xref: /freebsd/contrib/sendmail/src/queue.c (revision 6af83ee0d2941d18880b6aaa2b4facd1d30c6106)
1 /*
2  * Copyright (c) 1998-2004 Sendmail, Inc. and its suppliers.
3  *	All rights reserved.
4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
5  * Copyright (c) 1988, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * By using this file, you agree to the terms and conditions set
9  * forth in the LICENSE file which can be found at the top level of
10  * the sendmail distribution.
11  *
12  */
13 
14 #include <sendmail.h>
15 
16 SM_RCSID("@(#)$Id: queue.c,v 8.939 2004/08/03 19:57:23 ca Exp $")
17 
18 #include <dirent.h>
19 
20 # define RELEASE_QUEUE	(void) 0
21 # define ST_INODE(st)	(st).st_ino
22 
23 #  define sm_file_exists(errno) ((errno) == EEXIST)
24 
25 # if HASFLOCK && defined(O_EXLOCK)
26 #   define SM_OPEN_EXLOCK 1
27 #   define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL|O_EXLOCK)
28 # else /* HASFLOCK && defined(O_EXLOCK) */
29 #  define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL)
30 # endif /* HASFLOCK && defined(O_EXLOCK) */
31 
32 #ifndef SM_OPEN_EXLOCK
33 # define SM_OPEN_EXLOCK 0
34 #endif /* ! SM_OPEN_EXLOCK */
35 
36 /*
37 **  Historical notes:
38 **	QF_VERSION == 4 was sendmail 8.10/8.11 without _FFR_QUEUEDELAY
39 **	QF_VERSION == 5 was sendmail 8.10/8.11 with    _FFR_QUEUEDELAY
40 **	QF_VERSION == 6 was sendmail 8.12      without _FFR_QUEUEDELAY
41 **	QF_VERSION == 7 was sendmail 8.12      with    _FFR_QUEUEDELAY
42 **	QF_VERSION == 8 is  sendmail 8.13
43 */
44 
45 #define QF_VERSION	8	/* version number of this queue format */
46 
47 static char	queue_letter __P((ENVELOPE *, int));
48 static bool	quarantine_queue_item __P((int, int, ENVELOPE *, char *));
49 
50 /* Naming convention: qgrp: index of queue group, qg: QUEUEGROUP */
51 
52 /*
53 **  Work queue.
54 */
55 
56 struct work
57 {
58 	char		*w_name;	/* name of control file */
59 	char		*w_host;	/* name of recipient host */
60 	bool		w_lock;		/* is message locked? */
61 	bool		w_tooyoung;	/* is it too young to run? */
62 	long		w_pri;		/* priority of message, see below */
63 	time_t		w_ctime;	/* creation time */
64 	time_t		w_mtime;	/* modification time */
65 	int		w_qgrp;		/* queue group located in */
66 	int		w_qdir;		/* queue directory located in */
67 	struct work	*w_next;	/* next in queue */
68 };
69 
70 typedef struct work	WORK;
71 
72 static WORK	*WorkQ;		/* queue of things to be done */
73 static int	NumWorkGroups;	/* number of work groups */
74 static time_t	Current_LA_time = 0;
75 
76 /* Get new load average every 30 seconds. */
77 #define GET_NEW_LA_TIME	30
78 
79 #define SM_GET_LA(now)	\
80 	do							\
81 	{							\
82 		now = curtime();				\
83 		if (Current_LA_time < now - GET_NEW_LA_TIME)	\
84 		{						\
85 			sm_getla();				\
86 			Current_LA_time = now;			\
87 		}						\
88 	} while (0)
89 
90 /*
91 **  DoQueueRun indicates that a queue run is needed.
92 **	Notice: DoQueueRun is modified in a signal handler!
93 */
94 
95 static bool	volatile DoQueueRun; /* non-interrupt time queue run needed */
96 
97 /*
98 **  Work group definition structure.
99 **	Each work group contains one or more queue groups. This is done
100 **	to manage the number of queue group runners active at the same time
101 **	to be within the constraints of MaxQueueChildren (if it is set).
102 **	The number of queue groups that can be run on the next work run
103 **	is kept track of. The queue groups are run in a round robin.
104 */
105 
106 struct workgrp
107 {
108 	int		wg_numqgrp;	/* number of queue groups in work grp */
109 	int		wg_runners;	/* total runners */
110 	int		wg_curqgrp;	/* current queue group */
111 	QUEUEGRP	**wg_qgs;	/* array of queue groups */
112 	int		wg_maxact;	/* max # of active runners */
113 	time_t		wg_lowqintvl;	/* lowest queue interval */
114 	int		wg_restart;	/* needs restarting? */
115 	int		wg_restartcnt;	/* count of times restarted */
116 };
117 
118 typedef struct workgrp WORKGRP;
119 
120 static WORKGRP	volatile WorkGrp[MAXWORKGROUPS + 1];	/* work groups */
121 
122 #if SM_HEAP_CHECK
123 static SM_DEBUG_T DebugLeakQ = SM_DEBUG_INITIALIZER("leak_q",
124 	"@(#)$Debug: leak_q - trace memory leaks during queue processing $");
125 #endif /* SM_HEAP_CHECK */
126 
127 /*
128 **  We use EmptyString instead of "" to avoid
129 **  'zero-length format string' warnings from gcc
130 */
131 
132 static const char EmptyString[] = "";
133 
134 static void	grow_wlist __P((int, int));
135 static int	multiqueue_cache __P((char *, int, QUEUEGRP *, int, unsigned int *));
136 static int	gatherq __P((int, int, bool, bool *, bool *));
137 static int	sortq __P((int));
138 static void	printctladdr __P((ADDRESS *, SM_FILE_T *));
139 static bool	readqf __P((ENVELOPE *, bool));
140 static void	restart_work_group __P((int));
141 static void	runner_work __P((ENVELOPE *, int, bool, int, int));
142 static void	schedule_queue_runs __P((bool, int, bool));
143 static char	*strrev __P((char *));
144 static ADDRESS	*setctluser __P((char *, int, ENVELOPE *));
145 #if _FFR_RHS
146 static int	sm_strshufflecmp __P((char *, char *));
147 static void	init_shuffle_alphabet __P(());
148 #endif /* _FFR_RHS */
149 static int	workcmpf0();
150 static int	workcmpf1();
151 static int	workcmpf2();
152 static int	workcmpf3();
153 static int	workcmpf4();
154 static int	randi = 3;	/* index for workcmpf5() */
155 static int	workcmpf5();
156 static int	workcmpf6();
157 #if _FFR_RHS
158 static int	workcmpf7();
159 #endif /* _FFR_RHS */
160 
161 #if RANDOMSHIFT
162 # define get_rand_mod(m)	((get_random() >> RANDOMSHIFT) % (m))
163 #else /* RANDOMSHIFT */
164 # define get_rand_mod(m)	(get_random() % (m))
165 #endif /* RANDOMSHIFT */
166 
167 /*
168 **  File system definition.
169 **	Used to keep track of how much free space is available
170 **	on a file system in which one or more queue directories reside.
171 */
172 
173 typedef struct filesys_shared	FILESYS;
174 
175 struct filesys_shared
176 {
177 	dev_t	fs_dev;		/* unique device id */
178 	long	fs_avail;	/* number of free blocks available */
179 	long	fs_blksize;	/* block size, in bytes */
180 };
181 
182 /* probably kept in shared memory */
183 static FILESYS	FileSys[MAXFILESYS];	/* queue file systems */
184 static char	*FSPath[MAXFILESYS];	/* pathnames for file systems */
185 
186 #if SM_CONF_SHM
187 
188 /*
189 **  Shared memory data
190 **
191 **  Current layout:
192 **	size -- size of shared memory segment
193 **	pid -- pid of owner, should be a unique id to avoid misinterpretations
194 **		by other processes.
195 **	tag -- should be a unique id to avoid misinterpretations by others.
196 **		idea: hash over configuration data that will be stored here.
197 **	NumFileSys -- number of file systems.
198 **	FileSys -- (arrary of) structure for used file systems.
199 **	RSATmpCnt -- counter for number of uses of ephemeral RSA key.
200 **	QShm -- (array of) structure for information about queue directories.
201 */
202 
203 /*
204 **  Queue data in shared memory
205 */
206 
207 typedef struct queue_shared	QUEUE_SHM_T;
208 
209 struct queue_shared
210 {
211 	int	qs_entries;	/* number of entries */
212 	/* XXX more to follow? */
213 };
214 
215 static void	*Pshm;		/* pointer to shared memory */
216 static FILESYS	*PtrFileSys;	/* pointer to queue file system array */
217 int		ShmId = SM_SHM_NO_ID;	/* shared memory id */
218 static QUEUE_SHM_T	*QShm;		/* pointer to shared queue data */
219 static size_t shms;
220 
221 # define SHM_OFF_PID(p)	(((char *) (p)) + sizeof(int))
222 # define SHM_OFF_TAG(p)	(((char *) (p)) + sizeof(pid_t) + sizeof(int))
223 # define SHM_OFF_HEAD	(sizeof(pid_t) + sizeof(int) * 2)
224 
225 /* how to access FileSys */
226 # define FILE_SYS(i)	(PtrFileSys[i])
227 
228 /* first entry is a tag, for now just the size */
229 # define OFF_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD)
230 
231 /* offset for PNumFileSys */
232 # define OFF_NUM_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys))
233 
234 /* offset for PRSATmpCnt */
235 # define OFF_RSA_TMP_CNT(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int))
236 int	*PRSATmpCnt;
237 
238 /* offset for queue_shm */
239 # define OFF_QUEUE_SHM(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
240 
241 # define QSHM_ENTRIES(i)	QShm[i].qs_entries
242 
243 /* basic size of shared memory segment */
244 # define SM_T_SIZE	(SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
245 
246 static unsigned int	hash_q __P((char *, unsigned int));
247 
248 /*
249 **  HASH_Q -- simple hash function
250 **
251 **	Parameters:
252 **		p -- string to hash.
253 **		h -- hash start value (from previous run).
254 **
255 **	Returns:
256 **		hash value.
257 */
258 
259 static unsigned int
260 hash_q(p, h)
261 	char *p;
262 	unsigned int h;
263 {
264 	int c, d;
265 
266 	while (*p != '\0')
267 	{
268 		d = *p++;
269 		c = d;
270 		c ^= c<<6;
271 		h += (c<<11) ^ (c>>1);
272 		h ^= (d<<14) + (d<<7) + (d<<4) + d;
273 	}
274 	return h;
275 }
276 
277 
278 #else /* SM_CONF_SHM */
279 # define FILE_SYS(i)	FileSys[i]
280 #endif /* SM_CONF_SHM */
281 
282 /* access to the various components of file system data */
283 #define FILE_SYS_NAME(i)	FSPath[i]
284 #define FILE_SYS_AVAIL(i)	FILE_SYS(i).fs_avail
285 #define FILE_SYS_BLKSIZE(i)	FILE_SYS(i).fs_blksize
286 #define FILE_SYS_DEV(i)	FILE_SYS(i).fs_dev
287 
288 
289 /*
290 **  Current qf file field assignments:
291 **
292 **	A	AUTH= parameter
293 **	B	body type
294 **	C	controlling user
295 **	D	data file name
296 **	d	data file directory name (added in 8.12)
297 **	E	error recipient
298 **	F	flag bits
299 **	G	free (was: queue delay algorithm if _FFR_QUEUEDELAY)
300 **	H	header
301 **	I	data file's inode number
302 **	K	time of last delivery attempt
303 **	L	Solaris Content-Length: header (obsolete)
304 **	M	message
305 **	N	number of delivery attempts
306 **	P	message priority
307 **	q	quarantine reason
308 **	Q	original recipient (ORCPT=)
309 **	r	final recipient (Final-Recipient: DSN field)
310 **	R	recipient
311 **	S	sender
312 **	T	init time
313 **	V	queue file version
314 **	X	free (was: character set if _FFR_SAVE_CHARSET)
315 **	Y	free (was: current delay if _FFR_QUEUEDELAY)
316 **	Z	original envelope id from ESMTP
317 **	!	deliver by (added in 8.12)
318 **	$	define macro
319 **	.	terminate file
320 */
321 
322 /*
323 **  QUEUEUP -- queue a message up for future transmission.
324 **
325 **	Parameters:
326 **		e -- the envelope to queue up.
327 **		announce -- if true, tell when you are queueing up.
328 **		msync -- if true, then fsync() if SuperSafe interactive mode.
329 **
330 **	Returns:
331 **		none.
332 **
333 **	Side Effects:
334 **		The current request is saved in a control file.
335 **		The queue file is left locked.
336 */
337 
338 void
339 queueup(e, announce, msync)
340 	register ENVELOPE *e;
341 	bool announce;
342 	bool msync;
343 {
344 	register SM_FILE_T *tfp;
345 	register HDR *h;
346 	register ADDRESS *q;
347 	int tfd = -1;
348 	int i;
349 	bool newid;
350 	register char *p;
351 	MAILER nullmailer;
352 	MCI mcibuf;
353 	char qf[MAXPATHLEN];
354 	char tf[MAXPATHLEN];
355 	char df[MAXPATHLEN];
356 	char buf[MAXLINE];
357 
358 	/*
359 	**  Create control file.
360 	*/
361 
362 #define OPEN_TF	do							\
363 		{							\
364 			MODE_T oldumask = 0;				\
365 									\
366 			if (bitset(S_IWGRP, QueueFileMode))		\
367 				oldumask = umask(002);			\
368 			tfd = open(tf, TF_OPEN_FLAGS, QueueFileMode);	\
369 			if (bitset(S_IWGRP, QueueFileMode))		\
370 				(void) umask(oldumask);			\
371 		} while (0)
372 
373 
374 	newid = (e->e_id == NULL) || !bitset(EF_INQUEUE, e->e_flags);
375 	(void) sm_strlcpy(tf, queuename(e, NEWQFL_LETTER), sizeof tf);
376 	tfp = e->e_lockfp;
377 	if (tfp == NULL && newid)
378 	{
379 		/*
380 		**  open qf file directly: this will give an error if the file
381 		**  already exists and hence prevent problems if a queue-id
382 		**  is reused (e.g., because the clock is set back).
383 		*/
384 
385 		(void) sm_strlcpy(tf, queuename(e, ANYQFL_LETTER), sizeof tf);
386 		OPEN_TF;
387 		if (tfd < 0 ||
388 #if !SM_OPEN_EXLOCK
389 		    !lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB) ||
390 #endif /* !SM_OPEN_EXLOCK */
391 		    (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
392 					 (void *) &tfd, SM_IO_WRONLY,
393 					 NULL)) == NULL)
394 		{
395 			int save_errno = errno;
396 
397 			printopenfds(true);
398 			errno = save_errno;
399 			syserr("!queueup: cannot create queue file %s, euid=%d, fd=%d, fp=%p",
400 				tf, (int) geteuid(), tfd, tfp);
401 			/* NOTREACHED */
402 		}
403 		e->e_lockfp = tfp;
404 	}
405 
406 	/* if newid, write the queue file directly (instead of temp file) */
407 	if (!newid)
408 	{
409 		/* get a locked tf file */
410 		for (i = 0; i < 128; i++)
411 		{
412 			if (tfd < 0)
413 			{
414 				OPEN_TF;
415 				if (tfd < 0)
416 				{
417 					if (errno != EEXIST)
418 						break;
419 					if (LogLevel > 0 && (i % 32) == 0)
420 						sm_syslog(LOG_ALERT, e->e_id,
421 							  "queueup: cannot create %s, uid=%d: %s",
422 							  tf, (int) geteuid(),
423 							  sm_errstring(errno));
424 				}
425 #if SM_OPEN_EXLOCK
426 				else
427 					break;
428 #endif /* SM_OPEN_EXLOCK */
429 			}
430 			if (tfd >= 0)
431 			{
432 #if SM_OPEN_EXLOCK
433 				/* file is locked by open() */
434 				break;
435 #else /* SM_OPEN_EXLOCK */
436 				if (lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB))
437 					break;
438 				else
439 #endif /* SM_OPEN_EXLOCK */
440 				if (LogLevel > 0 && (i % 32) == 0)
441 					sm_syslog(LOG_ALERT, e->e_id,
442 						  "queueup: cannot lock %s: %s",
443 						  tf, sm_errstring(errno));
444 				if ((i % 32) == 31)
445 				{
446 					(void) close(tfd);
447 					tfd = -1;
448 				}
449 			}
450 
451 			if ((i % 32) == 31)
452 			{
453 				/* save the old temp file away */
454 				(void) rename(tf, queuename(e, TEMPQF_LETTER));
455 			}
456 			else
457 				(void) sleep(i % 32);
458 		}
459 		if (tfd < 0 || (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
460 						 (void *) &tfd, SM_IO_WRONLY_B,
461 						 NULL)) == NULL)
462 		{
463 			int save_errno = errno;
464 
465 			printopenfds(true);
466 			errno = save_errno;
467 			syserr("!queueup: cannot create queue temp file %s, uid=%d",
468 				tf, (int) geteuid());
469 		}
470 	}
471 
472 	if (tTd(40, 1))
473 		sm_dprintf("\n>>>>> queueing %s/%s%s >>>>>\n",
474 			   qid_printqueue(e->e_qgrp, e->e_qdir),
475 			   queuename(e, ANYQFL_LETTER),
476 			   newid ? " (new id)" : "");
477 	if (tTd(40, 3))
478 	{
479 		sm_dprintf("  e_flags=");
480 		printenvflags(e);
481 	}
482 	if (tTd(40, 32))
483 	{
484 		sm_dprintf("  sendq=");
485 		printaddr(sm_debug_file(), e->e_sendqueue, true);
486 	}
487 	if (tTd(40, 9))
488 	{
489 		sm_dprintf("  tfp=");
490 		dumpfd(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL), true, false);
491 		sm_dprintf("  lockfp=");
492 		if (e->e_lockfp == NULL)
493 			sm_dprintf("NULL\n");
494 		else
495 			dumpfd(sm_io_getinfo(e->e_lockfp, SM_IO_WHAT_FD, NULL),
496 			       true, false);
497 	}
498 
499 	/*
500 	**  If there is no data file yet, create one.
501 	*/
502 
503 	(void) sm_strlcpy(df, queuename(e, DATAFL_LETTER), sizeof df);
504 	if (bitset(EF_HAS_DF, e->e_flags))
505 	{
506 		if (e->e_dfp != NULL &&
507 		    SuperSafe != SAFE_REALLY &&
508 		    SuperSafe != SAFE_REALLY_POSTMILTER &&
509 		    sm_io_setinfo(e->e_dfp, SM_BF_COMMIT, NULL) < 0 &&
510 		    errno != EINVAL)
511 		{
512 			syserr("!queueup: cannot commit data file %s, uid=%d",
513 			       queuename(e, DATAFL_LETTER), (int) geteuid());
514 		}
515 		if (e->e_dfp != NULL &&
516 		    SuperSafe == SAFE_INTERACTIVE && msync)
517 		{
518 			if (tTd(40,32))
519 				sm_syslog(LOG_INFO, e->e_id,
520 					  "queueup: fsync(e->e_dfp)");
521 
522 			if (fsync(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD,
523 						NULL)) < 0)
524 			{
525 				if (newid)
526 					syserr("!552 Error writing data file %s",
527 					       df);
528 				else
529 					syserr("!452 Error writing data file %s",
530 					       df);
531 			}
532 		}
533 	}
534 	else
535 	{
536 		int dfd;
537 		MODE_T oldumask = 0;
538 		register SM_FILE_T *dfp = NULL;
539 		struct stat stbuf;
540 
541 		if (e->e_dfp != NULL &&
542 		    sm_io_getinfo(e->e_dfp, SM_IO_WHAT_ISTYPE, BF_FILE_TYPE))
543 			syserr("committing over bf file");
544 
545 		if (bitset(S_IWGRP, QueueFileMode))
546 			oldumask = umask(002);
547 		dfd = open(df, O_WRONLY|O_CREAT|O_TRUNC|QF_O_EXTRA,
548 			   QueueFileMode);
549 		if (bitset(S_IWGRP, QueueFileMode))
550 			(void) umask(oldumask);
551 		if (dfd < 0 || (dfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
552 						 (void *) &dfd, SM_IO_WRONLY_B,
553 						 NULL)) == NULL)
554 			syserr("!queueup: cannot create data temp file %s, uid=%d",
555 				df, (int) geteuid());
556 		if (fstat(dfd, &stbuf) < 0)
557 			e->e_dfino = -1;
558 		else
559 		{
560 			e->e_dfdev = stbuf.st_dev;
561 			e->e_dfino = ST_INODE(stbuf);
562 		}
563 		e->e_flags |= EF_HAS_DF;
564 		memset(&mcibuf, '\0', sizeof mcibuf);
565 		mcibuf.mci_out = dfp;
566 		mcibuf.mci_mailer = FileMailer;
567 		(*e->e_putbody)(&mcibuf, e, NULL);
568 
569 		if (SuperSafe == SAFE_REALLY ||
570 		    SuperSafe == SAFE_REALLY_POSTMILTER ||
571 		    (SuperSafe == SAFE_INTERACTIVE && msync))
572 		{
573 			if (tTd(40,32))
574 				sm_syslog(LOG_INFO, e->e_id,
575 					  "queueup: fsync(dfp)");
576 
577 			if (fsync(sm_io_getinfo(dfp, SM_IO_WHAT_FD, NULL)) < 0)
578 			{
579 				if (newid)
580 					syserr("!552 Error writing data file %s",
581 					       df);
582 				else
583 					syserr("!452 Error writing data file %s",
584 					       df);
585 			}
586 		}
587 
588 		if (sm_io_close(dfp, SM_TIME_DEFAULT) < 0)
589 			syserr("!queueup: cannot save data temp file %s, uid=%d",
590 				df, (int) geteuid());
591 		e->e_putbody = putbody;
592 	}
593 
594 	/*
595 	**  Output future work requests.
596 	**	Priority and creation time should be first, since
597 	**	they are required by gatherq.
598 	*/
599 
600 	/* output queue version number (must be first!) */
601 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "V%d\n", QF_VERSION);
602 
603 	/* output creation time */
604 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "T%ld\n", (long) e->e_ctime);
605 
606 	/* output last delivery time */
607 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "K%ld\n", (long) e->e_dtime);
608 
609 	/* output number of delivery attempts */
610 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "N%d\n", e->e_ntries);
611 
612 	/* output message priority */
613 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "P%ld\n", e->e_msgpriority);
614 
615 	/*
616 	**  If data file is in a different directory than the queue file,
617 	**  output a "d" record naming the directory of the data file.
618 	*/
619 
620 	if (e->e_dfqgrp != e->e_qgrp)
621 	{
622 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "d%s\n",
623 			Queue[e->e_dfqgrp]->qg_qpaths[e->e_dfqdir].qp_name);
624 	}
625 
626 	/* output inode number of data file */
627 	/* XXX should probably include device major/minor too */
628 	if (e->e_dfino != -1)
629 	{
630 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "I%ld/%ld/%llu\n",
631 				     (long) major(e->e_dfdev),
632 				     (long) minor(e->e_dfdev),
633 				     (ULONGLONG_T) e->e_dfino);
634 	}
635 
636 	/* output body type */
637 	if (e->e_bodytype != NULL)
638 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "B%s\n",
639 				     denlstring(e->e_bodytype, true, false));
640 
641 	/* quarantine reason */
642 	if (e->e_quarmsg != NULL)
643 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "q%s\n",
644 				     denlstring(e->e_quarmsg, true, false));
645 
646 	/* message from envelope, if it exists */
647 	if (e->e_message != NULL)
648 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
649 				     denlstring(e->e_message, true, false));
650 
651 	/* send various flag bits through */
652 	p = buf;
653 	if (bitset(EF_WARNING, e->e_flags))
654 		*p++ = 'w';
655 	if (bitset(EF_RESPONSE, e->e_flags))
656 		*p++ = 'r';
657 	if (bitset(EF_HAS8BIT, e->e_flags))
658 		*p++ = '8';
659 	if (bitset(EF_DELETE_BCC, e->e_flags))
660 		*p++ = 'b';
661 	if (bitset(EF_RET_PARAM, e->e_flags))
662 		*p++ = 'd';
663 	if (bitset(EF_NO_BODY_RETN, e->e_flags))
664 		*p++ = 'n';
665 	if (bitset(EF_SPLIT, e->e_flags))
666 		*p++ = 's';
667 	*p++ = '\0';
668 	if (buf[0] != '\0')
669 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "F%s\n", buf);
670 
671 	/* save $={persistentMacros} macro values */
672 	queueup_macros(macid("{persistentMacros}"), tfp, e);
673 
674 	/* output name of sender */
675 	if (bitnset(M_UDBENVELOPE, e->e_from.q_mailer->m_flags))
676 		p = e->e_sender;
677 	else
678 		p = e->e_from.q_paddr;
679 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "S%s\n",
680 			     denlstring(p, true, false));
681 
682 	/* output ESMTP-supplied "original" information */
683 	if (e->e_envid != NULL)
684 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Z%s\n",
685 				     denlstring(e->e_envid, true, false));
686 
687 	/* output AUTH= parameter */
688 	if (e->e_auth_param != NULL)
689 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "A%s\n",
690 				     denlstring(e->e_auth_param, true, false));
691 	if (e->e_dlvr_flag != 0)
692 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "!%c %ld\n",
693 				     (char) e->e_dlvr_flag, e->e_deliver_by);
694 
695 	/* output list of recipient addresses */
696 	printctladdr(NULL, NULL);
697 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
698 	{
699 		if (!QS_IS_UNDELIVERED(q->q_state))
700 			continue;
701 
702 		/* message for this recipient, if it exists */
703 		if (q->q_message != NULL)
704 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
705 					     denlstring(q->q_message, true,
706 							false));
707 
708 		printctladdr(q, tfp);
709 		if (q->q_orcpt != NULL)
710 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Q%s\n",
711 					     denlstring(q->q_orcpt, true,
712 							false));
713 		if (q->q_finalrcpt != NULL)
714 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "r%s\n",
715 					     denlstring(q->q_finalrcpt, true,
716 							false));
717 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'R');
718 		if (bitset(QPRIMARY, q->q_flags))
719 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'P');
720 		if (bitset(QHASNOTIFY, q->q_flags))
721 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'N');
722 		if (bitset(QPINGONSUCCESS, q->q_flags))
723 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'S');
724 		if (bitset(QPINGONFAILURE, q->q_flags))
725 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'F');
726 		if (bitset(QPINGONDELAY, q->q_flags))
727 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'D');
728 		if (q->q_alias != NULL &&
729 		    bitset(QALIAS, q->q_alias->q_flags))
730 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'A');
731 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, ':');
732 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s\n",
733 				     denlstring(q->q_paddr, true, false));
734 		if (announce)
735 		{
736 			char *tag = "queued";
737 
738 			if (e->e_quarmsg != NULL)
739 				tag = "quarantined";
740 
741 			e->e_to = q->q_paddr;
742 			message(tag);
743 			if (LogLevel > 8)
744 				logdelivery(q->q_mailer, NULL, q->q_status,
745 					    tag, NULL, (time_t) 0, e);
746 			e->e_to = NULL;
747 		}
748 		if (tTd(40, 1))
749 		{
750 			sm_dprintf("queueing ");
751 			printaddr(sm_debug_file(), q, false);
752 		}
753 	}
754 
755 	/*
756 	**  Output headers for this message.
757 	**	Expand macros completely here.  Queue run will deal with
758 	**	everything as absolute headers.
759 	**		All headers that must be relative to the recipient
760 	**		can be cracked later.
761 	**	We set up a "null mailer" -- i.e., a mailer that will have
762 	**	no effect on the addresses as they are output.
763 	*/
764 
765 	memset((char *) &nullmailer, '\0', sizeof nullmailer);
766 	nullmailer.m_re_rwset = nullmailer.m_rh_rwset =
767 			nullmailer.m_se_rwset = nullmailer.m_sh_rwset = -1;
768 	nullmailer.m_eol = "\n";
769 	memset(&mcibuf, '\0', sizeof mcibuf);
770 	mcibuf.mci_mailer = &nullmailer;
771 	mcibuf.mci_out = tfp;
772 
773 	macdefine(&e->e_macro, A_PERM, 'g', "\201f");
774 	for (h = e->e_header; h != NULL; h = h->h_link)
775 	{
776 		if (h->h_value == NULL)
777 			continue;
778 
779 		/* don't output resent headers on non-resent messages */
780 		if (bitset(H_RESENT, h->h_flags) &&
781 		    !bitset(EF_RESENT, e->e_flags))
782 			continue;
783 
784 		/* expand macros; if null, don't output header at all */
785 		if (bitset(H_DEFAULT, h->h_flags))
786 		{
787 			(void) expand(h->h_value, buf, sizeof buf, e);
788 			if (buf[0] == '\0')
789 				continue;
790 		}
791 
792 		/* output this header */
793 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "H?");
794 
795 		/* output conditional macro if present */
796 		if (h->h_macro != '\0')
797 		{
798 			if (bitset(0200, h->h_macro))
799 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
800 						     "${%s}",
801 						      macname(bitidx(h->h_macro)));
802 			else
803 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
804 						     "$%c", h->h_macro);
805 		}
806 		else if (!bitzerop(h->h_mflags) &&
807 			 bitset(H_CHECK|H_ACHECK, h->h_flags))
808 		{
809 			int j;
810 
811 			/* if conditional, output the set of conditions */
812 			for (j = '\0'; j <= '\177'; j++)
813 				if (bitnset(j, h->h_mflags))
814 					(void) sm_io_putc(tfp, SM_TIME_DEFAULT,
815 							  j);
816 		}
817 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, '?');
818 
819 		/* output the header: expand macros, convert addresses */
820 		if (bitset(H_DEFAULT, h->h_flags) &&
821 		    !bitset(H_BINDLATE, h->h_flags))
822 		{
823 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s: %s\n",
824 					     h->h_field,
825 					     denlstring(buf, false, true));
826 		}
827 		else if (bitset(H_FROM|H_RCPT, h->h_flags) &&
828 			 !bitset(H_BINDLATE, h->h_flags))
829 		{
830 			bool oldstyle = bitset(EF_OLDSTYLE, e->e_flags);
831 			SM_FILE_T *savetrace = TrafficLogFile;
832 
833 			TrafficLogFile = NULL;
834 
835 			if (bitset(H_FROM, h->h_flags))
836 				oldstyle = false;
837 
838 			commaize(h, h->h_value, oldstyle, &mcibuf, e);
839 
840 			TrafficLogFile = savetrace;
841 		}
842 		else
843 		{
844 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s: %s\n",
845 					     h->h_field,
846 					     denlstring(h->h_value, false,
847 							true));
848 		}
849 	}
850 
851 	/*
852 	**  Clean up.
853 	**
854 	**	Write a terminator record -- this is to prevent
855 	**	scurrilous crackers from appending any data.
856 	*/
857 
858 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ".\n");
859 
860 	if (sm_io_flush(tfp, SM_TIME_DEFAULT) != 0 ||
861 	    ((SuperSafe == SAFE_REALLY ||
862 	      SuperSafe == SAFE_REALLY_POSTMILTER ||
863 	      (SuperSafe == SAFE_INTERACTIVE && msync)) &&
864 	     fsync(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL)) < 0) ||
865 	    sm_io_error(tfp))
866 	{
867 		if (newid)
868 			syserr("!552 Error writing control file %s", tf);
869 		else
870 			syserr("!452 Error writing control file %s", tf);
871 	}
872 
873 	if (!newid)
874 	{
875 		char new = queue_letter(e, ANYQFL_LETTER);
876 
877 		/* rename (locked) tf to be (locked) [qh]f */
878 		(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER),
879 				  sizeof qf);
880 		if (rename(tf, qf) < 0)
881 			syserr("cannot rename(%s, %s), uid=%d",
882 				tf, qf, (int) geteuid());
883 		else
884 		{
885 			/*
886 			**  Check if type has changed and only
887 			**  remove the old item if the rename above
888 			**  succeeded.
889 			*/
890 
891 			if (e->e_qfletter != '\0' &&
892 			    e->e_qfletter != new)
893 			{
894 				if (tTd(40, 5))
895 				{
896 					sm_dprintf("type changed from %c to %c\n",
897 						   e->e_qfletter, new);
898 				}
899 
900 				if (unlink(queuename(e, e->e_qfletter)) < 0)
901 				{
902 					/* XXX: something more drastic? */
903 					if (LogLevel > 0)
904 						sm_syslog(LOG_ERR, e->e_id,
905 							  "queueup: unlink(%s) failed: %s",
906 							  queuename(e, e->e_qfletter),
907 							  sm_errstring(errno));
908 				}
909 			}
910 		}
911 		e->e_qfletter = new;
912 
913 		/*
914 		**  fsync() after renaming to make sure metadata is
915 		**  written to disk on filesystems in which renames are
916 		**  not guaranteed.
917 		*/
918 
919 		if (SuperSafe != SAFE_NO)
920 		{
921 			/* for softupdates */
922 			if (tfd >= 0 && fsync(tfd) < 0)
923 			{
924 				syserr("!queueup: cannot fsync queue temp file %s",
925 				       tf);
926 			}
927 			SYNC_DIR(qf, true);
928 		}
929 
930 		/* close and unlock old (locked) queue file */
931 		if (e->e_lockfp != NULL)
932 			(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
933 		e->e_lockfp = tfp;
934 
935 		/* save log info */
936 		if (LogLevel > 79)
937 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", qf);
938 	}
939 	else
940 	{
941 		/* save log info */
942 		if (LogLevel > 79)
943 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", tf);
944 
945 		e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
946 	}
947 
948 	errno = 0;
949 	e->e_flags |= EF_INQUEUE;
950 
951 	if (tTd(40, 1))
952 		sm_dprintf("<<<<< done queueing %s <<<<<\n\n", e->e_id);
953 	return;
954 }
955 
956 /*
957 **  PRINTCTLADDR -- print control address to file.
958 **
959 **	Parameters:
960 **		a -- address.
961 **		tfp -- file pointer.
962 **
963 **	Returns:
964 **		none.
965 **
966 **	Side Effects:
967 **		The control address (if changed) is printed to the file.
968 **		The last control address and uid are saved.
969 */
970 
971 static void
972 printctladdr(a, tfp)
973 	register ADDRESS *a;
974 	SM_FILE_T *tfp;
975 {
976 	char *user;
977 	register ADDRESS *q;
978 	uid_t uid;
979 	gid_t gid;
980 	static ADDRESS *lastctladdr = NULL;
981 	static uid_t lastuid;
982 
983 	/* initialization */
984 	if (a == NULL || a->q_alias == NULL || tfp == NULL)
985 	{
986 		if (lastctladdr != NULL && tfp != NULL)
987 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C\n");
988 		lastctladdr = NULL;
989 		lastuid = 0;
990 		return;
991 	}
992 
993 	/* find the active uid */
994 	q = getctladdr(a);
995 	if (q == NULL)
996 	{
997 		user = NULL;
998 		uid = 0;
999 		gid = 0;
1000 	}
1001 	else
1002 	{
1003 		user = q->q_ruser != NULL ? q->q_ruser : q->q_user;
1004 		uid = q->q_uid;
1005 		gid = q->q_gid;
1006 	}
1007 	a = a->q_alias;
1008 
1009 	/* check to see if this is the same as last time */
1010 	if (lastctladdr != NULL && uid == lastuid &&
1011 	    strcmp(lastctladdr->q_paddr, a->q_paddr) == 0)
1012 		return;
1013 	lastuid = uid;
1014 	lastctladdr = a;
1015 
1016 	if (uid == 0 || user == NULL || user[0] == '\0')
1017 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C");
1018 	else
1019 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C%s:%ld:%ld",
1020 				     denlstring(user, true, false), (long) uid,
1021 				     (long) gid);
1022 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ":%s\n",
1023 			     denlstring(a->q_paddr, true, false));
1024 }
1025 
1026 /*
1027 **  RUNNERS_SIGTERM -- propagate a SIGTERM to queue runner process
1028 **
1029 **	This propagates the signal to the child processes that are queue
1030 **	runners. This is for a queue runner "cleanup". After all of the
1031 **	child queue runner processes are signaled (it should be SIGTERM
1032 **	being the sig) then the old signal handler (Oldsh) is called
1033 **	to handle any cleanup set for this process (provided it is not
1034 **	SIG_DFL or SIG_IGN). The signal may not be handled immediately
1035 **	if the BlockOldsh flag is set. If the current process doesn't
1036 **	have a parent then handle the signal immediately, regardless of
1037 **	BlockOldsh.
1038 **
1039 **	Parameters:
1040 **		sig -- the signal number being sent
1041 **
1042 **	Returns:
1043 **		none.
1044 **
1045 **	Side Effects:
1046 **		Sets the NoMoreRunners boolean to true to stop more runners
1047 **		from being started in runqueue().
1048 **
1049 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1050 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1051 **		DOING.
1052 */
1053 
1054 static bool		volatile NoMoreRunners = false;
1055 static sigfunc_t	Oldsh_term = SIG_DFL;
1056 static sigfunc_t	Oldsh_hup = SIG_DFL;
1057 static sigfunc_t	volatile Oldsh = SIG_DFL;
1058 static bool		BlockOldsh = false;
1059 static int		volatile Oldsig = 0;
1060 static SIGFUNC_DECL	runners_sigterm __P((int));
1061 static SIGFUNC_DECL	runners_sighup __P((int));
1062 
1063 static SIGFUNC_DECL
1064 runners_sigterm(sig)
1065 	int sig;
1066 {
1067 	int save_errno = errno;
1068 
1069 	FIX_SYSV_SIGNAL(sig, runners_sigterm);
1070 	errno = save_errno;
1071 	CHECK_CRITICAL(sig);
1072 	NoMoreRunners = true;
1073 	Oldsh = Oldsh_term;
1074 	Oldsig = sig;
1075 	proc_list_signal(PROC_QUEUE, sig);
1076 
1077 	if (!BlockOldsh || getppid() <= 1)
1078 	{
1079 		/* Check that a valid 'old signal handler' is callable */
1080 		if (Oldsh_term != SIG_DFL && Oldsh_term != SIG_IGN &&
1081 		    Oldsh_term != runners_sigterm)
1082 			(*Oldsh_term)(sig);
1083 	}
1084 	errno = save_errno;
1085 	return SIGFUNC_RETURN;
1086 }
1087 /*
1088 **  RUNNERS_SIGHUP -- propagate a SIGHUP to queue runner process
1089 **
1090 **	This propagates the signal to the child processes that are queue
1091 **	runners. This is for a queue runner "cleanup". After all of the
1092 **	child queue runner processes are signaled (it should be SIGHUP
1093 **	being the sig) then the old signal handler (Oldsh) is called to
1094 **	handle any cleanup set for this process (provided it is not SIG_DFL
1095 **	or SIG_IGN). The signal may not be handled immediately if the
1096 **	BlockOldsh flag is set. If the current process doesn't have
1097 **	a parent then handle the signal immediately, regardless of
1098 **	BlockOldsh.
