xref: /freebsd/contrib/sendmail/src/queue.c (revision 77c1fcec914bae1232762ca0b0462abd6957ff26)
1 /*
2  * Copyright (c) 1998-2009, 2011, 2012, 2014 Proofpoint, Inc. and its suppliers.
3  *	All rights reserved.
4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
5  * Copyright (c) 1988, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * By using this file, you agree to the terms and conditions set
9  * forth in the LICENSE file which can be found at the top level of
10  * the sendmail distribution.
11  *
12  */
13 
14 #include <sendmail.h>
15 #include <sm/sem.h>
16 
17 SM_RCSID("@(#)$Id: queue.c,v 8.1000 2013-11-22 20:51:56 ca Exp $")
18 
19 #include <dirent.h>
20 
21 # define RELEASE_QUEUE	(void) 0
22 # define ST_INODE(st)	(st).st_ino
23 
24 #  define sm_file_exists(errno) ((errno) == EEXIST)
25 
26 # if HASFLOCK && defined(O_EXLOCK)
27 #   define SM_OPEN_EXLOCK 1
28 #   define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL|O_EXLOCK)
29 # else /* HASFLOCK && defined(O_EXLOCK) */
30 #  define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL)
31 # endif /* HASFLOCK && defined(O_EXLOCK) */
32 
33 #ifndef SM_OPEN_EXLOCK
34 # define SM_OPEN_EXLOCK 0
35 #endif /* ! SM_OPEN_EXLOCK */
36 
37 /*
38 **  Historical notes:
39 **	QF_VERSION == 4 was sendmail 8.10/8.11 without _FFR_QUEUEDELAY
40 **	QF_VERSION == 5 was sendmail 8.10/8.11 with    _FFR_QUEUEDELAY
41 **	QF_VERSION == 6 was sendmail 8.12      without _FFR_QUEUEDELAY
42 **	QF_VERSION == 7 was sendmail 8.12      with    _FFR_QUEUEDELAY
43 **	QF_VERSION == 8 is  sendmail 8.13
44 */
45 
46 #define QF_VERSION	8	/* version number of this queue format */
47 
48 static char	queue_letter __P((ENVELOPE *, int));
49 static bool	quarantine_queue_item __P((int, int, ENVELOPE *, char *));
50 
51 /* Naming convention: qgrp: index of queue group, qg: QUEUEGROUP */
52 
53 /*
54 **  Work queue.
55 */
56 
57 struct work
58 {
59 	char		*w_name;	/* name of control file */
60 	char		*w_host;	/* name of recipient host */
61 	bool		w_lock;		/* is message locked? */
62 	bool		w_tooyoung;	/* is it too young to run? */
63 	long		w_pri;		/* priority of message, see below */
64 	time_t		w_ctime;	/* creation time */
65 	time_t		w_mtime;	/* modification time */
66 	int		w_qgrp;		/* queue group located in */
67 	int		w_qdir;		/* queue directory located in */
68 	struct work	*w_next;	/* next in queue */
69 };
70 
71 typedef struct work	WORK;
72 
73 static WORK	*WorkQ;		/* queue of things to be done */
74 static int	NumWorkGroups;	/* number of work groups */
75 static time_t	Current_LA_time = 0;
76 
77 /* Get new load average every 30 seconds. */
78 #define GET_NEW_LA_TIME	30
79 
80 #define SM_GET_LA(now)	\
81 	do							\
82 	{							\
83 		now = curtime();				\
84 		if (Current_LA_time < now - GET_NEW_LA_TIME)	\
85 		{						\
86 			sm_getla();				\
87 			Current_LA_time = now;			\
88 		}						\
89 	} while (0)
90 
91 /*
92 **  DoQueueRun indicates that a queue run is needed.
93 **	Notice: DoQueueRun is modified in a signal handler!
94 */
95 
96 static bool	volatile DoQueueRun; /* non-interrupt time queue run needed */
97 
98 /*
99 **  Work group definition structure.
100 **	Each work group contains one or more queue groups. This is done
101 **	to manage the number of queue group runners active at the same time
102 **	to be within the constraints of MaxQueueChildren (if it is set).
103 **	The number of queue groups that can be run on the next work run
104 **	is kept track of. The queue groups are run in a round robin.
105 */
106 
107 struct workgrp
108 {
109 	int		wg_numqgrp;	/* number of queue groups in work grp */
110 	int		wg_runners;	/* total runners */
111 	int		wg_curqgrp;	/* current queue group */
112 	QUEUEGRP	**wg_qgs;	/* array of queue groups */
113 	int		wg_maxact;	/* max # of active runners */
114 	time_t		wg_lowqintvl;	/* lowest queue interval */
115 	int		wg_restart;	/* needs restarting? */
116 	int		wg_restartcnt;	/* count of times restarted */
117 };
118 
119 typedef struct workgrp WORKGRP;
120 
121 static WORKGRP	volatile WorkGrp[MAXWORKGROUPS + 1];	/* work groups */
122 
123 #if SM_HEAP_CHECK
124 static SM_DEBUG_T DebugLeakQ = SM_DEBUG_INITIALIZER("leak_q",
125 	"@(#)$Debug: leak_q - trace memory leaks during queue processing $");
126 #endif /* SM_HEAP_CHECK */
127 
128 static void	grow_wlist __P((int, int));
129 static int	multiqueue_cache __P((char *, int, QUEUEGRP *, int, unsigned int *));
130 static int	gatherq __P((int, int, bool, bool *, bool *, int *));
131 static int	sortq __P((int));
132 static void	printctladdr __P((ADDRESS *, SM_FILE_T *));
133 static bool	readqf __P((ENVELOPE *, bool));
134 static void	restart_work_group __P((int));
135 static void	runner_work __P((ENVELOPE *, int, bool, int, int));
136 static void	schedule_queue_runs __P((bool, int, bool));
137 static char	*strrev __P((char *));
138 static ADDRESS	*setctluser __P((char *, int, ENVELOPE *));
139 #if _FFR_RHS
140 static int	sm_strshufflecmp __P((char *, char *));
141 static void	init_shuffle_alphabet __P(());
142 #endif /* _FFR_RHS */
143 
144 /*
145 **  Note: workcmpf?() don't use a prototype because it will cause a conflict
146 **  with the qsort() call (which expects something like
147 **  int (*compar)(const void *, const void *), not (WORK *, WORK *))
148 */
149 
150 static int	workcmpf0();
151 static int	workcmpf1();
152 static int	workcmpf2();
153 static int	workcmpf3();
154 static int	workcmpf4();
155 static int	randi = 3;	/* index for workcmpf5() */
156 static int	workcmpf5();
157 static int	workcmpf6();
158 #if _FFR_RHS
159 static int	workcmpf7();
160 #endif /* _FFR_RHS */
161 
162 #if RANDOMSHIFT
163 # define get_rand_mod(m)	((get_random() >> RANDOMSHIFT) % (m))
164 #else /* RANDOMSHIFT */
165 # define get_rand_mod(m)	(get_random() % (m))
166 #endif /* RANDOMSHIFT */
167 
168 /*
169 **  File system definition.
170 **	Used to keep track of how much free space is available
171 **	on a file system in which one or more queue directories reside.
172 */
173 
174 typedef struct filesys_shared	FILESYS;
175 
176 struct filesys_shared
177 {
178 	dev_t	fs_dev;		/* unique device id */
179 	long	fs_avail;	/* number of free blocks available */
180 	long	fs_blksize;	/* block size, in bytes */
181 };
182 
183 /* probably kept in shared memory */
184 static FILESYS	FileSys[MAXFILESYS];	/* queue file systems */
185 static const char *FSPath[MAXFILESYS];	/* pathnames for file systems */
186 
187 #if SM_CONF_SHM
188 
189 /*
190 **  Shared memory data
191 **
192 **  Current layout:
193 **	size -- size of shared memory segment
194 **	pid -- pid of owner, should be a unique id to avoid misinterpretations
195 **		by other processes.
196 **	tag -- should be a unique id to avoid misinterpretations by others.
197 **		idea: hash over configuration data that will be stored here.
198 **	NumFileSys -- number of file systems.
199 **	FileSys -- (array of) structure for used file systems.
200 **	RSATmpCnt -- counter for number of uses of ephemeral RSA key.
201 **	QShm -- (array of) structure for information about queue directories.
202 */
203 
204 /*
205 **  Queue data in shared memory
206 */
207 
208 typedef struct queue_shared	QUEUE_SHM_T;
209 
210 struct queue_shared
211 {
212 	int	qs_entries;	/* number of entries */
213 	/* XXX more to follow? */
214 };
215 
216 static void	*Pshm;		/* pointer to shared memory */
217 static FILESYS	*PtrFileSys;	/* pointer to queue file system array */
218 int		ShmId = SM_SHM_NO_ID;	/* shared memory id */
219 static QUEUE_SHM_T	*QShm;		/* pointer to shared queue data */
220 static size_t shms;
221 
222 # define SHM_OFF_PID(p)	(((char *) (p)) + sizeof(int))
223 # define SHM_OFF_TAG(p)	(((char *) (p)) + sizeof(pid_t) + sizeof(int))
224 # define SHM_OFF_HEAD	(sizeof(pid_t) + sizeof(int) * 2)
225 
226 /* how to access FileSys */
227 # define FILE_SYS(i)	(PtrFileSys[i])
228 
229 /* first entry is a tag, for now just the size */
230 # define OFF_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD)
231 
232 /* offset for PNumFileSys */
233 # define OFF_NUM_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys))
234 
235 /* offset for PRSATmpCnt */
236 # define OFF_RSA_TMP_CNT(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int))
237 int	*PRSATmpCnt;
238 
239 /* offset for queue_shm */
240 # define OFF_QUEUE_SHM(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
241 
242 # define QSHM_ENTRIES(i)	QShm[i].qs_entries
243 
244 /* basic size of shared memory segment */
245 # define SM_T_SIZE	(SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
246 
247 static unsigned int	hash_q __P((char *, unsigned int));
248 
249 /*
250 **  HASH_Q -- simple hash function
251 **
252 **	Parameters:
253 **		p -- string to hash.
254 **		h -- hash start value (from previous run).
255 **
256 **	Returns:
257 **		hash value.
258 */
259 
260 static unsigned int
261 hash_q(p, h)
262 	char *p;
263 	unsigned int h;
264 {
265 	int c, d;
266 
267 	while (*p != '\0')
268 	{
269 		d = *p++;
270 		c = d;
271 		c ^= c<<6;
272 		h += (c<<11) ^ (c>>1);
273 		h ^= (d<<14) + (d<<7) + (d<<4) + d;
274 	}
275 	return h;
276 }
277 
278 
279 #else /* SM_CONF_SHM */
280 # define FILE_SYS(i)	FileSys[i]
281 #endif /* SM_CONF_SHM */
282 
283 /* access to the various components of file system data */
284 #define FILE_SYS_NAME(i)	FSPath[i]
285 #define FILE_SYS_AVAIL(i)	FILE_SYS(i).fs_avail
286 #define FILE_SYS_BLKSIZE(i)	FILE_SYS(i).fs_blksize
287 #define FILE_SYS_DEV(i)	FILE_SYS(i).fs_dev
288 
289 
290 /*
291 **  Current qf file field assignments:
292 **
293 **	A	AUTH= parameter
294 **	B	body type
295 **	C	controlling user
296 **	D	data file name
297 **	d	data file directory name (added in 8.12)
298 **	E	error recipient
299 **	F	flag bits
300 **	G	free
301 **	H	header
302 **	I	data file's inode number
303 **	K	time of last delivery attempt
304 **	L	Solaris Content-Length: header (obsolete)
305 **	M	message
306 **	N	number of delivery attempts
307 **	P	message priority
308 **	q	quarantine reason
309 **	Q	original recipient (ORCPT=)
310 **	r	final recipient (Final-Recipient: DSN field)
311 **	R	recipient
312 **	S	sender
313 **	T	init time
314 **	V	queue file version
315 **	X	free (was: character set if _FFR_SAVE_CHARSET)
316 **	Y	free
317 **	Z	original envelope id from ESMTP
318 **	!	deliver by (added in 8.12)
319 **	$	define macro
320 **	.	terminate file
321 */
322 
323 /*
324 **  QUEUEUP -- queue a message up for future transmission.
325 **
326 **	Parameters:
327 **		e -- the envelope to queue up.
328 **		announce -- if true, tell when you are queueing up.
329 **		msync -- if true, then fsync() if SuperSafe interactive mode.
330 **
331 **	Returns:
332 **		none.
333 **
334 **	Side Effects:
335 **		The current request is saved in a control file.
336 **		The queue file is left locked.
337 */
338 
339 void
340 queueup(e, announce, msync)
341 	register ENVELOPE *e;
342 	bool announce;
343 	bool msync;
344 {
345 	register SM_FILE_T *tfp;
346 	register HDR *h;
347 	register ADDRESS *q;
348 	int tfd = -1;
349 	int i;
350 	bool newid;
351 	register char *p;
352 	MAILER nullmailer;
353 	MCI mcibuf;
354 	char qf[MAXPATHLEN];
355 	char tf[MAXPATHLEN];
356 	char df[MAXPATHLEN];
357 	char buf[MAXLINE];
358 
359 	/*
360 	**  Create control file.
361 	*/
362 
363 #define OPEN_TF	do							\
364 		{							\
365 			MODE_T oldumask = 0;				\
366 									\
367 			if (bitset(S_IWGRP, QueueFileMode))		\
368 				oldumask = umask(002);			\
369 			tfd = open(tf, TF_OPEN_FLAGS, QueueFileMode);	\
370 			if (bitset(S_IWGRP, QueueFileMode))		\
371 				(void) umask(oldumask);			\
372 		} while (0)
373 
374 
375 	newid = (e->e_id == NULL) || !bitset(EF_INQUEUE, e->e_flags);
376 	(void) sm_strlcpy(tf, queuename(e, NEWQFL_LETTER), sizeof(tf));
377 	tfp = e->e_lockfp;
378 	if (tfp == NULL && newid)
379 	{
380 		/*
381 		**  open qf file directly: this will give an error if the file
382 		**  already exists and hence prevent problems if a queue-id
383 		**  is reused (e.g., because the clock is set back).
384 		*/
385 
386 		(void) sm_strlcpy(tf, queuename(e, ANYQFL_LETTER), sizeof(tf));
387 		OPEN_TF;
388 		if (tfd < 0 ||
389 #if !SM_OPEN_EXLOCK
390 		    !lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB) ||
391 #endif /* !SM_OPEN_EXLOCK */
392 		    (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
393 					 (void *) &tfd, SM_IO_WRONLY,
394 					 NULL)) == NULL)
395 		{
396 			int save_errno = errno;
397 
398 			printopenfds(true);
399 			errno = save_errno;
400 			syserr("!queueup: cannot create queue file %s, euid=%ld, fd=%d, fp=%p",
401 				tf, (long) geteuid(), tfd, tfp);
402 			/* NOTREACHED */
403 		}
404 		e->e_lockfp = tfp;
405 		upd_qs(e, 1, 0, "queueup");
406 	}
407 
408 	/* if newid, write the queue file directly (instead of temp file) */
409 	if (!newid)
410 	{
411 		/* get a locked tf file */
412 		for (i = 0; i < 128; i++)
413 		{
414 			if (tfd < 0)
415 			{
416 				OPEN_TF;
417 				if (tfd < 0)
418 				{
419 					if (errno != EEXIST)
420 						break;
421 					if (LogLevel > 0 && (i % 32) == 0)
422 						sm_syslog(LOG_ALERT, e->e_id,
423 							  "queueup: cannot create %s, euid=%ld: %s",
424 							  tf, (long) geteuid(),
425 							  sm_errstring(errno));
426 				}
427 #if SM_OPEN_EXLOCK
428 				else
429 					break;
430 #endif /* SM_OPEN_EXLOCK */
431 			}
432 			if (tfd >= 0)
433 			{
434 #if SM_OPEN_EXLOCK
435 				/* file is locked by open() */
436 				break;
437 #else /* SM_OPEN_EXLOCK */
438 				if (lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB))
439 					break;
440 				else
441 #endif /* SM_OPEN_EXLOCK */
442 				if (LogLevel > 0 && (i % 32) == 0)
443 					sm_syslog(LOG_ALERT, e->e_id,
444 						  "queueup: cannot lock %s: %s",
445 						  tf, sm_errstring(errno));
446 				if ((i % 32) == 31)
447 				{
448 					(void) close(tfd);
449 					tfd = -1;
450 				}
451 			}
452 
453 			if ((i % 32) == 31)
454 			{
455 				/* save the old temp file away */
456 				(void) rename(tf, queuename(e, TEMPQF_LETTER));
457 			}
458 			else
459 				(void) sleep(i % 32);
460 		}
461 		if (tfd < 0 || (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
462 						 (void *) &tfd, SM_IO_WRONLY_B,
463 						 NULL)) == NULL)
464 		{
465 			int save_errno = errno;
466 
467 			printopenfds(true);
468 			errno = save_errno;
469 			syserr("!queueup: cannot create queue temp file %s, uid=%ld",
470 				tf, (long) geteuid());
471 		}
472 	}
473 
474 	if (tTd(40, 1))
475 		sm_dprintf("\n>>>>> queueing %s/%s%s >>>>>\n",
476 			   qid_printqueue(e->e_qgrp, e->e_qdir),
477 			   queuename(e, ANYQFL_LETTER),
478 			   newid ? " (new id)" : "");
479 	if (tTd(40, 3))
480 	{
481 		sm_dprintf("  e_flags=");
482 		printenvflags(e);
483 	}
484 	if (tTd(40, 32))
485 	{
486 		sm_dprintf("  sendq=");
487 		printaddr(sm_debug_file(), e->e_sendqueue, true);
488 	}
489 	if (tTd(40, 9))
490 	{
491 		sm_dprintf("  tfp=");
492 		dumpfd(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL), true, false);
493 		sm_dprintf("  lockfp=");
494 		if (e->e_lockfp == NULL)
495 			sm_dprintf("NULL\n");
496 		else
497 			dumpfd(sm_io_getinfo(e->e_lockfp, SM_IO_WHAT_FD, NULL),
498 			       true, false);
499 	}
500 
501 	/*
502 	**  If there is no data file yet, create one.
503 	*/
504 
505 	(void) sm_strlcpy(df, queuename(e, DATAFL_LETTER), sizeof(df));
506 	if (bitset(EF_HAS_DF, e->e_flags))
507 	{
508 		if (e->e_dfp != NULL &&
509 		    SuperSafe != SAFE_REALLY &&
510 		    SuperSafe != SAFE_REALLY_POSTMILTER &&
511 		    sm_io_setinfo(e->e_dfp, SM_BF_COMMIT, NULL) < 0 &&
512 		    errno != EINVAL)
513 		{
514 			syserr("!queueup: cannot commit data file %s, uid=%ld",
515 			       queuename(e, DATAFL_LETTER), (long) geteuid());
516 		}
517 		if (e->e_dfp != NULL &&
518 		    SuperSafe == SAFE_INTERACTIVE && msync)
519 		{
520 			if (tTd(40,32))
521 				sm_syslog(LOG_INFO, e->e_id,
522 					  "queueup: fsync(e->e_dfp)");
523 
524 			if (fsync(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD,
525 						NULL)) < 0)
526 			{
527 				if (newid)
528 					syserr("!552 Error writing data file %s",
529 					       df);
530 				else
531 					syserr("!452 Error writing data file %s",
532 					       df);
533 			}
534 		}
535 	}
536 	else
537 	{
538 		int dfd;
539 		MODE_T oldumask = 0;
540 		register SM_FILE_T *dfp = NULL;
541 		struct stat stbuf;
542 
543 		if (e->e_dfp != NULL &&
544 		    sm_io_getinfo(e->e_dfp, SM_IO_WHAT_ISTYPE, BF_FILE_TYPE))
545 			syserr("committing over bf file");
546 
547 		if (bitset(S_IWGRP, QueueFileMode))
548 			oldumask = umask(002);
549 		dfd = open(df, O_WRONLY|O_CREAT|O_TRUNC|QF_O_EXTRA,
550 			   QueueFileMode);
551 		if (bitset(S_IWGRP, QueueFileMode))
552 			(void) umask(oldumask);
553 		if (dfd < 0 || (dfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
554 						 (void *) &dfd, SM_IO_WRONLY_B,
555 						 NULL)) == NULL)
556 			syserr("!queueup: cannot create data temp file %s, uid=%ld",
557 				df, (long) geteuid());
558 		if (fstat(dfd, &stbuf) < 0)
559 			e->e_dfino = -1;
560 		else
561 		{
562 			e->e_dfdev = stbuf.st_dev;
563 			e->e_dfino = ST_INODE(stbuf);
564 		}
565 		e->e_flags |= EF_HAS_DF;
566 		memset(&mcibuf, '\0', sizeof(mcibuf));
567 		mcibuf.mci_out = dfp;
568 		mcibuf.mci_mailer = FileMailer;
569 		(*e->e_putbody)(&mcibuf, e, NULL);
570 
571 		if (SuperSafe == SAFE_REALLY ||
572 		    SuperSafe == SAFE_REALLY_POSTMILTER ||
573 		    (SuperSafe == SAFE_INTERACTIVE && msync))
574 		{
575 			if (tTd(40,32))
576 				sm_syslog(LOG_INFO, e->e_id,
577 					  "queueup: fsync(dfp)");
578 
579 			if (fsync(sm_io_getinfo(dfp, SM_IO_WHAT_FD, NULL)) < 0)
580 			{
581 				if (newid)
582 					syserr("!552 Error writing data file %s",
583 					       df);
584 				else
585 					syserr("!452 Error writing data file %s",
586 					       df);
587 			}
588 		}
589 
590 		if (sm_io_close(dfp, SM_TIME_DEFAULT) < 0)
591 			syserr("!queueup: cannot save data temp file %s, uid=%ld",
592 				df, (long) geteuid());
593 		e->e_putbody = putbody;
594 	}
595 
596 	/*
597 	**  Output future work requests.
598 	**	Priority and creation time should be first, since
599 	**	they are required by gatherq.
600 	*/
601 
602 	/* output queue version number (must be first!) */
603 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "V%d\n", QF_VERSION);
604 
605 	/* output creation time */
606 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "T%ld\n", (long) e->e_ctime);
607 
608 	/* output last delivery time */
609 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "K%ld\n", (long) e->e_dtime);
610 
611 	/* output number of delivery attempts */
612 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "N%d\n", e->e_ntries);
613 
614 	/* output message priority */
615 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "P%ld\n", e->e_msgpriority);
616 
617 	/*
618 	**  If data file is in a different directory than the queue file,
619 	**  output a "d" record naming the directory of the data file.
