		for (ee = e->e_sibling; ee != NULL; ee = ee->e_sibling)
873 		{
874 			/* now unlock the job */
875 			closexscript(ee);
876 			unlockqueue(ee);
877 
878 			/* this envelope is marked unused */
879 			if (ee->e_dfp != NULL)
880 			{
881 				(void) sm_io_close(ee->e_dfp, SM_TIME_DEFAULT);
882 				ee->e_dfp = NULL;
883 			}
884 			ee->e_id = NULL;
885 			ee->e_flags &= ~EF_HAS_DF;
886 		}
887 		e->e_sibling = oldsib;
888 	}
889 
890 	/* now run through the queue */
891 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
892 	{
893 #if XDEBUG
894 		char wbuf[MAXNAME + 20];
895 
896 		(void) sm_snprintf(wbuf, sizeof(wbuf), "sendall(%.*s)",
897 				   MAXNAME, q->q_paddr);
898 		checkfd012(wbuf);
899 #endif /* XDEBUG */
900 		if (mode == SM_VERIFY)
901 		{
902 			e->e_to = q->q_paddr;
903 			if (QS_IS_SENDABLE(q->q_state))
904 			{
905 				if (q->q_host != NULL && q->q_host[0] != '\0')
906 					message("deliverable: mailer %s, host %s, user %s",
907 						q->q_mailer->m_name,
908 						q->q_host,
909 						q->q_user);
910 				else
911 					message("deliverable: mailer %s, user %s",
912 						q->q_mailer->m_name,
913 						q->q_user);
914 			}
915 		}
916 		else if (QS_IS_OK(q->q_state))
917 		{
918 			/*
919 			**  Checkpoint the send list every few addresses
920 			*/
921 
922 			if (CheckpointInterval > 0 &&
923 			    e->e_nsent >= CheckpointInterval)
924 			{
925 				queueup(e, false, false);
926 				e->e_nsent = 0;
927 			}
928 			(void) deliver(e, q);
929 			didany = true;
930 		}
931 	}
932 	if (didany)
933 	{
934 		e->e_dtime = curtime();
935 		e->e_ntries++;
936 	}
937 
938 #if XDEBUG
939 	checkfd012("end of sendenvelope");
940 #endif
941 }
942 
943 #if REQUIRES_DIR_FSYNC
944 /*
945 **  SYNC_DIR -- fsync a directory based on a filename
946 **
947 **	Parameters:
948 **		filename -- path of file
949 **		panic -- panic?
950 **
951 **	Returns:
952 **		none
953 */
954 
955 void
956 sync_dir(filename, panic)
957 	char *filename;
958 	bool panic;
959 {
960 	int dirfd;
961 	char *dirp;
962 	char dir[MAXPATHLEN];
963 
964 	if (!RequiresDirfsync)
965 		return;
966 
967 	/* filesystems which require the directory be synced */
968 	dirp = strrchr(filename, '/');
969 	if (dirp != NULL)
970 	{
971 		if (sm_strlcpy(dir, filename, sizeof(dir)) >= sizeof(dir))
972 			return;
973 		dir[dirp - filename] = '\0';
974 		dirp = dir;
975 	}
976 	else
977 		dirp = ".";
978 	dirfd = open(dirp, O_RDONLY, 0700);
979 	if (tTd(40,32))
980 		sm_syslog(LOG_INFO, NOQID, "sync_dir: %s: fsync(%d)",
981 			  dirp, dirfd);
982 	if (dirfd >= 0)
983 	{
984 		if (fsync(dirfd) < 0)
985 		{
986 			if (panic)
987 				syserr("!sync_dir: cannot fsync directory %s",
988 				       dirp);
989 			else if (LogLevel > 1)
990 				sm_syslog(LOG_ERR, NOQID,
991 					  "sync_dir: cannot fsync directory %s: %s",
992 					  dirp, sm_errstring(errno));
993 		}
994 		(void) close(dirfd);
995 	}
996 }
997 #endif /* REQUIRES_DIR_FSYNC */
998 /*
999 **  DUP_QUEUE_FILE -- duplicate a queue file into a split queue
1000 **
1001 **	Parameters:
1002 **		e -- the existing envelope
1003 **		ee -- the new envelope
1004 **		type -- the queue file type (e.g., DATAFL_LETTER)
1005 **
1006 **	Returns:
1007 **		none
1008 */
1009 
1010 static void
1011 dup_queue_file(e, ee, type)
1012 	ENVELOPE *e, *ee;
1013 	int type;
1014 {
1015 	char f1buf[MAXPATHLEN], f2buf[MAXPATHLEN];
1016 
1017 	ee->e_dfp = NULL;
1018 	ee->e_xfp = NULL;
1019 
1020 	/*
1021 	**  Make sure both are in the same directory.
1022 	*/
1023 
1024 	(void) sm_strlcpy(f1buf, queuename(e, type), sizeof(f1buf));
1025 	(void) sm_strlcpy(f2buf, queuename(ee, type), sizeof(f2buf));
1026 
1027 	/* Force the df to disk if it's not there yet */
1028 	if (type == DATAFL_LETTER && e->e_dfp != NULL &&
1029 	    sm_io_setinfo(e->e_dfp, SM_BF_COMMIT, NULL) < 0 &&
1030 	    errno != EINVAL)
1031 	{
1032 		syserr("!dup_queue_file: can't commit %s", f1buf);
1033 		/* NOTREACHED */
1034 	}
1035 
1036 	if (link(f1buf, f2buf) < 0)
1037 	{
1038 		int save_errno = errno;
1039 
1040 		syserr("sendall: link(%s, %s)", f1buf, f2buf);
1041 		if (save_errno == EEXIST)
1042 		{
1043 			if (unlink(f2buf) < 0)
1044 			{
1045 				syserr("!sendall: unlink(%s): permanent",
1046 				       f2buf);
1047 				/* NOTREACHED */
1048 			}
1049 			if (link(f1buf, f2buf) < 0)
1050 			{
1051 				syserr("!sendall: link(%s, %s): permanent",
1052 				       f1buf, f2buf);
1053 				/* NOTREACHED */
1054 			}
1055 		}
1056 	}
1057 	SYNC_DIR(f2buf, true);
1058 }
1059 /*
1060 **  DOFORK -- do a fork, retrying a couple of times on failure.
1061 **
1062 **	This MUST be a macro, since after a vfork we are running
1063 **	two processes on the same stack!!!
1064 **
1065 **	Parameters:
1066 **		none.
1067 **
1068 **	Returns:
1069 **		From a macro???  You've got to be kidding!
1070 **
1071 **	Side Effects:
1072 **		Modifies the ==> LOCAL <== variable 'pid', leaving:
1073 **			pid of child in parent, zero in child.
1074 **			-1 on unrecoverable error.
1075 **
1076 **	Notes:
1077 **		I'm awfully sorry this looks so awful.  That's
1078 **		vfork for you.....
1079 */
1080 
1081 #define NFORKTRIES	5
1082 
1083 #ifndef FORK
1084 # define FORK	fork
1085 #endif
1086 
1087 #define DOFORK(fORKfN) \
1088 {\
1089 	register int i;\
1090 \
1091 	for (i = NFORKTRIES; --i >= 0; )\
1092 	{\
1093 		pid = fORKfN();\
1094 		if (pid >= 0)\
1095 			break;\
1096 		if (i > 0)\
1097 			(void) sleep((unsigned) NFORKTRIES - i);\
1098 	}\
1099 }
1100 /*
1101 **  DOFORK -- simple fork interface to DOFORK.
1102 **
1103 **	Parameters:
1104 **		none.
1105 **
1106 **	Returns:
1107 **		pid of child in parent.
1108 **		zero in child.
1109 **		-1 on error.
1110 **
1111 **	Side Effects:
1112 **		returns twice, once in parent and once in child.
1113 */
1114 
1115 pid_t
1116 dofork()
1117 {
1118 	register pid_t pid = -1;
1119 
1120 	DOFORK(fork);
1121 	return pid;
1122 }
1123 
1124 /*
1125 **  COLONCMP -- compare host-signatures up to first ':' or EOS
1126 **
1127 **	This takes two strings which happen to be host-signatures and
1128 **	compares them. If the lowest preference portions of the MX-RR's
1129 **	match (up to ':' or EOS, whichever is first), then we have
1130 **	match. This is used for coattail-piggybacking messages during
1131 **	message delivery.
1132 **	If the signatures are the same up to the first ':' the remainder of
1133 **	the signatures are then compared with a normal strcmp(). This saves
1134 **	re-examining the first part of the signatures.
1135 **
1136 **	Parameters:
1137 **		a - first host-signature
1138 **		b - second host-signature
1139 **
1140 **	Returns:
1141 **		HS_MATCH_NO -- no "match".
1142 **		HS_MATCH_FIRST -- "match" for the first MX preference
1143 **			(up to the first colon (':')).
1144 **		HS_MATCH_FULL -- match for the entire MX record.
1145 **
1146 **	Side Effects:
1147 **		none.
1148 */
1149 
1150 #define HS_MATCH_NO	0
1151 #define HS_MATCH_FIRST	1
1152 #define HS_MATCH_FULL	2
1153 
1154 static int
1155 coloncmp(a, b)
1156 	register const char *a;
1157 	register const char *b;
1158 {
1159 	int ret = HS_MATCH_NO;
1160 	int braclev = 0;
1161 
1162 	while (*a == *b++)
1163 	{
1164 		/* Need to account for IPv6 bracketed addresses */
1165 		if (*a == '[')
1166 			braclev++;
1167 		else if (*a == ']' && braclev > 0)
1168 			braclev--;
1169 		else if (*a == ':' && braclev <= 0)
1170 		{
1171 			ret = HS_MATCH_FIRST;
1172 			a++;
1173 			break;
1174 		}
1175 		else if (*a == '\0')
1176 			return HS_MATCH_FULL; /* a full match */
1177 		a++;
1178 	}
1179 	if (ret == HS_MATCH_NO &&
1180 	    braclev <= 0 &&
1181 	    ((*a == '\0' && *(b - 1) == ':') ||
1182 	     (*a == ':' && *(b - 1) == '\0')))
1183 		return HS_MATCH_FIRST;
1184 	if (ret == HS_MATCH_FIRST && strcmp(a, b) == 0)
1185 		return HS_MATCH_FULL;
1186 
1187 	return ret;
1188 }
1189 
1190 /*
1191 **  SHOULD_TRY_FBSH -- Should try FallbackSmartHost?
1192 **
1193 **	Parameters:
1194 **		e -- envelope
1195 **		tried_fallbacksmarthost -- has been tried already? (in/out)
1196 **		hostbuf -- buffer for hostname (expand FallbackSmartHost) (out)
1197 **		hbsz -- size of hostbuf
1198 **		status -- current delivery status
1199 **
1200 **	Returns:
1201 **		true iff FallbackSmartHost should be tried.
1202 */
1203 
1204 static bool should_try_fbsh __P((ENVELOPE *, bool *, char *, size_t, int));
1205 
1206 static bool
1207 should_try_fbsh(e, tried_fallbacksmarthost, hostbuf, hbsz, status)
1208 	ENVELOPE *e;
1209 	bool *tried_fallbacksmarthost;
1210 	char *hostbuf;
1211 	size_t hbsz;
1212 	int status;
1213 {
1214 	/*
1215 	**  If the host was not found or a temporary failure occurred
1216 	**  and a FallbackSmartHost is defined (and we have not yet
1217 	**  tried it), then make one last try with it as the host.
1218 	*/
1219 
1220 	if ((status == EX_NOHOST || status == EX_TEMPFAIL) &&
1221 	    FallbackSmartHost != NULL && !*tried_fallbacksmarthost)
1222 	{
1223 		*tried_fallbacksmarthost = true;
1224 		expand(FallbackSmartHost, hostbuf, hbsz, e);
1225 		if (!wordinclass(hostbuf, 'w'))
1226 		{
1227 			if (tTd(11, 1))
1228 				sm_dprintf("one last try with FallbackSmartHost %s\n",
1229 					   hostbuf);
1230 			return true;
1231 		}
1232 	}
1233 	return false;
1234 }
1235 
1236 /*
1237 **  DELIVER -- Deliver a message to a list of addresses.
1238 **
1239 **	This routine delivers to everyone on the same host as the
1240 **	user on the head of the list.  It is clever about mailers
1241 **	that don't handle multiple users.  It is NOT guaranteed
1242 **	that it will deliver to all these addresses however -- so
1243 **	deliver should be called once for each address on the list.
1244 **	Deliver tries to be as opportunistic as possible about piggybacking
1245 **	messages. Some definitions to make understanding easier follow below.
1246 **	Piggybacking occurs when an existing connection to a mail host can
1247 **	be used to send the same message to more than one recipient at the
1248 **	same time. So "no piggybacking" means one message for one recipient
1249 **	per connection. "Intentional piggybacking" happens when the
1250 **	recipients' host address (not the mail host address) is used to
1251 **	attempt piggybacking. Recipients with the same host address
1252 **	have the same mail host. "Coincidental piggybacking" relies on
1253 **	piggybacking based on all the mail host addresses in the MX-RR. This
1254 **	is "coincidental" in the fact it could not be predicted until the
1255 **	MX Resource Records for the hosts were obtained and examined. For
1256 **	example (preference order and equivalence is important, not values):
1257 **		domain1 IN MX 10 mxhost-A
1258 **			IN MX 20 mxhost-B
1259 **		domain2 IN MX  4 mxhost-A
1260 **			IN MX  8 mxhost-B
1261 **	Domain1 and domain2 can piggyback the same message to mxhost-A or
1262 **	mxhost-B (if mxhost-A cannot be reached).
1263 **	"Coattail piggybacking" relaxes the strictness of "coincidental
1264 **	piggybacking" in the hope that most significant (lowest value)
1265 **	MX preference host(s) can create more piggybacking. For example
1266 **	(again, preference order and equivalence is important, not values):
1267 **		domain3 IN MX 100 mxhost-C
1268 **			IN MX 100 mxhost-D
1269 **			IN MX 200 mxhost-E
1270 **		domain4 IN MX  50 mxhost-C
1271 **			IN MX  50 mxhost-D
1272 **			IN MX  80 mxhost-F
1273 **	A message for domain3 and domain4 can piggyback to mxhost-C if mxhost-C
1274 **	is available. Same with mxhost-D because in both RR's the preference
1275 **	value is the same as mxhost-C, respectively.
1276 **	So deliver attempts coattail piggybacking when possible. If the
1277 **	first MX preference level hosts cannot be used then the piggybacking
1278 **	reverts to coincidental piggybacking. Using the above example you
1279 **	cannot deliver to mxhost-F for domain3 regardless of preference value.
1280 **	("Coattail" from "riding on the coattails of your predecessor" meaning
1281 **	gaining benefit from a predecessor effort with no or little addition
1282 **	effort. The predecessor here being the preceding MX RR).
1283 **
1284 **	Parameters:
1285 **		e -- the envelope to deliver.
1286 **		firstto -- head of the address list to deliver to.
1287 **
1288 **	Returns:
1289 **		zero -- successfully delivered.
1290 **		else -- some failure, see ExitStat for more info.
1291 **
1292 **	Side Effects:
1293 **		The standard input is passed off to someone.
1294 */
1295 
1296 static int
1297 deliver(e, firstto)
1298 	register ENVELOPE *e;
1299 	ADDRESS *firstto;
1300 {
1301 	char *host;			/* host being sent to */
1302 	char *user;			/* user being sent to */
1303 	char **pvp;
1304 	register char **mvp;
1305 	register char *p;
1306 	register MAILER *m;		/* mailer for this recipient */
1307 	ADDRESS *volatile ctladdr;
1308 #if HASSETUSERCONTEXT
1309 	ADDRESS *volatile contextaddr = NULL;
1310 #endif
1311 	register MCI *volatile mci;
1312 	register ADDRESS *SM_NONVOLATILE to = firstto;
1313 	volatile bool clever = false;	/* running user smtp to this mailer */
1314 	ADDRESS *volatile tochain = NULL; /* users chain in this mailer call */
1315 	int rcode;			/* response code */
1316 	SM_NONVOLATILE int lmtp_rcode = EX_OK;
1317 	SM_NONVOLATILE int nummxhosts = 0; /* number of MX hosts available */
1318 	SM_NONVOLATILE int hostnum = 0;	/* current MX host index */
1319 	char *firstsig;			/* signature of firstto */
1320 	volatile pid_t pid = -1;
1321 	char *volatile curhost;
1322 	SM_NONVOLATILE unsigned short port = 0;
1323 	SM_NONVOLATILE time_t enough = 0;
1324 #if NETUNIX
1325 	char *SM_NONVOLATILE mux_path = NULL;	/* path to UNIX domain socket */
1326 #endif
1327 	time_t xstart;
1328 	bool suidwarn;
1329 	bool anyok;			/* at least one address was OK */
1330 	SM_NONVOLATILE bool goodmxfound = false; /* at least one MX was OK */
1331 	bool ovr;
1332 	bool quarantine;
1333 #if STARTTLS
1334 	/* 0: try TLS, 1: try without TLS again, >1: don't try again */
1335 	int tlsstate;
1336 # if DANE
1337 	dane_vrfy_ctx_T	dane_vrfy_ctx;
1338 	STAB *ste;
1339 # endif
1340 #endif
1341 #if STARTTLS || SASL
1342 	int dotpos;
1343 
1344 # define RM_TRAIL_DOT(name)				\
1345 	do {						\
1346 		dotpos = strlen(name) - 1;		\
1347 		if (dotpos >= 0)			\
1348 		{					\
1349 			if (name[dotpos] == '.')	\
1350 				name[dotpos] = '\0';	\
1351 			else				\
1352 				dotpos = -1;		\
1353 		}					\
1354 	} while (0)
1355 
1356 # define FIX_TRAIL_DOT(name)				\
1357 	do {						\
1358 		if (dotpos >= 0)			\
1359 			name[dotpos] = '.';		\
1360 	} while (0)
1361 
1362 #endif
1363 	int strsize;
1364 	int rcptcount;
1365 	int ret;
1366 	static int tobufsize = 0;
1367 	static char *tobuf = NULL;
1368 	char *rpath;	/* translated return path */
1369 	int mpvect[2];
1370 	int rpvect[2];
1371 	char *mxhosts[MAXMXHOSTS + 1];
1372 	char *pv[MAXPV + 1];
1373 	char buf[MAXNAME + 1];
1374 	char cbuf[MAXPATHLEN];
1375 
1376 	errno = 0;
1377 	SM_REQUIRE(firstto != NULL);	/* same as to */
1378 	if (!QS_IS_OK(to->q_state))
1379 		return 0;
1380 
1381 	suidwarn = geteuid() == 0;
1382 
1383 	SM_REQUIRE(e != NULL);
1384 	m = to->q_mailer;
1385 	host = to->q_host;
1386 	CurEnv = e;			/* just in case */
1387 	e->e_statmsg = NULL;
1388 	SmtpError[0] = '\0';
1389 	xstart = curtime();
1390 #if STARTTLS
1391 	tlsstate = 0;
1392 # if DANE
1393 	memset(&dane_vrfy_ctx, '\0', sizeof(dane_vrfy_ctx));
1394 	ste = NULL;
1395 # endif
1396 #endif
1397 
1398 	if (tTd(10, 1))
1399 		sm_dprintf("\n--deliver, id=%s, mailer=%s, host=`%s', first user=`%s'\n",
1400 			e->e_id, m->m_name, host, to->q_user);
1401 	if (tTd(10, 100))
1402 		printopenfds(false);
1403 
1404 	/*
1405 	**  Clear {client_*} macros if this is a bounce message to
1406 	**  prevent rejection by check_compat ruleset.
1407 	*/
1408 
1409 	if (bitset(EF_RESPONSE, e->e_flags))
1410 	{
1411 		macdefine(&e->e_macro, A_PERM, macid("{client_name}"), "");
1412 		macdefine(&e->e_macro, A_PERM, macid("{client_ptr}"), "");
1413 		macdefine(&e->e_macro, A_PERM, macid("{client_addr}"), "");
1414 		macdefine(&e->e_macro, A_PERM, macid("{client_port}"), "");
1415 		macdefine(&e->e_macro, A_PERM, macid("{client_resolve}"), "");
1416 	}
1417 
1418 	SM_TRY
1419 	{
1420 	ADDRESS *skip_back = NULL;
1421 
1422 	/*
1423 	**  Do initial argv setup.
1424 	**	Insert the mailer name.  Notice that $x expansion is
1425 	**	NOT done on the mailer name.  Then, if the mailer has
1426 	**	a picky -f flag, we insert it as appropriate.  This
1427 	**	code does not check for 'pv' overflow; this places a
1428 	**	manifest lower limit of 4 for MAXPV.
1429 	**		The from address rewrite is expected to make
1430 	**		the address relative to the other end.
1431 	*/
1432 
1433 	/* rewrite from address, using rewriting rules */
1434 	rcode = EX_OK;
1435 	SM_ASSERT(e->e_from.q_mailer != NULL);
1436 	if (bitnset(M_UDBENVELOPE, e->e_from.q_mailer->m_flags))
1437 		p = e->e_sender;
1438 	else
1439 		p = e->e_from.q_paddr;
1440 	rpath = remotename(p, m, RF_SENDERADDR|RF_CANONICAL, &rcode, e);
1441 	if (rcode != EX_OK && bitnset(M_xSMTP, m->m_flags))
1442 		goto cleanup;
1443 	if (strlen(rpath) > MAXNAME)
1444 	{
1445 		rpath = shortenstring(rpath, MAXSHORTSTR);
1446 
1447 		/* avoid bogus errno */
1448 		errno = 0;
1449 		syserr("remotename: huge return path %s", rpath);
1450 	}
1451 	rpath = sm_rpool_strdup_x(e->e_rpool, rpath);
1452 	macdefine(&e->e_macro, A_PERM, 'g', rpath);
1453 	macdefine(&e->e_macro, A_PERM, 'h', host);
1454 	Errors = 0;
1455 	pvp = pv;
1456 	*pvp++ = m->m_argv[0];
1457 
1458 	/* ignore long term host status information if mailer flag W is set */
1459 	if (bitnset(M_NOHOSTSTAT, m->m_flags))
1460 		IgnoreHostStatus = true;
1461 
1462 	/* insert -f or -r flag as appropriate */
1463 	if (FromFlag &&
1464 	    (bitnset(M_FOPT, m->m_flags) ||
1465 	     bitnset(M_ROPT, m->m_flags)))
1466 	{
1467 		if (bitnset(M_FOPT, m->m_flags))
1468 			*pvp++ = "-f";
1469 		else
1470 			*pvp++ = "-r";
1471 		*pvp++ = rpath;
1472 	}
1473 
1474 	/*
1475 	**  Append the other fixed parts of the argv.  These run
1476 	**  up to the first entry containing "$u".  There can only
1477 	**  be one of these, and there are only a few more slots
1478 	**  in the pv after it.
1479 	*/
1480 
1481 	for (mvp = m->m_argv; (p = *++mvp) != NULL; )
1482 	{
1483 		/* can't use strchr here because of sign extension problems */
1484 		while (*p != '\0')
1485 		{
1486 			if ((*p++ & 0377) == MACROEXPAND)
1487 			{
1488 				if (*p == 'u')
1489 					break;
1490 			}
1491 		}
1492 
1493 		if (*p != '\0')
1494 			break;
1495 
1496 		/* this entry is safe -- go ahead and process it */
1497 		expand(*mvp, buf, sizeof(buf), e);
1498 		*pvp++ = sm_rpool_strdup_x(e->e_rpool, buf);
1499 		if (pvp >= &pv[MAXPV - 3])
1500 		{
1501 			syserr("554 5.3.5 Too many parameters to %s before $u",
1502 			       pv[0]);
1503 			rcode = -1;
1504 			goto cleanup;
1505 		}
1506 	}
1507 
1508 	/*
1509 	**  If we have no substitution for the user name in the argument
1510 	**  list, we know that we must supply the names otherwise -- and
1511 	**  SMTP is the answer!!
1512 	*/
1513 
1514 	if (*mvp == NULL)
1515 	{
1516 		/* running LMTP or SMTP */
1517 		clever = true;
1518 		*pvp = NULL;
1519 		setbitn(M_xSMTP, m->m_flags);
1520 	}
1521 	else if (bitnset(M_LMTP, m->m_flags))
1522 	{
1523 		/* not running LMTP */
1524 		sm_syslog(LOG_ERR, NULL,
1525 			  "Warning: mailer %s: LMTP flag (F=z) turned off",
1526 			  m->m_name);
1527 		clrbitn(M_LMTP, m->m_flags);
1528 	}
1529 
1530 	/*
1531 	**  At this point *mvp points to the argument with $u.  We
1532 	**  run through our address list and append all the addresses
1533 	**  we can.  If we run out of space, do not fret!  We can
1534 	**  always send another copy later.
1535 	*/
1536 
1537 	e->e_to = NULL;
1538 	strsize = 2;
1539 	rcptcount = 0;
1540 	ctladdr = NULL;
1541 	if (firstto->q_signature == NULL)
1542 		firstto->q_signature = hostsignature(firstto->q_mailer,
1543 						     firstto->q_host,
1544 						     firstto->q_flags & QSECURE);
1545 	firstsig = firstto->q_signature;
1546 
1547 	for (; to != NULL; to = to->q_next)
1548 	{
1549 		/* avoid sending multiple recipients to dumb mailers */
1550 		if (tochain != NULL && !bitnset(M_MUSER, m->m_flags))
1551 			break;
1552 
1553 		/* if already sent or not for this host, don't send */
1554 		if (!QS_IS_OK(to->q_state)) /* already sent; look at next */
1555 			continue;
1556 
1557 		/*
1558 		**  Must be same mailer to keep grouping rcpts.
1559 		**  If mailers don't match: continue; sendqueue is not
1560 		**  sorted by mailers, so don't break;
1561 		*/
1562 
1563 		if (to->q_mailer != firstto->q_mailer)
1564 			continue;
1565 
1566 		if (to->q_signature == NULL) /* for safety */
1567 			to->q_signature = hostsignature(to->q_mailer,
1568 							to->q_host,
1569 							to->q_flags & QSECURE);
1570 
1571 		/*
1572 		**  This is for coincidental and tailcoat piggybacking messages
1573 		**  to the same mail host. While the signatures are identical
1574 		**  (that's the MX-RR's are identical) we can do coincidental
1575 		**  piggybacking. We try hard for coattail piggybacking
1576 		**  with the same mail host when the next recipient has the
1577 		**  same host at lowest preference. It may be that this
1578 		**  won't work out, so 'skip_back' is maintained if a backup
1579 		**  to coincidental piggybacking or full signature must happen.