1099 **
1100 **	Parameters:
1101 **		sig -- the signal number being sent
1102 **
1103 **	Returns:
1104 **		none.
1105 **
1106 **	Side Effects:
1107 **		Sets the NoMoreRunners boolean to true to stop more runners
1108 **		from being started in runqueue().
1109 **
1110 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1111 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1112 **		DOING.
1113 */
1114 
1115 static SIGFUNC_DECL
1116 runners_sighup(sig)
1117 	int sig;
1118 {
1119 	int save_errno = errno;
1120 
1121 	FIX_SYSV_SIGNAL(sig, runners_sighup);
1122 	errno = save_errno;
1123 	CHECK_CRITICAL(sig);
1124 	NoMoreRunners = true;
1125 	Oldsh = Oldsh_hup;
1126 	Oldsig = sig;
1127 	proc_list_signal(PROC_QUEUE, sig);
1128 
1129 	if (!BlockOldsh || getppid() <= 1)
1130 	{
1131 		/* Check that a valid 'old signal handler' is callable */
1132 		if (Oldsh_hup != SIG_DFL && Oldsh_hup != SIG_IGN &&
1133 		    Oldsh_hup != runners_sighup)
1134 			(*Oldsh_hup)(sig);
1135 	}
1136 	errno = save_errno;
1137 	return SIGFUNC_RETURN;
1138 }
1139 /*
1140 **  MARK_WORK_GROUP_RESTART -- mark a work group as needing a restart
1141 **
1142 **  Sets a workgroup for restarting.
1143 **
1144 **	Parameters:
1145 **		wgrp -- the work group id to restart.
1146 **		reason -- why (signal?), -1 to turn off restart
1147 **
1148 **	Returns:
1149 **		none.
1150 **
1151 **	Side effects:
1152 **		May set global RestartWorkGroup to true.
1153 **
1154 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1155 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1156 **		DOING.
1157 */
1158 
1159 void
1160 mark_work_group_restart(wgrp, reason)
1161 	int wgrp;
1162 	int reason;
1163 {
1164 	if (wgrp < 0 || wgrp > NumWorkGroups)
1165 		return;
1166 
1167 	WorkGrp[wgrp].wg_restart = reason;
1168 	if (reason >= 0)
1169 		RestartWorkGroup = true;
1170 }
1171 /*
1172 **  RESTART_MARKED_WORK_GROUPS -- restart work groups marked as needing restart
1173 **
1174 **  Restart any workgroup marked as needing a restart provided more
1175 **  runners are allowed.
1176 **
1177 **	Parameters:
1178 **		none.
1179 **
1180 **	Returns:
1181 **		none.
1182 **
1183 **	Side effects:
1184 **		Sets global RestartWorkGroup to false.
1185 */
1186 
1187 void
1188 restart_marked_work_groups()
1189 {
1190 	int i;
1191 	int wasblocked;
1192 
1193 	if (NoMoreRunners)
1194 		return;
1195 
1196 	/* Block SIGCHLD so reapchild() doesn't mess with us */
1197 	wasblocked = sm_blocksignal(SIGCHLD);
1198 
1199 	for (i = 0; i < NumWorkGroups; i++)
1200 	{
1201 		if (WorkGrp[i].wg_restart >= 0)
1202 		{
1203 			if (LogLevel > 8)
1204 				sm_syslog(LOG_ERR, NOQID,
1205 					  "restart queue runner=%d due to signal 0x%x",
1206 					  i, WorkGrp[i].wg_restart);
1207 			restart_work_group(i);
1208 		}
1209 	}
1210 	RestartWorkGroup = false;
1211 
1212 	if (wasblocked == 0)
1213 		(void) sm_releasesignal(SIGCHLD);
1214 }
1215 /*
1216 **  RESTART_WORK_GROUP -- restart a specific work group
1217 **
1218 **  Restart a specific workgroup provided more runners are allowed.
1219 **  If the requested work group has been restarted too many times log
1220 **  this and refuse to restart.
1221 **
1222 **	Parameters:
1223 **		wgrp -- the work group id to restart
1224 **
1225 **	Returns:
1226 **		none.
1227 **
1228 **	Side Effects:
1229 **		starts another process doing the work of wgrp
1230 */
1231 
1232 #define MAX_PERSIST_RESTART	10	/* max allowed number of restarts */
1233 
1234 static void
1235 restart_work_group(wgrp)
1236 	int wgrp;
1237 {
1238 	if (NoMoreRunners ||
1239 	    wgrp < 0 || wgrp > NumWorkGroups)
1240 		return;
1241 
1242 	WorkGrp[wgrp].wg_restart = -1;
1243 	if (WorkGrp[wgrp].wg_restartcnt < MAX_PERSIST_RESTART)
1244 	{
1245 		/* avoid overflow; increment here */
1246 		WorkGrp[wgrp].wg_restartcnt++;
1247 		(void) run_work_group(wgrp, RWG_FORK|RWG_PERSISTENT|RWG_RUNALL);
1248 	}
1249 	else
1250 	{
1251 		sm_syslog(LOG_ERR, NOQID,
1252 			  "ERROR: persistent queue runner=%d restarted too many times, queue runner lost",
1253 			  wgrp);
1254 	}
1255 }
1256 /*
1257 **  SCHEDULE_QUEUE_RUNS -- schedule the next queue run for a work group.
1258 **
1259 **	Parameters:
1260 **		runall -- schedule even if individual bit is not set.
1261 **		wgrp -- the work group id to schedule.
1262 **		didit -- the queue run was performed for this work group.
1263 **
1264 **	Returns:
1265 **		nothing
1266 */
1267 
1268 #define INCR_MOD(v, m)	if (++v >= m)	\
1269 				v = 0;	\
1270 			else
1271 
1272 static void
1273 schedule_queue_runs(runall, wgrp, didit)
1274 	bool runall;
1275 	int wgrp;
1276 	bool didit;
1277 {
1278 	int qgrp, cgrp, endgrp;
1279 #if _FFR_QUEUE_SCHED_DBG
1280 	time_t lastsched;
1281 	bool sched;
1282 #endif /* _FFR_QUEUE_SCHED_DBG */
1283 	time_t now;
1284 	time_t minqintvl;
1285 
1286 	/*
1287 	**  This is a bit ugly since we have to duplicate the
1288 	**  code that "walks" through a work queue group.
1289 	*/
1290 
1291 	now = curtime();
1292 	minqintvl = 0;
1293 	cgrp = endgrp = WorkGrp[wgrp].wg_curqgrp;
1294 	do
1295 	{
1296 		time_t qintvl;
1297 
1298 #if _FFR_QUEUE_SCHED_DBG
1299 		lastsched = 0;
1300 		sched = false;
1301 #endif /* _FFR_QUEUE_SCHED_DBG */
1302 		qgrp = WorkGrp[wgrp].wg_qgs[cgrp]->qg_index;
1303 		if (Queue[qgrp]->qg_queueintvl > 0)
1304 			qintvl = Queue[qgrp]->qg_queueintvl;
1305 		else if (QueueIntvl > 0)
1306 			qintvl = QueueIntvl;
1307 		else
1308 			qintvl = (time_t) 0;
1309 #if _FFR_QUEUE_SCHED_DBG
1310 		lastsched = Queue[qgrp]->qg_nextrun;
1311 #endif /* _FFR_QUEUE_SCHED_DBG */
1312 		if ((runall || Queue[qgrp]->qg_nextrun <= now) && qintvl > 0)
1313 		{
1314 #if _FFR_QUEUE_SCHED_DBG
1315 			sched = true;
1316 #endif /* _FFR_QUEUE_SCHED_DBG */
1317 			if (minqintvl == 0 || qintvl < minqintvl)
1318 				minqintvl = qintvl;
1319 
1320 			/*
1321 			**  Only set a new time if a queue run was performed
1322 			**  for this queue group.  If the queue was not run,
1323 			**  we could starve it by setting a new time on each
1324 			**  call.
1325 			*/
1326 
1327 			if (didit)
1328 				Queue[qgrp]->qg_nextrun += qintvl;
1329 		}
1330 #if _FFR_QUEUE_SCHED_DBG
1331 		if (tTd(69, 10))
1332 			sm_syslog(LOG_INFO, NOQID,
1333 				"sqr: wgrp=%d, cgrp=%d, qgrp=%d, intvl=%ld, QI=%ld, runall=%d, lastrun=%ld, nextrun=%ld, sched=%d",
1334 				wgrp, cgrp, qgrp, Queue[qgrp]->qg_queueintvl,
1335 				QueueIntvl, runall, lastsched,
1336 				Queue[qgrp]->qg_nextrun, sched);
1337 #endif /* _FFR_QUEUE_SCHED_DBG */
1338 		INCR_MOD(cgrp, WorkGrp[wgrp].wg_numqgrp);
1339 	} while (endgrp != cgrp);
1340 	if (minqintvl > 0)
1341 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1342 }
1343 
1344 #if _FFR_QUEUE_RUN_PARANOIA
1345 /*
1346 **  CHECKQUEUERUNNER -- check whether a queue group hasn't been run.
1347 **
1348 **	Use this if events may get lost and hence queue runners may not
1349 **	be started and mail will pile up in a queue.
1350 **
1351 **	Parameters:
1352 **		none.
1353 **
1354 **	Returns:
1355 **		true if a queue run is necessary.
1356 **
1357 **	Side Effects:
1358 **		may schedule a queue run.
1359 */
1360 
1361 bool
1362 checkqueuerunner()
1363 {
1364 	int qgrp;
1365 	time_t now, minqintvl;
1366 
1367 	now = curtime();
1368 	minqintvl = 0;
1369 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
1370 	{
1371 		time_t qintvl;
1372 
1373 		if (Queue[qgrp]->qg_queueintvl > 0)
1374 			qintvl = Queue[qgrp]->qg_queueintvl;
1375 		else if (QueueIntvl > 0)
1376 			qintvl = QueueIntvl;
1377 		else
1378 			qintvl = (time_t) 0;
1379 		if (Queue[qgrp]->qg_nextrun <= now - qintvl)
1380 		{
1381 			if (minqintvl == 0 || qintvl < minqintvl)
1382 				minqintvl = qintvl;
1383 			if (LogLevel > 1)
1384 				sm_syslog(LOG_WARNING, NOQID,
1385 					"checkqueuerunner: queue %d should have been run at %s, queue interval %ld",
1386 					qgrp,
1387 					arpadate(ctime(&Queue[qgrp]->qg_nextrun)),
1388 					qintvl);
1389 		}
1390 	}
1391 	if (minqintvl > 0)
1392 	{
1393 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1394 		return true;
1395 	}
1396 	return false;
1397 }
1398 #endif /* _FFR_QUEUE_RUN_PARANOIA */
1399 
1400 /*
1401 **  RUNQUEUE -- run the jobs in the queue.
1402 **
1403 **	Gets the stuff out of the queue in some presumably logical
1404 **	order and processes them.
1405 **
1406 **	Parameters:
1407 **		forkflag -- true if the queue scanning should be done in
1408 **			a child process.  We double-fork so it is not our
1409 **			child and we don't have to clean up after it.
1410 **			false can be ignored if we have multiple queues.
1411 **		verbose -- if true, print out status information.
1412 **		persistent -- persistent queue runner?
1413 **		runall -- run all groups or only a subset (DoQueueRun)?
1414 **
1415 **	Returns:
1416 **		true if the queue run successfully began.
1417 **
1418 **	Side Effects:
1419 **		runs things in the mail queue using run_work_group().
1420 **		maybe schedules next queue run.
1421 */
1422 
1423 static ENVELOPE	QueueEnvelope;		/* the queue run envelope */
1424 static time_t	LastQueueTime = 0;	/* last time a queue ID assigned */
1425 static pid_t	LastQueuePid = -1;	/* last PID which had a queue ID */
1426 
1427 /* values for qp_supdirs */
1428 #define QP_NOSUB	0x0000	/* No subdirectories */
1429 #define QP_SUBDF	0x0001	/* "df" subdirectory */
1430 #define QP_SUBQF	0x0002	/* "qf" subdirectory */
1431 #define QP_SUBXF	0x0004	/* "xf" subdirectory */
1432 
1433 bool
1434 runqueue(forkflag, verbose, persistent, runall)
1435 	bool forkflag;
1436 	bool verbose;
1437 	bool persistent;
1438 	bool runall;
1439 {
1440 	int i;
1441 	bool ret = true;
1442 	static int curnum = 0;
1443 	sigfunc_t cursh;
1444 #if SM_HEAP_CHECK
1445 	SM_NONVOLATILE int oldgroup = 0;
1446 
1447 	if (sm_debug_active(&DebugLeakQ, 1))
1448 	{
1449 		oldgroup = sm_heap_group();
1450 		sm_heap_newgroup();
1451 		sm_dprintf("runqueue() heap group #%d\n", sm_heap_group());
1452 	}
1453 #endif /* SM_HEAP_CHECK */
1454 
1455 	/* queue run has been started, don't do any more this time */
1456 	DoQueueRun = false;
1457 
1458 	/* more than one queue or more than one directory per queue */
1459 	if (!forkflag && !verbose &&
1460 	    (WorkGrp[0].wg_qgs[0]->qg_numqueues > 1 || NumWorkGroups > 1 ||
1461 	     WorkGrp[0].wg_numqgrp > 1))
1462 		forkflag = true;
1463 
1464 	/*
1465 	**  For controlling queue runners via signals sent to this process.
1466 	**  Oldsh* will get called too by runners_sig* (if it is not SIG_IGN
1467 	**  or SIG_DFL) to preserve cleanup behavior. Now that this process
1468 	**  will have children (and perhaps grandchildren) this handler will
1469 	**  be left in place. This is because this process, once it has
1470 	**  finished spinning off queue runners, may go back to doing something
1471 	**  else (like being a daemon). And we still want on a SIG{TERM,HUP} to
1472 	**  clean up the child queue runners. Only install 'runners_sig*' once
1473 	**  else we'll get stuck looping forever.
1474 	*/
1475 
1476 	cursh = sm_signal(SIGTERM, runners_sigterm);
1477 	if (cursh != runners_sigterm)
1478 		Oldsh_term = cursh;
1479 	cursh = sm_signal(SIGHUP, runners_sighup);
1480 	if (cursh != runners_sighup)
1481 		Oldsh_hup = cursh;
1482 
1483 	for (i = 0; i < NumWorkGroups && !NoMoreRunners; i++)
1484 	{
1485 		int rwgflags = RWG_NONE;
1486 
1487 		/*
1488 		**  If MaxQueueChildren active then test whether the start
1489 		**  of the next queue group's additional queue runners (maximum)
1490 		**  will result in MaxQueueChildren being exceeded.
1491 		**
1492 		**  Note: do not use continue; even though another workgroup
1493 		**	may have fewer queue runners, this would be "unfair",
1494 		**	i.e., this work group might "starve" then.
1495 		*/
1496 
1497 #if _FFR_QUEUE_SCHED_DBG
1498 		if (tTd(69, 10))
1499 			sm_syslog(LOG_INFO, NOQID,
1500 				"rq: curnum=%d, MaxQueueChildren=%d, CurRunners=%d, WorkGrp[curnum].wg_maxact=%d",
1501 				curnum, MaxQueueChildren, CurRunners,
1502 				WorkGrp[curnum].wg_maxact);
1503 #endif /* _FFR_QUEUE_SCHED_DBG */
1504 		if (MaxQueueChildren > 0 &&
1505 		    CurRunners + WorkGrp[curnum].wg_maxact > MaxQueueChildren)
1506 			break;
1507 
1508 		/*
1509 		**  Pick up where we left off (curnum), in case we
1510 		**  used up all the children last time without finishing.
1511 		**  This give a round-robin fairness to queue runs.
1512 		**
1513 		**  Increment CurRunners before calling run_work_group()
1514 		**  to avoid a "race condition" with proc_list_drop() which
1515 		**  decrements CurRunners if the queue runners terminate.
1516 		**  Notice: CurRunners is an upper limit, in some cases
1517 		**  (too few jobs in the queue) this value is larger than
1518 		**  the actual number of queue runners. The discrepancy can
1519 		**  increase if some queue runners "hang" for a long time.
1520 		*/
1521 
1522 		CurRunners += WorkGrp[curnum].wg_maxact;
1523 		if (forkflag)
1524 			rwgflags |= RWG_FORK;
1525 		if (verbose)
1526 			rwgflags |= RWG_VERBOSE;
1527 		if (persistent)
1528 			rwgflags |= RWG_PERSISTENT;
1529 		if (runall)
1530 			rwgflags |= RWG_RUNALL;
1531 		ret = run_work_group(curnum, rwgflags);
1532 
1533 		/*
1534 		**  Failure means a message was printed for ETRN
1535 		**  and subsequent queues are likely to fail as well.
1536 		**  Decrement CurRunners in that case because
1537 		**  none have been started.
1538 		*/
1539 
1540 		if (!ret)
1541 		{
1542 			CurRunners -= WorkGrp[curnum].wg_maxact;
1543 			break;
1544 		}
1545 
1546 		if (!persistent)
1547 			schedule_queue_runs(runall, curnum, true);
1548 		INCR_MOD(curnum, NumWorkGroups);
1549 	}
1550 
1551 	/* schedule left over queue runs */
1552 	if (i < NumWorkGroups && !NoMoreRunners && !persistent)
1553 	{
1554 		int h;
1555 
1556 		for (h = curnum; i < NumWorkGroups; i++)
1557 		{
1558 			schedule_queue_runs(runall, h, false);
1559 			INCR_MOD(h, NumWorkGroups);
1560 		}
1561 	}
1562 
1563 
1564 #if SM_HEAP_CHECK
1565 	if (sm_debug_active(&DebugLeakQ, 1))
1566 		sm_heap_setgroup(oldgroup);
1567 #endif /* SM_HEAP_CHECK */
1568 	return ret;
1569 }
1570 
1571 #if _FFR_SKIP_DOMAINS
1572 /*
1573 **  SKIP_DOMAINS -- Skip 'skip' number of domains in the WorkQ.
1574 **
1575 **  Added by Stephen Frost <sfrost@snowman.net> to support
1576 **  having each runner process every N'th domain instead of
1577 **  every N'th message.
1578 **
1579 **	Parameters:
1580 **		skip -- number of domains in WorkQ to skip.
1581 **
1582 **	Returns:
1583 **		total number of messages skipped.
1584 **
1585 **	Side Effects:
1586 **		may change WorkQ
1587 */
1588 
1589 static int
1590 skip_domains(skip)
1591 	int skip;
1592 {
1593 	int n, seqjump;
1594 
1595 	for (n = 0, seqjump = 0; n < skip && WorkQ != NULL; seqjump++)
1596 	{
1597 		if (WorkQ->w_next != NULL)
1598 		{
1599 			if (WorkQ->w_host != NULL &&
1600 			    WorkQ->w_next->w_host != NULL)
1601 			{
1602 				if (sm_strcasecmp(WorkQ->w_host,
1603 						WorkQ->w_next->w_host) != 0)
1604 					n++;
1605 			}
1606 			else
1607 			{
1608 				if ((WorkQ->w_host != NULL &&
1609 				     WorkQ->w_next->w_host == NULL) ||
1610 				    (WorkQ->w_host == NULL &&
1611 				     WorkQ->w_next->w_host != NULL))
1612 					     n++;
1613 			}
1614 		}
1615 		WorkQ = WorkQ->w_next;
1616 	}
1617 	return seqjump;
1618 }
1619 #endif /* _FFR_SKIP_DOMAINS */
1620 
1621 /*
1622 **  RUNNER_WORK -- have a queue runner do its work
1623 **
1624 **  Have a queue runner do its work a list of entries.
1625 **  When work isn't directly being done then this process can take a signal
1626 **  and terminate immediately (in a clean fashion of course).
1627 **  When work is directly being done, it's not to be interrupted
1628 **  immediately: the work should be allowed to finish at a clean point
1629 **  before termination (in a clean fashion of course).
1630 **
1631 **	Parameters:
1632 **		e -- envelope.
1633 **		sequenceno -- 'th process to run WorkQ.
1634 **		didfork -- did the calling process fork()?
1635 **		skip -- process only each skip'th item.
1636 **		njobs -- number of jobs in WorkQ.
1637 **
1638 **	Returns:
1639 **		none.
1640 **
1641 **	Side Effects:
1642 **		runs things in the mail queue.
1643 */
1644 
1645 static void
1646 runner_work(e, sequenceno, didfork, skip, njobs)
1647 	register ENVELOPE *e;
1648 	int sequenceno;
1649 	bool didfork;
1650 	int skip;
1651 	int njobs;
1652 {
1653 	int n, seqjump;
1654 	WORK *w;
1655 	time_t now;
1656 
1657 	SM_GET_LA(now);
1658 
1659 	/*
1660 	**  Here we temporarily block the second calling of the handlers.
1661 	**  This allows us to handle the signal without terminating in the
1662 	**  middle of direct work. If a signal does come, the test for
1663 	**  NoMoreRunners will find it.
1664 	*/
1665 
1666 	BlockOldsh = true;
1667 	seqjump = skip;
1668 
1669 	/* process them once at a time */
1670 	while (WorkQ != NULL)
1671 	{
1672 #if SM_HEAP_CHECK
1673 		SM_NONVOLATILE int oldgroup = 0;
1674 
1675 		if (sm_debug_active(&DebugLeakQ, 1))
1676 		{
1677 			oldgroup = sm_heap_group();
1678 			sm_heap_newgroup();
1679 			sm_dprintf("run_queue_group() heap group #%d\n",
1680 				sm_heap_group());
1681 		}
1682 #endif /* SM_HEAP_CHECK */
1683 
1684 		/* do no more work */
1685 		if (NoMoreRunners)
1686 		{
1687 			/* Check that a valid signal handler is callable */
1688 			if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1689 			    Oldsh != runners_sighup &&
1690 			    Oldsh != runners_sigterm)
1691 				(*Oldsh)(Oldsig);
1692 			break;
1693 		}
1694 
1695 		w = WorkQ; /* assign current work item */
1696 
1697 		/*
1698 		**  Set the head of the WorkQ to the next work item.
1699 		**  It is set 'skip' ahead (the number of parallel queue
1700 		**  runners working on WorkQ together) since each runner
1701 		**  works on every 'skip'th (N-th) item.
1702 #if _FFR_SKIP_DOMAINS
1703 		**  In the case of the BYHOST Queue Sort Order, the 'item'
1704 		**  is a domain, so we work on every 'skip'th (N-th) domain.
1705 #endif * _FFR_SKIP_DOMAINS *
1706 		*/
1707 
1708 #if _FFR_SKIP_DOMAINS
1709 		if (QueueSortOrder == QSO_BYHOST)
1710 		{
1711 			seqjump = 1;
1712 			if (WorkQ->w_next != NULL)
1713 			{
1714 				if (WorkQ->w_host != NULL &&
1715 				    WorkQ->w_next->w_host != NULL)
1716 				{
1717 					if (sm_strcasecmp(WorkQ->w_host,
1718 							WorkQ->w_next->w_host)
1719 								!= 0)
1720 						seqjump = skip_domains(skip);
1721 					else
1722 						WorkQ = WorkQ->w_next;
1723 				}
1724 				else
1725 				{
1726 					if ((WorkQ->w_host != NULL &&
1727 					     WorkQ->w_next->w_host == NULL) ||
1728 					    (WorkQ->w_host == NULL &&
1729 					     WorkQ->w_next->w_host != NULL))
1730 						seqjump = skip_domains(skip);
1731 					else
1732 						WorkQ = WorkQ->w_next;
1733 				}
1734 			}
1735 			else
1736 				WorkQ = WorkQ->w_next;
1737 		}
1738 		else
1739 #endif /* _FFR_SKIP_DOMAINS */
1740 		{
1741 			for (n = 0; n < skip && WorkQ != NULL; n++)
1742 				WorkQ = WorkQ->w_next;
1743 		}
1744 
1745 		e->e_to = NULL;
1746 
1747 		/*
1748 		**  Ignore jobs that are too expensive for the moment.
1749 		**
1750 		**	Get new load average every GET_NEW_LA_TIME seconds.
1751 		*/
1752 
1753 		SM_GET_LA(now);
1754 		if (shouldqueue(WkRecipFact, Current_LA_time))
1755 		{
1756 			char *msg = "Aborting queue run: load average too high";
1757 
1758 			if (Verbose)
1759 				message("%s", msg);
1760 			if (LogLevel > 8)
1761 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1762 			break;
1763 		}
1764 		if (shouldqueue(w->w_pri, w->w_ctime))
1765 		{
1766 			if (Verbose)
1767 				message(EmptyString);
1768 			if (QueueSortOrder == QSO_BYPRIORITY)
1769 			{
1770 				if (Verbose)
1771 					message("Skipping %s/%s (sequence %d of %d) and flushing rest of queue",
1772 						qid_printqueue(w->w_qgrp,
1773 							       w->w_qdir),
1774 						w->w_name + 2, sequenceno,
1775 						njobs);
1776 				if (LogLevel > 8)
1777 					sm_syslog(LOG_INFO, NOQID,
1778 						  "runqueue: Flushing queue from %s/%s (pri %ld, LA %d, %d of %d)",
1779 						  qid_printqueue(w->w_qgrp,
1780 								 w->w_qdir),
1781 						  w->w_name + 2, w->w_pri,
1782 						  CurrentLA, sequenceno,
1783 						  njobs);
1784 				break;
1785 			}
1786 			else if (Verbose)
1787 				message("Skipping %s/%s (sequence %d of %d)",
1788 					qid_printqueue(w->w_qgrp, w->w_qdir),
1789 					w->w_name + 2, sequenceno, njobs);
1790 		}
1791 		else
1792 		{
1793 			if (Verbose)
1794 			{
1795 				message(EmptyString);
1796 				message("Running %s/%s (sequence %d of %d)",
1797 					qid_printqueue(w->w_qgrp, w->w_qdir),
1798 					w->w_name + 2, sequenceno, njobs);
1799 			}
1800 			if (didfork && MaxQueueChildren > 0)
1801 			{
1802 				sm_blocksignal(SIGCHLD);
1803 				(void) sm_signal(SIGCHLD, reapchild);
1804 			}
1805 			if (tTd(63, 100))
1806 				sm_syslog(LOG_DEBUG, NOQID,
1807 					  "runqueue %s dowork(%s)",
1808 					  qid_printqueue(w->w_qgrp, w->w_qdir),
1809 					  w->w_name + 2);
1810 
1811 			(void) dowork(w->w_qgrp, w->w_qdir, w->w_name + 2,
1812 				      ForkQueueRuns, false, e);
1813 			errno = 0;
1814 		}
1815 		sm_free(w->w_name); /* XXX */
1816 		if (w->w_host != NULL)
1817 			sm_free(w->w_host); /* XXX */
1818 		sm_free((char *) w); /* XXX */
1819 		sequenceno += seqjump; /* next sequence number */
1820 #if SM_HEAP_CHECK
1821 		if (sm_debug_active(&DebugLeakQ, 1))
1822 			sm_heap_setgroup(oldgroup);
1823 #endif /* SM_HEAP_CHECK */
1824 	}
1825 
1826 	BlockOldsh = false;
1827 
1828 	/* check the signals didn't happen during the revert */
1829 	if (NoMoreRunners)
1830 	{
1831 		/* Check that a valid signal handler is callable */
1832 		if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1833 		    Oldsh != runners_sighup && Oldsh != runners_sigterm)
1834 			(*Oldsh)(Oldsig);
1835 	}
1836 
1837 	Oldsh = SIG_DFL; /* after the NoMoreRunners check */
1838 }
1839 /*
1840 **  RUN_WORK_GROUP -- run the jobs in a queue group from a work group.
1841 **
1842 **	Gets the stuff out of the queue in some presumably logical
1843 **	order and processes them.
1844 **
1845 **	Parameters:
1846 **		wgrp -- work group to process.
1847 **		flags -- RWG_* flags
1848 **
1849 **	Returns:
1850 **		true if the queue run successfully began.
1851 **
1852 **	Side Effects:
1853 **		runs things in the mail queue.
1854 */
1855 
1856 /* Minimum sleep time for persistent queue runners */
1857 #define MIN_SLEEP_TIME	5
1858 
1859 bool
1860 run_work_group(wgrp, flags)
1861 	int wgrp;
1862 	int flags;
1863 {
1864 	register ENVELOPE *e;
1865 	int njobs, qdir;
1866 	int sequenceno = 1;
1867 	int qgrp, endgrp, h, i;
1868 	time_t now;
1869 	bool full, more;
1870 	SM_RPOOL_T *rpool;
1871 	extern void rmexpstab __P((void));
1872 	extern ENVELOPE BlankEnvelope;
1873 	extern SIGFUNC_DECL reapchild __P((int));
1874 
1875 	if (wgrp < 0)
1876 		return false;
1877 
1878 	/*
1879 	**  If no work will ever be selected, don't even bother reading
1880 	**  the queue.
1881 	*/
1882 
1883 	SM_GET_LA(now);
1884 
1885 	if (!bitset(RWG_PERSISTENT, flags) &&
1886 	    shouldqueue(WkRecipFact, Current_LA_time))
1887 	{
1888 		char *msg = "Skipping queue run -- load average too high";
1889 
1890 		if (bitset(RWG_VERBOSE, flags))
1891 			message("458 %s\n", msg);
1892 		if (LogLevel > 8)
1893 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1894 		return false;
1895 	}
1896 
1897 	/*
1898 	**  See if we already have too many children.
1899 	*/
1900 
1901 	if (bitset(RWG_FORK, flags) &&
1902 	    WorkGrp[wgrp].wg_lowqintvl > 0 &&
1903 	    !bitset(RWG_PERSISTENT, flags) &&
1904 	    MaxChildren > 0 && CurChildren >= MaxChildren)
1905 	{
1906 		char *msg = "Skipping queue run -- too many children";
1907 
1908 		if (bitset(RWG_VERBOSE, flags))
1909 			message("458 %s (%d)\n", msg, CurChildren);
1910 		if (LogLevel > 8)
1911 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s (%d)",
1912 				  msg, CurChildren);
1913 		return false;
1914 	}
1915 
1916 	/*
1917 	**  See if we want to go off and do other useful work.
1918 	*/
1919 
1920 	if (bitset(RWG_FORK, flags))
1921 	{
1922 		pid_t pid;
1923 
1924 		(void) sm_blocksignal(SIGCHLD);
1925 		(void) sm_signal(SIGCHLD, reapchild);
1926 
1927 		pid = dofork();
1928 		if (pid == -1)
1929 		{
1930 			const char *msg = "Skipping queue run -- fork() failed";
1931 			const char *err = sm_errstring(errno);
1932 
1933 			if (bitset(RWG_VERBOSE, flags))
1934 				message("458 %s: %s\n", msg, err);
1935 			if (LogLevel > 8)
1936 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s: %s",
1937 					  msg, err);
1938 			(void) sm_releasesignal(SIGCHLD);
1939 			return false;
1940 		}
1941 		if (pid != 0)
1942 		{
1943 			/* parent -- pick up intermediate zombie */
1944 			(void) sm_blocksignal(SIGALRM);
1945 
1946 			/* wgrp only used when queue runners are persistent */
1947 			proc_list_add(pid, "Queue runner", PROC_QUEUE,
1948 				      WorkGrp[wgrp].wg_maxact,
1949 				      bitset(RWG_PERSISTENT, flags) ? wgrp : -1,
1950 				      NULL);
1951 			(void) sm_releasesignal(SIGALRM);
1952 			(void) sm_releasesignal(SIGCHLD);
1953 			return true;
1954 		}
1955 
1956 		/* child -- clean up signals */
1957 
1958 		/* Reset global flags */
1959 		RestartRequest = NULL;
1960 		RestartWorkGroup = false;
1961 		ShutdownRequest = NULL;
1962 		PendingSignal = 0;
1963 		CurrentPid = getpid();
1964 		close_sendmail_pid();
1965 
1966 		/*
1967 		**  Initialize exception stack and default exception
1968 		**  handler for child process.
1969 		*/
1970 
1971 		sm_exc_newthread(fatal_error);
1972 		clrcontrol();
1973 		proc_list_clear();
1974 
1975 		/* Add parent process as first child item */
1976 		proc_list_add(CurrentPid, "Queue runner child process",
1977 			      PROC_QUEUE_CHILD, 0, -1, NULL);
1978 		(void) sm_releasesignal(SIGCHLD);
1979 		(void) sm_signal(SIGCHLD, SIG_DFL);
1980 		(void) sm_signal(SIGHUP, SIG_DFL);
1981 		(void) sm_signal(SIGTERM, intsig);
1982 	}
1983 
1984 	/*
1985 	**  Release any resources used by the daemon code.
1986 	*/
1987 
1988 	clrdaemon();
1989 
1990 	/* force it to run expensive jobs */
1991 	NoConnect = false;
1992 
1993 	/* drop privileges */
1994 	if (geteuid() == (uid_t) 0)
1995 		(void) drop_privileges(false);
1996 
1997 	/*
1998 	**  Create ourselves an envelope
1999 	*/
2000 
2001 	CurEnv = &QueueEnvelope;
2002 	rpool = sm_rpool_new_x(NULL);
2003 	e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2004 	e->e_flags = BlankEnvelope.e_flags;
2005 	e->e_parent = NULL;
2006 
2007 	/* make sure we have disconnected from parent */
2008 	if (bitset(RWG_FORK, flags))
2009 	{
2010 		disconnect(1, e);
2011 		QuickAbort = false;
2012 	}
2013 
2014 	/*
2015 	**  If we are running part of the queue, always ignore stored
2016 	**  host status.
2017 	*/
2018 
2019 	if (QueueLimitId != NULL || QueueLimitSender != NULL ||
2020 	    QueueLimitQuarantine != NULL ||
2021 	    QueueLimitRecipient != NULL)
2022 	{
2023 		IgnoreHostStatus = true;
2024 		MinQueueAge = 0;
2025 	}
2026 
2027 	/*
2028 	**  Here is where we choose the queue group from the work group.
2029 	**  The caller of the "domorework" label must setup a new envelope.
2030 	*/
2031 
2032 	endgrp = WorkGrp[wgrp].wg_curqgrp; /* to not spin endlessly */
2033 
2034   domorework:
2035 
2036 	/*
2037 	**  Run a queue group if:
2038 	**  RWG_RUNALL bit is set or the bit for this group is set.
2039 	*/
2040 
2041 	now = curtime();
2042 	for (;;)
2043 	{
2044 		/*
2045 		**  Find the next queue group within the work group that
2046 		**  has been marked as needing a run.
2047 		*/
2048 
2049 		qgrp = WorkGrp[wgrp].wg_qgs[WorkGrp[wgrp].wg_curqgrp]->qg_index;
2050 		WorkGrp[wgrp].wg_curqgrp++; /* advance */
2051 		WorkGrp[wgrp].wg_curqgrp %= WorkGrp[wgrp].wg_numqgrp; /* wrap */
2052 		if (bitset(RWG_RUNALL, flags) ||
2053 		    (Queue[qgrp]->qg_nextrun <= now &&
2054 		     Queue[qgrp]->qg_nextrun != (time_t) -1))
2055 			break;
2056 		if (endgrp == WorkGrp[wgrp].wg_curqgrp)
2057 		{
2058 			e->e_id = NULL;
2059 			if (bitset(RWG_FORK, flags))
2060 				finis(true, true, ExitStat);
2061 			return true; /* we're done */
2062 		}
2063 	}
2064 
2065 	qdir = Queue[qgrp]->qg_curnum; /* round-robin init of queue position */
2066 #if _FFR_QUEUE_SCHED_DBG
2067 	if (tTd(69, 12))
2068 		sm_syslog(LOG_INFO, NOQID,
2069 			"rwg: wgrp=%d, qgrp=%d, qdir=%d, name=%s, curqgrp=%d, numgrps=%d",
2070 			wgrp, qgrp, qdir, qid_printqueue(qgrp, qdir),
2071 			WorkGrp[wgrp].wg_curqgrp, WorkGrp[wgrp].wg_numqgrp);
2072 #endif /* _FFR_QUEUE_SCHED_DBG */
2073 
2074 #if HASNICE
2075 	/* tweak niceness of queue runs */
2076 	if (Queue[qgrp]->qg_nice > 0)
2077 		(void) nice(Queue[qgrp]->qg_nice);
2078 #endif /* HASNICE */
2079 
2080 	/* XXX running queue group... */
2081 	sm_setproctitle(true, CurEnv, "running queue: %s",
2082 			qid_printqueue(qgrp, qdir));
2083 
2084 	if (LogLevel > 69 || tTd(63, 99))
2085 		sm_syslog(LOG_DEBUG, NOQID,
2086 			  "runqueue %s, pid=%d, forkflag=%d",
2087 			  qid_printqueue(qgrp, qdir), (int) CurrentPid,
2088 			  bitset(RWG_FORK, flags));
2089 
2090 	/*
2091 	**  Start making passes through the queue.
2092 	**	First, read and sort the entire queue.
2093 	**	Then, process the work in that order.
2094 	**		But if you take too long, start over.