620 	*/
621 
622 	if (e->e_dfqgrp != e->e_qgrp)
623 	{
624 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "d%s\n",
625 			Queue[e->e_dfqgrp]->qg_qpaths[e->e_dfqdir].qp_name);
626 	}
627 
628 	/* output inode number of data file */
629 	if (e->e_dfino != -1)
630 	{
631 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "I%ld/%ld/%llu\n",
632 				     (long) major(e->e_dfdev),
633 				     (long) minor(e->e_dfdev),
634 				     (ULONGLONG_T) e->e_dfino);
635 	}
636 
637 	/* output body type */
638 	if (e->e_bodytype != NULL)
639 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "B%s\n",
640 				     denlstring(e->e_bodytype, true, false));
641 
642 	/* quarantine reason */
643 	if (e->e_quarmsg != NULL)
644 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "q%s\n",
645 				     denlstring(e->e_quarmsg, true, false));
646 
647 	/* message from envelope, if it exists */
648 	if (e->e_message != NULL)
649 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
650 				     denlstring(e->e_message, true, false));
651 
652 	/* send various flag bits through */
653 	p = buf;
654 	if (bitset(EF_WARNING, e->e_flags))
655 		*p++ = 'w';
656 	if (bitset(EF_RESPONSE, e->e_flags))
657 		*p++ = 'r';
658 	if (bitset(EF_HAS8BIT, e->e_flags))
659 		*p++ = '8';
660 	if (bitset(EF_DELETE_BCC, e->e_flags))
661 		*p++ = 'b';
662 	if (bitset(EF_RET_PARAM, e->e_flags))
663 		*p++ = 'd';
664 	if (bitset(EF_NO_BODY_RETN, e->e_flags))
665 		*p++ = 'n';
666 	if (bitset(EF_SPLIT, e->e_flags))
667 		*p++ = 's';
668 	*p++ = '\0';
669 	if (buf[0] != '\0')
670 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "F%s\n", buf);
671 
672 	/* save $={persistentMacros} macro values */
673 	queueup_macros(macid("{persistentMacros}"), tfp, e);
674 
675 	/* output name of sender */
676 	if (bitnset(M_UDBENVELOPE, e->e_from.q_mailer->m_flags))
677 		p = e->e_sender;
678 	else
679 		p = e->e_from.q_paddr;
680 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "S%s\n",
681 			     denlstring(p, true, false));
682 
683 	/* output ESMTP-supplied "original" information */
684 	if (e->e_envid != NULL)
685 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Z%s\n",
686 				     denlstring(e->e_envid, true, false));
687 
688 	/* output AUTH= parameter */
689 	if (e->e_auth_param != NULL)
690 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "A%s\n",
691 				     denlstring(e->e_auth_param, true, false));
692 	if (e->e_dlvr_flag != 0)
693 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "!%c %ld\n",
694 				     (char) e->e_dlvr_flag, e->e_deliver_by);
695 
696 	/* output list of recipient addresses */
697 	printctladdr(NULL, NULL);
698 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
699 	{
700 		if (!QS_IS_UNDELIVERED(q->q_state))
701 			continue;
702 
703 		/* message for this recipient, if it exists */
704 		if (q->q_message != NULL)
705 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
706 					     denlstring(q->q_message, true,
707 							false));
708 
709 		printctladdr(q, tfp);
710 		if (q->q_orcpt != NULL)
711 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Q%s\n",
712 					     denlstring(q->q_orcpt, true,
713 							false));
714 		if (q->q_finalrcpt != NULL)
715 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "r%s\n",
716 					     denlstring(q->q_finalrcpt, true,
717 							false));
718 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'R');
719 		if (bitset(QPRIMARY, q->q_flags))
720 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'P');
721 		if (bitset(QHASNOTIFY, q->q_flags))
722 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'N');
723 		if (bitset(QPINGONSUCCESS, q->q_flags))
724 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'S');
725 		if (bitset(QPINGONFAILURE, q->q_flags))
726 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'F');
727 		if (bitset(QPINGONDELAY, q->q_flags))
728 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'D');
729 		if (bitset(QINTBCC, q->q_flags))
730 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'B');
731 		if (q->q_alias != NULL &&
732 		    bitset(QALIAS, q->q_alias->q_flags))
733 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'A');
734 
735 		/* _FFR_RCPTFLAGS */
736 		if (bitset(QDYNMAILER, q->q_flags))
737 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, QDYNMAILFLG);
738 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, ':');
739 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s\n",
740 				     denlstring(q->q_paddr, true, false));
741 		if (announce)
742 		{
743 			char *tag = "queued";
744 
745 			if (e->e_quarmsg != NULL)
746 				tag = "quarantined";
747 
748 			e->e_to = q->q_paddr;
749 			message("%s", tag);
750 			if (LogLevel > 8)
751 				logdelivery(q->q_mailer, NULL, q->q_status,
752 					    tag, NULL, (time_t) 0, e, q, EX_OK);
753 			e->e_to = NULL;
754 		}
755 		if (tTd(40, 1))
756 		{
757 			sm_dprintf("queueing ");
758 			printaddr(sm_debug_file(), q, false);
759 		}
760 	}
761 
762 	/*
763 	**  Output headers for this message.
764 	**	Expand macros completely here.  Queue run will deal with
765 	**	everything as absolute headers.
766 	**		All headers that must be relative to the recipient
767 	**		can be cracked later.
768 	**	We set up a "null mailer" -- i.e., a mailer that will have
769 	**	no effect on the addresses as they are output.
770 	*/
771 
772 	memset((char *) &nullmailer, '\0', sizeof(nullmailer));
773 	nullmailer.m_re_rwset = nullmailer.m_rh_rwset =
774 			nullmailer.m_se_rwset = nullmailer.m_sh_rwset = -1;
775 	nullmailer.m_eol = "\n";
776 	memset(&mcibuf, '\0', sizeof(mcibuf));
777 	mcibuf.mci_mailer = &nullmailer;
778 	mcibuf.mci_out = tfp;
779 
780 	macdefine(&e->e_macro, A_PERM, 'g', "\201f");
781 	for (h = e->e_header; h != NULL; h = h->h_link)
782 	{
783 		if (h->h_value == NULL)
784 			continue;
785 
786 		/* don't output resent headers on non-resent messages */
787 		if (bitset(H_RESENT, h->h_flags) &&
788 		    !bitset(EF_RESENT, e->e_flags))
789 			continue;
790 
791 		/* expand macros; if null, don't output header at all */
792 		if (bitset(H_DEFAULT, h->h_flags))
793 		{
794 			(void) expand(h->h_value, buf, sizeof(buf), e);
795 			if (buf[0] == '\0')
796 				continue;
797 			if (buf[0] == ' ' && buf[1] == '\0')
798 				continue;
799 		}
800 
801 		/* output this header */
802 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "H?");
803 
804 		/* output conditional macro if present */
805 		if (h->h_macro != '\0')
806 		{
807 			if (bitset(0200, h->h_macro))
808 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
809 						     "${%s}",
810 						      macname(bitidx(h->h_macro)));
811 			else
812 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
813 						     "$%c", h->h_macro);
814 		}
815 		else if (!bitzerop(h->h_mflags) &&
816 			 bitset(H_CHECK|H_ACHECK, h->h_flags))
817 		{
818 			int j;
819 
820 			/* if conditional, output the set of conditions */
821 			for (j = '\0'; j <= '\177'; j++)
822 				if (bitnset(j, h->h_mflags))
823 					(void) sm_io_putc(tfp, SM_TIME_DEFAULT,
824 							  j);
825 		}
826 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, '?');
827 
828 		/* output the header: expand macros, convert addresses */
829 		if (bitset(H_DEFAULT, h->h_flags) &&
830 		    !bitset(H_BINDLATE, h->h_flags))
831 		{
832 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s:%s\n",
833 					     h->h_field,
834 					     denlstring(buf, false, true));
835 		}
836 		else if (bitset(H_FROM|H_RCPT, h->h_flags) &&
837 			 !bitset(H_BINDLATE, h->h_flags))
838 		{
839 			bool oldstyle = bitset(EF_OLDSTYLE, e->e_flags);
840 			SM_FILE_T *savetrace = TrafficLogFile;
841 
842 			TrafficLogFile = NULL;
843 
844 			if (bitset(H_FROM, h->h_flags))
845 				oldstyle = false;
846 			commaize(h, h->h_value, oldstyle, &mcibuf, e,
847 				 PXLF_HEADER);
848 
849 			TrafficLogFile = savetrace;
850 		}
851 		else
852 		{
853 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s:%s\n",
854 					     h->h_field,
855 					     denlstring(h->h_value, false,
856 							true));
857 		}
858 	}
859 
860 	/*
861 	**  Clean up.
862 	**
863 	**	Write a terminator record -- this is to prevent
864 	**	scurrilous crackers from appending any data.
865 	*/
866 
867 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ".\n");
868 
869 	if (sm_io_flush(tfp, SM_TIME_DEFAULT) != 0 ||
870 	    ((SuperSafe == SAFE_REALLY ||
871 	      SuperSafe == SAFE_REALLY_POSTMILTER ||
872 	      (SuperSafe == SAFE_INTERACTIVE && msync)) &&
873 	     fsync(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL)) < 0) ||
874 	    sm_io_error(tfp))
875 	{
876 		if (newid)
877 			syserr("!552 Error writing control file %s", tf);
878 		else
879 			syserr("!452 Error writing control file %s", tf);
880 	}
881 
882 	if (!newid)
883 	{
884 		char new = queue_letter(e, ANYQFL_LETTER);
885 
886 		/* rename (locked) tf to be (locked) [qh]f */
887 		(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER),
888 				  sizeof(qf));
889 		if (rename(tf, qf) < 0)
890 			syserr("cannot rename(%s, %s), uid=%ld",
891 				tf, qf, (long) geteuid());
892 		else
893 		{
894 			/*
895 			**  Check if type has changed and only
896 			**  remove the old item if the rename above
897 			**  succeeded.
898 			*/
899 
900 			if (e->e_qfletter != '\0' &&
901 			    e->e_qfletter != new)
902 			{
903 				if (tTd(40, 5))
904 				{
905 					sm_dprintf("type changed from %c to %c\n",
906 						   e->e_qfletter, new);
907 				}
908 
909 				if (unlink(queuename(e, e->e_qfletter)) < 0)
910 				{
911 					/* XXX: something more drastic? */
912 					if (LogLevel > 0)
913 						sm_syslog(LOG_ERR, e->e_id,
914 							  "queueup: unlink(%s) failed: %s",
915 							  queuename(e, e->e_qfletter),
916 							  sm_errstring(errno));
917 				}
918 			}
919 		}
920 		e->e_qfletter = new;
921 
922 		/*
923 		**  fsync() after renaming to make sure metadata is
924 		**  written to disk on filesystems in which renames are
925 		**  not guaranteed.
926 		*/
927 
928 		if (SuperSafe != SAFE_NO)
929 		{
930 			/* for softupdates */
931 			if (tfd >= 0 && fsync(tfd) < 0)
932 			{
933 				syserr("!queueup: cannot fsync queue temp file %s",
934 				       tf);
935 			}
936 			SYNC_DIR(qf, true);
937 		}
938 
939 		/* close and unlock old (locked) queue file */
940 		if (e->e_lockfp != NULL)
941 			(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
942 		e->e_lockfp = tfp;
943 
944 		/* save log info */
945 		if (LogLevel > 79)
946 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", qf);
947 	}
948 	else
949 	{
950 		/* save log info */
951 		if (LogLevel > 79)
952 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", tf);
953 
954 		e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
955 	}
956 
957 	errno = 0;
958 	e->e_flags |= EF_INQUEUE;
959 
960 	if (tTd(40, 1))
961 		sm_dprintf("<<<<< done queueing %s <<<<<\n\n", e->e_id);
962 	return;
963 }
964 
965 /*
966 **  PRINTCTLADDR -- print control address to file.
967 **
968 **	Parameters:
969 **		a -- address.
970 **		tfp -- file pointer.
971 **
972 **	Returns:
973 **		none.
974 **
975 **	Side Effects:
976 **		The control address (if changed) is printed to the file.
977 **		The last control address and uid are saved.
978 */
979 
980 static void
981 printctladdr(a, tfp)
982 	register ADDRESS *a;
983 	SM_FILE_T *tfp;
984 {
985 	char *user;
986 	register ADDRESS *q;
987 	uid_t uid;
988 	gid_t gid;
989 	static ADDRESS *lastctladdr = NULL;
990 	static uid_t lastuid;
991 
992 	/* initialization */
993 	if (a == NULL || a->q_alias == NULL || tfp == NULL)
994 	{
995 		if (lastctladdr != NULL && tfp != NULL)
996 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C\n");
997 		lastctladdr = NULL;
998 		lastuid = 0;
999 		return;
1000 	}
1001 
1002 	/* find the active uid */
1003 	q = getctladdr(a);
1004 	if (q == NULL)
1005 	{
1006 		user = NULL;
1007 		uid = 0;
1008 		gid = 0;
1009 	}
1010 	else
1011 	{
1012 		user = q->q_ruser != NULL ? q->q_ruser : q->q_user;
1013 		uid = q->q_uid;
1014 		gid = q->q_gid;
1015 	}
1016 	a = a->q_alias;
1017 
1018 	/* check to see if this is the same as last time */
1019 	if (lastctladdr != NULL && uid == lastuid &&
1020 	    strcmp(lastctladdr->q_paddr, a->q_paddr) == 0)
1021 		return;
1022 	lastuid = uid;
1023 	lastctladdr = a;
1024 
1025 	if (uid == 0 || user == NULL || user[0] == '\0')
1026 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C");
1027 	else
1028 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C%s:%ld:%ld",
1029 				     denlstring(user, true, false), (long) uid,
1030 				     (long) gid);
1031 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ":%s\n",
1032 			     denlstring(a->q_paddr, true, false));
1033 }
1034 
1035 /*
1036 **  RUNNERS_SIGTERM -- propagate a SIGTERM to queue runner process
1037 **
1038 **	This propagates the signal to the child processes that are queue
1039 **	runners. This is for a queue runner "cleanup". After all of the
1040 **	child queue runner processes are signaled (it should be SIGTERM
1041 **	being the sig) then the old signal handler (Oldsh) is called
1042 **	to handle any cleanup set for this process (provided it is not
1043 **	SIG_DFL or SIG_IGN). The signal may not be handled immediately
1044 **	if the BlockOldsh flag is set. If the current process doesn't
1045 **	have a parent then handle the signal immediately, regardless of
1046 **	BlockOldsh.
1047 **
1048 **	Parameters:
1049 **		sig -- the signal number being sent
1050 **
1051 **	Returns:
1052 **		none.
1053 **
1054 **	Side Effects:
1055 **		Sets the NoMoreRunners boolean to true to stop more runners
1056 **		from being started in runqueue().
1057 **
1058 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1059 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1060 **		DOING.
1061 */
1062 
1063 static bool		volatile NoMoreRunners = false;
1064 static sigfunc_t	Oldsh_term = SIG_DFL;
1065 static sigfunc_t	Oldsh_hup = SIG_DFL;
1066 static sigfunc_t	volatile Oldsh = SIG_DFL;
1067 static bool		BlockOldsh = false;
1068 static int		volatile Oldsig = 0;
1069 static SIGFUNC_DECL	runners_sigterm __P((int));
1070 static SIGFUNC_DECL	runners_sighup __P((int));
1071 
1072 static SIGFUNC_DECL
1073 runners_sigterm(sig)
1074 	int sig;
1075 {
1076 	int save_errno = errno;
1077 
1078 	FIX_SYSV_SIGNAL(sig, runners_sigterm);
1079 	errno = save_errno;
1080 	CHECK_CRITICAL(sig);
1081 	NoMoreRunners = true;
1082 	Oldsh = Oldsh_term;
1083 	Oldsig = sig;
1084 	proc_list_signal(PROC_QUEUE, sig);
1085 
1086 	if (!BlockOldsh || getppid() <= 1)
1087 	{
1088 		/* Check that a valid 'old signal handler' is callable */
1089 		if (Oldsh_term != SIG_DFL && Oldsh_term != SIG_IGN &&
1090 		    Oldsh_term != runners_sigterm)
1091 			(*Oldsh_term)(sig);
1092 	}
1093 	errno = save_errno;
1094 	return SIGFUNC_RETURN;
1095 }
1096 /*
1097 **  RUNNERS_SIGHUP -- propagate a SIGHUP to queue runner process
1098 **
1099 **	This propagates the signal to the child processes that are queue
1100 **	runners. This is for a queue runner "cleanup". After all of the
1101 **	child queue runner processes are signaled (it should be SIGHUP
1102 **	being the sig) then the old signal handler (Oldsh) is called to
1103 **	handle any cleanup set for this process (provided it is not SIG_DFL
1104 **	or SIG_IGN). The signal may not be handled immediately if the
1105 **	BlockOldsh flag is set. If the current process doesn't have
1106 **	a parent then handle the signal immediately, regardless of
1107 **	BlockOldsh.
1108 **
1109 **	Parameters:
1110 **		sig -- the signal number being sent
1111 **
1112 **	Returns:
1113 **		none.
1114 **
1115 **	Side Effects:
1116 **		Sets the NoMoreRunners boolean to true to stop more runners
1117 **		from being started in runqueue().
1118 **
1119 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1120 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1121 **		DOING.
1122 */
1123 
1124 static SIGFUNC_DECL
1125 runners_sighup(sig)
1126 	int sig;
1127 {
1128 	int save_errno = errno;
1129 
1130 	FIX_SYSV_SIGNAL(sig, runners_sighup);
1131 	errno = save_errno;
1132 	CHECK_CRITICAL(sig);
1133 	NoMoreRunners = true;
1134 	Oldsh = Oldsh_hup;
1135 	Oldsig = sig;
1136 	proc_list_signal(PROC_QUEUE, sig);
1137 
1138 	if (!BlockOldsh || getppid() <= 1)
1139 	{
1140 		/* Check that a valid 'old signal handler' is callable */
1141 		if (Oldsh_hup != SIG_DFL && Oldsh_hup != SIG_IGN &&
1142 		    Oldsh_hup != runners_sighup)
1143 			(*Oldsh_hup)(sig);
1144 	}
1145 	errno = save_errno;
1146 	return SIGFUNC_RETURN;
1147 }
1148 /*
1149 **  MARK_WORK_GROUP_RESTART -- mark a work group as needing a restart
1150 **
1151 **  Sets a workgroup for restarting.
1152 **
1153 **	Parameters:
1154 **		wgrp -- the work group id to restart.
1155 **		reason -- why (signal?), -1 to turn off restart
1156 **
1157 **	Returns:
1158 **		none.
1159 **
1160 **	Side effects:
1161 **		May set global RestartWorkGroup to true.
1162 **
1163 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1164 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1165 **		DOING.
1166 */
1167 
1168 void
1169 mark_work_group_restart(wgrp, reason)
1170 	int wgrp;
1171 	int reason;
1172 {
1173 	if (wgrp < 0 || wgrp > NumWorkGroups)
1174 		return;
1175 
1176 	WorkGrp[wgrp].wg_restart = reason;
1177 	if (reason >= 0)
1178 		RestartWorkGroup = true;
1179 }
1180 /*
1181 **  RESTART_MARKED_WORK_GROUPS -- restart work groups marked as needing restart
1182 **
1183 **  Restart any workgroup marked as needing a restart provided more
1184 **  runners are allowed.
1185 **
1186 **	Parameters:
1187 **		none.
1188 **
1189 **	Returns:
1190 **		none.
1191 **
1192 **	Side effects:
1193 **		Sets global RestartWorkGroup to false.
1194 */
1195 
1196 void
1197 restart_marked_work_groups()
1198 {
1199 	int i;
1200 	int wasblocked;
1201 
1202 	if (NoMoreRunners)
1203 		return;
1204 
1205 	/* Block SIGCHLD so reapchild() doesn't mess with us */
1206 	wasblocked = sm_blocksignal(SIGCHLD);
1207 
1208 	for (i = 0; i < NumWorkGroups; i++)
1209 	{
1210 		if (WorkGrp[i].wg_restart >= 0)
1211 		{
1212 			if (LogLevel > 8)
1213 				sm_syslog(LOG_ERR, NOQID,
1214 					  "restart queue runner=%d due to signal 0x%x",
1215 					  i, WorkGrp[i].wg_restart);
1216 			restart_work_group(i);
1217 		}
1218 	}
1219 	RestartWorkGroup = false;
1220 
1221 	if (wasblocked == 0)
1222 		(void) sm_releasesignal(SIGCHLD);
1223 }
1224 /*
1225 **  RESTART_WORK_GROUP -- restart a specific work group
1226 **
1227 **  Restart a specific workgroup provided more runners are allowed.
1228 **  If the requested work group has been restarted too many times log
1229 **  this and refuse to restart.
1230 **
1231 **	Parameters:
1232 **		wgrp -- the work group id to restart
1233 **
1234 **	Returns:
1235 **		none.
1236 **
1237 **	Side Effects:
1238 **		starts another process doing the work of wgrp
1239 */
1240 
1241 #define MAX_PERSIST_RESTART	10	/* max allowed number of restarts */
1242 
1243 static void
1244 restart_work_group(wgrp)
1245 	int wgrp;
1246 {
1247 	if (NoMoreRunners ||
1248 	    wgrp < 0 || wgrp > NumWorkGroups)
1249 		return;
1250 
1251 	WorkGrp[wgrp].wg_restart = -1;
1252 	if (WorkGrp[wgrp].wg_restartcnt < MAX_PERSIST_RESTART)
1253 	{
1254 		/* avoid overflow; increment here */
1255 		WorkGrp[wgrp].wg_restartcnt++;
1256 		(void) run_work_group(wgrp, RWG_FORK|RWG_PERSISTENT|RWG_RUNALL);
1257 	}
1258 	else
1259 	{
1260 		sm_syslog(LOG_ERR, NOQID,
1261 			  "ERROR: persistent queue runner=%d restarted too many times, queue runner lost",
1262 			  wgrp);
1263 	}
1264 }
1265 /*
1266 **  SCHEDULE_QUEUE_RUNS -- schedule the next queue run for a work group.
1267 **
1268 **	Parameters:
1269 **		runall -- schedule even if individual bit is not set.
1270 **		wgrp -- the work group id to schedule.
1271 **		didit -- the queue run was performed for this work group.
1272 **
1273 **	Returns:
1274 **		nothing
1275 */
1276 
1277 #define INCR_MOD(v, m)	if (++v >= m)	\
1278 				v = 0;	\
1279 			else
1280 
1281 static void
1282 schedule_queue_runs(runall, wgrp, didit)
1283 	bool runall;
1284 	int wgrp;
1285 	bool didit;
1286 {
1287 	int qgrp, cgrp, endgrp;
1288 #if _FFR_QUEUE_SCHED_DBG
1289 	time_t lastsched;
1290 	bool sched;
1291 #endif /* _FFR_QUEUE_SCHED_DBG */
1292 	time_t now;
1293 	time_t minqintvl;
1294 
1295 	/*
1296 	**  This is a bit ugly since we have to duplicate the
1297 	**  code that "walks" through a work queue group.
1298 	*/
1299 
1300 	now = curtime();
1301 	minqintvl = 0;
1302 	cgrp = endgrp = WorkGrp[wgrp].wg_curqgrp;
1303 	do
1304 	{
1305 		time_t qintvl;
1306 
1307 #if _FFR_QUEUE_SCHED_DBG
1308 		lastsched = 0;
1309 		sched = false;
1310 #endif /* _FFR_QUEUE_SCHED_DBG */
1311 		qgrp = WorkGrp[wgrp].wg_qgs[cgrp]->qg_index;
1312 		if (Queue[qgrp]->qg_queueintvl > 0)
1313 			qintvl = Queue[qgrp]->qg_queueintvl;
1314 		else if (QueueIntvl > 0)
1315 			qintvl = QueueIntvl;
1316 		else
1317 			qintvl = (time_t) 0;
1318 #if _FFR_QUEUE_SCHED_DBG
1319 		lastsched = Queue[qgrp]->qg_nextrun;
1320 #endif /* _FFR_QUEUE_SCHED_DBG */
1321 		if ((runall || Queue[qgrp]->qg_nextrun <= now) && qintvl > 0)
1322 		{
1323 #if _FFR_QUEUE_SCHED_DBG
1324 			sched = true;
1325 #endif /* _FFR_QUEUE_SCHED_DBG */
1326 			if (minqintvl == 0 || qintvl < minqintvl)
1327 				minqintvl = qintvl;
1328 
1329 			/*
1330 			**  Only set a new time if a queue run was performed
1331 			**  for this queue group.  If the queue was not run,
1332 			**  we could starve it by setting a new time on each
1333 			**  call.
1334 			*/
1335 
1336 			if (didit)
1337 				Queue[qgrp]->qg_nextrun += qintvl;
1338 		}
1339 #if _FFR_QUEUE_SCHED_DBG
1340 		if (tTd(69, 10))
1341 			sm_syslog(LOG_INFO, NOQID,
1342 				"sqr: wgrp=%d, cgrp=%d, qgrp=%d, intvl=%ld, QI=%ld, runall=%d, lastrun=%ld, nextrun=%ld, sched=%d",
1343 				wgrp, cgrp, qgrp, Queue[qgrp]->qg_queueintvl,
1344 				QueueIntvl, runall, lastsched,
1345 				Queue[qgrp]->qg_nextrun, sched);
1346 #endif /* _FFR_QUEUE_SCHED_DBG */
1347 		INCR_MOD(cgrp, WorkGrp[wgrp].wg_numqgrp);
1348 	} while (endgrp != cgrp);
1349 	if (minqintvl > 0)
1350 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1351 }
1352 
1353 #if _FFR_QUEUE_RUN_PARANOIA
1354 /*
1355 **  CHECKQUEUERUNNER -- check whether a queue group hasn't been run.
1356 **
1357 **	Use this if events may get lost and hence queue runners may not
1358 **	be started and mail will pile up in a queue.
1359 **
1360 **	Parameters:
1361 **		none.
1362 **
1363 **	Returns:
1364 **		true if a queue run is necessary.
1365 **
1366 **	Side Effects:
1367 **		may schedule a queue run.
1368 */
1369 
1370 bool
1371 checkqueuerunner()
1372 {
1373 	int qgrp;
1374 	time_t now, minqintvl;
1375 
1376 	now = curtime();
1377 	minqintvl = 0;
1378 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
1379 	{
1380 		time_t qintvl;
1381 
1382 		if (Queue[qgrp]->qg_queueintvl > 0)
1383 			qintvl = Queue[qgrp]->qg_queueintvl;
1384 		else if (QueueIntvl > 0)
1385 			qintvl = QueueIntvl;
1386 		else
1387 			qintvl = (time_t) 0;
1388 		if (Queue[qgrp]->qg_nextrun <= now - qintvl)
1389 		{
1390 			if (minqintvl == 0 || qintvl < minqintvl)
1391 				minqintvl = qintvl;
1392 			if (LogLevel > 1)
1393 				sm_syslog(LOG_WARNING, NOQID,
1394 					"checkqueuerunner: queue %d should have been run at %s, queue interval %ld",
1395 					qgrp,
1396 					arpadate(ctime(&Queue[qgrp]->qg_nextrun)),
1397 					qintvl);
1398 		}
1399 	}
1400 	if (minqintvl > 0)
1401 	{
1402 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1403 		return true;
1404 	}
1405 	return false;
1406 }
1407 #endif /* _FFR_QUEUE_RUN_PARANOIA */
1408 
1409 /*
1410 **  RUNQUEUE -- run the jobs in the queue.