1580 		*/
1581 
1582 		ret = firstto == to ? HS_MATCH_FULL :
1583 				      coloncmp(to->q_signature, firstsig);
1584 		if (ret == HS_MATCH_FULL)
1585 			skip_back = to;
1586 		else if (ret == HS_MATCH_NO)
1587 			break;
1588 
1589 		if (!clever)
1590 		{
1591 			/* avoid overflowing tobuf */
1592 			strsize += strlen(to->q_paddr) + 1;
1593 			if (strsize > TOBUFSIZE)
1594 				break;
1595 		}
1596 
1597 		if (++rcptcount > to->q_mailer->m_maxrcpt)
1598 			break;
1599 
1600 		if (tTd(10, 1))
1601 		{
1602 			sm_dprintf("\nsend to ");
1603 			printaddr(sm_debug_file(), to, false);
1604 		}
1605 
1606 		/* compute effective uid/gid when sending */
1607 		if (bitnset(M_RUNASRCPT, to->q_mailer->m_flags))
1608 #if HASSETUSERCONTEXT
1609 			contextaddr = ctladdr = getctladdr(to);
1610 #else
1611 			ctladdr = getctladdr(to);
1612 #endif
1613 
1614 		if (tTd(10, 2))
1615 		{
1616 			sm_dprintf("ctladdr=");
1617 			printaddr(sm_debug_file(), ctladdr, false);
1618 		}
1619 
1620 		user = to->q_user;
1621 		e->e_to = to->q_paddr;
1622 
1623 		/*
1624 		**  Check to see that these people are allowed to
1625 		**  talk to each other.
1626 		**  Check also for overflow of e_msgsize.
1627 		*/
1628 
1629 		if (m->m_maxsize != 0 &&
1630 		    (e->e_msgsize > m->m_maxsize || e->e_msgsize < 0))
1631 		{
1632 			e->e_flags |= EF_NO_BODY_RETN;
1633 			if (bitnset(M_LOCALMAILER, to->q_mailer->m_flags))
1634 				to->q_status = "5.2.3";
1635 			else
1636 				to->q_status = "5.3.4";
1637 
1638 			/* set to->q_rstatus = NULL; or to the following? */
1639 			usrerrenh(to->q_status,
1640 				  "552 Message is too large; %ld bytes max",
1641 				  m->m_maxsize);
1642 			markfailure(e, to, NULL, EX_UNAVAILABLE, false);
1643 			giveresponse(EX_UNAVAILABLE, to->q_status, m,
1644 				     NULL, ctladdr, xstart, e, to);
1645 			continue;
1646 		}
1647 		SM_SET_H_ERRNO(0);
1648 		ovr = true;
1649 
1650 		/* do config file checking of compatibility */
1651 		quarantine = (e->e_quarmsg != NULL);
1652 		rcode = rscheck("check_compat", e->e_from.q_paddr, to->q_paddr,
1653 				e, RSF_RMCOMM|RSF_COUNT, 3, NULL,
1654 				e->e_id, NULL, NULL);
1655 		if (rcode == EX_OK)
1656 		{
1657 			/* do in-code checking if not discarding */
1658 			if (!bitset(EF_DISCARD, e->e_flags))
1659 			{
1660 				rcode = checkcompat(to, e);
1661 				ovr = false;
1662 			}
1663 		}
1664 		if (rcode != EX_OK)
1665 		{
1666 			markfailure(e, to, NULL, rcode, ovr);
1667 			giveresponse(rcode, to->q_status, m,
1668 				     NULL, ctladdr, xstart, e, to);
1669 			continue;
1670 		}
1671 		if (!quarantine && e->e_quarmsg != NULL)
1672 		{
1673 			/*
1674 			**  check_compat or checkcompat() has tried
1675 			**  to quarantine but that isn't supported.
1676 			**  Revert the attempt.
1677 			*/
1678 
1679 			e->e_quarmsg = NULL;
1680 			macdefine(&e->e_macro, A_PERM,
1681 				  macid("{quarantine}"), "");
1682 		}
1683 		if (bitset(EF_DISCARD, e->e_flags))
1684 		{
1685 			if (tTd(10, 5))
1686 			{
1687 				sm_dprintf("deliver: discarding recipient ");
1688 				printaddr(sm_debug_file(), to, false);
1689 			}
1690 
1691 			/* pretend the message was sent */
1692 			/* XXX should we log something here? */
1693 			to->q_state = QS_DISCARDED;
1694 
1695 			/*
1696 			**  Remove discard bit to prevent discard of
1697 			**  future recipients.  This is safe because the
1698 			**  true "global discard" has been handled before
1699 			**  we get here.
1700 			*/
1701 
1702 			e->e_flags &= ~EF_DISCARD;
1703 			continue;
1704 		}
1705 
1706 		/*
1707 		**  Strip quote bits from names if the mailer is dumb
1708 		**	about them.
1709 		*/
1710 
1711 		if (bitnset(M_STRIPQ, m->m_flags))
1712 		{
1713 			stripquotes(user);
1714 			stripquotes(host);
1715 		}
1716 
1717 		/*
1718 		**  Strip all leading backslashes if requested and the
1719 		**  next character is alphanumerical (the latter can
1720 		**  probably relaxed a bit, see RFC2821).
1721 		*/
1722 
1723 		if (bitnset(M_STRIPBACKSL, m->m_flags) && user[0] == '\\')
1724 			stripbackslash(user);
1725 
1726 		/* hack attack -- delivermail compatibility */
1727 		if (m == ProgMailer && *user == '|')
1728 			user++;
1729 
1730 		/*
1731 		**  If an error message has already been given, don't
1732 		**	bother to send to this address.
1733 		**
1734 		**	>>>>>>>>>> This clause assumes that the local mailer
1735 		**	>> NOTE >> cannot do any further aliasing; that
1736 		**	>>>>>>>>>> function is subsumed by sendmail.
1737 		*/
1738 
1739 		if (!QS_IS_OK(to->q_state))
1740 			continue;
1741 
1742 		/*
1743 		**  See if this user name is "special".
1744 		**	If the user name has a slash in it, assume that this
1745 		**	is a file -- send it off without further ado.  Note
1746 		**	that this type of addresses is not processed along
1747 		**	with the others, so we fudge on the To person.
1748 		*/
1749 
1750 		if (strcmp(m->m_mailer, "[FILE]") == 0)
1751 		{
1752 			macdefine(&e->e_macro, A_PERM, 'u', user);
1753 			p = to->q_home;
1754 			if (p == NULL && ctladdr != NULL)
1755 				p = ctladdr->q_home;
1756 			macdefine(&e->e_macro, A_PERM, 'z', p);
1757 			expand(m->m_argv[1], buf, sizeof(buf), e);
1758 			if (strlen(buf) > 0)
1759 				rcode = mailfile(buf, m, ctladdr, SFF_CREAT, e);
1760 			else
1761 			{
1762 				syserr("empty filename specification for mailer %s",
1763 				       m->m_name);
1764 				rcode = EX_CONFIG;
1765 			}
1766 			giveresponse(rcode, to->q_status, m, NULL,
1767 				     ctladdr, xstart, e, to);
1768 			markfailure(e, to, NULL, rcode, true);
1769 			e->e_nsent++;
1770 			if (rcode == EX_OK)
1771 			{
1772 				to->q_state = QS_SENT;
1773 				if (bitnset(M_LOCALMAILER, m->m_flags) &&
1774 				    bitset(QPINGONSUCCESS, to->q_flags))
1775 				{
1776 					to->q_flags |= QDELIVERED;
1777 					to->q_status = "2.1.5";
1778 					(void) sm_io_fprintf(e->e_xfp,
1779 							     SM_TIME_DEFAULT,
1780 							     "%s... Successfully delivered\n",
1781 							     to->q_paddr);
1782 				}
1783 			}
1784 			to->q_statdate = curtime();
1785 			markstats(e, to, STATS_NORMAL);
1786 			continue;
1787 		}
1788 
1789 		/*
1790 		**  Address is verified -- add this user to mailer
1791 		**  argv, and add it to the print list of recipients.
1792 		*/
1793 
1794 		/* link together the chain of recipients */
1795 		to->q_tchain = tochain;
1796 		tochain = to;
1797 		e->e_to = "[CHAIN]";
1798 
1799 		macdefine(&e->e_macro, A_PERM, 'u', user);  /* to user */
1800 		p = to->q_home;
1801 		if (p == NULL && ctladdr != NULL)
1802 			p = ctladdr->q_home;
1803 		macdefine(&e->e_macro, A_PERM, 'z', p);  /* user's home */
1804 
1805 		/* set the ${dsn_notify} macro if applicable */
1806 		if (bitset(QHASNOTIFY, to->q_flags))
1807 		{
1808 			char notify[MAXLINE];
1809 
1810 			notify[0] = '\0';
1811 			if (bitset(QPINGONSUCCESS, to->q_flags))
1812 				(void) sm_strlcat(notify, "SUCCESS,",
1813 						  sizeof(notify));
1814 			if (bitset(QPINGONFAILURE, to->q_flags))
1815 				(void) sm_strlcat(notify, "FAILURE,",
1816 						  sizeof(notify));
1817 			if (bitset(QPINGONDELAY, to->q_flags))
1818 				(void) sm_strlcat(notify, "DELAY,",
1819 						  sizeof(notify));
1820 
1821 			/* Set to NEVER or drop trailing comma */
1822 			if (notify[0] == '\0')
1823 				(void) sm_strlcat(notify, "NEVER",
1824 						  sizeof(notify));
1825 			else
1826 				notify[strlen(notify) - 1] = '\0';
1827 
1828 			macdefine(&e->e_macro, A_TEMP,
1829 				macid("{dsn_notify}"), notify);
1830 		}
1831 		else
1832 			macdefine(&e->e_macro, A_PERM,
1833 				macid("{dsn_notify}"), NULL);
1834 
1835 		/*
1836 		**  Expand out this user into argument list.
1837 		*/
1838 
1839 		if (!clever)
1840 		{
1841 			expand(*mvp, buf, sizeof(buf), e);
1842 			*pvp++ = sm_rpool_strdup_x(e->e_rpool, buf);
1843 			if (pvp >= &pv[MAXPV - 2])
1844 			{
1845 				/* allow some space for trailing parms */
1846 				break;
1847 			}
1848 		}
1849 	}
1850 
1851 	/* see if any addresses still exist */
1852 	if (tochain == NULL)
1853 	{
1854 		rcode = 0;
1855 		goto cleanup;
1856 	}
1857 
1858 	/* print out messages as full list */
1859 	strsize = 1;
1860 	for (to = tochain; to != NULL; to = to->q_tchain)
1861 		strsize += strlen(to->q_paddr) + 1;
1862 	if (strsize < TOBUFSIZE)
1863 		strsize = TOBUFSIZE;
1864 	if (strsize > tobufsize)
1865 	{
1866 		SM_FREE(tobuf);
1867 		tobuf = sm_pmalloc_x(strsize);
1868 		tobufsize = strsize;
1869 	}
1870 	p = tobuf;
1871 	*p = '\0';
1872 	for (to = tochain; to != NULL; to = to->q_tchain)
1873 	{
1874 		(void) sm_strlcpyn(p, tobufsize - (p - tobuf), 2,
1875 				   ",", to->q_paddr);
1876 		p += strlen(p);
1877 	}
1878 	e->e_to = tobuf + 1;
1879 
1880 	/*
1881 	**  Fill out any parameters after the $u parameter.
1882 	*/
1883 
1884 	if (!clever)
1885 	{
1886 		while (*++mvp != NULL)
1887 		{
1888 			expand(*mvp, buf, sizeof(buf), e);
1889 			*pvp++ = sm_rpool_strdup_x(e->e_rpool, buf);
1890 			if (pvp >= &pv[MAXPV])
1891 				syserr("554 5.3.0 deliver: pv overflow after $u for %s",
1892 				       pv[0]);
1893 		}
1894 	}
1895 	*pvp++ = NULL;
1896 
1897 	/*
1898 	**  Call the mailer.
1899 	**	The argument vector gets built, pipes
1900 	**	are created as necessary, and we fork & exec as
1901 	**	appropriate.
1902 	**	If we are running SMTP, we just need to clean up.
1903 	*/
1904 
1905 	/* XXX this seems a bit weird */
1906 	if (ctladdr == NULL && m != ProgMailer && m != FileMailer &&
1907 	    bitset(QGOODUID, e->e_from.q_flags))
1908 		ctladdr = &e->e_from;
1909 
1910 #if NAMED_BIND
1911 	if (ConfigLevel < 2)
1912 		_res.options &= ~(RES_DEFNAMES | RES_DNSRCH);	/* XXX */
1913 #endif
1914 
1915 	if (tTd(11, 1))
1916 	{
1917 		sm_dprintf("openmailer:");
1918 		printav(sm_debug_file(), pv);
1919 	}
1920 	errno = 0;
1921 	SM_SET_H_ERRNO(0);
1922 	CurHostName = NULL;
1923 
1924 	/*
1925 	**  Deal with the special case of mail handled through an IPC
1926 	**  connection.
1927 	**	In this case we don't actually fork.  We must be
1928 	**	running SMTP for this to work.  We will return a
1929 	**	zero pid to indicate that we are running IPC.
1930 	**  We also handle a debug version that just talks to stdin/out.
1931 	*/
1932 
1933 	curhost = NULL;
1934 	SmtpPhase = NULL;
1935 	mci = NULL;
1936 
1937 #if XDEBUG
1938 	{
1939 		char wbuf[MAXLINE];
1940 
1941 		/* make absolutely certain 0, 1, and 2 are in use */
1942 		(void) sm_snprintf(wbuf, sizeof(wbuf), "%s... openmailer(%s)",
1943 				   shortenstring(e->e_to, MAXSHORTSTR),
1944 				   m->m_name);
1945 		checkfd012(wbuf);
1946 	}
1947 #endif /* XDEBUG */
1948 
1949 	/* check for 8-bit available */
1950 	if (bitset(EF_HAS8BIT, e->e_flags) &&
1951 	    bitnset(M_7BITS, m->m_flags) &&
1952 	    (bitset(EF_DONT_MIME, e->e_flags) ||
1953 	     !(bitset(MM_MIME8BIT, MimeMode) ||
1954 	       (bitset(EF_IS_MIME, e->e_flags) &&
1955 		bitset(MM_CVTMIME, MimeMode)))))
1956 	{
1957 		e->e_status = "5.6.3";
1958 		usrerrenh(e->e_status,
1959 			  "554 Cannot send 8-bit data to 7-bit destination");
1960 		rcode = EX_DATAERR;
1961 		goto give_up;
1962 	}
1963 
1964 	if (tTd(62, 8))
1965 		checkfds("before delivery");
1966 
1967 	/* check for Local Person Communication -- not for mortals!!! */
1968 	if (strcmp(m->m_mailer, "[LPC]") == 0)
1969 	{
1970 		if (clever)
1971 		{
1972 			/* flush any expired connections */
1973 			(void) mci_scan(NULL);
1974 
1975 			/* try to get a cached connection or just a slot */
1976 			mci = mci_get(m->m_name, m);
1977 			if (mci->mci_host == NULL)
1978 				mci->mci_host = m->m_name;
1979 			CurHostName = mci->mci_host;
1980 			if (mci->mci_state != MCIS_CLOSED)
1981 			{
1982 				message("Using cached SMTP/LPC connection for %s...",
1983 					m->m_name);
1984 				mci->mci_deliveries++;
1985 				goto do_transfer;
1986 			}
1987 		}
1988 		else
1989 		{
1990 			mci = mci_new(e->e_rpool);
1991 		}
1992 		mci->mci_in = smioin;
1993 		mci->mci_out = smioout;
1994 		mci->mci_mailer = m;
1995 		mci->mci_host = m->m_name;
1996 		if (clever)
1997 		{
1998 			mci->mci_state = MCIS_OPENING;
1999 			mci_cache(mci);
2000 		}
2001 		else
2002 			mci->mci_state = MCIS_OPEN;
2003 	}
2004 	else if (strcmp(m->m_mailer, "[IPC]") == 0)
2005 	{
2006 		register int i;
2007 
2008 		if (pv[0] == NULL || pv[1] == NULL || pv[1][0] == '\0')
2009 		{
2010 			syserr("null destination for %s mailer", m->m_mailer);
2011 			rcode = EX_CONFIG;
2012 			goto give_up;
2013 		}
2014 
2015 #if NETUNIX
2016 		if (strcmp(pv[0], "FILE") == 0)
2017 		{
2018 			curhost = CurHostName = "localhost";
2019 			mux_path = pv[1];
2020 		}
2021 		else
2022 #endif /* NETUNIX */
2023 		{
2024 			CurHostName = pv[1];
2025 							/* XXX ??? */
2026 			curhost = hostsignature(m, pv[1], firstto->q_flags & QSECURE);
2027 		}
2028 
2029 		if (curhost == NULL || curhost[0] == '\0')
2030 		{
2031 			syserr("null host signature for %s", pv[1]);
2032 			rcode = EX_CONFIG;
2033 			goto give_up;
2034 		}
2035 
2036 		if (!clever)
2037 		{
2038 			syserr("554 5.3.5 non-clever IPC");
2039 			rcode = EX_CONFIG;
2040 			goto give_up;
2041 		}
2042 		if (pv[2] != NULL
2043 #if NETUNIX
2044 		    && mux_path == NULL
2045 #endif
2046 		    )
2047 		{
2048 			port = htons((unsigned short) atoi(pv[2]));
2049 			if (port == 0)
2050 			{
2051 #ifdef NO_GETSERVBYNAME
2052 				syserr("Invalid port number: %s", pv[2]);
2053 #else /* NO_GETSERVBYNAME */
2054 				struct servent *sp = getservbyname(pv[2], "tcp");
2055 
2056 				if (sp == NULL)
2057 					syserr("Service %s unknown", pv[2]);
2058 				else
2059 					port = sp->s_port;
2060 #endif /* NO_GETSERVBYNAME */
2061 			}
2062 		}
2063 
2064 		nummxhosts = parse_hostsignature(curhost, mxhosts, m);
2065 		if (TimeOuts.to_aconnect > 0)
2066 			enough = curtime() + TimeOuts.to_aconnect;
2067 tryhost:
2068 		while (hostnum < nummxhosts)
2069 		{
2070 			char sep = ':';
2071 			char *endp;
2072 			static char hostbuf[MAXNAME + 1];
2073 			bool tried_fallbacksmarthost = false;
2074 #if DANE
2075 			unsigned long tlsa_flags;
2076 
2077 			ste = NULL;
2078 			tlsa_flags = 0;
2079 #endif
2080 #if NETINET6
2081 			if (*mxhosts[hostnum] == '[')
2082 			{
2083 				endp = strchr(mxhosts[hostnum] + 1, ']');
2084 				if (endp != NULL)
2085 					endp = strpbrk(endp + 1, ":,");
2086 			}
2087 			else
2088 				endp = strpbrk(mxhosts[hostnum], ":,");
2089 #else /* NETINET6 */
2090 			endp = strpbrk(mxhosts[hostnum], ":,");
2091 #endif /* NETINET6 */
2092 			if (endp != NULL)
2093 			{
2094 				sep = *endp;
2095 				*endp = '\0';
2096 			}
2097 
2098 			if (hostnum == 1 && skip_back != NULL)
2099 			{
2100 				/*
2101 				**  Coattail piggybacking is no longer an
2102 				**  option with the mail host next to be tried
2103 				**  no longer the lowest MX preference
2104 				**  (hostnum == 1 meaning we're on the second
2105 				**  preference). We do not try to coattail
2106 				**  piggyback more than the first MX preference.
2107 				**  Revert 'tochain' to last location for
2108 				**  coincidental piggybacking. This works this
2109 				**  easily because the q_tchain kept getting
2110 				**  added to the top of the linked list.
2111 				*/
2112 
2113 				tochain = skip_back;
2114 			}
2115 
2116 			if (*mxhosts[hostnum] == '\0')
2117 			{
2118 				syserr("deliver: null host name in signature");
2119 				hostnum++;
2120 				if (endp != NULL)
2121 					*endp = sep;
2122 				continue;
2123 			}
2124 			(void) sm_strlcpy(hostbuf, mxhosts[hostnum],
2125 					  sizeof(hostbuf));
2126 			hostnum++;
2127 			if (endp != NULL)
2128 				*endp = sep;
2129 #if STARTTLS
2130 			tlsstate = 0;
2131 #endif
2132 
2133   one_last_try:
2134 			/* see if we already know that this host is fried */
2135 			CurHostName = hostbuf;
2136 			mci = mci_get(hostbuf, m);
2137 			if (mci->mci_state != MCIS_CLOSED)
2138 			{
2139 				char *type;
2140 
2141 				if (tTd(11, 1))
2142 				{
2143 					sm_dprintf("openmailer: ");
2144 					mci_dump(sm_debug_file(), mci, false);
2145 				}
2146 				CurHostName = mci->mci_host;
2147 				if (bitnset(M_LMTP, m->m_flags))
2148 					type = "L";
2149 				else if (bitset(MCIF_ESMTP, mci->mci_flags))
2150 					type = "ES";
2151 				else
2152 					type = "S";
2153 				message("Using cached %sMTP connection to %s via %s...",
2154 					type, hostbuf, m->m_name);
2155 				mci->mci_deliveries++;
2156 				break;
2157 			}
2158 			mci->mci_mailer = m;
2159 #if DANE
2160 			tlsa_flags = 0;
2161 			if (CHK_DANE(Dane))
2162 				(void) GETTLSA(hostbuf, &ste, m->m_port);
2163 
2164 			/* XXX: check expiration! */
2165 			if (ste != NULL && TLSA_RR_TEMPFAIL(ste->s_tlsa))
2166 			{
2167 				if (tTd(11, 1))
2168 					sm_dprintf("skip: host=%s, TLSA_RR_lookup=%d\n"
2169 						, hostbuf
2170 						, ste->s_tlsa->dane_tlsa_dnsrc);
2171 
2172 				tlsa_flags |= TLSAFLTEMP;
2173 			}
2174 #endif /* DANE */
2175 
2176 			if (mci->mci_exitstat != EX_OK)
2177 			{
2178 				if (mci->mci_exitstat == EX_TEMPFAIL)
2179 					goodmxfound = true;
2180 
2181 				/* Try FallbackSmartHost? */
2182 				if (should_try_fbsh(e, &tried_fallbacksmarthost,
2183 						    hostbuf, sizeof(hostbuf),
2184 						    mci->mci_exitstat))
2185 					goto one_last_try;
2186 
2187 				continue;
2188 			}
2189 
2190 			if (mci_lock_host(mci) != EX_OK)
2191 			{
2192 				mci_setstat(mci, EX_TEMPFAIL, "4.4.5", NULL);
2193 				goodmxfound = true;
2194 				continue;
2195 			}
2196 
2197 			/* try the connection */
2198 			sm_setproctitle(true, e, "%s %s: %s",
2199 					qid_printname(e),
2200 					hostbuf, "user open");
2201 #if NETUNIX
2202 			if (mux_path != NULL)
2203 			{
2204 				message("Connecting to %s via %s...",
2205 					mux_path, m->m_name);
2206 				i = makeconnection_ds((char *) mux_path, mci);
2207 			}
2208 			else
2209 #endif /* NETUNIX */
2210 			{
2211 				if (port == 0)
2212 					message("Connecting to %s via %s...",
2213 						hostbuf, m->m_name);
2214 				else
2215 					message("Connecting to %s port %d via %s...",
2216 						hostbuf, ntohs(port),
2217 						m->m_name);
2218 #if DANE
2219 				tlsa_flags |= (ste != NULL) ? Dane : DANE_NEVER;
2220 				dane_vrfy_ctx.dane_vrfy_chk = tlsa_flags;
2221 				dane_vrfy_ctx.dane_vrfy_port = m->m_port;
2222 				if (tTd(11, 11))
2223 					sm_dprintf("makeconnection: before: chk=%d, mode=%lX\n", dane_vrfy_ctx.dane_vrfy_chk, tlsa_flags);
2224 #endif
2225 				i = makeconnection(hostbuf, port, mci, e,
2226 						enough
2227 #if DANE
2228 						, &tlsa_flags
2229 #endif
2230 						);
2231 #if DANE
2232 				if (tTd(11, 11))
2233 					sm_dprintf("makeconnection: after: chk=%d, mode=%lX\n", dane_vrfy_ctx.dane_vrfy_chk, tlsa_flags);
2234 				if (dane_vrfy_ctx.dane_vrfy_chk != DANE_ALWAYS)
2235 					dane_vrfy_ctx.dane_vrfy_chk = DANEMODE(tlsa_flags);
2236 				if (EX_TEMPFAIL == i &&
2237 				    ((tlsa_flags & (TLSAFLTEMP|DANE_SECURE)) ==
2238 				     (TLSAFLTEMP|DANE_SECURE)))
2239 				{
2240 					(void) sm_strlcpy(SmtpError,
2241 						" for TLSA RR",
2242 						sizeof(SmtpError));
2243 # if NAMED_BIND
2244 					SM_SET_H_ERRNO(TRY_AGAIN);
2245 # endif
2246 				}
2247 #endif
2248 			}
2249 			mci->mci_errno = errno;
2250 			mci->mci_lastuse = curtime();
2251 			mci->mci_deliveries = 0;
2252 			mci->mci_exitstat = i;
2253 			mci_clr_extensions(mci);
2254 #if NAMED_BIND
2255 			mci->mci_herrno = h_errno;
2256 #endif
2257 
2258 			/*
2259 			**  Have we tried long enough to get a connection?
2260 			**	If yes, skip to the fallback MX hosts
2261 			**	(if existent).