2095 	*/
2096 
2097 	for (i = 0; i < Queue[qgrp]->qg_numqueues; i++)
2098 	{
2099 		h = gatherq(qgrp, qdir, false, &full, &more);
2100 #if SM_CONF_SHM
2101 		if (ShmId != SM_SHM_NO_ID)
2102 			QSHM_ENTRIES(Queue[qgrp]->qg_qpaths[qdir].qp_idx) = h;
2103 #endif /* SM_CONF_SHM */
2104 		/* If there are no more items in this queue advance */
2105 		if (!more)
2106 		{
2107 			/* A round-robin advance */
2108 			qdir++;
2109 			qdir %= Queue[qgrp]->qg_numqueues;
2110 		}
2111 
2112 		/* Has the WorkList reached the limit? */
2113 		if (full)
2114 			break; /* don't try to gather more */
2115 	}
2116 
2117 	/* order the existing work requests */
2118 	njobs = sortq(Queue[qgrp]->qg_maxlist);
2119 	Queue[qgrp]->qg_curnum = qdir; /* update */
2120 
2121 
2122 	if (!Verbose && bitnset(QD_FORK, Queue[qgrp]->qg_flags))
2123 	{
2124 		int loop, maxrunners;
2125 		pid_t pid;
2126 
2127 		/*
2128 		**  For this WorkQ we want to fork off N children (maxrunners)
2129 		**  at this point. Each child has a copy of WorkQ. Each child
2130 		**  will process every N-th item. The parent will wait for all
2131 		**  of the children to finish before moving on to the next
2132 		**  queue group within the work group. This saves us forking
2133 		**  a new runner-child for each work item.
2134 		**  It's valid for qg_maxqrun == 0 since this may be an
2135 		**  explicit "don't run this queue" setting.
2136 		*/
2137 
2138 		maxrunners = Queue[qgrp]->qg_maxqrun;
2139 
2140 		/* No need to have more runners then there are jobs */
2141 		if (maxrunners > njobs)
2142 			maxrunners = njobs;
2143 		for (loop = 0; loop < maxrunners; loop++)
2144 		{
2145 			/*
2146 			**  Since the delivery may happen in a child and the
2147 			**  parent does not wait, the parent may close the
2148 			**  maps thereby removing any shared memory used by
2149 			**  the map.  Therefore, close the maps now so the
2150 			**  child will dynamically open them if necessary.
2151 			*/
2152 
2153 			closemaps(false);
2154 
2155 			pid = fork();
2156 			if (pid < 0)
2157 			{
2158 				syserr("run_work_group: cannot fork");
2159 				return false;
2160 			}
2161 			else if (pid > 0)
2162 			{
2163 				/* parent -- clean out connection cache */
2164 				mci_flush(false, NULL);
2165 #if _FFR_SKIP_DOMAINS
2166 				if (QueueSortOrder == QSO_BYHOST)
2167 				{
2168 					sequenceno += skip_domains(1);
2169 				}
2170 				else
2171 #endif /* _FFR_SKIP_DOMAINS */
2172 				{
2173 					/* for the skip */
2174 					WorkQ = WorkQ->w_next;
2175 					sequenceno++;
2176 				}
2177 				proc_list_add(pid, "Queue child runner process",
2178 					      PROC_QUEUE_CHILD, 0, -1, NULL);
2179 
2180 				/* No additional work, no additional runners */
2181 				if (WorkQ == NULL)
2182 					break;
2183 			}
2184 			else
2185 			{
2186 				/* child -- Reset global flags */
2187 				RestartRequest = NULL;
2188 				RestartWorkGroup = false;
2189 				ShutdownRequest = NULL;
2190 				PendingSignal = 0;
2191 				CurrentPid = getpid();
2192 				close_sendmail_pid();
2193 
2194 				/*
2195 				**  Initialize exception stack and default
2196 				**  exception handler for child process.
2197 				**  When fork()'d the child now has a private
2198 				**  copy of WorkQ at its current position.
2199 				*/
2200 
2201 				sm_exc_newthread(fatal_error);
2202 
2203 				/*
2204 				**  SMTP processes (whether -bd or -bs) set
2205 				**  SIGCHLD to reapchild to collect
2206 				**  children status.  However, at delivery
2207 				**  time, that status must be collected
2208 				**  by sm_wait() to be dealt with properly
2209 				**  (check success of delivery based
2210 				**  on status code, etc).  Therefore, if we
2211 				**  are an SMTP process, reset SIGCHLD
2212 				**  back to the default so reapchild
2213 				**  doesn't collect status before
2214 				**  sm_wait().
2215 				*/
2216 
2217 				if (OpMode == MD_SMTP ||
2218 				    OpMode == MD_DAEMON ||
2219 				    MaxQueueChildren > 0)
2220 				{
2221 					proc_list_clear();
2222 					sm_releasesignal(SIGCHLD);
2223 					(void) sm_signal(SIGCHLD, SIG_DFL);
2224 				}
2225 
2226 				/* child -- error messages to the transcript */
2227 				QuickAbort = OnlyOneError = false;
2228 				runner_work(e, sequenceno, true,
2229 					    maxrunners, njobs);
2230 
2231 				/* This child is done */
2232 				finis(true, true, ExitStat);
2233 				/* NOTREACHED */
2234 			}
2235 		}
2236 
2237 		sm_releasesignal(SIGCHLD);
2238 
2239 		/*
2240 		**  Wait until all of the runners have completed before
2241 		**  seeing if there is another queue group in the
2242 		**  work group to process.
2243 		**  XXX Future enhancement: don't wait() for all children
2244 		**  here, just go ahead and make sure that overall the number
2245 		**  of children is not exceeded.
2246 		*/
2247 
2248 		while (CurChildren > 0)
2249 		{
2250 			int status;
2251 			pid_t ret;
2252 
2253 			while ((ret = sm_wait(&status)) <= 0)
2254 				continue;
2255 			proc_list_drop(ret, status, NULL);
2256 		}
2257 	}
2258 	else if (Queue[qgrp]->qg_maxqrun > 0 || bitset(RWG_FORCE, flags))
2259 	{
2260 		/*
2261 		**  When current process will not fork children to do the work,
2262 		**  it will do the work itself. The 'skip' will be 1 since
2263 		**  there are no child runners to divide the work across.
2264 		*/
2265 
2266 		runner_work(e, sequenceno, false, 1, njobs);
2267 	}
2268 
2269 	/* free memory allocated by newenvelope() above */
2270 	sm_rpool_free(rpool);
2271 	QueueEnvelope.e_rpool = NULL;
2272 
2273 	/* Are there still more queues in the work group to process? */
2274 	if (endgrp != WorkGrp[wgrp].wg_curqgrp)
2275 	{
2276 		rpool = sm_rpool_new_x(NULL);
2277 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2278 		e->e_flags = BlankEnvelope.e_flags;
2279 		goto domorework;
2280 	}
2281 
2282 	/* No more queues in work group to process. Now check persistent. */
2283 	if (bitset(RWG_PERSISTENT, flags))
2284 	{
2285 		sequenceno = 1;
2286 		sm_setproctitle(true, CurEnv, "running queue: %s",
2287 				qid_printqueue(qgrp, qdir));
2288 
2289 		/*
2290 		**  close bogus maps, i.e., maps which caused a tempfail,
2291 		**	so we get fresh map connections on the next lookup.
2292 		**  closemaps() is also called when children are started.
2293 		*/
2294 
2295 		closemaps(true);
2296 
2297 		/* Close any cached connections. */
2298 		mci_flush(true, NULL);
2299 
2300 		/* Clean out expired related entries. */
2301 		rmexpstab();
2302 
2303 #if NAMED_BIND
2304 		/* Update MX records for FallbackMX. */
2305 		if (FallbackMX != NULL)
2306 			(void) getfallbackmxrr(FallbackMX);
2307 #endif /* NAMED_BIND */
2308 
2309 #if USERDB
2310 		/* close UserDatabase */
2311 		_udbx_close();
2312 #endif /* USERDB */
2313 
2314 #if SM_HEAP_CHECK
2315 		if (sm_debug_active(&SmHeapCheck, 2)
2316 		    && access("memdump", F_OK) == 0
2317 		   )
2318 		{
2319 			SM_FILE_T *out;
2320 
2321 			remove("memdump");
2322 			out = sm_io_open(SmFtStdio, SM_TIME_DEFAULT,
2323 					 "memdump.out", SM_IO_APPEND, NULL);
2324 			if (out != NULL)
2325 			{
2326 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT, "----------------------\n");
2327 				sm_heap_report(out,
2328 					sm_debug_level(&SmHeapCheck) - 1);
2329 				(void) sm_io_close(out, SM_TIME_DEFAULT);
2330 			}
2331 		}
2332 #endif /* SM_HEAP_CHECK */
2333 
2334 		/* let me rest for a second to catch my breath */
2335 		if (njobs == 0 && WorkGrp[wgrp].wg_lowqintvl < MIN_SLEEP_TIME)
2336 			sleep(MIN_SLEEP_TIME);
2337 		else if (WorkGrp[wgrp].wg_lowqintvl <= 0)
2338 			sleep(QueueIntvl > 0 ? QueueIntvl : MIN_SLEEP_TIME);
2339 		else
2340 			sleep(WorkGrp[wgrp].wg_lowqintvl);
2341 
2342 		/*
2343 		**  Get the LA outside the WorkQ loop if necessary.
2344 		**  In a persistent queue runner the code is repeated over
2345 		**  and over but gatherq() may ignore entries due to
2346 		**  shouldqueue() (do we really have to do this twice?).
2347 		**  Hence the queue runners would just idle around when once
2348 		**  CurrentLA caused all entries in a queue to be ignored.
2349 		*/
2350 
2351 		if (njobs == 0)
2352 			SM_GET_LA(now);
2353 		rpool = sm_rpool_new_x(NULL);
2354 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2355 		e->e_flags = BlankEnvelope.e_flags;
2356 		goto domorework;
2357 	}
2358 
2359 	/* exit without the usual cleanup */
2360 	e->e_id = NULL;
2361 	if (bitset(RWG_FORK, flags))
2362 		finis(true, true, ExitStat);
2363 	/* NOTREACHED */
2364 	return true;
2365 }
2366 
2367 /*
2368 **  DOQUEUERUN -- do a queue run?
2369 */
2370 
2371 bool
2372 doqueuerun()
2373 {
2374 	return DoQueueRun;
2375 }
2376 
2377 /*
2378 **  RUNQUEUEEVENT -- Sets a flag to indicate that a queue run should be done.
2379 **
2380 **	Parameters:
2381 **		none.
2382 **
2383 **	Returns:
2384 **		none.
2385 **
2386 **	Side Effects:
2387 **		The invocation of this function via an alarm may interrupt
2388 **		a set of actions. Thus errno may be set in that context.
2389 **		We need to restore errno at the end of this function to ensure
2390 **		that any work done here that sets errno doesn't return a
2391 **		misleading/false errno value. Errno may	be EINTR upon entry to
2392 **		this function because of non-restartable/continuable system
2393 **		API was active. Iff this is true we will override errno as
2394 **		a timeout (as a more accurate error message).
2395 **
2396 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
2397 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
2398 **		DOING.
2399 */
2400 
2401 void
2402 runqueueevent(ignore)
2403 	int ignore;
2404 {
2405 	int save_errno = errno;
2406 
2407 	/*
2408 	**  Set the general bit that we want a queue run,
2409 	**  tested in doqueuerun()
2410 	*/
2411 
2412 	DoQueueRun = true;
2413 #if _FFR_QUEUE_SCHED_DBG
2414 	if (tTd(69, 10))
2415 		sm_syslog(LOG_INFO, NOQID, "rqe: done");
2416 #endif /* _FFR_QUEUE_SCHED_DBG */
2417 
2418 	errno = save_errno;
2419 	if (errno == EINTR)
2420 		errno = ETIMEDOUT;
2421 }
2422 /*
2423 **  GATHERQ -- gather messages from the message queue(s) the work queue.
2424 **
2425 **	Parameters:
2426 **		qgrp -- the index of the queue group.
2427 **		qdir -- the index of the queue directory.
2428 **		doall -- if set, include everything in the queue (even
2429 **			the jobs that cannot be run because the load
2430 **			average is too high, or MaxQueueRun is reached).
2431 **			Otherwise, exclude those jobs.
2432 **		full -- (optional) to be set 'true' if WorkList is full
2433 **		more -- (optional) to be set 'true' if there are still more
2434 **			messages in this queue not added to WorkList
2435 **
2436 **	Returns:
2437 **		The number of request in the queue (not necessarily
2438 **		the number of requests in WorkList however).
2439 **
2440 **	Side Effects:
2441 **		prepares available work into WorkList
2442 */
2443 
2444 #define NEED_P		0001	/* 'P': priority */
2445 #define NEED_T		0002	/* 'T': time */
2446 #define NEED_R		0004	/* 'R': recipient */
2447 #define NEED_S		0010	/* 'S': sender */
2448 #define NEED_H		0020	/* host */
2449 #define HAS_QUARANTINE	0040	/* has an unexpected 'q' line */
2450 #define NEED_QUARANTINE	0100	/* 'q': reason */
2451 
2452 static WORK	*WorkList = NULL;	/* list of unsort work */
2453 static int	WorkListSize = 0;	/* current max size of WorkList */
2454 static int	WorkListCount = 0;	/* # of work items in WorkList */
2455 
2456 static int
2457 gatherq(qgrp, qdir, doall, full, more)
2458 	int qgrp;
2459 	int qdir;
2460 	bool doall;
2461 	bool *full;
2462 	bool *more;
2463 {
2464 	register struct dirent *d;
2465 	register WORK *w;
2466 	register char *p;
2467 	DIR *f;
2468 	int i, num_ent;
2469 	int wn;
2470 	QUEUE_CHAR *check;
2471 	char qd[MAXPATHLEN];
2472 	char qf[MAXPATHLEN];
2473 
2474 	wn = WorkListCount - 1;
2475 	num_ent = 0;
2476 	if (qdir == NOQDIR)
2477 		(void) sm_strlcpy(qd, ".", sizeof qd);
2478 	else
2479 		(void) sm_strlcpyn(qd, sizeof qd, 2,
2480 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
2481 			(bitset(QP_SUBQF,
2482 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
2483 					? "/qf" : ""));
2484 
2485 	if (tTd(41, 1))
2486 	{
2487 		sm_dprintf("gatherq:\n");
2488 
2489 		check = QueueLimitId;
2490 		while (check != NULL)
2491 		{
2492 			sm_dprintf("\tQueueLimitId = %s%s\n",
2493 				check->queue_negate ? "!" : "",
2494 				check->queue_match);
2495 			check = check->queue_next;
2496 		}
2497 
2498 		check = QueueLimitSender;
2499 		while (check != NULL)
2500 		{
2501 			sm_dprintf("\tQueueLimitSender = %s%s\n",
2502 				check->queue_negate ? "!" : "",
2503 				check->queue_match);
2504 			check = check->queue_next;
2505 		}
2506 
2507 		check = QueueLimitRecipient;
2508 		while (check != NULL)
2509 		{
2510 			sm_dprintf("\tQueueLimitRecipient = %s%s\n",
2511 				check->queue_negate ? "!" : "",
2512 				check->queue_match);
2513 			check = check->queue_next;
2514 		}
2515 
2516 		if (QueueMode == QM_QUARANTINE)
2517 		{
2518 			check = QueueLimitQuarantine;
2519 			while (check != NULL)
2520 			{
2521 				sm_dprintf("\tQueueLimitQuarantine = %s%s\n",
2522 					   check->queue_negate ? "!" : "",
2523 					   check->queue_match);
2524 				check = check->queue_next;
2525 			}
2526 		}
2527 	}
2528 
2529 	/* open the queue directory */
2530 	f = opendir(qd);
2531 	if (f == NULL)
2532 	{
2533 		syserr("gatherq: cannot open \"%s\"",
2534 			qid_printqueue(qgrp, qdir));
2535 		if (full != NULL)
2536 			*full = WorkListCount >= MaxQueueRun && MaxQueueRun > 0;
2537 		if (more != NULL)
2538 			*more = false;
2539 		return 0;
2540 	}
2541 
2542 	/*
2543 	**  Read the work directory.
2544 	*/
2545 
2546 	while ((d = readdir(f)) != NULL)
2547 	{
2548 		SM_FILE_T *cf;
2549 		int qfver = 0;
2550 		char lbuf[MAXNAME + 1];
2551 		struct stat sbuf;
2552 
2553 		if (tTd(41, 50))
2554 			sm_dprintf("gatherq: checking %s..", d->d_name);
2555 
2556 		/* is this an interesting entry? */
2557 		if (!(((QueueMode == QM_NORMAL &&
2558 			d->d_name[0] == NORMQF_LETTER) ||
2559 		       (QueueMode == QM_QUARANTINE &&
2560 			d->d_name[0] == QUARQF_LETTER) ||
2561 		       (QueueMode == QM_LOST &&
2562 			d->d_name[0] == LOSEQF_LETTER)) &&
2563 		      d->d_name[1] == 'f'))
2564 		{
2565 			if (tTd(41, 50))
2566 				sm_dprintf("  skipping\n");
2567 			continue;
2568 		}
2569 		if (tTd(41, 50))
2570 			sm_dprintf("\n");
2571 
2572 		if (strlen(d->d_name) >= MAXQFNAME)
2573 		{
2574 			if (Verbose)
2575 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
2576 						     "gatherq: %s too long, %d max characters\n",
2577 						     d->d_name, MAXQFNAME);
2578 			if (LogLevel > 0)
2579 				sm_syslog(LOG_ALERT, NOQID,
2580 					  "gatherq: %s too long, %d max characters",
2581 					  d->d_name, MAXQFNAME);
2582 			continue;
2583 		}
2584 
2585 		check = QueueLimitId;
2586 		while (check != NULL)
2587 		{
2588 			if (strcontainedin(false, check->queue_match,
2589 					   d->d_name) != check->queue_negate)
2590 				break;
2591 			else
2592 				check = check->queue_next;
2593 		}
2594 		if (QueueLimitId != NULL && check == NULL)
2595 			continue;
2596 
2597 		/* grow work list if necessary */
2598 		if (++wn >= MaxQueueRun && MaxQueueRun > 0)
2599 		{
2600 			if (wn == MaxQueueRun && LogLevel > 0)
2601 				sm_syslog(LOG_WARNING, NOQID,
2602 					  "WorkList for %s maxed out at %d",
2603 					  qid_printqueue(qgrp, qdir),
2604 					  MaxQueueRun);
2605 			if (doall)
2606 				continue;	/* just count entries */
2607 			break;
2608 		}
2609 		if (wn >= WorkListSize)
2610 		{
2611 			grow_wlist(qgrp, qdir);
2612 			if (wn >= WorkListSize)
2613 				continue;
2614 		}
2615 		SM_ASSERT(wn >= 0);
2616 		w = &WorkList[wn];
2617 
2618 		(void) sm_strlcpyn(qf, sizeof qf, 3, qd, "/", d->d_name);
2619 		if (stat(qf, &sbuf) < 0)
2620 		{
2621 			if (errno != ENOENT)
2622 				sm_syslog(LOG_INFO, NOQID,
2623 					  "gatherq: can't stat %s/%s",
2624 					  qid_printqueue(qgrp, qdir),
2625 					  d->d_name);
2626 			wn--;
2627 			continue;
2628 		}
2629 		if (!bitset(S_IFREG, sbuf.st_mode))
2630 		{
2631 			/* Yikes!  Skip it or we will hang on open! */
2632 			if (!((d->d_name[0] == DATAFL_LETTER ||
2633 			       d->d_name[0] == NORMQF_LETTER ||
2634 			       d->d_name[0] == QUARQF_LETTER ||
2635 			       d->d_name[0] == LOSEQF_LETTER ||
2636 			       d->d_name[0] == XSCRPT_LETTER) &&
2637 			      d->d_name[1] == 'f' && d->d_name[2] == '\0'))
2638 				syserr("gatherq: %s/%s is not a regular file",
2639 				       qid_printqueue(qgrp, qdir), d->d_name);
2640 			wn--;
2641 			continue;
2642 		}
2643 
2644 		/* avoid work if possible */
2645 		if ((QueueSortOrder == QSO_BYFILENAME ||
2646 		     QueueSortOrder == QSO_BYMODTIME ||
2647 		     QueueSortOrder == QSO_RANDOM) &&
2648 		    QueueLimitQuarantine == NULL &&
2649 		    QueueLimitSender == NULL &&
2650 		    QueueLimitRecipient == NULL)
2651 		{
2652 			w->w_qgrp = qgrp;
2653 			w->w_qdir = qdir;
2654 			w->w_name = newstr(d->d_name);
2655 			w->w_host = NULL;
2656 			w->w_lock = w->w_tooyoung = false;
2657 			w->w_pri = 0;
2658 			w->w_ctime = 0;
2659 			w->w_mtime = sbuf.st_mtime;
2660 			++num_ent;
2661 			continue;
2662 		}
2663 
2664 		/* open control file */
2665 		cf = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
2666 				NULL);
2667 		if (cf == NULL && OpMode != MD_PRINT)
2668 		{
2669 			/* this may be some random person sending hir msgs */
2670 			if (tTd(41, 2))
2671 				sm_dprintf("gatherq: cannot open %s: %s\n",
2672 					d->d_name, sm_errstring(errno));
2673 			errno = 0;
2674 			wn--;
2675 			continue;
2676 		}
2677 		w->w_qgrp = qgrp;
2678 		w->w_qdir = qdir;
2679 		w->w_name = newstr(d->d_name);
2680 		w->w_host = NULL;
2681 		if (cf != NULL)
2682 		{
2683 			w->w_lock = !lockfile(sm_io_getinfo(cf, SM_IO_WHAT_FD,
2684 							    NULL),
2685 					      w->w_name, NULL,
2686 					      LOCK_SH|LOCK_NB);
2687 		}
2688 		w->w_tooyoung = false;
2689 
2690 		/* make sure jobs in creation don't clog queue */
2691 		w->w_pri = 0x7fffffff;
2692 		w->w_ctime = 0;
2693 		w->w_mtime = sbuf.st_mtime;
2694 
2695 		/* extract useful information */
2696 		i = NEED_P|NEED_T;
2697 		if (QueueSortOrder == QSO_BYHOST
2698 #if _FFR_RHS
2699 		    || QueueSortOrder == QSO_BYSHUFFLE
2700 #endif /* _FFR_RHS */
2701 		   )
2702 		{
2703 			/* need w_host set for host sort order */
2704 			i |= NEED_H;
2705 		}
2706 		if (QueueLimitSender != NULL)
2707 			i |= NEED_S;
2708 		if (QueueLimitRecipient != NULL)
2709 			i |= NEED_R;
2710 		if (QueueLimitQuarantine != NULL)
2711 			i |= NEED_QUARANTINE;
2712 		while (cf != NULL && i != 0 &&
2713 		       sm_io_fgets(cf, SM_TIME_DEFAULT, lbuf,
2714 				   sizeof lbuf) != NULL)
2715 		{
2716 			int c;
2717 			time_t age;
2718 
2719 			p = strchr(lbuf, '\n');
2720 			if (p != NULL)
2721 				*p = '\0';
2722 			else
2723 			{
2724 				/* flush rest of overly long line */
2725 				while ((c = sm_io_getc(cf, SM_TIME_DEFAULT))
2726 				       != SM_IO_EOF && c != '\n')
2727 					continue;
2728 			}
2729 
2730 			switch (lbuf[0])
2731 			{
2732 			  case 'V':
2733 				qfver = atoi(&lbuf[1]);
2734 				break;
2735 
2736 			  case 'P':
2737 				w->w_pri = atol(&lbuf[1]);
2738 				i &= ~NEED_P;
2739 				break;
2740 
2741 			  case 'T':
2742 				w->w_ctime = atol(&lbuf[1]);
2743 				i &= ~NEED_T;
2744 				break;
2745 
2746 			  case 'q':
2747 				if (QueueMode != QM_QUARANTINE &&
2748 				    QueueMode != QM_LOST)
2749 				{
2750 					if (tTd(41, 49))
2751 						sm_dprintf("%s not marked as quarantined but has a 'q' line\n",
2752 							   w->w_name);
2753 					i |= HAS_QUARANTINE;
2754 				}
2755 				else if (QueueMode == QM_QUARANTINE)
2756 				{
2757 					if (QueueLimitQuarantine == NULL)
2758 					{
2759 						i &= ~NEED_QUARANTINE;
2760 						break;
2761 					}
2762 					p = &lbuf[1];
2763 					check = QueueLimitQuarantine;
2764 					while (check != NULL)
2765 					{
2766 						if (strcontainedin(false,
2767 								   check->queue_match,
2768 								   p) !=
2769 						    check->queue_negate)
2770 							break;
2771 						else
2772 							check = check->queue_next;
2773 					}
2774 					if (check != NULL)
2775 						i &= ~NEED_QUARANTINE;
2776 				}
2777 				break;
2778 
2779 			  case 'R':
2780 				if (w->w_host == NULL &&
2781 				    (p = strrchr(&lbuf[1], '@')) != NULL)
2782 				{
2783 #if _FFR_RHS
2784 					if (QueueSortOrder == QSO_BYSHUFFLE)
2785 						w->w_host = newstr(&p[1]);
2786 					else
2787 #endif /* _FFR_RHS */
2788 						w->w_host = strrev(&p[1]);
2789 					makelower(w->w_host);
2790 					i &= ~NEED_H;
2791 				}
2792 				if (QueueLimitRecipient == NULL)
2793 				{
2794 					i &= ~NEED_R;
2795 					break;
2796 				}
2797 				if (qfver > 0)
2798 				{
2799 					p = strchr(&lbuf[1], ':');
2800 					if (p == NULL)
2801 						p = &lbuf[1];
2802 					else
2803 						++p; /* skip over ':' */
2804 				}
2805 				else
2806 					p = &lbuf[1];
2807 				check = QueueLimitRecipient;
2808 				while (check != NULL)
2809 				{
2810 					if (strcontainedin(true,
2811 							   check->queue_match,
2812 							   p) !=
2813 					    check->queue_negate)
2814 						break;
2815 					else
2816 						check = check->queue_next;
2817 				}
2818 				if (check != NULL)
2819 					i &= ~NEED_R;
2820 				break;
2821 
2822 			  case 'S':
2823 				check = QueueLimitSender;
2824 				while (check != NULL)
2825 				{
2826 					if (strcontainedin(true,
2827 							   check->queue_match,
2828 							   &lbuf[1]) !=
2829 					    check->queue_negate)
2830 						break;
2831 					else
2832 						check = check->queue_next;
2833 				}
2834 				if (check != NULL)
2835 					i &= ~NEED_S;
2836 				break;
2837 
2838 			  case 'K':
2839 				age = curtime() - (time_t) atol(&lbuf[1]);
2840 				if (age >= 0 && MinQueueAge > 0 &&
2841 				    age < MinQueueAge)
2842 					w->w_tooyoung = true;
2843 				break;
2844 
2845 			  case 'N':
2846 				if (atol(&lbuf[1]) == 0)
2847 					w->w_tooyoung = false;
2848 				break;
2849 			}
2850 		}
2851 		if (cf != NULL)
2852 			(void) sm_io_close(cf, SM_TIME_DEFAULT);
2853 
2854 		if ((!doall && shouldqueue(w->w_pri, w->w_ctime)) ||
2855 		    bitset(HAS_QUARANTINE, i) ||
2856 		    bitset(NEED_QUARANTINE, i) ||
2857 		    bitset(NEED_R|NEED_S, i))
2858 		{
2859 			/* don't even bother sorting this job in */
2860 			if (tTd(41, 49))
2861 				sm_dprintf("skipping %s (%x)\n", w->w_name, i);
2862 			sm_free(w->w_name); /* XXX */
2863 			if (w->w_host != NULL)
2864 				sm_free(w->w_host); /* XXX */
2865 			wn--;
2866 		}
2867 		else
2868 			++num_ent;
2869 	}
2870 	(void) closedir(f);
2871 	wn++;
2872 
2873 	i = wn - WorkListCount;
2874 	WorkListCount += SM_MIN(num_ent, WorkListSize);
2875 
2876 	if (more != NULL)
2877 		*more = WorkListCount < wn;
2878 
2879 	if (full != NULL)
2880 		*full = (wn >= MaxQueueRun && MaxQueueRun > 0) ||
2881 			(WorkList == NULL && wn > 0);
2882 
2883 	return i;
2884 }
2885 /*
2886 **  SORTQ -- sort the work list
2887 **
2888 **	First the old WorkQ is cleared away. Then the WorkList is sorted
2889 **	for all items so that important (higher sorting value) items are not
2890 **	trunctated off. Then the most important items are moved from
2891 **	WorkList to WorkQ. The lower count of 'max' or MaxListCount items
2892 **	are moved.
2893 **
2894 **	Parameters:
2895 **		max -- maximum number of items to be placed in WorkQ
2896 **
2897 **	Returns:
2898 **		the number of items in WorkQ
2899 **
2900 **	Side Effects:
2901 **		WorkQ gets released and filled with new work. WorkList
2902 **		gets released. Work items get sorted in order.
2903 */
2904 
2905 static int
2906 sortq(max)
2907 	int max;
2908 {
2909 	register int i;			/* local counter */
2910 	register WORK *w;		/* tmp item pointer */
2911 	int wc = WorkListCount;		/* trim size for WorkQ */
2912 
2913 	if (WorkQ != NULL)
2914 	{
2915 		WORK *nw;
2916 
2917 		/* Clear out old WorkQ. */
2918 		for (w = WorkQ; w != NULL; w = nw)
2919 		{
2920 			nw = w->w_next;
2921 			sm_free(w->w_name); /* XXX */
2922 			if (w->w_host != NULL)
2923 				sm_free(w->w_host); /* XXX */
2924 			sm_free((char *) w); /* XXX */
2925 		}
2926 		WorkQ = NULL;
2927 	}
2928 
2929 	if (WorkList == NULL || wc <= 0)
2930 		return 0;
2931 
2932 	/* Check if the per queue group item limit will be exceeded */
2933 	if (wc > max && max > 0)
2934 		wc = max;
2935 
2936 	/*
2937 	**  The sort now takes place using all of the items in WorkList.
2938 	**  The list gets trimmed to the most important items after the sort.
2939 	**  If the trim were to happen before the sort then one or more
2940 	**  important items might get truncated off -- not what we want.
2941 	*/
2942 
2943 	if (QueueSortOrder == QSO_BYHOST)
2944 	{
2945 		/*
2946 		**  Sort the work directory for the first time,
2947 		**  based on host name, lock status, and priority.
2948 		*/
2949 
2950 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf1);
2951 
2952 		/*
2953 		**  If one message to host is locked, "lock" all messages
2954 		**  to that host.
2955 		*/
2956 
2957 		i = 0;
2958 		while (i < wc)
2959 		{
2960 			if (!WorkList[i].w_lock)
2961 			{
2962 				i++;
2963 				continue;
2964 			}
2965 			w = &WorkList[i];
2966 			while (++i < wc)
2967 			{
2968 				if (WorkList[i].w_host == NULL &&
2969 				    w->w_host == NULL)
2970 					WorkList[i].w_lock = true;
2971 				else if (WorkList[i].w_host != NULL &&
2972 					 w->w_host != NULL &&
2973 					 sm_strcasecmp(WorkList[i].w_host,
2974 						       w->w_host) == 0)
2975 					WorkList[i].w_lock = true;
2976 				else
2977 					break;
2978 			}
2979 		}
2980 
2981 		/*
2982 		**  Sort the work directory for the second time,
2983 		**  based on lock status, host name, and priority.
2984 		*/
2985 
2986 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf2);
2987 	}
2988 	else if (QueueSortOrder == QSO_BYTIME)
2989 	{
2990 		/*
2991 		**  Simple sort based on submission time only.
2992 		*/
2993 
2994 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf3);
2995 	}
2996 	else if (QueueSortOrder == QSO_BYFILENAME)
2997 	{
2998 		/*
2999 		**  Sort based on queue filename.
3000 		*/
3001 
3002 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf4);
3003 	}
3004 	else if (QueueSortOrder == QSO_RANDOM)
3005 	{
3006 		/*
3007 		**  Sort randomly.  To avoid problems with an instable sort,
3008 		**  use a random index into the queue file name to start
3009 		**  comparison.
3010 		*/
3011 
3012 		randi = get_rand_mod(MAXQFNAME);
3013 		if (randi < 2)
3014 			randi = 3;
3015 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf5);
3016 	}
3017 	else if (QueueSortOrder == QSO_BYMODTIME)
3018 	{
3019 		/*
3020 		**  Simple sort based on modification time of queue file.
3021 		**  This puts the oldest items first.
3022 		*/
3023 
3024 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf6);
3025 	}
3026 #if _FFR_RHS
3027 	else if (QueueSortOrder == QSO_BYSHUFFLE)
3028 	{
3029 		/*
3030 		**  Simple sort based on shuffled host name.
3031 		*/
3032 
3033 		init_shuffle_alphabet();
3034 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf7);
3035 	}
3036 #endif /* _FFR_RHS */
3037 	else if (QueueSortOrder == QSO_BYPRIORITY)
3038 	{
3039 		/*
3040 		**  Simple sort based on queue priority only.
3041 		*/
3042 
3043 		qsort((char *) WorkList, wc, sizeof *WorkList, workcmpf0);
3044 	}
3045 	/* else don't sort at all */
3046 
3047 	/*
3048 	**  Convert the work list into canonical form.
3049 	**	Should be turning it into a list of envelopes here perhaps.
3050 	**  Only take the most important items up to the per queue group
3051 	**  maximum.
3052 	*/
3053 
3054 	for (i = wc; --i >= 0; )
3055 	{
3056 		w = (WORK *) xalloc(sizeof *w);
3057 		w->w_qgrp = WorkList[i].w_qgrp;
3058 		w->w_qdir = WorkList[i].w_qdir;
3059 		w->w_name = WorkList[i].w_name;
3060 		w->w_host = WorkList[i].w_host;
3061 		w->w_lock = WorkList[i].w_lock;
3062 		w->w_tooyoung = WorkList[i].w_tooyoung;
3063 		w->w_pri = WorkList[i].w_pri;
3064 		w->w_ctime = WorkList[i].w_ctime;
3065 		w->w_mtime = WorkList[i].w_mtime;
3066 		w->w_next = WorkQ;
3067 		WorkQ = w;
3068 	}
3069 
3070 	/* free the rest of the list */
3071 	for (i = WorkListCount; --i >= wc; )
3072 	{
3073 		sm_free(WorkList[i].w_name);
3074 		if (WorkList[i].w_host != NULL)
3075 			sm_free(WorkList[i].w_host);
3076 	}
3077 
3078 	if (WorkList != NULL)
3079 		sm_free(WorkList); /* XXX */
3080 	WorkList = NULL;
3081 	WorkListSize = 0;
3082 	WorkListCount = 0;
3083 
3084 	if (tTd(40, 1))
3085 	{
3086 		for (w = WorkQ; w != NULL; w = w->w_next)
3087 		{
3088 			if (w->w_host != NULL)
3089 				sm_dprintf("%22s: pri=%ld %s\n",
3090 					w->w_name, w->w_pri, w->w_host);
3091 			else
3092 				sm_dprintf("%32s: pri=%ld\n",
3093 					w->w_name, w->w_pri);
3094 		}
3095 	}
3096 
3097 	return wc; /* return number of WorkQ items */
3098 }
3099 /*
3100 **  GROW_WLIST -- make the work list larger
3101 **
3102 **	Parameters:
3103 **		qgrp -- the index for the queue group.
3104 **		qdir -- the index for the queue directory.
3105 **
3106 **	Returns:
3107 **		none.
3108 **
3109 **	Side Effects:
3110 **		Adds another QUEUESEGSIZE entries to WorkList if possible.
3111 **		It can fail if there isn't enough memory, so WorkListSize
3112 **		should be checked again upon return.
3113 */
3114 
3115 static void
3116 grow_wlist(qgrp, qdir)
3117 	int qgrp;
3118 	int qdir;
3119 {
3120 	if (tTd(41, 1))
3121 		sm_dprintf("grow_wlist: WorkListSize=%d\n", WorkListSize);
3122 	if (WorkList == NULL)
3123 	{
3124 		WorkList = (WORK *) xalloc((sizeof *WorkList) *
3125 					   (QUEUESEGSIZE + 1));
3126 		WorkListSize = QUEUESEGSIZE;
3127 	}
3128 	else
3129 	{
3130 		int newsize = WorkListSize + QUEUESEGSIZE;
3131 		WORK *newlist = (WORK *) sm_realloc((char *) WorkList,
3132 					  (unsigned) sizeof(WORK) * (newsize + 1));
3133 
3134 		if (newlist != NULL)
3135 		{
3136 			WorkListSize = newsize;
3137 			WorkList = newlist;
3138 			if (LogLevel > 1)
3139 			{
3140 				sm_syslog(LOG_INFO, NOQID,
3141 					  "grew WorkList for %s to %d",
3142 					  qid_printqueue(qgrp, qdir),
3143 					  WorkListSize);
3144 			}
3145 		}
3146 		else if (LogLevel > 0)
3147 		{
3148 			sm_syslog(LOG_ALERT, NOQID,
3149 				  "FAILED to grow WorkList for %s to %d",
3150 				  qid_printqueue(qgrp, qdir), newsize);
3151 		}
3152 	}
3153 	if (tTd(41, 1))
3154 		sm_dprintf("grow_wlist: WorkListSize now %d\n", WorkListSize);
3155 }
3156 /*
3157 **  WORKCMPF0 -- simple priority-only compare function.
3158 **
3159 **	Parameters:
3160 **		a -- the first argument.
3161 **		b -- the second argument.
3162 **
3163 **	Returns:
3164 **		-1 if a < b
3165 **		 0 if a == b
3166 **		+1 if a > b
3167 **
3168 */
3169 
3170 static int
3171 workcmpf0(a, b)
3172 	register WORK *a;
3173 	register WORK *b;
3174 {
3175 	long pa = a->w_pri;
3176 	long pb = b->w_pri;
3177 
3178 	if (pa == pb)
3179 		return 0;
3180 	else if (pa > pb)
3181 		return 1;
3182 	else
3183 		return -1;
3184 }
3185 /*
3186 **  WORKCMPF1 -- first compare function for ordering work based on host name.
3187 **
3188 **	Sorts on host name, lock status, and priority in that order.
3189 **
3190 **	Parameters:
3191 **		a -- the first argument.
3192 **		b -- the second argument.