1411 **
1412 **	Gets the stuff out of the queue in some presumably logical
1413 **	order and processes them.
1414 **
1415 **	Parameters:
1416 **		forkflag -- true if the queue scanning should be done in
1417 **			a child process.  We double-fork so it is not our
1418 **			child and we don't have to clean up after it.
1419 **			false can be ignored if we have multiple queues.
1420 **		verbose -- if true, print out status information.
1421 **		persistent -- persistent queue runner?
1422 **		runall -- run all groups or only a subset (DoQueueRun)?
1423 **
1424 **	Returns:
1425 **		true if the queue run successfully began.
1426 **
1427 **	Side Effects:
1428 **		runs things in the mail queue using run_work_group().
1429 **		maybe schedules next queue run.
1430 */
1431 
1432 static ENVELOPE	QueueEnvelope;		/* the queue run envelope */
1433 static time_t	LastQueueTime = 0;	/* last time a queue ID assigned */
1434 static pid_t	LastQueuePid = -1;	/* last PID which had a queue ID */
1435 
1436 /* values for qp_supdirs */
1437 #define QP_NOSUB	0x0000	/* No subdirectories */
1438 #define QP_SUBDF	0x0001	/* "df" subdirectory */
1439 #define QP_SUBQF	0x0002	/* "qf" subdirectory */
1440 #define QP_SUBXF	0x0004	/* "xf" subdirectory */
1441 
1442 bool
1443 runqueue(forkflag, verbose, persistent, runall)
1444 	bool forkflag;
1445 	bool verbose;
1446 	bool persistent;
1447 	bool runall;
1448 {
1449 	int i;
1450 	bool ret = true;
1451 	static int curnum = 0;
1452 	sigfunc_t cursh;
1453 #if SM_HEAP_CHECK
1454 	SM_NONVOLATILE int oldgroup = 0;
1455 
1456 	if (sm_debug_active(&DebugLeakQ, 1))
1457 	{
1458 		oldgroup = sm_heap_group();
1459 		sm_heap_newgroup();
1460 		sm_dprintf("runqueue() heap group #%d\n", sm_heap_group());
1461 	}
1462 #endif /* SM_HEAP_CHECK */
1463 
1464 	/* queue run has been started, don't do any more this time */
1465 	DoQueueRun = false;
1466 
1467 	/* more than one queue or more than one directory per queue */
1468 	if (!forkflag && !verbose &&
1469 	    (WorkGrp[0].wg_qgs[0]->qg_numqueues > 1 || NumWorkGroups > 1 ||
1470 	     WorkGrp[0].wg_numqgrp > 1))
1471 		forkflag = true;
1472 
1473 	/*
1474 	**  For controlling queue runners via signals sent to this process.
1475 	**  Oldsh* will get called too by runners_sig* (if it is not SIG_IGN
1476 	**  or SIG_DFL) to preserve cleanup behavior. Now that this process
1477 	**  will have children (and perhaps grandchildren) this handler will
1478 	**  be left in place. This is because this process, once it has
1479 	**  finished spinning off queue runners, may go back to doing something
1480 	**  else (like being a daemon). And we still want on a SIG{TERM,HUP} to
1481 	**  clean up the child queue runners. Only install 'runners_sig*' once
1482 	**  else we'll get stuck looping forever.
1483 	*/
1484 
1485 	cursh = sm_signal(SIGTERM, runners_sigterm);
1486 	if (cursh != runners_sigterm)
1487 		Oldsh_term = cursh;
1488 	cursh = sm_signal(SIGHUP, runners_sighup);
1489 	if (cursh != runners_sighup)
1490 		Oldsh_hup = cursh;
1491 
1492 	for (i = 0; i < NumWorkGroups && !NoMoreRunners; i++)
1493 	{
1494 		int rwgflags = RWG_NONE;
1495 		int wasblocked;
1496 
1497 		/*
1498 		**  If MaxQueueChildren active then test whether the start
1499 		**  of the next queue group's additional queue runners (maximum)
1500 		**  will result in MaxQueueChildren being exceeded.
1501 		**
1502 		**  Note: do not use continue; even though another workgroup
1503 		**	may have fewer queue runners, this would be "unfair",
1504 		**	i.e., this work group might "starve" then.
1505 		*/
1506 
1507 #if _FFR_QUEUE_SCHED_DBG
1508 		if (tTd(69, 10))
1509 			sm_syslog(LOG_INFO, NOQID,
1510 				"rq: curnum=%d, MaxQueueChildren=%d, CurRunners=%d, WorkGrp[curnum].wg_maxact=%d",
1511 				curnum, MaxQueueChildren, CurRunners,
1512 				WorkGrp[curnum].wg_maxact);
1513 #endif /* _FFR_QUEUE_SCHED_DBG */
1514 		if (MaxQueueChildren > 0 &&
1515 		    CurRunners + WorkGrp[curnum].wg_maxact > MaxQueueChildren)
1516 			break;
1517 
1518 		/*
1519 		**  Pick up where we left off (curnum), in case we
1520 		**  used up all the children last time without finishing.
1521 		**  This give a round-robin fairness to queue runs.
1522 		**
1523 		**  Increment CurRunners before calling run_work_group()
1524 		**  to avoid a "race condition" with proc_list_drop() which
1525 		**  decrements CurRunners if the queue runners terminate.
1526 		**  Notice: CurRunners is an upper limit, in some cases
1527 		**  (too few jobs in the queue) this value is larger than
1528 		**  the actual number of queue runners. The discrepancy can
1529 		**  increase if some queue runners "hang" for a long time.
1530 		*/
1531 
1532 		/* don't let proc_list_drop() change CurRunners */
1533 		wasblocked = sm_blocksignal(SIGCHLD);
1534 		CurRunners += WorkGrp[curnum].wg_maxact;
1535 		if (wasblocked == 0)
1536 			(void) sm_releasesignal(SIGCHLD);
1537 		if (forkflag)
1538 			rwgflags |= RWG_FORK;
1539 		if (verbose)
1540 			rwgflags |= RWG_VERBOSE;
1541 		if (persistent)
1542 			rwgflags |= RWG_PERSISTENT;
1543 		if (runall)
1544 			rwgflags |= RWG_RUNALL;
1545 		ret = run_work_group(curnum, rwgflags);
1546 
1547 		/*
1548 		**  Failure means a message was printed for ETRN
1549 		**  and subsequent queues are likely to fail as well.
1550 		**  Decrement CurRunners in that case because
1551 		**  none have been started.
1552 		*/
1553 
1554 		if (!ret)
1555 		{
1556 			/* don't let proc_list_drop() change CurRunners */
1557 			wasblocked = sm_blocksignal(SIGCHLD);
1558 			CurRunners -= WorkGrp[curnum].wg_maxact;
1559 			CHK_CUR_RUNNERS("runqueue", curnum,
1560 					WorkGrp[curnum].wg_maxact);
1561 			if (wasblocked == 0)
1562 				(void) sm_releasesignal(SIGCHLD);
1563 			break;
1564 		}
1565 
1566 		if (!persistent)
1567 			schedule_queue_runs(runall, curnum, true);
1568 		INCR_MOD(curnum, NumWorkGroups);
1569 	}
1570 
1571 	/* schedule left over queue runs */
1572 	if (i < NumWorkGroups && !NoMoreRunners && !persistent)
1573 	{
1574 		int h;
1575 
1576 		for (h = curnum; i < NumWorkGroups; i++)
1577 		{
1578 			schedule_queue_runs(runall, h, false);
1579 			INCR_MOD(h, NumWorkGroups);
1580 		}
1581 	}
1582 
1583 
1584 #if SM_HEAP_CHECK
1585 	if (sm_debug_active(&DebugLeakQ, 1))
1586 		sm_heap_setgroup(oldgroup);
1587 #endif /* SM_HEAP_CHECK */
1588 	return ret;
1589 }
1590 
1591 #if _FFR_SKIP_DOMAINS
1592 /*
1593 **  SKIP_DOMAINS -- Skip 'skip' number of domains in the WorkQ.
1594 **
1595 **  Added by Stephen Frost <sfrost@snowman.net> to support
1596 **  having each runner process every N'th domain instead of
1597 **  every N'th message.
1598 **
1599 **	Parameters:
1600 **		skip -- number of domains in WorkQ to skip.
1601 **
1602 **	Returns:
1603 **		total number of messages skipped.
1604 **
1605 **	Side Effects:
1606 **		may change WorkQ
1607 */
1608 
1609 static int
1610 skip_domains(skip)
1611 	int skip;
1612 {
1613 	int n, seqjump;
1614 
1615 	for (n = 0, seqjump = 0; n < skip && WorkQ != NULL; seqjump++)
1616 	{
1617 		if (WorkQ->w_next != NULL)
1618 		{
1619 			if (WorkQ->w_host != NULL &&
1620 			    WorkQ->w_next->w_host != NULL)
1621 			{
1622 				if (sm_strcasecmp(WorkQ->w_host,
1623 						WorkQ->w_next->w_host) != 0)
1624 					n++;
1625 			}
1626 			else
1627 			{
1628 				if ((WorkQ->w_host != NULL &&
1629 				     WorkQ->w_next->w_host == NULL) ||
1630 				    (WorkQ->w_host == NULL &&
1631 				     WorkQ->w_next->w_host != NULL))
1632 					     n++;
1633 			}
1634 		}
1635 		WorkQ = WorkQ->w_next;
1636 	}
1637 	return seqjump;
1638 }
1639 #endif /* _FFR_SKIP_DOMAINS */
1640 
1641 /*
1642 **  RUNNER_WORK -- have a queue runner do its work
1643 **
1644 **  Have a queue runner do its work a list of entries.
1645 **  When work isn't directly being done then this process can take a signal
1646 **  and terminate immediately (in a clean fashion of course).
1647 **  When work is directly being done, it's not to be interrupted
1648 **  immediately: the work should be allowed to finish at a clean point
1649 **  before termination (in a clean fashion of course).
1650 **
1651 **	Parameters:
1652 **		e -- envelope.
1653 **		sequenceno -- 'th process to run WorkQ.
1654 **		didfork -- did the calling process fork()?
1655 **		skip -- process only each skip'th item.
1656 **		njobs -- number of jobs in WorkQ.
1657 **
1658 **	Returns:
1659 **		none.
1660 **
1661 **	Side Effects:
1662 **		runs things in the mail queue.
1663 */
1664 
1665 static void
1666 runner_work(e, sequenceno, didfork, skip, njobs)
1667 	register ENVELOPE *e;
1668 	int sequenceno;
1669 	bool didfork;
1670 	int skip;
1671 	int njobs;
1672 {
1673 	int n, seqjump;
1674 	WORK *w;
1675 	time_t now;
1676 
1677 	SM_GET_LA(now);
1678 
1679 	/*
1680 	**  Here we temporarily block the second calling of the handlers.
1681 	**  This allows us to handle the signal without terminating in the
1682 	**  middle of direct work. If a signal does come, the test for
1683 	**  NoMoreRunners will find it.
1684 	*/
1685 
1686 	BlockOldsh = true;
1687 	seqjump = skip;
1688 
1689 	/* process them once at a time */
1690 	while (WorkQ != NULL)
1691 	{
1692 #if SM_HEAP_CHECK
1693 		SM_NONVOLATILE int oldgroup = 0;
1694 
1695 		if (sm_debug_active(&DebugLeakQ, 1))
1696 		{
1697 			oldgroup = sm_heap_group();
1698 			sm_heap_newgroup();
1699 			sm_dprintf("run_queue_group() heap group #%d\n",
1700 				sm_heap_group());
1701 		}
1702 #endif /* SM_HEAP_CHECK */
1703 
1704 		/* do no more work */
1705 		if (NoMoreRunners)
1706 		{
1707 			/* Check that a valid signal handler is callable */
1708 			if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1709 			    Oldsh != runners_sighup &&
1710 			    Oldsh != runners_sigterm)
1711 				(*Oldsh)(Oldsig);
1712 			break;
1713 		}
1714 
1715 		w = WorkQ; /* assign current work item */
1716 
1717 		/*
1718 		**  Set the head of the WorkQ to the next work item.
1719 		**  It is set 'skip' ahead (the number of parallel queue
1720 		**  runners working on WorkQ together) since each runner
1721 		**  works on every 'skip'th (N-th) item.
1722 #if _FFR_SKIP_DOMAINS
1723 		**  In the case of the BYHOST Queue Sort Order, the 'item'
1724 		**  is a domain, so we work on every 'skip'th (N-th) domain.
1725 #endif * _FFR_SKIP_DOMAINS *
1726 		*/
1727 
1728 #if _FFR_SKIP_DOMAINS
1729 		if (QueueSortOrder == QSO_BYHOST)
1730 		{
1731 			seqjump = 1;
1732 			if (WorkQ->w_next != NULL)
1733 			{
1734 				if (WorkQ->w_host != NULL &&
1735 				    WorkQ->w_next->w_host != NULL)
1736 				{
1737 					if (sm_strcasecmp(WorkQ->w_host,
1738 							WorkQ->w_next->w_host)
1739 								!= 0)
1740 						seqjump = skip_domains(skip);
1741 					else
1742 						WorkQ = WorkQ->w_next;
1743 				}
1744 				else
1745 				{
1746 					if ((WorkQ->w_host != NULL &&
1747 					     WorkQ->w_next->w_host == NULL) ||
1748 					    (WorkQ->w_host == NULL &&
1749 					     WorkQ->w_next->w_host != NULL))
1750 						seqjump = skip_domains(skip);
1751 					else
1752 						WorkQ = WorkQ->w_next;
1753 				}
1754 			}
1755 			else
1756 				WorkQ = WorkQ->w_next;
1757 		}
1758 		else
1759 #endif /* _FFR_SKIP_DOMAINS */
1760 		{
1761 			for (n = 0; n < skip && WorkQ != NULL; n++)
1762 				WorkQ = WorkQ->w_next;
1763 		}
1764 
1765 		e->e_to = NULL;
1766 
1767 		/*
1768 		**  Ignore jobs that are too expensive for the moment.
1769 		**
1770 		**	Get new load average every GET_NEW_LA_TIME seconds.
1771 		*/
1772 
1773 		SM_GET_LA(now);
1774 		if (shouldqueue(WkRecipFact, Current_LA_time))
1775 		{
1776 			char *msg = "Aborting queue run: load average too high";
1777 
1778 			if (Verbose)
1779 				message("%s", msg);
1780 			if (LogLevel > 8)
1781 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1782 			break;
1783 		}
1784 		if (shouldqueue(w->w_pri, w->w_ctime))
1785 		{
1786 			if (Verbose)
1787 				message("%s", "");
1788 			if (QueueSortOrder == QSO_BYPRIORITY)
1789 			{
1790 				if (Verbose)
1791 					message("Skipping %s/%s (sequence %d of %d) and flushing rest of queue",
1792 						qid_printqueue(w->w_qgrp,
1793 							       w->w_qdir),
1794 						w->w_name + 2, sequenceno,
1795 						njobs);
1796 				if (LogLevel > 8)
1797 					sm_syslog(LOG_INFO, NOQID,
1798 						  "runqueue: Flushing queue from %s/%s (pri %ld, LA %d, %d of %d)",
1799 						  qid_printqueue(w->w_qgrp,
1800 								 w->w_qdir),
1801 						  w->w_name + 2, w->w_pri,
1802 						  CurrentLA, sequenceno,
1803 						  njobs);
1804 				break;
1805 			}
1806 			else if (Verbose)
1807 				message("Skipping %s/%s (sequence %d of %d)",
1808 					qid_printqueue(w->w_qgrp, w->w_qdir),
1809 					w->w_name + 2, sequenceno, njobs);
1810 		}
1811 		else
1812 		{
1813 			if (Verbose)
1814 			{
1815 				message("%s", "");
1816 				message("Running %s/%s (sequence %d of %d)",
1817 					qid_printqueue(w->w_qgrp, w->w_qdir),
1818 					w->w_name + 2, sequenceno, njobs);
1819 			}
1820 			if (didfork && MaxQueueChildren > 0)
1821 			{
1822 				sm_blocksignal(SIGCHLD);
1823 				(void) sm_signal(SIGCHLD, reapchild);
1824 			}
1825 			if (tTd(63, 100))
1826 				sm_syslog(LOG_DEBUG, NOQID,
1827 					  "runqueue %s dowork(%s)",
1828 					  qid_printqueue(w->w_qgrp, w->w_qdir),
1829 					  w->w_name + 2);
1830 
1831 			(void) dowork(w->w_qgrp, w->w_qdir, w->w_name + 2,
1832 				      ForkQueueRuns, false, e);
1833 			errno = 0;
1834 		}
1835 		sm_free(w->w_name); /* XXX */
1836 		if (w->w_host != NULL)
1837 			sm_free(w->w_host); /* XXX */
1838 		sm_free((char *) w); /* XXX */
1839 		sequenceno += seqjump; /* next sequence number */
1840 #if SM_HEAP_CHECK
1841 		if (sm_debug_active(&DebugLeakQ, 1))
1842 			sm_heap_setgroup(oldgroup);
1843 #endif /* SM_HEAP_CHECK */
1844 	}
1845 
1846 	BlockOldsh = false;
1847 
1848 	/* check the signals didn't happen during the revert */
1849 	if (NoMoreRunners)
1850 	{
1851 		/* Check that a valid signal handler is callable */
1852 		if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1853 		    Oldsh != runners_sighup && Oldsh != runners_sigterm)
1854 			(*Oldsh)(Oldsig);
1855 	}
1856 
1857 	Oldsh = SIG_DFL; /* after the NoMoreRunners check */
1858 }
1859 /*
1860 **  RUN_WORK_GROUP -- run the jobs in a queue group from a work group.
1861 **
1862 **	Gets the stuff out of the queue in some presumably logical
1863 **	order and processes them.
1864 **
1865 **	Parameters:
1866 **		wgrp -- work group to process.
1867 **		flags -- RWG_* flags
1868 **
1869 **	Returns:
1870 **		true if the queue run successfully began.
1871 **
1872 **	Side Effects:
1873 **		runs things in the mail queue.
1874 */
1875 
1876 /* Minimum sleep time for persistent queue runners */
1877 #define MIN_SLEEP_TIME	5
1878 
1879 bool
1880 run_work_group(wgrp, flags)
1881 	int wgrp;
1882 	int flags;
1883 {
1884 	register ENVELOPE *e;
1885 	int njobs, qdir;
1886 	int sequenceno = 1;
1887 	int qgrp, endgrp, h, i;
1888 	time_t now;
1889 	bool full, more;
1890 	SM_RPOOL_T *rpool;
1891 	extern ENVELOPE BlankEnvelope;
1892 	extern SIGFUNC_DECL reapchild __P((int));
1893 
1894 	if (wgrp < 0)
1895 		return false;
1896 
1897 	/*
1898 	**  If no work will ever be selected, don't even bother reading
1899 	**  the queue.
1900 	*/
1901 
1902 	SM_GET_LA(now);
1903 
1904 	if (!bitset(RWG_PERSISTENT, flags) &&
1905 	    shouldqueue(WkRecipFact, Current_LA_time))
1906 	{
1907 		char *msg = "Skipping queue run -- load average too high";
1908 
1909 		if (bitset(RWG_VERBOSE, flags))
1910 			message("458 %s\n", msg);
1911 		if (LogLevel > 8)
1912 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1913 		return false;
1914 	}
1915 
1916 	/*
1917 	**  See if we already have too many children.
1918 	*/
1919 
1920 	if (bitset(RWG_FORK, flags) &&
1921 	    WorkGrp[wgrp].wg_lowqintvl > 0 &&
1922 	    !bitset(RWG_PERSISTENT, flags) &&
1923 	    MaxChildren > 0 && CurChildren >= MaxChildren)
1924 	{
1925 		char *msg = "Skipping queue run -- too many children";
1926 
1927 		if (bitset(RWG_VERBOSE, flags))
1928 			message("458 %s (%d)\n", msg, CurChildren);
1929 		if (LogLevel > 8)
1930 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s (%d)",
1931 				  msg, CurChildren);
1932 		return false;
1933 	}
1934 
1935 	/*
1936 	**  See if we want to go off and do other useful work.
1937 	*/
1938 
1939 	if (bitset(RWG_FORK, flags))
1940 	{
1941 		pid_t pid;
1942 
1943 		(void) sm_blocksignal(SIGCHLD);
1944 		(void) sm_signal(SIGCHLD, reapchild);
1945 
1946 		pid = dofork();
1947 		if (pid == -1)
1948 		{
1949 			const char *msg = "Skipping queue run -- fork() failed";
1950 			const char *err = sm_errstring(errno);
1951 
1952 			if (bitset(RWG_VERBOSE, flags))
1953 				message("458 %s: %s\n", msg, err);
1954 			if (LogLevel > 8)
1955 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s: %s",
1956 					  msg, err);
1957 			(void) sm_releasesignal(SIGCHLD);
1958 			return false;
1959 		}
1960 		if (pid != 0)
1961 		{
1962 			/* parent -- pick up intermediate zombie */
1963 			(void) sm_blocksignal(SIGALRM);
1964 
1965 			/* wgrp only used when queue runners are persistent */
1966 			proc_list_add(pid, "Queue runner", PROC_QUEUE,
1967 				      WorkGrp[wgrp].wg_maxact,
1968 				      bitset(RWG_PERSISTENT, flags) ? wgrp : -1,
1969 				      NULL);
1970 			(void) sm_releasesignal(SIGALRM);
1971 			(void) sm_releasesignal(SIGCHLD);
1972 			return true;
1973 		}
1974 
1975 		/* child -- clean up signals */
1976 
1977 		/* Reset global flags */
1978 		RestartRequest = NULL;
1979 		RestartWorkGroup = false;
1980 		ShutdownRequest = NULL;
1981 		PendingSignal = 0;
1982 		CurrentPid = getpid();
1983 		close_sendmail_pid();
1984 
1985 		/*
1986 		**  Initialize exception stack and default exception
1987 		**  handler for child process.
1988 		*/
1989 
1990 		sm_exc_newthread(fatal_error);
1991 		clrcontrol();
1992 		proc_list_clear();
1993 
1994 		/* Add parent process as first child item */
1995 		proc_list_add(CurrentPid, "Queue runner child process",
1996 			      PROC_QUEUE_CHILD, 0, -1, NULL);
1997 		(void) sm_releasesignal(SIGCHLD);
1998 		(void) sm_signal(SIGCHLD, SIG_DFL);
1999 		(void) sm_signal(SIGHUP, SIG_DFL);
2000 		(void) sm_signal(SIGTERM, intsig);
2001 	}
2002 
2003 	/*
2004 	**  Release any resources used by the daemon code.
2005 	*/
2006 
2007 	clrdaemon();
2008 
2009 	/* force it to run expensive jobs */
2010 	NoConnect = false;
2011 
2012 	/* drop privileges */
2013 	if (geteuid() == (uid_t) 0)
2014 		(void) drop_privileges(false);
2015 
2016 	/*
2017 	**  Create ourselves an envelope
2018 	*/
2019 
2020 	CurEnv = &QueueEnvelope;
2021 	rpool = sm_rpool_new_x(NULL);
2022 	e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2023 	e->e_flags = BlankEnvelope.e_flags;
2024 	e->e_parent = NULL;
2025 
2026 	/* make sure we have disconnected from parent */
2027 	if (bitset(RWG_FORK, flags))
2028 	{
2029 		disconnect(1, e);
2030 		QuickAbort = false;
2031 	}
2032 
2033 	/*
2034 	**  If we are running part of the queue, always ignore stored
2035 	**  host status.
2036 	*/
2037 
2038 	if (QueueLimitId != NULL || QueueLimitSender != NULL ||
2039 	    QueueLimitQuarantine != NULL ||
2040 	    QueueLimitRecipient != NULL)
2041 	{
2042 		IgnoreHostStatus = true;
2043 		MinQueueAge = 0;
2044 		MaxQueueAge = 0;
2045 	}
2046 
2047 	/*
2048 	**  Here is where we choose the queue group from the work group.
2049 	**  The caller of the "domorework" label must setup a new envelope.
2050 	*/
2051 
2052 	endgrp = WorkGrp[wgrp].wg_curqgrp; /* to not spin endlessly */
2053 
2054   domorework:
2055 
2056 	/*
2057 	**  Run a queue group if:
2058 	**  RWG_RUNALL bit is set or the bit for this group is set.