2262 			*/
2263 
2264 			if (enough > 0 && mci->mci_lastuse >= enough)
2265 			{
2266 				int h;
2267 #if NAMED_BIND
2268 				extern int NumFallbackMXHosts;
2269 #else
2270 				const int NumFallbackMXHosts = 0;
2271 #endif
2272 
2273 				if (hostnum < nummxhosts && LogLevel > 9)
2274 					sm_syslog(LOG_INFO, e->e_id,
2275 						  "Timeout.to_aconnect occurred before exhausting all addresses");
2276 
2277 				/* turn off timeout if fallback available */
2278 				if (NumFallbackMXHosts > 0)
2279 					enough = 0;
2280 
2281 				/* skip to a fallback MX host */
2282 				h = nummxhosts - NumFallbackMXHosts;
2283 				if (hostnum < h)
2284 					hostnum = h;
2285 			}
2286 			if (i == EX_OK)
2287 			{
2288 				goodmxfound = true;
2289 				markstats(e, firstto, STATS_CONNECT);
2290 				mci->mci_state = MCIS_OPENING;
2291 				mci_cache(mci);
2292 				if (TrafficLogFile != NULL)
2293 					(void) sm_io_fprintf(TrafficLogFile,
2294 							     SM_TIME_DEFAULT,
2295 							     "%05d === CONNECT %s\n",
2296 							     (int) CurrentPid,
2297 							     hostbuf);
2298 				break;
2299 			}
2300 			else
2301 			{
2302 				/* Try FallbackSmartHost? */
2303 				if (should_try_fbsh(e, &tried_fallbacksmarthost,
2304 						    hostbuf, sizeof(hostbuf), i))
2305 					goto one_last_try;
2306 
2307 				if (tTd(11, 1))
2308 					sm_dprintf("openmailer: makeconnection => stat=%d, errno=%d\n",
2309 						   i, errno);
2310 				if (i == EX_TEMPFAIL)
2311 					goodmxfound = true;
2312 				mci_unlock_host(mci);
2313 			}
2314 
2315 			/* enter status of this host */
2316 			setstat(i);
2317 
2318 			/* should print some message here for -v mode */
2319 		}
2320 		if (mci == NULL)
2321 		{
2322 			syserr("deliver: no host name");
2323 			rcode = EX_SOFTWARE;
2324 			goto give_up;
2325 		}
2326 		mci->mci_pid = 0;
2327 	}
2328 	else
2329 	{
2330 		/* flush any expired connections */
2331 		(void) mci_scan(NULL);
2332 		mci = NULL;
2333 
2334 		if (bitnset(M_LMTP, m->m_flags))
2335 		{
2336 			/* try to get a cached connection */
2337 			mci = mci_get(m->m_name, m);
2338 			if (mci->mci_host == NULL)
2339 				mci->mci_host = m->m_name;
2340 			CurHostName = mci->mci_host;
2341 			if (mci->mci_state != MCIS_CLOSED)
2342 			{
2343 				message("Using cached LMTP connection for %s...",
2344 					m->m_name);
2345 				mci->mci_deliveries++;
2346 				goto do_transfer;
2347 			}
2348 		}
2349 
2350 		/* announce the connection to verbose listeners */
2351 		if (host == NULL || host[0] == '\0')
2352 			message("Connecting to %s...", m->m_name);
2353 		else
2354 			message("Connecting to %s via %s...", host, m->m_name);
2355 		if (TrafficLogFile != NULL)
2356 		{
2357 			char **av;
2358 
2359 			(void) sm_io_fprintf(TrafficLogFile, SM_TIME_DEFAULT,
2360 					     "%05d === EXEC", (int) CurrentPid);
2361 			for (av = pv; *av != NULL; av++)
2362 				(void) sm_io_fprintf(TrafficLogFile,
2363 						     SM_TIME_DEFAULT, " %s",
2364 						     *av);
2365 			(void) sm_io_fprintf(TrafficLogFile, SM_TIME_DEFAULT,
2366 					     "\n");
2367 		}
2368 
2369 #if XDEBUG
2370 		checkfd012("before creating mail pipe");
2371 #endif
2372 
2373 		/* create a pipe to shove the mail through */
2374 		if (pipe(mpvect) < 0)
2375 		{
2376 			syserr("%s... openmailer(%s): pipe (to mailer)",
2377 			       shortenstring(e->e_to, MAXSHORTSTR), m->m_name);
2378 			if (tTd(11, 1))
2379 				sm_dprintf("openmailer: NULL\n");
2380 			rcode = EX_OSERR;
2381 			goto give_up;
2382 		}
2383 
2384 #if XDEBUG
2385 		/* make sure we didn't get one of the standard I/O files */
2386 		if (mpvect[0] < 3 || mpvect[1] < 3)
2387 		{
2388 			syserr("%s... openmailer(%s): bogus mpvect %d %d",
2389 			       shortenstring(e->e_to, MAXSHORTSTR), m->m_name,
2390 			       mpvect[0], mpvect[1]);
2391 			printopenfds(true);
2392 			if (tTd(11, 1))
2393 				sm_dprintf("openmailer: NULL\n");
2394 			rcode = EX_OSERR;
2395 			goto give_up;
2396 		}
2397 
2398 		/* make sure system call isn't dead meat */
2399 		checkfdopen(mpvect[0], "mpvect[0]");
2400 		checkfdopen(mpvect[1], "mpvect[1]");
2401 		if (mpvect[0] == mpvect[1] ||
2402 		    (e->e_lockfp != NULL &&
2403 		     (mpvect[0] == sm_io_getinfo(e->e_lockfp, SM_IO_WHAT_FD,
2404 						 NULL) ||
2405 		      mpvect[1] == sm_io_getinfo(e->e_lockfp, SM_IO_WHAT_FD,
2406 						 NULL))))
2407 		{
2408 			if (e->e_lockfp == NULL)
2409 				syserr("%s... openmailer(%s): overlapping mpvect %d %d",
2410 				       shortenstring(e->e_to, MAXSHORTSTR),
2411 				       m->m_name, mpvect[0], mpvect[1]);
2412 			else
2413 				syserr("%s... openmailer(%s): overlapping mpvect %d %d, lockfp = %d",
2414 				       shortenstring(e->e_to, MAXSHORTSTR),
2415 				       m->m_name, mpvect[0], mpvect[1],
2416 				       sm_io_getinfo(e->e_lockfp,
2417 						     SM_IO_WHAT_FD, NULL));
2418 		}
2419 #endif /* XDEBUG */
2420 
2421 		/* create a return pipe */
2422 		if (pipe(rpvect) < 0)
2423 		{
2424 			syserr("%s... openmailer(%s): pipe (from mailer)",
2425 			       shortenstring(e->e_to, MAXSHORTSTR),
2426 			       m->m_name);
2427 			(void) close(mpvect[0]);
2428 			(void) close(mpvect[1]);
2429 			if (tTd(11, 1))
2430 				sm_dprintf("openmailer: NULL\n");
2431 			rcode = EX_OSERR;
2432 			goto give_up;
2433 		}
2434 #if XDEBUG
2435 		checkfdopen(rpvect[0], "rpvect[0]");
2436 		checkfdopen(rpvect[1], "rpvect[1]");
2437 #endif
2438 
2439 		/*
2440 		**  Actually fork the mailer process.
2441 		**	DOFORK is clever about retrying.
2442 		**
2443 		**	Dispose of SIGCHLD signal catchers that may be laying
2444 		**	around so that endmailer will get it.
2445 		*/
2446 
2447 		if (e->e_xfp != NULL)	/* for debugging */
2448 			(void) sm_io_flush(e->e_xfp, SM_TIME_DEFAULT);
2449 		(void) sm_io_flush(smioout, SM_TIME_DEFAULT);
2450 		(void) sm_signal(SIGCHLD, SIG_DFL);
2451 
2452 
2453 		DOFORK(FORK);
2454 		/* pid is set by DOFORK */
2455 
2456 		if (pid < 0)
2457 		{
2458 			/* failure */
2459 			syserr("%s... openmailer(%s): cannot fork",
2460 			       shortenstring(e->e_to, MAXSHORTSTR), m->m_name);
2461 			(void) close(mpvect[0]);
2462 			(void) close(mpvect[1]);
2463 			(void) close(rpvect[0]);
2464 			(void) close(rpvect[1]);
2465 			if (tTd(11, 1))
2466 				sm_dprintf("openmailer: NULL\n");
2467 			rcode = EX_OSERR;
2468 			goto give_up;
2469 		}
2470 		else if (pid == 0)
2471 		{
2472 			int save_errno;
2473 			int sff;
2474 			int new_euid = NO_UID;
2475 			int new_ruid = NO_UID;
2476 			int new_gid = NO_GID;
2477 			char *user = NULL;
2478 			struct stat stb;
2479 			extern int DtableSize;
2480 
2481 			CurrentPid = getpid();
2482 
2483 			/* clear the events to turn off SIGALRMs */
2484 			sm_clear_events();
2485 
2486 			/* Reset global flags */
2487 			RestartRequest = NULL;
2488 			RestartWorkGroup = false;
2489 			ShutdownRequest = NULL;
2490 			PendingSignal = 0;
2491 
2492 			if (e->e_lockfp != NULL)
2493 				(void) close(sm_io_getinfo(e->e_lockfp,
2494 							   SM_IO_WHAT_FD,
2495 							   NULL));
2496 
2497 			/* child -- set up input & exec mailer */
2498 			(void) sm_signal(SIGALRM, sm_signal_noop);
2499 			(void) sm_signal(SIGCHLD, SIG_DFL);
2500 			(void) sm_signal(SIGHUP, SIG_IGN);
2501 			(void) sm_signal(SIGINT, SIG_IGN);
2502 			(void) sm_signal(SIGTERM, SIG_DFL);
2503 #ifdef SIGUSR1
2504 			(void) sm_signal(SIGUSR1, sm_signal_noop);
2505 #endif
2506 
2507 			if (m != FileMailer || stat(tochain->q_user, &stb) < 0)
2508 				stb.st_mode = 0;
2509 
2510 #if HASSETUSERCONTEXT
2511 			/*
2512 			**  Set user resources.
2513 			*/
2514 
2515 			if (contextaddr != NULL)
2516 			{
2517 				int sucflags;
2518 				struct passwd *pwd;
2519 
2520 				if (contextaddr->q_ruser != NULL)
2521 					pwd = sm_getpwnam(contextaddr->q_ruser);
2522 				else
2523 					pwd = sm_getpwnam(contextaddr->q_user);
2524 				sucflags = LOGIN_SETRESOURCES|LOGIN_SETPRIORITY;
2525 # ifdef LOGIN_SETCPUMASK
2526 				sucflags |= LOGIN_SETCPUMASK;
2527 # endif
2528 # ifdef LOGIN_SETLOGINCLASS
2529 				sucflags |= LOGIN_SETLOGINCLASS;
2530 # endif
2531 # ifdef LOGIN_SETMAC
2532 				sucflags |= LOGIN_SETMAC;
2533 # endif
2534 				if (pwd != NULL &&
2535 				    setusercontext(NULL, pwd, pwd->pw_uid,
2536 						   sucflags) == -1 &&
2537 				    suidwarn)
2538 				{
2539 					syserr("openmailer: setusercontext() failed");
2540 					exit(EX_TEMPFAIL);
2541 				}
2542 			}
2543 #endif /* HASSETUSERCONTEXT */
2544 
2545 #if HASNICE
2546 			/* tweak niceness */
2547 			if (m->m_nice != 0)
2548 				(void) nice(m->m_nice);
2549 #endif /* HASNICE */
2550 
2551 			/* reset group id */
2552 			if (bitnset(M_SPECIFIC_UID, m->m_flags))
2553 			{
2554 				if (m->m_gid == NO_GID)
2555 					new_gid = RunAsGid;
2556 				else
2557 					new_gid = m->m_gid;
2558 			}
2559 			else if (bitset(S_ISGID, stb.st_mode))
2560 				new_gid = stb.st_gid;
2561 			else if (ctladdr != NULL && ctladdr->q_gid != 0)
2562 			{
2563 				if (!DontInitGroups)
2564 				{
2565 					user = ctladdr->q_ruser;
2566 					if (user == NULL)
2567 						user = ctladdr->q_user;
2568 
2569 					if (initgroups(user,
2570 						       ctladdr->q_gid) == -1
2571 					    && suidwarn)
2572 					{
2573 						syserr("openmailer: initgroups(%s, %ld) failed",
2574 							user, (long) ctladdr->q_gid);
2575 						exit(EX_TEMPFAIL);
2576 					}
2577 				}
2578 				else
2579 				{
2580 					GIDSET_T gidset[1];
2581 
2582 					gidset[0] = ctladdr->q_gid;
2583 					if (setgroups(1, gidset) == -1
2584 					    && suidwarn)
2585 					{
2586 						syserr("openmailer: setgroups() failed");
2587 						exit(EX_TEMPFAIL);
2588 					}
2589 				}
2590 				new_gid = ctladdr->q_gid;
2591 			}
2592 			else
2593 			{
2594 				if (!DontInitGroups)
2595 				{
2596 					user = DefUser;
2597 					if (initgroups(DefUser, DefGid) == -1 &&
2598 					    suidwarn)
2599 					{
2600 						syserr("openmailer: initgroups(%s, %ld) failed",
2601 						       DefUser, (long) DefGid);
2602 						exit(EX_TEMPFAIL);
2603 					}
2604 				}
2605 				else
2606 				{
2607 					GIDSET_T gidset[1];
2608 
2609 					gidset[0] = DefGid;
2610 					if (setgroups(1, gidset) == -1
2611 					    && suidwarn)
2612 					{
2613 						syserr("openmailer: setgroups() failed");
2614 						exit(EX_TEMPFAIL);
2615 					}
2616 				}
2617 				if (m->m_gid == NO_GID)
2618 					new_gid = DefGid;
2619 				else
2620 					new_gid = m->m_gid;
2621 			}
2622 			if (new_gid != NO_GID)
2623 			{
2624 				if (RunAsUid != 0 &&
2625 				    bitnset(M_SPECIFIC_UID, m->m_flags) &&
2626 				    new_gid != getgid() &&
2627 				    new_gid != getegid())
2628 				{
2629 					/* Only root can change the gid */
2630 					syserr("openmailer: insufficient privileges to change gid, RunAsUid=%ld, new_gid=%ld, gid=%ld, egid=%ld",
2631 					       (long) RunAsUid, (long) new_gid,
2632 					       (long) getgid(), (long) getegid());
2633 					exit(EX_TEMPFAIL);
2634 				}
2635 
2636 				if (setgid(new_gid) < 0 && suidwarn)
2637 				{
2638 					syserr("openmailer: setgid(%ld) failed",
2639 					       (long) new_gid);
2640 					exit(EX_TEMPFAIL);
2641 				}
2642 			}
2643 
2644 			/* change root to some "safe" directory */
2645 			if (m->m_rootdir != NULL)
2646 			{
2647 				expand(m->m_rootdir, cbuf, sizeof(cbuf), e);
2648 				if (tTd(11, 20))
2649 					sm_dprintf("openmailer: chroot %s\n",
2650 						   cbuf);
2651 				if (chroot(cbuf) < 0)
2652 				{
2653 					syserr("openmailer: Cannot chroot(%s)",
2654 					       cbuf);
2655 					exit(EX_TEMPFAIL);
2656 				}
2657 				if (chdir("/") < 0)
2658 				{
2659 					syserr("openmailer: cannot chdir(/)");
2660 					exit(EX_TEMPFAIL);
2661 				}
2662 			}
2663 
2664 			/* reset user id */
2665 			endpwent();
2666 			sm_mbdb_terminate();
2667 			if (bitnset(M_SPECIFIC_UID, m->m_flags))
2668 			{
2669 				if (m->m_uid == NO_UID)
2670 					new_euid = RunAsUid;
2671 				else
2672 					new_euid = m->m_uid;
2673 
2674 				/*
2675 				**  Undo the effects of the uid change in main
2676 				**  for signal handling.  The real uid may
2677 				**  be used by mailer in adding a "From "
2678 				**  line.
2679 				*/
2680 
2681 				if (RealUid != 0 && RealUid != getuid())
2682 				{
2683 #if MAILER_SETUID_METHOD == USE_SETEUID
2684 # if HASSETREUID
2685 					if (setreuid(RealUid, geteuid()) < 0)
2686 					{
2687 						syserr("openmailer: setreuid(%d, %d) failed",
2688 						       (int) RealUid, (int) geteuid());
2689 						exit(EX_OSERR);
2690 					}
2691 # endif /* HASSETREUID */
2692 #endif /* MAILER_SETUID_METHOD == USE_SETEUID */
2693 #if MAILER_SETUID_METHOD == USE_SETREUID
2694 					new_ruid = RealUid;
2695 #endif
2696 				}
2697 			}
2698 			else if (bitset(S_ISUID, stb.st_mode))
2699 				new_ruid = stb.st_uid;
2700 			else if (ctladdr != NULL && ctladdr->q_uid != 0)
2701 				new_ruid = ctladdr->q_uid;
2702 			else if (m->m_uid != NO_UID)
2703 				new_ruid = m->m_uid;
2704 			else
2705 				new_ruid = DefUid;
2706 
2707 #if _FFR_USE_SETLOGIN
2708 			/* run disconnected from terminal and set login name */
2709 			if (setsid() >= 0 &&
2710 			    ctladdr != NULL && ctladdr->q_uid != 0 &&
2711 			    new_euid == ctladdr->q_uid)
2712 			{
2713 				struct passwd *pwd;
2714 
2715 				pwd = sm_getpwuid(ctladdr->q_uid);
2716 				if (pwd != NULL && suidwarn)
2717 					(void) setlogin(pwd->pw_name);
2718 				endpwent();
2719 			}
2720 #endif /* _FFR_USE_SETLOGIN */
2721 
2722 			if (new_euid != NO_UID)
2723 			{
2724 				if (RunAsUid != 0 && new_euid != RunAsUid)
2725 				{
2726 					/* Only root can change the uid */
2727 					syserr("openmailer: insufficient privileges to change uid, new_euid=%ld, RunAsUid=%ld",
2728 					       (long) new_euid, (long) RunAsUid);
2729 					exit(EX_TEMPFAIL);
2730 				}
2731 
2732 				vendor_set_uid(new_euid);
2733 #if MAILER_SETUID_METHOD == USE_SETEUID
2734 				if (seteuid(new_euid) < 0 && suidwarn)
2735 				{
2736 					syserr("openmailer: seteuid(%ld) failed",
2737 					       (long) new_euid);
2738 					exit(EX_TEMPFAIL);
2739 				}
2740 #endif /* MAILER_SETUID_METHOD == USE_SETEUID */
2741 #if MAILER_SETUID_METHOD == USE_SETREUID
2742 				if (setreuid(new_ruid, new_euid) < 0 && suidwarn)
2743 				{
2744 					syserr("openmailer: setreuid(%ld, %ld) failed",
2745 					       (long) new_ruid, (long) new_euid);
2746 					exit(EX_TEMPFAIL);
2747 				}
2748 #endif /* MAILER_SETUID_METHOD == USE_SETREUID */
2749 #if MAILER_SETUID_METHOD == USE_SETUID
2750 				if (new_euid != geteuid() && setuid(new_euid) < 0 && suidwarn)
2751 				{
2752 					syserr("openmailer: setuid(%ld) failed",
2753 					       (long) new_euid);
2754 					exit(EX_TEMPFAIL);
2755 				}
2756 #endif /* MAILER_SETUID_METHOD == USE_SETUID */
2757 			}
2758 			else if (new_ruid != NO_UID)
2759 			{
2760 				vendor_set_uid(new_ruid);
2761 				if (setuid(new_ruid) < 0 && suidwarn)
2762 				{
2763 					syserr("openmailer: setuid(%ld) failed",
2764 					       (long) new_ruid);
2765 					exit(EX_TEMPFAIL);
2766 				}
2767 			}
2768 
2769 			if (tTd(11, 2))
2770 				sm_dprintf("openmailer: running as r/euid=%ld/%ld, r/egid=%ld/%ld\n",
2771 					   (long) getuid(), (long) geteuid(),
2772 					   (long) getgid(), (long) getegid());
2773 
2774 			/* move into some "safe" directory */
2775 			if (m->m_execdir != NULL)
2776 			{
2777 				char *q;
2778 
2779 				for (p = m->m_execdir; p != NULL; p = q)
2780 				{
2781 					q = strchr(p, ':');
2782 					if (q != NULL)
2783 						*q = '\0';
2784 					expand(p, cbuf, sizeof(cbuf), e);
2785 					if (q != NULL)
2786 						*q++ = ':';
2787 					if (tTd(11, 20))
2788 						sm_dprintf("openmailer: trydir %s\n",
2789 							   cbuf);
2790 					if (cbuf[0] != '\0' &&
2791 					    chdir(cbuf) >= 0)
2792 						break;
2793 				}
2794 			}
2795 
2796 			/* Check safety of program to be run */
2797 			sff = SFF_ROOTOK|SFF_EXECOK;
2798 			if (!bitnset(DBS_RUNWRITABLEPROGRAM,
2799 				     DontBlameSendmail))
2800 				sff |= SFF_NOGWFILES|SFF_NOWWFILES;
2801 			if (bitnset(DBS_RUNPROGRAMINUNSAFEDIRPATH,
2802 				    DontBlameSendmail))
2803 				sff |= SFF_NOPATHCHECK;
2804 			else
2805 				sff |= SFF_SAFEDIRPATH;
2806 			ret = safefile(m->m_mailer, getuid(), getgid(),
2807 				       user, sff, 0, NULL);
2808 			if (ret != 0)
2809 				sm_syslog(LOG_INFO, e->e_id,
2810 					  "Warning: program %s unsafe: %s",
2811 					  m->m_mailer, sm_errstring(ret));
2812 
2813 			/* arrange to filter std & diag output of command */
2814 			(void) close(rpvect[0]);
2815 			if (dup2(rpvect[1], STDOUT_FILENO) < 0)
2816 			{
2817 				syserr("%s... openmailer(%s): cannot dup pipe %d for stdout",
2818 				       shortenstring(e->e_to, MAXSHORTSTR),
2819 				       m->m_name, rpvect[1]);
2820 				_exit(EX_OSERR);
2821 			}
2822 			(void) close(rpvect[1]);
2823 
2824 			if (dup2(STDOUT_FILENO, STDERR_FILENO) < 0)
2825 			{
2826 				syserr("%s... openmailer(%s): cannot dup stdout for stderr",
2827 				       shortenstring(e->e_to, MAXSHORTSTR),
2828 				       m->m_name);
2829 				_exit(EX_OSERR);
2830 			}
2831 
2832 			/* arrange to get standard input */
2833 			(void) close(mpvect[1]);
2834 			if (dup2(mpvect[0], STDIN_FILENO) < 0)
2835 			{
2836 				syserr("%s... openmailer(%s): cannot dup pipe %d for stdin",
2837 				       shortenstring(e->e_to, MAXSHORTSTR),
2838 				       m->m_name, mpvect[0]);
2839 				_exit(EX_OSERR);
2840 			}
2841 			(void) close(mpvect[0]);
2842 
2843 			/* arrange for all the files to be closed */
2844 			sm_close_on_exec(STDERR_FILENO + 1, DtableSize);
2845 
2846 #if !_FFR_USE_SETLOGIN
2847 			/* run disconnected from terminal */
2848 			(void) setsid();
2849 #endif
2850 
2851 			/* try to execute the mailer */
2852 			(void) execve(m->m_mailer, (ARGV_T) pv,
2853 				      (ARGV_T) UserEnviron);
2854 			save_errno = errno;
2855 			syserr("Cannot exec %s", m->m_mailer);
2856 			if (bitnset(M_LOCALMAILER, m->m_flags) ||
2857 			    transienterror(save_errno))
2858 				_exit(EX_OSERR);
2859 			_exit(EX_UNAVAILABLE);
2860 		}
2861 
2862 		/*
2863 		**  Set up return value.
2864 		*/
2865 
2866 		if (mci == NULL)
2867 		{
2868 			if (clever)
2869 			{
2870 				/*
2871 				**  Allocate from general heap, not
2872 				**  envelope rpool, because this mci
2873 				**  is going to be cached.
2874 				*/
2875 
2876 				mci = mci_new(NULL);
2877 			}
2878 			else
2879 			{
2880 				/*
2881 				**  Prevent a storage leak by allocating
2882 				**  this from the envelope rpool.
2883 				*/
2884 
2885 				mci = mci_new(e->e_rpool);
2886 			}
2887 		}
2888 		mci->mci_mailer = m;
2889 		if (clever)
2890 		{
2891 			mci->mci_state = MCIS_OPENING;
2892 			mci_cache(mci);
2893 		}
2894 		else
2895 		{
2896 			mci->mci_state = MCIS_OPEN;
2897 		}
2898 		mci->mci_pid = pid;
2899 		(void) close(mpvect[0]);
2900 		mci->mci_out = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
2901 					  (void *) &(mpvect[1]), SM_IO_WRONLY_B,
2902 					  NULL);
2903 		if (mci->mci_out == NULL)
2904 		{
2905 			syserr("deliver: cannot create mailer output channel, fd=%d",
2906 			       mpvect[1]);
2907 			(void) close(mpvect[1]);
2908 			(void) close(rpvect[0]);
2909 			(void) close(rpvect[1]);
2910 			rcode = EX_OSERR;
2911 			goto give_up;
2912 		}
2913 
2914 		(void) close(rpvect[1]);
2915 		mci->mci_in = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
2916 					 (void *) &(rpvect[0]), SM_IO_RDONLY_B,
2917 					 NULL);
2918 		if (mci->mci_in == NULL)
2919 		{
2920 			syserr("deliver: cannot create mailer input channel, fd=%d",
2921 			       mpvect[1]);
2922 			(void) close(rpvect[0]);
2923 			(void) sm_io_close(mci->mci_out, SM_TIME_DEFAULT);
2924 			mci->mci_out = NULL;
2925 			rcode = EX_OSERR;
2926 			goto give_up;
2927 		}
2928 	}
2929 
2930 	/*
2931 	**  If we are in SMTP opening state, send initial protocol.