3193 **
3194 **	Returns:
3195 **		<0 if a < b
3196 **		 0 if a == b
3197 **		>0 if a > b
3198 **
3199 */
3200 
3201 static int
3202 workcmpf1(a, b)
3203 	register WORK *a;
3204 	register WORK *b;
3205 {
3206 	int i;
3207 
3208 	/* host name */
3209 	if (a->w_host != NULL && b->w_host == NULL)
3210 		return 1;
3211 	else if (a->w_host == NULL && b->w_host != NULL)
3212 		return -1;
3213 	if (a->w_host != NULL && b->w_host != NULL &&
3214 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3215 		return i;
3216 
3217 	/* lock status */
3218 	if (a->w_lock != b->w_lock)
3219 		return b->w_lock - a->w_lock;
3220 
3221 	/* job priority */
3222 	return workcmpf0(a, b);
3223 }
3224 /*
3225 **  WORKCMPF2 -- second compare function for ordering work based on host name.
3226 **
3227 **	Sorts on lock status, host name, and priority in that order.
3228 **
3229 **	Parameters:
3230 **		a -- the first argument.
3231 **		b -- the second argument.
3232 **
3233 **	Returns:
3234 **		<0 if a < b
3235 **		 0 if a == b
3236 **		>0 if a > b
3237 **
3238 */
3239 
3240 static int
3241 workcmpf2(a, b)
3242 	register WORK *a;
3243 	register WORK *b;
3244 {
3245 	int i;
3246 
3247 	/* lock status */
3248 	if (a->w_lock != b->w_lock)
3249 		return a->w_lock - b->w_lock;
3250 
3251 	/* host name */
3252 	if (a->w_host != NULL && b->w_host == NULL)
3253 		return 1;
3254 	else if (a->w_host == NULL && b->w_host != NULL)
3255 		return -1;
3256 	if (a->w_host != NULL && b->w_host != NULL &&
3257 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3258 		return i;
3259 
3260 	/* job priority */
3261 	return workcmpf0(a, b);
3262 }
3263 /*
3264 **  WORKCMPF3 -- simple submission-time-only compare function.
3265 **
3266 **	Parameters:
3267 **		a -- the first argument.
3268 **		b -- the second argument.
3269 **
3270 **	Returns:
3271 **		-1 if a < b
3272 **		 0 if a == b
3273 **		+1 if a > b
3274 **
3275 */
3276 
3277 static int
3278 workcmpf3(a, b)
3279 	register WORK *a;
3280 	register WORK *b;
3281 {
3282 	if (a->w_ctime > b->w_ctime)
3283 		return 1;
3284 	else if (a->w_ctime < b->w_ctime)
3285 		return -1;
3286 	else
3287 		return 0;
3288 }
3289 /*
3290 **  WORKCMPF4 -- compare based on file name
3291 **
3292 **	Parameters:
3293 **		a -- the first argument.
3294 **		b -- the second argument.
3295 **
3296 **	Returns:
3297 **		-1 if a < b
3298 **		 0 if a == b
3299 **		+1 if a > b
3300 **
3301 */
3302 
3303 static int
3304 workcmpf4(a, b)
3305 	register WORK *a;
3306 	register WORK *b;
3307 {
3308 	return strcmp(a->w_name, b->w_name);
3309 }
3310 /*
3311 **  WORKCMPF5 -- compare based on assigned random number
3312 **
3313 **	Parameters:
3314 **		a -- the first argument (ignored).
3315 **		b -- the second argument (ignored).
3316 **
3317 **	Returns:
3318 **		randomly 1/-1
3319 */
3320 
3321 /* ARGSUSED0 */
3322 static int
3323 workcmpf5(a, b)
3324 	register WORK *a;
3325 	register WORK *b;
3326 {
3327 	if (strlen(a->w_name) < randi || strlen(b->w_name) < randi)
3328 		return -1;
3329 	return a->w_name[randi] - b->w_name[randi];
3330 }
3331 /*
3332 **  WORKCMPF6 -- simple modification-time-only compare function.
3333 **
3334 **	Parameters:
3335 **		a -- the first argument.
3336 **		b -- the second argument.
3337 **
3338 **	Returns:
3339 **		-1 if a < b
3340 **		 0 if a == b
3341 **		+1 if a > b
3342 **
3343 */
3344 
3345 static int
3346 workcmpf6(a, b)
3347 	register WORK *a;
3348 	register WORK *b;
3349 {
3350 	if (a->w_mtime > b->w_mtime)
3351 		return 1;
3352 	else if (a->w_mtime < b->w_mtime)
3353 		return -1;
3354 	else
3355 		return 0;
3356 }
3357 #if _FFR_RHS
3358 /*
3359 **  WORKCMPF7 -- compare function for ordering work based on shuffled host name.
3360 **
3361 **	Sorts on lock status, host name, and priority in that order.
3362 **
3363 **	Parameters:
3364 **		a -- the first argument.
3365 **		b -- the second argument.
3366 **
3367 **	Returns:
3368 **		<0 if a < b
3369 **		 0 if a == b
3370 **		>0 if a > b
3371 **
3372 */
3373 
3374 static int
3375 workcmpf7(a, b)
3376 	register WORK *a;
3377 	register WORK *b;
3378 {
3379 	int i;
3380 
3381 	/* lock status */
3382 	if (a->w_lock != b->w_lock)
3383 		return a->w_lock - b->w_lock;
3384 
3385 	/* host name */
3386 	if (a->w_host != NULL && b->w_host == NULL)
3387 		return 1;
3388 	else if (a->w_host == NULL && b->w_host != NULL)
3389 		return -1;
3390 	if (a->w_host != NULL && b->w_host != NULL &&
3391 	    (i = sm_strshufflecmp(a->w_host, b->w_host)) != 0)
3392 		return i;
3393 
3394 	/* job priority */
3395 	return workcmpf0(a, b);
3396 }
3397 #endif /* _FFR_RHS */
3398 /*
3399 **  STRREV -- reverse string
3400 **
3401 **	Returns a pointer to a new string that is the reverse of
3402 **	the string pointed to by fwd.  The space for the new
3403 **	string is obtained using xalloc().
3404 **
3405 **	Parameters:
3406 **		fwd -- the string to reverse.
3407 **
3408 **	Returns:
3409 **		the reversed string.
3410 */
3411 
3412 static char *
3413 strrev(fwd)
3414 	char *fwd;
3415 {
3416 	char *rev = NULL;
3417 	int len, cnt;
3418 
3419 	len = strlen(fwd);
3420 	rev = xalloc(len + 1);
3421 	for (cnt = 0; cnt < len; ++cnt)
3422 		rev[cnt] = fwd[len - cnt - 1];
3423 	rev[len] = '\0';
3424 	return rev;
3425 }
3426 
3427 #if _FFR_RHS
3428 
3429 # define NASCII	128
3430 # define NCHAR	256
3431 
3432 static unsigned char ShuffledAlphabet[NCHAR];
3433 
3434 void
3435 init_shuffle_alphabet()
3436 {
3437 	static bool init = false;
3438 	int i;
3439 
3440 	if (init)
3441 		return;
3442 
3443 	/* fill the ShuffledAlphabet */
3444 	for (i = 0; i < NCHAR; i++)
3445 		ShuffledAlphabet[i] = i;
3446 
3447 	/* mix it */
3448 	for (i = 1; i < NCHAR; i++)
3449 	{
3450 		register int j = get_random() % NCHAR;
3451 		register int tmp;
3452 
3453 		tmp = ShuffledAlphabet[j];
3454 		ShuffledAlphabet[j] = ShuffledAlphabet[i];
3455 		ShuffledAlphabet[i] = tmp;
3456 	}
3457 
3458 	/* make it case insensitive */
3459 	for (i = 'A'; i <= 'Z'; i++)
3460 		ShuffledAlphabet[i] = ShuffledAlphabet[i + 'a' - 'A'];
3461 
3462 	/* fill the upper part */
3463 	for (i = 0; i < NCHAR; i++)
3464 		ShuffledAlphabet[i + NCHAR] = ShuffledAlphabet[i];
3465 	init = true;
3466 }
3467 
3468 static int
3469 sm_strshufflecmp(a, b)
3470 	char *a;
3471 	char *b;
3472 {
3473 	const unsigned char *us1 = (const unsigned char *) a;
3474 	const unsigned char *us2 = (const unsigned char *) b;
3475 
3476 	while (ShuffledAlphabet[*us1] == ShuffledAlphabet[*us2++])
3477 	{
3478 		if (*us1++ == '\0')
3479 			return 0;
3480 	}
3481 	return (ShuffledAlphabet[*us1] - ShuffledAlphabet[*--us2]);
3482 }
3483 #endif /* _FFR_RHS */
3484 
3485 /*
3486 **  DOWORK -- do a work request.
3487 **
3488 **	Parameters:
3489 **		qgrp -- the index of the queue group for the job.
3490 **		qdir -- the index of the queue directory for the job.
3491 **		id -- the ID of the job to run.
3492 **		forkflag -- if set, run this in background.
3493 **		requeueflag -- if set, reinstantiate the queue quickly.
3494 **			This is used when expanding aliases in the queue.
3495 **			If forkflag is also set, it doesn't wait for the
3496 **			child.
3497 **		e - the envelope in which to run it.
3498 **
3499 **	Returns:
3500 **		process id of process that is running the queue job.
3501 **
3502 **	Side Effects:
3503 **		The work request is satisfied if possible.
3504 */
3505 
3506 pid_t
3507 dowork(qgrp, qdir, id, forkflag, requeueflag, e)
3508 	int qgrp;
3509 	int qdir;
3510 	char *id;
3511 	bool forkflag;
3512 	bool requeueflag;
3513 	register ENVELOPE *e;
3514 {
3515 	register pid_t pid;
3516 	SM_RPOOL_T *rpool;
3517 
3518 	if (tTd(40, 1))
3519 		sm_dprintf("dowork(%s/%s)\n", qid_printqueue(qgrp, qdir), id);
3520 
3521 	/*
3522 	**  Fork for work.
3523 	*/
3524 
3525 	if (forkflag)
3526 	{
3527 		/*
3528 		**  Since the delivery may happen in a child and the
3529 		**  parent does not wait, the parent may close the
3530 		**  maps thereby removing any shared memory used by
3531 		**  the map.  Therefore, close the maps now so the
3532 		**  child will dynamically open them if necessary.
3533 		*/
3534 
3535 		closemaps(false);
3536 
3537 		pid = fork();
3538 		if (pid < 0)
3539 		{
3540 			syserr("dowork: cannot fork");
3541 			return 0;
3542 		}
3543 		else if (pid > 0)
3544 		{
3545 			/* parent -- clean out connection cache */
3546 			mci_flush(false, NULL);
3547 		}
3548 		else
3549 		{
3550 			/*
3551 			**  Initialize exception stack and default exception
3552 			**  handler for child process.
3553 			*/
3554 
3555 			/* Reset global flags */
3556 			RestartRequest = NULL;
3557 			RestartWorkGroup = false;
3558 			ShutdownRequest = NULL;
3559 			PendingSignal = 0;
3560 			CurrentPid = getpid();
3561 			sm_exc_newthread(fatal_error);
3562 
3563 			/*
3564 			**  See note above about SMTP processes and SIGCHLD.
3565 			*/
3566 
3567 			if (OpMode == MD_SMTP ||
3568 			    OpMode == MD_DAEMON ||
3569 			    MaxQueueChildren > 0)
3570 			{
3571 				proc_list_clear();
3572 				sm_releasesignal(SIGCHLD);
3573 				(void) sm_signal(SIGCHLD, SIG_DFL);
3574 			}
3575 
3576 			/* child -- error messages to the transcript */
3577 			QuickAbort = OnlyOneError = false;
3578 		}
3579 	}
3580 	else
3581 	{
3582 		pid = 0;
3583 	}
3584 
3585 	if (pid == 0)
3586 	{
3587 		/*
3588 		**  CHILD
3589 		**	Lock the control file to avoid duplicate deliveries.
3590 		**		Then run the file as though we had just read it.
3591 		**	We save an idea of the temporary name so we
3592 		**		can recover on interrupt.
3593 		*/
3594 
3595 		if (forkflag)
3596 		{
3597 			/* Reset global flags */
3598 			RestartRequest = NULL;
3599 			RestartWorkGroup = false;
3600 			ShutdownRequest = NULL;
3601 			PendingSignal = 0;
3602 		}
3603 
3604 		/* set basic modes, etc. */
3605 		sm_clear_events();
3606 		clearstats();
3607 		rpool = sm_rpool_new_x(NULL);
3608 		clearenvelope(e, false, rpool);
3609 		e->e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3610 		set_delivery_mode(SM_DELIVER, e);
3611 		e->e_errormode = EM_MAIL;
3612 		e->e_id = id;
3613 		e->e_qgrp = qgrp;
3614 		e->e_qdir = qdir;
3615 		GrabTo = UseErrorsTo = false;
3616 		ExitStat = EX_OK;
3617 		if (forkflag)
3618 		{
3619 			disconnect(1, e);
3620 			set_op_mode(MD_QUEUERUN);
3621 		}
3622 		sm_setproctitle(true, e, "%s from queue", qid_printname(e));
3623 		if (LogLevel > 76)
3624 			sm_syslog(LOG_DEBUG, e->e_id, "dowork, pid=%d",
3625 				  (int) CurrentPid);
3626 
3627 		/* don't use the headers from sendmail.cf... */
3628 		e->e_header = NULL;
3629 
3630 		/* read the queue control file -- return if locked */
3631 		if (!readqf(e, false))
3632 		{
3633 			if (tTd(40, 4) && e->e_id != NULL)
3634 				sm_dprintf("readqf(%s) failed\n",
3635 					qid_printname(e));
3636 			e->e_id = NULL;
3637 			if (forkflag)
3638 				finis(false, true, EX_OK);
3639 			else
3640 			{
3641 				/* adding this frees 8 bytes */
3642 				clearenvelope(e, false, rpool);
3643 
3644 				/* adding this frees 12 bytes */
3645 				sm_rpool_free(rpool);
3646 				e->e_rpool = NULL;
3647 				return 0;
3648 			}
3649 		}
3650 
3651 		e->e_flags |= EF_INQUEUE;
3652 		eatheader(e, requeueflag, true);
3653 
3654 		if (requeueflag)
3655 			queueup(e, false, false);
3656 
3657 		/* do the delivery */
3658 		sendall(e, SM_DELIVER);
3659 
3660 		/* finish up and exit */
3661 		if (forkflag)
3662 			finis(true, true, ExitStat);
3663 		else
3664 		{
3665 			dropenvelope(e, true, false);
3666 			sm_rpool_free(rpool);
3667 			e->e_rpool = NULL;
3668 		}
3669 	}
3670 	e->e_id = NULL;
3671 	return pid;
3672 }
3673 
3674 /*
3675 **  DOWORKLIST -- process a list of envelopes as work requests
3676 **
3677 **	Similar to dowork(), except that after forking, it processes an
3678 **	envelope and its siblings, treating each envelope as a work request.
3679 **
3680 **	Parameters:
3681 **		el -- envelope to be processed including its siblings.
3682 **		forkflag -- if set, run this in background.
3683 **		requeueflag -- if set, reinstantiate the queue quickly.
3684 **			This is used when expanding aliases in the queue.
3685 **			If forkflag is also set, it doesn't wait for the
3686 **			child.
3687 **
3688 **	Returns:
3689 **		process id of process that is running the queue job.
3690 **
3691 **	Side Effects:
3692 **		The work request is satisfied if possible.
3693 */
3694 
3695 pid_t
3696 doworklist(el, forkflag, requeueflag)
3697 	ENVELOPE *el;
3698 	bool forkflag;
3699 	bool requeueflag;
3700 {
3701 	register pid_t pid;
3702 	ENVELOPE *ei;
3703 
3704 	if (tTd(40, 1))
3705 		sm_dprintf("doworklist()\n");
3706 
3707 	/*
3708 	**  Fork for work.
3709 	*/
3710 
3711 	if (forkflag)
3712 	{
3713 		/*
3714 		**  Since the delivery may happen in a child and the
3715 		**  parent does not wait, the parent may close the
3716 		**  maps thereby removing any shared memory used by
3717 		**  the map.  Therefore, close the maps now so the
3718 		**  child will dynamically open them if necessary.
3719 		*/
3720 
3721 		closemaps(false);
3722 
3723 		pid = fork();
3724 		if (pid < 0)
3725 		{
3726 			syserr("doworklist: cannot fork");
3727 			return 0;
3728 		}
3729 		else if (pid > 0)
3730 		{
3731 			/* parent -- clean out connection cache */
3732 			mci_flush(false, NULL);
3733 		}
3734 		else
3735 		{
3736 			/*
3737 			**  Initialize exception stack and default exception
3738 			**  handler for child process.
3739 			*/
3740 
3741 			/* Reset global flags */
3742 			RestartRequest = NULL;
3743 			RestartWorkGroup = false;
3744 			ShutdownRequest = NULL;
3745 			PendingSignal = 0;
3746 			CurrentPid = getpid();
3747 			sm_exc_newthread(fatal_error);
3748 
3749 			/*
3750 			**  See note above about SMTP processes and SIGCHLD.
3751 			*/
3752 
3753 			if (OpMode == MD_SMTP ||
3754 			    OpMode == MD_DAEMON ||
3755 			    MaxQueueChildren > 0)
3756 			{
3757 				proc_list_clear();
3758 				sm_releasesignal(SIGCHLD);
3759 				(void) sm_signal(SIGCHLD, SIG_DFL);
3760 			}
3761 
3762 			/* child -- error messages to the transcript */
3763 			QuickAbort = OnlyOneError = false;
3764 		}
3765 	}
3766 	else
3767 	{
3768 		pid = 0;
3769 	}
3770 
3771 	if (pid != 0)
3772 		return pid;
3773 
3774 	/*
3775 	**  IN CHILD
3776 	**	Lock the control file to avoid duplicate deliveries.
3777 	**		Then run the file as though we had just read it.
3778 	**	We save an idea of the temporary name so we
3779 	**		can recover on interrupt.
3780 	*/
3781 
3782 	if (forkflag)
3783 	{
3784 		/* Reset global flags */
3785 		RestartRequest = NULL;
3786 		RestartWorkGroup = false;
3787 		ShutdownRequest = NULL;
3788 		PendingSignal = 0;
3789 	}
3790 
3791 	/* set basic modes, etc. */
3792 	sm_clear_events();
3793 	clearstats();
3794 	GrabTo = UseErrorsTo = false;
3795 	ExitStat = EX_OK;
3796 	if (forkflag)
3797 	{
3798 		disconnect(1, el);
3799 		set_op_mode(MD_QUEUERUN);
3800 	}
3801 	if (LogLevel > 76)
3802 		sm_syslog(LOG_DEBUG, el->e_id, "doworklist, pid=%d",
3803 			  (int) CurrentPid);
3804 
3805 	for (ei = el; ei != NULL; ei = ei->e_sibling)
3806 	{
3807 		ENVELOPE e;
3808 		SM_RPOOL_T *rpool;
3809 
3810 		if (WILL_BE_QUEUED(ei->e_sendmode))
3811 			continue;
3812 		else if (QueueMode != QM_QUARANTINE &&
3813 			 ei->e_quarmsg != NULL)
3814 			continue;
3815 
3816 		rpool = sm_rpool_new_x(NULL);
3817 		clearenvelope(&e, true, rpool);
3818 		e.e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3819 		set_delivery_mode(SM_DELIVER, &e);
3820 		e.e_errormode = EM_MAIL;
3821 		e.e_id = ei->e_id;
3822 		e.e_qgrp = ei->e_qgrp;
3823 		e.e_qdir = ei->e_qdir;
3824 		openxscript(&e);
3825 		sm_setproctitle(true, &e, "%s from queue", qid_printname(&e));
3826 
3827 		/* don't use the headers from sendmail.cf... */
3828 		e.e_header = NULL;
3829 		CurEnv = &e;
3830 
3831 		/* read the queue control file -- return if locked */
3832 		if (readqf(&e, false))
3833 		{
3834 			e.e_flags |= EF_INQUEUE;
3835 			eatheader(&e, requeueflag, true);
3836 
3837 			if (requeueflag)
3838 				queueup(&e, false, false);
3839 
3840 			/* do the delivery */
3841 			sendall(&e, SM_DELIVER);
3842 			dropenvelope(&e, true, false);
3843 		}
3844 		else
3845 		{
3846 			if (tTd(40, 4) && e.e_id != NULL)
3847 				sm_dprintf("readqf(%s) failed\n",
3848 					qid_printname(&e));
3849 		}
3850 		sm_rpool_free(rpool);
3851 		ei->e_id = NULL;
3852 	}
3853 
3854 	/* restore CurEnv */
3855 	CurEnv = el;
3856 
3857 	/* finish up and exit */
3858 	if (forkflag)
3859 		finis(true, true, ExitStat);
3860 	return 0;
3861 }
3862 /*
3863 **  READQF -- read queue file and set up environment.
3864 **
3865 **	Parameters:
3866 **		e -- the envelope of the job to run.
3867 **		openonly -- only open the qf (returned as e_lockfp)
3868 **
3869 **	Returns:
3870 **		true if it successfully read the queue file.
3871 **		false otherwise.
3872 **
3873 **	Side Effects:
3874 **		The queue file is returned locked.
3875 */
3876 
3877 static bool
3878 readqf(e, openonly)
3879 	register ENVELOPE *e;
3880 	bool openonly;
3881 {
3882 	register SM_FILE_T *qfp;
3883 	ADDRESS *ctladdr;
3884 	struct stat st, stf;
3885 	char *bp;
3886 	int qfver = 0;
3887 	long hdrsize = 0;
3888 	register char *p;
3889 	char *frcpt = NULL;
3890 	char *orcpt = NULL;
3891 	bool nomore = false;
3892 	bool bogus = false;
3893 	MODE_T qsafe;
3894 	char *err;
3895 	char qf[MAXPATHLEN];
3896 	char buf[MAXLINE];
3897 
3898 	/*
3899 	**  Read and process the file.
3900 	*/
3901 
3902 	(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER), sizeof qf);
3903 	qfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDWR_B, NULL);
3904 	if (qfp == NULL)
3905 	{
3906 		int save_errno = errno;
3907 
3908 		if (tTd(40, 8))
3909 			sm_dprintf("readqf(%s): sm_io_open failure (%s)\n",
3910 				qf, sm_errstring(errno));
3911 		errno = save_errno;
3912 		if (errno != ENOENT
3913 		    )
3914 			syserr("readqf: no control file %s", qf);
3915 		RELEASE_QUEUE;
3916 		return false;
3917 	}
3918 
3919 	if (!lockfile(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), qf, NULL,
3920 		      LOCK_EX|LOCK_NB))
3921 	{
3922 		/* being processed by another queuer */
3923 		if (Verbose)
3924 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3925 					     "%s: locked\n", e->e_id);
3926 		if (tTd(40, 8))
3927 			sm_dprintf("%s: locked\n", e->e_id);
3928 		if (LogLevel > 19)
3929 			sm_syslog(LOG_DEBUG, e->e_id, "locked");
3930 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3931 		RELEASE_QUEUE;
3932 		return false;
3933 	}
3934 
3935 	RELEASE_QUEUE;
3936 
3937 	/*
3938 	**  Prevent locking race condition.
3939 	**
3940 	**  Process A: readqf(): qfp = fopen(qffile)
3941 	**  Process B: queueup(): rename(tf, qf)
3942 	**  Process B: unlocks(tf)
3943 	**  Process A: lockfile(qf);
3944 	**
3945 	**  Process A (us) has the old qf file (before the rename deleted
3946 	**  the directory entry) and will be delivering based on old data.
3947 	**  This can lead to multiple deliveries of the same recipients.
3948 	**
3949 	**  Catch this by checking if the underlying qf file has changed
3950 	**  *after* acquiring our lock and if so, act as though the file
3951 	**  was still locked (i.e., just return like the lockfile() case
3952 	**  above.
3953 	*/
3954 
3955 	if (stat(qf, &stf) < 0 ||
3956 	    fstat(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), &st) < 0)
3957 	{
3958 		/* must have been being processed by someone else */
3959 		if (tTd(40, 8))
3960 			sm_dprintf("readqf(%s): [f]stat failure (%s)\n",
3961 				qf, sm_errstring(errno));
3962 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3963 		return false;
3964 	}
3965 
3966 	if (st.st_nlink != stf.st_nlink ||
3967 	    st.st_dev != stf.st_dev ||
3968 	    ST_INODE(st) != ST_INODE(stf) ||
3969 #if HAS_ST_GEN && 0		/* AFS returns garbage in st_gen */
3970 	    st.st_gen != stf.st_gen ||
3971 #endif /* HAS_ST_GEN && 0 */
3972 	    st.st_uid != stf.st_uid ||
3973 	    st.st_gid != stf.st_gid ||
3974 	    st.st_size != stf.st_size)
3975 	{
3976 		/* changed after opened */
3977 		if (Verbose)
3978 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3979 					     "%s: changed\n", e->e_id);
3980 		if (tTd(40, 8))
3981 			sm_dprintf("%s: changed\n", e->e_id);
3982 		if (LogLevel > 19)
3983 			sm_syslog(LOG_DEBUG, e->e_id, "changed");
3984 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3985 		return false;
3986 	}
3987 
3988 	/*
3989 	**  Check the queue file for plausibility to avoid attacks.
3990 	*/
3991 
3992 	qsafe = S_IWOTH|S_IWGRP;
3993 	if (bitset(S_IWGRP, QueueFileMode))
3994 		qsafe &= ~S_IWGRP;
3995 
3996 	bogus = st.st_uid != geteuid() &&
3997 		st.st_uid != TrustedUid &&
3998 		geteuid() != RealUid;
3999 
4000 	/*
4001 	**  If this qf file results from a set-group-ID binary, then
4002 	**  we check whether the directory is group-writable,
4003 	**  the queue file mode contains the group-writable bit, and
4004 	**  the groups are the same.
4005 	**  Notice: this requires that the set-group-ID binary is used to
4006 	**  run the queue!
4007 	*/
4008 
4009 	if (bogus && st.st_gid == getegid() && UseMSP)
4010 	{
4011 		char delim;
4012 		struct stat dst;
4013 
4014 		bp = SM_LAST_DIR_DELIM(qf);
4015 		if (bp == NULL)
4016 			delim = '\0';
4017 		else
4018 		{
4019 			delim = *bp;
4020 			*bp = '\0';
4021 		}
4022 		if (stat(delim == '\0' ? "." : qf, &dst) < 0)
4023 			syserr("readqf: cannot stat directory %s",
4024 				delim == '\0' ? "." : qf);
4025 		else
4026 		{
4027 			bogus = !(bitset(S_IWGRP, QueueFileMode) &&
4028 				  bitset(S_IWGRP, dst.st_mode) &&
4029 				  dst.st_gid == st.st_gid);
4030 		}
4031 		if (delim != '\0')
4032 			*bp = delim;
4033 	}
4034 	if (!bogus)
4035 		bogus = bitset(qsafe, st.st_mode);
4036 	if (bogus)
4037 	{
4038 		if (LogLevel > 0)
4039 		{
4040 			sm_syslog(LOG_ALERT, e->e_id,
4041 				  "bogus queue file, uid=%d, gid=%d, mode=%o",
4042 				  st.st_uid, st.st_gid, st.st_mode);
4043 		}
4044 		if (tTd(40, 8))
4045 			sm_dprintf("readqf(%s): bogus file\n", qf);
4046 		e->e_flags |= EF_INQUEUE;
4047 		if (!openonly)
4048 			loseqfile(e, "bogus file uid/gid in mqueue");
4049 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4050 		return false;
4051 	}
4052 
4053 	if (st.st_size == 0)
4054 	{
4055 		/* must be a bogus file -- if also old, just remove it */
4056 		if (!openonly && st.st_ctime + 10 * 60 < curtime())
4057 		{
4058 			(void) xunlink(queuename(e, DATAFL_LETTER));
4059 			(void) xunlink(queuename(e, ANYQFL_LETTER));
4060 		}
4061 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4062 		return false;
4063 	}
4064 
4065 	if (st.st_nlink == 0)
4066 	{
4067 		/*
4068 		**  Race condition -- we got a file just as it was being
4069 		**  unlinked.  Just assume it is zero length.
4070 		*/
4071 
4072 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4073 		return false;
4074 	}
4075 
4076 #if _FFR_TRUSTED_QF
4077 	/*
4078 	**  If we don't own the file mark it as unsafe.
4079 	**  However, allow TrustedUser to own it as well
4080 	**  in case TrustedUser manipulates the queue.
4081 	*/
4082 
4083 	if (st.st_uid != geteuid() && st.st_uid != TrustedUid)
4084 		e->e_flags |= EF_UNSAFE;
4085 #else /* _FFR_TRUSTED_QF */
4086 	/* If we don't own the file mark it as unsafe */
4087 	if (st.st_uid != geteuid())
4088 		e->e_flags |= EF_UNSAFE;
4089 #endif /* _FFR_TRUSTED_QF */
4090 
4091 	/* good file -- save this lock */
4092 	e->e_lockfp = qfp;
4093 
4094 	/* Just wanted the open file */
4095 	if (openonly)
4096 		return true;
4097 
4098 	/* do basic system initialization */
4099 	initsys(e);
4100 	macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
4101 
4102 	LineNumber = 0;
4103 	e->e_flags |= EF_GLOBALERRS;
4104 	set_op_mode(MD_QUEUERUN);
4105 	ctladdr = NULL;
4106 	e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
4107 	e->e_dfqgrp = e->e_qgrp;
4108 	e->e_dfqdir = e->e_qdir;
4109 #if _FFR_QUEUE_MACRO
4110 	macdefine(&e->e_macro, A_TEMP, macid("{queue}"),
4111 		  qid_printqueue(e->e_qgrp, e->e_qdir));
4112 #endif /* _FFR_QUEUE_MACRO */
4113 	e->e_dfino = -1;
4114 	e->e_msgsize = -1;
4115 	while ((bp = fgetfolded(buf, sizeof buf, qfp)) != NULL)
4116 	{
4117 		unsigned long qflags;
4118 		ADDRESS *q;
4119 		int r;
4120 		time_t now;
4121 		auto char *ep;
4122 
4123 		if (tTd(40, 4))
4124 			sm_dprintf("+++++ %s\n", bp);
4125 		if (nomore)
4126 		{
4127 			/* hack attack */
4128   hackattack:
4129 			syserr("SECURITY ALERT: extra or bogus data in queue file: %s",
4130 			       bp);
4131 			err = "bogus queue line";
4132 			goto fail;
4133 		}
4134 		switch (bp[0])
4135 		{
4136 		  case 'A':		/* AUTH= parameter */
4137 			if (!xtextok(&bp[1]))
4138 				goto hackattack;
4139 			e->e_auth_param = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4140 			break;
4141 
4142 		  case 'B':		/* body type */
4143 			r = check_bodytype(&bp[1]);
4144 			if (!BODYTYPE_VALID(r))
4145 				goto hackattack;
4146 			e->e_bodytype = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4147 			break;
4148 
4149 		  case 'C':		/* specify controlling user */
4150 			ctladdr = setctluser(&bp[1], qfver, e);
4151 			break;
4152 
4153 		  case 'D':		/* data file name */
4154 			/* obsolete -- ignore */
4155 			break;
4156 
4157 		  case 'd':		/* data file directory name */
4158 			{
4159 				int qgrp, qdir;
4160 
4161 #if _FFR_MSP_PARANOIA
4162 				/* forbid queue groups in MSP? */
4163 				if (UseMSP)
4164 					goto hackattack;
4165 #endif /* _FFR_MSP_PARANOIA */
4166 				for (qgrp = 0;
4167 				     qgrp < NumQueue && Queue[qgrp] != NULL;
4168 				     ++qgrp)
4169 				{
4170 					for (qdir = 0;
4171 					     qdir < Queue[qgrp]->qg_numqueues;
4172 					     ++qdir)
4173 					{
4174 						if (strcmp(&bp[1],
4175 							   Queue[qgrp]->qg_qpaths[qdir].qp_name)
4176 						    == 0)
4177 						{
4178 							e->e_dfqgrp = qgrp;
4179 							e->e_dfqdir = qdir;
4180 							goto done;
4181 						}
4182 					}
4183 				}
4184 				err = "bogus queue file directory";
4185 				goto fail;
4186 			  done:
4187 				break;
4188 			}
4189 
4190 		  case 'E':		/* specify error recipient */
4191 			/* no longer used */
4192 			break;
4193 
4194 		  case 'F':		/* flag bits */
4195 			if (strncmp(bp, "From ", 5) == 0)
4196 			{
4197 				/* we are being spoofed! */
4198 				syserr("SECURITY ALERT: bogus qf line %s", bp);
4199 				err = "bogus queue line";
4200 				goto fail;
4201 			}
4202 			for (p = &bp[1]; *p != '\0'; p++)
4203 			{
4204 				switch (*p)
4205 				{
4206 				  case '8':	/* has 8 bit data */
4207 					e->e_flags |= EF_HAS8BIT;
4208 					break;
4209 
4210 				  case 'b':	/* delete Bcc: header */
4211 					e->e_flags |= EF_DELETE_BCC;
4212 					break;
4213 
4214 				  case 'd':	/* envelope has DSN RET= */
4215 					e->e_flags |= EF_RET_PARAM;
4216 					break;
4217 
4218 				  case 'n':	/* don't return body */
4219 					e->e_flags |= EF_NO_BODY_RETN;
4220 					break;
4221 
4222 				  case 'r':	/* response */
4223 					e->e_flags |= EF_RESPONSE;
4224 					break;
4225 
4226 				  case 's':	/* split */
4227 					e->e_flags |= EF_SPLIT;
4228 					break;
4229 
4230 				  case 'w':	/* warning sent */
4231 					e->e_flags |= EF_WARNING;
4232 					break;
4233 				}
4234 			}
4235 			break;
4236 
4237 		  case 'q':		/* quarantine reason */
4238 			e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4239 			macdefine(&e->e_macro, A_PERM,
4240 				  macid("{quarantine}"), e->e_quarmsg);
4241 			break;
4242 
4243 		  case 'H':		/* header */
4244 
4245 			/*
4246 			**  count size before chompheader() destroys the line.
4247 			**  this isn't accurate due to macro expansion, but
4248 			**  better than before. "-3" to skip H?? at least.
4249 			*/
4250 
4251 			hdrsize += strlen(bp) - 3;
4252 			(void) chompheader(&bp[1], CHHDR_QUEUE, NULL, e);
4253 			break;
4254 
4255 		  case 'I':		/* data file's inode number */
4256 			/* regenerated below */
4257 			break;
4258 
4259 		  case 'K':		/* time of last delivery attempt */
4260 			e->e_dtime = atol(&buf[1]);
4261 			break;
4262 
4263 		  case 'L':		/* Solaris Content-Length: */
4264 		  case 'M':		/* message */
4265 			/* ignore this; we want a new message next time */
4266 			break;
4267 
4268 		  case 'N':		/* number of delivery attempts */
4269 			e->e_ntries = atoi(&buf[1]);
4270 
4271 			/* if this has been tried recently, let it be */
4272 			now = curtime();
4273 			if (e->e_ntries > 0 && e->e_dtime <= now &&
4274 			    now < e->e_dtime + MinQueueAge)
4275 			{
4276 				char *howlong;
4277 
4278 				howlong = pintvl(now - e->e_dtime, true);
4279 				if (Verbose)
4280 					(void) sm_io_fprintf(smioout,
4281 							     SM_TIME_DEFAULT,
4282 							     "%s: too young (%s)\n",
4283 							     e->e_id, howlong);
4284 				if (tTd(40, 8))
4285 					sm_dprintf("%s: too young (%s)\n",
4286 						e->e_id, howlong);
4287 				if (LogLevel > 19)
4288 					sm_syslog(LOG_DEBUG, e->e_id,
4289 						  "too young (%s)",
4290 						  howlong);
4291 				e->e_id = NULL;
4292 				unlockqueue(e);
4293 				return false;
4294 			}
4295 			macdefine(&e->e_macro, A_TEMP,
4296 				macid("{ntries}"), &buf[1]);
4297 
4298 #if NAMED_BIND
4299 			/* adjust BIND parameters immediately */
4300 			if (e->e_ntries == 0)
4301 			{
4302 				_res.retry = TimeOuts.res_retry[RES_TO_FIRST];
4303 				_res.retrans = TimeOuts.res_retrans[RES_TO_FIRST];
4304 			}
4305 			else
4306 			{
4307 				_res.retry = TimeOuts.res_retry[RES_TO_NORMAL];
4308 				_res.retrans = TimeOuts.res_retrans[RES_TO_NORMAL];
4309 			}
4310 #endif /* NAMED_BIND */
4311 			break;
4312 
4313 		  case 'P':		/* message priority */
4314 			e->e_msgpriority = atol(&bp[1]) + WkTimeFact;
4315 			break;
4316 
4317 		  case 'Q':		/* original recipient */
4318 			orcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4319 			break;
4320 
4321 		  case 'r':		/* final recipient */
4322 			frcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4323 			break;
4324 
4325 		  case 'R':		/* specify recipient */
4326 			p = bp;
4327 			qflags = 0;
4328 			if (qfver >= 1)
4329 			{
4330 				/* get flag bits */
4331 				while (*++p != '\0' && *p != ':')
4332 				{
4333 					switch (*p)
4334 					{
4335 					  case 'N':
4336 						qflags |= QHASNOTIFY;
4337 						break;
4338 
4339 					  case 'S':
4340 						qflags |= QPINGONSUCCESS;
4341 						break;
4342 
4343 					  case 'F':
4344 						qflags |= QPINGONFAILURE;
4345 						break;
4346 
4347 					  case 'D':
4348 						qflags |= QPINGONDELAY;
4349 						break;
4350 
4351 					  case 'P':
4352 						qflags |= QPRIMARY;
4353 						break;
4354 
4355 					  case 'A':
4356 						if (ctladdr != NULL)
4357 							ctladdr->q_flags |= QALIAS;
4358 						break;
4359 
4360 					  default: /* ignore or complain? */
4361 						break;
4362 					}
4363 				}
4364 			}
4365 			else
4366 				qflags |= QPRIMARY;
4367 			macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4368 				"e r");
4369 			if (*p != '\0')
4370 				q = parseaddr(++p, NULLADDR, RF_COPYALL, '\0',
4371 						NULL, e, true);
4372 			else
4373 				q = NULL;
4374 			if (q != NULL)
4375 			{
4376 				/* make sure we keep the current qgrp */
4377 				if (ISVALIDQGRP(e->e_qgrp))
4378 					q->q_qgrp = e->e_qgrp;
4379 				q->q_alias = ctladdr;
4380 				if (qfver >= 1)
4381 					q->q_flags &= ~Q_PINGFLAGS;
4382 				q->q_flags |= qflags;
4383 				q->q_finalrcpt = frcpt;
4384 				q->q_orcpt = orcpt;
4385 				(void) recipient(q, &e->e_sendqueue, 0, e);
4386 			}
4387 			frcpt = NULL;
4388 			orcpt = NULL;
4389 			macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4390 				NULL);
4391 			break;
4392 
4393 		  case 'S':		/* sender */
4394 			setsender(sm_rpool_strdup_x(e->e_rpool, &bp[1]),
4395 				  e, NULL, '\0', true);
4396 			break;
4397 
4398 		  case 'T':		/* init time */
4399 			e->e_ctime = atol(&bp[1]);
4400 			break;
4401 
4402 		  case 'V':		/* queue file version number */
4403 			qfver = atoi(&bp[1]);
4404 			if (qfver <= QF_VERSION)
4405 				break;
4406 			syserr("Version number in queue file (%d) greater than max (%d)",
4407 				qfver, QF_VERSION);
4408 			err = "unsupported queue file version";
4409 			goto fail;
4410 			/* NOTREACHED */
4411 			break;
4412 
4413 		  case 'Z':		/* original envelope id from ESMTP */
4414 			e->e_envid = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4415 			macdefine(&e->e_macro, A_PERM,
4416 				macid("{dsn_envid}"), e->e_envid);
4417 			break;
4418 
4419 		  case '!':		/* deliver by */
4420 
4421 			/* format: flag (1 char) space long-integer */
4422 			e->e_dlvr_flag = buf[1];
4423 			e->e_deliver_by = strtol(&buf[3], NULL, 10);
4424 
4425 		  case '$':		/* define macro */
4426 			{
4427 				char *p;
4428 
4429 				/* XXX elimate p? */
4430 				r = macid_parse(&bp[1], &ep);
4431 				if (r == 0)
4432 					break;
4433 				p = sm_rpool_strdup_x(e->e_rpool, ep);
4434 				macdefine(&e->e_macro, A_PERM, r, p);
4435 			}
4436 			break;
4437 
4438 		  case '.':		/* terminate file */
4439 			nomore = true;
4440 			break;
4441 
4442 #if _FFR_QUEUEDELAY
4443 		  case 'G':
4444 		  case 'Y':
4445 
4446 			/*
4447 			**  Maintain backward compatibility for
4448 			**  users who defined _FFR_QUEUEDELAY in
4449 			**  previous releases.  Remove this
4450 			**  code in 8.14 or 8.15.