2059 	*/
2060 
2061 	now = curtime();
2062 	for (;;)
2063 	{
2064 		/*
2065 		**  Find the next queue group within the work group that
2066 		**  has been marked as needing a run.
2067 		*/
2068 
2069 		qgrp = WorkGrp[wgrp].wg_qgs[WorkGrp[wgrp].wg_curqgrp]->qg_index;
2070 		WorkGrp[wgrp].wg_curqgrp++; /* advance */
2071 		WorkGrp[wgrp].wg_curqgrp %= WorkGrp[wgrp].wg_numqgrp; /* wrap */
2072 		if (bitset(RWG_RUNALL, flags) ||
2073 		    (Queue[qgrp]->qg_nextrun <= now &&
2074 		     Queue[qgrp]->qg_nextrun != (time_t) -1))
2075 			break;
2076 		if (endgrp == WorkGrp[wgrp].wg_curqgrp)
2077 		{
2078 			e->e_id = NULL;
2079 			if (bitset(RWG_FORK, flags))
2080 				finis(true, true, ExitStat);
2081 			return true; /* we're done */
2082 		}
2083 	}
2084 
2085 	qdir = Queue[qgrp]->qg_curnum; /* round-robin init of queue position */
2086 #if _FFR_QUEUE_SCHED_DBG
2087 	if (tTd(69, 12))
2088 		sm_syslog(LOG_INFO, NOQID,
2089 			"rwg: wgrp=%d, qgrp=%d, qdir=%d, name=%s, curqgrp=%d, numgrps=%d",
2090 			wgrp, qgrp, qdir, qid_printqueue(qgrp, qdir),
2091 			WorkGrp[wgrp].wg_curqgrp, WorkGrp[wgrp].wg_numqgrp);
2092 #endif /* _FFR_QUEUE_SCHED_DBG */
2093 
2094 #if HASNICE
2095 	/* tweak niceness of queue runs */
2096 	if (Queue[qgrp]->qg_nice > 0)
2097 		(void) nice(Queue[qgrp]->qg_nice);
2098 #endif /* HASNICE */
2099 
2100 	/* XXX running queue group... */
2101 	sm_setproctitle(true, CurEnv, "running queue: %s",
2102 			qid_printqueue(qgrp, qdir));
2103 
2104 	if (LogLevel > 69 || tTd(63, 99))
2105 		sm_syslog(LOG_DEBUG, NOQID,
2106 			  "runqueue %s, pid=%d, forkflag=%d",
2107 			  qid_printqueue(qgrp, qdir), (int) CurrentPid,
2108 			  bitset(RWG_FORK, flags));
2109 
2110 	/*
2111 	**  Start making passes through the queue.
2112 	**	First, read and sort the entire queue.
2113 	**	Then, process the work in that order.
2114 	**		But if you take too long, start over.
2115 	*/
2116 
2117 	for (i = 0; i < Queue[qgrp]->qg_numqueues; i++)
2118 	{
2119 		(void) gatherq(qgrp, qdir, false, &full, &more, &h);
2120 #if SM_CONF_SHM
2121 		if (ShmId != SM_SHM_NO_ID)
2122 			QSHM_ENTRIES(Queue[qgrp]->qg_qpaths[qdir].qp_idx) = h;
2123 #endif /* SM_CONF_SHM */
2124 		/* If there are no more items in this queue advance */
2125 		if (!more)
2126 		{
2127 			/* A round-robin advance */
2128 			qdir++;
2129 			qdir %= Queue[qgrp]->qg_numqueues;
2130 		}
2131 
2132 		/* Has the WorkList reached the limit? */
2133 		if (full)
2134 			break; /* don't try to gather more */
2135 	}
2136 
2137 	/* order the existing work requests */
2138 	njobs = sortq(Queue[qgrp]->qg_maxlist);
2139 	Queue[qgrp]->qg_curnum = qdir; /* update */
2140 
2141 
2142 	if (!Verbose && bitnset(QD_FORK, Queue[qgrp]->qg_flags))
2143 	{
2144 		int loop, maxrunners;
2145 		pid_t pid;
2146 
2147 		/*
2148 		**  For this WorkQ we want to fork off N children (maxrunners)
2149 		**  at this point. Each child has a copy of WorkQ. Each child
2150 		**  will process every N-th item. The parent will wait for all
2151 		**  of the children to finish before moving on to the next
2152 		**  queue group within the work group. This saves us forking
2153 		**  a new runner-child for each work item.
2154 		**  It's valid for qg_maxqrun == 0 since this may be an
2155 		**  explicit "don't run this queue" setting.
2156 		*/
2157 
2158 		maxrunners = Queue[qgrp]->qg_maxqrun;
2159 
2160 		/*
2161 		**  If no runners are configured for this group but
2162 		**  the queue is "forced" then lets use 1 runner.
2163 		*/
2164 
2165 		if (maxrunners == 0 && bitset(RWG_FORCE, flags))
2166 			maxrunners = 1;
2167 
2168 		/* No need to have more runners then there are jobs */
2169 		if (maxrunners > njobs)
2170 			maxrunners = njobs;
2171 		for (loop = 0; loop < maxrunners; loop++)
2172 		{
2173 			/*
2174 			**  Since the delivery may happen in a child and the
2175 			**  parent does not wait, the parent may close the
2176 			**  maps thereby removing any shared memory used by
2177 			**  the map.  Therefore, close the maps now so the
2178 			**  child will dynamically open them if necessary.
2179 			*/
2180 
2181 			closemaps(false);
2182 
2183 			pid = fork();
2184 			if (pid < 0)
2185 			{
2186 				syserr("run_work_group: cannot fork");
2187 				return false;
2188 			}
2189 			else if (pid > 0)
2190 			{
2191 				/* parent -- clean out connection cache */
2192 				mci_flush(false, NULL);
2193 #if _FFR_SKIP_DOMAINS
2194 				if (QueueSortOrder == QSO_BYHOST)
2195 				{
2196 					sequenceno += skip_domains(1);
2197 				}
2198 				else
2199 #endif /* _FFR_SKIP_DOMAINS */
2200 				{
2201 					/* for the skip */
2202 					WorkQ = WorkQ->w_next;
2203 					sequenceno++;
2204 				}
2205 				proc_list_add(pid, "Queue child runner process",
2206 					      PROC_QUEUE_CHILD, 0, -1, NULL);
2207 
2208 				/* No additional work, no additional runners */
2209 				if (WorkQ == NULL)
2210 					break;
2211 			}
2212 			else
2213 			{
2214 				/* child -- Reset global flags */
2215 				RestartRequest = NULL;
2216 				RestartWorkGroup = false;
2217 				ShutdownRequest = NULL;
2218 				PendingSignal = 0;
2219 				CurrentPid = getpid();
2220 				close_sendmail_pid();
2221 
2222 				/*
2223 				**  Initialize exception stack and default
2224 				**  exception handler for child process.
2225 				**  When fork()'d the child now has a private
2226 				**  copy of WorkQ at its current position.
2227 				*/
2228 
2229 				sm_exc_newthread(fatal_error);
2230 
2231 				/*
2232 				**  SMTP processes (whether -bd or -bs) set
2233 				**  SIGCHLD to reapchild to collect
2234 				**  children status.  However, at delivery
2235 				**  time, that status must be collected
2236 				**  by sm_wait() to be dealt with properly
2237 				**  (check success of delivery based
2238 				**  on status code, etc).  Therefore, if we
2239 				**  are an SMTP process, reset SIGCHLD
2240 				**  back to the default so reapchild
2241 				**  doesn't collect status before
2242 				**  sm_wait().
2243 				*/
2244 
2245 				if (OpMode == MD_SMTP ||
2246 				    OpMode == MD_DAEMON ||
2247 				    MaxQueueChildren > 0)
2248 				{
2249 					proc_list_clear();
2250 					sm_releasesignal(SIGCHLD);
2251 					(void) sm_signal(SIGCHLD, SIG_DFL);
2252 				}
2253 
2254 				/* child -- error messages to the transcript */
2255 				QuickAbort = OnlyOneError = false;
2256 				runner_work(e, sequenceno, true,
2257 					    maxrunners, njobs);
2258 
2259 				/* This child is done */
2260 				finis(true, true, ExitStat);
2261 				/* NOTREACHED */
2262 			}
2263 		}
2264 
2265 		sm_releasesignal(SIGCHLD);
2266 
2267 		/*
2268 		**  Wait until all of the runners have completed before
2269 		**  seeing if there is another queue group in the
2270 		**  work group to process.
2271 		**  XXX Future enhancement: don't wait() for all children
2272 		**  here, just go ahead and make sure that overall the number
2273 		**  of children is not exceeded.
2274 		*/
2275 
2276 		while (CurChildren > 0)
2277 		{
2278 			int status;
2279 			pid_t ret;
2280 
2281 			while ((ret = sm_wait(&status)) <= 0)
2282 				continue;
2283 			proc_list_drop(ret, status, NULL);
2284 		}
2285 	}
2286 	else if (Queue[qgrp]->qg_maxqrun > 0 || bitset(RWG_FORCE, flags))
2287 	{
2288 		/*
2289 		**  When current process will not fork children to do the work,
2290 		**  it will do the work itself. The 'skip' will be 1 since
2291 		**  there are no child runners to divide the work across.
2292 		*/
2293 
2294 		runner_work(e, sequenceno, false, 1, njobs);
2295 	}
2296 
2297 	/* free memory allocated by newenvelope() above */
2298 	sm_rpool_free(rpool);
2299 	QueueEnvelope.e_rpool = NULL;
2300 
2301 	/* Are there still more queues in the work group to process? */
2302 	if (endgrp != WorkGrp[wgrp].wg_curqgrp)
2303 	{
2304 		rpool = sm_rpool_new_x(NULL);
2305 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2306 		e->e_flags = BlankEnvelope.e_flags;
2307 		goto domorework;
2308 	}
2309 
2310 	/* No more queues in work group to process. Now check persistent. */
2311 	if (bitset(RWG_PERSISTENT, flags))
2312 	{
2313 		sequenceno = 1;
2314 		sm_setproctitle(true, NULL, "running queue: %s",
2315 				qid_printqueue(qgrp, qdir));
2316 
2317 		/*
2318 		**  close bogus maps, i.e., maps which caused a tempfail,
2319 		**	so we get fresh map connections on the next lookup.
2320 		**  closemaps() is also called when children are started.
2321 		*/
2322 
2323 		closemaps(true);
2324 
2325 		/* Close any cached connections. */
2326 		mci_flush(true, NULL);
2327 
2328 		/* Clean out expired related entries. */
2329 		rmexpstab();
2330 
2331 #if NAMED_BIND
2332 		/* Update MX records for FallbackMX. */
2333 		if (FallbackMX != NULL)
2334 			(void) getfallbackmxrr(FallbackMX);
2335 #endif /* NAMED_BIND */
2336 
2337 #if USERDB
2338 		/* close UserDatabase */
2339 		_udbx_close();
2340 #endif /* USERDB */
2341 
2342 #if SM_HEAP_CHECK
2343 		if (sm_debug_active(&SmHeapCheck, 2)
2344 		    && access("memdump", F_OK) == 0
2345 		   )
2346 		{
2347 			SM_FILE_T *out;
2348 
2349 			remove("memdump");
2350 			out = sm_io_open(SmFtStdio, SM_TIME_DEFAULT,
2351 					 "memdump.out", SM_IO_APPEND, NULL);
2352 			if (out != NULL)
2353 			{
2354 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT, "----------------------\n");
2355 				sm_heap_report(out,
2356 					sm_debug_level(&SmHeapCheck) - 1);
2357 				(void) sm_io_close(out, SM_TIME_DEFAULT);
2358 			}
2359 		}
2360 #endif /* SM_HEAP_CHECK */
2361 
2362 		/* let me rest for a second to catch my breath */
2363 		if (njobs == 0 && WorkGrp[wgrp].wg_lowqintvl < MIN_SLEEP_TIME)
2364 			sleep(MIN_SLEEP_TIME);
2365 		else if (WorkGrp[wgrp].wg_lowqintvl <= 0)
2366 			sleep(QueueIntvl > 0 ? QueueIntvl : MIN_SLEEP_TIME);
2367 		else
2368 			sleep(WorkGrp[wgrp].wg_lowqintvl);
2369 
2370 		/*
2371 		**  Get the LA outside the WorkQ loop if necessary.
2372 		**  In a persistent queue runner the code is repeated over
2373 		**  and over but gatherq() may ignore entries due to
2374 		**  shouldqueue() (do we really have to do this twice?).
2375 		**  Hence the queue runners would just idle around when once
2376 		**  CurrentLA caused all entries in a queue to be ignored.
2377 		*/
2378 
2379 		if (njobs == 0)
2380 			SM_GET_LA(now);
2381 		rpool = sm_rpool_new_x(NULL);
2382 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2383 		e->e_flags = BlankEnvelope.e_flags;
2384 		goto domorework;
2385 	}
2386 
2387 	/* exit without the usual cleanup */
2388 	e->e_id = NULL;
2389 	if (bitset(RWG_FORK, flags))
2390 		finis(true, true, ExitStat);
2391 	/* NOTREACHED */
2392 	return true;
2393 }
2394 
2395 /*
2396 **  DOQUEUERUN -- do a queue run?
2397 */
2398 
2399 bool
2400 doqueuerun()
2401 {
2402 	return DoQueueRun;
2403 }
2404 
2405 /*
2406 **  RUNQUEUEEVENT -- Sets a flag to indicate that a queue run should be done.
2407 **
2408 **	Parameters:
2409 **		none.
2410 **
2411 **	Returns:
2412 **		none.
2413 **
2414 **	Side Effects:
2415 **		The invocation of this function via an alarm may interrupt
2416 **		a set of actions. Thus errno may be set in that context.
2417 **		We need to restore errno at the end of this function to ensure
2418 **		that any work done here that sets errno doesn't return a
2419 **		misleading/false errno value. Errno may	be EINTR upon entry to
2420 **		this function because of non-restartable/continuable system
2421 **		API was active. Iff this is true we will override errno as
2422 **		a timeout (as a more accurate error message).
2423 **
2424 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
2425 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
2426 **		DOING.
2427 */
2428 
2429 void
2430 runqueueevent(ignore)
2431 	int ignore;
2432 {
2433 	int save_errno = errno;
2434 
2435 	/*
2436 	**  Set the general bit that we want a queue run,
2437 	**  tested in doqueuerun()
2438 	*/
2439 
2440 	DoQueueRun = true;
2441 #if _FFR_QUEUE_SCHED_DBG
2442 	if (tTd(69, 10))
2443 		sm_syslog(LOG_INFO, NOQID, "rqe: done");
2444 #endif /* _FFR_QUEUE_SCHED_DBG */
2445 
2446 	errno = save_errno;
2447 	if (errno == EINTR)
2448 		errno = ETIMEDOUT;
2449 }
2450 /*
2451 **  GATHERQ -- gather messages from the message queue(s) the work queue.
2452 **
2453 **	Parameters:
2454 **		qgrp -- the index of the queue group.
2455 **		qdir -- the index of the queue directory.
2456 **		doall -- if set, include everything in the queue (even
2457 **			the jobs that cannot be run because the load
2458 **			average is too high, or MaxQueueRun is reached).
2459 **			Otherwise, exclude those jobs.
2460 **		full -- (optional) to be set 'true' if WorkList is full
2461 **		more -- (optional) to be set 'true' if there are still more
2462 **			messages in this queue not added to WorkList
2463 **		pnentries -- (optional) total nuber of entries in queue
2464 **
2465 **	Returns:
2466 **		The number of request in the queue (not necessarily
2467 **		the number of requests in WorkList however).
2468 **
2469 **	Side Effects:
2470 **		prepares available work into WorkList
2471 */
2472 
2473 #define NEED_P		0001	/* 'P': priority */
2474 #define NEED_T		0002	/* 'T': time */
2475 #define NEED_R		0004	/* 'R': recipient */
2476 #define NEED_S		0010	/* 'S': sender */
2477 #define NEED_H		0020	/* host */
2478 #define HAS_QUARANTINE	0040	/* has an unexpected 'q' line */
2479 #define NEED_QUARANTINE	0100	/* 'q': reason */
2480 
2481 static WORK	*WorkList = NULL;	/* list of unsort work */
2482 static int	WorkListSize = 0;	/* current max size of WorkList */
2483 static int	WorkListCount = 0;	/* # of work items in WorkList */
2484 
2485 static int
2486 gatherq(qgrp, qdir, doall, full, more, pnentries)
2487 	int qgrp;
2488 	int qdir;
2489 	bool doall;
2490 	bool *full;
2491 	bool *more;
2492 	int *pnentries;
2493 {
2494 	register struct dirent *d;
2495 	register WORK *w;
2496 	register char *p;
2497 	DIR *f;
2498 	int i, num_ent, wn, nentries;
2499 	QUEUE_CHAR *check;
2500 	char qd[MAXPATHLEN];
2501 	char qf[MAXPATHLEN];
2502 
2503 	wn = WorkListCount - 1;
2504 	num_ent = 0;
2505 	nentries = 0;
2506 	if (qdir == NOQDIR)
2507 		(void) sm_strlcpy(qd, ".", sizeof(qd));
2508 	else
2509 		(void) sm_strlcpyn(qd, sizeof(qd), 2,
2510 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
2511 			(bitset(QP_SUBQF,
2512 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
2513 					? "/qf" : ""));
2514 
2515 	if (tTd(41, 1))
2516 	{
2517 		sm_dprintf("gatherq:\n");
2518 
2519 		check = QueueLimitId;
2520 		while (check != NULL)
2521 		{
2522 			sm_dprintf("\tQueueLimitId = %s%s\n",
2523 				check->queue_negate ? "!" : "",
2524 				check->queue_match);
2525 			check = check->queue_next;
2526 		}
2527 
2528 		check = QueueLimitSender;
2529 		while (check != NULL)
2530 		{
2531 			sm_dprintf("\tQueueLimitSender = %s%s\n",
2532 				check->queue_negate ? "!" : "",
2533 				check->queue_match);
2534 			check = check->queue_next;
2535 		}
2536 
2537 		check = QueueLimitRecipient;
2538 		while (check != NULL)
2539 		{
2540 			sm_dprintf("\tQueueLimitRecipient = %s%s\n",
2541 				check->queue_negate ? "!" : "",
2542 				check->queue_match);
2543 			check = check->queue_next;
2544 		}
2545 
2546 		if (QueueMode == QM_QUARANTINE)
2547 		{
2548 			check = QueueLimitQuarantine;
2549 			while (check != NULL)
2550 			{
2551 				sm_dprintf("\tQueueLimitQuarantine = %s%s\n",
2552 					   check->queue_negate ? "!" : "",
2553 					   check->queue_match);
2554 				check = check->queue_next;
2555 			}
2556 		}
2557 	}
2558 
2559 	/* open the queue directory */
2560 	f = opendir(qd);
2561 	if (f == NULL)
2562 	{
2563 		syserr("gatherq: cannot open \"%s\"",
2564 			qid_printqueue(qgrp, qdir));
2565 		if (full != NULL)
2566 			*full = WorkListCount >= MaxQueueRun && MaxQueueRun > 0;
2567 		if (more != NULL)
2568 			*more = false;
2569 		return 0;
2570 	}
2571 
2572 	/*
2573 	**  Read the work directory.