2932 	*/
2933 
2934 	if (bitnset(M_7BITS, m->m_flags) &&
2935 	    (!clever || mci->mci_state == MCIS_OPENING))
2936 		mci->mci_flags |= MCIF_7BIT;
2937 	if (clever && mci->mci_state != MCIS_CLOSED)
2938 	{
2939 #if STARTTLS || SASL
2940 		char *srvname;
2941 		extern SOCKADDR CurHostAddr;
2942 #endif /* STARTTLS || SASL */
2943 
2944 #if SASL
2945 # define DONE_AUTH(f)		bitset(MCIF_AUTHACT, f)
2946 #endif
2947 #if STARTTLS
2948 # define DONE_STARTTLS(f)	bitset(MCIF_TLSACT, f)
2949 #endif
2950 #define ONLY_HELO(f)		bitset(MCIF_ONLY_EHLO, f)
2951 #define SET_HELO(f)		f |= MCIF_ONLY_EHLO
2952 #define CLR_HELO(f)		f &= ~MCIF_ONLY_EHLO
2953 
2954 #if STARTTLS || SASL
2955 		/* don't use CurHostName, it is changed in many places */
2956 		if (mci->mci_host != NULL)
2957 		{
2958 			srvname = mci->mci_host;
2959 			RM_TRAIL_DOT(srvname);
2960 		}
2961 		else if (mci->mci_mailer != NULL)
2962 		{
2963 			srvname = mci->mci_mailer->m_name;
2964 			dotpos = -1;
2965 		}
2966 		else
2967 		{
2968 			srvname = "local";
2969 			dotpos = -1;
2970 		}
2971 
2972 		/* don't set {server_name} to NULL or "": see getauth() */
2973 		macdefine(&mci->mci_macro, A_TEMP, macid("{server_name}"),
2974 			  srvname);
2975 
2976 		/* CurHostAddr is set by makeconnection() and mci_get() */
2977 		if (CurHostAddr.sa.sa_family != 0)
2978 		{
2979 			macdefine(&mci->mci_macro, A_TEMP,
2980 				  macid("{server_addr}"),
2981 				  anynet_ntoa(&CurHostAddr));
2982 		}
2983 		else if (mci->mci_mailer != NULL)
2984 		{
2985 			/* mailer name is unique, use it as address */
2986 			macdefine(&mci->mci_macro, A_PERM,
2987 				  macid("{server_addr}"),
2988 				  mci->mci_mailer->m_name);
2989 		}
2990 		else
2991 		{
2992 			/* don't set it to NULL or "": see getauth() */
2993 			macdefine(&mci->mci_macro, A_PERM,
2994 				  macid("{server_addr}"), "0");
2995 		}
2996 
2997 # if DANE
2998 		SM_FREE(dane_vrfy_ctx.dane_vrfy_host);
2999 		SM_FREE(dane_vrfy_ctx.dane_vrfy_sni);
3000 		dane_vrfy_ctx.dane_vrfy_fp[0] = '\0';
3001 		if (ste != NULL && ste->s_tlsa != NULL &&
3002 		    ste->s_tlsa->dane_tlsa_sni != NULL)
3003 			dane_vrfy_ctx.dane_vrfy_sni = sm_strdup(ste->s_tlsa->dane_tlsa_sni);
3004 		dane_vrfy_ctx.dane_vrfy_host = sm_strdup(srvname);
3005 # endif
3006 
3007 		/* undo change of srvname (mci->mci_host) */
3008 		FIX_TRAIL_DOT(srvname);
3009 
3010 reconnect:	/* after switching to an encrypted connection */
3011 # if DANE
3012 		if (DONE_STARTTLS(mci->mci_flags))
3013 		{
3014 			/* use a "reset" function? */
3015 			SM_FREE(dane_vrfy_ctx.dane_vrfy_host);
3016 			SM_FREE(dane_vrfy_ctx.dane_vrfy_sni);
3017 			dane_vrfy_ctx.dane_vrfy_fp[0] = '\0';
3018 			dane_vrfy_ctx.dane_vrfy_res = 0;
3019 		}
3020 # endif
3021 
3022 #endif /* STARTTLS || SASL */
3023 
3024 		/* set the current connection information */
3025 		e->e_mci = mci;
3026 #if SASL
3027 		mci->mci_saslcap = NULL;
3028 #endif
3029 		smtpinit(m, mci, e, ONLY_HELO(mci->mci_flags));
3030 		CLR_HELO(mci->mci_flags);
3031 
3032 		if (IS_DLVR_RETURN(e))
3033 		{
3034 			/*
3035 			**  Check whether other side can deliver e-mail
3036 			**  fast enough
3037 			*/
3038 
3039 			if (!bitset(MCIF_DLVR_BY, mci->mci_flags))
3040 			{
3041 				e->e_status = "5.4.7";
3042 				usrerrenh(e->e_status,
3043 					  "554 Server does not support Deliver By");
3044 				rcode = EX_UNAVAILABLE;
3045 				goto give_up;
3046 			}
3047 			if (e->e_deliver_by > 0 &&
3048 			    e->e_deliver_by - (curtime() - e->e_ctime) <
3049 			    mci->mci_min_by)
3050 			{
3051 				e->e_status = "5.4.7";
3052 				usrerrenh(e->e_status,
3053 					  "554 Message can't be delivered in time; %ld < %ld",
3054 					  e->e_deliver_by - (long) (curtime() -
3055 								e->e_ctime),
3056 					  mci->mci_min_by);
3057 				rcode = EX_UNAVAILABLE;
3058 				goto give_up;
3059 			}
3060 		}
3061 
3062 #if STARTTLS
3063 		/* first TLS then AUTH to provide a security layer */
3064 		if (mci->mci_state != MCIS_CLOSED &&
3065 		    !DONE_STARTTLS(mci->mci_flags))
3066 		{
3067 			int olderrors;
3068 			bool usetls;
3069 			bool saveQuickAbort = QuickAbort;
3070 			bool saveSuprErrs = SuprErrs;
3071 			char *host = NULL;
3072 
3073 			rcode = EX_OK;
3074 			usetls = bitset(MCIF_TLS, mci->mci_flags);
3075 			if (usetls)
3076 				usetls = !iscltflgset(e, D_NOTLS);
3077 			if (usetls)
3078 				usetls = tlsstate == 0;
3079 
3080 			host = macvalue(macid("{server_name}"), e);
3081 			if (usetls)
3082 			{
3083 				olderrors = Errors;
3084 				QuickAbort = false;
3085 				SuprErrs = true;
3086 				if (rscheck("try_tls", host, NULL, e,
3087 					    RSF_RMCOMM, 7, host, NOQID, NULL,
3088 					    NULL) != EX_OK
3089 				    || Errors > olderrors)
3090 				{
3091 					usetls = false;
3092 				}
3093 				SuprErrs = saveSuprErrs;
3094 				QuickAbort = saveQuickAbort;
3095 			}
3096 
3097 			if (usetls)
3098 			{
3099 				if ((rcode = starttls(m, mci, e
3100 # if DANE
3101 							, &dane_vrfy_ctx
3102 # endif
3103 					)) == EX_OK)
3104 				{
3105 					/* start again without STARTTLS */
3106 					mci->mci_flags |= MCIF_TLSACT;
3107 				}
3108 				else
3109 				{
3110 					char *s;
3111 
3112 					/*
3113 					**  TLS negotiation failed, what to do?
3114 					**  fall back to unencrypted connection
3115 					**  or abort? How to decide?
3116 					**  set a macro and call a ruleset.
3117 					*/
3118 
3119 					mci->mci_flags &= ~MCIF_TLS;
3120 					switch (rcode)
3121 					{
3122 					  case EX_TEMPFAIL:
3123 						s = "TEMP";
3124 						break;
3125 					  case EX_USAGE:
3126 						s = "USAGE";
3127 						break;
3128 					  case EX_PROTOCOL:
3129 						s = "PROTOCOL";
3130 						break;
3131 					  case EX_SOFTWARE:
3132 						s = "SOFTWARE";
3133 						break;
3134 					  case EX_UNAVAILABLE:
3135 						s = "NONE";
3136 						break;
3137 
3138 					  /* everything else is a failure */
3139 					  default:
3140 						s = "FAILURE";
3141 						rcode = EX_TEMPFAIL;
3142 					}
3143 					macdefine(&e->e_macro, A_PERM,
3144 						  macid("{verify}"), s);
3145 				}
3146 			}
3147 			else
3148 			{
3149 				p = tlsstate == 0 ? "NONE": "CLEAR";
3150 # if DANE
3151 				/*
3152 				**  TLSA found but STARTTLS not offered?
3153 				**  What is the best way to "fail"?
3154 				**  XXX: check expiration!
3155 				*/
3156 
3157 				if (!bitset(MCIF_TLS, mci->mci_flags) &&
3158 				    ste != NULL &&
3159 				    ste->s_tlsa != NULL &&
3160 				    ste->s_tlsa->dane_tlsa_n > 0)
3161 				{
3162 					if (LogLevel > 8)
3163 						sm_syslog(LOG_NOTICE, NOQID,
3164 							"STARTTLS=client, relay=%.100s, warning=DANE configured in DNS but no STARTTLS available",
3165 							host);
3166 					/* XXX include TLSA RR from DNS? */
3167 
3168 					p = "DANE_FAIL";
3169 				}
3170 # endif /* DANE */
3171 				macdefine(&e->e_macro, A_PERM,
3172 					  macid("{verify}"), p);
3173 			}
3174 			olderrors = Errors;
3175 			QuickAbort = false;
3176 			SuprErrs = true;
3177 
3178 			/*
3179 			**  rcode == EX_SOFTWARE is special:
3180 			**  the TLS negotiation failed
3181 			**  we have to drop the connection no matter what
3182 			**  However, we call tls_server to give it the chance
3183 			**  to log the problem and return an appropriate
3184 			**  error code.
3185 			*/
3186 
3187 			if (rscheck("tls_server",
3188 				    macvalue(macid("{verify}"), e),
3189 				    NULL, e, RSF_RMCOMM|RSF_COUNT, 5,
3190 				    host, NOQID, NULL, NULL) != EX_OK ||
3191 			    Errors > olderrors ||
3192 			    rcode == EX_SOFTWARE)
3193 			{
3194 				char enhsc[ENHSCLEN];
3195 				extern char MsgBuf[];
3196 
3197 				if (ISSMTPCODE(MsgBuf) &&
3198 				    extenhsc(MsgBuf + 4, ' ', enhsc) > 0)
3199 				{
3200 					p = sm_rpool_strdup_x(e->e_rpool,
3201 							      MsgBuf);
3202 				}
3203 				else
3204 				{
3205 					p = "403 4.7.0 server not authenticated.";
3206 					(void) sm_strlcpy(enhsc, "4.7.0",
3207 							  sizeof(enhsc));
3208 				}
3209 				SuprErrs = saveSuprErrs;
3210 				QuickAbort = saveQuickAbort;
3211 
3212 				if (rcode == EX_SOFTWARE)
3213 				{
3214 					/* drop the connection */
3215 					mci->mci_state = MCIS_QUITING;
3216 					if (mci->mci_in != NULL)
3217 					{
3218 						(void) sm_io_close(mci->mci_in,
3219 								   SM_TIME_DEFAULT);
3220 						mci->mci_in = NULL;
3221 					}
3222 					mci->mci_flags &= ~MCIF_TLSACT;
3223 					(void) endmailer(mci, e, pv);
3224 
3225 					if ((TLSFallbacktoClear ||
3226 					     SM_TLSI_IS(&(mci->mci_tlsi),
3227 							TLSI_FL_FB2CLR)) &&
3228 					    !SM_TLSI_IS(&(mci->mci_tlsi),
3229 							TLSI_FL_NOFB2CLR)
3230 # if DANE
3231 					     && dane_vrfy_ctx.dane_vrfy_chk !=
3232 						DANE_SECURE
3233 # endif
3234 					    )
3235 					{
3236 						++tlsstate;
3237 					}
3238 				}
3239 				else
3240 				{
3241 					/* abort transfer */
3242 					smtpquit(m, mci, e);
3243 				}
3244 
3245 				/* avoid bogus error msg */
3246 				mci->mci_errno = 0;
3247 
3248 				/* temp or permanent failure? */
3249 				rcode = (*p == '4') ? EX_TEMPFAIL
3250 						    : EX_UNAVAILABLE;
3251 				mci_setstat(mci, rcode, enhsc, p);
3252 
3253 				/*
3254 				**  hack to get the error message into
3255 				**  the envelope (done in giveresponse())
3256 				*/
3257 
3258 				(void) sm_strlcpy(SmtpError, p,
3259 						  sizeof(SmtpError));
3260 			}
3261 			else if (mci->mci_state == MCIS_CLOSED)
3262 			{
3263 				/* connection close caused by 421 */
3264 				mci->mci_errno = 0;
3265 				rcode = EX_TEMPFAIL;
3266 				mci_setstat(mci, rcode, NULL, "421");
3267 			}
3268 			else
3269 				rcode = 0;
3270 
3271 			QuickAbort = saveQuickAbort;
3272 			SuprErrs = saveSuprErrs;
3273 			if (DONE_STARTTLS(mci->mci_flags) &&
3274 			    mci->mci_state != MCIS_CLOSED)
3275 			{
3276 				SET_HELO(mci->mci_flags);
3277 				mci_clr_extensions(mci);
3278 				goto reconnect;
3279 			}
3280 			if (tlsstate == 1)
3281 			{
3282 				if (tTd(11, 1))
3283 				{
3284 					sm_syslog(LOG_DEBUG, NOQID,
3285 						"STARTTLS=client, relay=%.100s, tlsstate=%d, status=trying_again",
3286 						mci->mci_host, tlsstate);
3287 					mci_dump(NULL, mci, true);
3288 				}
3289 				++tlsstate;
3290 
3291 				/*
3292 				**  Fake the status so a new connection is
3293 				**  tried, otherwise the TLS error will
3294 				**  "persist" during this delivery attempt.
3295 				*/
3296 
3297 				mci->mci_errno = 0;
3298 				rcode = EX_OK;
3299 				mci_setstat(mci, rcode, NULL, NULL);
3300 				goto one_last_try;
3301 }
3302 		}
3303 #endif /* STARTTLS */
3304 #if SASL
3305 		/* if other server supports authentication let's authenticate */
3306 		if (mci->mci_state != MCIS_CLOSED &&
3307 		    mci->mci_saslcap != NULL &&
3308 		    !DONE_AUTH(mci->mci_flags) && !iscltflgset(e, D_NOAUTH))
3309 		{
3310 			/* Should we require some minimum authentication? */
3311 			if ((ret = smtpauth(m, mci, e)) == EX_OK)
3312 			{
3313 				int result;
3314 				sasl_ssf_t *ssf = NULL;
3315 
3316 				/* Get security strength (features) */
3317 				result = sasl_getprop(mci->mci_conn, SASL_SSF,
3318 # if SASL >= 20000
3319 						      (const void **) &ssf);
3320 # else
3321 						      (void **) &ssf);
3322 # endif
3323 
3324 				/* XXX authid? */
3325 				if (LogLevel > 9)
3326 					sm_syslog(LOG_INFO, NOQID,
3327 						  "AUTH=client, relay=%.100s, mech=%.16s, bits=%d",
3328 						  mci->mci_host,
3329 						  macvalue(macid("{auth_type}"), e),
3330 						  result == SASL_OK ? *ssf : 0);
3331 
3332 				/*
3333 				**  Only switch to encrypted connection
3334 				**  if a security layer has been negotiated
3335 				*/
3336 
3337 				if (result == SASL_OK && *ssf > 0)
3338 				{
3339 					int tmo;
3340 
3341 					/*
3342 					**  Convert I/O layer to use SASL.
3343 					**  If the call fails, the connection
3344 					**  is aborted.
3345 					*/
3346 
3347 					tmo = DATA_PROGRESS_TIMEOUT * 1000;
3348 					if (sfdcsasl(&mci->mci_in,
3349 						     &mci->mci_out,
3350 						     mci->mci_conn, tmo) == 0)
3351 					{
3352 						mci_clr_extensions(mci);
3353 						mci->mci_flags |= MCIF_AUTHACT|
3354 								  MCIF_ONLY_EHLO;
3355 						goto reconnect;
3356 					}
3357 					syserr("AUTH TLS switch failed in client");
3358 				}
3359 				/* else? XXX */
3360 				mci->mci_flags |= MCIF_AUTHACT;
3361 
3362 			}
3363 			else if (ret == EX_TEMPFAIL)
3364 			{
3365 				if (LogLevel > 8)
3366 					sm_syslog(LOG_ERR, NOQID,
3367 						  "AUTH=client, relay=%.100s, temporary failure, connection abort",
3368 						  mci->mci_host);
3369 				smtpquit(m, mci, e);
3370 
3371 				/* avoid bogus error msg */
3372 				mci->mci_errno = 0;
3373 				rcode = EX_TEMPFAIL;
3374 				mci_setstat(mci, rcode, "4.3.0", p);
3375 
3376 				/*
3377 				**  hack to get the error message into
3378 				**  the envelope (done in giveresponse())
3379 				*/
3380 
3381 				(void) sm_strlcpy(SmtpError,
3382 						  "Temporary AUTH failure",
3383 						  sizeof(SmtpError));
3384 			}
3385 		}
3386 #endif /* SASL */
3387 	}
3388 
3389 do_transfer:
3390 	/* clear out per-message flags from connection structure */
3391 	mci->mci_flags &= ~(MCIF_CVT7TO8|MCIF_CVT8TO7);
3392 
3393 	if (bitset(EF_HAS8BIT, e->e_flags) &&
3394 	    !bitset(EF_DONT_MIME, e->e_flags) &&
3395 	    bitnset(M_7BITS, m->m_flags))
3396 		mci->mci_flags |= MCIF_CVT8TO7;
3397 
3398 #if MIME7TO8
3399 	if (bitnset(M_MAKE8BIT, m->m_flags) &&
3400 	    !bitset(MCIF_7BIT, mci->mci_flags) &&
3401 	    (p = hvalue("Content-Transfer-Encoding", e->e_header)) != NULL &&
3402 	     (sm_strcasecmp(p, "quoted-printable") == 0 ||
3403 	      sm_strcasecmp(p, "base64") == 0) &&
3404 	    (p = hvalue("Content-Type", e->e_header)) != NULL)
3405 	{
3406 		/* may want to convert 7 -> 8 */
3407 		/* XXX should really parse it here -- and use a class XXX */
3408 		if (sm_strncasecmp(p, "text/plain", 10) == 0 &&
3409 		    (p[10] == '\0' || p[10] == ' ' || p[10] == ';'))
3410 			mci->mci_flags |= MCIF_CVT7TO8;
3411 	}
3412 #endif /* MIME7TO8 */
3413 
3414 	if (tTd(11, 1))
3415 	{
3416 		sm_dprintf("openmailer: ");
3417 		mci_dump(sm_debug_file(), mci, false);
3418 	}
3419 
3420 #if _FFR_CLIENT_SIZE
3421 	/*
3422 	**  See if we know the maximum size and
3423 	**  abort if the message is too big.
3424 	**
3425 	**  NOTE: _FFR_CLIENT_SIZE is untested.
3426 	*/
3427 
3428 	if (bitset(MCIF_SIZE, mci->mci_flags) &&
3429 	    mci->mci_maxsize > 0 &&
3430 	    e->e_msgsize > mci->mci_maxsize)
3431 	{
3432 		e->e_flags |= EF_NO_BODY_RETN;
3433 		if (bitnset(M_LOCALMAILER, m->m_flags))
3434 			e->e_status = "5.2.3";
3435 		else
3436 			e->e_status = "5.3.4";
3437 
3438 		usrerrenh(e->e_status,
3439 			  "552 Message is too large; %ld bytes max",
3440 			  mci->mci_maxsize);
3441 		rcode = EX_DATAERR;
3442 
3443 		/* Need an e_message for error */
3444 		(void) sm_snprintf(SmtpError, sizeof(SmtpError),
3445 				   "Message is too large; %ld bytes max",
3446 				   mci->mci_maxsize);
3447 		goto give_up;
3448 	}
3449 #endif /* _FFR_CLIENT_SIZE */
3450 
3451 	if (mci->mci_state != MCIS_OPEN)
3452 	{
3453 		/* couldn't open the mailer */
3454 		rcode = mci->mci_exitstat;
3455 		errno = mci->mci_errno;
3456 		SM_SET_H_ERRNO(mci->mci_herrno);
3457 		if (rcode == EX_OK)
3458 		{
3459 			/* shouldn't happen */
3460 			syserr("554 5.3.5 deliver: mci=%lx rcode=%d errno=%d state=%d sig=%s",
3461 			       (unsigned long) mci, rcode, errno,
3462 			       mci->mci_state, firstsig);
3463 			mci_dump_all(smioout, true);
3464 			rcode = EX_SOFTWARE;
3465 		}
3466 		else if (nummxhosts > hostnum)
3467 		{
3468 			/* try next MX site */
3469 			goto tryhost;
3470 		}
3471 	}
3472 	else if (!clever)
3473 	{
3474 		bool ok;
3475 
3476 		/*
3477 		**  Format and send message.
3478 		*/
3479 
3480 		rcode = EX_OK;
3481 		errno = 0;
3482 		ok = putfromline(mci, e);
3483 		if (ok)
3484 			ok = (*e->e_puthdr)(mci, e->e_header, e, M87F_OUTER);
3485 		if (ok)
3486 			ok = (*e->e_putbody)(mci, e, NULL);
3487 		if (ok && bitset(MCIF_INLONGLINE, mci->mci_flags))
3488 			ok = putline("", mci);
3489 
3490 		/*
3491 		**  Ignore an I/O error that was caused by EPIPE.
3492 		**  Some broken mailers don't read the entire body
3493 		**  but just exit() thus causing an I/O error.
3494 		*/
3495 
3496 		if (!ok && (sm_io_error(mci->mci_out) && errno == EPIPE))
3497 			ok = true;
3498 
3499 		/* (always) get the exit status */
3500 		rcode = endmailer(mci, e, pv);
3501 		if (!ok)
3502 			rcode = EX_TEMPFAIL;
3503 		if (rcode == EX_TEMPFAIL && SmtpError[0] == '\0')
3504 		{
3505 			/*
3506 			**  Need an e_message for mailq display.
3507 			**  We set SmtpError as
3508 			*/
3509 
3510 			(void) sm_snprintf(SmtpError, sizeof(SmtpError),
3511 					   "%s mailer (%s) exited with EX_TEMPFAIL",
3512 					   m->m_name, m->m_mailer);
3513 		}
3514 	}
3515 	else
3516 	{
3517 		/*
3518 		**  Send the MAIL FROM: protocol
3519 		*/
3520 
3521 		/* XXX this isn't pipelined... */
3522 		rcode = smtpmailfrom(m, mci, e);
3523 		if (rcode == EX_OK)
3524 		{
3525 			register int i;
3526 #if PIPELINING
3527 			ADDRESS *volatile pchain;
3528 #endif
3529 
3530 			/* send the recipient list */
3531 			tobuf[0] = '\0';
3532 			mci->mci_retryrcpt = false;
3533 			mci->mci_tolist = tobuf;
3534 #if PIPELINING
3535 			pchain = NULL;
3536 			mci->mci_nextaddr = NULL;
3537 #endif
3538 
3539 			for (to = tochain; to != NULL; to = to->q_tchain)
3540 			{
3541 				if (!QS_IS_UNMARKED(to->q_state))
3542 					continue;
3543 
3544 				/* mark recipient state as "ok so far" */
3545 				to->q_state = QS_OK;
3546 				e->e_to = to->q_paddr;
3547 #if STARTTLS
3548 				i = rscheck("tls_rcpt", to->q_user, NULL, e,
3549 					    RSF_RMCOMM|RSF_COUNT, 3,
3550 					    mci->mci_host, e->e_id, NULL, NULL);
3551 				if (i != EX_OK)
3552 				{
3553 					markfailure(e, to, mci, i, false);
3554 					giveresponse(i, to->q_status,  m, mci,
3555 						     ctladdr, xstart, e, to);
3556 					if (i == EX_TEMPFAIL)
3557 					{
3558 						mci->mci_retryrcpt = true;
3559 						to->q_state = QS_RETRY;
3560 					}
3561 					continue;
3562 				}
3563 #endif /* STARTTLS */
3564 
3565 				i = smtprcpt(to, m, mci, e, ctladdr, xstart);
3566 #if PIPELINING
3567 				if (i == EX_OK &&
3568 				    bitset(MCIF_PIPELINED, mci->mci_flags))
3569 				{
3570 					/*
3571 					**  Add new element to list of
3572 					**  recipients for pipelining.
3573 					*/
3574 
3575 					to->q_pchain = NULL;
3576 					if (mci->mci_nextaddr == NULL)
3577 						mci->mci_nextaddr = to;
3578 					if (pchain == NULL)
3579 						pchain = to;
3580 					else
3581 					{
3582 						pchain->q_pchain = to;
3583 						pchain = pchain->q_pchain;
3584 					}
3585 				}
3586 #endif /* PIPELINING */
3587 				if (i != EX_OK)
3588 				{
3589 					markfailure(e, to, mci, i, false);
3590 					giveresponse(i, to->q_status, m, mci,
3591 						     ctladdr, xstart, e, to);
3592 					if (i == EX_TEMPFAIL)
3593 						to->q_state = QS_RETRY;
3594 				}
3595 			}
3596 
3597 			/* No recipients in list and no missing responses? */
3598 			if (tobuf[0] == '\0'
3599 #if PIPELINING
3600 			    && bitset(MCIF_PIPELINED, mci->mci_flags)
3601 			    && mci->mci_nextaddr == NULL
3602 #endif
3603 			   )
3604 			{
3605 				rcode = EX_OK;
3606 				e->e_to = NULL;
3607 				if (bitset(MCIF_CACHED, mci->mci_flags))
3608 					smtprset(m, mci, e);
3609 			}
3610 			else
3611 			{
3612 				e->e_to = tobuf + 1;
3613 				rcode = smtpdata(m, mci, e, ctladdr, xstart);
3614 			}
3615 		}
3616 		if (rcode == EX_TEMPFAIL && nummxhosts > hostnum)
3617 		{
3618 			/* try next MX site */
3619 			goto tryhost;
3620 		}
3621 	}
3622 #if NAMED_BIND
3623 	if (ConfigLevel < 2)
3624 		_res.options |= RES_DEFNAMES | RES_DNSRCH;	/* XXX */
3625 #endif
3626 
3627 	if (tTd(62, 1))
3628 		checkfds("after delivery");
3629 
3630 	/*
3631 	**  Do final status disposal.
3632 	**	We check for something in tobuf for the SMTP case.
3633 	**	If we got a temporary failure, arrange to queue the
3634 	**		addressees.
3635 	*/
3636 
3637   give_up:
3638 	if (bitnset(M_LMTP, m->m_flags))
3639 	{
3640 		lmtp_rcode = rcode;
3641 		tobuf[0] = '\0';
3642 		anyok = false;
3643 		strsize = 0;
3644 	}
3645 	else
3646 		anyok = rcode == EX_OK;
3647 
3648 	for (to = tochain; to != NULL; to = to->q_tchain)
3649 	{
3650 		/* see if address already marked */
3651 		if (!QS_IS_OK(to->q_state))
3652 			continue;
3653 
3654 		/* if running LMTP, get the status for each address */
3655 		if (bitnset(M_LMTP, m->m_flags))
3656 		{
3657 			if (lmtp_rcode == EX_OK)
3658 				rcode = smtpgetstat(m, mci, e);
3659 			if (rcode == EX_OK)
3660 			{
3661 				strsize += sm_strlcat2(tobuf + strsize, ",",
3662 						to->q_paddr,
3663 						tobufsize - strsize);
3664 				SM_ASSERT(strsize < tobufsize);
3665 				anyok = true;
3666 			}
3667 			else
3668 			{
3669 				e->e_to = to->q_paddr;
3670 				markfailure(e, to, mci, rcode, true);
3671 				giveresponse(rcode, to->q_status, m, mci,
3672 					     ctladdr, xstart, e, to);
3673 				e->e_to = tobuf + 1;
3674 				continue;
3675 			}
3676 		}
3677 		else
3678 		{
3679 			/* mark bad addresses */
3680 			if (rcode != EX_OK)
3681 			{
3682 				if (goodmxfound && rcode == EX_NOHOST)
3683 					rcode = EX_TEMPFAIL;
3684 				markfailure(e, to, mci, rcode, true);
3685 				continue;
3686 			}
3687 		}
3688 
3689 		/* successful delivery */
3690 		to->q_state = QS_SENT;
3691 		to->q_statdate = curtime();
3692 		e->e_nsent++;
3693 
3694 		/*
3695 		**  Checkpoint the send list every few addresses
3696 		*/
3697 
3698 		if (CheckpointInterval > 0 && e->e_nsent >= CheckpointInterval)
3699 		{
3700 			queueup(e, false, false);
3701 			e->e_nsent = 0;
3702 		}
3703 
3704 		if (bitnset(M_LOCALMAILER, m->m_flags) &&
3705 		    bitset(QPINGONSUCCESS, to->q_flags))
3706 		{
3707 			to->q_flags |= QDELIVERED;
3708 			to->q_status = "2.1.5";
3709 			(void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT,
3710 					     "%s... Successfully delivered\n",
3711 					     to->q_paddr);
3712 		}
3713 		else if (bitset(QPINGONSUCCESS, to->q_flags) &&
3714 			 bitset(QPRIMARY, to->q_flags) &&
3715 			 !bitset(MCIF_DSN, mci->mci_flags))
3716 		{
3717 			to->q_flags |= QRELAYED;
3718 			(void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT,
3719 					     "%s... relayed; expect no further notifications\n",
3720 					     to->q_paddr);
3721 		}
3722 		else if (IS_DLVR_NOTIFY(e) &&
3723 			 !bitset(MCIF_DLVR_BY, mci->mci_flags) &&
3724 			 bitset(QPRIMARY, to->q_flags) &&
3725 			 (!bitset(QHASNOTIFY, to->q_flags) ||
3726 			  bitset(QPINGONSUCCESS, to->q_flags) ||
3727 			  bitset(QPINGONFAILURE, to->q_flags) ||
3728 			  bitset(QPINGONDELAY, to->q_flags)))
3729 		{
3730 			/* RFC 2852, 4.1.4.2: no NOTIFY, or not NEVER */
3731 			to->q_flags |= QBYNRELAY;
3732 			(void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT,
3733 					     "%s... Deliver-by notify: relayed\n",
3734 					     to->q_paddr);
3735 		}
3736 		else if (IS_DLVR_TRACE(e) &&
3737 			 (!bitset(QHASNOTIFY, to->q_flags) ||
3738 			  bitset(QPINGONSUCCESS, to->q_flags) ||
3739 			  bitset(QPINGONFAILURE, to->q_flags) ||
3740 			  bitset(QPINGONDELAY, to->q_flags)) &&
3741 			 bitset(QPRIMARY, to->q_flags))
3742 		{
3743 			/* RFC 2852, 4.1.4: no NOTIFY, or not NEVER */
3744 			to->q_flags |= QBYTRACE;
3745 			(void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT,
3746 					     "%s... Deliver-By trace: relayed\n",
3747 					     to->q_paddr);
3748 		}
3749 	}
3750 
3751 	if (bitnset(M_LMTP, m->m_flags))
3752 	{
3753 		/*
3754 		**  Global information applies to the last recipient only;
3755 		**  clear it out to avoid bogus errors.