4451 			*/
4452 
4453 			if (qfver == 5 || qfver == 7)
4454 				break;
4455 
4456 			/* If not qfver 5 or 7, then 'G' or 'Y' is invalid */
4457 			/* FALLTHROUGH */
4458 #endif /* _FFR_QUEUEDELAY */
4459 
4460 		  default:
4461 			syserr("readqf: %s: line %d: bad line \"%s\"",
4462 				qf, LineNumber, shortenstring(bp, MAXSHORTSTR));
4463 			err = "unrecognized line";
4464 			goto fail;
4465 		}
4466 
4467 		if (bp != buf)
4468 			sm_free(bp); /* XXX */
4469 	}
4470 
4471 	/*
4472 	**  If we haven't read any lines, this queue file is empty.
4473 	**  Arrange to remove it without referencing any null pointers.
4474 	*/
4475 
4476 	if (LineNumber == 0)
4477 	{
4478 		errno = 0;
4479 		e->e_flags |= EF_CLRQUEUE|EF_FATALERRS|EF_RESPONSE;
4480 		return true;
4481 	}
4482 
4483 	/* Check to make sure we have a complete queue file read */
4484 	if (!nomore)
4485 	{
4486 		syserr("readqf: %s: incomplete queue file read", qf);
4487 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4488 		return false;
4489 	}
4490 
4491 	/* possibly set ${dsn_ret} macro */
4492 	if (bitset(EF_RET_PARAM, e->e_flags))
4493 	{
4494 		if (bitset(EF_NO_BODY_RETN, e->e_flags))
4495 			macdefine(&e->e_macro, A_PERM,
4496 				macid("{dsn_ret}"), "hdrs");
4497 		else
4498 			macdefine(&e->e_macro, A_PERM,
4499 				macid("{dsn_ret}"), "full");
4500 	}
4501 
4502 	/*
4503 	**  Arrange to read the data file.
4504 	*/
4505 
4506 	p = queuename(e, DATAFL_LETTER);
4507 	e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, p, SM_IO_RDONLY_B,
4508 			      NULL);
4509 	if (e->e_dfp == NULL)
4510 	{
4511 		syserr("readqf: cannot open %s", p);
4512 	}
4513 	else
4514 	{
4515 		e->e_flags |= EF_HAS_DF;
4516 		if (fstat(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD, NULL), &st)
4517 		    >= 0)
4518 		{
4519 			e->e_msgsize = st.st_size + hdrsize;
4520 			e->e_dfdev = st.st_dev;
4521 			e->e_dfino = ST_INODE(st);
4522 			(void) sm_snprintf(buf, sizeof buf, "%ld",
4523 					   e->e_msgsize);
4524 			macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"),
4525 				  buf);
4526 		}
4527 	}
4528 
4529 	return true;
4530 
4531   fail:
4532 	/*
4533 	**  There was some error reading the qf file (reason is in err var.)
4534 	**  Cleanup:
4535 	**	close file; clear e_lockfp since it is the same as qfp,
4536 	**	hence it is invalid (as file) after qfp is closed;
4537 	**	the qf file is on disk, so set the flag to avoid calling
4538 	**	queueup() with bogus data.
4539 	*/
4540 
4541 	if (qfp != NULL)
4542 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4543 	e->e_lockfp = NULL;
4544 	e->e_flags |= EF_INQUEUE;
4545 	loseqfile(e, err);
4546 	return false;
4547 }
4548 /*
4549 **  PRTSTR -- print a string, "unprintable" characters are shown as \oct
4550 **
4551 **	Parameters:
4552 **		s -- string to print
4553 **		ml -- maximum length of output
4554 **
4555 **	Returns:
4556 **		number of entries
4557 **
4558 **	Side Effects:
4559 **		Prints a string on stdout.
4560 */
4561 
4562 static void
4563 prtstr(s, ml)
4564 	char *s;
4565 	int ml;
4566 {
4567 	int c;
4568 
4569 	if (s == NULL)
4570 		return;
4571 	while (ml-- > 0 && ((c = *s++) != '\0'))
4572 	{
4573 		if (c == '\\')
4574 		{
4575 			if (ml-- > 0)
4576 			{
4577 				(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4578 				(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4579 			}
4580 		}
4581 		else if (isascii(c) && isprint(c))
4582 			(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4583 		else
4584 		{
4585 			if ((ml -= 3) > 0)
4586 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4587 						     "\\%03o", c & 0xFF);
4588 		}
4589 	}
4590 }
4591 /*
4592 **  PRINTNQE -- print out number of entries in the mail queue
4593 **
4594 **	Parameters:
4595 **		out -- output file pointer.
4596 **		prefix -- string to output in front of each line.
4597 **
4598 **	Returns:
4599 **		none.
4600 */
4601 
4602 void
4603 printnqe(out, prefix)
4604 	SM_FILE_T *out;
4605 	char *prefix;
4606 {
4607 #if SM_CONF_SHM
4608 	int i, k = 0, nrequests = 0;
4609 	bool unknown = false;
4610 
4611 	if (ShmId == SM_SHM_NO_ID)
4612 	{
4613 		if (prefix == NULL)
4614 			(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4615 					"Data unavailable: shared memory not updated\n");
4616 		else
4617 			(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4618 					"%sNOTCONFIGURED:-1\r\n", prefix);
4619 		return;
4620 	}
4621 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4622 	{
4623 		int j;
4624 
4625 		k++;
4626 		for (j = 0; j < Queue[i]->qg_numqueues; j++)
4627 		{
4628 			int n;
4629 
4630 			if (StopRequest)
4631 				stop_sendmail();
4632 
4633 			n = QSHM_ENTRIES(Queue[i]->qg_qpaths[j].qp_idx);
4634 			if (prefix != NULL)
4635 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4636 					"%s%s:%d\r\n",
4637 					prefix, qid_printqueue(i, j), n);
4638 			else if (n < 0)
4639 			{
4640 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4641 					"%s: unknown number of entries\n",
4642 					qid_printqueue(i, j));
4643 				unknown = true;
4644 			}
4645 			else if (n == 0)
4646 			{
4647 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4648 					"%s is empty\n",
4649 					qid_printqueue(i, j));
4650 			}
4651 			else if (n > 0)
4652 			{
4653 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4654 					"%s: entries=%d\n",
4655 					qid_printqueue(i, j), n);
4656 				nrequests += n;
4657 				k++;
4658 			}
4659 		}
4660 	}
4661 	if (prefix == NULL && k > 1)
4662 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4663 				     "\t\tTotal requests: %d%s\n",
4664 				     nrequests, unknown ? " (about)" : "");
4665 #else /* SM_CONF_SHM */
4666 	if (prefix == NULL)
4667 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4668 			     "Data unavailable without shared memory support\n");
4669 	else
4670 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4671 			     "%sNOTAVAILABLE:-1\r\n", prefix);
4672 #endif /* SM_CONF_SHM */
4673 }
4674 /*
4675 **  PRINTQUEUE -- print out a representation of the mail queue
4676 **
4677 **	Parameters:
4678 **		none.
4679 **
4680 **	Returns:
4681 **		none.
4682 **
4683 **	Side Effects:
4684 **		Prints a listing of the mail queue on the standard output.
4685 */
4686 
4687 void
4688 printqueue()
4689 {
4690 	int i, k = 0, nrequests = 0;
4691 
4692 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4693 	{
4694 		int j;
4695 
4696 		k++;
4697 		for (j = 0; j < Queue[i]->qg_numqueues; j++)
4698 		{
4699 			if (StopRequest)
4700 				stop_sendmail();
4701 			nrequests += print_single_queue(i, j);
4702 			k++;
4703 		}
4704 	}
4705 	if (k > 1)
4706 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4707 				     "\t\tTotal requests: %d\n",
4708 				     nrequests);
4709 }
4710 /*
4711 **  PRINT_SINGLE_QUEUE -- print out a representation of a single mail queue
4712 **
4713 **	Parameters:
4714 **		qgrp -- the index of the queue group.
4715 **		qdir -- the queue directory.
4716 **
4717 **	Returns:
4718 **		number of requests in mail queue.
4719 **
4720 **	Side Effects:
4721 **		Prints a listing of the mail queue on the standard output.
4722 */
4723 
4724 int
4725 print_single_queue(qgrp, qdir)
4726 	int qgrp;
4727 	int qdir;
4728 {
4729 	register WORK *w;
4730 	SM_FILE_T *f;
4731 	int nrequests;
4732 	char qd[MAXPATHLEN];
4733 	char qddf[MAXPATHLEN];
4734 	char buf[MAXLINE];
4735 
4736 	if (qdir == NOQDIR)
4737 	{
4738 		(void) sm_strlcpy(qd, ".", sizeof qd);
4739 		(void) sm_strlcpy(qddf, ".", sizeof qddf);
4740 	}
4741 	else
4742 	{
4743 		(void) sm_strlcpyn(qd, sizeof qd, 2,
4744 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
4745 			(bitset(QP_SUBQF,
4746 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4747 					? "/qf" : ""));
4748 		(void) sm_strlcpyn(qddf, sizeof qddf, 2,
4749 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
4750 			(bitset(QP_SUBDF,
4751 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4752 					? "/df" : ""));
4753 	}
4754 
4755 	/*
4756 	**  Check for permission to print the queue
4757 	*/
4758 
4759 	if (bitset(PRIV_RESTRICTMAILQ, PrivacyFlags) && RealUid != 0)
4760 	{
4761 		struct stat st;
4762 #ifdef NGROUPS_MAX
4763 		int n;
4764 		extern GIDSET_T InitialGidSet[NGROUPS_MAX];
4765 #endif /* NGROUPS_MAX */
4766 
4767 		if (stat(qd, &st) < 0)
4768 		{
4769 			syserr("Cannot stat %s",
4770 				qid_printqueue(qgrp, qdir));
4771 			return 0;
4772 		}
4773 #ifdef NGROUPS_MAX
4774 		n = NGROUPS_MAX;
4775 		while (--n >= 0)
4776 		{
4777 			if (InitialGidSet[n] == st.st_gid)
4778 				break;
4779 		}
4780 		if (n < 0 && RealGid != st.st_gid)
4781 #else /* NGROUPS_MAX */
4782 		if (RealGid != st.st_gid)
4783 #endif /* NGROUPS_MAX */
4784 		{
4785 			usrerr("510 You are not permitted to see the queue");
4786 			setstat(EX_NOPERM);
4787 			return 0;
4788 		}
4789 	}
4790 
4791 	/*
4792 	**  Read and order the queue.
4793 	*/
4794 
4795 	nrequests = gatherq(qgrp, qdir, true, NULL, NULL);
4796 	(void) sortq(Queue[qgrp]->qg_maxlist);
4797 
4798 	/*
4799 	**  Print the work list that we have read.
4800 	*/
4801 
4802 	/* first see if there is anything */
4803 	if (nrequests <= 0)
4804 	{
4805 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%s is empty\n",
4806 				     qid_printqueue(qgrp, qdir));
4807 		return 0;
4808 	}
4809 
4810 	sm_getla();	/* get load average */
4811 
4812 	(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\t\t%s (%d request%s",
4813 			     qid_printqueue(qgrp, qdir),
4814 			     nrequests, nrequests == 1 ? "" : "s");
4815 	if (MaxQueueRun > 0 && nrequests > MaxQueueRun)
4816 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4817 				     ", only %d printed", MaxQueueRun);
4818 	if (Verbose)
4819 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4820 			")\n-----Q-ID----- --Size-- -Priority- ---Q-Time--- --------Sender/Recipient--------\n");
4821 	else
4822 		(void) sm_io_fprintf(smioout,  SM_TIME_DEFAULT,
4823 			")\n-----Q-ID----- --Size-- -----Q-Time----- ------------Sender/Recipient-----------\n");
4824 	for (w = WorkQ; w != NULL; w = w->w_next)
4825 	{
4826 		struct stat st;
4827 		auto time_t submittime = 0;
4828 		long dfsize;
4829 		int flags = 0;
4830 		int qfver;
4831 		char quarmsg[MAXLINE];
4832 		char statmsg[MAXLINE];
4833 		char bodytype[MAXNAME + 1];
4834 		char qf[MAXPATHLEN];
4835 
4836 		if (StopRequest)
4837 			stop_sendmail();
4838 
4839 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%13s",
4840 				     w->w_name + 2);
4841 		(void) sm_strlcpyn(qf, sizeof qf, 3, qd, "/", w->w_name);
4842 		f = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
4843 			       NULL);
4844 		if (f == NULL)
4845 		{
4846 			if (errno == EPERM)
4847 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4848 						     " (permission denied)\n");
4849 			else if (errno == ENOENT)
4850 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4851 						     " (job completed)\n");
4852 			else
4853 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4854 						     " (%s)\n",
4855 						     sm_errstring(errno));
4856 			errno = 0;
4857 			continue;
4858 		}
4859 		w->w_name[0] = DATAFL_LETTER;
4860 		(void) sm_strlcpyn(qf, sizeof qf, 3, qddf, "/", w->w_name);
4861 		if (stat(qf, &st) >= 0)
4862 			dfsize = st.st_size;
4863 		else
4864 		{
4865 			ENVELOPE e;
4866 
4867 			/*
4868 			**  Maybe the df file can't be statted because
4869 			**  it is in a different directory than the qf file.
4870 			**  In order to find out, we must read the qf file.
4871 			*/
4872 
4873 			newenvelope(&e, &BlankEnvelope, sm_rpool_new_x(NULL));
4874 			e.e_id = w->w_name + 2;
4875 			e.e_qgrp = qgrp;
4876 			e.e_qdir = qdir;
4877 			dfsize = -1;
4878 			if (readqf(&e, false))
4879 			{
4880 				char *df = queuename(&e, DATAFL_LETTER);
4881 				if (stat(df, &st) >= 0)
4882 					dfsize = st.st_size;
4883 			}
4884 			if (e.e_lockfp != NULL)
4885 			{
4886 				(void) sm_io_close(e.e_lockfp, SM_TIME_DEFAULT);
4887 				e.e_lockfp = NULL;
4888 			}
4889 			clearenvelope(&e, false, e.e_rpool);
4890 			sm_rpool_free(e.e_rpool);
4891 		}
4892 		if (w->w_lock)
4893 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "*");
4894 		else if (QueueMode == QM_LOST)
4895 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "?");
4896 		else if (w->w_tooyoung)
4897 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "-");
4898 		else if (shouldqueue(w->w_pri, w->w_ctime))
4899 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "X");
4900 		else
4901 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, " ");
4902 
4903 		errno = 0;
4904 
4905 		quarmsg[0] = '\0';
4906 		statmsg[0] = bodytype[0] = '\0';
4907 		qfver = 0;
4908 		while (sm_io_fgets(f, SM_TIME_DEFAULT, buf, sizeof buf) != NULL)
4909 		{
4910 			register int i;
4911 			register char *p;
4912 
4913 			if (StopRequest)
4914 				stop_sendmail();
4915 
4916 			fixcrlf(buf, true);
4917 			switch (buf[0])
4918 			{
4919 			  case 'V':	/* queue file version */
4920 				qfver = atoi(&buf[1]);
4921 				break;
4922 
4923 			  case 'M':	/* error message */
4924 				if ((i = strlen(&buf[1])) >= sizeof statmsg)
4925 					i = sizeof statmsg - 1;
4926 				memmove(statmsg, &buf[1], i);
4927 				statmsg[i] = '\0';
4928 				break;
4929 
4930 			  case 'q':	/* quarantine reason */
4931 				if ((i = strlen(&buf[1])) >= sizeof quarmsg)
4932 					i = sizeof quarmsg - 1;
4933 				memmove(quarmsg, &buf[1], i);
4934 				quarmsg[i] = '\0';
4935 				break;
4936 
4937 			  case 'B':	/* body type */
4938 				if ((i = strlen(&buf[1])) >= sizeof bodytype)
4939 					i = sizeof bodytype - 1;
4940 				memmove(bodytype, &buf[1], i);
4941 				bodytype[i] = '\0';
4942 				break;
4943 
4944 			  case 'S':	/* sender name */
4945 				if (Verbose)
4946 				{
4947 					(void) sm_io_fprintf(smioout,
4948 						SM_TIME_DEFAULT,
4949 						"%8ld %10ld%c%.12s ",
4950 						dfsize,
4951 						w->w_pri,
4952 						bitset(EF_WARNING, flags)
4953 							? '+' : ' ',
4954 						ctime(&submittime) + 4);
4955 					prtstr(&buf[1], 78);
4956 				}
4957 				else
4958 				{
4959 					(void) sm_io_fprintf(smioout,
4960 						SM_TIME_DEFAULT,
4961 						"%8ld %.16s ",
4962 						dfsize,
4963 						ctime(&submittime));
4964 					prtstr(&buf[1], 39);
4965 				}
4966 
4967 				if (quarmsg[0] != '\0')
4968 				{
4969 					(void) sm_io_fprintf(smioout,
4970 							     SM_TIME_DEFAULT,
4971 							     "\n     QUARANTINE: %.*s",
4972 							     Verbose ? 100 : 60,
4973 							     quarmsg);
4974 					quarmsg[0] = '\0';
4975 				}
4976 
4977 				if (statmsg[0] != '\0' || bodytype[0] != '\0')
4978 				{
4979 					(void) sm_io_fprintf(smioout,
4980 						SM_TIME_DEFAULT,
4981 						"\n    %10.10s",
4982 						bodytype);
4983 					if (statmsg[0] != '\0')
4984 						(void) sm_io_fprintf(smioout,
4985 							SM_TIME_DEFAULT,
4986 							"   (%.*s)",
4987 							Verbose ? 100 : 60,
4988 							statmsg);
4989 					statmsg[0] = '\0';
4990 				}
4991 				break;
4992 
4993 			  case 'C':	/* controlling user */
4994 				if (Verbose)
4995 					(void) sm_io_fprintf(smioout,
4996 						SM_TIME_DEFAULT,
4997 						"\n\t\t\t\t\t\t(---%.64s---)",
4998 						&buf[1]);
4999 				break;
5000 
5001 			  case 'R':	/* recipient name */
5002 				p = &buf[1];
5003 				if (qfver >= 1)
5004 				{
5005 					p = strchr(p, ':');
5006 					if (p == NULL)
5007 						break;
5008 					p++;
5009 				}
5010 				if (Verbose)
5011 				{
5012 					(void) sm_io_fprintf(smioout,
5013 							SM_TIME_DEFAULT,
5014 							"\n\t\t\t\t\t\t");
5015 					prtstr(p, 71);
5016 				}
5017 				else
5018 				{
5019 					(void) sm_io_fprintf(smioout,
5020 							SM_TIME_DEFAULT,
5021 							"\n\t\t\t\t\t ");
5022 					prtstr(p, 38);
5023 				}
5024 				if (Verbose && statmsg[0] != '\0')
5025 				{
5026 					(void) sm_io_fprintf(smioout,
5027 							SM_TIME_DEFAULT,
5028 							"\n\t\t (%.100s)",
5029 							statmsg);
5030 					statmsg[0] = '\0';
5031 				}
5032 				break;
5033 
5034 			  case 'T':	/* creation time */
5035 				submittime = atol(&buf[1]);
5036 				break;
5037 
5038 			  case 'F':	/* flag bits */
5039 				for (p = &buf[1]; *p != '\0'; p++)
5040 				{
5041 					switch (*p)
5042 					{
5043 					  case 'w':
5044 						flags |= EF_WARNING;
5045 						break;
5046 					}
5047 				}
5048 			}
5049 		}
5050 		if (submittime == (time_t) 0)
5051 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
5052 					     " (no control file)");
5053 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\n");
5054 		(void) sm_io_close(f, SM_TIME_DEFAULT);
5055 	}
5056 	return nrequests;
5057 }
5058 
5059 /*
5060 **  QUEUE_LETTER -- get the proper queue letter for the current QueueMode.
5061 **
5062 **	Parameters:
5063 **		e -- envelope to build it in/from.
5064 **		type -- the file type, used as the first character
5065 **			of the file name.
5066 **
5067 **	Returns:
5068 **		the letter to use
5069 */
5070 
5071 static char
5072 queue_letter(e, type)
5073 	ENVELOPE *e;
5074 	int type;
5075 {
5076 	/* Change type according to QueueMode */
5077 	if (type == ANYQFL_LETTER)
5078 	{
5079 		if (e->e_quarmsg != NULL)
5080 			type = QUARQF_LETTER;
5081 		else
5082 		{
5083 			switch (QueueMode)
5084 			{
5085 			  case QM_NORMAL:
5086 				type = NORMQF_LETTER;
5087 				break;
5088 
5089 			  case QM_QUARANTINE:
5090 				type = QUARQF_LETTER;
5091 				break;
5092 
5093 			  case QM_LOST:
5094 				type = LOSEQF_LETTER;
5095 				break;
5096 
5097 			  default:
5098 				/* should never happen */
5099 				abort();
5100 				/* NOTREACHED */
5101 			}
5102 		}
5103 	}
5104 	return type;
5105 }
5106 
5107 /*
5108 **  QUEUENAME -- build a file name in the queue directory for this envelope.
5109 **
5110 **	Parameters:
5111 **		e -- envelope to build it in/from.
5112 **		type -- the file type, used as the first character
5113 **			of the file name.
5114 **
5115 **	Returns:
5116 **		a pointer to the queue name (in a static buffer).
5117 **
5118 **	Side Effects:
5119 **		If no id code is already assigned, queuename() will
5120 **		assign an id code with assign_queueid().  If no queue
5121 **		directory is assigned, one will be set with setnewqueue().
5122 */
5123 
5124 char *
5125 queuename(e, type)
5126 	register ENVELOPE *e;
5127 	int type;
5128 {
5129 	int qd, qg;
5130 	char *sub = "/";
5131 	char pref[3];
5132 	static char buf[MAXPATHLEN];
5133 
5134 	/* Assign an ID if needed */
5135 	if (e->e_id == NULL)
5136 		assign_queueid(e);
5137 	type = queue_letter(e, type);
5138 
5139 	/* begin of filename */
5140 	pref[0] = (char) type;
5141 	pref[1] = 'f';
5142 	pref[2] = '\0';
5143 
5144 	/* Assign a queue group/directory if needed */
5145 	if (type == XSCRPT_LETTER)
5146 	{
5147 		/*
5148 		**  We don't want to call setnewqueue() if we are fetching
5149 		**  the pathname of the transcript file, because setnewqueue
5150 		**  chooses a queue, and sometimes we need to write to the
5151 		**  transcript file before we have gathered enough information
5152 		**  to choose a queue.
5153 		*/
5154 
5155 		if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5156 		{
5157 			if (e->e_qgrp != NOQGRP && e->e_qdir != NOQDIR)
5158 			{
5159 				e->e_xfqgrp = e->e_qgrp;
5160 				e->e_xfqdir = e->e_qdir;
5161 			}
5162 			else
5163 			{
5164 				e->e_xfqgrp = 0;
5165 				if (Queue[e->e_xfqgrp]->qg_numqueues <= 1)
5166 					e->e_xfqdir = 0;
5167 				else
5168 				{
5169 					e->e_xfqdir = get_rand_mod(
5170 					      Queue[e->e_xfqgrp]->qg_numqueues);
5171 				}
5172 			}
5173 		}
5174 		qd = e->e_xfqdir;
5175 		qg = e->e_xfqgrp;
5176 	}
5177 	else
5178 	{
5179 		if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
5180 			setnewqueue(e);
5181 		if (type ==  DATAFL_LETTER)
5182 		{
5183 			qd = e->e_dfqdir;
5184 			qg = e->e_dfqgrp;
5185 		}
5186 		else
5187 		{
5188 			qd = e->e_qdir;
5189 			qg = e->e_qgrp;
5190 		}
5191 	}
5192 
5193 	/* xf files always have a valid qd and qg picked above */
5194 	if (e->e_qdir == NOQDIR && type != XSCRPT_LETTER)
5195 		(void) sm_strlcpyn(buf, sizeof buf, 2, pref, e->e_id);
5196 	else
5197 	{
5198 		switch (type)
5199 		{
5200 		  case DATAFL_LETTER:
5201 			if (bitset(QP_SUBDF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5202 				sub = "/df/";
5203 			break;
5204 
5205 		  case QUARQF_LETTER:
5206 		  case TEMPQF_LETTER:
5207 		  case NEWQFL_LETTER:
5208 		  case LOSEQF_LETTER:
5209 		  case NORMQF_LETTER:
5210 			if (bitset(QP_SUBQF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5211 				sub = "/qf/";
5212 			break;
5213 
5214 		  case XSCRPT_LETTER:
5215 			if (bitset(QP_SUBXF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5216 				sub = "/xf/";
5217 			break;
5218 
5219 		  default:
5220 			sm_abort("queuename: bad queue file type %d", type);
5221 		}
5222 
5223 		(void) sm_strlcpyn(buf, sizeof buf, 4,
5224 				Queue[qg]->qg_qpaths[qd].qp_name,
5225 				sub, pref, e->e_id);
5226 	}
5227 
5228 	if (tTd(7, 2))
5229 		sm_dprintf("queuename: %s\n", buf);
5230 	return buf;
5231 }
5232 
5233 /*
5234 **  INIT_QID_ALG -- Initialize the (static) parameters that are used to
5235 **	generate a queue ID.
5236 **
5237 **	This function is called by the daemon to reset
5238 **	LastQueueTime and LastQueuePid which are used by assign_queueid().
5239 **	Otherwise the algorithm may cause problems because
5240 **	LastQueueTime and LastQueuePid are set indirectly by main()
5241 **	before the daemon process is started, hence LastQueuePid is not
5242 **	the pid of the daemon and therefore a child of the daemon can
5243 **	actually have the same pid as LastQueuePid which means the section
5244 **	in  assign_queueid():
5245 **	* see if we need to get a new base time/pid *
5246 **	is NOT triggered which will cause the same queue id to be generated.
5247 **
5248 **	Parameters:
5249 **		none
5250 **
5251 **	Returns:
5252 **		none.
5253 */
5254 
5255 void
5256 init_qid_alg()
5257 {
5258 	LastQueueTime = 0;
5259 	LastQueuePid = -1;
5260 }
5261 
5262 /*
5263 **  ASSIGN_QUEUEID -- assign a queue ID for this envelope.
5264 **
5265 **	Assigns an id code if one does not already exist.
5266 **	This code assumes that nothing will remain in the queue for
5267 **	longer than 60 years.  It is critical that files with the given
5268 **	name do not already exist in the queue.
5269 **	[No longer initializes e_qdir to NOQDIR.]
5270 **
5271 **	Parameters:
5272 **		e -- envelope to set it in.
5273 **
5274 **	Returns:
5275 **		none.
5276 */
5277 
5278 static const char QueueIdChars[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
5279 # define QIC_LEN	60
5280 # define QIC_LEN_R	62
5281 
5282 /*
5283 **  Note: the length is "officially" 60 because minutes and seconds are
5284 **	usually only 0-59.  However (Linux):
5285 **       tm_sec The number of seconds after the minute, normally in
5286 **		the range 0 to 59, but can be up to 61 to allow for
5287 **		leap seconds.
5288 **	Hence the real length of the string is 62 to take this into account.
5289 **	Alternatively % QIC_LEN can (should) be used for access everywhere.
5290 */
5291 
5292 # define queuenextid() CurrentPid
5293 
5294 
5295 void
5296 assign_queueid(e)
5297 	register ENVELOPE *e;
5298 {
5299 	pid_t pid = queuenextid();
5300 	static int cX = 0;
5301 	static long random_offset;
5302 	struct tm *tm;
5303 	char idbuf[MAXQFNAME - 2];
5304 	int seq;
5305 
5306 	if (e->e_id != NULL)
5307 		return;
5308 
5309 	/* see if we need to get a new base time/pid */
5310 	if (cX >= QIC_LEN * QIC_LEN || LastQueueTime == 0 ||
5311 	    LastQueuePid != pid)
5312 	{
5313 		time_t then = LastQueueTime;
5314 
5315 		/* if the first time through, pick a random offset */
5316 		if (LastQueueTime == 0)
5317 			random_offset = get_random();
5318 
5319 		while ((LastQueueTime = curtime()) == then &&
5320 		       LastQueuePid == pid)
5321 		{
5322 			(void) sleep(1);
5323 		}
5324 		LastQueuePid = queuenextid();
5325 		cX = 0;
5326 	}
5327 
5328 	/*
5329 	**  Generate a new sequence number between 0 and QIC_LEN*QIC_LEN-1.
5330 	**  This lets us generate up to QIC_LEN*QIC_LEN unique queue ids
5331 	**  per second, per process.  With envelope splitting,
5332 	**  a single message can consume many queue ids.
5333 	*/
5334 
5335 	seq = (int)((cX + random_offset) % (QIC_LEN * QIC_LEN));
5336 	++cX;
5337 	if (tTd(7, 50))
5338 		sm_dprintf("assign_queueid: random_offset = %ld (%d)\n",
5339 			random_offset, seq);
5340 
5341 	tm = gmtime(&LastQueueTime);
5342 	idbuf[0] = QueueIdChars[tm->tm_year % QIC_LEN];
5343 	idbuf[1] = QueueIdChars[tm->tm_mon];
5344 	idbuf[2] = QueueIdChars[tm->tm_mday];
5345 	idbuf[3] = QueueIdChars[tm->tm_hour];
5346 	idbuf[4] = QueueIdChars[tm->tm_min % QIC_LEN_R];
5347 	idbuf[5] = QueueIdChars[tm->tm_sec % QIC_LEN_R];
5348 	idbuf[6] = QueueIdChars[seq / QIC_LEN];
5349 	idbuf[7] = QueueIdChars[seq % QIC_LEN];
5350 	(void) sm_snprintf(&idbuf[8], sizeof idbuf - 8, "%06d",
5351 			   (int) LastQueuePid);
5352 	e->e_id = sm_rpool_strdup_x(e->e_rpool, idbuf);
5353 	macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
5354 #if 0
5355 	/* XXX: inherited from MainEnvelope */
5356 	e->e_qgrp = NOQGRP;  /* too early to do anything else */
5357 	e->e_qdir = NOQDIR;
5358 	e->e_xfqgrp = NOQGRP;
5359 #endif /* 0 */
5360 
5361 	/* New ID means it's not on disk yet */
5362 	e->e_qfletter = '\0';
5363 
5364 	if (tTd(7, 1))
5365 		sm_dprintf("assign_queueid: assigned id %s, e=%p\n",
5366 			e->e_id, e);
5367 	if (LogLevel > 93)
5368 		sm_syslog(LOG_DEBUG, e->e_id, "assigned id");
5369 }
5370 /*
5371 **  SYNC_QUEUE_TIME -- Assure exclusive PID in any given second
5372 **
5373 **	Make sure one PID can't be used by two processes in any one second.
5374 **
5375 **		If the system rotates PIDs fast enough, may get the
5376 **		same pid in the same second for two distinct processes.
5377 **		This will interfere with the queue file naming system.
5378 **
5379 **	Parameters:
5380 **		none
5381 **
5382 **	Returns:
5383 **		none
5384 */
5385 
5386 void
5387 sync_queue_time()
5388 {
5389 #if FAST_PID_RECYCLE
5390 	if (OpMode != MD_TEST &&
5391 	    OpMode != MD_VERIFY &&
5392 	    LastQueueTime > 0 &&
5393 	    LastQueuePid == CurrentPid &&
5394 	    curtime() == LastQueueTime)
5395 		(void) sleep(1);
5396 #endif /* FAST_PID_RECYCLE */
5397 }
5398 /*
5399 **  UNLOCKQUEUE -- unlock the queue entry for a specified envelope
5400 **
5401 **	Parameters:
5402 **		e -- the envelope to unlock.
5403 **
5404 **	Returns:
5405 **		none
5406 **
5407 **	Side Effects:
5408 **		unlocks the queue for `e'.
5409 */
5410 
5411 void
5412 unlockqueue(e)
5413 	ENVELOPE *e;
5414 {
5415 	if (tTd(51, 4))
5416 		sm_dprintf("unlockqueue(%s)\n",
5417 			e->e_id == NULL ? "NOQUEUE" : e->e_id);
5418 
5419 
5420 	/* if there is a lock file in the envelope, close it */
5421 	if (e->e_lockfp != NULL)
5422 		(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
5423 	e->e_lockfp = NULL;
5424 
5425 	/* don't create a queue id if we don't already have one */
5426 	if (e->e_id == NULL)
5427 		return;
5428 
5429 	/* remove the transcript */
5430 	if (LogLevel > 87)
5431 		sm_syslog(LOG_DEBUG, e->e_id, "unlock");
5432 	if (!tTd(51, 104))
5433 		(void) xunlink(queuename(e, XSCRPT_LETTER));
5434 }
5435 /*
5436 **  SETCTLUSER -- create a controlling address
5437 **
5438 **	Create a fake "address" given only a local login name; this is
5439 **	used as a "controlling user" for future recipient addresses.
5440 **
5441 **	Parameters:
5442 **		user -- the user name of the controlling user.
5443 **		qfver -- the version stamp of this queue file.
5444 **		e -- envelope
5445 **
5446 **	Returns:
5447 **		An address descriptor for the controlling user,
5448 **		using storage allocated from e->e_rpool.
5449 **
5450 */
5451 
5452 static ADDRESS *
5453 setctluser(user, qfver, e)
5454 	char *user;
5455 	int qfver;
5456 	ENVELOPE *e;
5457 {
5458 	register ADDRESS *a;
5459 	struct passwd *pw;
5460 	char *p;
5461 
5462 	/*
5463 	**  See if this clears our concept of controlling user.
5464 	*/
5465 
5466 	if (user == NULL || *user == '\0')
5467 		return NULL;
5468 
5469 	/*
5470 	**  Set up addr fields for controlling user.
5471 	*/
5472 
5473 	a = (ADDRESS *) sm_rpool_malloc_x(e->e_rpool, sizeof *a);
5474 	memset((char *) a, '\0', sizeof *a);
5475 
5476 	if (*user == ':')
5477 	{
5478 		p = &user[1];
5479 		a->q_user = sm_rpool_strdup_x(e->e_rpool, p);
5480 	}
5481 	else
5482 	{
5483 		p = strtok(user, ":");
5484 		a->q_user = sm_rpool_strdup_x(e->e_rpool, user);
5485 		if (qfver >= 2)
5486 		{
5487 			if ((p = strtok(NULL, ":")) != NULL)
5488 				a->q_uid = atoi(p);
5489 			if ((p = strtok(NULL, ":")) != NULL)
5490 				a->q_gid = atoi(p);
5491 			if ((p = strtok(NULL, ":")) != NULL)
5492 			{
5493 				char *o;
5494 
5495 				a->q_flags |= QGOODUID;
5496 
5497 				/* if there is another ':': restore it */
5498 				if ((o = strtok(NULL, ":")) != NULL && o > p)
5499 					o[-1] = ':';
5500 			}
5501 		}
5502 		else if ((pw = sm_getpwnam(user)) != NULL)
5503 		{
5504 			if (*pw->pw_dir == '\0')
5505 				a->q_home = NULL;
5506 			else if (strcmp(pw->pw_dir, "/") == 0)
5507 				a->q_home = "";
5508 			else
5509 				a->q_home = sm_rpool_strdup_x(e->e_rpool, pw->pw_dir);
5510 			a->q_uid = pw->pw_uid;
5511 			a->q_gid = pw->pw_gid;
5512 			a->q_flags |= QGOODUID;
5513 		}
5514 	}
5515 
5516 	a->q_flags |= QPRIMARY;		/* flag as a "ctladdr" */
5517 	a->q_mailer = LocalMailer;
5518 	if (p == NULL)
5519 		a->q_paddr = sm_rpool_strdup_x(e->e_rpool, a->q_user);
5520 	else
5521 		a->q_paddr = sm_rpool_strdup_x(e->e_rpool, p);
5522 	return a;
5523 }
5524 /*
5525 **  LOSEQFILE -- rename queue file with LOSEQF_LETTER & try to let someone know
5526 **
5527 **	Parameters:
5528 **		e -- the envelope (e->e_id will be used).