2574 	*/
2575 
2576 	while ((d = readdir(f)) != NULL)
2577 	{
2578 		SM_FILE_T *cf;
2579 		int qfver = 0;
2580 		char lbuf[MAXNAME + 1];
2581 		struct stat sbuf;
2582 
2583 		if (tTd(41, 50))
2584 			sm_dprintf("gatherq: checking %s..", d->d_name);
2585 
2586 		/* is this an interesting entry? */
2587 		if (!(((QueueMode == QM_NORMAL &&
2588 			d->d_name[0] == NORMQF_LETTER) ||
2589 		       (QueueMode == QM_QUARANTINE &&
2590 			d->d_name[0] == QUARQF_LETTER) ||
2591 		       (QueueMode == QM_LOST &&
2592 			d->d_name[0] == LOSEQF_LETTER)) &&
2593 		      d->d_name[1] == 'f'))
2594 		{
2595 			if (tTd(41, 50))
2596 				sm_dprintf("  skipping\n");
2597 			continue;
2598 		}
2599 		if (tTd(41, 50))
2600 			sm_dprintf("\n");
2601 
2602 		if (strlen(d->d_name) >= MAXQFNAME)
2603 		{
2604 			if (Verbose)
2605 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
2606 						     "gatherq: %s too long, %d max characters\n",
2607 						     d->d_name, MAXQFNAME);
2608 			if (LogLevel > 0)
2609 				sm_syslog(LOG_ALERT, NOQID,
2610 					  "gatherq: %s too long, %d max characters",
2611 					  d->d_name, MAXQFNAME);
2612 			continue;
2613 		}
2614 
2615 		++nentries;
2616 		check = QueueLimitId;
2617 		while (check != NULL)
2618 		{
2619 			if (strcontainedin(false, check->queue_match,
2620 					   d->d_name) != check->queue_negate)
2621 				break;
2622 			else
2623 				check = check->queue_next;
2624 		}
2625 		if (QueueLimitId != NULL && check == NULL)
2626 			continue;
2627 
2628 		/* grow work list if necessary */
2629 		if (++wn >= MaxQueueRun && MaxQueueRun > 0)
2630 		{
2631 			if (wn == MaxQueueRun && LogLevel > 0)
2632 				sm_syslog(LOG_WARNING, NOQID,
2633 					  "WorkList for %s maxed out at %d",
2634 					  qid_printqueue(qgrp, qdir),
2635 					  MaxQueueRun);
2636 			if (doall)
2637 				continue;	/* just count entries */
2638 			break;
2639 		}
2640 		if (wn >= WorkListSize)
2641 		{
2642 			grow_wlist(qgrp, qdir);
2643 			if (wn >= WorkListSize)
2644 				continue;
2645 		}
2646 		SM_ASSERT(wn >= 0);
2647 		w = &WorkList[wn];
2648 
2649 		(void) sm_strlcpyn(qf, sizeof(qf), 3, qd, "/", d->d_name);
2650 		if (stat(qf, &sbuf) < 0)
2651 		{
2652 			if (errno != ENOENT)
2653 				sm_syslog(LOG_INFO, NOQID,
2654 					  "gatherq: can't stat %s/%s",
2655 					  qid_printqueue(qgrp, qdir),
2656 					  d->d_name);
2657 			wn--;
2658 			continue;
2659 		}
2660 		if (!bitset(S_IFREG, sbuf.st_mode))
2661 		{
2662 			/* Yikes!  Skip it or we will hang on open! */
2663 			if (!((d->d_name[0] == DATAFL_LETTER ||
2664 			       d->d_name[0] == NORMQF_LETTER ||
2665 			       d->d_name[0] == QUARQF_LETTER ||
2666 			       d->d_name[0] == LOSEQF_LETTER ||
2667 			       d->d_name[0] == XSCRPT_LETTER) &&
2668 			      d->d_name[1] == 'f' && d->d_name[2] == '\0'))
2669 				syserr("gatherq: %s/%s is not a regular file",
2670 				       qid_printqueue(qgrp, qdir), d->d_name);
2671 			wn--;
2672 			continue;
2673 		}
2674 
2675 		/* avoid work if possible */
2676 		if ((QueueSortOrder == QSO_BYFILENAME ||
2677 		     QueueSortOrder == QSO_BYMODTIME ||
2678 		     QueueSortOrder == QSO_NONE ||
2679 		     QueueSortOrder == QSO_RANDOM) &&
2680 		    QueueLimitQuarantine == NULL &&
2681 		    QueueLimitSender == NULL &&
2682 		    QueueLimitRecipient == NULL)
2683 		{
2684 			w->w_qgrp = qgrp;
2685 			w->w_qdir = qdir;
2686 			w->w_name = newstr(d->d_name);
2687 			w->w_host = NULL;
2688 			w->w_lock = w->w_tooyoung = false;
2689 			w->w_pri = 0;
2690 			w->w_ctime = 0;
2691 			w->w_mtime = sbuf.st_mtime;
2692 			++num_ent;
2693 			continue;
2694 		}
2695 
2696 		/* open control file */
2697 		cf = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
2698 				NULL);
2699 		if (cf == NULL && OpMode != MD_PRINT)
2700 		{
2701 			/* this may be some random person sending hir msgs */
2702 			if (tTd(41, 2))
2703 				sm_dprintf("gatherq: cannot open %s: %s\n",
2704 					d->d_name, sm_errstring(errno));
2705 			errno = 0;
2706 			wn--;
2707 			continue;
2708 		}
2709 		w->w_qgrp = qgrp;
2710 		w->w_qdir = qdir;
2711 		w->w_name = newstr(d->d_name);
2712 		w->w_host = NULL;
2713 		if (cf != NULL)
2714 		{
2715 			w->w_lock = !lockfile(sm_io_getinfo(cf, SM_IO_WHAT_FD,
2716 							    NULL),
2717 					      w->w_name, NULL,
2718 					      LOCK_SH|LOCK_NB);
2719 		}
2720 		w->w_tooyoung = false;
2721 
2722 		/* make sure jobs in creation don't clog queue */
2723 		w->w_pri = 0x7fffffff;
2724 		w->w_ctime = 0;
2725 		w->w_mtime = sbuf.st_mtime;
2726 
2727 		/* extract useful information */
2728 		i = NEED_P|NEED_T;
2729 		if (QueueSortOrder == QSO_BYHOST
2730 #if _FFR_RHS
2731 		    || QueueSortOrder == QSO_BYSHUFFLE
2732 #endif /* _FFR_RHS */
2733 		   )
2734 		{
2735 			/* need w_host set for host sort order */
2736 			i |= NEED_H;
2737 		}
2738 		if (QueueLimitSender != NULL)
2739 			i |= NEED_S;
2740 		if (QueueLimitRecipient != NULL)
2741 			i |= NEED_R;
2742 		if (QueueLimitQuarantine != NULL)
2743 			i |= NEED_QUARANTINE;
2744 		while (cf != NULL && i != 0 &&
2745 		       sm_io_fgets(cf, SM_TIME_DEFAULT, lbuf,
2746 				   sizeof(lbuf)) >= 0)
2747 		{
2748 			int c;
2749 			time_t age;
2750 
2751 			p = strchr(lbuf, '\n');
2752 			if (p != NULL)
2753 				*p = '\0';
2754 			else
2755 			{
2756 				/* flush rest of overly long line */
2757 				while ((c = sm_io_getc(cf, SM_TIME_DEFAULT))
2758 				       != SM_IO_EOF && c != '\n')
2759 					continue;
2760 			}
2761 
2762 			switch (lbuf[0])
2763 			{
2764 			  case 'V':
2765 				qfver = atoi(&lbuf[1]);
2766 				break;
2767 
2768 			  case 'P':
2769 				w->w_pri = atol(&lbuf[1]);
2770 				i &= ~NEED_P;
2771 				break;
2772 
2773 			  case 'T':
2774 				w->w_ctime = atol(&lbuf[1]);
2775 				i &= ~NEED_T;
2776 				break;
2777 
2778 			  case 'q':
2779 				if (QueueMode != QM_QUARANTINE &&
2780 				    QueueMode != QM_LOST)
2781 				{
2782 					if (tTd(41, 49))
2783 						sm_dprintf("%s not marked as quarantined but has a 'q' line\n",
2784 							   w->w_name);
2785 					i |= HAS_QUARANTINE;
2786 				}
2787 				else if (QueueMode == QM_QUARANTINE)
2788 				{
2789 					if (QueueLimitQuarantine == NULL)
2790 					{
2791 						i &= ~NEED_QUARANTINE;
2792 						break;
2793 					}
2794 					p = &lbuf[1];
2795 					check = QueueLimitQuarantine;
2796 					while (check != NULL)
2797 					{
2798 						if (strcontainedin(false,
2799 								   check->queue_match,
2800 								   p) !=
2801 						    check->queue_negate)
2802 							break;
2803 						else
2804 							check = check->queue_next;
2805 					}
2806 					if (check != NULL)
2807 						i &= ~NEED_QUARANTINE;
2808 				}
2809 				break;
2810 
2811 			  case 'R':
2812 				if (w->w_host == NULL &&
2813 				    (p = strrchr(&lbuf[1], '@')) != NULL)
2814 				{
2815 #if _FFR_RHS
2816 					if (QueueSortOrder == QSO_BYSHUFFLE)
2817 						w->w_host = newstr(&p[1]);
2818 					else
2819 #endif /* _FFR_RHS */
2820 						w->w_host = strrev(&p[1]);
2821 					makelower(w->w_host);
2822 					i &= ~NEED_H;
2823 				}
2824 				if (QueueLimitRecipient == NULL)
2825 				{
2826 					i &= ~NEED_R;
2827 					break;
2828 				}
2829 				if (qfver > 0)
2830 				{
2831 					p = strchr(&lbuf[1], ':');
2832 					if (p == NULL)
2833 						p = &lbuf[1];
2834 					else
2835 						++p; /* skip over ':' */
2836 				}
2837 				else
2838 					p = &lbuf[1];
2839 				check = QueueLimitRecipient;
2840 				while (check != NULL)
2841 				{
2842 					if (strcontainedin(true,
2843 							   check->queue_match,
2844 							   p) !=
2845 					    check->queue_negate)
2846 						break;
2847 					else
2848 						check = check->queue_next;
2849 				}
2850 				if (check != NULL)
2851 					i &= ~NEED_R;
2852 				break;
2853 
2854 			  case 'S':
2855 				check = QueueLimitSender;
2856 				while (check != NULL)
2857 				{
2858 					if (strcontainedin(true,
2859 							   check->queue_match,
2860 							   &lbuf[1]) !=
2861 					    check->queue_negate)
2862 						break;
2863 					else
2864 						check = check->queue_next;
2865 				}
2866 				if (check != NULL)
2867 					i &= ~NEED_S;
2868 				break;
2869 
2870 			  case 'K':
2871 				if (MaxQueueAge > 0)
2872 				{
2873 					time_t lasttry, delay;
2874 
2875 					lasttry = (time_t) atol(&lbuf[1]);
2876 					delay = MIN(lasttry - w->w_ctime,
2877 						    MaxQueueAge);
2878 					age = curtime() - lasttry;
2879 					if (age < delay)
2880 						w->w_tooyoung = true;
2881 					break;
2882 				}
2883 
2884 				age = curtime() - (time_t) atol(&lbuf[1]);
2885 				if (age >= 0 && MinQueueAge > 0 &&
2886 				    age < MinQueueAge)
2887 					w->w_tooyoung = true;
2888 				break;
2889 
2890 			  case 'N':
2891 				if (atol(&lbuf[1]) == 0)
2892 					w->w_tooyoung = false;
2893 				break;
2894 			}
2895 		}
2896 		if (cf != NULL)
2897 			(void) sm_io_close(cf, SM_TIME_DEFAULT);
2898 
2899 		if ((!doall && (shouldqueue(w->w_pri, w->w_ctime) ||
2900 		    w->w_tooyoung)) ||
2901 		    bitset(HAS_QUARANTINE, i) ||
2902 		    bitset(NEED_QUARANTINE, i) ||
2903 		    bitset(NEED_R|NEED_S, i))
2904 		{
2905 			/* don't even bother sorting this job in */
2906 			if (tTd(41, 49))
2907 				sm_dprintf("skipping %s (%x)\n", w->w_name, i);
2908 			sm_free(w->w_name); /* XXX */
2909 			if (w->w_host != NULL)
2910 				sm_free(w->w_host); /* XXX */
2911 			wn--;
2912 		}
2913 		else
2914 			++num_ent;
2915 	}
2916 	(void) closedir(f);
2917 	wn++;
2918 
2919 	i = wn - WorkListCount;
2920 	WorkListCount += SM_MIN(num_ent, WorkListSize);
2921 
2922 	if (more != NULL)
2923 		*more = WorkListCount < wn;
2924 
2925 	if (full != NULL)
2926 		*full = (wn >= MaxQueueRun && MaxQueueRun > 0) ||
2927 			(WorkList == NULL && wn > 0);
2928 
2929 	if (pnentries != NULL)
2930 		*pnentries = nentries;
2931 	return i;
2932 }
2933 /*
2934 **  SORTQ -- sort the work list
2935 **
2936 **	First the old WorkQ is cleared away. Then the WorkList is sorted
2937 **	for all items so that important (higher sorting value) items are not
2938 **	truncated off. Then the most important items are moved from
2939 **	WorkList to WorkQ. The lower count of 'max' or MaxListCount items
2940 **	are moved.
2941 **
2942 **	Parameters:
2943 **		max -- maximum number of items to be placed in WorkQ
2944 **
2945 **	Returns:
2946 **		the number of items in WorkQ
2947 **
2948 **	Side Effects:
2949 **		WorkQ gets released and filled with new work. WorkList
2950 **		gets released. Work items get sorted in order.
2951 */
2952 
2953 static int
2954 sortq(max)
2955 	int max;
2956 {
2957 	register int i;			/* local counter */
2958 	register WORK *w;		/* tmp item pointer */
2959 	int wc = WorkListCount;		/* trim size for WorkQ */
2960 
2961 	if (WorkQ != NULL)
2962 	{
2963 		WORK *nw;
2964 
2965 		/* Clear out old WorkQ. */
2966 		for (w = WorkQ; w != NULL; w = nw)
2967 		{
2968 			nw = w->w_next;
2969 			sm_free(w->w_name); /* XXX */
2970 			if (w->w_host != NULL)
2971 				sm_free(w->w_host); /* XXX */
2972 			sm_free((char *) w); /* XXX */
2973 		}
2974 		WorkQ = NULL;
2975 	}
2976 
2977 	if (WorkList == NULL || wc <= 0)
2978 		return 0;
2979 
2980 	/*
2981 	**  The sort now takes place using all of the items in WorkList.
2982 	**  The list gets trimmed to the most important items after the sort.
2983 	**  If the trim were to happen before the sort then one or more
2984 	**  important items might get truncated off -- not what we want.
2985 	*/
2986 
2987 	if (QueueSortOrder == QSO_BYHOST)
2988 	{
2989 		/*
2990 		**  Sort the work directory for the first time,
2991 		**  based on host name, lock status, and priority.
2992 		*/
2993 
2994 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf1);
2995 
2996 		/*
2997 		**  If one message to host is locked, "lock" all messages
2998 		**  to that host.
2999 		*/
3000 
3001 		i = 0;
3002 		while (i < wc)
3003 		{
3004 			if (!WorkList[i].w_lock)
3005 			{
3006 				i++;
3007 				continue;
3008 			}
3009 			w = &WorkList[i];
3010 			while (++i < wc)
3011 			{
3012 				if (WorkList[i].w_host == NULL &&
3013 				    w->w_host == NULL)
3014 					WorkList[i].w_lock = true;
3015 				else if (WorkList[i].w_host != NULL &&
3016 					 w->w_host != NULL &&
3017 					 sm_strcasecmp(WorkList[i].w_host,
3018 						       w->w_host) == 0)
3019 					WorkList[i].w_lock = true;
3020 				else
3021 					break;
3022 			}
3023 		}
3024 
3025 		/*
3026 		**  Sort the work directory for the second time,
3027 		**  based on lock status, host name, and priority.
3028 		*/
3029 
3030 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf2);
3031 	}
3032 	else if (QueueSortOrder == QSO_BYTIME)
3033 	{
3034 		/*
3035 		**  Simple sort based on submission time only.
3036 		*/
3037 
3038 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf3);
3039 	}
3040 	else if (QueueSortOrder == QSO_BYFILENAME)
3041 	{
3042 		/*
3043 		**  Sort based on queue filename.
3044 		*/
3045 
3046 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf4);
3047 	}
3048 	else if (QueueSortOrder == QSO_RANDOM)
3049 	{
3050 		/*
3051 		**  Sort randomly.  To avoid problems with an instable sort,
3052 		**  use a random index into the queue file name to start
3053 		**  comparison.
3054 		*/
3055 
3056 		randi = get_rand_mod(MAXQFNAME);
3057 		if (randi < 2)
3058 			randi = 3;
3059 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf5);
3060 	}
3061 	else if (QueueSortOrder == QSO_BYMODTIME)
3062 	{
3063 		/*
3064 		**  Simple sort based on modification time of queue file.
3065 		**  This puts the oldest items first.
3066 		*/
3067 
3068 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf6);
3069 	}
3070 #if _FFR_RHS
3071 	else if (QueueSortOrder == QSO_BYSHUFFLE)
3072 	{
3073 		/*
3074 		**  Simple sort based on shuffled host name.
3075 		*/
3076 
3077 		init_shuffle_alphabet();
3078 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf7);
3079 	}
3080 #endif /* _FFR_RHS */
3081 	else if (QueueSortOrder == QSO_BYPRIORITY)
3082 	{
3083 		/*
3084 		**  Simple sort based on queue priority only.
3085 		*/
3086 
3087 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf0);
3088 	}
3089 	/* else don't sort at all */
3090 
3091 	/* Check if the per queue group item limit will be exceeded */
3092 	if (wc > max && max > 0)
3093 		wc = max;
3094 
3095 	/*
3096 	**  Convert the work list into canonical form.
3097 	**	Should be turning it into a list of envelopes here perhaps.
3098 	**  Only take the most important items up to the per queue group
3099 	**  maximum.
3100 	*/
3101 
3102 	for (i = wc; --i >= 0; )
3103 	{
3104 		w = (WORK *) xalloc(sizeof(*w));
3105 		w->w_qgrp = WorkList[i].w_qgrp;
3106 		w->w_qdir = WorkList[i].w_qdir;
3107 		w->w_name = WorkList[i].w_name;
3108 		w->w_host = WorkList[i].w_host;
3109 		w->w_lock = WorkList[i].w_lock;
3110 		w->w_tooyoung = WorkList[i].w_tooyoung;
3111 		w->w_pri = WorkList[i].w_pri;
3112 		w->w_ctime = WorkList[i].w_ctime;
3113 		w->w_mtime = WorkList[i].w_mtime;
3114 		w->w_next = WorkQ;
3115 		WorkQ = w;
3116 	}
3117 
3118 	/* free the rest of the list */
3119 	for (i = WorkListCount; --i >= wc; )
3120 	{
3121 		sm_free(WorkList[i].w_name);
3122 		if (WorkList[i].w_host != NULL)
3123 			sm_free(WorkList[i].w_host);
3124 	}
3125 
3126 	if (WorkList != NULL)
3127 		sm_free(WorkList); /* XXX */
3128 	WorkList = NULL;
3129 	WorkListSize = 0;
3130 	WorkListCount = 0;
3131 
3132 	if (tTd(40, 1))
3133 	{
3134 		for (w = WorkQ; w != NULL; w = w->w_next)
3135 		{
3136 			if (w->w_host != NULL)
3137 				sm_dprintf("%22s: pri=%ld %s\n",
3138 					w->w_name, w->w_pri, w->w_host);
3139 			else
3140 				sm_dprintf("%32s: pri=%ld\n",
3141 					w->w_name, w->w_pri);
3142 		}
3143 	}
3144 
3145 	return wc; /* return number of WorkQ items */
3146 }
3147 /*
3148 **  GROW_WLIST -- make the work list larger
3149 **
3150 **	Parameters:
3151 **		qgrp -- the index for the queue group.
3152 **		qdir -- the index for the queue directory.
3153 **
3154 **	Returns:
3155 **		none.
3156 **
3157 **	Side Effects:
3158 **		Adds another QUEUESEGSIZE entries to WorkList if possible.
3159 **		It can fail if there isn't enough memory, so WorkListSize
3160 **		should be checked again upon return.
3161 */
3162 
3163 static void
3164 grow_wlist(qgrp, qdir)
3165 	int qgrp;
3166 	int qdir;
3167 {
3168 	if (tTd(41, 1))
3169 		sm_dprintf("grow_wlist: WorkListSize=%d\n", WorkListSize);
3170 	if (WorkList == NULL)
3171 	{
3172 		WorkList = (WORK *) xalloc((sizeof(*WorkList)) *
3173 					   (QUEUESEGSIZE + 1));
3174 		WorkListSize = QUEUESEGSIZE;
3175 	}
3176 	else
3177 	{
3178 		int newsize = WorkListSize + QUEUESEGSIZE;
3179 		WORK *newlist = (WORK *) sm_realloc((char *) WorkList,
3180 					  (unsigned) sizeof(WORK) * (newsize + 1));
3181 
3182 		if (newlist != NULL)
3183 		{
3184 			WorkListSize = newsize;
3185 			WorkList = newlist;
3186 			if (LogLevel > 1)
3187 			{
3188 				sm_syslog(LOG_INFO, NOQID,
3189 					  "grew WorkList for %s to %d",
3190 					  qid_printqueue(qgrp, qdir),
3191 					  WorkListSize);
3192 			}
3193 		}
3194 		else if (LogLevel > 0)
3195 		{
3196 			sm_syslog(LOG_ALERT, NOQID,
3197 				  "FAILED to grow WorkList for %s to %d",
3198 				  qid_printqueue(qgrp, qdir), newsize);
3199 		}
3200 	}
3201 	if (tTd(41, 1))
3202 		sm_dprintf("grow_wlist: WorkListSize now %d\n", WorkListSize);
3203 }
3204 /*
3205 **  WORKCMPF0 -- simple priority-only compare function.
3206 **
3207 **	Parameters:
3208 **		a -- the first argument.
3209 **		b -- the second argument.
3210 **
3211 **	Returns:
3212 **		-1 if a < b
3213 **		 0 if a == b
3214 **		+1 if a > b
3215 **
3216 */
3217 
3218 static int
3219 workcmpf0(a, b)
3220 	register WORK *a;
3221 	register WORK *b;
3222 {
3223 	long pa = a->w_pri;
3224 	long pb = b->w_pri;
3225 
3226 	if (pa == pb)
3227 		return 0;
3228 	else if (pa > pb)
3229 		return 1;
3230 	else
3231 		return -1;
3232 }
3233 /*
3234 **  WORKCMPF1 -- first compare function for ordering work based on host name.
3235 **
3236 **	Sorts on host name, lock status, and priority in that order.
3237 **
3238 **	Parameters:
3239 **		a -- the first argument.
3240 **		b -- the second argument.
3241 **
3242 **	Returns:
3243 **		<0 if a < b
3244 **		 0 if a == b
3245 **		>0 if a > b
3246 **
3247 */
3248 
3249 static int
3250 workcmpf1(a, b)
3251 	register WORK *a;
3252 	register WORK *b;
3253 {
3254 	int i;
3255 
3256 	/* host name */
3257 	if (a->w_host != NULL && b->w_host == NULL)
3258 		return 1;
3259 	else if (a->w_host == NULL && b->w_host != NULL)
3260 		return -1;
3261 	if (a->w_host != NULL && b->w_host != NULL &&
3262 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3263 		return i;
3264 
3265 	/* lock status */
3266 	if (a->w_lock != b->w_lock)
3267 		return b->w_lock - a->w_lock;
3268 
3269 	/* job priority */
3270 	return workcmpf0(a, b);
3271 }
3272 /*
3273 **  WORKCMPF2 -- second compare function for ordering work based on host name.
3274 **
3275 **	Sorts on lock status, host name, and priority in that order.
3276 **
3277 **	Parameters:
3278 **		a -- the first argument.
3279 **		b -- the second argument.
3280 **
3281 **	Returns:
3282 **		<0 if a < b
3283 **		 0 if a == b
3284 **		>0 if a > b
3285 **
3286 */
3287 
3288 static int
3289 workcmpf2(a, b)
3290 	register WORK *a;
3291 	register WORK *b;
3292 {
3293 	int i;
3294 
3295 	/* lock status */
3296 	if (a->w_lock != b->w_lock)
3297 		return a->w_lock - b->w_lock;
3298 
3299 	/* host name */
3300 	if (a->w_host != NULL && b->w_host == NULL)
3301 		return 1;
3302 	else if (a->w_host == NULL && b->w_host != NULL)
3303 		return -1;
3304 	if (a->w_host != NULL && b->w_host != NULL &&
3305 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3306 		return i;
3307 
3308 	/* job priority */
3309 	return workcmpf0(a, b);
3310 }
3311 /*
3312 **  WORKCMPF3 -- simple submission-time-only compare function.
3313 **
3314 **	Parameters:
3315 **		a -- the first argument.
3316 **		b -- the second argument.
3317 **
3318 **	Returns:
3319 **		-1 if a < b
3320 **		 0 if a == b
3321 **		+1 if a > b
3322 **
3323 */
3324 
3325 static int
3326 workcmpf3(a, b)
3327 	register WORK *a;
3328 	register WORK *b;
3329 {
3330 	if (a->w_ctime > b->w_ctime)
3331 		return 1;
3332 	else if (a->w_ctime < b->w_ctime)
3333 		return -1;
3334 	else
3335 		return 0;
3336 }
3337 /*
3338 **  WORKCMPF4 -- compare based on file name
3339 **
3340 **	Parameters:
3341 **		a -- the first argument.
3342 **		b -- the second argument.
3343 **
3344 **	Returns:
3345 **		-1 if a < b
3346 **		 0 if a == b
3347 **		+1 if a > b
3348 **
3349 */
3350 
3351 static int
3352 workcmpf4(a, b)
3353 	register WORK *a;
3354 	register WORK *b;
3355 {
3356 	return strcmp(a->w_name, b->w_name);
3357 }
3358 /*
3359 **  WORKCMPF5 -- compare based on assigned random number
3360 **
3361 **	Parameters:
3362 **		a -- the first argument.
3363 **		b -- the second argument.
3364 **
3365 **	Returns:
3366 **		randomly 1/-1
3367 */
3368 
3369 /* ARGSUSED0 */
3370 static int
3371 workcmpf5(a, b)
3372 	register WORK *a;
3373 	register WORK *b;
3374 {
3375 	if (strlen(a->w_name) < randi || strlen(b->w_name) < randi)
3376 		return -1;
3377 	return a->w_name[randi] - b->w_name[randi];
3378 }
3379 /*
3380 **  WORKCMPF6 -- simple modification-time-only compare function.
3381 **
3382 **	Parameters:
3383 **		a -- the first argument.
3384 **		b -- the second argument.
3385 **
3386 **	Returns:
3387 **		-1 if a < b
3388 **		 0 if a == b
3389 **		+1 if a > b
3390 **
3391 */
3392 
3393 static int
3394 workcmpf6(a, b)
3395 	register WORK *a;
3396 	register WORK *b;
3397 {
3398 	if (a->w_mtime > b->w_mtime)
3399 		return 1;
3400 	else if (a->w_mtime < b->w_mtime)
3401 		return -1;
3402 	else
3403 		return 0;
3404 }
3405 #if _FFR_RHS
3406 /*
3407 **  WORKCMPF7 -- compare function for ordering work based on shuffled host name.
3408 **
3409 **	Sorts on lock status, host name, and priority in that order.
3410 **
3411 **	Parameters:
3412 **		a -- the first argument.
3413 **		b -- the second argument.
3414 **
3415 **	Returns:
3416 **		<0 if a < b
3417 **		 0 if a == b
3418 **		>0 if a > b
3419 **
3420 */
3421 
3422 static int
3423 workcmpf7(a, b)
3424 	register WORK *a;
3425 	register WORK *b;
3426 {
3427 	int i;
3428 
3429 	/* lock status */
3430 	if (a->w_lock != b->w_lock)
3431 		return a->w_lock - b->w_lock;
3432 
3433 	/* host name */
3434 	if (a->w_host != NULL && b->w_host == NULL)
3435 		return 1;
3436 	else if (a->w_host == NULL && b->w_host != NULL)
3437 		return -1;
3438 	if (a->w_host != NULL && b->w_host != NULL &&
3439 	    (i = sm_strshufflecmp(a->w_host, b->w_host)) != 0)
3440 		return i;
3441 
3442 	/* job priority */
3443 	return workcmpf0(a, b);
3444 }
3445 #endif /* _FFR_RHS */
3446 /*
3447 **  STRREV -- reverse string
3448 **
3449 **	Returns a pointer to a new string that is the reverse of
3450 **	the string pointed to by fwd.  The space for the new
3451 **	string is obtained using xalloc().
3452 **
3453 **	Parameters:
3454 **		fwd -- the string to reverse.
3455 **
3456 **	Returns:
3457 **		the reversed string.