3756 		*/
3757 
3758 		rcode = EX_OK;
3759 		e->e_statmsg = NULL;
3760 
3761 		/* reset the mci state for the next transaction */
3762 		if (mci != NULL &&
3763 		    (mci->mci_state == MCIS_MAIL ||
3764 		     mci->mci_state == MCIS_RCPT ||
3765 		     mci->mci_state == MCIS_DATA))
3766 		{
3767 			mci->mci_state = MCIS_OPEN;
3768 			SmtpPhase = mci->mci_phase = "idle";
3769 			sm_setproctitle(true, e, "%s: %s", CurHostName,
3770 					mci->mci_phase);
3771 		}
3772 	}
3773 
3774 	if (tobuf[0] != '\0')
3775 	{
3776 		giveresponse(rcode, NULL, m, mci, ctladdr, xstart, e, NULL);
3777 #if 0
3778 		/*
3779 		**  This code is disabled for now because I am not
3780 		**  sure that copying status from the first recipient
3781 		**  to all non-status'ed recipients is a good idea.
3782 		*/
3783 
3784 		if (tochain->q_message != NULL &&
3785 		    !bitnset(M_LMTP, m->m_flags) && rcode != EX_OK)
3786 		{
3787 			for (to = tochain->q_tchain; to != NULL;
3788 			     to = to->q_tchain)
3789 			{
3790 				/* see if address already marked */
3791 				if (QS_IS_QUEUEUP(to->q_state) &&
3792 				    to->q_message == NULL)
3793 					to->q_message = sm_rpool_strdup_x(e->e_rpool,
3794 							tochain->q_message);
3795 			}
3796 		}
3797 #endif /* 0 */
3798 	}
3799 	if (anyok)
3800 		markstats(e, tochain, STATS_NORMAL);
3801 	mci_store_persistent(mci);
3802 
3803 #if _FFR_OCC
3804 	/*
3805 	**  HACK: this is NOT the right place to "close" a connection!
3806 	**  use smtpquit?
3807 	**  add a flag to mci to indicate that rate/conc. was increased?
3808 	*/
3809 
3810 	if (clever)
3811 	{
3812 		extern SOCKADDR CurHostAddr;
3813 
3814 		/* check family... {} */
3815 		/* r = anynet_pton(AF_INET, p, dst); */
3816 		occ_close(e, mci, host, &CurHostAddr);
3817 	}
3818 #endif /* _FFR_OCC */
3819 
3820 	/* Some recipients were tempfailed, try them on the next host */
3821 	if (mci != NULL && mci->mci_retryrcpt && nummxhosts > hostnum)
3822 	{
3823 		/* try next MX site */
3824 		goto tryhost;
3825 	}
3826 
3827 	/* now close the connection */
3828 	if (clever && mci != NULL && mci->mci_state != MCIS_CLOSED &&
3829 	    !bitset(MCIF_CACHED, mci->mci_flags))
3830 		smtpquit(m, mci, e);
3831 
3832 cleanup: ;
3833 	}
3834 	SM_FINALLY
3835 	{
3836 		/*
3837 		**  Restore state and return.
3838 		*/
3839 #if XDEBUG
3840 		char wbuf[MAXLINE];
3841 
3842 		/* make absolutely certain 0, 1, and 2 are in use */
3843 		(void) sm_snprintf(wbuf, sizeof(wbuf),
3844 				   "%s... end of deliver(%s)",
3845 				   e->e_to == NULL ? "NO-TO-LIST"
3846 						   : shortenstring(e->e_to,
3847 								   MAXSHORTSTR),
3848 				  m->m_name);
3849 		checkfd012(wbuf);
3850 #endif /* XDEBUG */
3851 
3852 		errno = 0;
3853 
3854 		/*
3855 		**  It was originally necessary to set macro 'g' to NULL
3856 		**  because it previously pointed to an auto buffer.
3857 		**  We don't do this any more, so this may be unnecessary.
3858 		*/
3859 
3860 		macdefine(&e->e_macro, A_PERM, 'g', (char *) NULL);
3861 		e->e_to = NULL;
3862 	}
3863 	SM_END_TRY
3864 	return rcode;
3865 }
3866 
3867 /*
3868 **  MARKFAILURE -- mark a failure on a specific address.
3869 **
3870 **	Parameters:
3871 **		e -- the envelope we are sending.
3872 **		q -- the address to mark.
3873 **		mci -- mailer connection information.
3874 **		rcode -- the code signifying the particular failure.
3875 **		ovr -- override an existing code?
3876 **
3877 **	Returns:
3878 **		none.
3879 **
3880 **	Side Effects:
3881 **		marks the address (and possibly the envelope) with the
3882 **			failure so that an error will be returned or
3883 **			the message will be queued, as appropriate.
3884 */
3885 
3886 void
3887 markfailure(e, q, mci, rcode, ovr)
3888 	register ENVELOPE *e;
3889 	register ADDRESS *q;
3890 	register MCI *mci;
3891 	int rcode;
3892 	bool ovr;
3893 {
3894 	int save_errno = errno;
3895 	char *status = NULL;
3896 	char *rstatus = NULL;
3897 
3898 	switch (rcode)
3899 	{
3900 	  case EX_OK:
3901 		break;
3902 
3903 	  case EX_TEMPFAIL:
3904 	  case EX_IOERR:
3905 	  case EX_OSERR:
3906 		q->q_state = QS_QUEUEUP;
3907 		break;
3908 
3909 	  default:
3910 		q->q_state = QS_BADADDR;
3911 		break;
3912 	}
3913 
3914 	/* find most specific error code possible */
3915 	if (mci != NULL && mci->mci_status != NULL)
3916 	{
3917 		status = sm_rpool_strdup_x(e->e_rpool, mci->mci_status);
3918 		if (mci->mci_rstatus != NULL)
3919 			rstatus = sm_rpool_strdup_x(e->e_rpool,
3920 						    mci->mci_rstatus);
3921 	}
3922 	else if (e->e_status != NULL)
3923 	{
3924 		status = e->e_status;
3925 	}
3926 	else
3927 	{
3928 		switch (rcode)
3929 		{
3930 		  case EX_USAGE:
3931 			status = "5.5.4";
3932 			break;
3933 
3934 		  case EX_DATAERR:
3935 			status = "5.5.2";
3936 			break;
3937 
3938 		  case EX_NOUSER:
3939 			status = "5.1.1";
3940 			break;
3941 
3942 		  case EX_NOHOST:
3943 			status = "5.1.2";
3944 			break;
3945 
3946 		  case EX_NOINPUT:
3947 		  case EX_CANTCREAT:
3948 		  case EX_NOPERM:
3949 			status = "5.3.0";
3950 			break;
3951 
3952 		  case EX_UNAVAILABLE:
3953 		  case EX_SOFTWARE:
3954 		  case EX_OSFILE:
3955 		  case EX_PROTOCOL:
3956 		  case EX_CONFIG:
3957 			status = "5.5.0";
3958 			break;
3959 
3960 		  case EX_OSERR:
3961 		  case EX_IOERR:
3962 			status = "4.5.0";
3963 			break;
3964 
3965 		  case EX_TEMPFAIL:
3966 			status = "4.2.0";
3967 			break;
3968 		}
3969 	}
3970 
3971 	/* new status? */
3972 	if (status != NULL && *status != '\0' && (ovr || q->q_status == NULL ||
3973 	    *q->q_status == '\0' || *q->q_status < *status))
3974 	{
3975 		q->q_status = status;
3976 		q->q_rstatus = rstatus;
3977 	}
3978 	if (rcode != EX_OK && q->q_rstatus == NULL &&
3979 	    q->q_mailer != NULL && q->q_mailer->m_diagtype != NULL &&
3980 	    sm_strcasecmp(q->q_mailer->m_diagtype, "X-UNIX") == 0)
3981 	{
3982 		char buf[16];
3983 
3984 		(void) sm_snprintf(buf, sizeof(buf), "%d", rcode);
3985 		q->q_rstatus = sm_rpool_strdup_x(e->e_rpool, buf);
3986 	}
3987 
3988 	q->q_statdate = curtime();
3989 	if (CurHostName != NULL && CurHostName[0] != '\0' &&
3990 	    mci != NULL && !bitset(M_LOCALMAILER, mci->mci_flags))
3991 		q->q_statmta = sm_rpool_strdup_x(e->e_rpool, CurHostName);
3992 
3993 	/* restore errno */
3994 	errno = save_errno;
3995 }
3996 /*
3997 **  ENDMAILER -- Wait for mailer to terminate.
3998 **
3999 **	We should never get fatal errors (e.g., segmentation
4000 **	violation), so we report those specially.  For other
4001 **	errors, we choose a status message (into statmsg),
4002 **	and if it represents an error, we print it.
4003 **
4004 **	Parameters:
4005 **		mci -- the mailer connection info.
4006 **		e -- the current envelope.
4007 **		pv -- the parameter vector that invoked the mailer
4008 **			(for error messages).
4009 **
4010 **	Returns:
4011 **		exit code of mailer.
4012 **
4013 **	Side Effects:
4014 **		none.
4015 */
4016 
4017 static jmp_buf	EndWaitTimeout;
4018 
4019 static void
4020 endwaittimeout(ignore)
4021 	int ignore;
4022 {
4023 	/*
4024 	**  NOTE: THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
4025 	**	ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
4026 	**	DOING.
4027 	*/
4028 
4029 	errno = ETIMEDOUT;
4030 	longjmp(EndWaitTimeout, 1);
4031 }
4032 
4033 int
4034 endmailer(mci, e, pv)
4035 	register MCI *mci;
4036 	register ENVELOPE *e;
4037 	char **pv;
4038 {
4039 	int st;
4040 	int save_errno = errno;
4041 	char buf[MAXLINE];
4042 	SM_EVENT *ev = NULL;
4043 
4044 
4045 	mci_unlock_host(mci);
4046 
4047 	/* close output to mailer */
4048 	if (mci->mci_out != NULL)
4049 	{
4050 		(void) sm_io_close(mci->mci_out, SM_TIME_DEFAULT);
4051 		mci->mci_out = NULL;
4052 	}
4053 
4054 	/* copy any remaining input to transcript */
4055 	if (mci->mci_in != NULL && mci->mci_state != MCIS_ERROR &&
4056 	    e->e_xfp != NULL)
4057 	{
4058 		while (sfgets(buf, sizeof(buf), mci->mci_in,
4059 			      TimeOuts.to_quit, "Draining Input") != NULL)
4060 			(void) sm_io_fputs(e->e_xfp, SM_TIME_DEFAULT, buf);
4061 	}
4062 
4063 #if SASL
4064 	/* close SASL connection */
4065 	if (bitset(MCIF_AUTHACT, mci->mci_flags))
4066 	{
4067 		sasl_dispose(&mci->mci_conn);
4068 		mci->mci_flags &= ~MCIF_AUTHACT;
4069 	}
4070 #endif /* SASL */
4071 
4072 #if STARTTLS
4073 	/* shutdown TLS */
4074 	(void) endtlsclt(mci);
4075 #endif
4076 
4077 	/* now close the input */
4078 	if (mci->mci_in != NULL)
4079 	{
4080 		(void) sm_io_close(mci->mci_in, SM_TIME_DEFAULT);
4081 		mci->mci_in = NULL;
4082 	}
4083 	mci->mci_state = MCIS_CLOSED;
4084 
4085 	errno = save_errno;
4086 
4087 	/* in the IPC case there is nothing to wait for */
4088 	if (mci->mci_pid == 0)
4089 		return EX_OK;
4090 
4091 	/* put a timeout around the wait */
4092 	if (mci->mci_mailer->m_wait > 0)
4093 	{
4094 		if (setjmp(EndWaitTimeout) == 0)
4095 			ev = sm_setevent(mci->mci_mailer->m_wait,
4096 					 endwaittimeout, 0);
4097 		else
4098 		{
4099 			syserr("endmailer %s: wait timeout (%ld)",
4100 			       mci->mci_mailer->m_name,
4101 			       (long) mci->mci_mailer->m_wait);
4102 			return EX_TEMPFAIL;
4103 		}
4104 	}
4105 
4106 	/* wait for the mailer process, collect status */
4107 	st = waitfor(mci->mci_pid);
4108 	save_errno = errno;
4109 	if (ev != NULL)
4110 		sm_clrevent(ev);
4111 	errno = save_errno;
4112 
4113 	if (st == -1)
4114 	{
4115 		syserr("endmailer %s: wait", mci->mci_mailer->m_name);
4116 		return EX_SOFTWARE;
4117 	}
4118 
4119 	if (WIFEXITED(st))
4120 	{
4121 		/* normal death -- return status */
4122 		return (WEXITSTATUS(st));
4123 	}
4124 
4125 	/* it died a horrid death */
4126 	syserr("451 4.3.0 mailer %s died with signal %d%s",
4127 		mci->mci_mailer->m_name, WTERMSIG(st),
4128 		WCOREDUMP(st) ? " (core dumped)" :
4129 		(WIFSTOPPED(st) ? " (stopped)" : ""));
4130 
4131 	/* log the arguments */
4132 	if (pv != NULL && e->e_xfp != NULL)
4133 	{
4134 		register char **av;
4135 
4136 		(void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT, "Arguments:");
4137 		for (av = pv; *av != NULL; av++)
4138 			(void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT, " %s",
4139 					     *av);
4140 		(void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT, "\n");
4141 	}
4142 
4143 	ExitStat = EX_TEMPFAIL;
4144 	return EX_TEMPFAIL;
4145 }
4146 /*
4147 **  GIVERESPONSE -- Interpret an error response from a mailer
4148 **
4149 **	Parameters:
4150 **		status -- the status code from the mailer (high byte
4151 **			only; core dumps must have been taken care of
4152 **			already).
4153 **		dsn -- the DSN associated with the address, if any.
4154 **		m -- the mailer info for this mailer.
4155 **		mci -- the mailer connection info -- can be NULL if the
4156 **			response is given before the connection is made.
4157 **		ctladdr -- the controlling address for the recipient
4158 **			address(es).
4159 **		xstart -- the transaction start time, for computing
4160 **			transaction delays.
4161 **		e -- the current envelope.
4162 **		to -- the current recipient (NULL if none).
4163 **
4164 **	Returns:
4165 **		none.
4166 **
4167 **	Side Effects:
4168 **		Errors may be incremented.
4169 **		ExitStat may be set.
4170 */
4171 
4172 void
4173 giveresponse(status, dsn, m, mci, ctladdr, xstart, e, to)
4174 	int status;
4175 	char *dsn;
4176 	register MAILER *m;
4177 	register MCI *mci;
4178 	ADDRESS *ctladdr;
4179 	time_t xstart;
4180 	ENVELOPE *e;
4181 	ADDRESS *to;
4182 {
4183 	register const char *statmsg;
4184 	int errnum = errno;
4185 	int off = 4;
4186 	bool usestat = false;
4187 	char dsnbuf[ENHSCLEN];
4188 	char buf[MAXLINE];
4189 	char *exmsg;
4190 
4191 	if (e == NULL)
4192 	{
4193 		syserr("giveresponse: null envelope");
4194 		/* NOTREACHED */
4195 		SM_ASSERT(0);
4196 	}
4197 
4198 	/*
4199 	**  Compute status message from code.
4200 	*/
4201 
4202 	exmsg = sm_sysexmsg(status);
4203 	if (status == 0)
4204 	{
4205 		statmsg = "250 2.0.0 Sent";
4206 		if (e->e_statmsg != NULL)
4207 		{
4208 			(void) sm_snprintf(buf, sizeof(buf), "%s (%s)",
4209 					   statmsg,
4210 					   shortenstring(e->e_statmsg, 403));
4211 			statmsg = buf;
4212 		}
4213 	}
4214 	else if (exmsg == NULL)
4215 	{
4216 		(void) sm_snprintf(buf, sizeof(buf),
4217 				   "554 5.3.0 unknown mailer error %d",
4218 				   status);
4219 		status = EX_UNAVAILABLE;
4220 		statmsg = buf;
4221 		usestat = true;
4222 	}
4223 	else if (status == EX_TEMPFAIL)
4224 	{
4225 		char *bp = buf;
4226 
4227 		(void) sm_strlcpy(bp, exmsg + 1, SPACELEFT(buf, bp));
4228 		bp += strlen(bp);
4229 #if NAMED_BIND
4230 		if (h_errno == TRY_AGAIN)
4231 			statmsg = sm_errstring(h_errno + E_DNSBASE);
4232 		else
4233 #endif /* NAMED_BIND */
4234 		{
4235 			if (errnum != 0)
4236 				statmsg = sm_errstring(errnum);
4237 			else
4238 				statmsg = SmtpError;
4239 		}
4240 		if (statmsg != NULL && statmsg[0] != '\0')
4241 		{
4242 			switch (errnum)
4243 			{
4244 #ifdef ENETDOWN
4245 			  case ENETDOWN:	/* Network is down */
4246 #endif
4247 #ifdef ENETUNREACH
4248 			  case ENETUNREACH:	/* Network is unreachable */
4249 #endif
4250 #ifdef ENETRESET
4251 			  case ENETRESET:	/* Network dropped connection on reset */
4252 #endif
4253 #ifdef ECONNABORTED
4254 			  case ECONNABORTED:	/* Software caused connection abort */
4255 #endif
4256 #ifdef EHOSTDOWN
4257 			  case EHOSTDOWN:	/* Host is down */
4258 #endif
4259 #ifdef EHOSTUNREACH
4260 			  case EHOSTUNREACH:	/* No route to host */
4261 #endif
4262 				if (mci != NULL && mci->mci_host != NULL)
4263 				{
4264 					(void) sm_strlcpyn(bp,
4265 							   SPACELEFT(buf, bp),
4266 							   2, ": ",
4267 							   mci->mci_host);
4268 					bp += strlen(bp);
4269 				}
4270 				break;
4271 			}
4272 			(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, ": ",
4273 					   statmsg);
4274 #if DANE
4275 			if (errnum == 0 && SmtpError[0] != '\0' &&
4276 			    h_errno == TRY_AGAIN &&
4277 			    mci->mci_exitstat == EX_TEMPFAIL)
4278 			{
4279 				(void) sm_strlcat(bp, SmtpError,
4280 					SPACELEFT(buf, bp));
4281 				bp += strlen(bp);
4282 			}
4283 #endif /* DANE */
4284 			usestat = true;
4285 		}
4286 		statmsg = buf;
4287 	}
4288 #if NAMED_BIND
4289 	else if (status == EX_NOHOST && h_errno != 0)
4290 	{
4291 		statmsg = sm_errstring(h_errno + E_DNSBASE);
4292 		(void) sm_snprintf(buf, sizeof(buf), "%s (%s)", exmsg + 1,
4293 				   statmsg);
4294 		statmsg = buf;
4295 		usestat = true;
4296 	}
4297 #endif /* NAMED_BIND */
4298 	else
4299 	{
4300 		statmsg = exmsg;
4301 		if (*statmsg++ == ':' && errnum != 0)
4302 		{
4303 			(void) sm_snprintf(buf, sizeof(buf), "%s: %s", statmsg,
4304 					   sm_errstring(errnum));
4305 			statmsg = buf;
4306 			usestat = true;
4307 		}
4308 		else if (bitnset(M_LMTP, m->m_flags) && e->e_statmsg != NULL)
4309 		{
4310 			(void) sm_snprintf(buf, sizeof(buf), "%s (%s)", statmsg,
4311 					   shortenstring(e->e_statmsg, 403));
4312 			statmsg = buf;
4313 			usestat = true;
4314 		}
4315 	}
4316 
4317 	/*
4318 	**  Print the message as appropriate
4319 	*/
4320 
4321 	if (status == EX_OK || status == EX_TEMPFAIL)
4322 	{
4323 		extern char MsgBuf[];
4324 
4325 		if ((off = isenhsc(statmsg + 4, ' ')) > 0)
4326 		{
4327 			if (dsn == NULL)
4328 			{
4329 				(void) sm_snprintf(dsnbuf, sizeof(dsnbuf),
4330 						   "%.*s", off, statmsg + 4);
4331 				dsn = dsnbuf;
4332 			}
4333 			off += 5;
4334 		}
4335 		else
4336 		{
4337 			off = 4;
4338 		}
4339 		message("%s", statmsg + off);
4340 		if (status == EX_TEMPFAIL && e->e_xfp != NULL)
4341 			(void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT, "%s\n",
4342 					     &MsgBuf[4]);
4343 	}
4344 	else
4345 	{
4346 		char mbuf[ENHSCLEN + 4];
4347 
4348 		Errors++;
4349 		if ((off = isenhsc(statmsg + 4, ' ')) > 0 &&
4350 		    off < sizeof(mbuf) - 4)
4351 		{
4352 			if (dsn == NULL)
4353 			{
4354 				(void) sm_snprintf(dsnbuf, sizeof(dsnbuf),
4355 						   "%.*s", off, statmsg + 4);
4356 				dsn = dsnbuf;
4357 			}
4358 			off += 5;
4359 
4360 			/* copy only part of statmsg to mbuf */
4361 			(void) sm_strlcpy(mbuf, statmsg, off);
4362 			(void) sm_strlcat(mbuf, " %s", sizeof(mbuf));
4363 		}
4364 		else
4365 		{
4366 			dsnbuf[0] = '\0';
4367 			(void) sm_snprintf(mbuf, sizeof(mbuf), "%.3s %%s",
4368 					   statmsg);
4369 			off = 4;
4370 		}
4371 		usrerr(mbuf, &statmsg[off]);
4372 	}
4373 
4374 	/*
4375 	**  Final cleanup.
4376 	**	Log a record of the transaction.  Compute the new ExitStat
4377 	**	-- if we already had an error, stick with that.
4378 	*/
4379 
4380 	if (OpMode != MD_VERIFY && !bitset(EF_VRFYONLY, e->e_flags) &&
4381 	    LogLevel > ((status == EX_TEMPFAIL) ? 8 : (status == EX_OK) ? 7 : 6))
4382 		logdelivery(m, mci, dsn, statmsg + off, ctladdr, xstart, e, to, status);
4383 
4384 	if (tTd(11, 2))
4385 		sm_dprintf("giveresponse: status=%d, dsn=%s, e->e_message=%s, errnum=%d\n",
4386 			   status,
4387 			   dsn == NULL ? "<NULL>" : dsn,
4388 			   e->e_message == NULL ? "<NULL>" : e->e_message,
4389 			   errnum);
4390 
4391 	if (status != EX_TEMPFAIL)
4392 		setstat(status);
4393 	if (status != EX_OK && (status != EX_TEMPFAIL || e->e_message == NULL))
4394 		e->e_message = sm_rpool_strdup_x(e->e_rpool, statmsg + off);
4395 	if (status != EX_OK && to != NULL && to->q_message == NULL)
4396 	{
4397 		if (!usestat && e->e_message != NULL)
4398 			to->q_message = sm_rpool_strdup_x(e->e_rpool,
4399 							  e->e_message);
4400 		else
4401 			to->q_message = sm_rpool_strdup_x(e->e_rpool,
4402 							  statmsg + off);
4403 	}
4404 	errno = 0;
4405 	SM_SET_H_ERRNO(0);
4406 }
4407 /*
4408 **  LOGDELIVERY -- log the delivery in the system log
4409 **
4410 **	Care is taken to avoid logging lines that are too long, because
4411 **	some versions of syslog have an unfortunate proclivity for core
4412 **	dumping.  This is a hack, to be sure, that is at best empirical.
4413 **
4414 **	Parameters:
4415 **		m -- the mailer info.  Can be NULL for initial queue.
4416 **		mci -- the mailer connection info -- can be NULL if the
4417 **			log is occurring when no connection is active.
4418 **		dsn -- the DSN attached to the status.
4419 **		status -- the message to print for the status.
4420 **		ctladdr -- the controlling address for the to list.
4421 **		xstart -- the transaction start time, used for
4422 **			computing transaction delay.
4423 **		e -- the current envelope.
4424 **		to -- the current recipient (NULL if none).