5529 **		why -- reported to whomever can hear.
5530 **
5531 **	Returns:
5532 **		none.
5533 */
5534 
5535 void
5536 loseqfile(e, why)
5537 	register ENVELOPE *e;
5538 	char *why;
5539 {
5540 	bool loseit = true;
5541 	char *p;
5542 	char buf[MAXPATHLEN];
5543 
5544 	if (e == NULL || e->e_id == NULL)
5545 		return;
5546 	p = queuename(e, ANYQFL_LETTER);
5547 	if (sm_strlcpy(buf, p, sizeof buf) >= sizeof buf)
5548 		return;
5549 	if (!bitset(EF_INQUEUE, e->e_flags))
5550 		queueup(e, false, true);
5551 	else if (QueueMode == QM_LOST)
5552 		loseit = false;
5553 
5554 	/* if already lost, no need to re-lose */
5555 	if (loseit)
5556 	{
5557 		p = queuename(e, LOSEQF_LETTER);
5558 		if (rename(buf, p) < 0)
5559 			syserr("cannot rename(%s, %s), uid=%d",
5560 			       buf, p, (int) geteuid());
5561 		else if (LogLevel > 0)
5562 			sm_syslog(LOG_ALERT, e->e_id,
5563 				  "Losing %s: %s", buf, why);
5564 	}
5565 	if (e->e_dfp != NULL)
5566 	{
5567 		(void) sm_io_close(e->e_dfp, SM_TIME_DEFAULT);
5568 		e->e_dfp = NULL;
5569 	}
5570 	e->e_flags &= ~EF_HAS_DF;
5571 }
5572 /*
5573 **  NAME2QID -- translate a queue group name to a queue group id
5574 **
5575 **	Parameters:
5576 **		queuename -- name of queue group.
5577 **
5578 **	Returns:
5579 **		queue group id if found.
5580 **		NOQGRP otherwise.
5581 */
5582 
5583 int
5584 name2qid(queuename)
5585 	char *queuename;
5586 {
5587 	register STAB *s;
5588 
5589 	s = stab(queuename, ST_QUEUE, ST_FIND);
5590 	if (s == NULL)
5591 		return NOQGRP;
5592 	return s->s_quegrp->qg_index;
5593 }
5594 /*
5595 **  QID_PRINTNAME -- create externally printable version of queue id
5596 **
5597 **	Parameters:
5598 **		e -- the envelope.
5599 **
5600 **	Returns:
5601 **		a printable version
5602 */
5603 
5604 char *
5605 qid_printname(e)
5606 	ENVELOPE *e;
5607 {
5608 	char *id;
5609 	static char idbuf[MAXQFNAME + 34];
5610 
5611 	if (e == NULL)
5612 		return "";
5613 
5614 	if (e->e_id == NULL)
5615 		id = "";
5616 	else
5617 		id = e->e_id;
5618 
5619 	if (e->e_qdir == NOQDIR)
5620 		return id;
5621 
5622 	(void) sm_snprintf(idbuf, sizeof idbuf, "%.32s/%s",
5623 			   Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_name,
5624 			   id);
5625 	return idbuf;
5626 }
5627 /*
5628 **  QID_PRINTQUEUE -- create full version of queue directory for data files
5629 **
5630 **	Parameters:
5631 **		qgrp -- index in queue group.
5632 **		qdir -- the short version of the queue directory
5633 **
5634 **	Returns:
5635 **		the full pathname to the queue (might point to a static var)
5636 */
5637 
5638 char *
5639 qid_printqueue(qgrp, qdir)
5640 	int qgrp;
5641 	int qdir;
5642 {
5643 	char *subdir;
5644 	static char dir[MAXPATHLEN];
5645 
5646 	if (qdir == NOQDIR)
5647 		return Queue[qgrp]->qg_qdir;
5648 
5649 	if (strcmp(Queue[qgrp]->qg_qpaths[qdir].qp_name, ".") == 0)
5650 		subdir = NULL;
5651 	else
5652 		subdir = Queue[qgrp]->qg_qpaths[qdir].qp_name;
5653 
5654 	(void) sm_strlcpyn(dir, sizeof dir, 4,
5655 			Queue[qgrp]->qg_qdir,
5656 			subdir == NULL ? "" : "/",
5657 			subdir == NULL ? "" : subdir,
5658 			(bitset(QP_SUBDF,
5659 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
5660 					? "/df" : ""));
5661 	return dir;
5662 }
5663 
5664 /*
5665 **  PICKQDIR -- Pick a queue directory from a queue group
5666 **
5667 **	Parameters:
5668 **		qg -- queue group
5669 **		fsize -- file size in bytes
5670 **		e -- envelope, or NULL
5671 **
5672 **	Result:
5673 **		NOQDIR if no queue directory in qg has enough free space to
5674 **		hold a file of size 'fsize', otherwise the index of
5675 **		a randomly selected queue directory which resides on a
5676 **		file system with enough disk space.
5677 **		XXX This could be extended to select a queuedir with
5678 **			a few (the fewest?) number of entries. That data
5679 **			is available if shared memory is used.
5680 **
5681 **	Side Effects:
5682 **		If the request fails and e != NULL then sm_syslog is called.
5683 */
5684 
5685 int
5686 pickqdir(qg, fsize, e)
5687 	QUEUEGRP *qg;
5688 	long fsize;
5689 	ENVELOPE *e;
5690 {
5691 	int qdir;
5692 	int i;
5693 	long avail = 0;
5694 
5695 	/* Pick a random directory, as a starting point. */
5696 	if (qg->qg_numqueues <= 1)
5697 		qdir = 0;
5698 	else
5699 		qdir = get_rand_mod(qg->qg_numqueues);
5700 
5701 	if (MinBlocksFree <= 0 && fsize <= 0)
5702 		return qdir;
5703 
5704 	/*
5705 	**  Now iterate over the queue directories,
5706 	**  looking for a directory with enough space for this message.
5707 	*/
5708 
5709 	i = qdir;
5710 	do
5711 	{
5712 		QPATHS *qp = &qg->qg_qpaths[i];
5713 		long needed = 0;
5714 		long fsavail = 0;
5715 
5716 		if (fsize > 0)
5717 			needed += fsize / FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5718 				  + ((fsize % FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5719 				      > 0) ? 1 : 0);
5720 		if (MinBlocksFree > 0)
5721 			needed += MinBlocksFree;
5722 		fsavail = FILE_SYS_AVAIL(qp->qp_fsysidx);
5723 #if SM_CONF_SHM
5724 		if (fsavail <= 0)
5725 		{
5726 			long blksize;
5727 
5728 			/*
5729 			**  might be not correctly updated,
5730 			**  let's try to get the info directly.
5731 			*/
5732 
5733 			fsavail = freediskspace(FILE_SYS_NAME(qp->qp_fsysidx),
5734 						&blksize);
5735 			if (fsavail < 0)
5736 				fsavail = 0;
5737 		}
5738 #endif /* SM_CONF_SHM */
5739 		if (needed <= fsavail)
5740 			return i;
5741 		if (avail < fsavail)
5742 			avail = fsavail;
5743 
5744 		if (qg->qg_numqueues > 0)
5745 			i = (i + 1) % qg->qg_numqueues;
5746 	} while (i != qdir);
5747 
5748 	if (e != NULL && LogLevel > 0)
5749 		sm_syslog(LOG_ALERT, e->e_id,
5750 			"low on space (%s needs %ld bytes + %ld blocks in %s), max avail: %ld",
5751 			CurHostName == NULL ? "SMTP-DAEMON" : CurHostName,
5752 			fsize, MinBlocksFree,
5753 			qg->qg_qdir, avail);
5754 	return NOQDIR;
5755 }
5756 /*
5757 **  SETNEWQUEUE -- Sets a new queue group and directory
5758 **
5759 **	Assign a queue group and directory to an envelope and store the
5760 **	directory in e->e_qdir.
5761 **
5762 **	Parameters:
5763 **		e -- envelope to assign a queue for.
5764 **
5765 **	Returns:
5766 **		true if successful
5767 **		false otherwise
5768 **
5769 **	Side Effects:
5770 **		On success, e->e_qgrp and e->e_qdir are non-negative.
5771 **		On failure (not enough disk space),
5772 **		e->qgrp = NOQGRP, e->e_qdir = NOQDIR
5773 **		and usrerr() is invoked (which could raise an exception).
5774 */
5775 
5776 bool
5777 setnewqueue(e)
5778 	ENVELOPE *e;
5779 {
5780 	if (tTd(41, 20))
5781 		sm_dprintf("setnewqueue: called\n");
5782 
5783 	/* not set somewhere else */
5784 	if (e->e_qgrp == NOQGRP)
5785 	{
5786 		ADDRESS *q;
5787 
5788 		/*
5789 		**  Use the queue group of the "first" recipient, as set by
5790 		**  the "queuegroup" rule set.  If that is not defined, then
5791 		**  use the queue group of the mailer of the first recipient.
5792 		**  If that is not defined either, then use the default
5793 		**  queue group.
5794 		**  Notice: "first" depends on the sorting of sendqueue
5795 		**  in recipient().
5796 		**  To avoid problems with "bad" recipients look
5797 		**  for a valid address first.
5798 		*/
5799 
5800 		q = e->e_sendqueue;
5801 		while (q != NULL &&
5802 		       (QS_IS_BADADDR(q->q_state) || QS_IS_DEAD(q->q_state)))
5803 		{
5804 			q = q->q_next;
5805 		}
5806 		if (q == NULL)
5807 			e->e_qgrp = 0;
5808 		else if (q->q_qgrp >= 0)
5809 			e->e_qgrp = q->q_qgrp;
5810 		else if (q->q_mailer != NULL &&
5811 			 ISVALIDQGRP(q->q_mailer->m_qgrp))
5812 			e->e_qgrp = q->q_mailer->m_qgrp;
5813 		else
5814 			e->e_qgrp = 0;
5815 		e->e_dfqgrp = e->e_qgrp;
5816 	}
5817 
5818 	if (ISVALIDQDIR(e->e_qdir) && ISVALIDQDIR(e->e_dfqdir))
5819 	{
5820 		if (tTd(41, 20))
5821 			sm_dprintf("setnewqueue: e_qdir already assigned (%s)\n",
5822 				qid_printqueue(e->e_qgrp, e->e_qdir));
5823 		return true;
5824 	}
5825 
5826 	filesys_update();
5827 	e->e_qdir = pickqdir(Queue[e->e_qgrp], e->e_msgsize, e);
5828 	if (e->e_qdir == NOQDIR)
5829 	{
5830 		e->e_qgrp = NOQGRP;
5831 		if (!bitset(EF_FATALERRS, e->e_flags))
5832 			usrerr("452 4.4.5 Insufficient disk space; try again later");
5833 		e->e_flags |= EF_FATALERRS;
5834 		return false;
5835 	}
5836 
5837 	if (tTd(41, 3))
5838 		sm_dprintf("setnewqueue: Assigned queue directory %s\n",
5839 			qid_printqueue(e->e_qgrp, e->e_qdir));
5840 
5841 	if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5842 	{
5843 		e->e_xfqgrp = e->e_qgrp;
5844 		e->e_xfqdir = e->e_qdir;
5845 	}
5846 	e->e_dfqdir = e->e_qdir;
5847 	return true;
5848 }
5849 /*
5850 **  CHKQDIR -- check a queue directory
5851 **
5852 **	Parameters:
5853 **		name -- name of queue directory
5854 **		sff -- flags for safefile()
5855 **
5856 **	Returns:
5857 **		is it a queue directory?
5858 */
5859 
5860 static bool
5861 chkqdir(name, sff)
5862 	char *name;
5863 	long sff;
5864 {
5865 	struct stat statb;
5866 	int i;
5867 
5868 	/* skip over . and .. directories */
5869 	if (name[0] == '.' &&
5870 	    (name[1] == '\0' || (name[1] == '.' && name[2] == '\0')))
5871 		return false;
5872 #if HASLSTAT
5873 	if (lstat(name, &statb) < 0)
5874 #else /* HASLSTAT */
5875 	if (stat(name, &statb) < 0)
5876 #endif /* HASLSTAT */
5877 	{
5878 		if (tTd(41, 2))
5879 			sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5880 				   name, sm_errstring(errno));
5881 		return false;
5882 	}
5883 #if HASLSTAT
5884 	if (S_ISLNK(statb.st_mode))
5885 	{
5886 		/*
5887 		**  For a symlink we need to make sure the
5888 		**  target is a directory
5889 		*/
5890 
5891 		if (stat(name, &statb) < 0)
5892 		{
5893 			if (tTd(41, 2))
5894 				sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5895 					   name, sm_errstring(errno));
5896 			return false;
5897 		}
5898 	}
5899 #endif /* HASLSTAT */
5900 
5901 	if (!S_ISDIR(statb.st_mode))
5902 	{
5903 		if (tTd(41, 2))
5904 			sm_dprintf("chkqdir: \"%s\": Not a directory\n",
5905 				name);
5906 		return false;
5907 	}
5908 
5909 	/* Print a warning if unsafe (but still use it) */
5910 	/* XXX do this only if we want the warning? */
5911 	i = safedirpath(name, RunAsUid, RunAsGid, NULL, sff, 0, 0);
5912 	if (i != 0)
5913 	{
5914 		if (tTd(41, 2))
5915 			sm_dprintf("chkqdir: \"%s\": Not safe: %s\n",
5916 				   name, sm_errstring(i));
5917 #if _FFR_CHK_QUEUE
5918 		if (LogLevel > 8)
5919 			sm_syslog(LOG_WARNING, NOQID,
5920 				  "queue directory \"%s\": Not safe: %s",
5921 				  name, sm_errstring(i));
5922 #endif /* _FFR_CHK_QUEUE */
5923 	}
5924 	return true;
5925 }
5926 /*
5927 **  MULTIQUEUE_CACHE -- cache a list of paths to queues.
5928 **
5929 **	Each potential queue is checked as the cache is built.
5930 **	Thereafter, each is blindly trusted.
5931 **	Note that we can be called again after a timeout to rebuild
5932 **	(although code for that is not ready yet).
5933 **
5934 **	Parameters:
5935 **		basedir -- base of all queue directories.
5936 **		blen -- strlen(basedir).
5937 **		qg -- queue group.
5938 **		qn -- number of queue directories already cached.
5939 **		phash -- pointer to hash value over queue dirs.
5940 #if SM_CONF_SHM
5941 **			only used if shared memory is active.
5942 #endif * SM_CONF_SHM *
5943 **
5944 **	Returns:
5945 **		new number of queue directories.
5946 */
5947 
5948 #define INITIAL_SLOTS	20
5949 #define ADD_SLOTS	10
5950 
5951 static int
5952 multiqueue_cache(basedir, blen, qg, qn, phash)
5953 	char *basedir;
5954 	int blen;
5955 	QUEUEGRP *qg;
5956 	int qn;
5957 	unsigned int *phash;
5958 {
5959 	char *cp;
5960 	int i, len;
5961 	int slotsleft = 0;
5962 	long sff = SFF_ANYFILE;
5963 	char qpath[MAXPATHLEN];
5964 	char subdir[MAXPATHLEN];
5965 	char prefix[MAXPATHLEN];	/* dir relative to basedir */
5966 
5967 	if (tTd(41, 20))
5968 		sm_dprintf("multiqueue_cache: called\n");
5969 
5970 	/* Initialize to current directory */
5971 	prefix[0] = '.';
5972 	prefix[1] = '\0';
5973 	if (qg->qg_numqueues != 0 && qg->qg_qpaths != NULL)
5974 	{
5975 		for (i = 0; i < qg->qg_numqueues; i++)
5976 		{
5977 			if (qg->qg_qpaths[i].qp_name != NULL)
5978 				(void) sm_free(qg->qg_qpaths[i].qp_name); /* XXX */
5979 		}
5980 		(void) sm_free((char *) qg->qg_qpaths); /* XXX */
5981 		qg->qg_qpaths = NULL;
5982 		qg->qg_numqueues = 0;
5983 	}
5984 
5985 	/* If running as root, allow safedirpath() checks to use privs */
5986 	if (RunAsUid == 0)
5987 		sff |= SFF_ROOTOK;
5988 #if _FFR_CHK_QUEUE
5989 	sff |= SFF_SAFEDIRPATH|SFF_NOWWFILES;
5990 	if (!UseMSP)
5991 		sff |= SFF_NOGWFILES;
5992 #endif /* _FFR_CHK_QUEUE */
5993 
5994 	if (!SM_IS_DIR_START(qg->qg_qdir))
5995 	{
5996 		/*
5997 		**  XXX we could add basedir, but then we have to realloc()
5998 		**  the string... Maybe another time.
5999 		*/
6000 
6001 		syserr("QueuePath %s not absolute", qg->qg_qdir);
6002 		ExitStat = EX_CONFIG;
6003 		return qn;
6004 	}
6005 
6006 	/* qpath: directory of current workgroup */
6007 	len = sm_strlcpy(qpath, qg->qg_qdir, sizeof qpath);
6008 	if (len >= sizeof qpath)
6009 	{
6010 		syserr("QueuePath %.256s too long (%d max)",
6011 		       qg->qg_qdir, (int) sizeof qpath);
6012 		ExitStat = EX_CONFIG;
6013 		return qn;
6014 	}
6015 
6016 	/* begin of qpath must be same as basedir */
6017 	if (strncmp(basedir, qpath, blen) != 0 &&
6018 	    (strncmp(basedir, qpath, blen - 1) != 0 || len != blen - 1))
6019 	{
6020 		syserr("QueuePath %s not subpath of QueueDirectory %s",
6021 			qpath, basedir);
6022 		ExitStat = EX_CONFIG;
6023 		return qn;
6024 	}
6025 
6026 	/* Do we have a nested subdirectory? */
6027 	if (blen < len && SM_FIRST_DIR_DELIM(qg->qg_qdir + blen) != NULL)
6028 	{
6029 
6030 		/* Copy subdirectory into prefix for later use */
6031 		if (sm_strlcpy(prefix, qg->qg_qdir + blen, sizeof prefix) >=
6032 		    sizeof prefix)
6033 		{
6034 			syserr("QueuePath %.256s too long (%d max)",
6035 				qg->qg_qdir, (int) sizeof qpath);
6036 			ExitStat = EX_CONFIG;
6037 			return qn;
6038 		}
6039 		cp = SM_LAST_DIR_DELIM(prefix);
6040 		SM_ASSERT(cp != NULL);
6041 		*cp = '\0';	/* cut off trailing / */
6042 	}
6043 
6044 	/* This is guaranteed by the basedir check above */
6045 	SM_ASSERT(len >= blen - 1);
6046 	cp = &qpath[len - 1];
6047 	if (*cp == '*')
6048 	{
6049 		register DIR *dp;
6050 		register struct dirent *d;
6051 		int off;
6052 		char *delim;
6053 		char relpath[MAXPATHLEN];
6054 
6055 		*cp = '\0';	/* Overwrite wildcard */
6056 		if ((cp = SM_LAST_DIR_DELIM(qpath)) == NULL)
6057 		{
6058 			syserr("QueueDirectory: can not wildcard relative path");
6059 			if (tTd(41, 2))
6060 				sm_dprintf("multiqueue_cache: \"%s*\": Can not wildcard relative path.\n",
6061 					qpath);
6062 			ExitStat = EX_CONFIG;
6063 			return qn;
6064 		}
6065 		if (cp == qpath)
6066 		{
6067 			/*
6068 			**  Special case of top level wildcard, like /foo*
6069 			**	Change to //foo*
6070 			*/
6071 
6072 			(void) sm_strlcpy(qpath + 1, qpath, sizeof qpath - 1);
6073 			++cp;
6074 		}
6075 		delim = cp;
6076 		*(cp++) = '\0';		/* Replace / with \0 */
6077 		len = strlen(cp);	/* Last component of queue directory */
6078 
6079 		/*
6080 		**  Path relative to basedir, with trailing /
6081 		**  It will be modified below to specify the subdirectories
6082 		**  so they can be opened without chdir().
6083 		*/
6084 
6085 		off = sm_strlcpyn(relpath, sizeof relpath, 2, prefix, "/");
6086 		SM_ASSERT(off < sizeof relpath);
6087 
6088 		if (tTd(41, 2))
6089 			sm_dprintf("multiqueue_cache: prefix=\"%s%s\"\n",
6090 				   relpath, cp);
6091 
6092 		/* It is always basedir: we don't need to store it per group */
6093 		/* XXX: optimize this! -> one more global? */
6094 		qg->qg_qdir = newstr(basedir);
6095 		qg->qg_qdir[blen - 1] = '\0';	/* cut off trailing / */
6096 
6097 		/*
6098 		**  XXX Should probably wrap this whole loop in a timeout
6099 		**  in case some wag decides to NFS mount the queues.
6100 		*/
6101 
6102 		/* Test path to get warning messages. */
6103 		if (qn == 0)
6104 		{
6105 			/*  XXX qg_runasuid and qg_runasgid for specials? */
6106 			i = safedirpath(basedir, RunAsUid, RunAsGid, NULL,
6107 					sff, 0, 0);
6108 			if (i != 0 && tTd(41, 2))
6109 				sm_dprintf("multiqueue_cache: \"%s\": Not safe: %s\n",
6110 					   basedir, sm_errstring(i));
6111 		}
6112 
6113 		if ((dp = opendir(prefix)) == NULL)
6114 		{
6115 			syserr("can not opendir(%s/%s)", qg->qg_qdir, prefix);
6116 			if (tTd(41, 2))
6117 				sm_dprintf("multiqueue_cache: opendir(\"%s/%s\"): %s\n",
6118 					   qg->qg_qdir, prefix,
6119 					   sm_errstring(errno));
6120 			ExitStat = EX_CONFIG;
6121 			return qn;
6122 		}
6123 		while ((d = readdir(dp)) != NULL)
6124 		{
6125 			i = strlen(d->d_name);
6126 			if (i < len || strncmp(d->d_name, cp, len) != 0)
6127 			{
6128 				if (tTd(41, 5))
6129 					sm_dprintf("multiqueue_cache: \"%s\", skipped\n",
6130 						d->d_name);
6131 				continue;
6132 			}
6133 
6134 			/* Create relative pathname: prefix + local directory */
6135 			i = sizeof(relpath) - off;
6136 			if (sm_strlcpy(relpath + off, d->d_name, i) >= i)
6137 				continue;	/* way too long */
6138 
6139 			if (!chkqdir(relpath, sff))
6140 				continue;
6141 
6142 			if (qg->qg_qpaths == NULL)
6143 			{
6144 				slotsleft = INITIAL_SLOTS;
6145 				qg->qg_qpaths = (QPATHS *)xalloc((sizeof *qg->qg_qpaths) *
6146 								slotsleft);
6147 				qg->qg_numqueues = 0;
6148 			}
6149 			else if (slotsleft < 1)
6150 			{
6151 				qg->qg_qpaths = (QPATHS *)sm_realloc((char *)qg->qg_qpaths,
6152 							  (sizeof *qg->qg_qpaths) *
6153 							  (qg->qg_numqueues +
6154 							   ADD_SLOTS));
6155 				if (qg->qg_qpaths == NULL)
6156 				{
6157 					(void) closedir(dp);
6158 					return qn;
6159 				}
6160 				slotsleft += ADD_SLOTS;
6161 			}
6162 
6163 			/* check subdirs */
6164 			qg->qg_qpaths[qg->qg_numqueues].qp_subdirs = QP_NOSUB;
6165 
6166 #define CHKRSUBDIR(name, flag)	\
6167 	(void) sm_strlcpyn(subdir, sizeof subdir, 3, relpath, "/", name); \
6168 	if (chkqdir(subdir, sff))	\
6169 		qg->qg_qpaths[qg->qg_numqueues].qp_subdirs |= flag;	\
6170 	else
6171 
6172 
6173 			CHKRSUBDIR("qf", QP_SUBQF);
6174 			CHKRSUBDIR("df", QP_SUBDF);
6175 			CHKRSUBDIR("xf", QP_SUBXF);
6176 
6177 			/* assert(strlen(d->d_name) < MAXPATHLEN - 14) */
6178 			/* maybe even - 17 (subdirs) */
6179 
6180 			if (prefix[0] != '.')
6181 				qg->qg_qpaths[qg->qg_numqueues].qp_name =
6182 					newstr(relpath);
6183 			else
6184 				qg->qg_qpaths[qg->qg_numqueues].qp_name =
6185 					newstr(d->d_name);
6186 
6187 			if (tTd(41, 2))
6188 				sm_dprintf("multiqueue_cache: %d: \"%s\" cached (%x).\n",
6189 					qg->qg_numqueues, relpath,
6190 					qg->qg_qpaths[qg->qg_numqueues].qp_subdirs);
6191 #if SM_CONF_SHM
6192 			qg->qg_qpaths[qg->qg_numqueues].qp_idx = qn;
6193 			*phash = hash_q(relpath, *phash);
6194 #endif /* SM_CONF_SHM */
6195 			qg->qg_numqueues++;
6196 			++qn;
6197 			slotsleft--;
6198 		}
6199 		(void) closedir(dp);
6200 
6201 		/* undo damage */
6202 		*delim = '/';
6203 	}
6204 	if (qg->qg_numqueues == 0)
6205 	{
6206 		qg->qg_qpaths = (QPATHS *) xalloc(sizeof *qg->qg_qpaths);
6207 
6208 		/* test path to get warning messages */
6209 		i = safedirpath(qpath, RunAsUid, RunAsGid, NULL, sff, 0, 0);
6210 		if (i == ENOENT)
6211 		{
6212 			syserr("can not opendir(%s)", qpath);
6213 			if (tTd(41, 2))
6214 				sm_dprintf("multiqueue_cache: opendir(\"%s\"): %s\n",
6215 					   qpath, sm_errstring(i));
6216 			ExitStat = EX_CONFIG;
6217 			return qn;
6218 		}
6219 
6220 		qg->qg_qpaths[0].qp_subdirs = QP_NOSUB;
6221 		qg->qg_numqueues = 1;
6222 
6223 		/* check subdirs */
6224 #define CHKSUBDIR(name, flag)	\
6225 	(void) sm_strlcpyn(subdir, sizeof subdir, 3, qg->qg_qdir, "/", name); \
6226 	if (chkqdir(subdir, sff))	\
6227 		qg->qg_qpaths[0].qp_subdirs |= flag;	\
6228 	else
6229 
6230 		CHKSUBDIR("qf", QP_SUBQF);
6231 		CHKSUBDIR("df", QP_SUBDF);
6232 		CHKSUBDIR("xf", QP_SUBXF);
6233 
6234 		if (qg->qg_qdir[blen - 1] != '\0' &&
6235 		    qg->qg_qdir[blen] != '\0')
6236 		{
6237 			/*
6238 			**  Copy the last component into qpaths and
6239 			**  cut off qdir
6240 			*/
6241 
6242 			qg->qg_qpaths[0].qp_name = newstr(qg->qg_qdir + blen);
6243 			qg->qg_qdir[blen - 1] = '\0';
6244 		}
6245 		else
6246 			qg->qg_qpaths[0].qp_name = newstr(".");
6247 
6248 #if SM_CONF_SHM
6249 		qg->qg_qpaths[0].qp_idx = qn;
6250 		*phash = hash_q(qg->qg_qpaths[0].qp_name, *phash);
6251 #endif /* SM_CONF_SHM */
6252 		++qn;
6253 	}
6254 	return qn;
6255 }
6256 
6257 /*
6258 **  FILESYS_FIND -- find entry in FileSys table, or add new one
6259 **
6260 **	Given the pathname of a directory, determine the file system
6261 **	in which that directory resides, and return a pointer to the
6262 **	entry in the FileSys table that describes the file system.
6263 **	A new entry is added if necessary (and requested).
6264 **	If the directory does not exist, -1 is returned.
6265 **
6266 **	Parameters:
6267 **		path -- pathname of directory
6268 **		add -- add to structure if not found.
6269 **
6270 **	Returns:
6271 **		>=0: found: index in file system table
6272 **		<0: some error, i.e.,
6273 **		FSF_TOO_MANY: too many filesystems (-> syserr())
6274 **		FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6275 **		FSF_NOT_FOUND: not in list
6276 */
6277 
6278 static short filesys_find __P((char *, bool));
6279 
6280 #define FSF_NOT_FOUND	(-1)
6281 #define FSF_STAT_FAIL	(-2)
6282 #define FSF_TOO_MANY	(-3)
6283 
6284 static short
6285 filesys_find(path, add)
6286 	char *path;
6287 	bool add;
6288 {
6289 	struct stat st;
6290 	short i;
6291 
6292 	if (stat(path, &st) < 0)
6293 	{
6294 		syserr("cannot stat queue directory %s", path);
6295 		return FSF_STAT_FAIL;
6296 	}
6297 	for (i = 0; i < NumFileSys; ++i)
6298 	{
6299 		if (FILE_SYS_DEV(i) == st.st_dev)
6300 			return i;
6301 	}
6302 	if (i >= MAXFILESYS)
6303 	{
6304 		syserr("too many queue file systems (%d max)", MAXFILESYS);
6305 		return FSF_TOO_MANY;
6306 	}
6307 	if (!add)
6308 		return FSF_NOT_FOUND;
6309 
6310 	++NumFileSys;
6311 	FILE_SYS_NAME(i) = path;
6312 	FILE_SYS_DEV(i) = st.st_dev;
6313 	FILE_SYS_AVAIL(i) = 0;
6314 	FILE_SYS_BLKSIZE(i) = 1024; /* avoid divide by zero */
6315 	return i;
6316 }
6317 
6318 /*
6319 **  FILESYS_SETUP -- set up mapping from queue directories to file systems
6320 **
6321 **	This data structure is used to efficiently check the amount of
6322 **	free space available in a set of queue directories.
6323 **
6324 **	Parameters:
6325 **		add -- initialize structure if necessary.
6326 **
6327 **	Returns:
6328 **		0: success
6329 **		<0: some error, i.e.,
6330 **		FSF_NOT_FOUND: not in list
6331 **		FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6332 **		FSF_TOO_MANY: too many filesystems (-> syserr())
6333 */
6334 
6335 static int filesys_setup __P((bool));
6336 
6337 static int
6338 filesys_setup(add)
6339 	bool add;
6340 {
6341 	int i, j;
6342 	short fs;
6343 	int ret;
6344 
6345 	ret = 0;
6346 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
6347 	{
6348 		for (j = 0; j < Queue[i]->qg_numqueues; ++j)
6349 		{
6350 			QPATHS *qp = &Queue[i]->qg_qpaths[j];
6351 
6352 			fs = filesys_find(qp->qp_name, add);
6353 			if (fs >= 0)
6354 				qp->qp_fsysidx = fs;
6355 			else
6356 				qp->qp_fsysidx = 0;
6357 			if (fs < ret)
6358 				ret = fs;
6359 		}
6360 	}
6361 	return ret;
6362 }
6363 
6364 /*
6365 **  FILESYS_UPDATE -- update amount of free space on all file systems
6366 **
6367 **	The FileSys table is used to cache the amount of free space
6368 **	available on all queue directory file systems.
6369 **	This function updates the cached information if it has expired.
6370 **
6371 **	Parameters:
6372 **		none.
6373 **
6374 **	Returns:
6375 **		none.
6376 **
6377 **	Side Effects:
6378 **		Updates FileSys table.
6379 */
6380 
6381 void
6382 filesys_update()
6383 {
6384 	int i;
6385 	long avail, blksize;
6386 	time_t now;
6387 	static time_t nextupdate = 0;
6388 
6389 #if SM_CONF_SHM
6390 	/* only the daemon updates this structure */
6391 	if (ShmId != SM_SHM_NO_ID && DaemonPid != CurrentPid)
6392 		return;
6393 #endif /* SM_CONF_SHM */
6394 	now = curtime();
6395 	if (now < nextupdate)
6396 		return;
6397 	nextupdate = now + FILESYS_UPDATE_INTERVAL;
6398 	for (i = 0; i < NumFileSys; ++i)
6399 	{
6400 		FILESYS *fs = &FILE_SYS(i);
6401 
6402 		avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6403 		if (avail < 0 || blksize <= 0)
6404 		{
6405 			if (LogLevel > 5)
6406 				sm_syslog(LOG_ERR, NOQID,
6407 					"filesys_update failed: %s, fs=%s, avail=%ld, blocksize=%ld",
6408 					sm_errstring(errno),
6409 					FILE_SYS_NAME(i), avail, blksize);
6410 			fs->fs_avail = 0;
6411 			fs->fs_blksize = 1024; /* avoid divide by zero */
6412 			nextupdate = now + 2; /* let's do this soon again */
6413 		}
6414 		else
6415 		{
6416 			fs->fs_avail = avail;
6417 			fs->fs_blksize = blksize;
6418 		}
6419 	}
6420 }
6421 
6422 #if _FFR_ANY_FREE_FS
6423 /*
6424 **  FILESYS_FREE -- check whether there is at least one fs with enough space.
6425 **
6426 **	Parameters:
6427 **		fsize -- file size in bytes
6428 **
6429 **	Returns:
6430 **		true iff there is one fs with more than fsize bytes free.
6431 */
6432 
6433 bool
6434 filesys_free(fsize)
6435 	long fsize;
6436 {
6437 	int i;
6438 
6439 	if (fsize <= 0)
6440 		return true;
6441 	for (i = 0; i < NumFileSys; ++i)
6442 	{
6443 		long needed = 0;
6444 
6445 		if (FILE_SYS_AVAIL(i) < 0 || FILE_SYS_BLKSIZE(i) <= 0)
6446 			continue;
6447 		needed += fsize / FILE_SYS_BLKSIZE(i)
6448 			  + ((fsize % FILE_SYS_BLKSIZE(i)
6449 			      > 0) ? 1 : 0)
6450 			  + MinBlocksFree;
6451 		if (needed <= FILE_SYS_AVAIL(i))
6452 			return true;
6453 	}
6454 	return false;
6455 }
6456 #endif /* _FFR_ANY_FREE_FS */
6457 
6458 #if _FFR_CONTROL_MSTAT
6459 /*
6460 **  DISK_STATUS -- show amount of free space in queue directories
6461 **
6462 **	Parameters:
6463 **		out -- output file pointer.
6464 **		prefix -- string to output in front of each line.
6465 **
6466 **	Returns:
6467 **		none.
6468 */
6469 
6470 void
6471 disk_status(out, prefix)
6472 	SM_FILE_T *out;
6473 	char *prefix;
6474 {
6475 	int i;
6476 	long avail, blksize;
6477 	long free;
6478 
6479 	for (i = 0; i < NumFileSys; ++i)
6480 	{
6481 		avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6482 		if (avail >= 0 && blksize > 0)
6483 		{
6484 			free = (long)((double) avail *
6485 				((double) blksize / 1024));
6486 		}
6487 		else
6488 			free = -1;
6489 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
6490 				"%s%d/%s/%ld\r\n",
6491 				prefix, i,
6492 				FILE_SYS_NAME(i),
6493 					free);
6494 	}
6495 }
6496 #endif /* _FFR_CONTROL_MSTAT */
6497 
6498 #if SM_CONF_SHM
6499 /*
6500 **  UPD_QS -- update information about queue when adding/deleting an entry
6501 **
6502 **	Parameters:
6503 **		e -- envelope.
6504 **		delete -- delete/add entry.
6505 **		avail -- update the space available as well.
6506 **
6507 **	Returns:
6508 **		none.
6509 **
6510 **	Side Effects:
6511 **		Modifies available space in filesystem.
6512 **		Changes number of entries in queue directory.
6513 */
6514 
6515 void
6516 upd_qs(e, delete, avail)
6517 	ENVELOPE *e;
6518 	bool delete;
6519 	bool avail;
6520 {
6521 	short fidx;
6522 	int idx;
6523 	long s;
6524 
6525 	if (ShmId == SM_SHM_NO_ID || e == NULL)
6526 		return;
6527 	if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
6528 		return;
6529 	idx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_idx;
6530 
6531 	/* XXX in theory this needs to be protected with a mutex */
6532 	if (QSHM_ENTRIES(idx) >= 0)
6533 	{
6534 		if (delete)
6535 			--QSHM_ENTRIES(idx);
6536 		else
6537 			++QSHM_ENTRIES(idx);
6538 	}
6539 
6540 	fidx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_fsysidx;
6541 	if (fidx < 0)
6542 		return;
6543 
6544 	/* update available space also?  (might be loseqfile) */
6545 	if (!avail)
6546 		return;
6547 
6548 	/* convert size to blocks; this causes rounding errors */
6549 	s = e->e_msgsize / FILE_SYS_BLKSIZE(fidx);
6550 	if (s == 0)
6551 		return;
6552 
6553 	/* XXX in theory this needs to be protected with a mutex */
6554 	if (delete)
6555 		FILE_SYS_AVAIL(fidx) += s;
6556 	else
6557 		FILE_SYS_AVAIL(fidx) -= s;
6558 
6559 }
6560 
6561 #if _FFR_SELECT_SHM
6562 
6563 static bool write_key_file __P((char *, long));
6564 static long read_key_file __P((char *, long));
6565 
6566 /*
6567 **  WRITE_KEY_FILE -- record some key into a file.
6568 **
6569 **	Parameters:
6570 **		keypath -- file name.
6571 **		key -- key to write.
6572 **
6573 **	Returns:
6574 **		true iff file could be written.
6575 **
6576 **	Side Effects:
6577 **		writes file.