3458 */
3459 
3460 static char *
3461 strrev(fwd)
3462 	char *fwd;
3463 {
3464 	char *rev = NULL;
3465 	int len, cnt;
3466 
3467 	len = strlen(fwd);
3468 	rev = xalloc(len + 1);
3469 	for (cnt = 0; cnt < len; ++cnt)
3470 		rev[cnt] = fwd[len - cnt - 1];
3471 	rev[len] = '\0';
3472 	return rev;
3473 }
3474 
3475 #if _FFR_RHS
3476 
3477 # define NASCII	128
3478 # define NCHAR	256
3479 
3480 static unsigned char ShuffledAlphabet[NCHAR];
3481 
3482 void
3483 init_shuffle_alphabet()
3484 {
3485 	static bool init = false;
3486 	int i;
3487 
3488 	if (init)
3489 		return;
3490 
3491 	/* fill the ShuffledAlphabet */
3492 	for (i = 0; i < NASCII; i++)
3493 		ShuffledAlphabet[i] = i;
3494 
3495 	/* mix it */
3496 	for (i = 1; i < NASCII; i++)
3497 	{
3498 		register int j = get_random() % NASCII;
3499 		register int tmp;
3500 
3501 		tmp = ShuffledAlphabet[j];
3502 		ShuffledAlphabet[j] = ShuffledAlphabet[i];
3503 		ShuffledAlphabet[i] = tmp;
3504 	}
3505 
3506 	/* make it case insensitive */
3507 	for (i = 'A'; i <= 'Z'; i++)
3508 		ShuffledAlphabet[i] = ShuffledAlphabet[i + 'a' - 'A'];
3509 
3510 	/* fill the upper part */
3511 	for (i = 0; i < NASCII; i++)
3512 		ShuffledAlphabet[i + NASCII] = ShuffledAlphabet[i];
3513 	init = true;
3514 }
3515 
3516 static int
3517 sm_strshufflecmp(a, b)
3518 	char *a;
3519 	char *b;
3520 {
3521 	const unsigned char *us1 = (const unsigned char *) a;
3522 	const unsigned char *us2 = (const unsigned char *) b;
3523 
3524 	while (ShuffledAlphabet[*us1] == ShuffledAlphabet[*us2++])
3525 	{
3526 		if (*us1++ == '\0')
3527 			return 0;
3528 	}
3529 	return (ShuffledAlphabet[*us1] - ShuffledAlphabet[*--us2]);
3530 }
3531 #endif /* _FFR_RHS */
3532 
3533 /*
3534 **  DOWORK -- do a work request.
3535 **
3536 **	Parameters:
3537 **		qgrp -- the index of the queue group for the job.
3538 **		qdir -- the index of the queue directory for the job.
3539 **		id -- the ID of the job to run.
3540 **		forkflag -- if set, run this in background.
3541 **		requeueflag -- if set, reinstantiate the queue quickly.
3542 **			This is used when expanding aliases in the queue.
3543 **			If forkflag is also set, it doesn't wait for the
3544 **			child.
3545 **		e - the envelope in which to run it.
3546 **
3547 **	Returns:
3548 **		process id of process that is running the queue job.
3549 **
3550 **	Side Effects:
3551 **		The work request is satisfied if possible.
3552 */
3553 
3554 pid_t
3555 dowork(qgrp, qdir, id, forkflag, requeueflag, e)
3556 	int qgrp;
3557 	int qdir;
3558 	char *id;
3559 	bool forkflag;
3560 	bool requeueflag;
3561 	register ENVELOPE *e;
3562 {
3563 	register pid_t pid;
3564 	SM_RPOOL_T *rpool;
3565 
3566 	if (tTd(40, 1))
3567 		sm_dprintf("dowork(%s/%s)\n", qid_printqueue(qgrp, qdir), id);
3568 
3569 	/*
3570 	**  Fork for work.
3571 	*/
3572 
3573 	if (forkflag)
3574 	{
3575 		/*
3576 		**  Since the delivery may happen in a child and the
3577 		**  parent does not wait, the parent may close the
3578 		**  maps thereby removing any shared memory used by
3579 		**  the map.  Therefore, close the maps now so the
3580 		**  child will dynamically open them if necessary.
3581 		*/
3582 
3583 		closemaps(false);
3584 
3585 		pid = fork();
3586 		if (pid < 0)
3587 		{
3588 			syserr("dowork: cannot fork");
3589 			return 0;
3590 		}
3591 		else if (pid > 0)
3592 		{
3593 			/* parent -- clean out connection cache */
3594 			mci_flush(false, NULL);
3595 		}
3596 		else
3597 		{
3598 			/*
3599 			**  Initialize exception stack and default exception
3600 			**  handler for child process.
3601 			*/
3602 
3603 			/* Reset global flags */
3604 			RestartRequest = NULL;
3605 			RestartWorkGroup = false;
3606 			ShutdownRequest = NULL;
3607 			PendingSignal = 0;
3608 			CurrentPid = getpid();
3609 			sm_exc_newthread(fatal_error);
3610 
3611 			/*
3612 			**  See note above about SMTP processes and SIGCHLD.
3613 			*/
3614 
3615 			if (OpMode == MD_SMTP ||
3616 			    OpMode == MD_DAEMON ||
3617 			    MaxQueueChildren > 0)
3618 			{
3619 				proc_list_clear();
3620 				sm_releasesignal(SIGCHLD);
3621 				(void) sm_signal(SIGCHLD, SIG_DFL);
3622 			}
3623 
3624 			/* child -- error messages to the transcript */
3625 			QuickAbort = OnlyOneError = false;
3626 		}
3627 	}
3628 	else
3629 	{
3630 		pid = 0;
3631 	}
3632 
3633 	if (pid == 0)
3634 	{
3635 		/*
3636 		**  CHILD
3637 		**	Lock the control file to avoid duplicate deliveries.
3638 		**		Then run the file as though we had just read it.
3639 		**	We save an idea of the temporary name so we
3640 		**		can recover on interrupt.
3641 		*/
3642 
3643 		if (forkflag)
3644 		{
3645 			/* Reset global flags */
3646 			RestartRequest = NULL;
3647 			RestartWorkGroup = false;
3648 			ShutdownRequest = NULL;
3649 			PendingSignal = 0;
3650 		}
3651 
3652 		/* set basic modes, etc. */
3653 		sm_clear_events();
3654 		clearstats();
3655 		rpool = sm_rpool_new_x(NULL);
3656 		clearenvelope(e, false, rpool);
3657 		e->e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3658 		set_delivery_mode(SM_DELIVER, e);
3659 		e->e_errormode = EM_MAIL;
3660 		e->e_id = id;
3661 		e->e_qgrp = qgrp;
3662 		e->e_qdir = qdir;
3663 		GrabTo = UseErrorsTo = false;
3664 		ExitStat = EX_OK;
3665 		if (forkflag)
3666 		{
3667 			disconnect(1, e);
3668 			set_op_mode(MD_QUEUERUN);
3669 		}
3670 		sm_setproctitle(true, e, "%s from queue", qid_printname(e));
3671 		if (LogLevel > 76)
3672 			sm_syslog(LOG_DEBUG, e->e_id, "dowork, pid=%d",
3673 				  (int) CurrentPid);
3674 
3675 		/* don't use the headers from sendmail.cf... */
3676 		e->e_header = NULL;
3677 
3678 		/* read the queue control file -- return if locked */
3679 		if (!readqf(e, false))
3680 		{
3681 			if (tTd(40, 4) && e->e_id != NULL)
3682 				sm_dprintf("readqf(%s) failed\n",
3683 					qid_printname(e));
3684 			e->e_id = NULL;
3685 			if (forkflag)
3686 				finis(false, true, EX_OK);
3687 			else
3688 			{
3689 				/* adding this frees 8 bytes */
3690 				clearenvelope(e, false, rpool);
3691 
3692 				/* adding this frees 12 bytes */
3693 				sm_rpool_free(rpool);
3694 				e->e_rpool = NULL;
3695 				return 0;
3696 			}
3697 		}
3698 
3699 		e->e_flags |= EF_INQUEUE;
3700 		eatheader(e, requeueflag, true);
3701 
3702 		if (requeueflag)
3703 			queueup(e, false, false);
3704 
3705 		/* do the delivery */
3706 		sendall(e, SM_DELIVER);
3707 
3708 		/* finish up and exit */
3709 		if (forkflag)
3710 			finis(true, true, ExitStat);
3711 		else
3712 		{
3713 			(void) dropenvelope(e, true, false);
3714 			sm_rpool_free(rpool);
3715 			e->e_rpool = NULL;
3716 			e->e_message = NULL;
3717 		}
3718 	}
3719 	e->e_id = NULL;
3720 	return pid;
3721 }
3722 
3723 /*
3724 **  DOWORKLIST -- process a list of envelopes as work requests
3725 **
3726 **	Similar to dowork(), except that after forking, it processes an
3727 **	envelope and its siblings, treating each envelope as a work request.
3728 **
3729 **	Parameters:
3730 **		el -- envelope to be processed including its siblings.
3731 **		forkflag -- if set, run this in background.
3732 **		requeueflag -- if set, reinstantiate the queue quickly.
3733 **			This is used when expanding aliases in the queue.
3734 **			If forkflag is also set, it doesn't wait for the
3735 **			child.
3736 **
3737 **	Returns:
3738 **		process id of process that is running the queue job.
3739 **
3740 **	Side Effects:
3741 **		The work request is satisfied if possible.
3742 */
3743 
3744 pid_t
3745 doworklist(el, forkflag, requeueflag)
3746 	ENVELOPE *el;
3747 	bool forkflag;
3748 	bool requeueflag;
3749 {
3750 	register pid_t pid;
3751 	ENVELOPE *ei;
3752 
3753 	if (tTd(40, 1))
3754 		sm_dprintf("doworklist()\n");
3755 
3756 	/*
3757 	**  Fork for work.
3758 	*/
3759 
3760 	if (forkflag)
3761 	{
3762 		/*
3763 		**  Since the delivery may happen in a child and the
3764 		**  parent does not wait, the parent may close the
3765 		**  maps thereby removing any shared memory used by
3766 		**  the map.  Therefore, close the maps now so the
3767 		**  child will dynamically open them if necessary.
3768 		*/
3769 
3770 		closemaps(false);
3771 
3772 		pid = fork();
3773 		if (pid < 0)
3774 		{
3775 			syserr("doworklist: cannot fork");
3776 			return 0;
3777 		}
3778 		else if (pid > 0)
3779 		{
3780 			/* parent -- clean out connection cache */
3781 			mci_flush(false, NULL);
3782 		}
3783 		else
3784 		{
3785 			/*
3786 			**  Initialize exception stack and default exception
3787 			**  handler for child process.
3788 			*/
3789 
3790 			/* Reset global flags */
3791 			RestartRequest = NULL;
3792 			RestartWorkGroup = false;
3793 			ShutdownRequest = NULL;
3794 			PendingSignal = 0;
3795 			CurrentPid = getpid();
3796 			sm_exc_newthread(fatal_error);
3797 
3798 			/*
3799 			**  See note above about SMTP processes and SIGCHLD.
3800 			*/
3801 
3802 			if (OpMode == MD_SMTP ||
3803 			    OpMode == MD_DAEMON ||
3804 			    MaxQueueChildren > 0)
3805 			{
3806 				proc_list_clear();
3807 				sm_releasesignal(SIGCHLD);
3808 				(void) sm_signal(SIGCHLD, SIG_DFL);
3809 			}
3810 
3811 			/* child -- error messages to the transcript */
3812 			QuickAbort = OnlyOneError = false;
3813 		}
3814 	}
3815 	else
3816 	{
3817 		pid = 0;
3818 	}
3819 
3820 	if (pid != 0)
3821 		return pid;
3822 
3823 	/*
3824 	**  IN CHILD
3825 	**	Lock the control file to avoid duplicate deliveries.
3826 	**		Then run the file as though we had just read it.
3827 	**	We save an idea of the temporary name so we
3828 	**		can recover on interrupt.
3829 	*/
3830 
3831 	if (forkflag)
3832 	{
3833 		/* Reset global flags */
3834 		RestartRequest = NULL;
3835 		RestartWorkGroup = false;
3836 		ShutdownRequest = NULL;
3837 		PendingSignal = 0;
3838 	}
3839 
3840 	/* set basic modes, etc. */
3841 	sm_clear_events();
3842 	clearstats();
3843 	GrabTo = UseErrorsTo = false;
3844 	ExitStat = EX_OK;
3845 	if (forkflag)
3846 	{
3847 		disconnect(1, el);
3848 		set_op_mode(MD_QUEUERUN);
3849 	}
3850 	if (LogLevel > 76)
3851 		sm_syslog(LOG_DEBUG, el->e_id, "doworklist, pid=%d",
3852 			  (int) CurrentPid);
3853 
3854 	for (ei = el; ei != NULL; ei = ei->e_sibling)
3855 	{
3856 		ENVELOPE e;
3857 		SM_RPOOL_T *rpool;
3858 
3859 		if (WILL_BE_QUEUED(ei->e_sendmode))
3860 			continue;
3861 		else if (QueueMode != QM_QUARANTINE &&
3862 			 ei->e_quarmsg != NULL)
3863 			continue;
3864 
3865 		rpool = sm_rpool_new_x(NULL);
3866 		clearenvelope(&e, true, rpool);
3867 		e.e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3868 		set_delivery_mode(SM_DELIVER, &e);
3869 		e.e_errormode = EM_MAIL;
3870 		e.e_id = ei->e_id;
3871 		e.e_qgrp = ei->e_qgrp;
3872 		e.e_qdir = ei->e_qdir;
3873 		openxscript(&e);
3874 		sm_setproctitle(true, &e, "%s from queue", qid_printname(&e));
3875 
3876 		/* don't use the headers from sendmail.cf... */
3877 		e.e_header = NULL;
3878 		CurEnv = &e;
3879 
3880 		/* read the queue control file -- return if locked */
3881 		if (readqf(&e, false))
3882 		{
3883 			e.e_flags |= EF_INQUEUE;
3884 			eatheader(&e, requeueflag, true);
3885 
3886 			if (requeueflag)
3887 				queueup(&e, false, false);
3888 
3889 			/* do the delivery */
3890 			sendall(&e, SM_DELIVER);
3891 			(void) dropenvelope(&e, true, false);
3892 		}
3893 		else
3894 		{
3895 			if (tTd(40, 4) && e.e_id != NULL)
3896 				sm_dprintf("readqf(%s) failed\n",
3897 					qid_printname(&e));
3898 		}
3899 		sm_rpool_free(rpool);
3900 		ei->e_id = NULL;
3901 	}
3902 
3903 	/* restore CurEnv */
3904 	CurEnv = el;
3905 
3906 	/* finish up and exit */
3907 	if (forkflag)
3908 		finis(true, true, ExitStat);
3909 	return 0;
3910 }
3911 /*
3912 **  READQF -- read queue file and set up environment.
3913 **
3914 **	Parameters:
3915 **		e -- the envelope of the job to run.
3916 **		openonly -- only open the qf (returned as e_lockfp)
3917 **
3918 **	Returns:
3919 **		true if it successfully read the queue file.
3920 **		false otherwise.
3921 **
3922 **	Side Effects:
3923 **		The queue file is returned locked.
3924 */
3925 
3926 static bool
3927 readqf(e, openonly)
3928 	register ENVELOPE *e;
3929 	bool openonly;
3930 {
3931 	register SM_FILE_T *qfp;
3932 	ADDRESS *ctladdr;
3933 	struct stat st, stf;
3934 	char *bp;
3935 	int qfver = 0;
3936 	long hdrsize = 0;
3937 	register char *p;
3938 	char *frcpt = NULL;
3939 	char *orcpt = NULL;
3940 	bool nomore = false;
3941 	bool bogus = false;
3942 	MODE_T qsafe;
3943 	char *err;
3944 	char qf[MAXPATHLEN];
3945 	char buf[MAXLINE];
3946 	int bufsize;
3947 
3948 	/*
3949 	**  Read and process the file.
3950 	*/
3951 
3952 	SM_REQUIRE(e != NULL);
3953 	bp = NULL;
3954 	(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER), sizeof(qf));
3955 	qfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDWR_B, NULL);
3956 	if (qfp == NULL)
3957 	{
3958 		int save_errno = errno;
3959 
3960 		if (tTd(40, 8))
3961 			sm_dprintf("readqf(%s): sm_io_open failure (%s)\n",
3962 				qf, sm_errstring(errno));
3963 		errno = save_errno;
3964 		if (errno != ENOENT
3965 		    )
3966 			syserr("readqf: no control file %s", qf);
3967 		RELEASE_QUEUE;
3968 		return false;
3969 	}
3970 
3971 	if (!lockfile(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), qf, NULL,
3972 		      LOCK_EX|LOCK_NB))
3973 	{
3974 		/* being processed by another queuer */
3975 		if (Verbose)
3976 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3977 					     "%s: locked\n", e->e_id);
3978 		if (tTd(40, 8))
3979 			sm_dprintf("%s: locked\n", e->e_id);
3980 		if (LogLevel > 19)
3981 			sm_syslog(LOG_DEBUG, e->e_id, "locked");
3982 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3983 		RELEASE_QUEUE;
3984 		return false;
3985 	}
3986 
3987 	RELEASE_QUEUE;
3988 
3989 	/*
3990 	**  Prevent locking race condition.
3991 	**
3992 	**  Process A: readqf(): qfp = fopen(qffile)
3993 	**  Process B: queueup(): rename(tf, qf)
3994 	**  Process B: unlocks(tf)
3995 	**  Process A: lockfile(qf);
3996 	**
3997 	**  Process A (us) has the old qf file (before the rename deleted
3998 	**  the directory entry) and will be delivering based on old data.
3999 	**  This can lead to multiple deliveries of the same recipients.
4000 	**
4001 	**  Catch this by checking if the underlying qf file has changed
4002 	**  *after* acquiring our lock and if so, act as though the file
4003 	**  was still locked (i.e., just return like the lockfile() case
4004 	**  above.
4005 	*/
4006 
4007 	if (stat(qf, &stf) < 0 ||
4008 	    fstat(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), &st) < 0)
4009 	{
4010 		/* must have been being processed by someone else */
4011 		if (tTd(40, 8))
4012 			sm_dprintf("readqf(%s): [f]stat failure (%s)\n",
4013 				qf, sm_errstring(errno));
4014 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4015 		return false;
4016 	}
4017 
4018 	if (st.st_nlink != stf.st_nlink ||
4019 	    st.st_dev != stf.st_dev ||
4020 	    ST_INODE(st) != ST_INODE(stf) ||
4021 #if HAS_ST_GEN && 0		/* AFS returns garbage in st_gen */
4022 	    st.st_gen != stf.st_gen ||
4023 #endif /* HAS_ST_GEN && 0 */
4024 	    st.st_uid != stf.st_uid ||
4025 	    st.st_gid != stf.st_gid ||
4026 	    st.st_size != stf.st_size)
4027 	{
4028 		/* changed after opened */
4029 		if (Verbose)
4030 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4031 					     "%s: changed\n", e->e_id);
4032 		if (tTd(40, 8))
4033 			sm_dprintf("%s: changed\n", e->e_id);
4034 		if (LogLevel > 19)
4035 			sm_syslog(LOG_DEBUG, e->e_id, "changed");
4036 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4037 		return false;
4038 	}
4039 
4040 	/*
4041 	**  Check the queue file for plausibility to avoid attacks.
4042 	*/
4043 
4044 	qsafe = S_IWOTH|S_IWGRP;
4045 	if (bitset(S_IWGRP, QueueFileMode))
4046 		qsafe &= ~S_IWGRP;
4047 
4048 	bogus = st.st_uid != geteuid() &&
4049 		st.st_uid != TrustedUid &&
4050 		geteuid() != RealUid;
4051 
4052 	/*
4053 	**  If this qf file results from a set-group-ID binary, then
4054 	**  we check whether the directory is group-writable,
4055 	**  the queue file mode contains the group-writable bit, and
4056 	**  the groups are the same.
4057 	**  Notice: this requires that the set-group-ID binary is used to
4058 	**  run the queue!
4059 	*/
4060 
4061 	if (bogus && st.st_gid == getegid() && UseMSP)
4062 	{
4063 		char delim;
4064 		struct stat dst;
4065 
4066 		bp = SM_LAST_DIR_DELIM(qf);
4067 		if (bp == NULL)
4068 			delim = '\0';
4069 		else
4070 		{
4071 			delim = *bp;
4072 			*bp = '\0';
4073 		}
4074 		if (stat(delim == '\0' ? "." : qf, &dst) < 0)
4075 			syserr("readqf: cannot stat directory %s",
4076 				delim == '\0' ? "." : qf);
4077 		else
4078 		{
4079 			bogus = !(bitset(S_IWGRP, QueueFileMode) &&
4080 				  bitset(S_IWGRP, dst.st_mode) &&
4081 				  dst.st_gid == st.st_gid);
4082 		}
4083 		if (delim != '\0')
4084 			*bp = delim;
4085 		bp = NULL;
4086 	}
4087 	if (!bogus)
4088 		bogus = bitset(qsafe, st.st_mode);
4089 	if (bogus)
4090 	{
4091 		if (LogLevel > 0)
4092 		{
4093 			sm_syslog(LOG_ALERT, e->e_id,
4094 				  "bogus queue file, uid=%ld, gid=%ld, mode=%o",
4095 				  (long) st.st_uid, (long) st.st_gid,
4096 				  (unsigned int) st.st_mode);
4097 		}
4098 		if (tTd(40, 8))
4099 			sm_dprintf("readqf(%s): bogus file\n", qf);
4100 		e->e_flags |= EF_INQUEUE;
4101 		if (!openonly)
4102 			loseqfile(e, "bogus file uid/gid in mqueue");
4103 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4104 		return false;
4105 	}
4106 
4107 	if (st.st_size == 0)
4108 	{
4109 		/* must be a bogus file -- if also old, just remove it */
4110 		if (!openonly && st.st_ctime + 10 * 60 < curtime())
4111 		{
4112 			(void) xunlink(queuename(e, DATAFL_LETTER));
4113 			(void) xunlink(queuename(e, ANYQFL_LETTER));
4114 		}
4115 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4116 		return false;
4117 	}
4118 
4119 	if (st.st_nlink == 0)
4120 	{
4121 		/*
4122 		**  Race condition -- we got a file just as it was being
4123 		**  unlinked.  Just assume it is zero length.
4124 		*/
4125 
4126 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4127 		return false;
4128 	}
4129 
4130 #if _FFR_TRUSTED_QF
4131 	/*
4132 	**  If we don't own the file mark it as unsafe.
4133 	**  However, allow TrustedUser to own it as well
4134 	**  in case TrustedUser manipulates the queue.
4135 	*/
4136 
4137 	if (st.st_uid != geteuid() && st.st_uid != TrustedUid)
4138 		e->e_flags |= EF_UNSAFE;
4139 #else /* _FFR_TRUSTED_QF */
4140 	/* If we don't own the file mark it as unsafe */
4141 	if (st.st_uid != geteuid())
4142 		e->e_flags |= EF_UNSAFE;
4143 #endif /* _FFR_TRUSTED_QF */
4144 
4145 	/* good file -- save this lock */
4146 	e->e_lockfp = qfp;
4147 
4148 	/* Just wanted the open file */
4149 	if (openonly)
4150 		return true;
4151 
4152 	/* do basic system initialization */
4153 	initsys(e);
4154 	macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
4155 
4156 	LineNumber = 0;
4157 	e->e_flags |= EF_GLOBALERRS;
4158 	set_op_mode(MD_QUEUERUN);
4159 	ctladdr = NULL;
4160 	e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
4161 	e->e_dfqgrp = e->e_qgrp;
4162 	e->e_dfqdir = e->e_qdir;
4163 #if _FFR_QUEUE_MACRO
4164 	macdefine(&e->e_macro, A_TEMP, macid("{queue}"),
4165 		  qid_printqueue(e->e_qgrp, e->e_qdir));
4166 #endif /* _FFR_QUEUE_MACRO */
4167 	e->e_dfino = -1;
4168 	e->e_msgsize = -1;
4169 	while (bufsize = sizeof(buf),
4170 	       (bp = fgetfolded(buf, &bufsize, qfp)) != NULL)
4171 	{
4172 		unsigned long qflags;
4173 		ADDRESS *q;
4174 		int r;
4175 		time_t now;
4176 		auto char *ep;
4177 
4178 		if (tTd(40, 4))
4179 			sm_dprintf("+++++ %s\n", bp);
4180 		if (nomore)
4181 		{
4182 			/* hack attack */
4183   hackattack:
4184 			syserr("SECURITY ALERT: extra or bogus data in queue file: %s",
4185 			       bp);
4186 			err = "bogus queue line";
4187 			goto fail;
4188 		}
4189 		switch (bp[0])
4190 		{
4191 		  case 'A':		/* AUTH= parameter */
4192 			if (!xtextok(&bp[1]))
4193 				goto hackattack;
4194 			e->e_auth_param = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4195 			break;
4196 
4197 		  case 'B':		/* body type */
4198 			r = check_bodytype(&bp[1]);
4199 			if (!BODYTYPE_VALID(r))
4200 				goto hackattack;
4201 			e->e_bodytype = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4202 			break;
4203 
4204 		  case 'C':		/* specify controlling user */
4205 			ctladdr = setctluser(&bp[1], qfver, e);
4206 			break;
4207 
4208 		  case 'D':		/* data file name */
4209 			/* obsolete -- ignore */
4210 			break;
4211 
4212 		  case 'd':		/* data file directory name */
4213 			{
4214 				int qgrp, qdir;
4215 
4216 #if _FFR_MSP_PARANOIA
4217 				/* forbid queue groups in MSP? */
4218 				if (UseMSP)
4219 					goto hackattack;
4220 #endif /* _FFR_MSP_PARANOIA */
4221 				for (qgrp = 0;
4222 				     qgrp < NumQueue && Queue[qgrp] != NULL;
4223 				     ++qgrp)
4224 				{
4225 					for (qdir = 0;
4226 					     qdir < Queue[qgrp]->qg_numqueues;
4227 					     ++qdir)
4228 					{
4229 						if (strcmp(&bp[1],
4230 							   Queue[qgrp]->qg_qpaths[qdir].qp_name)
4231 						    == 0)
4232 						{
4233 							e->e_dfqgrp = qgrp;
4234 							e->e_dfqdir = qdir;
4235 							goto done;
4236 						}
4237 					}
4238 				}
4239 				err = "bogus queue file directory";
4240 				goto fail;
4241 			  done:
4242 				break;
4243 			}
4244 
4245 		  case 'E':		/* specify error recipient */
4246 			/* no longer used */
4247 			break;
4248 
4249 		  case 'F':		/* flag bits */
4250 			if (strncmp(bp, "From ", 5) == 0)
4251 			{
4252 				/* we are being spoofed! */
4253 				syserr("SECURITY ALERT: bogus qf line %s", bp);
4254 				err = "bogus queue line";
4255 				goto fail;
4256 			}
4257 			for (p = &bp[1]; *p != '\0'; p++)
4258 			{
4259 				switch (*p)
4260 				{
4261 				  case '8':	/* has 8 bit data */
4262 					e->e_flags |= EF_HAS8BIT;
4263 					break;
4264 
4265 				  case 'b':	/* delete Bcc: header */
4266 					e->e_flags |= EF_DELETE_BCC;
4267 					break;
4268 
4269 				  case 'd':	/* envelope has DSN RET= */
4270 					e->e_flags |= EF_RET_PARAM;
4271 					break;
4272 
4273 				  case 'n':	/* don't return body */
4274 					e->e_flags |= EF_NO_BODY_RETN;
4275 					break;
4276 
4277 				  case 'r':	/* response */
4278 					e->e_flags |= EF_RESPONSE;
4279 					break;
4280 
4281 				  case 's':	/* split */
4282 					e->e_flags |= EF_SPLIT;
4283 					break;
4284 
4285 				  case 'w':	/* warning sent */
4286 					e->e_flags |= EF_WARNING;
4287 					break;
4288 				}
4289 			}
4290 			break;
4291 
4292 		  case 'q':		/* quarantine reason */
4293 			e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4294 			macdefine(&e->e_macro, A_PERM,
4295 				  macid("{quarantine}"), e->e_quarmsg);
4296 			break;
4297 
4298 		  case 'H':		/* header */
4299 
4300 			/*
4301 			**  count size before chompheader() destroys the line.