4425 **		rcode -- status code
4426 **
4427 **	Returns:
4428 **		none
4429 **
4430 **	Side Effects:
4431 **		none
4432 */
4433 
4434 void
4435 logdelivery(m, mci, dsn, status, ctladdr, xstart, e, to, rcode)
4436 	MAILER *m;
4437 	register MCI *mci;
4438 	char *dsn;
4439 	const char *status;
4440 	ADDRESS *ctladdr;
4441 	time_t xstart;
4442 	register ENVELOPE *e;
4443 	ADDRESS *to;
4444 	int rcode;
4445 {
4446 	register char *bp;
4447 	register char *p;
4448 	int l;
4449 	time_t now = curtime();
4450 	char buf[1024];
4451 
4452 #if (SYSLOG_BUFSIZE) >= 256
4453 	/* ctladdr: max 106 bytes */
4454 	bp = buf;
4455 	if (ctladdr != NULL)
4456 	{
4457 		(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, ", ctladdr=",
4458 				   shortenstring(ctladdr->q_paddr, 83));
4459 		bp += strlen(bp);
4460 		if (bitset(QGOODUID, ctladdr->q_flags))
4461 		{
4462 			(void) sm_snprintf(bp, SPACELEFT(buf, bp), " (%d/%d)",
4463 					   (int) ctladdr->q_uid,
4464 					   (int) ctladdr->q_gid);
4465 			bp += strlen(bp);
4466 		}
4467 	}
4468 
4469 	/* delay & xdelay: max 41 bytes */
4470 	(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, ", delay=",
4471 			   pintvl(now - e->e_ctime, true));
4472 	bp += strlen(bp);
4473 
4474 	if (xstart != (time_t) 0)
4475 	{
4476 		(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, ", xdelay=",
4477 				   pintvl(now - xstart, true));
4478 		bp += strlen(bp);
4479 	}
4480 
4481 	/* mailer: assume about 19 bytes (max 10 byte mailer name) */
4482 	if (m != NULL)
4483 	{
4484 		(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, ", mailer=",
4485 				   m->m_name);
4486 		bp += strlen(bp);
4487 	}
4488 
4489 # if _FFR_LOG_MORE2
4490 	LOG_MORE(buf, bp);
4491 # endif
4492 
4493 	/* pri: changes with each delivery attempt */
4494 	(void) sm_snprintf(bp, SPACELEFT(buf, bp), ", pri=%ld",
4495 		PRT_NONNEGL(e->e_msgpriority));
4496 	bp += strlen(bp);
4497 
4498 	/* relay: max 66 bytes for IPv4 addresses */
4499 	if (mci != NULL && mci->mci_host != NULL)
4500 	{
4501 		extern SOCKADDR CurHostAddr;
4502 
4503 		(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, ", relay=",
4504 				   shortenstring(mci->mci_host, 40));
4505 		bp += strlen(bp);
4506 
4507 		if (CurHostAddr.sa.sa_family != 0)
4508 		{
4509 			(void) sm_snprintf(bp, SPACELEFT(buf, bp), " [%s]",
4510 					   anynet_ntoa(&CurHostAddr));
4511 		}
4512 	}
4513 	else if (strcmp(status, "quarantined") == 0)
4514 	{
4515 		if (e->e_quarmsg != NULL)
4516 			(void) sm_snprintf(bp, SPACELEFT(buf, bp),
4517 					   ", quarantine=%s",
4518 					   shortenstring(e->e_quarmsg, 40));
4519 	}
4520 	else if (strcmp(status, "queued") != 0)
4521 	{
4522 		p = macvalue('h', e);
4523 		if (p != NULL && p[0] != '\0')
4524 		{
4525 			(void) sm_snprintf(bp, SPACELEFT(buf, bp),
4526 					   ", relay=%s", shortenstring(p, 40));
4527 		}
4528 	}
4529 	bp += strlen(bp);
4530 
4531 	/* dsn */
4532 	if (dsn != NULL && *dsn != '\0')
4533 	{
4534 		(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, ", dsn=",
4535 				   shortenstring(dsn, ENHSCLEN));
4536 		bp += strlen(bp);
4537 	}
4538 
4539 # if _FFR_LOG_NTRIES
4540 	/* ntries */
4541 	if (e->e_ntries >= 0)
4542 	{
4543 		(void) sm_snprintf(bp, SPACELEFT(buf, bp),
4544 				   ", ntries=%d", e->e_ntries + 1);
4545 		bp += strlen(bp);
4546 	}
4547 # endif /* _FFR_LOG_NTRIES */
4548 
4549 # define STATLEN		(((SYSLOG_BUFSIZE) - 100) / 4)
4550 # if (STATLEN) < 63
4551 #  undef STATLEN
4552 #  define STATLEN	63
4553 # endif /* (STATLEN) < 63 */
4554 # if (STATLEN) > 203
4555 #  undef STATLEN
4556 #  define STATLEN	203
4557 # endif /* (STATLEN) > 203 */
4558 
4559 	/*
4560 	**  Notes:
4561 	**  per-rcpt status: to->q_rstatus
4562 	**  global status: e->e_text
4563 	**
4564 	**  We (re)use STATLEN here, is that a good choice?
4565 	**
4566 	**  stat=Deferred: ...
4567 	**  has sometimes the same text?
4568 	**
4569 	**  Note: this doesn't show the stage at which the error happened.
4570 	**  can/should we log that?
4571 	**  XS_* in reply() basically encodes the state.
4572 	**
4573 	**  Note: in some case the normal logging might show the same server
4574 	**  reply - how to avoid that?
4575 	*/
4576 
4577 	/* only show errors */
4578 	if (rcode != EX_OK && to != NULL && to->q_rstatus != NULL &&
4579 	    *to->q_rstatus != '\0')
4580 	{
4581 		(void) sm_snprintf(bp, SPACELEFT(buf, bp),
4582 			", reply=%s",
4583 			shortenstring(to->q_rstatus, STATLEN));
4584 		bp += strlen(bp);
4585 	}
4586 	else if (rcode != EX_OK && e->e_text != NULL)
4587 	{
4588 		(void) sm_snprintf(bp, SPACELEFT(buf, bp),
4589 			", reply=%d %s%s%s",
4590 			e->e_rcode,
4591 			e->e_renhsc,
4592 			(e->e_renhsc[0] != '\0') ? " " : "",
4593 			shortenstring(e->e_text, STATLEN));
4594 		bp += strlen(bp);
4595 	}
4596 
4597 	/* stat: max 210 bytes */
4598 	if ((bp - buf) > (sizeof(buf) - ((STATLEN) + 20)))
4599 	{
4600 		/* desperation move -- truncate data */
4601 		bp = buf + sizeof(buf) - ((STATLEN) + 17);
4602 		(void) sm_strlcpy(bp, "...", SPACELEFT(buf, bp));
4603 		bp += 3;
4604 	}
4605 
4606 	(void) sm_strlcpy(bp, ", stat=", SPACELEFT(buf, bp));
4607 	bp += strlen(bp);
4608 
4609 	(void) sm_strlcpy(bp, shortenstring(status, STATLEN),
4610 			  SPACELEFT(buf, bp));
4611 
4612 	/* id, to: max 13 + TOBUFSIZE bytes */
4613 	l = SYSLOG_BUFSIZE - 100 - strlen(buf);
4614 	if (l < 0)
4615 		l = 0;
4616 	p = e->e_to == NULL ? "NO-TO-LIST" : e->e_to;
4617 	while (strlen(p) >= l)
4618 	{
4619 		register char *q;
4620 
4621 		for (q = p + l; q > p; q--)
4622 		{
4623 			/* XXX a comma in an address will break this! */
4624 			if (*q == ',')
4625 				break;
4626 		}
4627 		if (p == q)
4628 			break;
4629 		sm_syslog(LOG_INFO, e->e_id, "to=%.*s [more]%s",
4630 			  (int) (++q - p), p, buf);
4631 		p = q;
4632 	}
4633 	sm_syslog(LOG_INFO, e->e_id, "to=%.*s%s", l, p, buf);
4634 
4635 #else /* (SYSLOG_BUFSIZE) >= 256 */
4636 
4637 	l = SYSLOG_BUFSIZE - 85;
4638 	if (l < 0)
4639 		l = 0;
4640 	p = e->e_to == NULL ? "NO-TO-LIST" : e->e_to;
4641 	while (strlen(p) >= l)
4642 	{
4643 		register char *q;
4644 
4645 		for (q = p + l; q > p; q--)
4646 		{
4647 			if (*q == ',')
4648 				break;
4649 		}
4650 		if (p == q)
4651 			break;
4652 
4653 		sm_syslog(LOG_INFO, e->e_id, "to=%.*s [more]",
4654 			  (int) (++q - p), p);
4655 		p = q;
4656 	}
4657 	sm_syslog(LOG_INFO, e->e_id, "to=%.*s", l, p);
4658 
4659 	if (ctladdr != NULL)
4660 	{
4661 		bp = buf;
4662 		(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, "ctladdr=",
4663 				   shortenstring(ctladdr->q_paddr, 83));
4664 		bp += strlen(bp);
4665 		if (bitset(QGOODUID, ctladdr->q_flags))
4666 		{
4667 			(void) sm_snprintf(bp, SPACELEFT(buf, bp), " (%d/%d)",
4668 					   ctladdr->q_uid, ctladdr->q_gid);
4669 			bp += strlen(bp);
4670 		}
4671 		sm_syslog(LOG_INFO, e->e_id, "%s", buf);
4672 	}
4673 	bp = buf;
4674 	(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, "delay=",
4675 			   pintvl(now - e->e_ctime, true));
4676 	bp += strlen(bp);
4677 	if (xstart != (time_t) 0)
4678 	{
4679 		(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, ", xdelay=",
4680 				   pintvl(now - xstart, true));
4681 		bp += strlen(bp);
4682 	}
4683 
4684 	if (m != NULL)
4685 	{
4686 		(void) sm_strlcpyn(bp, SPACELEFT(buf, bp), 2, ", mailer=",
4687 				   m->m_name);
4688 		bp += strlen(bp);
4689 	}
4690 	sm_syslog(LOG_INFO, e->e_id, "%.1000s", buf);
4691 
4692 	buf[0] = '\0';
4693 	bp = buf;
4694 	if (mci != NULL && mci->mci_host != NULL)
4695 	{
4696 		extern SOCKADDR CurHostAddr;
4697 
4698 		(void) sm_snprintf(bp, SPACELEFT(buf, bp), "relay=%.100s",
4699 				   mci->mci_host);
4700 		bp += strlen(bp);
4701 
4702 		if (CurHostAddr.sa.sa_family != 0)
4703 			(void) sm_snprintf(bp, SPACELEFT(buf, bp),
4704 					   " [%.100s]",
4705 					   anynet_ntoa(&CurHostAddr));
4706 	}
4707 	else if (strcmp(status, "quarantined") == 0)
4708 	{
4709 		if (e->e_quarmsg != NULL)
4710 			(void) sm_snprintf(bp, SPACELEFT(buf, bp),
4711 					   ", quarantine=%.100s",
4712 					   e->e_quarmsg);
4713 	}
4714 	else if (strcmp(status, "queued") != 0)
4715 	{
4716 		p = macvalue('h', e);
4717 		if (p != NULL && p[0] != '\0')
4718 			(void) sm_snprintf(buf, sizeof(buf), "relay=%.100s", p);
4719 	}
4720 	if (buf[0] != '\0')
4721 		sm_syslog(LOG_INFO, e->e_id, "%.1000s", buf);
4722 
4723 	sm_syslog(LOG_INFO, e->e_id, "stat=%s", shortenstring(status, 63));
4724 #endif /* (SYSLOG_BUFSIZE) >= 256 */
4725 }
4726 /*
4727 **  PUTFROMLINE -- output a UNIX-style from line (or whatever)
4728 **
4729 **	This can be made an arbitrary message separator by changing $l
4730 **
4731 **	One of the ugliest hacks seen by human eyes is contained herein:
4732 **	UUCP wants those stupid "remote from <host>" lines.  Why oh why
4733 **	does a well-meaning programmer such as myself have to deal with
4734 **	this kind of antique garbage????
4735 **
4736 **	Parameters:
4737 **		mci -- the connection information.
4738 **		e -- the envelope.
4739 **
4740 **	Returns:
4741 **		true iff line was written successfully
4742 **
4743 **	Side Effects:
4744 **		outputs some text to fp.
4745 */
4746 
4747 bool
4748 putfromline(mci, e)
4749 	register MCI *mci;
4750 	ENVELOPE *e;
4751 {
4752 	char *template = UnixFromLine;
4753 	char buf[MAXLINE];
4754 	char xbuf[MAXLINE];
4755 
4756 	if (bitnset(M_NHDR, mci->mci_mailer->m_flags))
4757 		return true;
4758 
4759 	mci->mci_flags |= MCIF_INHEADER;
4760 
4761 	if (bitnset(M_UGLYUUCP, mci->mci_mailer->m_flags))
4762 	{
4763 		char *bang;
4764 
4765 		expand("\201g", buf, sizeof(buf), e);
4766 		bang = strchr(buf, '!');
4767 		if (bang == NULL)
4768 		{
4769 			char *at;
4770 			char hname[MAXNAME];
4771 
4772 			/*
4773 			**  If we can construct a UUCP path, do so
4774 			*/
4775 
4776 			at = strrchr(buf, '@');
4777 			if (at == NULL)
4778 			{
4779 				expand("\201k", hname, sizeof(hname), e);
4780 				at = hname;
4781 			}
4782 			else
4783 				*at++ = '\0';
4784 			(void) sm_snprintf(xbuf, sizeof(xbuf),
4785 					   "From %.800s  \201d remote from %.100s\n",
4786 					   buf, at);
4787 		}
4788 		else
4789 		{
4790 			*bang++ = '\0';
4791 			(void) sm_snprintf(xbuf, sizeof(xbuf),
4792 					   "From %.800s  \201d remote from %.100s\n",
4793 					   bang, buf);
4794 			template = xbuf;
4795 		}
4796 	}
4797 	expand(template, buf, sizeof(buf), e);
4798 	return putxline(buf, strlen(buf), mci, PXLF_HEADER);
4799 }
4800 
4801 /*
4802 **  PUTBODY -- put the body of a message.
4803 **
4804 **	Parameters:
4805 **		mci -- the connection information.
4806 **		e -- the envelope to put out.
4807 **		separator -- if non-NULL, a message separator that must
4808 **			not be permitted in the resulting message.
4809 **
4810 **	Returns:
4811 **		true iff message was written successfully
4812 **
4813 **	Side Effects:
4814 **		The message is written onto fp.
4815 */
4816 
4817 /* values for output state variable */
4818 #define OSTATE_HEAD	0	/* at beginning of line */
4819 #define OSTATE_CR	1	/* read a carriage return */
4820 #define OSTATE_INLINE	2	/* putting rest of line */
4821 
4822 bool
4823 putbody(mci, e, separator)
4824 	register MCI *mci;
4825 	register ENVELOPE *e;
4826 	char *separator;
4827 {
4828 	bool dead = false;
4829 	bool ioerr = false;
4830 	int save_errno;
4831 	char buf[MAXLINE];
4832 #if MIME8TO7
4833 	char *boundaries[MAXMIMENESTING + 1];
4834 #endif
4835 
4836 	/*
4837 	**  Output the body of the message
4838 	*/
4839 
4840 	if (e->e_dfp == NULL && bitset(EF_HAS_DF, e->e_flags))
4841 	{
4842 		char *df = queuename(e, DATAFL_LETTER);
4843 
4844 		e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, df,
4845 				      SM_IO_RDONLY_B, NULL);
4846 		if (e->e_dfp == NULL)
4847 		{
4848 			char *msg = "!putbody: Cannot open %s for %s from %s";
4849 
4850 			if (errno == ENOENT)
4851 				msg++;
4852 			syserr(msg, df, e->e_to, e->e_from.q_paddr);
4853 		}
4854 
4855 	}
4856 	if (e->e_dfp == NULL)
4857 	{
4858 		if (bitset(MCIF_INHEADER, mci->mci_flags))
4859 		{
4860 			if (!putline("", mci))
4861 				goto writeerr;
4862 			mci->mci_flags &= ~MCIF_INHEADER;
4863 		}
4864 		if (!putline("<<< No Message Collected >>>", mci))
4865 			goto writeerr;
4866 		goto endofmessage;
4867 	}
4868 
4869 	if (e->e_dfino == (ino_t) 0)
4870 	{
4871 		struct stat stbuf;
4872 
4873 		if (fstat(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD, NULL), &stbuf)
4874 		    < 0)
4875 			e->e_dfino = -1;
4876 		else
4877 		{
4878 			e->e_dfdev = stbuf.st_dev;
4879 			e->e_dfino = stbuf.st_ino;
4880 		}
4881 	}
4882 
4883 	/* paranoia: the data file should always be in a rewound state */
4884 	(void) bfrewind(e->e_dfp);
4885 
4886 	/* simulate an I/O timeout when used as source */
4887 	if (tTd(84, 101))
4888 		sleep(319);
4889 
4890 #if MIME8TO7
4891 	if (bitset(MCIF_CVT8TO7, mci->mci_flags))
4892 	{
4893 		/*
4894 		**  Do 8 to 7 bit MIME conversion.
4895 		*/
4896 
4897 		/* make sure it looks like a MIME message */
4898 		if (hvalue("MIME-Version", e->e_header) == NULL &&
4899 		    !putline("MIME-Version: 1.0", mci))
4900 			goto writeerr;
4901 
4902 		if (hvalue("Content-Type", e->e_header) == NULL)
4903 		{
4904 			(void) sm_snprintf(buf, sizeof(buf),
4905 					   "Content-Type: text/plain; charset=%s",
4906 					   defcharset(e));
4907 			if (!putline(buf, mci))
4908 				goto writeerr;
4909 		}
4910 
4911 		/* now do the hard work */
4912 		boundaries[0] = NULL;
4913 		mci->mci_flags |= MCIF_INHEADER;
4914 		if (mime8to7(mci, e->e_header, e, boundaries, M87F_OUTER, 0) ==
4915 								SM_IO_EOF)
4916 			goto writeerr;
4917 	}
4918 # if MIME7TO8
4919 	else if (bitset(MCIF_CVT7TO8, mci->mci_flags))
4920 	{
4921 		if (!mime7to8(mci, e->e_header, e))
4922 			goto writeerr;
4923 	}
4924 # endif /* MIME7TO8 */
4925 	else if (MaxMimeHeaderLength > 0 || MaxMimeFieldLength > 0)
4926 	{
4927 		bool oldsuprerrs = SuprErrs;
4928 
4929 		/* Use mime8to7 to check multipart for MIME header overflows */
4930 		boundaries[0] = NULL;
4931 		mci->mci_flags |= MCIF_INHEADER;
4932 
4933 		/*
4934 		**  If EF_DONT_MIME is set, we have a broken MIME message
4935 		**  and don't want to generate a new bounce message whose
4936 		**  body propagates the broken MIME.  We can't just not call
4937 		**  mime8to7() as is done above since we need the security
4938 		**  checks.  The best we can do is suppress the errors.
4939 		*/
4940 
4941 		if (bitset(EF_DONT_MIME, e->e_flags))
4942 			SuprErrs = true;
4943 
4944 		if (mime8to7(mci, e->e_header, e, boundaries,
4945 				M87F_OUTER|M87F_NO8TO7, 0) == SM_IO_EOF)
4946 			goto writeerr;
4947 
4948 		/* restore SuprErrs */
4949 		SuprErrs = oldsuprerrs;
4950 	}
4951 	else
4952 #endif /* MIME8TO7 */
4953 	{
4954 		int ostate;
4955 		register char *bp;
4956 		register char *pbp;
4957 		register int c;
4958 		register char *xp;
4959 		int padc;
4960 		char *buflim;
4961 		int pos = 0;
4962 		char peekbuf[12];
4963 
4964 		if (bitset(MCIF_INHEADER, mci->mci_flags))
4965 		{
4966 			if (!putline("", mci))
4967 				goto writeerr;
4968 			mci->mci_flags &= ~MCIF_INHEADER;
4969 		}
4970 
4971 		/* determine end of buffer; allow for short mailer lines */
4972 		buflim = &buf[sizeof(buf) - 1];
4973 		if (mci->mci_mailer->m_linelimit > 0 &&
4974 		    mci->mci_mailer->m_linelimit < sizeof(buf) - 1)
4975 			buflim = &buf[mci->mci_mailer->m_linelimit - 1];
4976 
4977 		/* copy temp file to output with mapping */
4978 		ostate = OSTATE_HEAD;
4979 		bp = buf;
4980 		pbp = peekbuf;
4981 		while (!sm_io_error(mci->mci_out) && !dead)
4982 		{
4983 			if (pbp > peekbuf)
4984 				c = *--pbp;
4985 			else if ((c = sm_io_getc(e->e_dfp, SM_TIME_DEFAULT))
4986 				 == SM_IO_EOF)
4987 				break;
4988 			if (bitset(MCIF_7BIT, mci->mci_flags))
4989 				c &= 0x7f;
4990 			switch (ostate)
4991 			{
4992 			  case OSTATE_HEAD:
4993 				if (c == '\0' &&
4994 				    bitnset(M_NONULLS,
4995 					    mci->mci_mailer->m_flags))
4996 					break;
4997 				if (c != '\r' && c != '\n' && bp < buflim)
4998 				{
4999 					*bp++ = c;
5000 					break;
5001 				}
5002 
5003 				/* check beginning of line for special cases */
5004 				*bp = '\0';
5005 				pos = 0;
5006 				padc = SM_IO_EOF;
5007 				if (buf[0] == 'F' &&
5008 				    bitnset(M_ESCFROM, mci->mci_mailer->m_flags)
5009 				    && strncmp(buf, "From ", 5) == 0)
5010 				{
5011 					padc = '>';
5012 				}
5013 				if (buf[0] == '-' && buf[1] == '-' &&
5014 				    separator != NULL)
5015 				{
5016 					/* possible separator */
5017 					int sl = strlen(separator);
5018 
5019 					if (strncmp(&buf[2], separator, sl)
5020 					    == 0)
5021 						padc = ' ';
5022 				}
5023 				if (buf[0] == '.' &&
5024 				    bitnset(M_XDOT, mci->mci_mailer->m_flags))
5025 				{
5026 					padc = '.';
5027 				}
5028 
5029 				/* now copy out saved line */
5030 				if (TrafficLogFile != NULL)
5031 				{
5032 					(void) sm_io_fprintf(TrafficLogFile,
5033 							     SM_TIME_DEFAULT,
5034 							     "%05d >>> ",
5035 							     (int) CurrentPid);
5036 					if (padc != SM_IO_EOF)
5037 						(void) sm_io_putc(TrafficLogFile,
5038 								  SM_TIME_DEFAULT,
5039 								  padc);
5040 					for (xp = buf; xp < bp; xp++)
5041 						(void) sm_io_putc(TrafficLogFile,
5042 								  SM_TIME_DEFAULT,
5043 								  (unsigned char) *xp);
5044 					if (c == '\n')
5045 						(void) sm_io_fputs(TrafficLogFile,
5046 								   SM_TIME_DEFAULT,
5047 								   mci->mci_mailer->m_eol);
5048 				}
5049 				if (padc != SM_IO_EOF)
5050 				{
5051 					if (sm_io_putc(mci->mci_out,
5052 						       SM_TIME_DEFAULT, padc)
5053 					    == SM_IO_EOF)
5054 					{
5055 						dead = true;
5056 						continue;
5057 					}
5058 					pos++;
5059 				}
5060 				for (xp = buf; xp < bp; xp++)
5061 				{
5062 					if (sm_io_putc(mci->mci_out,
5063 						       SM_TIME_DEFAULT,
5064 						       (unsigned char) *xp)
5065 					    == SM_IO_EOF)
5066 					{
5067 						dead = true;
5068 						break;
5069 					}
5070 				}
5071 				if (dead)
5072 					continue;
5073 				if (c == '\n')
5074 				{
5075 					if (sm_io_fputs(mci->mci_out,
5076 							SM_TIME_DEFAULT,
5077 							mci->mci_mailer->m_eol)
5078 							== SM_IO_EOF)
5079 						break;
5080 					pos = 0;
5081 				}
5082 				else
5083 				{
5084 					pos += bp - buf;
5085 					if (c != '\r')
5086 					{
5087 						SM_ASSERT(pbp < peekbuf +
5088 								sizeof(peekbuf));
5089 						*pbp++ = c;
5090 					}
5091 				}
5092 
5093 				bp = buf;
5094 
5095 				/* determine next state */
5096 				if (c == '\n')
5097 					ostate = OSTATE_HEAD;
5098 				else if (c == '\r')
5099 					ostate = OSTATE_CR;
5100 				else
5101 					ostate = OSTATE_INLINE;
5102 				continue;
5103 
5104 			  case OSTATE_CR:
5105 				if (c == '\n')
5106 				{
5107 					/* got CRLF */
5108 					if (sm_io_fputs(mci->mci_out,
5109 							SM_TIME_DEFAULT,
5110 							mci->mci_mailer->m_eol)
5111 							== SM_IO_EOF)
5112 						continue;
5113 
5114 					if (TrafficLogFile != NULL)
5115 					{
5116 						(void) sm_io_fputs(TrafficLogFile,
5117 								   SM_TIME_DEFAULT,
5118 								   mci->mci_mailer->m_eol);
5119 					}
5120 					pos = 0;
5121 					ostate = OSTATE_HEAD;
5122 					continue;
5123 				}
5124 
5125 				/* had a naked carriage return */
5126 				SM_ASSERT(pbp < peekbuf + sizeof(peekbuf));
5127 				*pbp++ = c;
5128 				c = '\r';
5129 				ostate = OSTATE_INLINE;
5130 				goto putch;
5131 
5132 			  case OSTATE_INLINE:
5133 				if (c == '\r')
5134 				{
5135 					ostate = OSTATE_CR;
5136 					continue;
5137 				}
5138 				if (c == '\0' &&
5139 				    bitnset(M_NONULLS,
5140 					    mci->mci_mailer->m_flags))
5141 					break;
5142 putch:
5143 				if (mci->mci_mailer->m_linelimit > 0 &&
5144 				    pos >= mci->mci_mailer->m_linelimit - 1 &&
5145 				    c != '\n')
5146 				{
5147 					int d;
5148 
5149 					/* check next character for EOL */
5150 					if (pbp > peekbuf)
5151 						d = *(pbp - 1);
5152 					else if ((d = sm_io_getc(e->e_dfp,
5153 								 SM_TIME_DEFAULT))
5154 						 != SM_IO_EOF)
5155 					{
5156 						SM_ASSERT(pbp < peekbuf +
5157 								sizeof(peekbuf));
5158 						*pbp++ = d;
5159 					}
5160 
5161 					if (d == '\n' || d == SM_IO_EOF)
5162 					{
5163 						if (TrafficLogFile != NULL)
5164 							(void) sm_io_putc(TrafficLogFile,
5165 									  SM_TIME_DEFAULT,
5166 									  (unsigned char) c);
5167 						if (sm_io_putc(mci->mci_out,
5168 							       SM_TIME_DEFAULT,
5169 							       (unsigned char) c)
5170 							       == SM_IO_EOF)
5171 						{
5172 							dead = true;
5173 							continue;
5174 						}
5175 						pos++;
5176 						continue;
5177 					}
5178 
5179 					if (sm_io_putc(mci->mci_out,
5180 						       SM_TIME_DEFAULT, '!')
5181 					    == SM_IO_EOF ||
5182 					    sm_io_fputs(mci->mci_out,
5183 							SM_TIME_DEFAULT,
5184 							mci->mci_mailer->m_eol)
5185 					    == SM_IO_EOF)
5186 					{
5187 						dead = true;
5188 						continue;
5189 					}
5190 
5191 					if (TrafficLogFile != NULL)
5192 					{
5193 						(void) sm_io_fprintf(TrafficLogFile,
5194 								     SM_TIME_DEFAULT,
5195 								     "!%s",
5196 								     mci->mci_mailer->m_eol);
5197 					}
5198 					ostate = OSTATE_HEAD;
5199 					SM_ASSERT(pbp < peekbuf +
5200 							sizeof(peekbuf));
5201 					*pbp++ = c;
5202 					continue;
5203 				}
5204 				if (c == '\n')
5205 				{
5206 					if (TrafficLogFile != NULL)
5207 						(void) sm_io_fputs(TrafficLogFile,
5208 								   SM_TIME_DEFAULT,
5209 								   mci->mci_mailer->m_eol);
5210 					if (sm_io_fputs(mci->mci_out,
5211 							SM_TIME_DEFAULT,
5212 							mci->mci_mailer->m_eol)
5213 							== SM_IO_EOF)
5214 						continue;
5215 					pos = 0;
5216 					ostate = OSTATE_HEAD;
5217 				}
5218 				else
5219 				{
5220 					if (TrafficLogFile != NULL)
5221 						(void) sm_io_putc(TrafficLogFile,
5222 								  SM_TIME_DEFAULT,
5223 								  (unsigned char) c);
5224 					if (sm_io_putc(mci->mci_out,
5225 						       SM_TIME_DEFAULT,
5226 						       (unsigned char) c)
5227 					    == SM_IO_EOF)
5228 					{
5229 						dead = true;
5230 						continue;
5231 					}
5232 					pos++;
5233 					ostate = OSTATE_INLINE;
5234 				}
5235 				break;
5236 			}
5237 		}
5238 
5239 		/* make sure we are at the beginning of a line */
5240 		if (bp > buf)
5241 		{
5242 			if (TrafficLogFile != NULL)
5243 			{
5244 				for (xp = buf; xp < bp; xp++)
5245 					(void) sm_io_putc(TrafficLogFile,
5246 							  SM_TIME_DEFAULT,
5247 							  (unsigned char) *xp);
5248 			}
5249 			for (xp = buf; xp < bp; xp++)
5250 			{
5251 				if (sm_io_putc(mci->mci_out, SM_TIME_DEFAULT,
5252 					       (unsigned char) *xp)
5253 				    == SM_IO_EOF)
5254 				{
5255 					dead = true;
5256 					break;
5257 				}
5258 			}
5259 			pos += bp - buf;
5260 		}
5261 		if (!dead && pos > 0)
5262 		{
5263 			if (TrafficLogFile != NULL)
5264 				(void) sm_io_fputs(TrafficLogFile,
5265 						   SM_TIME_DEFAULT,
5266 						   mci->mci_mailer->m_eol);
5267 			if (sm_io_fputs(mci->mci_out, SM_TIME_DEFAULT,
5268 					   mci->mci_mailer->m_eol) == SM_IO_EOF)
5269 				goto writeerr;
5270 		}
5271 	}
5272 
5273 	if (sm_io_error(e->e_dfp))
5274 	{
5275 		syserr("putbody: %s/%cf%s: read error",
5276 		       qid_printqueue(e->e_dfqgrp, e->e_dfqdir),
5277 		       DATAFL_LETTER, e->e_id);
5278 		ExitStat = EX_IOERR;
5279 		ioerr = true;
5280 	}
5281 
5282 endofmessage:
5283 	/*
5284 	**  Since mailfile() uses e_dfp in a child process,
5285 	**  the file offset in the stdio library for the
5286 	**  parent process will not agree with the in-kernel
5287 	**  file offset since the file descriptor is shared
5288 	**  between the processes.  Therefore, it is vital
5289 	**  that the file always be rewound.  This forces the
5290 	**  kernel offset (lseek) and stdio library (ftell)
5291 	**  offset to match.