6578 */
6579 
6580 static bool
6581 write_key_file(keypath, key)
6582 	char *keypath;
6583 	long key;
6584 {
6585 	bool ok;
6586 	long sff;
6587 	SM_FILE_T *keyf;
6588 
6589 	ok = false;
6590 	if (keypath == NULL || *keypath == '\0')
6591 		return ok;
6592 	sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY|SFF_CREAT;
6593 	if (TrustedUid != 0 && RealUid == TrustedUid)
6594 		sff |= SFF_OPENASROOT;
6595 	keyf = safefopen(keypath, O_WRONLY|O_TRUNC, FileMode, sff);
6596 	if (keyf == NULL)
6597 	{
6598 		sm_syslog(LOG_ERR, NOQID, "unable to write %s: %s",
6599 			  keypath, sm_errstring(errno));
6600 	}
6601 	else
6602 	{
6603 		ok = sm_io_fprintf(keyf, SM_TIME_DEFAULT, "%ld\n", key) !=
6604 		     SM_IO_EOF;
6605 		ok = (sm_io_close(keyf, SM_TIME_DEFAULT) != SM_IO_EOF) && ok;
6606 	}
6607 	return ok;
6608 }
6609 
6610 /*
6611 **  READ_KEY_FILE -- read a key from a file.
6612 **
6613 **	Parameters:
6614 **		keypath -- file name.
6615 **		key -- default key.
6616 **
6617 **	Returns:
6618 **		key.
6619 */
6620 
6621 static long
6622 read_key_file(keypath, key)
6623 	char *keypath;
6624 	long key;
6625 {
6626 	int r;
6627 	long sff, n;
6628 	SM_FILE_T *keyf;
6629 
6630 	if (keypath == NULL || *keypath == '\0')
6631 		return key;
6632 	sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY;
6633 	if (RealUid == 0 || (TrustedUid != 0 && RealUid == TrustedUid))
6634 		sff |= SFF_OPENASROOT;
6635 	keyf = safefopen(keypath, O_RDONLY, FileMode, sff);
6636 	if (keyf == NULL)
6637 	{
6638 		sm_syslog(LOG_ERR, NOQID, "unable to read %s: %s",
6639 			  keypath, sm_errstring(errno));
6640 	}
6641 	else
6642 	{
6643 		r = sm_io_fscanf(keyf, SM_TIME_DEFAULT, "%ld", &n);
6644 		if (r == 1)
6645 			key = n;
6646 		(void) sm_io_close(keyf, SM_TIME_DEFAULT);
6647 	}
6648 	return key;
6649 }
6650 #endif /* _FFR_SELECT_SHM */
6651 
6652 /*
6653 **  INIT_SHM -- initialize shared memory structure
6654 **
6655 **	Initialize or attach to shared memory segment.
6656 **	Currently it is not a fatal error if this doesn't work.
6657 **	However, it causes us to have a "fallback" storage location
6658 **	for everything that is supposed to be in the shared memory,
6659 **	which makes the code slightly ugly.
6660 **
6661 **	Parameters:
6662 **		qn -- number of queue directories.
6663 **		owner -- owner of shared memory.
6664 **		hash -- identifies data that is stored in shared memory.
6665 **
6666 **	Returns:
6667 **		none.
6668 */
6669 
6670 static void init_shm __P((int, bool, unsigned int));
6671 
6672 static void
6673 init_shm(qn, owner, hash)
6674 	int qn;
6675 	bool owner;
6676 	unsigned int hash;
6677 {
6678 	int i;
6679 #if _FFR_SELECT_SHM
6680 	bool keyselect;
6681 #endif /* _FFR_SELECT_SHM */
6682 
6683 	PtrFileSys = &FileSys[0];
6684 	PNumFileSys = &Numfilesys;
6685 #if _FFR_SELECT_SHM
6686 /* if this "key" is specified: select one yourself */
6687 # define SEL_SHM_KEY	((key_t) -1)
6688 # define FIRST_SHM_KEY	25
6689 #endif /* _FFR_SELECT_SHM */
6690 
6691 	/* This allows us to disable shared memory at runtime. */
6692 	if (ShmKey != 0)
6693 	{
6694 		int count;
6695 		int save_errno;
6696 
6697 		count = 0;
6698 		shms = SM_T_SIZE + qn * sizeof(QUEUE_SHM_T);
6699 #if _FFR_SELECT_SHM
6700 		keyselect = ShmKey == SEL_SHM_KEY;
6701 		if (keyselect)
6702 		{
6703 			if (owner)
6704 				ShmKey = FIRST_SHM_KEY;
6705 			else
6706 			{
6707 				ShmKey = read_key_file(ShmKeyFile, ShmKey);
6708 				keyselect = false;
6709 				if (ShmKey == SEL_SHM_KEY)
6710 					goto error;
6711 			}
6712 		}
6713 #endif /* _FFR_SELECT_SHM */
6714 		for (;;)
6715 		{
6716 			/* XXX: maybe allow read access for group? */
6717 			Pshm = sm_shmstart(ShmKey, shms, SHM_R|SHM_W, &ShmId,
6718 					   owner);
6719 			save_errno = errno;
6720 			if (Pshm != NULL || !sm_file_exists(save_errno))
6721 				break;
6722 			if (++count >= 3)
6723 			{
6724 #if _FFR_SELECT_SHM
6725 				if (keyselect)
6726 				{
6727 					++ShmKey;
6728 
6729 					/* back where we started? */
6730 					if (ShmKey == SEL_SHM_KEY)
6731 						break;
6732 					continue;
6733 				}
6734 #endif /* _FFR_SELECT_SHM */
6735 				break;
6736 			}
6737 #if _FFR_SELECT_SHM
6738 			/* only sleep if we are at the first key */
6739 			if (!keyselect || ShmKey == SEL_SHM_KEY)
6740 #endif /* _FFR_SELECT_SHM */
6741 			sleep(count);
6742 		}
6743 		if (Pshm != NULL)
6744 		{
6745 			int *p;
6746 
6747 #if _FFR_SELECT_SHM
6748 			if (keyselect)
6749 				(void) write_key_file(ShmKeyFile, (long) ShmKey);
6750 #endif /* _FFR_SELECT_SHM */
6751 			p = (int *) Pshm;
6752 			if (owner)
6753 			{
6754 				*p = (int) shms;
6755 				*((pid_t *) SHM_OFF_PID(Pshm)) = CurrentPid;
6756 				p = (int *) SHM_OFF_TAG(Pshm);
6757 				*p = hash;
6758 			}
6759 			else
6760 			{
6761 				if (*p != (int) shms)
6762 				{
6763 					save_errno = EINVAL;
6764 					cleanup_shm(false);
6765 					goto error;
6766 				}
6767 				p = (int *) SHM_OFF_TAG(Pshm);
6768 				if (*p != (int) hash)
6769 				{
6770 					save_errno = EINVAL;
6771 					cleanup_shm(false);
6772 					goto error;
6773 				}
6774 
6775 				/*
6776 				**  XXX how to check the pid?
6777 				**  Read it from the pid-file? That does
6778 				**  not need to exist.
6779 				**  We could disable shm if we can't confirm
6780 				**  that it is the right one.
6781 				*/
6782 			}
6783 
6784 			PtrFileSys = (FILESYS *) OFF_FILE_SYS(Pshm);
6785 			PNumFileSys = (int *) OFF_NUM_FILE_SYS(Pshm);
6786 			QShm = (QUEUE_SHM_T *) OFF_QUEUE_SHM(Pshm);
6787 			PRSATmpCnt = (int *) OFF_RSA_TMP_CNT(Pshm);
6788 			*PRSATmpCnt = 0;
6789 			if (owner)
6790 			{
6791 				/* initialize values in shared memory */
6792 				NumFileSys = 0;
6793 				for (i = 0; i < qn; i++)
6794 					QShm[i].qs_entries = -1;
6795 			}
6796 			return;
6797 		}
6798   error:
6799 		if (LogLevel > (owner ? 8 : 11))
6800 		{
6801 			sm_syslog(owner ? LOG_ERR : LOG_NOTICE, NOQID,
6802 				  "can't %s shared memory, key=%ld: %s",
6803 				  owner ? "initialize" : "attach to",
6804 				  (long) ShmKey, sm_errstring(save_errno));
6805 		}
6806 	}
6807 }
6808 #endif /* SM_CONF_SHM */
6809 
6810 
6811 /*
6812 **  SETUP_QUEUES -- setup all queue groups
6813 **
6814 **	Parameters:
6815 **		owner -- owner of shared memory.
6816 **
6817 **	Returns:
6818 **		none.
6819 **
6820 #if SM_CONF_SHM
6821 **	Side Effects:
6822 **		attaches shared memory.
6823 #endif * SM_CONF_SHM *
6824 */
6825 
6826 void
6827 setup_queues(owner)
6828 	bool owner;
6829 {
6830 	int i, qn, len;
6831 	unsigned int hashval;
6832 	time_t now;
6833 	char basedir[MAXPATHLEN];
6834 	struct stat st;
6835 
6836 	/*
6837 	**  Determine basedir for all queue directories.
6838 	**  All queue directories must be (first level) subdirectories
6839 	**  of the basedir.  The basedir is the QueueDir
6840 	**  without wildcards, but with trailing /
6841 	*/
6842 
6843 	hashval = 0;
6844 	errno = 0;
6845 	len = sm_strlcpy(basedir, QueueDir, sizeof basedir);
6846 
6847 	/* Provide space for trailing '/' */
6848 	if (len >= sizeof basedir - 1)
6849 	{
6850 		syserr("QueueDirectory: path too long: %d,  max %d",
6851 			len, (int) sizeof basedir - 1);
6852 		ExitStat = EX_CONFIG;
6853 		return;
6854 	}
6855 	SM_ASSERT(len > 0);
6856 	if (basedir[len - 1] == '*')
6857 	{
6858 		char *cp;
6859 
6860 		cp = SM_LAST_DIR_DELIM(basedir);
6861 		if (cp == NULL)
6862 		{
6863 			syserr("QueueDirectory: can not wildcard relative path \"%s\"",
6864 				QueueDir);
6865 			if (tTd(41, 2))
6866 				sm_dprintf("setup_queues: \"%s\": Can not wildcard relative path.\n",
6867 					QueueDir);
6868 			ExitStat = EX_CONFIG;
6869 			return;
6870 		}
6871 
6872 		/* cut off wildcard pattern */
6873 		*++cp = '\0';
6874 		len = cp - basedir;
6875 	}
6876 	else if (!SM_IS_DIR_DELIM(basedir[len - 1]))
6877 	{
6878 		/* append trailing slash since it is a directory */
6879 		basedir[len] = '/';
6880 		basedir[++len] = '\0';
6881 	}
6882 
6883 	/* len counts up to the last directory delimiter */
6884 	SM_ASSERT(basedir[len - 1] == '/');
6885 
6886 	if (chdir(basedir) < 0)
6887 	{
6888 		int save_errno = errno;
6889 
6890 		syserr("can not chdir(%s)", basedir);
6891 		if (save_errno == EACCES)
6892 			(void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT,
6893 				"Program mode requires special privileges, e.g., root or TrustedUser.\n");
6894 		if (tTd(41, 2))
6895 			sm_dprintf("setup_queues: \"%s\": %s\n",
6896 				   basedir, sm_errstring(errno));
6897 		ExitStat = EX_CONFIG;
6898 		return;
6899 	}
6900 #if SM_CONF_SHM
6901 	hashval = hash_q(basedir, hashval);
6902 #endif /* SM_CONF_SHM */
6903 
6904 	/* initialize for queue runs */
6905 	DoQueueRun = false;
6906 	now = curtime();
6907 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
6908 		Queue[i]->qg_nextrun = now;
6909 
6910 
6911 	if (UseMSP && OpMode != MD_TEST)
6912 	{
6913 		long sff = SFF_CREAT;
6914 
6915 		if (stat(".", &st) < 0)
6916 		{
6917 			syserr("can not stat(%s)", basedir);
6918 			if (tTd(41, 2))
6919 				sm_dprintf("setup_queues: \"%s\": %s\n",
6920 					   basedir, sm_errstring(errno));
6921 			ExitStat = EX_CONFIG;
6922 			return;
6923 		}
6924 		if (RunAsUid == 0)
6925 			sff |= SFF_ROOTOK;
6926 
6927 		/*
6928 		**  Check queue directory permissions.
6929 		**	Can we write to a group writable queue directory?
6930 		*/
6931 
6932 		if (bitset(S_IWGRP, QueueFileMode) &&
6933 		    bitset(S_IWGRP, st.st_mode) &&
6934 		    safefile(" ", RunAsUid, RunAsGid, RunAsUserName, sff,
6935 			     QueueFileMode, NULL) != 0)
6936 		{
6937 			syserr("can not write to queue directory %s (RunAsGid=%d, required=%d)",
6938 				basedir, (int) RunAsGid, (int) st.st_gid);
6939 		}
6940 		if (bitset(S_IWOTH|S_IXOTH, st.st_mode))
6941 		{
6942 #if _FFR_MSP_PARANOIA
6943 			syserr("dangerous permissions=%o on queue directory %s",
6944 				(int) st.st_mode, basedir);
6945 #else /* _FFR_MSP_PARANOIA */
6946 			if (LogLevel > 0)
6947 				sm_syslog(LOG_ERR, NOQID,
6948 					  "dangerous permissions=%o on queue directory %s",
6949 					  (int) st.st_mode, basedir);
6950 #endif /* _FFR_MSP_PARANOIA */
6951 		}
6952 #if _FFR_MSP_PARANOIA
6953 		if (NumQueue > 1)
6954 			syserr("can not use multiple queues for MSP");
6955 #endif /* _FFR_MSP_PARANOIA */
6956 	}
6957 
6958 	/* initial number of queue directories */
6959 	qn = 0;
6960 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
6961 		qn = multiqueue_cache(basedir, len, Queue[i], qn, &hashval);
6962 
6963 #if SM_CONF_SHM
6964 	init_shm(qn, owner, hashval);
6965 	i = filesys_setup(owner || ShmId == SM_SHM_NO_ID);
6966 	if (i == FSF_NOT_FOUND)
6967 	{
6968 		/*
6969 		**  We didn't get the right filesystem data
6970 		**  This may happen if we don't have the right shared memory.
6971 		**  So let's do this without shared memory.
6972 		*/
6973 
6974 		SM_ASSERT(!owner);
6975 		cleanup_shm(false);	/* release shared memory */
6976 		i = filesys_setup(false);
6977 		if (i < 0)
6978 			syserr("filesys_setup failed twice, result=%d", i);
6979 		else if (LogLevel > 8)
6980 			sm_syslog(LOG_WARNING, NOQID,
6981 				  "shared memory does not contain expected data, ignored");
6982 	}
6983 #else /* SM_CONF_SHM */
6984 	i = filesys_setup(true);
6985 #endif /* SM_CONF_SHM */
6986 	if (i < 0)
6987 		ExitStat = EX_CONFIG;
6988 }
6989 
6990 #if SM_CONF_SHM
6991 /*
6992 **  CLEANUP_SHM -- do some cleanup work for shared memory etc
6993 **
6994 **	Parameters:
6995 **		owner -- owner of shared memory?
6996 **
6997 **	Returns:
6998 **		none.
6999 **
7000 **	Side Effects:
7001 **		detaches shared memory.
7002 */
7003 
7004 void
7005 cleanup_shm(owner)
7006 	bool owner;
7007 {
7008 	if (ShmId != SM_SHM_NO_ID)
7009 	{
7010 		if (sm_shmstop(Pshm, ShmId, owner) < 0 && LogLevel > 8)
7011 			sm_syslog(LOG_INFO, NOQID, "sm_shmstop failed=%s",
7012 				  sm_errstring(errno));
7013 		Pshm = NULL;
7014 		ShmId = SM_SHM_NO_ID;
7015 	}
7016 }
7017 #endif /* SM_CONF_SHM */
7018 
7019 /*
7020 **  CLEANUP_QUEUES -- do some cleanup work for queues
7021 **
7022 **	Parameters:
7023 **		none.
7024 **
7025 **	Returns:
7026 **		none.
7027 **
7028 */
7029 
7030 void
7031 cleanup_queues()
7032 {
7033 	sync_queue_time();
7034 }
7035 /*
7036 **  SET_DEF_QUEUEVAL -- set default values for a queue group.
7037 **
7038 **	Parameters:
7039 **		qg -- queue group
7040 **		all -- set all values (true for default group)?
7041 **
7042 **	Returns:
7043 **		none.
7044 **
7045 **	Side Effects:
7046 **		sets default values for the queue group.
7047 */
7048 
7049 void
7050 set_def_queueval(qg, all)
7051 	QUEUEGRP *qg;
7052 	bool all;
7053 {
7054 	if (bitnset(QD_DEFINED, qg->qg_flags))
7055 		return;
7056 	if (all)
7057 		qg->qg_qdir = QueueDir;
7058 #if _FFR_QUEUE_GROUP_SORTORDER
7059 	qg->qg_sortorder = QueueSortOrder;
7060 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7061 	qg->qg_maxqrun = all ? MaxRunnersPerQueue : -1;
7062 	qg->qg_nice = NiceQueueRun;
7063 }
7064 /*
7065 **  MAKEQUEUE -- define a new queue.
7066 **
7067 **	Parameters:
7068 **		line -- description of queue.  This is in labeled fields.
7069 **			The fields are:
7070 **			   F -- the flags associated with the queue
7071 **			   I -- the interval between running the queue
7072 **			   J -- the maximum # of jobs in work list
7073 **			   [M -- the maximum # of jobs in a queue run]
7074 **			   N -- the niceness at which to run
7075 **			   P -- the path to the queue
7076 **			   S -- the queue sorting order
7077 **			   R -- number of parallel queue runners
7078 **			   r -- max recipients per envelope
7079 **			The first word is the canonical name of the queue.
7080 **		qdef -- this is a 'Q' definition from .cf
7081 **
7082 **	Returns:
7083 **		none.
7084 **
7085 **	Side Effects:
7086 **		enters the queue into the queue table.
7087 */
7088 
7089 void
7090 makequeue(line, qdef)
7091 	char *line;
7092 	bool qdef;
7093 {
7094 	register char *p;
7095 	register QUEUEGRP *qg;
7096 	register STAB *s;
7097 	int i;
7098 	char fcode;
7099 
7100 	/* allocate a queue and set up defaults */
7101 	qg = (QUEUEGRP *) xalloc(sizeof *qg);
7102 	memset((char *) qg, '\0', sizeof *qg);
7103 
7104 	if (line[0] == '\0')
7105 	{
7106 		syserr("name required for queue");
7107 		return;
7108 	}
7109 
7110 	/* collect the queue name */
7111 	for (p = line;
7112 	     *p != '\0' && *p != ',' && !(isascii(*p) && isspace(*p));
7113 	     p++)
7114 		continue;
7115 	if (*p != '\0')
7116 		*p++ = '\0';
7117 	qg->qg_name = newstr(line);
7118 
7119 	/* set default values, can be overridden below */
7120 	set_def_queueval(qg, false);
7121 
7122 	/* now scan through and assign info from the fields */
7123 	while (*p != '\0')
7124 	{
7125 		auto char *delimptr;
7126 
7127 		while (*p != '\0' &&
7128 		       (*p == ',' || (isascii(*p) && isspace(*p))))
7129 			p++;
7130 
7131 		/* p now points to field code */
7132 		fcode = *p;
7133 		while (*p != '\0' && *p != '=' && *p != ',')
7134 			p++;
7135 		if (*p++ != '=')
7136 		{
7137 			syserr("queue %s: `=' expected", qg->qg_name);
7138 			return;
7139 		}
7140 		while (isascii(*p) && isspace(*p))
7141 			p++;
7142 
7143 		/* p now points to the field body */
7144 		p = munchstring(p, &delimptr, ',');
7145 
7146 		/* install the field into the queue struct */
7147 		switch (fcode)
7148 		{
7149 		  case 'P':		/* pathname */
7150 			if (*p == '\0')
7151 				syserr("queue %s: empty path name",
7152 					qg->qg_name);
7153 			else
7154 				qg->qg_qdir = newstr(p);
7155 			break;
7156 
7157 		  case 'F':		/* flags */
7158 			for (; *p != '\0'; p++)
7159 				if (!(isascii(*p) && isspace(*p)))
7160 					setbitn(*p, qg->qg_flags);
7161 			break;
7162 
7163 			/*
7164 			**  Do we need two intervals here:
7165 			**  One for persistent queue runners,
7166 			**  one for "normal" queue runs?
7167 			*/
7168 
7169 		  case 'I':	/* interval between running the queue */
7170 			qg->qg_queueintvl = convtime(p, 'm');
7171 			break;
7172 
7173 		  case 'N':		/* run niceness */
7174 			qg->qg_nice = atoi(p);
7175 			break;
7176 
7177 		  case 'R':		/* maximum # of runners for the group */
7178 			i = atoi(p);
7179 
7180 			/* can't have more runners than allowed total */
7181 			if (MaxQueueChildren > 0 && i > MaxQueueChildren)
7182 			{
7183 				qg->qg_maxqrun = MaxQueueChildren;
7184 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7185 						     "Q=%s: R=%d exceeds MaxQueueChildren=%d, set to MaxQueueChildren\n",
7186 						     qg->qg_name, i,
7187 						     MaxQueueChildren);
7188 			}
7189 			else
7190 				qg->qg_maxqrun = i;
7191 			break;
7192 
7193 		  case 'J':		/* maximum # of jobs in work list */
7194 			qg->qg_maxlist = atoi(p);
7195 			break;
7196 
7197 		  case 'r':		/* max recipients per envelope */
7198 			qg->qg_maxrcpt = atoi(p);
7199 			break;
7200 
7201 #if _FFR_QUEUE_GROUP_SORTORDER
7202 		  case 'S':		/* queue sorting order */
7203 			switch (*p)
7204 			{
7205 			  case 'h':	/* Host first */
7206 			  case 'H':
7207 				qg->qg_sortorder = QSO_BYHOST;
7208 				break;
7209 
7210 			  case 'p':	/* Priority order */
7211 			  case 'P':
7212 				qg->qg_sortorder = QSO_BYPRIORITY;
7213 				break;
7214 
7215 			  case 't':	/* Submission time */
7216 			  case 'T':
7217 				qg->qg_sortorder = QSO_BYTIME;
7218 				break;
7219 
7220 			  case 'f':	/* File name */
7221 			  case 'F':
7222 				qg->qg_sortorder = QSO_BYFILENAME;
7223 				break;
7224 
7225 			  case 'm':	/* Modification time */
7226 			  case 'M':
7227 				qg->qg_sortorder = QSO_BYMODTIME;
7228 				break;
7229 
7230 			  case 'r':	/* Random */
7231 			  case 'R':
7232 				qg->qg_sortorder = QSO_RANDOM;
7233 				break;
7234 
7235 # if _FFR_RHS
7236 			  case 's':	/* Shuffled host name */
7237 			  case 'S':
7238 				qg->qg_sortorder = QSO_BYSHUFFLE;
7239 				break;
7240 # endif /* _FFR_RHS */
7241 
7242 			  case 'n':	/* none */
7243 			  case 'N':
7244 				qg->qg_sortorder = QSO_NONE;
7245 				break;
7246 
7247 			  default:
7248 				syserr("Invalid queue sort order \"%s\"", p);
7249 			}
7250 			break;
7251 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7252 
7253 		  default:
7254 			syserr("Q%s: unknown queue equate %c=",
7255 			       qg->qg_name, fcode);
7256 			break;
7257 		}
7258 
7259 		p = delimptr;
7260 	}
7261 
7262 #if !HASNICE
7263 	if (qg->qg_nice != NiceQueueRun)
7264 	{
7265 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7266 				     "Q%s: Warning: N= set on system that doesn't support nice()\n",
7267 				     qg->qg_name);
7268 	}
7269 #endif /* !HASNICE */
7270 
7271 	/* do some rationality checking */
7272 	if (NumQueue >= MAXQUEUEGROUPS)
7273 	{
7274 		syserr("too many queue groups defined (%d max)",
7275 			MAXQUEUEGROUPS);
7276 		return;
7277 	}
7278 
7279 	if (qg->qg_qdir == NULL)
7280 	{
7281 		if (QueueDir == NULL || *QueueDir == '\0')
7282 		{
7283 			syserr("QueueDir must be defined before queue groups");
7284 			return;
7285 		}
7286 		qg->qg_qdir = newstr(QueueDir);
7287 	}
7288 
7289 	if (qg->qg_maxqrun > 1 && !bitnset(QD_FORK, qg->qg_flags))
7290 	{
7291 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7292 				     "Warning: Q=%s: R=%d: multiple queue runners specified\n\tbut flag '%c' is not set\n",
7293 				     qg->qg_name, qg->qg_maxqrun, QD_FORK);
7294 	}
7295 
7296 	/* enter the queue into the symbol table */
7297 	if (tTd(37, 8))
7298 		sm_syslog(LOG_INFO, NOQID,
7299 			  "Adding %s to stab, path: %s", qg->qg_name,
7300 			  qg->qg_qdir);
7301 	s = stab(qg->qg_name, ST_QUEUE, ST_ENTER);
7302 	if (s->s_quegrp != NULL)
7303 	{
7304 		i = s->s_quegrp->qg_index;
7305 
7306 		/* XXX what about the pointers inside this struct? */
7307 		sm_free(s->s_quegrp); /* XXX */
7308 	}
7309 	else
7310 		i = NumQueue++;
7311 	Queue[i] = s->s_quegrp = qg;
7312 	qg->qg_index = i;
7313 
7314 	/* set default value for max queue runners */
7315 	if (qg->qg_maxqrun < 0)
7316 	{
7317 		if (MaxRunnersPerQueue > 0)
7318 			qg->qg_maxqrun = MaxRunnersPerQueue;
7319 		else
7320 			qg->qg_maxqrun = 1;
7321 	}
7322 	if (qdef)
7323 		setbitn(QD_DEFINED, qg->qg_flags);
7324 }
7325 #if 0
7326 /*
7327 **  HASHFQN -- calculate a hash value for a fully qualified host name
7328 **
7329 **	Arguments:
7330 **		fqn -- an all lower-case host.domain string
7331 **		buckets -- the number of buckets (queue directories)
7332 **
7333 **	Returns:
7334 **		a bucket number (signed integer)
7335 **		-1 on error
7336 **
7337 **	Contributed by Exactis.com, Inc.
7338 */
7339 
7340 int
7341 hashfqn(fqn, buckets)
7342 	register char *fqn;
7343 	int buckets;
7344 {
7345 	register char *p;
7346 	register int h = 0, hash, cnt;
7347 
7348 	if (fqn == NULL)
7349 		return -1;
7350 
7351 	/*
7352 	**  A variation on the gdb hash
7353 	**  This is the best as of Feb 19, 1996 --bcx
7354 	*/
7355 
7356 	p = fqn;
7357 	h = 0x238F13AF * strlen(p);
7358 	for (cnt = 0; *p != 0; ++p, cnt++)
7359 	{
7360 		h = (h + (*p << (cnt * 5 % 24))) & 0x7FFFFFFF;
7361 	}
7362 	h = (1103515243 * h + 12345) & 0x7FFFFFFF;
7363 	if (buckets < 2)
7364 		hash = 0;
7365 	else
7366 		hash = (h % buckets);
7367 
7368 	return hash;
7369 }
7370 #endif /* 0 */
7371 
7372 /*
7373 **  A structure for sorting Queue according to maxqrun without
7374 **	screwing up Queue itself.
7375 */
7376 
7377 struct sortqgrp
7378 {
7379 	int sg_idx;		/* original index */
7380 	int sg_maxqrun;		/* max queue runners */
7381 };
7382 typedef struct sortqgrp	SORTQGRP_T;
7383 static int cmpidx __P((const void *, const void *));
7384 
7385 static int
7386 cmpidx(a, b)
7387 	const void *a;
7388 	const void *b;
7389 {
7390 	/* The sort is highest to lowest, so the comparison is reversed */
7391 	if (((SORTQGRP_T *)a)->sg_maxqrun < ((SORTQGRP_T *)b)->sg_maxqrun)
7392 		return 1;
7393 	else if (((SORTQGRP_T *)a)->sg_maxqrun > ((SORTQGRP_T *)b)->sg_maxqrun)
7394 		return -1;
7395 	else
7396 		return 0;
7397 }
7398 
7399 /*
7400 **  MAKEWORKGROUP -- balance queue groups into work groups per MaxQueueChildren
7401 **
7402 **  Take the now defined queue groups and assign them to work groups.
7403 **  This is done to balance out the number of concurrently active
7404 **  queue runners such that MaxQueueChildren is not exceeded. This may
7405 **  result in more than one queue group per work group. In such a case
7406 **  the number of running queue groups in that work group will have no
7407 **  more than the work group maximum number of runners (a "fair" portion
7408 **  of MaxQueueRunners). All queue groups within a work group will get a
7409 **  chance at running.
7410 **
7411 **	Parameters:
7412 **		none.
7413 **
7414 **	Returns:
7415 **		nothing.
7416 **
7417 **	Side Effects:
7418 **		Sets up WorkGrp structure.
7419 */
7420 
7421 void
7422 makeworkgroups()
7423 {
7424 	int i, j, total_runners, dir, h;
7425 	SORTQGRP_T si[MAXQUEUEGROUPS + 1];
7426 
7427 	total_runners = 0;
7428 	if (NumQueue == 1 && strcmp(Queue[0]->qg_name, "mqueue") == 0)
7429 	{
7430 		/*
7431 		**  There is only the "mqueue" queue group (a default)
7432 		**  containing all of the queues. We want to provide to
7433 		**  this queue group the maximum allowable queue runners.
7434 		**  To match older behavior (8.10/8.11) we'll try for
7435 		**  1 runner per queue capping it at MaxQueueChildren.
7436 		**  So if there are N queues, then there will be N runners
7437 		**  for the "mqueue" queue group (where N is kept less than
7438 		**  MaxQueueChildren).
7439 		*/
7440 
7441 		NumWorkGroups = 1;
7442 		WorkGrp[0].wg_numqgrp = 1;
7443 		WorkGrp[0].wg_qgs = (QUEUEGRP **) xalloc(sizeof(QUEUEGRP *));
7444 		WorkGrp[0].wg_qgs[0] = Queue[0];
7445 		if (MaxQueueChildren > 0 &&
7446 		    Queue[0]->qg_numqueues > MaxQueueChildren)
7447 			WorkGrp[0].wg_runners = MaxQueueChildren;
7448 		else
7449 			WorkGrp[0].wg_runners = Queue[0]->qg_numqueues;
7450 
7451 		Queue[0]->qg_wgrp = 0;
7452 
7453 		/* can't have more runners than allowed total */
7454 		if (MaxQueueChildren > 0 &&
7455 		    Queue[0]->qg_maxqrun > MaxQueueChildren)
7456 			Queue[0]->qg_maxqrun = MaxQueueChildren;
7457 		WorkGrp[0].wg_maxact = Queue[0]->qg_maxqrun;
7458 		WorkGrp[0].wg_lowqintvl = Queue[0]->qg_queueintvl;
7459 		return;
7460 	}
7461 
7462 	for (i = 0; i < NumQueue; i++)
7463 	{
7464 		si[i].sg_maxqrun = Queue[i]->qg_maxqrun;
7465 		si[i].sg_idx = i;
7466 	}
7467 	qsort(si, NumQueue, sizeof(si[0]), cmpidx);
7468 
7469 	NumWorkGroups = 0;
7470 	for (i = 0; i < NumQueue; i++)
7471 	{
7472 		total_runners += si[i].sg_maxqrun;
7473 		if (MaxQueueChildren <= 0 || total_runners <= MaxQueueChildren)
7474 			NumWorkGroups++;
7475 		else
7476 			break;
7477 	}
7478 
7479 	if (NumWorkGroups < 1)
7480 		NumWorkGroups = 1; /* gotta have one at least */
7481 	else if (NumWorkGroups > MAXWORKGROUPS)
7482 		NumWorkGroups = MAXWORKGROUPS; /* the limit */
7483 
7484 	/*
7485 	**  We now know the number of work groups to pack the queue groups
7486 	**  into. The queue groups in 'Queue' are sorted from highest
7487 	**  to lowest for the number of runners per queue group.
7488 	**  We put the queue groups with the largest number of runners
7489 	**  into work groups first. Then the smaller ones are fitted in
7490 	**  where it looks best.
7491 	*/
7492 
7493 	j = 0;
7494 	dir = 1;
7495 	for (i = 0; i < NumQueue; i++)
7496 	{
7497 		/* a to-and-fro packing scheme, continue from last position */
7498 		if (j >= NumWorkGroups)
7499 		{
7500 			dir = -1;
7501 			j = NumWorkGroups - 1;
7502 		}
7503 		else if (j < 0)
7504 		{
7505 			j = 0;
7506 			dir = 1;
7507 		}
7508 
7509 		if (WorkGrp[j].wg_qgs == NULL)
7510 			WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_malloc(sizeof(QUEUEGRP *) *
7511 							(WorkGrp[j].wg_numqgrp + 1));
7512 		else
7513 			WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_realloc(WorkGrp[j].wg_qgs,
7514 							sizeof(QUEUEGRP *) *
7515 							(WorkGrp[j].wg_numqgrp + 1));
7516 		if (WorkGrp[j].wg_qgs == NULL)
7517 		{
7518 			syserr("!cannot allocate memory for work queues, need %d bytes",
7519 			       (int) (sizeof(QUEUEGRP *) *
7520 				      (WorkGrp[j].wg_numqgrp + 1)));
7521 		}
7522 
7523 		h = si[i].sg_idx;
7524 		WorkGrp[j].wg_qgs[WorkGrp[j].wg_numqgrp] = Queue[h];
7525 		WorkGrp[j].wg_numqgrp++;
7526 		WorkGrp[j].wg_runners += Queue[h]->qg_maxqrun;
7527 		Queue[h]->qg_wgrp = j;
7528 
7529 		if (WorkGrp[j].wg_maxact == 0)
7530 		{
7531 			/* can't have more runners than allowed total */
7532 			if (MaxQueueChildren > 0 &&
7533 			    Queue[h]->qg_maxqrun > MaxQueueChildren)
7534 				Queue[h]->qg_maxqrun = MaxQueueChildren;
7535 			WorkGrp[j].wg_maxact = Queue[h]->qg_maxqrun;
7536 		}
7537 
7538 		/*
7539 		**  XXX: must wg_lowqintvl be the GCD?
7540 		**  qg1: 2m, qg2: 3m, minimum: 2m, when do queue runs for
7541 		**  qg2 occur?
7542 		*/
7543 
7544 		/* keep track of the lowest interval for a persistent runner */
7545 		if (Queue[h]->qg_queueintvl > 0 &&
7546 		    WorkGrp[j].wg_lowqintvl < Queue[h]->qg_queueintvl)
7547 			WorkGrp[j].wg_lowqintvl = Queue[h]->qg_queueintvl;
7548 		j += dir;
7549 	}
7550 	if (tTd(41, 9))
7551 	{
7552 		for (i = 0; i < NumWorkGroups; i++)
7553 		{
7554 			sm_dprintf("Workgroup[%d]=", i);
7555 			for (j = 0; j < WorkGrp[i].wg_numqgrp; j++)
7556 			{
7557 				sm_dprintf("%s, ",
7558 					WorkGrp[i].wg_qgs[j]->qg_name);
7559 			}
7560 			sm_dprintf("\n");
7561 		}
7562 	}
7563 }
7564 
7565 /*
7566 **  DUP_DF -- duplicate envelope data file
7567 **
7568 **	Copy the data file from the 'old' envelope to the 'new' envelope
7569 **	in the most efficient way possible.
7570 **
7571 **	Create a hard link from the 'old' data file to the 'new' data file.
7572 **	If the old and new queue directories are on different file systems,
7573 **	then the new data file link is created in the old queue directory,
7574 **	and the new queue file will contain a 'd' record pointing to the
7575 **	directory containing the new data file.
7576 **
7577 **	Parameters:
7578 **		old -- old envelope.
7579 **		new -- new envelope.
7580 **
7581 **	Results:
7582 **		Returns true on success, false on failure.
7583 **
7584 **	Side Effects:
7585 **		On success, the new data file is created.
7586 **		On fatal failure, EF_FATALERRS is set in old->e_flags.
7587 */
7588 
7589 static bool	dup_df __P((ENVELOPE *, ENVELOPE *));
7590 
7591 static bool
7592 dup_df(old, new)
7593 	ENVELOPE *old;
7594 	ENVELOPE *new;
7595 {
7596 	int ofs, nfs, r;
7597 	char opath[MAXPATHLEN];
7598 	char npath[MAXPATHLEN];
7599 
7600 	if (!bitset(EF_HAS_DF, old->e_flags))
7601 	{
7602 		/*
7603 		**  this can happen if: SuperSafe != True
7604 		**  and a bounce mail is sent that is split.
7605 		*/
7606 
7607 		queueup(old, false, true);
7608 	}
7609 	SM_REQUIRE(ISVALIDQGRP(old->e_qgrp) && ISVALIDQDIR(old->e_qdir));
7610 	SM_REQUIRE(ISVALIDQGRP(new->e_qgrp) && ISVALIDQDIR(new->e_qdir));
7611 
7612 	(void) sm_strlcpy(opath, queuename(old, DATAFL_LETTER), sizeof opath);
7613 	(void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof npath);
7614 
7615 	if (old->e_dfp != NULL)
7616 	{
7617 		r = sm_io_setinfo(old->e_dfp, SM_BF_COMMIT, NULL);
7618 		if (r < 0 && errno != EINVAL)
7619 		{
7620 			syserr("@can't commit %s", opath);
7621 			old->e_flags |= EF_FATALERRS;
7622 			return false;
7623 		}
7624 	}
7625 
7626 	/*
7627 	**  Attempt to create a hard link, if we think both old and new
7628 	**  are on the same file system, otherwise copy the file.
7629 	**
7630 	**  Don't waste time attempting a hard link unless old and new
7631 	**  are on the same file system.