4302 			**  this isn't accurate due to macro expansion, but
4303 			**  better than before. "-3" to skip H?? at least.
4304 			*/
4305 
4306 			hdrsize += strlen(bp) - 3;
4307 			(void) chompheader(&bp[1], CHHDR_QUEUE, NULL, e);
4308 			break;
4309 
4310 		  case 'I':		/* data file's inode number */
4311 			/* regenerated below */
4312 			break;
4313 
4314 		  case 'K':		/* time of last delivery attempt */
4315 			e->e_dtime = atol(&buf[1]);
4316 			break;
4317 
4318 		  case 'L':		/* Solaris Content-Length: */
4319 		  case 'M':		/* message */
4320 			/* ignore this; we want a new message next time */
4321 			break;
4322 
4323 		  case 'N':		/* number of delivery attempts */
4324 			e->e_ntries = atoi(&buf[1]);
4325 
4326 			/* if this has been tried recently, let it be */
4327 			now = curtime();
4328 			if (e->e_ntries > 0 && e->e_dtime <= now &&
4329 			    now < e->e_dtime + MinQueueAge)
4330 			{
4331 				char *howlong;
4332 
4333 				howlong = pintvl(now - e->e_dtime, true);
4334 				if (Verbose)
4335 					(void) sm_io_fprintf(smioout,
4336 							     SM_TIME_DEFAULT,
4337 							     "%s: too young (%s)\n",
4338 							     e->e_id, howlong);
4339 				if (tTd(40, 8))
4340 					sm_dprintf("%s: too young (%s)\n",
4341 						e->e_id, howlong);
4342 				if (LogLevel > 19)
4343 					sm_syslog(LOG_DEBUG, e->e_id,
4344 						  "too young (%s)",
4345 						  howlong);
4346 				e->e_id = NULL;
4347 				unlockqueue(e);
4348 				if (bp != buf)
4349 					sm_free(bp);
4350 				return false;
4351 			}
4352 			macdefine(&e->e_macro, A_TEMP,
4353 				macid("{ntries}"), &buf[1]);
4354 
4355 #if NAMED_BIND
4356 			/* adjust BIND parameters immediately */
4357 			if (e->e_ntries == 0)
4358 			{
4359 				_res.retry = TimeOuts.res_retry[RES_TO_FIRST];
4360 				_res.retrans = TimeOuts.res_retrans[RES_TO_FIRST];
4361 			}
4362 			else
4363 			{
4364 				_res.retry = TimeOuts.res_retry[RES_TO_NORMAL];
4365 				_res.retrans = TimeOuts.res_retrans[RES_TO_NORMAL];
4366 			}
4367 #endif /* NAMED_BIND */
4368 			break;
4369 
4370 		  case 'P':		/* message priority */
4371 			e->e_msgpriority = atol(&bp[1]) + WkTimeFact;
4372 			break;
4373 
4374 		  case 'Q':		/* original recipient */
4375 			orcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4376 			break;
4377 
4378 		  case 'r':		/* final recipient */
4379 			frcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4380 			break;
4381 
4382 		  case 'R':		/* specify recipient */
4383 			p = bp;
4384 			qflags = 0;
4385 			if (qfver >= 1)
4386 			{
4387 				/* get flag bits */
4388 				while (*++p != '\0' && *p != ':')
4389 				{
4390 					switch (*p)
4391 					{
4392 					  case 'N':
4393 						qflags |= QHASNOTIFY;
4394 						break;
4395 
4396 					  case 'S':
4397 						qflags |= QPINGONSUCCESS;
4398 						break;
4399 
4400 					  case 'F':
4401 						qflags |= QPINGONFAILURE;
4402 						break;
4403 
4404 					  case 'D':
4405 						qflags |= QPINGONDELAY;
4406 						break;
4407 
4408 					  case 'P':
4409 						qflags |= QPRIMARY;
4410 						break;
4411 
4412 					  case 'A':
4413 						if (ctladdr != NULL)
4414 							ctladdr->q_flags |= QALIAS;
4415 						break;
4416 
4417 					  case 'B':
4418 						qflags |= QINTBCC;
4419 						break;
4420 
4421 					  case QDYNMAILFLG:
4422 						qflags |= QDYNMAILER;
4423 						break;
4424 
4425 					  default: /* ignore or complain? */
4426 						break;
4427 					}
4428 				}
4429 			}
4430 			else
4431 				qflags |= QPRIMARY;
4432 			macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4433 				((qflags & QINTBCC) != 0) ? "e b" : "e r");
4434 			if (*p != '\0')
4435 				q = parseaddr(++p, NULLADDR, RF_COPYALL, '\0',
4436 						NULL, e, true);
4437 			else
4438 				q = NULL;
4439 			if (q != NULL)
4440 			{
4441 				/* make sure we keep the current qgrp */
4442 				if (ISVALIDQGRP(e->e_qgrp))
4443 					q->q_qgrp = e->e_qgrp;
4444 				q->q_alias = ctladdr;
4445 				if (qfver >= 1)
4446 					q->q_flags &= ~Q_PINGFLAGS;
4447 				q->q_flags |= qflags;
4448 				q->q_finalrcpt = frcpt;
4449 				q->q_orcpt = orcpt;
4450 #if _FFR_RCPTFLAGS
4451 				if (bitset(QDYNMAILER, qflags))
4452 					newmodmailer(q, QDYNMAILFLG);
4453 #endif
4454 				(void) recipient(q, &e->e_sendqueue, 0, e);
4455 			}
4456 			frcpt = NULL;
4457 			orcpt = NULL;
4458 			macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4459 				NULL);
4460 			break;
4461 
4462 		  case 'S':		/* sender */
4463 			setsender(sm_rpool_strdup_x(e->e_rpool, &bp[1]),
4464 				  e, NULL, '\0', true);
4465 			break;
4466 
4467 		  case 'T':		/* init time */
4468 			e->e_ctime = atol(&bp[1]);
4469 			break;
4470 
4471 		  case 'V':		/* queue file version number */
4472 			qfver = atoi(&bp[1]);
4473 			if (qfver <= QF_VERSION)
4474 				break;
4475 			syserr("Version number in queue file (%d) greater than max (%d)",
4476 				qfver, QF_VERSION);
4477 			err = "unsupported queue file version";
4478 			goto fail;
4479 			/* NOTREACHED */
4480 			break;
4481 
4482 		  case 'Z':		/* original envelope id from ESMTP */
4483 			e->e_envid = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4484 			macdefine(&e->e_macro, A_PERM,
4485 				macid("{dsn_envid}"), e->e_envid);
4486 			break;
4487 
4488 		  case '!':		/* deliver by */
4489 
4490 			/* format: flag (1 char) space long-integer */
4491 			e->e_dlvr_flag = buf[1];
4492 			e->e_deliver_by = strtol(&buf[3], NULL, 10);
4493 
4494 		  case '$':		/* define macro */
4495 			{
4496 				char *p;
4497 
4498 				/* XXX elimate p? */
4499 				r = macid_parse(&bp[1], &ep);
4500 				if (r == 0)
4501 					break;
4502 				p = sm_rpool_strdup_x(e->e_rpool, ep);
4503 				macdefine(&e->e_macro, A_PERM, r, p);
4504 			}
4505 			break;
4506 
4507 		  case '.':		/* terminate file */
4508 			nomore = true;
4509 			break;
4510 
4511 		  default:
4512 			syserr("readqf: %s: line %d: bad line \"%s\"",
4513 				qf, LineNumber, shortenstring(bp, MAXSHORTSTR));
4514 			err = "unrecognized line";
4515 			goto fail;
4516 		}
4517 
4518 		if (bp != buf)
4519 			SM_FREE(bp);
4520 	}
4521 
4522 	/*
4523 	**  If we haven't read any lines, this queue file is empty.
4524 	**  Arrange to remove it without referencing any null pointers.
4525 	*/
4526 
4527 	if (LineNumber == 0)
4528 	{
4529 		errno = 0;
4530 		e->e_flags |= EF_CLRQUEUE|EF_FATALERRS|EF_RESPONSE;
4531 		return true;
4532 	}
4533 
4534 	/* Check to make sure we have a complete queue file read */
4535 	if (!nomore)
4536 	{
4537 		syserr("readqf: %s: incomplete queue file read", qf);
4538 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4539 		return false;
4540 	}
4541 
4542 #if _FFR_QF_PARANOIA
4543 	/* Check to make sure key fields were read */
4544 	if (e->e_from.q_mailer == NULL)
4545 	{
4546 		syserr("readqf: %s: sender not specified in queue file", qf);
4547 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4548 		return false;
4549 	}
4550 	/* other checks? */
4551 #endif /* _FFR_QF_PARANOIA */
4552 
4553 	/* possibly set ${dsn_ret} macro */
4554 	if (bitset(EF_RET_PARAM, e->e_flags))
4555 	{
4556 		if (bitset(EF_NO_BODY_RETN, e->e_flags))
4557 			macdefine(&e->e_macro, A_PERM,
4558 				macid("{dsn_ret}"), "hdrs");
4559 		else
4560 			macdefine(&e->e_macro, A_PERM,
4561 				macid("{dsn_ret}"), "full");
4562 	}
4563 
4564 	/*
4565 	**  Arrange to read the data file.
4566 	*/
4567 
4568 	p = queuename(e, DATAFL_LETTER);
4569 	e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, p, SM_IO_RDONLY_B,
4570 			      NULL);
4571 	if (e->e_dfp == NULL)
4572 	{
4573 		syserr("readqf: cannot open %s", p);
4574 	}
4575 	else
4576 	{
4577 		e->e_flags |= EF_HAS_DF;
4578 		if (fstat(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD, NULL), &st)
4579 		    >= 0)
4580 		{
4581 			e->e_msgsize = st.st_size + hdrsize;
4582 			e->e_dfdev = st.st_dev;
4583 			e->e_dfino = ST_INODE(st);
4584 			(void) sm_snprintf(buf, sizeof(buf), "%ld",
4585 					   PRT_NONNEGL(e->e_msgsize));
4586 			macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"),
4587 				  buf);
4588 		}
4589 	}
4590 
4591 	return true;
4592 
4593   fail:
4594 	/*
4595 	**  There was some error reading the qf file (reason is in err var.)
4596 	**  Cleanup:
4597 	**	close file; clear e_lockfp since it is the same as qfp,
4598 	**	hence it is invalid (as file) after qfp is closed;
4599 	**	the qf file is on disk, so set the flag to avoid calling
4600 	**	queueup() with bogus data.
4601 	*/
4602 
4603 	if (bp != buf)
4604 		SM_FREE(bp);
4605 	if (qfp != NULL)
4606 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4607 	e->e_lockfp = NULL;
4608 	e->e_flags |= EF_INQUEUE;
4609 	loseqfile(e, err);
4610 	return false;
4611 }
4612 /*
4613 **  PRTSTR -- print a string, "unprintable" characters are shown as \oct
4614 **
4615 **	Parameters:
4616 **		s -- string to print
4617 **		ml -- maximum length of output
4618 **
4619 **	Returns:
4620 **		number of entries
4621 **
4622 **	Side Effects:
4623 **		Prints a string on stdout.
4624 */
4625 
4626 static void prtstr __P((char *, int));
4627 
4628 #if _FFR_BOUNCE_QUEUE
4629 # define SKIP_BOUNCE_QUEUE	\
4630 		if (i == BounceQueue)	\
4631 			continue;
4632 #else
4633 # define SKIP_BOUNCE_QUEUE
4634 #endif
4635 
4636 static void
4637 prtstr(s, ml)
4638 	char *s;
4639 	int ml;
4640 {
4641 	int c;
4642 
4643 	if (s == NULL)
4644 		return;
4645 	while (ml-- > 0 && ((c = *s++) != '\0'))
4646 	{
4647 		if (c == '\\')
4648 		{
4649 			if (ml-- > 0)
4650 			{
4651 				(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4652 				(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4653 			}
4654 		}
4655 		else if (isascii(c) && isprint(c))
4656 			(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4657 		else
4658 		{
4659 			if ((ml -= 3) > 0)
4660 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4661 						     "\\%03o", c & 0xFF);
4662 		}
4663 	}
4664 }
4665 /*
4666 **  PRINTNQE -- print out number of entries in the mail queue
4667 **
4668 **	Parameters:
4669 **		out -- output file pointer.
4670 **		prefix -- string to output in front of each line.
4671 **
4672 **	Returns:
4673 **		none.
4674 */
4675 
4676 void
4677 printnqe(out, prefix)
4678 	SM_FILE_T *out;
4679 	char *prefix;
4680 {
4681 #if SM_CONF_SHM
4682 	int i, k = 0, nrequests = 0;
4683 	bool unknown = false;
4684 
4685 	if (ShmId == SM_SHM_NO_ID)
4686 	{
4687 		if (prefix == NULL)
4688 			(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4689 					"Data unavailable: shared memory not updated\n");
4690 		else
4691 			(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4692 					"%sNOTCONFIGURED:-1\r\n", prefix);
4693 		return;
4694 	}
4695 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4696 	{
4697 		int j;
4698 
4699 		SKIP_BOUNCE_QUEUE
4700 		k++;
4701 		for (j = 0; j < Queue[i]->qg_numqueues; j++)
4702 		{
4703 			int n;
4704 
4705 			if (StopRequest)
4706 				stop_sendmail();
4707 
4708 			n = QSHM_ENTRIES(Queue[i]->qg_qpaths[j].qp_idx);
4709 			if (prefix != NULL)
4710 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4711 					"%s%s:%d\r\n",
4712 					prefix, qid_printqueue(i, j), n);
4713 			else if (n < 0)
4714 			{
4715 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4716 					"%s: unknown number of entries\n",
4717 					qid_printqueue(i, j));
4718 				unknown = true;
4719 			}
4720 			else if (n == 0)
4721 			{
4722 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4723 					"%s is empty\n",
4724 					qid_printqueue(i, j));
4725 			}
4726 			else if (n > 0)
4727 			{
4728 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4729 					"%s: entries=%d\n",
4730 					qid_printqueue(i, j), n);
4731 				nrequests += n;
4732 				k++;
4733 			}
4734 		}
4735 	}
4736 	if (prefix == NULL && k > 1)
4737 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4738 				     "\t\tTotal requests: %d%s\n",
4739 				     nrequests, unknown ? " (about)" : "");
4740 #else /* SM_CONF_SHM */
4741 	if (prefix == NULL)
4742 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4743 			     "Data unavailable without shared memory support\n");
4744 	else
4745 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4746 			     "%sNOTAVAILABLE:-1\r\n", prefix);
4747 #endif /* SM_CONF_SHM */
4748 }
4749 /*
4750 **  PRINTQUEUE -- print out a representation of the mail queue
4751 **
4752 **	Parameters:
4753 **		none.
4754 **
4755 **	Returns:
4756 **		none.
4757 **
4758 **	Side Effects:
4759 **		Prints a listing of the mail queue on the standard output.
4760 */
4761 
4762 void
4763 printqueue()
4764 {
4765 	int i, k = 0, nrequests = 0;
4766 
4767 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4768 	{
4769 		int j;
4770 
4771 		k++;
4772 		for (j = 0; j < Queue[i]->qg_numqueues; j++)
4773 		{
4774 			if (StopRequest)
4775 				stop_sendmail();
4776 			nrequests += print_single_queue(i, j);
4777 			k++;
4778 		}
4779 	}
4780 	if (k > 1)
4781 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4782 				     "\t\tTotal requests: %d\n",
4783 				     nrequests);
4784 }
4785 /*
4786 **  PRINT_SINGLE_QUEUE -- print out a representation of a single mail queue
4787 **
4788 **	Parameters:
4789 **		qgrp -- the index of the queue group.
4790 **		qdir -- the queue directory.
4791 **
4792 **	Returns:
4793 **		number of requests in mail queue.
4794 **
4795 **	Side Effects:
4796 **		Prints a listing of the mail queue on the standard output.
4797 */
4798 
4799 int
4800 print_single_queue(qgrp, qdir)
4801 	int qgrp;
4802 	int qdir;
4803 {
4804 	register WORK *w;
4805 	SM_FILE_T *f;
4806 	int nrequests;
4807 	char qd[MAXPATHLEN];
4808 	char qddf[MAXPATHLEN];
4809 	char buf[MAXLINE];
4810 
4811 	if (qdir == NOQDIR)
4812 	{
4813 		(void) sm_strlcpy(qd, ".", sizeof(qd));
4814 		(void) sm_strlcpy(qddf, ".", sizeof(qddf));
4815 	}
4816 	else
4817 	{
4818 		(void) sm_strlcpyn(qd, sizeof(qd), 2,
4819 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
4820 			(bitset(QP_SUBQF,
4821 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4822 					? "/qf" : ""));
4823 		(void) sm_strlcpyn(qddf, sizeof(qddf), 2,
4824 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
4825 			(bitset(QP_SUBDF,
4826 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4827 					? "/df" : ""));
4828 	}
4829 
4830 	/*
4831 	**  Check for permission to print the queue
4832 	*/
4833 
4834 	if (bitset(PRIV_RESTRICTMAILQ, PrivacyFlags) && RealUid != 0)
4835 	{
4836 		struct stat st;
4837 #ifdef NGROUPS_MAX
4838 		int n;
4839 		extern GIDSET_T InitialGidSet[NGROUPS_MAX];
4840 #endif /* NGROUPS_MAX */
4841 
4842 		if (stat(qd, &st) < 0)
4843 		{
4844 			syserr("Cannot stat %s",
4845 				qid_printqueue(qgrp, qdir));
4846 			return 0;
4847 		}
4848 #ifdef NGROUPS_MAX
4849 		n = NGROUPS_MAX;
4850 		while (--n >= 0)
4851 		{
4852 			if (InitialGidSet[n] == st.st_gid)
4853 				break;
4854 		}
4855 		if (n < 0 && RealGid != st.st_gid)
4856 #else /* NGROUPS_MAX */
4857 		if (RealGid != st.st_gid)
4858 #endif /* NGROUPS_MAX */
4859 		{
4860 			usrerr("510 You are not permitted to see the queue");
4861 			setstat(EX_NOPERM);
4862 			return 0;
4863 		}
4864 	}
4865 
4866 	/*
4867 	**  Read and order the queue.
4868 	*/
4869 
4870 	nrequests = gatherq(qgrp, qdir, true, NULL, NULL, NULL);
4871 	(void) sortq(Queue[qgrp]->qg_maxlist);
4872 
4873 	/*
4874 	**  Print the work list that we have read.
4875 	*/
4876 
4877 	/* first see if there is anything */
4878 	if (nrequests <= 0)
4879 	{
4880 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%s is empty\n",
4881 				     qid_printqueue(qgrp, qdir));
4882 		return 0;
4883 	}
4884 
4885 	sm_getla();	/* get load average */
4886 
4887 	(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\t\t%s (%d request%s",
4888 			     qid_printqueue(qgrp, qdir),
4889 			     nrequests, nrequests == 1 ? "" : "s");
4890 	if (MaxQueueRun > 0 && nrequests > MaxQueueRun)
4891 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4892 				     ", only %d printed", MaxQueueRun);
4893 	if (Verbose)
4894 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4895 			")\n-----Q-ID----- --Size-- -Priority- ---Q-Time--- --------Sender/Recipient--------\n");
4896 	else
4897 		(void) sm_io_fprintf(smioout,  SM_TIME_DEFAULT,
4898 			")\n-----Q-ID----- --Size-- -----Q-Time----- ------------Sender/Recipient-----------\n");
4899 	for (w = WorkQ; w != NULL; w = w->w_next)
4900 	{
4901 		struct stat st;
4902 		auto time_t submittime = 0;
4903 		long dfsize;
4904 		int flags = 0;
4905 		int qfver;
4906 		char quarmsg[MAXLINE];
4907 		char statmsg[MAXLINE];
4908 		char bodytype[MAXNAME + 1];
4909 		char qf[MAXPATHLEN];
4910 
4911 		if (StopRequest)
4912 			stop_sendmail();
4913 
4914 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%13s",
4915 				     w->w_name + 2);
4916 		(void) sm_strlcpyn(qf, sizeof(qf), 3, qd, "/", w->w_name);
4917 		f = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
4918 			       NULL);
4919 		if (f == NULL)
4920 		{
4921 			if (errno == EPERM)
4922 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4923 						     " (permission denied)\n");
4924 			else if (errno == ENOENT)
4925 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4926 						     " (job completed)\n");
4927 			else
4928 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4929 						     " (%s)\n",
4930 						     sm_errstring(errno));
4931 			errno = 0;
4932 			continue;
4933 		}
4934 		w->w_name[0] = DATAFL_LETTER;
4935 		(void) sm_strlcpyn(qf, sizeof(qf), 3, qddf, "/", w->w_name);
4936 		if (stat(qf, &st) >= 0)
4937 			dfsize = st.st_size;
4938 		else
4939 		{
4940 			ENVELOPE e;
4941 
4942 			/*
4943 			**  Maybe the df file can't be statted because
4944 			**  it is in a different directory than the qf file.
4945 			**  In order to find out, we must read the qf file.