5292 	*/
5293 
5294 	save_errno = errno;
5295 	if (e->e_dfp != NULL)
5296 		(void) bfrewind(e->e_dfp);
5297 
5298 	/* some mailers want extra blank line at end of message */
5299 	if (!dead && bitnset(M_BLANKEND, mci->mci_mailer->m_flags) &&
5300 	    buf[0] != '\0' && buf[0] != '\n')
5301 	{
5302 		if (!putline("", mci))
5303 			goto writeerr;
5304 	}
5305 
5306 	if (!dead &&
5307 	    (sm_io_flush(mci->mci_out, SM_TIME_DEFAULT) == SM_IO_EOF ||
5308 	     (sm_io_error(mci->mci_out) && errno != EPIPE)))
5309 	{
5310 		save_errno = errno;
5311 		syserr("putbody: write error");
5312 		ExitStat = EX_IOERR;
5313 		ioerr = true;
5314 	}
5315 
5316 	errno = save_errno;
5317 	return !dead && !ioerr;
5318 
5319   writeerr:
5320 	return false;
5321 }
5322 
5323 /*
5324 **  MAILFILE -- Send a message to a file.
5325 **
5326 **	If the file has the set-user-ID/set-group-ID bits set, but NO
5327 **	execute bits, sendmail will try to become the owner of that file
5328 **	rather than the real user.  Obviously, this only works if
5329 **	sendmail runs as root.
5330 **
5331 **	This could be done as a subordinate mailer, except that it
5332 **	is used implicitly to save messages in ~/dead.letter.  We
5333 **	view this as being sufficiently important as to include it
5334 **	here.  For example, if the system is dying, we shouldn't have
5335 **	to create another process plus some pipes to save the message.
5336 **
5337 **	Parameters:
5338 **		filename -- the name of the file to send to.
5339 **		mailer -- mailer definition for recipient -- if NULL,
5340 **			use FileMailer.
5341 **		ctladdr -- the controlling address header -- includes
5342 **			the userid/groupid to be when sending.
5343 **		sfflags -- flags for opening.
5344 **		e -- the current envelope.
5345 **
5346 **	Returns:
5347 **		The exit code associated with the operation.
5348 **
5349 **	Side Effects:
5350 **		none.
5351 */
5352 
5353 # define RETURN(st)			exit(st);
5354 
5355 static jmp_buf	CtxMailfileTimeout;
5356 
5357 int
5358 mailfile(filename, mailer, ctladdr, sfflags, e)
5359 	char *volatile filename;
5360 	MAILER *volatile mailer;
5361 	ADDRESS *ctladdr;
5362 	volatile long sfflags;
5363 	register ENVELOPE *e;
5364 {
5365 	register SM_FILE_T *f;
5366 	register pid_t pid = -1;
5367 	volatile int mode;
5368 	int len;
5369 	off_t curoff;
5370 	bool suidwarn = geteuid() == 0;
5371 	char *p;
5372 	char *volatile realfile;
5373 	SM_EVENT *ev;
5374 	char buf[MAXPATHLEN];
5375 	char targetfile[MAXPATHLEN];
5376 
5377 	if (tTd(11, 1))
5378 	{
5379 		sm_dprintf("mailfile %s\n  ctladdr=", filename);
5380 		printaddr(sm_debug_file(), ctladdr, false);
5381 	}
5382 
5383 	if (mailer == NULL)
5384 		mailer = FileMailer;
5385 
5386 	if (e->e_xfp != NULL)
5387 		(void) sm_io_flush(e->e_xfp, SM_TIME_DEFAULT);
5388 
5389 	/*
5390 	**  Special case /dev/null.  This allows us to restrict file
5391 	**  delivery to regular files only.
5392 	*/
5393 
5394 	if (sm_path_isdevnull(filename))
5395 		return EX_OK;
5396 
5397 	/* check for 8-bit available */
5398 	if (bitset(EF_HAS8BIT, e->e_flags) &&
5399 	    bitnset(M_7BITS, mailer->m_flags) &&
5400 	    (bitset(EF_DONT_MIME, e->e_flags) ||
5401 	     !(bitset(MM_MIME8BIT, MimeMode) ||
5402 	       (bitset(EF_IS_MIME, e->e_flags) &&
5403 		bitset(MM_CVTMIME, MimeMode)))))
5404 	{
5405 		e->e_status = "5.6.3";
5406 		usrerrenh(e->e_status,
5407 			  "554 Cannot send 8-bit data to 7-bit destination");
5408 		errno = 0;
5409 		return EX_DATAERR;
5410 	}
5411 
5412 	/* Find the actual file */
5413 	if (SafeFileEnv != NULL && SafeFileEnv[0] != '\0')
5414 	{
5415 		len = strlen(SafeFileEnv);
5416 
5417 		if (strncmp(SafeFileEnv, filename, len) == 0)
5418 			filename += len;
5419 
5420 		if (len + strlen(filename) + 1 >= sizeof(targetfile))
5421 		{
5422 			syserr("mailfile: filename too long (%s/%s)",
5423 			       SafeFileEnv, filename);
5424 			return EX_CANTCREAT;
5425 		}
5426 		(void) sm_strlcpy(targetfile, SafeFileEnv, sizeof(targetfile));
5427 		realfile = targetfile + len;
5428 		if (*filename == '/')
5429 			filename++;
5430 		if (*filename != '\0')
5431 		{
5432 			/* paranoia: trailing / should be removed in readcf */
5433 			if (targetfile[len - 1] != '/')
5434 				(void) sm_strlcat(targetfile,
5435 						  "/", sizeof(targetfile));
5436 			(void) sm_strlcat(targetfile, filename,
5437 					  sizeof(targetfile));
5438 		}
5439 	}
5440 	else if (mailer->m_rootdir != NULL)
5441 	{
5442 		expand(mailer->m_rootdir, targetfile, sizeof(targetfile), e);
5443 		len = strlen(targetfile);
5444 
5445 		if (strncmp(targetfile, filename, len) == 0)
5446 			filename += len;
5447 
5448 		if (len + strlen(filename) + 1 >= sizeof(targetfile))
5449 		{
5450 			syserr("mailfile: filename too long (%s/%s)",
5451 			       targetfile, filename);
5452 			return EX_CANTCREAT;
5453 		}
5454 		realfile = targetfile + len;
5455 		if (targetfile[len - 1] != '/')
5456 			(void) sm_strlcat(targetfile, "/", sizeof(targetfile));
5457 		if (*filename == '/')
5458 			(void) sm_strlcat(targetfile, filename + 1,
5459 					  sizeof(targetfile));
5460 		else
5461 			(void) sm_strlcat(targetfile, filename,
5462 					  sizeof(targetfile));
5463 	}
5464 	else
5465 	{
5466 		if (sm_strlcpy(targetfile, filename, sizeof(targetfile)) >=
5467 		    sizeof(targetfile))
5468 		{
5469 			syserr("mailfile: filename too long (%s)", filename);
5470 			return EX_CANTCREAT;
5471 		}
5472 		realfile = targetfile;
5473 	}
5474 
5475 	/*
5476 	**  Fork so we can change permissions here.
5477 	**	Note that we MUST use fork, not vfork, because of
5478 	**	the complications of calling subroutines, etc.
5479 	*/
5480 
5481 
5482 	/*
5483 	**  Dispose of SIGCHLD signal catchers that may be laying
5484 	**  around so that the waitfor() below will get it.
5485 	*/
5486 
5487 	(void) sm_signal(SIGCHLD, SIG_DFL);
5488 
5489 	DOFORK(fork);
5490 
5491 	if (pid < 0)
5492 		return EX_OSERR;
5493 	else if (pid == 0)
5494 	{
5495 		/* child -- actually write to file */
5496 		struct stat stb;
5497 		MCI mcibuf;
5498 		int err;
5499 		volatile int oflags = O_WRONLY|O_APPEND;
5500 
5501 		/* Reset global flags */
5502 		RestartRequest = NULL;
5503 		RestartWorkGroup = false;
5504 		ShutdownRequest = NULL;
5505 		PendingSignal = 0;
5506 		CurrentPid = getpid();
5507 
5508 		if (e->e_lockfp != NULL)
5509 		{
5510 			int fd;
5511 
5512 			fd = sm_io_getinfo(e->e_lockfp, SM_IO_WHAT_FD, NULL);
5513 			/* SM_ASSERT(fd >= 0); */
5514 			if (fd >= 0)
5515 				(void) close(fd);
5516 		}
5517 
5518 		(void) sm_signal(SIGINT, SIG_DFL);
5519 		(void) sm_signal(SIGHUP, SIG_DFL);
5520 		(void) sm_signal(SIGTERM, SIG_DFL);
5521 		(void) umask(OldUmask);
5522 		e->e_to = filename;
5523 		ExitStat = EX_OK;
5524 
5525 		if (setjmp(CtxMailfileTimeout) != 0)
5526 		{
5527 			RETURN(EX_TEMPFAIL);
5528 		}
5529 
5530 		if (TimeOuts.to_fileopen > 0)
5531 			ev = sm_setevent(TimeOuts.to_fileopen, mailfiletimeout,
5532 					 0);
5533 		else
5534 			ev = NULL;
5535 
5536 		/* check file mode to see if set-user-ID */
5537 		if (stat(targetfile, &stb) < 0)
5538 			mode = FileMode;
5539 		else
5540 			mode = stb.st_mode;
5541 
5542 		/* limit the errors to those actually caused in the child */
5543 		errno = 0;
5544 		ExitStat = EX_OK;
5545 
5546 		/* Allow alias expansions to use the S_IS{U,G}ID bits */
5547 		if ((ctladdr != NULL && !bitset(QALIAS, ctladdr->q_flags)) ||
5548 		    bitset(SFF_RUNASREALUID, sfflags))
5549 		{
5550 			/* ignore set-user-ID and set-group-ID bits */
5551 			mode &= ~(S_ISGID|S_ISUID);
5552 			if (tTd(11, 20))
5553 				sm_dprintf("mailfile: ignoring set-user-ID/set-group-ID bits\n");
5554 		}
5555 
5556 		/* we have to open the data file BEFORE setuid() */
5557 		if (e->e_dfp == NULL && bitset(EF_HAS_DF, e->e_flags))
5558 		{
5559 			char *df = queuename(e, DATAFL_LETTER);
5560 
5561 			e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, df,
5562 					      SM_IO_RDONLY_B, NULL);
5563 			if (e->e_dfp == NULL)
5564 			{
5565 				syserr("mailfile: Cannot open %s for %s from %s",
5566 					df, e->e_to, e->e_from.q_paddr);
5567 			}
5568 		}
5569 
5570 		/* select a new user to run as */
5571 		if (!bitset(SFF_RUNASREALUID, sfflags))
5572 		{
5573 			if (bitnset(M_SPECIFIC_UID, mailer->m_flags))
5574 			{
5575 				RealUserName = NULL;
5576 				if (mailer->m_uid == NO_UID)
5577 					RealUid = RunAsUid;
5578 				else
5579 					RealUid = mailer->m_uid;
5580 				if (RunAsUid != 0 && RealUid != RunAsUid)
5581 				{
5582 					/* Only root can change the uid */
5583 					syserr("mailfile: insufficient privileges to change uid, RunAsUid=%ld, RealUid=%ld",
5584 						(long) RunAsUid, (long) RealUid);
5585 					RETURN(EX_TEMPFAIL);
5586 				}
5587 			}
5588 			else if (bitset(S_ISUID, mode))
5589 			{
5590 				RealUserName = NULL;
5591 				RealUid = stb.st_uid;
5592 			}
5593 			else if (ctladdr != NULL && ctladdr->q_uid != 0)
5594 			{
5595 				if (ctladdr->q_ruser != NULL)
5596 					RealUserName = ctladdr->q_ruser;
5597 				else
5598 					RealUserName = ctladdr->q_user;
5599 				RealUid = ctladdr->q_uid;
5600 			}
5601 			else if (mailer != NULL && mailer->m_uid != NO_UID)
5602 			{
5603 				RealUserName = DefUser;
5604 				RealUid = mailer->m_uid;
5605 			}
5606 			else
5607 			{
5608 				RealUserName = DefUser;
5609 				RealUid = DefUid;
5610 			}
5611 
5612 			/* select a new group to run as */
5613 			if (bitnset(M_SPECIFIC_UID, mailer->m_flags))
5614 			{
5615 				if (mailer->m_gid == NO_GID)
5616 					RealGid = RunAsGid;
5617 				else
5618 					RealGid = mailer->m_gid;
5619 				if (RunAsUid != 0 &&
5620 				    (RealGid != getgid() ||
5621 				     RealGid != getegid()))
5622 				{
5623 					/* Only root can change the gid */
5624 					syserr("mailfile: insufficient privileges to change gid, RealGid=%ld, RunAsUid=%ld, gid=%ld, egid=%ld",
5625 					       (long) RealGid, (long) RunAsUid,
5626 					       (long) getgid(), (long) getegid());
5627 					RETURN(EX_TEMPFAIL);
5628 				}
5629 			}
5630 			else if (bitset(S_ISGID, mode))
5631 				RealGid = stb.st_gid;
5632 			else if (ctladdr != NULL &&
5633 				 ctladdr->q_uid == DefUid &&
5634 				 ctladdr->q_gid == 0)
5635 			{
5636 				/*
5637 				**  Special case:  This means it is an
5638 				**  alias and we should act as DefaultUser.
5639 				**  See alias()'s comments.
5640 				*/
5641 
5642 				RealGid = DefGid;
5643 				RealUserName = DefUser;
5644 			}
5645 			else if (ctladdr != NULL && ctladdr->q_uid != 0)
5646 				RealGid = ctladdr->q_gid;
5647 			else if (mailer != NULL && mailer->m_gid != NO_GID)
5648 				RealGid = mailer->m_gid;
5649 			else
5650 				RealGid = DefGid;
5651 		}
5652 
5653 		/* last ditch */
5654 		if (!bitset(SFF_ROOTOK, sfflags))
5655 		{
5656 			if (RealUid == 0)
5657 				RealUid = DefUid;
5658 			if (RealGid == 0)
5659 				RealGid = DefGid;
5660 		}
5661 
5662 		/* set group id list (needs /etc/group access) */
5663 		if (RealUserName != NULL && !DontInitGroups)
5664 		{
5665 			if (initgroups(RealUserName, RealGid) == -1 && suidwarn)
5666 			{
5667 				syserr("mailfile: initgroups(%s, %ld) failed",
5668 					RealUserName, (long) RealGid);
5669 				RETURN(EX_TEMPFAIL);
5670 			}
5671 		}
5672 		else
5673 		{
5674 			GIDSET_T gidset[1];
5675 
5676 			gidset[0] = RealGid;
5677 			if (setgroups(1, gidset) == -1 && suidwarn)
5678 			{
5679 				syserr("mailfile: setgroups() failed");
5680 				RETURN(EX_TEMPFAIL);
5681 			}
5682 		}
5683 
5684 		/*
5685 		**  If you have a safe environment, go into it.
5686 		*/
5687 
5688 		if (realfile != targetfile)
5689 		{
5690 			char save;
5691 
5692 			save = *realfile;
5693 			*realfile = '\0';
5694 			if (tTd(11, 20))
5695 				sm_dprintf("mailfile: chroot %s\n", targetfile);
5696 			if (chroot(targetfile) < 0)
5697 			{
5698 				syserr("mailfile: Cannot chroot(%s)",
5699 				       targetfile);
5700 				RETURN(EX_CANTCREAT);
5701 			}
5702 			*realfile = save;
5703 		}
5704 
5705 		if (tTd(11, 40))
5706 			sm_dprintf("mailfile: deliver to %s\n", realfile);
5707 
5708 		if (chdir("/") < 0)
5709 		{
5710 			syserr("mailfile: cannot chdir(/)");
5711 			RETURN(EX_CANTCREAT);
5712 		}
5713 
5714 		/* now reset the group and user ids */
5715 		endpwent();
5716 		sm_mbdb_terminate();
5717 		if (setgid(RealGid) < 0 && suidwarn)
5718 		{
5719 			syserr("mailfile: setgid(%ld) failed", (long) RealGid);
5720 			RETURN(EX_TEMPFAIL);
5721 		}
5722 		vendor_set_uid(RealUid);
5723 		if (setuid(RealUid) < 0 && suidwarn)
5724 		{
5725 			syserr("mailfile: setuid(%ld) failed", (long) RealUid);
5726 			RETURN(EX_TEMPFAIL);
5727 		}
5728 
5729 		if (tTd(11, 2))
5730 			sm_dprintf("mailfile: running as r/euid=%ld/%ld, r/egid=%ld/%ld\n",
5731 				(long) getuid(), (long) geteuid(),
5732 				(long) getgid(), (long) getegid());
5733 
5734 
5735 		/* move into some "safe" directory */
5736 		if (mailer->m_execdir != NULL)
5737 		{
5738 			char *q;
5739 
5740 			for (p = mailer->m_execdir; p != NULL; p = q)
5741 			{
5742 				q = strchr(p, ':');
5743 				if (q != NULL)
5744 					*q = '\0';
5745 				expand(p, buf, sizeof(buf), e);
5746 				if (q != NULL)
5747 					*q++ = ':';
5748 				if (tTd(11, 20))
5749 					sm_dprintf("mailfile: trydir %s\n",
5750 						   buf);
5751 				if (buf[0] != '\0' && chdir(buf) >= 0)
5752 					break;
5753 			}
5754 		}
5755 
5756 		/*
5757 		**  Recheck the file after we have assumed the ID of the
5758 		**  delivery user to make sure we can deliver to it as
5759 		**  that user.  This is necessary if sendmail is running
5760 		**  as root and the file is on an NFS mount which treats
5761 		**  root as nobody.
5762 		*/
5763 
5764 #if HASLSTAT
5765 		if (bitnset(DBS_FILEDELIVERYTOSYMLINK, DontBlameSendmail))
5766 			err = stat(realfile, &stb);
5767 		else
5768 			err = lstat(realfile, &stb);
5769 #else /* HASLSTAT */
5770 		err = stat(realfile, &stb);
5771 #endif /* HASLSTAT */
5772 
5773 		if (err < 0)
5774 		{
5775 			stb.st_mode = ST_MODE_NOFILE;
5776 			mode = FileMode;
5777 			oflags |= O_CREAT|O_EXCL;
5778 		}
5779 		else if (bitset(S_IXUSR|S_IXGRP|S_IXOTH, mode) ||
5780 			 (!bitnset(DBS_FILEDELIVERYTOHARDLINK,
5781 				   DontBlameSendmail) &&
5782 			  stb.st_nlink != 1) ||
5783 			 (realfile != targetfile && !S_ISREG(mode)))
5784 			exit(EX_CANTCREAT);
5785 		else
5786 			mode = stb.st_mode;
5787 
5788 		if (!bitnset(DBS_FILEDELIVERYTOSYMLINK, DontBlameSendmail))
5789 			sfflags |= SFF_NOSLINK;
5790 		if (!bitnset(DBS_FILEDELIVERYTOHARDLINK, DontBlameSendmail))
5791 			sfflags |= SFF_NOHLINK;
5792 		sfflags &= ~SFF_OPENASROOT;
5793 		f = safefopen(realfile, oflags, mode, sfflags);
5794 		if (f == NULL)
5795 		{
5796 			if (transienterror(errno))
5797 			{
5798 				usrerr("454 4.3.0 cannot open %s: %s",
5799 				       shortenstring(realfile, MAXSHORTSTR),
5800 				       sm_errstring(errno));
5801 				RETURN(EX_TEMPFAIL);
5802 			}
5803 			else
5804 			{
5805 				usrerr("554 5.3.0 cannot open %s: %s",
5806 				       shortenstring(realfile, MAXSHORTSTR),
5807 				       sm_errstring(errno));
5808 				RETURN(EX_CANTCREAT);
5809 			}
5810 		}
5811 		if (filechanged(realfile, sm_io_getinfo(f, SM_IO_WHAT_FD, NULL),
5812 		    &stb))
5813 		{
5814 			syserr("554 5.3.0 file changed after open");
5815 			RETURN(EX_CANTCREAT);
5816 		}
5817 		if (fstat(sm_io_getinfo(f, SM_IO_WHAT_FD, NULL), &stb) < 0)
5818 		{
5819 			syserr("554 5.3.0 cannot fstat %s",
5820 				sm_errstring(errno));
5821 			RETURN(EX_CANTCREAT);
5822 		}
5823 
5824 		curoff = stb.st_size;
5825 
5826 		if (ev != NULL)
5827 			sm_clrevent(ev);
5828 
5829 		memset(&mcibuf, '\0', sizeof(mcibuf));
5830 		mcibuf.mci_mailer = mailer;
5831 		mcibuf.mci_out = f;
5832 		if (bitnset(M_7BITS, mailer->m_flags))
5833 			mcibuf.mci_flags |= MCIF_7BIT;
5834 
5835 		/* clear out per-message flags from connection structure */
5836 		mcibuf.mci_flags &= ~(MCIF_CVT7TO8|MCIF_CVT8TO7);
5837 
5838 		if (bitset(EF_HAS8BIT, e->e_flags) &&
5839 		    !bitset(EF_DONT_MIME, e->e_flags) &&
5840 		    bitnset(M_7BITS, mailer->m_flags))
5841 			mcibuf.mci_flags |= MCIF_CVT8TO7;
5842 
5843 #if MIME7TO8
5844 		if (bitnset(M_MAKE8BIT, mailer->m_flags) &&
5845 		    !bitset(MCIF_7BIT, mcibuf.mci_flags) &&
5846 		    (p = hvalue("Content-Transfer-Encoding", e->e_header)) != NULL &&
5847 		    (sm_strcasecmp(p, "quoted-printable") == 0 ||
5848 		     sm_strcasecmp(p, "base64") == 0) &&
5849 		    (p = hvalue("Content-Type", e->e_header)) != NULL)
5850 		{
5851 			/* may want to convert 7 -> 8 */
5852 			/* XXX should really parse it here -- and use a class XXX */
5853 			if (sm_strncasecmp(p, "text/plain", 10) == 0 &&
5854 			    (p[10] == '\0' || p[10] == ' ' || p[10] == ';'))
5855 				mcibuf.mci_flags |= MCIF_CVT7TO8;
5856 		}
5857 #endif /* MIME7TO8 */
5858 
5859 		if (!putfromline(&mcibuf, e) ||
5860 		    !(*e->e_puthdr)(&mcibuf, e->e_header, e, M87F_OUTER) ||
5861 		    !(*e->e_putbody)(&mcibuf, e, NULL) ||
5862 		    !putline("\n", &mcibuf) ||
5863 		    (sm_io_flush(f, SM_TIME_DEFAULT) != 0 ||
5864 		    (SuperSafe != SAFE_NO &&
5865 		     fsync(sm_io_getinfo(f, SM_IO_WHAT_FD, NULL)) < 0) ||
5866 		    sm_io_error(f)))
5867 		{
5868 			setstat(EX_IOERR);
5869 #if !NOFTRUNCATE
5870 			(void) ftruncate(sm_io_getinfo(f, SM_IO_WHAT_FD, NULL),
5871 					 curoff);
5872 #endif
5873 		}
5874 
5875 		/* reset ISUID & ISGID bits for paranoid systems */
5876 #if HASFCHMOD
5877 		(void) fchmod(sm_io_getinfo(f, SM_IO_WHAT_FD, NULL),
5878 			      (MODE_T) mode);
5879 #else /* HASFCHMOD */
5880 		(void) chmod(filename, (MODE_T) mode);
5881 #endif /* HASFCHMOD */
5882 		if (sm_io_close(f, SM_TIME_DEFAULT) < 0)
5883 			setstat(EX_IOERR);
5884 		(void) sm_io_flush(smioout, SM_TIME_DEFAULT);
5885 		(void) setuid(RealUid);
5886 		exit(ExitStat);
5887 		/* NOTREACHED */
5888 	}
5889 	else
5890 	{
5891 		/* parent -- wait for exit status */
5892 		int st;
5893 
5894 		st = waitfor(pid);
5895 		if (st == -1)
5896 		{
5897 			syserr("mailfile: %s: wait", mailer->m_name);
5898 			return EX_SOFTWARE;
5899 		}
5900 		if (WIFEXITED(st))
5901 		{
5902 			errno = 0;
5903 			return (WEXITSTATUS(st));
5904 		}
5905 		else
5906 		{
5907 			syserr("mailfile: %s: child died on signal %d",
5908 			       mailer->m_name, st);
5909 			return EX_UNAVAILABLE;
5910 		}
5911 		/* NOTREACHED */
5912 	}
5913 	return EX_UNAVAILABLE;	/* avoid compiler warning on IRIX */
5914 }
5915 
5916 static void
5917 mailfiletimeout(ignore)
5918 	int ignore;
5919 {
5920 	/*
5921 	**  NOTE: THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
5922 	**	ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
5923 	**	DOING.