7632 	*/
7633 
7634 	ofs = Queue[old->e_qgrp]->qg_qpaths[old->e_qdir].qp_fsysidx;
7635 	nfs = Queue[new->e_qgrp]->qg_qpaths[new->e_qdir].qp_fsysidx;
7636 	if (FILE_SYS_DEV(ofs) == FILE_SYS_DEV(nfs))
7637 	{
7638 		if (link(opath, npath) == 0)
7639 		{
7640 			new->e_flags |= EF_HAS_DF;
7641 			SYNC_DIR(npath, true);
7642 			return true;
7643 		}
7644 		goto error;
7645 	}
7646 
7647 	/*
7648 	**  Can't link across queue directories, so try to create a hard
7649 	**  link in the same queue directory as the old df file.
7650 	**  The qf file will refer to the new df file using a 'd' record.
7651 	*/
7652 
7653 	new->e_dfqgrp = old->e_dfqgrp;
7654 	new->e_dfqdir = old->e_dfqdir;
7655 	(void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof npath);
7656 	if (link(opath, npath) == 0)
7657 	{
7658 		new->e_flags |= EF_HAS_DF;
7659 		SYNC_DIR(npath, true);
7660 		return true;
7661 	}
7662 
7663   error:
7664 	if (LogLevel > 0)
7665 		sm_syslog(LOG_ERR, old->e_id,
7666 			  "dup_df: can't link %s to %s, error=%s, envelope splitting failed",
7667 			  opath, npath, sm_errstring(errno));
7668 	return false;
7669 }
7670 
7671 /*
7672 **  SPLIT_ENV -- Allocate a new envelope based on a given envelope.
7673 **
7674 **	Parameters:
7675 **		e -- envelope.
7676 **		sendqueue -- sendqueue for new envelope.
7677 **		qgrp -- index of queue group.
7678 **		qdir -- queue directory.
7679 **
7680 **	Results:
7681 **		new envelope.
7682 **
7683 */
7684 
7685 static ENVELOPE	*split_env __P((ENVELOPE *, ADDRESS *, int, int));
7686 
7687 static ENVELOPE *
7688 split_env(e, sendqueue, qgrp, qdir)
7689 	ENVELOPE *e;
7690 	ADDRESS *sendqueue;
7691 	int qgrp;
7692 	int qdir;
7693 {
7694 	ENVELOPE *ee;
7695 
7696 	ee = (ENVELOPE *) sm_rpool_malloc_x(e->e_rpool, sizeof *ee);
7697 	STRUCTCOPY(*e, *ee);
7698 	ee->e_message = NULL;	/* XXX use original message? */
7699 	ee->e_id = NULL;
7700 	assign_queueid(ee);
7701 	ee->e_sendqueue = sendqueue;
7702 	ee->e_flags &= ~(EF_INQUEUE|EF_CLRQUEUE|EF_FATALERRS
7703 			 |EF_SENDRECEIPT|EF_RET_PARAM|EF_HAS_DF);
7704 	ee->e_flags |= EF_NORECEIPT;	/* XXX really? */
7705 	ee->e_from.q_state = QS_SENDER;
7706 	ee->e_dfp = NULL;
7707 	ee->e_lockfp = NULL;
7708 	if (e->e_xfp != NULL)
7709 		ee->e_xfp = sm_io_dup(e->e_xfp);
7710 
7711 	/* failed to dup e->e_xfp, start a new transcript */
7712 	if (ee->e_xfp == NULL)
7713 		openxscript(ee);
7714 
7715 	ee->e_qgrp = ee->e_dfqgrp = qgrp;
7716 	ee->e_qdir = ee->e_dfqdir = qdir;
7717 	ee->e_errormode = EM_MAIL;
7718 	ee->e_statmsg = NULL;
7719 	if (e->e_quarmsg != NULL)
7720 		ee->e_quarmsg = sm_rpool_strdup_x(ee->e_rpool,
7721 						  e->e_quarmsg);
7722 
7723 	/*
7724 	**  XXX Not sure if this copying is necessary.
7725 	**  sendall() does this copying, but I (dm) don't know if that is
7726 	**  because of the storage management discipline we were using
7727 	**  before rpools were introduced, or if it is because these lists
7728 	**  can be modified later.
7729 	*/
7730 
7731 	ee->e_header = copyheader(e->e_header, ee->e_rpool);
7732 	ee->e_errorqueue = copyqueue(e->e_errorqueue, ee->e_rpool);
7733 
7734 	return ee;
7735 }
7736 
7737 /* return values from split functions, check also below! */
7738 #define SM_SPLIT_FAIL	(0)
7739 #define SM_SPLIT_NONE	(1)
7740 #define SM_SPLIT_NEW(n)	(1 + (n))
7741 
7742 /*
7743 **  SPLIT_ACROSS_QUEUE_GROUPS
7744 **
7745 **	This function splits an envelope across multiple queue groups
7746 **	based on the queue group of each recipient.
7747 **
7748 **	Parameters:
7749 **		e -- envelope.
7750 **
7751 **	Results:
7752 **		SM_SPLIT_FAIL on failure
7753 **		SM_SPLIT_NONE if no splitting occurred,
7754 **		or 1 + the number of additional envelopes created.
7755 **
7756 **	Side Effects:
7757 **		On success, e->e_sibling points to a list of zero or more
7758 **		additional envelopes, and the associated data files exist
7759 **		on disk.  But the queue files are not created.
7760 **
7761 **		On failure, e->e_sibling is not changed.
7762 **		The order of recipients in e->e_sendqueue is permuted.
7763 **		Abandoned data files for additional envelopes that failed
7764 **		to be created may exist on disk.
7765 */
7766 
7767 static int	q_qgrp_compare __P((const void *, const void *));
7768 static int	e_filesys_compare __P((const void *, const void *));
7769 
7770 static int
7771 q_qgrp_compare(p1, p2)
7772 	const void *p1;
7773 	const void *p2;
7774 {
7775 	ADDRESS **pq1 = (ADDRESS **) p1;
7776 	ADDRESS **pq2 = (ADDRESS **) p2;
7777 
7778 	return (*pq1)->q_qgrp - (*pq2)->q_qgrp;
7779 }
7780 
7781 static int
7782 e_filesys_compare(p1, p2)
7783 	const void *p1;
7784 	const void *p2;
7785 {
7786 	ENVELOPE **pe1 = (ENVELOPE **) p1;
7787 	ENVELOPE **pe2 = (ENVELOPE **) p2;
7788 	int fs1, fs2;
7789 
7790 	fs1 = Queue[(*pe1)->e_qgrp]->qg_qpaths[(*pe1)->e_qdir].qp_fsysidx;
7791 	fs2 = Queue[(*pe2)->e_qgrp]->qg_qpaths[(*pe2)->e_qdir].qp_fsysidx;
7792 	if (FILE_SYS_DEV(fs1) < FILE_SYS_DEV(fs2))
7793 		return -1;
7794 	if (FILE_SYS_DEV(fs1) > FILE_SYS_DEV(fs2))
7795 		return 1;
7796 	return 0;
7797 }
7798 
7799 static int
7800 split_across_queue_groups(e)
7801 	ENVELOPE *e;
7802 {
7803 	int naddrs, nsplits, i;
7804 	bool changed;
7805 	char **pvp;
7806 	ADDRESS *q, **addrs;
7807 	ENVELOPE *ee, *es;
7808 	ENVELOPE *splits[MAXQUEUEGROUPS];
7809 	char pvpbuf[PSBUFSIZE];
7810 
7811 	SM_REQUIRE(ISVALIDQGRP(e->e_qgrp));
7812 
7813 	/* Count addresses and assign queue groups. */
7814 	naddrs = 0;
7815 	changed = false;
7816 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
7817 	{
7818 		if (QS_IS_DEAD(q->q_state))
7819 			continue;
7820 		++naddrs;
7821 
7822 		/* bad addresses and those already sent stay put */
7823 		if (QS_IS_BADADDR(q->q_state) ||
7824 		    QS_IS_SENT(q->q_state))
7825 			q->q_qgrp = e->e_qgrp;
7826 		else if (!ISVALIDQGRP(q->q_qgrp))
7827 		{
7828 			/* call ruleset which should return a queue group */
7829 			i = rscap(RS_QUEUEGROUP, q->q_user, NULL, e, &pvp,
7830 				  pvpbuf, sizeof(pvpbuf));
7831 			if (i == EX_OK &&
7832 			    pvp != NULL && pvp[0] != NULL &&
7833 			    (pvp[0][0] & 0377) == CANONNET &&
7834 			    pvp[1] != NULL && pvp[1][0] != '\0')
7835 			{
7836 				i = name2qid(pvp[1]);
7837 				if (ISVALIDQGRP(i))
7838 				{
7839 					q->q_qgrp = i;
7840 					changed = true;
7841 					if (tTd(20, 4))
7842 						sm_syslog(LOG_INFO, NOQID,
7843 							"queue group name %s -> %d",
7844 							pvp[1], i);
7845 					continue;
7846 				}
7847 				else if (LogLevel > 10)
7848 					sm_syslog(LOG_INFO, NOQID,
7849 						"can't find queue group name %s, selection ignored",
7850 						pvp[1]);
7851 			}
7852 			if (q->q_mailer != NULL &&
7853 			    ISVALIDQGRP(q->q_mailer->m_qgrp))
7854 			{
7855 				changed = true;
7856 				q->q_qgrp = q->q_mailer->m_qgrp;
7857 			}
7858 			else if (ISVALIDQGRP(e->e_qgrp))
7859 				q->q_qgrp = e->e_qgrp;
7860 			else
7861 				q->q_qgrp = 0;
7862 		}
7863 	}
7864 
7865 	/* only one address? nothing to split. */
7866 	if (naddrs <= 1 && !changed)
7867 		return SM_SPLIT_NONE;
7868 
7869 	/* sort the addresses by queue group */
7870 	addrs = sm_rpool_malloc_x(e->e_rpool, naddrs * sizeof(ADDRESS *));
7871 	for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
7872 	{
7873 		if (QS_IS_DEAD(q->q_state))
7874 			continue;
7875 		addrs[i++] = q;
7876 	}
7877 	qsort(addrs, naddrs, sizeof(ADDRESS *), q_qgrp_compare);
7878 
7879 	/* split into multiple envelopes, by queue group */
7880 	nsplits = 0;
7881 	es = NULL;
7882 	e->e_sendqueue = NULL;
7883 	for (i = 0; i < naddrs; ++i)
7884 	{
7885 		if (i == naddrs - 1 || addrs[i]->q_qgrp != addrs[i + 1]->q_qgrp)
7886 			addrs[i]->q_next = NULL;
7887 		else
7888 			addrs[i]->q_next = addrs[i + 1];
7889 
7890 		/* same queue group as original envelope? */
7891 		if (addrs[i]->q_qgrp == e->e_qgrp)
7892 		{
7893 			if (e->e_sendqueue == NULL)
7894 				e->e_sendqueue = addrs[i];
7895 			continue;
7896 		}
7897 
7898 		/* different queue group than original envelope */
7899 		if (es == NULL || addrs[i]->q_qgrp != es->e_qgrp)
7900 		{
7901 			ee = split_env(e, addrs[i], addrs[i]->q_qgrp, NOQDIR);
7902 			es = ee;
7903 			splits[nsplits++] = ee;
7904 		}
7905 	}
7906 
7907 	/* no splits? return right now. */
7908 	if (nsplits <= 0)
7909 		return SM_SPLIT_NONE;
7910 
7911 	/* assign a queue directory to each additional envelope */
7912 	for (i = 0; i < nsplits; ++i)
7913 	{
7914 		es = splits[i];
7915 #if 0
7916 		es->e_qdir = pickqdir(Queue[es->e_qgrp], es->e_msgsize, es);
7917 #endif /* 0 */
7918 		if (!setnewqueue(es))
7919 			goto failure;
7920 	}
7921 
7922 	/* sort the additional envelopes by queue file system */
7923 	qsort(splits, nsplits, sizeof(ENVELOPE *), e_filesys_compare);
7924 
7925 	/* create data files for each additional envelope */
7926 	if (!dup_df(e, splits[0]))
7927 	{
7928 		i = 0;
7929 		goto failure;
7930 	}
7931 	for (i = 1; i < nsplits; ++i)
7932 	{
7933 		/* copy or link to the previous data file */
7934 		if (!dup_df(splits[i - 1], splits[i]))
7935 			goto failure;
7936 	}
7937 
7938 	/* success: prepend the new envelopes to the e->e_sibling list */
7939 	for (i = 0; i < nsplits; ++i)
7940 	{
7941 		es = splits[i];
7942 		es->e_sibling = e->e_sibling;
7943 		e->e_sibling = es;
7944 	}
7945 	return SM_SPLIT_NEW(nsplits);
7946 
7947 	/* failure: clean up */
7948   failure:
7949 	if (i > 0)
7950 	{
7951 		int j;
7952 
7953 		for (j = 0; j < i; j++)
7954 			(void) unlink(queuename(splits[j], DATAFL_LETTER));
7955 	}
7956 	e->e_sendqueue = addrs[0];
7957 	for (i = 0; i < naddrs - 1; ++i)
7958 		addrs[i]->q_next = addrs[i + 1];
7959 	addrs[naddrs - 1]->q_next = NULL;
7960 	return SM_SPLIT_FAIL;
7961 }
7962 
7963 /*
7964 **  SPLIT_WITHIN_QUEUE
7965 **
7966 **	Split an envelope with multiple recipients into several
7967 **	envelopes within the same queue directory, if the number of
7968 **	recipients exceeds the limit for the queue group.
7969 **
7970 **	Parameters:
7971 **		e -- envelope.
7972 **
7973 **	Results:
7974 **		SM_SPLIT_FAIL on failure
7975 **		SM_SPLIT_NONE if no splitting occurred,
7976 **		or 1 + the number of additional envelopes created.
7977 */
7978 
7979 #define SPLIT_LOG_LEVEL	8
7980 
7981 static int	split_within_queue __P((ENVELOPE *));
7982 
7983 static int
7984 split_within_queue(e)
7985 	ENVELOPE *e;
7986 {
7987 	int maxrcpt, nrcpt, ndead, nsplit, i;
7988 	int j, l;
7989 	char *lsplits;
7990 	ADDRESS *q, **addrs;
7991 	ENVELOPE *ee, *firstsibling;
7992 
7993 	if (!ISVALIDQGRP(e->e_qgrp) || bitset(EF_SPLIT, e->e_flags))
7994 		return SM_SPLIT_NONE;
7995 
7996 	/* don't bother if there is no recipient limit */
7997 	maxrcpt = Queue[e->e_qgrp]->qg_maxrcpt;
7998 	if (maxrcpt <= 0)
7999 		return SM_SPLIT_NONE;
8000 
8001 	/* count recipients */
8002 	nrcpt = 0;
8003 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
8004 	{
8005 		if (QS_IS_DEAD(q->q_state))
8006 			continue;
8007 		++nrcpt;
8008 	}
8009 	if (nrcpt <= maxrcpt)
8010 		return SM_SPLIT_NONE;
8011 
8012 	/*
8013 	**  Preserve the recipient list
8014 	**  so that we can restore it in case of error.
8015 	**  (But we discard dead addresses.)
8016 	*/
8017 
8018 	addrs = sm_rpool_malloc_x(e->e_rpool, nrcpt * sizeof(ADDRESS *));
8019 	for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8020 	{
8021 		if (QS_IS_DEAD(q->q_state))
8022 			continue;
8023 		addrs[i++] = q;
8024 	}
8025 
8026 	/*
8027 	**  Partition the recipient list so that bad and sent addresses
8028 	**  come first. These will go with the original envelope, and
8029 	**  do not count towards the maxrcpt limit.
8030 	**  addrs[] does not contain QS_IS_DEAD() addresses.
8031 	*/
8032 
8033 	ndead = 0;
8034 	for (i = 0; i < nrcpt; ++i)
8035 	{
8036 		if (QS_IS_BADADDR(addrs[i]->q_state) ||
8037 		    QS_IS_SENT(addrs[i]->q_state) ||
8038 		    QS_IS_DEAD(addrs[i]->q_state)) /* for paranoia's sake */
8039 		{
8040 			if (i > ndead)
8041 			{
8042 				ADDRESS *tmp = addrs[i];
8043 
8044 				addrs[i] = addrs[ndead];
8045 				addrs[ndead] = tmp;
8046 			}
8047 			++ndead;
8048 		}
8049 	}
8050 
8051 	/* Check if no splitting required. */
8052 	if (nrcpt - ndead <= maxrcpt)
8053 		return SM_SPLIT_NONE;
8054 
8055 	/* fix links */
8056 	for (i = 0; i < nrcpt - 1; ++i)
8057 		addrs[i]->q_next = addrs[i + 1];
8058 	addrs[nrcpt - 1]->q_next = NULL;
8059 	e->e_sendqueue = addrs[0];
8060 
8061 	/* prepare buffer for logging */
8062 	if (LogLevel > SPLIT_LOG_LEVEL)
8063 	{
8064 		l = MAXLINE;
8065 		lsplits = sm_malloc(l);
8066 		if (lsplits != NULL)
8067 			*lsplits = '\0';
8068 		j = 0;
8069 	}
8070 	else
8071 	{
8072 		/* get rid of stupid compiler warnings */
8073 		lsplits = NULL;
8074 		j = l = 0;
8075 	}
8076 
8077 	/* split the envelope */
8078 	firstsibling = e->e_sibling;
8079 	i = maxrcpt + ndead;
8080 	nsplit = 0;
8081 	for (;;)
8082 	{
8083 		addrs[i - 1]->q_next = NULL;
8084 		ee = split_env(e, addrs[i], e->e_qgrp, e->e_qdir);
8085 		if (!dup_df(e, ee))
8086 		{
8087 
8088 			ee = firstsibling;
8089 			while (ee != NULL)
8090 			{
8091 				(void) unlink(queuename(ee, DATAFL_LETTER));
8092 				ee = ee->e_sibling;
8093 			}
8094 
8095 			/* Error.  Restore e's sibling & recipient lists. */
8096 			e->e_sibling = firstsibling;
8097 			for (i = 0; i < nrcpt - 1; ++i)
8098 				addrs[i]->q_next = addrs[i + 1];
8099 			if (lsplits != NULL)
8100 				sm_free(lsplits);
8101 			return SM_SPLIT_FAIL;
8102 		}
8103 
8104 		/* prepend the new envelope to e->e_sibling */
8105 		ee->e_sibling = e->e_sibling;
8106 		e->e_sibling = ee;
8107 		++nsplit;
8108 		if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8109 		{
8110 			if (j >= l - strlen(ee->e_id) - 3)
8111 			{
8112 				char *p;
8113 
8114 				l += MAXLINE;
8115 				p = sm_realloc(lsplits, l);
8116 				if (p == NULL)
8117 				{
8118 					/* let's try to get this done */
8119 					sm_free(lsplits);
8120 					lsplits = NULL;
8121 				}
8122 				else
8123 					lsplits = p;
8124 			}
8125 			if (lsplits != NULL)
8126 			{
8127 				if (j == 0)
8128 					j += sm_strlcat(lsplits + j,
8129 							ee->e_id,
8130 							l - j);
8131 				else
8132 					j += sm_strlcat2(lsplits + j,
8133 							 "; ",
8134 							 ee->e_id,
8135 							 l - j);
8136 				SM_ASSERT(j < l);
8137 			}
8138 		}
8139 		if (nrcpt - i <= maxrcpt)
8140 			break;
8141 		i += maxrcpt;
8142 	}
8143 	if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8144 	{
8145 		if (nsplit > 0)
8146 		{
8147 			sm_syslog(LOG_NOTICE, e->e_id,
8148 				  "split: maxrcpts=%d, rcpts=%d, count=%d, id%s=%s",
8149 				  maxrcpt, nrcpt - ndead, nsplit,
8150 				  nsplit > 1 ? "s" : "", lsplits);
8151 		}
8152 		sm_free(lsplits);
8153 	}
8154 	return SM_SPLIT_NEW(nsplit);
8155 }
8156 /*
8157 **  SPLIT_BY_RECIPIENT
8158 **
8159 **	Split an envelope with multiple recipients into multiple
8160 **	envelopes as required by the sendmail configuration.
8161 **
8162 **	Parameters:
8163 **		e -- envelope.
8164 **
8165 **	Results:
8166 **		Returns true on success, false on failure.
8167 **
8168 **	Side Effects:
8169 **		see split_across_queue_groups(), split_within_queue(e)
8170 */
8171 
8172 bool
8173 split_by_recipient(e)
8174 	ENVELOPE *e;
8175 {
8176 	int split, n, i, j, l;
8177 	char *lsplits;
8178 	ENVELOPE *ee, *next, *firstsibling;
8179 
8180 	if (OpMode == SM_VERIFY || !ISVALIDQGRP(e->e_qgrp) ||
8181 	    bitset(EF_SPLIT, e->e_flags))
8182 		return true;
8183 	n = split_across_queue_groups(e);
8184 	if (n == SM_SPLIT_FAIL)
8185 		return false;
8186 	firstsibling = ee = e->e_sibling;
8187 	if (n > 1 && LogLevel > SPLIT_LOG_LEVEL)
8188 	{
8189 		l = MAXLINE;
8190 		lsplits = sm_malloc(l);
8191 		if (lsplits != NULL)
8192 			*lsplits = '\0';
8193 		j = 0;
8194 	}
8195 	else
8196 	{
8197 		/* get rid of stupid compiler warnings */
8198 		lsplits = NULL;
8199 		j = l = 0;
8200 	}
8201 	for (i = 1; i < n; ++i)
8202 	{
8203 		next = ee->e_sibling;
8204 		if (split_within_queue(ee) == SM_SPLIT_FAIL)
8205 		{
8206 			e->e_sibling = firstsibling;
8207 			return false;
8208 		}
8209 		ee->e_flags |= EF_SPLIT;
8210 		if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8211 		{
8212 			if (j >= l - strlen(ee->e_id) - 3)
8213 			{
8214 				char *p;
8215 
8216 				l += MAXLINE;
8217 				p = sm_realloc(lsplits, l);
8218 				if (p == NULL)
8219 				{
8220 					/* let's try to get this done */
8221 					sm_free(lsplits);
8222 					lsplits = NULL;
8223 				}
8224 				else
8225 					lsplits = p;
8226 			}
8227 			if (lsplits != NULL)
8228 			{
8229 				if (j == 0)
8230 					j += sm_strlcat(lsplits + j,
8231 							ee->e_id, l - j);
8232 				else
8233 					j += sm_strlcat2(lsplits + j, "; ",
8234 							 ee->e_id, l - j);
8235 				SM_ASSERT(j < l);
8236 			}
8237 		}
8238 		ee = next;
8239 	}
8240 	if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL && n > 1)
8241 	{
8242 		sm_syslog(LOG_NOTICE, e->e_id, "split: count=%d, id%s=%s",
8243 			  n - 1, n > 2 ? "s" : "", lsplits);
8244 		sm_free(lsplits);
8245 	}
8246 	split = split_within_queue(e) != SM_SPLIT_FAIL;
8247 	if (split)
8248 		e->e_flags |= EF_SPLIT;
8249 	return split;
8250 }
8251 
8252 /*
8253 **  QUARANTINE_QUEUE_ITEM -- {un,}quarantine a single envelope
8254 **
8255 **	Add/remove quarantine reason and requeue appropriately.
8256 **
8257 **	Parameters:
8258 **		qgrp -- queue group for the item
8259 **		qdir -- queue directory in the given queue group
8260 **		e -- envelope information for the item
8261 **		reason -- quarantine reason, NULL means unquarantine.
8262 **
8263 **	Results:
8264 **		true if item changed, false otherwise
8265 **
8266 **	Side Effects:
8267 **		Changes quarantine tag in queue file and renames it.
8268 */
8269 
8270 static bool
8271 quarantine_queue_item(qgrp, qdir, e, reason)
8272 	int qgrp;
8273 	int qdir;
8274 	ENVELOPE *e;
8275 	char *reason;
8276 {
8277 	bool dirty = false;
8278 	bool failing = false;
8279 	bool foundq = false;
8280 	bool finished = false;
8281 	int fd;
8282 	int flags;
8283 	int oldtype;
8284 	int newtype;
8285 	int save_errno;
8286 	MODE_T oldumask = 0;
8287 	SM_FILE_T *oldqfp, *tempqfp;
8288 	char *bp;
8289 	char oldqf[MAXPATHLEN];
8290 	char tempqf[MAXPATHLEN];
8291 	char newqf[MAXPATHLEN];
8292 	char buf[MAXLINE];
8293 
8294 	oldtype = queue_letter(e, ANYQFL_LETTER);
8295 	(void) sm_strlcpy(oldqf, queuename(e, ANYQFL_LETTER), sizeof oldqf);
8296 	(void) sm_strlcpy(tempqf, queuename(e, NEWQFL_LETTER), sizeof tempqf);
8297 
8298 	/*
8299 	**  Instead of duplicating all the open
8300 	**  and lock code here, tell readqf() to
8301 	**  do that work and return the open
8302 	**  file pointer in e_lockfp.  Note that
8303 	**  we must release the locks properly when
8304 	**  we are done.
8305 	*/
8306 
8307 	if (!readqf(e, true))
8308 	{
8309 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8310 				     "Skipping %s\n", qid_printname(e));
8311 		return false;
8312 	}
8313 	oldqfp = e->e_lockfp;
8314 
8315 	/* open the new queue file */
8316 	flags = O_CREAT|O_WRONLY|O_EXCL;
8317 	if (bitset(S_IWGRP, QueueFileMode))
8318 		oldumask = umask(002);
8319 	fd = open(tempqf, flags, QueueFileMode);
8320 	if (bitset(S_IWGRP, QueueFileMode))
8321 		(void) umask(oldumask);
8322 	RELEASE_QUEUE;
8323 
8324 	if (fd < 0)
8325 	{
8326 		save_errno = errno;
8327 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8328 				     "Skipping %s: Could not open %s: %s\n",
8329 				     qid_printname(e), tempqf,
8330 				     sm_errstring(save_errno));
8331 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8332 		return false;
8333 	}
8334 	if (!lockfile(fd, tempqf, NULL, LOCK_EX|LOCK_NB))
8335 	{
8336 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8337 				     "Skipping %s: Could not lock %s\n",
8338 				     qid_printname(e), tempqf);
8339 		(void) close(fd);
8340 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8341 		return false;
8342 	}
8343 
8344 	tempqfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT, (void *) &fd,
8345 			     SM_IO_WRONLY_B, NULL);
8346 	if (tempqfp == NULL)
8347 	{
8348 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8349 				     "Skipping %s: Could not lock %s\n",
8350 				     qid_printname(e), tempqf);
8351 		(void) close(fd);
8352 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8353 		return false;
8354 	}
8355 
8356 	/* Copy the data over, changing the quarantine reason */
8357 	while ((bp = fgetfolded(buf, sizeof buf, oldqfp)) != NULL)
8358 	{
8359 		if (tTd(40, 4))
8360 			sm_dprintf("+++++ %s\n", bp);
8361 		switch (bp[0])
8362 		{
8363 		  case 'q':		/* quarantine reason */
8364 			foundq = true;
8365 			if (reason == NULL)
8366 			{
8367 				if (Verbose)
8368 				{
8369 					(void) sm_io_fprintf(smioout,
8370 							     SM_TIME_DEFAULT,
8371 							     "%s: Removed quarantine of \"%s\"\n",
8372 							     e->e_id, &bp[1]);
8373 				}
8374 				sm_syslog(LOG_INFO, e->e_id, "unquarantine");
8375 				dirty = true;
8376 				continue;
8377 			}
8378 			else if (strcmp(reason, &bp[1]) == 0)
8379 			{
8380 				if (Verbose)
8381 				{
8382 					(void) sm_io_fprintf(smioout,
8383 							     SM_TIME_DEFAULT,
8384 							     "%s: Already quarantined with \"%s\"\n",
8385 							     e->e_id, reason);
8386 				}
8387 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8388 						     "q%s\n", reason);
8389 			}
8390 			else
8391 			{
8392 				if (Verbose)
8393 				{
8394 					(void) sm_io_fprintf(smioout,
8395 							     SM_TIME_DEFAULT,
8396 							     "%s: Quarantine changed from \"%s\" to \"%s\"\n",
8397 							     e->e_id, &bp[1],
8398 							     reason);
8399 				}
8400 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8401 						     "q%s\n", reason);
8402 				sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8403 					  reason);
8404 				dirty = true;
8405 			}
8406 			break;
8407 
8408 		  case 'S':
8409 			/*
8410 			**  If we are quarantining an unquarantined item,
8411 			**  need to put in a new 'q' line before it's
8412 			**  too late.
8413 			*/
8414 
8415 			if (!foundq && reason != NULL)
8416 			{
8417 				if (Verbose)
8418 				{
8419 					(void) sm_io_fprintf(smioout,
8420 							     SM_TIME_DEFAULT,
8421 							     "%s: Quarantined with \"%s\"\n",
8422 							     e->e_id, reason);
8423 				}
8424 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8425 						     "q%s\n", reason);
8426 				sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8427 					  reason);
8428 				foundq = true;
8429 				dirty = true;
8430 			}
8431 
8432 			/* Copy the line to the new file */
8433 			(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8434 					     "%s\n", bp);
8435 			break;
8436 
8437 		  case '.':
8438 			finished = true;
8439 			/* FALLTHROUGH */
8440 
8441 		  default:
8442 			/* Copy the line to the new file */
8443 			(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8444 					     "%s\n", bp);
8445 			break;
8446 		}
8447 	}
8448 
8449 	/* Make sure we read the whole old file */
8450 	errno = sm_io_error(tempqfp);
8451 	if (errno != 0 && errno != SM_IO_EOF)
8452 	{
8453 		save_errno = errno;
8454 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8455 				     "Skipping %s: Error reading %s: %s\n",
8456 				     qid_printname(e), oldqf,
8457 				     sm_errstring(save_errno));
8458 		failing = true;
8459 	}
8460 
8461 	if (!failing && !finished)
8462 	{
8463 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8464 				     "Skipping %s: Incomplete file: %s\n",
8465 				     qid_printname(e), oldqf);
8466 		failing = true;
8467 	}
8468 
8469 	/* Check if we actually changed anything or we can just bail now */
8470 	if (!dirty)
8471 	{
8472 		/* pretend we failed, even though we technically didn't */
8473 		failing = true;
8474 	}
8475 
8476 	/* Make sure we wrote things out safely */
8477 	if (!failing &&
8478 	    (sm_io_flush(tempqfp, SM_TIME_DEFAULT) != 0 ||
8479 	     ((SuperSafe == SAFE_REALLY ||
8480 	       SuperSafe == SAFE_REALLY_POSTMILTER ||
8481 	       SuperSafe == SAFE_INTERACTIVE) &&
8482 	      fsync(sm_io_getinfo(tempqfp, SM_IO_WHAT_FD, NULL)) < 0) ||
8483 	     ((errno = sm_io_error(tempqfp)) != 0)))
8484 	{
8485 		save_errno = errno;
8486 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8487 				     "Skipping %s: Error writing %s: %s\n",
8488 				     qid_printname(e), tempqf,
8489 				     sm_errstring(save_errno));
8490 		failing = true;
8491 	}
8492 
8493 
8494 	/* Figure out the new filename */
8495 	newtype = (reason == NULL ? NORMQF_LETTER : QUARQF_LETTER);
8496 	if (oldtype == newtype)
8497 	{
8498 		/* going to rename tempqf to oldqf */
8499 		(void) sm_strlcpy(newqf, oldqf, sizeof newqf);
8500 	}
8501 	else
8502 	{
8503 		/* going to rename tempqf to new name based on newtype */
8504 		(void) sm_strlcpy(newqf, queuename(e, newtype), sizeof newqf);
8505 	}
8506 
8507 	save_errno = 0;
8508 
8509 	/* rename tempqf to newqf */
8510 	if (!failing &&
8511 	    rename(tempqf, newqf) < 0)
8512 		save_errno = (errno == 0) ? EINVAL : errno;
8513 
8514 	/* Check rename() success */
8515 	if (!failing && save_errno != 0)
8516 	{
8517 		sm_syslog(LOG_DEBUG, e->e_id,
8518 			  "quarantine_queue_item: rename(%s, %s): %s",
8519 			  tempqf, newqf, sm_errstring(save_errno));
8520 
8521 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8522 				     "Error renaming %s to %s: %s\n",
8523 				     tempqf, newqf,
8524 				     sm_errstring(save_errno));
8525 		if (oldtype == newtype)
8526 		{
8527 			/*
8528 			**  Bail here since we don't know the state of
8529 			**  the filesystem and may need to keep tempqf
8530 			**  for the user to rescue us.
8531 			*/
8532 
8533 			RELEASE_QUEUE;
8534 			errno = save_errno;
8535 			syserr("!452 Error renaming control file %s", tempqf);
8536 			/* NOTREACHED */
8537 		}
8538 		else
8539 		{
8540 			/* remove new file (if rename() half completed) */
8541 			if (xunlink(newqf) < 0)
8542 			{
8543 				save_errno = errno;
8544 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8545 						     "Error removing %s: %s\n",
8546 						     newqf,
8547 						     sm_errstring(save_errno));
8548 			}
8549 
8550 			/* tempqf removed below */
8551 			failing = true;
8552 		}
8553 
8554 	}
8555 
8556 	/* If changing file types, need to remove old type */
8557 	if (!failing && oldtype != newtype)
8558 	{
8559 		if (xunlink(oldqf) < 0)
8560 		{
8561 			save_errno = errno;
8562 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8563 					     "Error removing %s: %s\n",
8564 					     oldqf, sm_errstring(save_errno));
8565 		}
8566 	}
8567 
8568 	/* see if anything above failed */
8569 	if (failing)
8570 	{
8571 		/* Something failed: remove new file, old file still there */
8572 		(void) xunlink(tempqf);
8573 	}
8574 
8575 	/*
8576 	**  fsync() after file operations to make sure metadata is
8577 	**  written to disk on filesystems in which renames are
8578 	**  not guaranteed.  It's ok if they fail, mail won't be lost.
8579 	*/
8580 
8581 	if (SuperSafe != SAFE_NO)
8582 	{
8583 		/* for soft-updates */
8584 		(void) fsync(sm_io_getinfo(tempqfp,
8585 					   SM_IO_WHAT_FD, NULL));
8586 
8587 		if (!failing)
8588 		{
8589 			/* for soft-updates */
8590 			(void) fsync(sm_io_getinfo(oldqfp,
8591 						   SM_IO_WHAT_FD, NULL));
8592 		}
8593 
8594 		/* for other odd filesystems */
8595 		SYNC_DIR(tempqf, false);
8596 	}
8597 
8598 	/* Close up shop */
8599 	RELEASE_QUEUE;
8600 	if (tempqfp != NULL)
8601 		(void) sm_io_close(tempqfp, SM_TIME_DEFAULT);
8602 	if (oldqfp != NULL)
8603 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8604 
8605 	/* All went well */
8606 	return !failing;
8607 }
8608 
8609 /*
8610 **  QUARANTINE_QUEUE -- {un,}quarantine matching items in the queue
8611 **
8612 **	Read all matching queue items, add/remove quarantine
8613 **	reason, and requeue appropriately.
8614 **
8615 **	Parameters:
8616 **		reason -- quarantine reason, "." means unquarantine.
8617 **		qgrplimit -- limit to single queue group unless NOQGRP
8618 **
8619 **	Results:
8620 **		none.
8621 **
8622 **	Side Effects:
8623 **		Lots of changes to the queue.
8624 */
8625 
8626 void
8627 quarantine_queue(reason, qgrplimit)
8628 	char *reason;
8629 	int qgrplimit;
8630 {
8631 	int changed = 0;
8632 	int qgrp;
8633 
8634 	/* Convert internal representation of unquarantine */
8635 	if (reason != NULL && reason[0] == '.' && reason[1] == '\0')
8636 		reason = NULL;
8637 
8638 	if (reason != NULL)
8639 	{
8640 		/* clean it */
8641 		reason = newstr(denlstring(reason, true, true));
8642 	}
8643 
8644 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
8645 	{
8646 		int qdir;
8647 
8648 		if (qgrplimit != NOQGRP && qgrplimit != qgrp)
8649 			continue;
8650 
8651 		for (qdir = 0; qdir < Queue[qgrp]->qg_numqueues; qdir++)
8652 		{
8653 			int i;
8654 			int nrequests;
8655 
8656 			if (StopRequest)
8657 				stop_sendmail();
8658 
8659 			nrequests = gatherq(qgrp, qdir, true, NULL, NULL);
8660 
8661 			/* first see if there is anything */
8662 			if (nrequests <= 0)
8663 			{
8664 				if (Verbose)
8665 				{
8666 					(void) sm_io_fprintf(smioout,
8667 							     SM_TIME_DEFAULT, "%s: no matches\n",
8668 							     qid_printqueue(qgrp, qdir));
8669 				}
8670 				continue;
8671 			}
8672 
8673 			if (Verbose)
8674 			{
8675 				(void) sm_io_fprintf(smioout,
8676 						     SM_TIME_DEFAULT, "Processing %s:\n",
8677 						     qid_printqueue(qgrp, qdir));
8678 			}
8679 
8680 			for (i = 0; i < WorkListCount; i++)
8681 			{
8682 				ENVELOPE e;
8683 
8684 				if (StopRequest)
8685 					stop_sendmail();
8686 
8687 				/* setup envelope */
8688 				clearenvelope(&e, true, sm_rpool_new_x(NULL));
8689 				e.e_id = WorkList[i].w_name + 2;
8690 				e.e_qgrp = qgrp;
8691 				e.e_qdir = qdir;
8692 
8693 				if (tTd(70, 101))
8694 				{
8695 					sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8696 						      "Would do %s\n", e.e_id);
8697 					changed++;
8698 				}
8699 				else if (quarantine_queue_item(qgrp, qdir,
8700 							       &e, reason))
8701 					changed++;
8702 
8703 				/* clean up */
8704 				sm_rpool_free(e.e_rpool);
8705 				e.e_rpool = NULL;
8706 			}
8707 			if (WorkList != NULL)
8708 				sm_free(WorkList); /* XXX */
8709 			WorkList = NULL;
8710 			WorkListSize = 0;
8711 			WorkListCount = 0;
8712 		}
8713 	}
8714 	if (Verbose)
8715 	{
8716 		if (changed == 0)
8717 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8718 					     "No changes\n");
8719 		else
8720 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8721 					     "%d change%s\n",
8722 					     changed,
8723 					     changed == 1 ? "" : "s");
8724 	}
8725 }
8726