5924 	*/
5925 
5926 	errno = ETIMEDOUT;
5927 	longjmp(CtxMailfileTimeout, 1);
5928 }
5929 
5930 #if DANE
5931 
5932 /*
5933 **  GETMPORT -- return the port of a mailer
5934 **
5935 **	Parameters:
5936 **		m -- the mailer describing this host.
5937 **
5938 **	Returns:
5939 **		the port of the mailer if defined.
5940 **		0 otherwise
5941 **		<0 error
5942 */
5943 
5944 static int getmport __P((MAILER *));
5945 
5946 static int
5947 getmport(m)
5948 	MAILER *m;
5949 {
5950 	unsigned long ulval;
5951 	char *buf, *ep;
5952 
5953 	if (m->m_port > 0)
5954 		return m->m_port;
5955 
5956 	if (NULL == m->m_argv[0] ||NULL == m->m_argv[1])
5957 		return -1;
5958 	buf = m->m_argv[2];
5959 	if (NULL == buf)
5960 		return 0;
5961 
5962 	errno = 0;
5963 	ulval = strtoul(buf, &ep, 0);
5964 	if (buf[0] == '\0' || *ep != '\0')
5965 		return -1;
5966 	if (errno == ERANGE && ulval == ULONG_MAX)
5967 		return -1;
5968 	if (ulval > USHRT_MAX)
5969 		return -1;
5970 	m->m_port = (unsigned short) ulval;
5971 	if (tTd(17, 30))
5972 		sm_dprintf("getmport: mailer=%s, port=%d\n", m->m_name,
5973 			m->m_port);
5974 	return m->m_port;
5975 }
5976 # define GETMPORT(m) getmport(m)
5977 #else /* DANE */
5978 # define GETMPORT(m)	25
5979 #endif /* DANE */
5980 
5981 /*
5982 **  HOSTSIGNATURE -- return the "signature" for a host.
5983 **
5984 **	The signature describes how we are going to send this -- it
5985 **	can be just the hostname (for non-Internet hosts) or can be
5986 **	an ordered list of MX hosts.
5987 **
5988 **	Parameters:
5989 **		m -- the mailer describing this host.
5990 **		host -- the host name.
5991 **		ad -- DNSSEC: ad
5992 **
5993 **	Returns:
5994 **		The signature for this host.
5995 **
5996 **	Side Effects:
5997 **		Can tweak the symbol table.
5998 */
5999 
6000 #define MAXHOSTSIGNATURE	8192	/* max len of hostsignature */
6001 
6002 char *
6003 hostsignature(m, host, ad)
6004 	register MAILER *m;
6005 	char *host;
6006 	bool ad;
6007 {
6008 	register char *p;
6009 	register STAB *s;
6010 	time_t now;
6011 #if NAMED_BIND
6012 	char sep = ':';
6013 	char prevsep = ':';
6014 	int i;
6015 	int len;
6016 	int nmx;
6017 	int hl;
6018 	char *hp;
6019 	char *endp;
6020 	int oldoptions = _res.options;
6021 	char *mxhosts[MAXMXHOSTS + 1];
6022 	unsigned short mxprefs[MAXMXHOSTS + 1];
6023 #endif /* NAMED_BIND */
6024 
6025 	if (tTd(17, 3))
6026 		sm_dprintf("hostsignature(%s), ad=%d\n", host, ad);
6027 
6028 	/*
6029 	**  If local delivery (and not remote), just return a constant.
6030 	*/
6031 
6032 	if (bitnset(M_LOCALMAILER, m->m_flags) &&
6033 	    strcmp(m->m_mailer, "[IPC]") != 0 &&
6034 	    !(m->m_argv[0] != NULL && strcmp(m->m_argv[0], "TCP") == 0))
6035 		return "localhost";
6036 
6037 	/* an empty host does not have MX records */
6038 	if (*host == '\0')
6039 		return "_empty_";
6040 
6041 	/*
6042 	**  Check to see if this uses IPC -- if not, it can't have MX records.
6043 	*/
6044 
6045 	if (strcmp(m->m_mailer, "[IPC]") != 0 ||
6046 	    CurEnv->e_sendmode == SM_DEFER)
6047 	{
6048 		/* just an ordinary mailer or deferred mode */
6049 		return host;
6050 	}
6051 #if NETUNIX
6052 	else if (m->m_argv[0] != NULL &&
6053 		 strcmp(m->m_argv[0], "FILE") == 0)
6054 	{
6055 		/* rendezvous in the file system, no MX records */
6056 		return host;
6057 	}
6058 #endif /* NETUNIX */
6059 
6060 	/*
6061 	**  Look it up in the symbol table.
6062 	*/
6063 
6064 	now = curtime();
6065 	s = stab(host, ST_HOSTSIG, ST_ENTER);
6066 	if (s->s_hostsig.hs_sig != NULL)
6067 	{
6068 		if (s->s_hostsig.hs_exp >= now)
6069 		{
6070 			if (tTd(17, 3))
6071 				sm_dprintf("hostsignature(): stab(%s) found %s\n", host,
6072 					   s->s_hostsig.hs_sig);
6073 			return s->s_hostsig.hs_sig;
6074 		}
6075 
6076 		/* signature is expired: clear it */
6077 		sm_free(s->s_hostsig.hs_sig);
6078 		s->s_hostsig.hs_sig = NULL;
6079 	}
6080 
6081 	/* set default TTL */
6082 	s->s_hostsig.hs_exp = now + SM_DEFAULT_TTL;
6083 
6084 	/*
6085 	**  Not already there or expired -- create a signature.
6086 	*/
6087 
6088 #if NAMED_BIND
6089 	if (ConfigLevel < 2)
6090 		_res.options &= ~(RES_DEFNAMES | RES_DNSRCH);	/* XXX */
6091 
6092 	for (hp = host; hp != NULL; hp = endp)
6093 	{
6094 # if NETINET6
6095 		if (*hp == '[')
6096 		{
6097 			endp = strchr(hp + 1, ']');
6098 			if (endp != NULL)
6099 				endp = strpbrk(endp + 1, ":,");
6100 		}
6101 		else
6102 			endp = strpbrk(hp, ":,");
6103 # else /* NETINET6 */
6104 		endp = strpbrk(hp, ":,");
6105 # endif /* NETINET6 */
6106 		if (endp != NULL)
6107 		{
6108 			sep = *endp;
6109 			*endp = '\0';
6110 		}
6111 
6112 		if (bitnset(M_NOMX, m->m_flags))
6113 		{
6114 			/* skip MX lookups */
6115 			nmx = 1;
6116 			mxhosts[0] = hp;
6117 		}
6118 		else
6119 		{
6120 			auto int rcode;
6121 			int ttl;
6122 
6123 			GETMPORT(m);
6124 			nmx = getmxrr(hp, mxhosts, mxprefs,
6125 				      DROPLOCALHOST|TRYFALLBACK|(ad ? ISAD :0),
6126 				      &rcode, &ttl, M_PORT(m));
6127 			if (nmx <= 0)
6128 			{
6129 				int save_errno;
6130 				register MCI *mci;
6131 
6132 				/* update the connection info for this host */
6133 				save_errno = errno;
6134 				mci = mci_get(hp, m);
6135 				mci->mci_errno = save_errno;
6136 				mci->mci_herrno = h_errno;
6137 				mci->mci_lastuse = now;
6138 				if (nmx == NULLMX)
6139 					mci_setstat(mci, rcode, "5.7.27",
6140 						    "550 Host does not accept mail");
6141 				else if (rcode == EX_NOHOST)
6142 					mci_setstat(mci, rcode, "5.1.2",
6143 						    "550 Host unknown");
6144 				else
6145 					mci_setstat(mci, rcode, NULL, NULL);
6146 
6147 				/* use the original host name as signature */
6148 				nmx = 1;
6149 				mxhosts[0] = hp;
6150 			}
6151 			if (tTd(17, 3))
6152 				sm_dprintf("hostsignature(): getmxrr() returned %d, mxhosts[0]=%s\n",
6153 					   nmx, mxhosts[0]);
6154 
6155 			/*
6156 			**  Set new TTL: we use only one!
6157 			**	We could try to use the minimum instead.
6158 			*/
6159 
6160 			s->s_hostsig.hs_exp = now + SM_MIN(ttl, SM_DEFAULT_TTL);
6161 		}
6162 
6163 		len = 0;
6164 		for (i = 0; i < nmx; i++)
6165 			len += strlen(mxhosts[i]) + 1;
6166 		if (s->s_hostsig.hs_sig != NULL)
6167 			len += strlen(s->s_hostsig.hs_sig) + 1;
6168 		if (len < 0 || len >= MAXHOSTSIGNATURE)
6169 		{
6170 			sm_syslog(LOG_WARNING, NOQID, "hostsignature for host '%s' exceeds maxlen (%d): %d",
6171 				  host, MAXHOSTSIGNATURE, len);
6172 			len = MAXHOSTSIGNATURE;
6173 		}
6174 		p = sm_pmalloc_x(len);
6175 		if (s->s_hostsig.hs_sig != NULL)
6176 		{
6177 			(void) sm_strlcpy(p, s->s_hostsig.hs_sig, len);
6178 			sm_free(s->s_hostsig.hs_sig); /* XXX */
6179 			s->s_hostsig.hs_sig = p;
6180 			hl = strlen(p);
6181 			p += hl;
6182 			*p++ = prevsep;
6183 			len -= hl + 1;
6184 		}
6185 		else
6186 			s->s_hostsig.hs_sig = p;
6187 		for (i = 0; i < nmx; i++)
6188 		{
6189 			hl = strlen(mxhosts[i]);
6190 			if (len - 1 < hl || len <= 1)
6191 			{
6192 				/* force to drop out of outer loop */
6193 				len = -1;
6194 				break;
6195 			}
6196 			if (i != 0)
6197 			{
6198 				if (mxprefs[i] == mxprefs[i - 1])
6199 					*p++ = ',';
6200 				else
6201 					*p++ = ':';
6202 				len--;
6203 			}
6204 			(void) sm_strlcpy(p, mxhosts[i], len);
6205 			p += hl;
6206 			len -= hl;
6207 		}
6208 
6209 		/*
6210 		**  break out of loop if len exceeded MAXHOSTSIGNATURE
6211 		**  because we won't have more space for further hosts
6212 		**  anyway (separated by : in the .cf file).
6213 		*/
6214 
6215 		if (len < 0)
6216 			break;
6217 		if (endp != NULL)
6218 			*endp++ = sep;
6219 		prevsep = sep;
6220 	}
6221 	makelower(s->s_hostsig.hs_sig);
6222 	if (ConfigLevel < 2)
6223 		_res.options = oldoptions;
6224 #else /* NAMED_BIND */
6225 	/* not using BIND -- the signature is just the host name */
6226 	/*
6227 	**  'host' points to storage that will be freed after we are
6228 	**  done processing the current envelope, so we copy it.
6229 	*/
6230 	s->s_hostsig.hs_sig = sm_pstrdup_x(host);
6231 #endif /* NAMED_BIND */
6232 	if (tTd(17, 1))
6233 		sm_dprintf("hostsignature(%s) = %s\n", host, s->s_hostsig.hs_sig);
6234 	return s->s_hostsig.hs_sig;
6235 }
6236 /*
6237 **  PARSE_HOSTSIGNATURE -- parse the "signature" and return MX host array.
6238 **
6239 **	The signature describes how we are going to send this -- it
6240 **	can be just the hostname (for non-Internet hosts) or can be
6241 **	an ordered list of MX hosts which must be randomized for equal
6242 **	MX preference values.
6243 **
6244 **	Parameters:
6245 **		sig -- the host signature.
6246 **		mxhosts -- array to populate.
6247 **		mailer -- mailer.
6248 **
6249 **	Returns:
6250 **		The number of hosts inserted into mxhosts array.
6251 **
6252 **	Side Effects:
6253 **		Randomizes equal MX preference hosts in mxhosts.
6254 */
6255 
6256 static int
6257 parse_hostsignature(sig, mxhosts, mailer)
6258 	char *sig;
6259 	char **mxhosts;
6260 	MAILER *mailer;
6261 {
6262 	unsigned short curpref = 0;
6263 	int nmx = 0, i, j;	/* NOTE: i, j, and nmx must have same type */
6264 	char *hp, *endp;
6265 	unsigned short prefer[MAXMXHOSTS];
6266 	long rndm[MAXMXHOSTS];
6267 
6268 	for (hp = sig; hp != NULL; hp = endp)
6269 	{
6270 		char sep = ':';
6271 
6272 #if NETINET6
6273 		if (*hp == '[')
6274 		{
6275 			endp = strchr(hp + 1, ']');
6276 			if (endp != NULL)
6277 				endp = strpbrk(endp + 1, ":,");
6278 		}
6279 		else
6280 			endp = strpbrk(hp, ":,");
6281 #else /* NETINET6 */
6282 		endp = strpbrk(hp, ":,");
6283 #endif /* NETINET6 */
6284 		if (endp != NULL)
6285 		{
6286 			sep = *endp;
6287 			*endp = '\0';
6288 		}
6289 
6290 		mxhosts[nmx] = hp;
6291 		prefer[nmx] = curpref;
6292 		if (mci_match(hp, mailer))
6293 			rndm[nmx] = 0;
6294 		else
6295 			rndm[nmx] = get_random();
6296 
6297 		if (endp != NULL)
6298 		{
6299 			/*
6300 			**  Since we don't have the original MX prefs,
6301 			**  make our own.  If the separator is a ':', that
6302 			**  means the preference for the next host will be
6303 			**  higher than this one, so simply increment curpref.
6304 			*/
6305 
6306 			if (sep == ':')
6307 				curpref++;
6308 
6309 			*endp++ = sep;
6310 		}
6311 		if (++nmx >= MAXMXHOSTS)
6312 			break;
6313 	}
6314 
6315 	/* sort the records using the random factor for equal preferences */
6316 	for (i = 0; i < nmx; i++)
6317 	{
6318 		for (j = i + 1; j < nmx; j++)
6319 		{
6320 			/*
6321 			**  List is already sorted by MX preference, only
6322 			**  need to look for equal preference MX records
6323 			*/
6324 
6325 			if (prefer[i] < prefer[j])
6326 				break;
6327 
6328 			if (prefer[i] > prefer[j] ||
6329 			    (prefer[i] == prefer[j] && rndm[i] > rndm[j]))
6330 			{
6331 				register unsigned short tempp;
6332 				register long tempr;
6333 				register char *temp1;
6334 
6335 				tempp = prefer[i];
6336 				prefer[i] = prefer[j];
6337 				prefer[j] = tempp;
6338 				temp1 = mxhosts[i];
6339 				mxhosts[i] = mxhosts[j];
6340 				mxhosts[j] = temp1;
6341 				tempr = rndm[i];
6342 				rndm[i] = rndm[j];
6343 				rndm[j] = tempr;
6344 			}
6345 		}
6346 	}
6347 	return nmx;
6348 }
6349 
6350 #if STARTTLS
6351 static SSL_CTX	*clt_ctx = NULL;
6352 static bool	tls_ok_clt = true;
6353 
6354 /*
6355 **  SETCLTTLS -- client side TLS: allow/disallow.
6356 **
6357 **	Parameters:
6358 **		tls_ok -- should tls be done?
6359 **
6360 **	Returns:
6361 **		none.
6362 **
6363 **	Side Effects:
6364 **		sets tls_ok_clt (static variable in this module)
6365 */
6366 
6367 void
6368 setclttls(tls_ok)
6369 	bool tls_ok;
6370 {
6371 	tls_ok_clt = tls_ok;
6372 	return;
6373 }
6374 /*
6375 **  INITCLTTLS -- initialize client side TLS
6376 **
6377 **	Parameters:
6378 **		tls_ok -- should tls initialization be done?
6379 **
6380 **	Returns:
6381 **		succeeded?
6382 **
6383 **	Side Effects:
6384 **		sets tls_ok_clt (static variable in this module)
6385 */
6386 
6387 bool
6388 initclttls(tls_ok)
6389 	bool tls_ok;
6390 {
6391 	if (!tls_ok_clt)
6392 		return false;
6393 	tls_ok_clt = tls_ok;
6394 	if (!tls_ok_clt)
6395 		return false;
6396 	if (clt_ctx != NULL)
6397 		return true;	/* already done */
6398 	tls_ok_clt = inittls(&clt_ctx, TLS_I_CLT, Clt_SSL_Options, false,
6399 			CltCertFile, CltKeyFile,
6400 # if _FFR_CLIENTCA
6401 			(CltCACertPath != NULL) ? CltCACertPath :
6402 # endif
6403 				CACertPath,
6404 # if _FFR_CLIENTCA
6405 			(CltCACertFile != NULL) ? CltCACertFile :
6406 # endif
6407 				CACertFile,
6408 			DHParams);
6409 	return tls_ok_clt;
6410 }
6411 
6412 /*
6413 **  STARTTLS -- try to start secure connection (client side)
6414 **
6415 **	Parameters:
6416 **		m -- the mailer.
6417 **		mci -- the mailer connection info.
6418 **		e -- the envelope.
6419 **
6420 **	Returns:
6421 **		success?
6422 **		(maybe this should be some other code than EX_
6423 **		that denotes which stage failed.)
6424 */
6425 
6426 static int
6427 starttls(m, mci, e
6428 # if DANE
6429 	, dane_vrfy_ctx
6430 # endif
6431 	)
6432 	MAILER *m;
6433 	MCI *mci;
6434 	ENVELOPE *e;
6435 # if DANE
6436 	dane_vrfy_ctx_P	dane_vrfy_ctx;
6437 # endif
6438 {
6439 	int smtpresult;
6440 	int result = 0;
6441 	int rfd, wfd;
6442 	SSL *clt_ssl = NULL;
6443 	time_t tlsstart;
6444 	extern int TLSsslidx;
6445 
6446 	if (clt_ctx == NULL && !initclttls(true))
6447 		return EX_TEMPFAIL;
6448 
6449 	if (!TLS_set_engine(SSLEngine, false))
6450 	{
6451 		sm_syslog(LOG_ERR, NOQID,
6452 			  "STARTTLS=client, engine=%s, TLS_set_engine=failed",
6453 			  SSLEngine);
6454 		return EX_TEMPFAIL;
6455 	}
6456 
6457 	smtpmessage("STARTTLS", m, mci);
6458 
6459 	/* get the reply */
6460 	smtpresult = reply(m, mci, e, TimeOuts.to_starttls, NULL, NULL,
6461 			XS_STARTTLS);
6462 
6463 	/* check return code from server */
6464 	if (REPLYTYPE(smtpresult) == 4)
6465 		return EX_TEMPFAIL;
6466 	if (smtpresult == 501)
6467 		return EX_USAGE;
6468 	if (smtpresult == -1)
6469 		return smtpresult;
6470 
6471 	/* not an expected reply but we have to deal with it */
6472 	if (REPLYTYPE(smtpresult) == 5)
6473 		return EX_UNAVAILABLE;
6474 	if (smtpresult != 220)
6475 		return EX_PROTOCOL;
6476 
6477 	if (LogLevel > 13)
6478 		sm_syslog(LOG_INFO, NOQID, "STARTTLS=client, start=ok");
6479 
6480 	/* start connection */
6481 	if ((clt_ssl = SSL_new(clt_ctx)) == NULL)
6482 	{
6483 		if (LogLevel > 5)
6484 		{
6485 			sm_syslog(LOG_ERR, NOQID,
6486 				  "STARTTLS=client, error: SSL_new failed");
6487 			tlslogerr(LOG_WARNING, 9, "client");
6488 		}
6489 		return EX_SOFTWARE;
6490 	}
6491 	/* SSL_clear(clt_ssl); ? */
6492 
6493 	if (get_tls_se_options(e, clt_ssl, &mci->mci_tlsi, false) != 0)
6494 	{
6495 		sm_syslog(LOG_ERR, NOQID,
6496 			  "STARTTLS=client, get_tls_se_options=fail");
6497 		return EX_SOFTWARE;
6498 	}
6499 	result = SSL_set_ex_data(clt_ssl, TLSsslidx, &mci->mci_tlsi);
6500 	if (0 == result)
6501 	{
6502 		if (LogLevel > 5)
6503 		{
6504 			sm_syslog(LOG_ERR, NOQID,
6505 				  "STARTTLS=client, error: SSL_set_ex_data failed=%d, idx=%d",
6506 				  result, TLSsslidx);
6507 			tlslogerr(LOG_WARNING, 9, "client");
6508 		}
6509 		return EX_SOFTWARE;
6510 	}
6511 # if DANE
6512 	if (SM_TLSI_IS(&(mci->mci_tlsi), TLSI_FL_NODANE))
6513 		dane_vrfy_ctx->dane_vrfy_chk = DANE_NEVER;
6514 	else
6515 	{
6516 		int r;
6517 
6518 #  define SM_IS_EMPTY(s)	(NULL == (s) || '\0' == *(s))
6519 
6520 		/* set SNI only if there is a TLSA RR */
6521 		if (dane_get_tlsa(dane_vrfy_ctx) != NULL &&
6522 		    !(SM_IS_EMPTY(dane_vrfy_ctx->dane_vrfy_host) &&
6523 		      SM_IS_EMPTY(dane_vrfy_ctx->dane_vrfy_sni)) &&
6524 		    (r = SSL_set_tlsext_host_name(clt_ssl,
6525 				(!SM_IS_EMPTY(dane_vrfy_ctx->dane_vrfy_sni)
6526 				? dane_vrfy_ctx->dane_vrfy_sni
6527 				: dane_vrfy_ctx->dane_vrfy_host))) <= 0)
6528 		{
6529 			if (LogLevel > 5)
6530 			{
6531 				sm_syslog(LOG_ERR, NOQID,
6532 					  "STARTTLS=client, host=%s, SSL_set_tlsext_host_name=%d",
6533 					  dane_vrfy_ctx->dane_vrfy_host, r);
6534 			}
6535 			tlslogerr(LOG_ERR, 5, "client");
6536 			/* return EX_SOFTWARE; */
6537 		}
6538 	}
6539 	memcpy(&mci->mci_tlsi.tlsi_dvc, dane_vrfy_ctx, sizeof(*dane_vrfy_ctx));
6540 # endif /* DANE */
6541 
6542 	rfd = sm_io_getinfo(mci->mci_in, SM_IO_WHAT_FD, NULL);
6543 	wfd = sm_io_getinfo(mci->mci_out, SM_IO_WHAT_FD, NULL);
6544 
6545 	if (rfd < 0 || wfd < 0 ||
6546 	    (result = SSL_set_rfd(clt_ssl, rfd)) != 1 ||
6547 	    (result = SSL_set_wfd(clt_ssl, wfd)) != 1)
6548 	{
6549 		if (LogLevel > 5)
6550 		{
6551 			sm_syslog(LOG_ERR, NOQID,
6552 				  "STARTTLS=client, error: SSL_set_xfd failed=%d",
6553 				  result);
6554 			tlslogerr(LOG_WARNING, 9, "client");
6555 		}
6556 		return EX_SOFTWARE;
6557 	}
6558 	SSL_set_connect_state(clt_ssl);
6559 	tlsstart = curtime();
6560 
6561 ssl_retry:
6562 	if ((result = SSL_connect(clt_ssl)) <= 0)
6563 	{
6564 		int i, ssl_err;
6565 		int save_errno = errno;
6566 
6567 		ssl_err = SSL_get_error(clt_ssl, result);
6568 		i = tls_retry(clt_ssl, rfd, wfd, tlsstart,
6569 			TimeOuts.to_starttls, ssl_err, "client");
6570 		if (i > 0)
6571 			goto ssl_retry;
6572 
6573 		if (LogLevel > 5)
6574 		{
6575 			unsigned long l;
6576 			const char *sr;
6577 
6578 			l = ERR_peek_error();
6579 			sr = ERR_reason_error_string(l);
6580 			sm_syslog(LOG_WARNING, NOQID,
6581 				  "STARTTLS=client, error: connect failed=%d, reason=%s, SSL_error=%d, errno=%d, retry=%d",
6582 				  result, sr == NULL ? "unknown" : sr, ssl_err,
6583 				  save_errno, i);
6584 			tlslogerr(LOG_WARNING, 9, "client");
6585 		}
6586 
6587 		SM_SSL_FREE(clt_ssl);
6588 		return EX_SOFTWARE;
6589 	}
6590 	mci->mci_ssl = clt_ssl;
6591 	result = tls_get_info(mci->mci_ssl, false, mci->mci_host,
6592 			      &mci->mci_macro, true);
6593 
6594 	/* switch to use TLS... */
6595 	if (sfdctls(&mci->mci_in, &mci->mci_out, mci->mci_ssl) == 0)
6596 		return EX_OK;
6597 
6598 	/* failure */
6599 	SM_SSL_FREE(clt_ssl);
6600 	return EX_SOFTWARE;
6601 }
6602 /*
6603 **  ENDTLSCLT -- shutdown secure connection (client side)
6604 **
6605 **	Parameters:
6606 **		mci -- the mailer connection info.
6607 **
6608 **	Returns:
6609 **		success?
6610 */
6611 
6612 static int
6613 endtlsclt(mci)
6614 	MCI *mci;
6615 {
6616 	int r;
6617 
6618 	if (!bitset(MCIF_TLSACT, mci->mci_flags))
6619 		return EX_OK;
6620 	r = endtls(&mci->mci_ssl, "client");
6621 	mci->mci_flags &= ~MCIF_TLSACT;
6622 	return r;
6623 }
6624 #endif /* STARTTLS */
6625 #if STARTTLS || SASL
6626 /*
6627 **  ISCLTFLGSET -- check whether client flag is set.
6628 **
6629 **	Parameters:
6630 **		e -- envelope.
6631 **		flag -- flag to check in {client_flags}
6632 **
6633 **	Returns:
6634 **		true iff flag is set.
6635 */
6636 
6637 static bool
6638 iscltflgset(e, flag)
6639 	ENVELOPE *e;
6640 	int flag;
6641 {
6642 	char *p;
6643 
6644 	p = macvalue(macid("{client_flags}"), e);
6645 	if (p == NULL)
6646 		return false;
6647 	for (; *p != '\0'; p++)
6648 	{
6649 		/* look for just this one flag */
6650 		if (*p == (char) flag)
6651 			return true;
6652 	}
6653 	return false;
6654 }
6655 #endif /* STARTTLS || SASL */
6656