4946 			*/
4947 
4948 			newenvelope(&e, &BlankEnvelope, sm_rpool_new_x(NULL));
4949 			e.e_id = w->w_name + 2;
4950 			e.e_qgrp = qgrp;
4951 			e.e_qdir = qdir;
4952 			dfsize = -1;
4953 			if (readqf(&e, false))
4954 			{
4955 				char *df = queuename(&e, DATAFL_LETTER);
4956 				if (stat(df, &st) >= 0)
4957 					dfsize = st.st_size;
4958 			}
4959 			if (e.e_lockfp != NULL)
4960 			{
4961 				(void) sm_io_close(e.e_lockfp, SM_TIME_DEFAULT);
4962 				e.e_lockfp = NULL;
4963 			}
4964 			clearenvelope(&e, false, e.e_rpool);
4965 			sm_rpool_free(e.e_rpool);
4966 		}
4967 		if (w->w_lock)
4968 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "*");
4969 		else if (QueueMode == QM_LOST)
4970 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "?");
4971 		else if (w->w_tooyoung)
4972 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "-");
4973 		else if (shouldqueue(w->w_pri, w->w_ctime))
4974 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "X");
4975 		else
4976 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, " ");
4977 
4978 		errno = 0;
4979 
4980 		quarmsg[0] = '\0';
4981 		statmsg[0] = bodytype[0] = '\0';
4982 		qfver = 0;
4983 		while (sm_io_fgets(f, SM_TIME_DEFAULT, buf, sizeof(buf)) >= 0)
4984 		{
4985 			register int i;
4986 			register char *p;
4987 
4988 			if (StopRequest)
4989 				stop_sendmail();
4990 
4991 			fixcrlf(buf, true);
4992 			switch (buf[0])
4993 			{
4994 			  case 'V':	/* queue file version */
4995 				qfver = atoi(&buf[1]);
4996 				break;
4997 
4998 			  case 'M':	/* error message */
4999 				if ((i = strlen(&buf[1])) >= sizeof(statmsg))
5000 					i = sizeof(statmsg) - 1;
5001 				memmove(statmsg, &buf[1], i);
5002 				statmsg[i] = '\0';
5003 				break;
5004 
5005 			  case 'q':	/* quarantine reason */
5006 				if ((i = strlen(&buf[1])) >= sizeof(quarmsg))
5007 					i = sizeof(quarmsg) - 1;
5008 				memmove(quarmsg, &buf[1], i);
5009 				quarmsg[i] = '\0';
5010 				break;
5011 
5012 			  case 'B':	/* body type */
5013 				if ((i = strlen(&buf[1])) >= sizeof(bodytype))
5014 					i = sizeof(bodytype) - 1;
5015 				memmove(bodytype, &buf[1], i);
5016 				bodytype[i] = '\0';
5017 				break;
5018 
5019 			  case 'S':	/* sender name */
5020 				if (Verbose)
5021 				{
5022 					(void) sm_io_fprintf(smioout,
5023 						SM_TIME_DEFAULT,
5024 						"%8ld %10ld%c%.12s ",
5025 						dfsize,
5026 						w->w_pri,
5027 						bitset(EF_WARNING, flags)
5028 							? '+' : ' ',
5029 						ctime(&submittime) + 4);
5030 					prtstr(&buf[1], 78);
5031 				}
5032 				else
5033 				{
5034 					(void) sm_io_fprintf(smioout,
5035 						SM_TIME_DEFAULT,
5036 						"%8ld %.16s ",
5037 						dfsize,
5038 						ctime(&submittime));
5039 					prtstr(&buf[1], 39);
5040 				}
5041 
5042 				if (quarmsg[0] != '\0')
5043 				{
5044 					(void) sm_io_fprintf(smioout,
5045 							     SM_TIME_DEFAULT,
5046 							     "\n     QUARANTINE: %.*s",
5047 							     Verbose ? 100 : 60,
5048 							     quarmsg);
5049 					quarmsg[0] = '\0';
5050 				}
5051 
5052 				if (statmsg[0] != '\0' || bodytype[0] != '\0')
5053 				{
5054 					(void) sm_io_fprintf(smioout,
5055 						SM_TIME_DEFAULT,
5056 						"\n    %10.10s",
5057 						bodytype);
5058 					if (statmsg[0] != '\0')
5059 						(void) sm_io_fprintf(smioout,
5060 							SM_TIME_DEFAULT,
5061 							"   (%.*s)",
5062 							Verbose ? 100 : 60,
5063 							statmsg);
5064 					statmsg[0] = '\0';
5065 				}
5066 				break;
5067 
5068 			  case 'C':	/* controlling user */
5069 				if (Verbose)
5070 					(void) sm_io_fprintf(smioout,
5071 						SM_TIME_DEFAULT,
5072 						"\n\t\t\t\t\t\t(---%.64s---)",
5073 						&buf[1]);
5074 				break;
5075 
5076 			  case 'R':	/* recipient name */
5077 				p = &buf[1];
5078 				if (qfver >= 1)
5079 				{
5080 					p = strchr(p, ':');
5081 					if (p == NULL)
5082 						break;
5083 					p++;
5084 				}
5085 				if (Verbose)
5086 				{
5087 					(void) sm_io_fprintf(smioout,
5088 							SM_TIME_DEFAULT,
5089 							"\n\t\t\t\t\t\t");
5090 					prtstr(p, 71);
5091 				}
5092 				else
5093 				{
5094 					(void) sm_io_fprintf(smioout,
5095 							SM_TIME_DEFAULT,
5096 							"\n\t\t\t\t\t ");
5097 					prtstr(p, 38);
5098 				}
5099 				if (Verbose && statmsg[0] != '\0')
5100 				{
5101 					(void) sm_io_fprintf(smioout,
5102 							SM_TIME_DEFAULT,
5103 							"\n\t\t (%.100s)",
5104 							statmsg);
5105 					statmsg[0] = '\0';
5106 				}
5107 				break;
5108 
5109 			  case 'T':	/* creation time */
5110 				submittime = atol(&buf[1]);
5111 				break;
5112 
5113 			  case 'F':	/* flag bits */
5114 				for (p = &buf[1]; *p != '\0'; p++)
5115 				{
5116 					switch (*p)
5117 					{
5118 					  case 'w':
5119 						flags |= EF_WARNING;
5120 						break;
5121 					}
5122 				}
5123 			}
5124 		}
5125 		if (submittime == (time_t) 0)
5126 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
5127 					     " (no control file)");
5128 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\n");
5129 		(void) sm_io_close(f, SM_TIME_DEFAULT);
5130 	}
5131 	return nrequests;
5132 }
5133 
5134 /*
5135 **  QUEUE_LETTER -- get the proper queue letter for the current QueueMode.
5136 **
5137 **	Parameters:
5138 **		e -- envelope to build it in/from.
5139 **		type -- the file type, used as the first character
5140 **			of the file name.
5141 **
5142 **	Returns:
5143 **		the letter to use
5144 */
5145 
5146 static char
5147 queue_letter(e, type)
5148 	ENVELOPE *e;
5149 	int type;
5150 {
5151 	/* Change type according to QueueMode */
5152 	if (type == ANYQFL_LETTER)
5153 	{
5154 		if (e->e_quarmsg != NULL)
5155 			type = QUARQF_LETTER;
5156 		else
5157 		{
5158 			switch (QueueMode)
5159 			{
5160 			  case QM_NORMAL:
5161 				type = NORMQF_LETTER;
5162 				break;
5163 
5164 			  case QM_QUARANTINE:
5165 				type = QUARQF_LETTER;
5166 				break;
5167 
5168 			  case QM_LOST:
5169 				type = LOSEQF_LETTER;
5170 				break;
5171 
5172 			  default:
5173 				/* should never happen */
5174 				abort();
5175 				/* NOTREACHED */
5176 			}
5177 		}
5178 	}
5179 	return type;
5180 }
5181 
5182 /*
5183 **  QUEUENAME -- build a file name in the queue directory for this envelope.
5184 **
5185 **	Parameters:
5186 **		e -- envelope to build it in/from.
5187 **		type -- the file type, used as the first character
5188 **			of the file name.
5189 **
5190 **	Returns:
5191 **		a pointer to the queue name (in a static buffer).
5192 **
5193 **	Side Effects:
5194 **		If no id code is already assigned, queuename() will
5195 **		assign an id code with assign_queueid().  If no queue
5196 **		directory is assigned, one will be set with setnewqueue().
5197 */
5198 
5199 char *
5200 queuename(e, type)
5201 	register ENVELOPE *e;
5202 	int type;
5203 {
5204 	int qd, qg;
5205 	char *sub = "/";
5206 	char pref[3];
5207 	static char buf[MAXPATHLEN];
5208 
5209 	/* Assign an ID if needed */
5210 	if (e->e_id == NULL)
5211 	{
5212 		if (IntSig)
5213 			return NULL;
5214 		assign_queueid(e);
5215 	}
5216 	type = queue_letter(e, type);
5217 
5218 	/* begin of filename */
5219 	pref[0] = (char) type;
5220 	pref[1] = 'f';
5221 	pref[2] = '\0';
5222 
5223 	/* Assign a queue group/directory if needed */
5224 	if (type == XSCRPT_LETTER)
5225 	{
5226 		/*
5227 		**  We don't want to call setnewqueue() if we are fetching
5228 		**  the pathname of the transcript file, because setnewqueue
5229 		**  chooses a queue, and sometimes we need to write to the
5230 		**  transcript file before we have gathered enough information
5231 		**  to choose a queue.
5232 		*/
5233 
5234 		if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5235 		{
5236 			if (e->e_qgrp != NOQGRP && e->e_qdir != NOQDIR)
5237 			{
5238 				e->e_xfqgrp = e->e_qgrp;
5239 				e->e_xfqdir = e->e_qdir;
5240 			}
5241 			else
5242 			{
5243 				e->e_xfqgrp = 0;
5244 				if (Queue[e->e_xfqgrp]->qg_numqueues <= 1)
5245 					e->e_xfqdir = 0;
5246 				else
5247 				{
5248 					e->e_xfqdir = get_rand_mod(
5249 					      Queue[e->e_xfqgrp]->qg_numqueues);
5250 				}
5251 			}
5252 		}
5253 		qd = e->e_xfqdir;
5254 		qg = e->e_xfqgrp;
5255 	}
5256 	else
5257 	{
5258 		if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
5259 		{
5260 			if (IntSig)
5261 				return NULL;
5262 			(void) setnewqueue(e);
5263 		}
5264 		if (type ==  DATAFL_LETTER)
5265 		{
5266 			qd = e->e_dfqdir;
5267 			qg = e->e_dfqgrp;
5268 		}
5269 		else
5270 		{
5271 			qd = e->e_qdir;
5272 			qg = e->e_qgrp;
5273 		}
5274 	}
5275 
5276 	/* xf files always have a valid qd and qg picked above */
5277 	if ((qd == NOQDIR || qg == NOQGRP) && type != XSCRPT_LETTER)
5278 		(void) sm_strlcpyn(buf, sizeof(buf), 2, pref, e->e_id);
5279 	else
5280 	{
5281 		switch (type)
5282 		{
5283 		  case DATAFL_LETTER:
5284 			if (bitset(QP_SUBDF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5285 				sub = "/df/";
5286 			break;
5287 
5288 		  case QUARQF_LETTER:
5289 		  case TEMPQF_LETTER:
5290 		  case NEWQFL_LETTER:
5291 		  case LOSEQF_LETTER:
5292 		  case NORMQF_LETTER:
5293 			if (bitset(QP_SUBQF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5294 				sub = "/qf/";
5295 			break;
5296 
5297 		  case XSCRPT_LETTER:
5298 			if (bitset(QP_SUBXF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5299 				sub = "/xf/";
5300 			break;
5301 
5302 		  default:
5303 			if (IntSig)
5304 				return NULL;
5305 			sm_abort("queuename: bad queue file type %d", type);
5306 		}
5307 
5308 		(void) sm_strlcpyn(buf, sizeof(buf), 4,
5309 				Queue[qg]->qg_qpaths[qd].qp_name,
5310 				sub, pref, e->e_id);
5311 	}
5312 
5313 	if (tTd(7, 2))
5314 		sm_dprintf("queuename: %s\n", buf);
5315 	return buf;
5316 }
5317 
5318 /*
5319 **  INIT_QID_ALG -- Initialize the (static) parameters that are used to
5320 **	generate a queue ID.
5321 **
5322 **	This function is called by the daemon to reset
5323 **	LastQueueTime and LastQueuePid which are used by assign_queueid().
5324 **	Otherwise the algorithm may cause problems because
5325 **	LastQueueTime and LastQueuePid are set indirectly by main()
5326 **	before the daemon process is started, hence LastQueuePid is not
5327 **	the pid of the daemon and therefore a child of the daemon can
5328 **	actually have the same pid as LastQueuePid which means the section
5329 **	in  assign_queueid():
5330 **	* see if we need to get a new base time/pid *
5331 **	is NOT triggered which will cause the same queue id to be generated.
5332 **
5333 **	Parameters:
5334 **		none
5335 **
5336 **	Returns:
5337 **		none.
5338 */
5339 
5340 void
5341 init_qid_alg()
5342 {
5343 	LastQueueTime = 0;
5344 	LastQueuePid = -1;
5345 }
5346 
5347 /*
5348 **  ASSIGN_QUEUEID -- assign a queue ID for this envelope.
5349 **
5350 **	Assigns an id code if one does not already exist.
5351 **	This code assumes that nothing will remain in the queue for
5352 **	longer than 60 years.  It is critical that files with the given
5353 **	name do not already exist in the queue.
5354 **	[No longer initializes e_qdir to NOQDIR.]
5355 **
5356 **	Parameters:
5357 **		e -- envelope to set it in.
5358 **
5359 **	Returns:
5360 **		none.
5361 */
5362 
5363 static const char QueueIdChars[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
5364 # define QIC_LEN	60
5365 # define QIC_LEN_R	62
5366 
5367 /*
5368 **  Note: the length is "officially" 60 because minutes and seconds are
5369 **	usually only 0-59.  However (Linux):
5370 **       tm_sec The number of seconds after the minute, normally in
5371 **		the range 0 to 59, but can be up to 61 to allow for
5372 **		leap seconds.
5373 **	Hence the real length of the string is 62 to take this into account.
5374 **	Alternatively % QIC_LEN can (should) be used for access everywhere.
5375 */
5376 
5377 # define queuenextid() CurrentPid
5378 #define QIC_LEN_SQR	(QIC_LEN * QIC_LEN)
5379 
5380 void
5381 assign_queueid(e)
5382 	register ENVELOPE *e;
5383 {
5384 	pid_t pid = queuenextid();
5385 	static unsigned int cX = 0;
5386 	static unsigned int random_offset;
5387 	struct tm *tm;
5388 	char idbuf[MAXQFNAME - 2];
5389 	unsigned int seq;
5390 
5391 	if (e->e_id != NULL)
5392 		return;
5393 
5394 	/* see if we need to get a new base time/pid */
5395 	if (cX >= QIC_LEN_SQR || LastQueueTime == 0 || LastQueuePid != pid)
5396 	{
5397 		time_t then = LastQueueTime;
5398 
5399 		/* if the first time through, pick a random offset */
5400 		if (LastQueueTime == 0)
5401 			random_offset = ((unsigned int)get_random())
5402 					% QIC_LEN_SQR;
5403 
5404 		while ((LastQueueTime = curtime()) == then &&
5405 		       LastQueuePid == pid)
5406 		{
5407 			(void) sleep(1);
5408 		}
5409 		LastQueuePid = queuenextid();
5410 		cX = 0;
5411 	}
5412 
5413 	/*
5414 	**  Generate a new sequence number between 0 and QIC_LEN_SQR-1.
5415 	**  This lets us generate up to QIC_LEN_SQR unique queue ids
5416 	**  per second, per process.  With envelope splitting,
5417 	**  a single message can consume many queue ids.
5418 	*/
5419 
5420 	seq = (cX + random_offset) % QIC_LEN_SQR;
5421 	++cX;
5422 	if (tTd(7, 50))
5423 		sm_dprintf("assign_queueid: random_offset=%u (%u)\n",
5424 			random_offset, seq);
5425 
5426 	tm = gmtime(&LastQueueTime);
5427 	idbuf[0] = QueueIdChars[tm->tm_year % QIC_LEN];
5428 	idbuf[1] = QueueIdChars[tm->tm_mon];
5429 	idbuf[2] = QueueIdChars[tm->tm_mday];
5430 	idbuf[3] = QueueIdChars[tm->tm_hour];
5431 	idbuf[4] = QueueIdChars[tm->tm_min % QIC_LEN_R];
5432 	idbuf[5] = QueueIdChars[tm->tm_sec % QIC_LEN_R];
5433 	idbuf[6] = QueueIdChars[seq / QIC_LEN];
5434 	idbuf[7] = QueueIdChars[seq % QIC_LEN];
5435 	(void) sm_snprintf(&idbuf[8], sizeof(idbuf) - 8, "%06d",
5436 			   (int) LastQueuePid);
5437 	e->e_id = sm_rpool_strdup_x(e->e_rpool, idbuf);
5438 	macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
5439 #if 0
5440 	/* XXX: inherited from MainEnvelope */
5441 	e->e_qgrp = NOQGRP;  /* too early to do anything else */
5442 	e->e_qdir = NOQDIR;
5443 	e->e_xfqgrp = NOQGRP;
5444 #endif /* 0 */
5445 
5446 	/* New ID means it's not on disk yet */
5447 	e->e_qfletter = '\0';
5448 
5449 	if (tTd(7, 1))
5450 		sm_dprintf("assign_queueid: assigned id %s, e=%p\n",
5451 			e->e_id, e);
5452 	if (LogLevel > 93)
5453 		sm_syslog(LOG_DEBUG, e->e_id, "assigned id");
5454 }
5455 /*
5456 **  SYNC_QUEUE_TIME -- Assure exclusive PID in any given second
5457 **
5458 **	Make sure one PID can't be used by two processes in any one second.
5459 **
5460 **		If the system rotates PIDs fast enough, may get the
5461 **		same pid in the same second for two distinct processes.
5462 **		This will interfere with the queue file naming system.
5463 **
5464 **	Parameters:
5465 **		none
5466 **
5467 **	Returns:
5468 **		none
5469 */
5470 
5471 void
5472 sync_queue_time()
5473 {
5474 #if FAST_PID_RECYCLE
5475 	if (OpMode != MD_TEST &&
5476 	    OpMode != MD_CHECKCONFIG &&
5477 	    OpMode != MD_VERIFY &&
5478 	    LastQueueTime > 0 &&
5479 	    LastQueuePid == CurrentPid &&
5480 	    curtime() == LastQueueTime)
5481 		(void) sleep(1);
5482 #endif /* FAST_PID_RECYCLE */
5483 }
5484 /*
5485 **  UNLOCKQUEUE -- unlock the queue entry for a specified envelope
5486 **
5487 **	Parameters:
5488 **		e -- the envelope to unlock.
5489 **
5490 **	Returns:
5491 **		none
5492 **
5493 **	Side Effects:
5494 **		unlocks the queue for `e'.
5495 */
5496 
5497 void
5498 unlockqueue(e)
5499 	ENVELOPE *e;
5500 {
5501 	if (tTd(51, 4))
5502 		sm_dprintf("unlockqueue(%s)\n",
5503 			e->e_id == NULL ? "NOQUEUE" : e->e_id);
5504 
5505 
5506 	/* if there is a lock file in the envelope, close it */
5507 	if (e->e_lockfp != NULL)
5508 		(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
5509 	e->e_lockfp = NULL;
5510 
5511 	/* don't create a queue id if we don't already have one */
5512 	if (e->e_id == NULL)
5513 		return;
5514 
5515 	/* remove the transcript */
5516 	if (LogLevel > 87)
5517 		sm_syslog(LOG_DEBUG, e->e_id, "unlock");
5518 	if (!tTd(51, 104))
5519 		(void) xunlink(queuename(e, XSCRPT_LETTER));
5520 }
5521 /*
5522 **  SETCTLUSER -- create a controlling address
5523 **
5524 **	Create a fake "address" given only a local login name; this is
5525 **	used as a "controlling user" for future recipient addresses.
5526 **
5527 **	Parameters:
5528 **		user -- the user name of the controlling user.
5529 **		qfver -- the version stamp of this queue file.
5530 **		e -- envelope
5531 **
5532 **	Returns:
5533 **		An address descriptor for the controlling user,
5534 **		using storage allocated from e->e_rpool.
5535 **
5536 */
5537 
5538 static ADDRESS *
5539 setctluser(user, qfver, e)
5540 	char *user;
5541 	int qfver;
5542 	ENVELOPE *e;
5543 {
5544 	register ADDRESS *a;
5545 	struct passwd *pw;
5546 	char *p;
5547 
5548 	/*
5549 	**  See if this clears our concept of controlling user.
5550 	*/
5551 
5552 	if (user == NULL || *user == '\0')
5553 		return NULL;
5554 
5555 	/*
5556 	**  Set up addr fields for controlling user.
5557 	*/
5558 
5559 	a = (ADDRESS *) sm_rpool_malloc_x(e->e_rpool, sizeof(*a));
5560 	memset((char *) a, '\0', sizeof(*a));
5561 
5562 	if (*user == ':')
5563 	{
5564 		p = &user[1];
5565 		a->q_user = sm_rpool_strdup_x(e->e_rpool, p);
5566 	}
5567 	else
5568 	{
5569 		p = strtok(user, ":");
5570 		a->q_user = sm_rpool_strdup_x(e->e_rpool, user);
5571 		if (qfver >= 2)
5572 		{
5573 			if ((p = strtok(NULL, ":")) != NULL)
5574 				a->q_uid = atoi(p);
5575 			if ((p = strtok(NULL, ":")) != NULL)
5576 				a->q_gid = atoi(p);
5577 			if ((p = strtok(NULL, ":")) != NULL)
5578 			{
5579 				char *o;
5580 
5581 				a->q_flags |= QGOODUID;
5582 
5583 				/* if there is another ':': restore it */
5584 				if ((o = strtok(NULL, ":")) != NULL && o > p)
5585 					o[-1] = ':';
5586 			}
5587 		}
5588 		else if ((pw = sm_getpwnam(user)) != NULL)
5589 		{
5590 			if (*pw->pw_dir == '\0')
5591 				a->q_home = NULL;
5592 			else if (strcmp(pw->pw_dir, "/") == 0)
5593 				a->q_home = "";
5594 			else
5595 				a->q_home = sm_rpool_strdup_x(e->e_rpool, pw->pw_dir);
5596 			a->q_uid = pw->pw_uid;
5597 			a->q_gid = pw->pw_gid;
5598 			a->q_flags |= QGOODUID;
5599 		}
5600 	}
5601 
5602 	a->q_flags |= QPRIMARY;		/* flag as a "ctladdr" */
5603 	a->q_mailer = LocalMailer;
5604 	if (p == NULL)
5605 		a->q_paddr = sm_rpool_strdup_x(e->e_rpool, a->q_user);
5606 	else
5607 		a->q_paddr = sm_rpool_strdup_x(e->e_rpool, p);
5608 	return a;
5609 }
5610 /*
5611 **  LOSEQFILE -- rename queue file with LOSEQF_LETTER & try to let someone know
5612 **
5613 **	Parameters:
5614 **		e -- the envelope (e->e_id will be used).
5615 **		why -- reported to whomever can hear.
5616 **
5617 **	Returns:
5618 **		none.
5619 */
5620 
5621 void
5622 loseqfile(e, why)
5623 	register ENVELOPE *e;
5624 	char *why;
5625 {
5626 	bool loseit = true;
5627 	char *p;
5628 	char buf[MAXPATHLEN];
5629 
5630 	if (e == NULL || e->e_id == NULL)
5631 		return;
5632 	p = queuename(e, ANYQFL_LETTER);
5633 	if (sm_strlcpy(buf, p, sizeof(buf)) >= sizeof(buf))
5634 		return;
5635 	if (!bitset(EF_INQUEUE, e->e_flags))
5636 		queueup(e, false, true);
5637 	else if (QueueMode == QM_LOST)
5638 		loseit = false;
5639 
5640 	/* if already lost, no need to re-lose */
5641 	if (loseit)
5642 	{
5643 		p = queuename(e, LOSEQF_LETTER);
5644 		if (rename(buf, p) < 0)
5645 			syserr("cannot rename(%s, %s), uid=%ld",
5646 			       buf, p, (long) geteuid());
5647 		else if (LogLevel > 0)
5648 			sm_syslog(LOG_ALERT, e->e_id,
5649 				  "Losing %s: %s", buf, why);
5650 	}
5651 	if (e->e_dfp != NULL)
5652 	{
5653 		(void) sm_io_close(e->e_dfp, SM_TIME_DEFAULT);
5654 		e->e_dfp = NULL;
5655 	}
5656 	e->e_flags &= ~EF_HAS_DF;
5657 }
5658 /*
5659 **  NAME2QID -- translate a queue group name to a queue group id
5660 **
5661 **	Parameters:
5662 **		queuename -- name of queue group.
5663 **
5664 **	Returns:
5665 **		queue group id if found.
5666 **		NOQGRP otherwise.
5667 */
5668 
5669 int
5670 name2qid(queuename)
5671 	char *queuename;
5672 {
5673 	register STAB *s;
5674 
5675 	s = stab(queuename, ST_QUEUE, ST_FIND);
5676 	if (s == NULL)
5677 		return NOQGRP;
5678 	return s->s_quegrp->qg_index;
5679 }
5680 /*
5681 **  QID_PRINTNAME -- create externally printable version of queue id
5682 **
5683 **	Parameters:
5684 **		e -- the envelope.
5685 **
5686 **	Returns:
5687 **		a printable version
5688 */
5689 
5690 char *
5691 qid_printname(e)
5692 	ENVELOPE *e;
5693 {
5694 	char *id;
5695 	static char idbuf[MAXQFNAME + 34];
5696 
5697 	if (e == NULL)
5698 		return "";
5699 
5700 	if (e->e_id == NULL)
5701 		id = "";
5702 	else
5703 		id = e->e_id;
5704 
5705 	if (e->e_qdir == NOQDIR)
5706 		return id;
5707 
5708 	(void) sm_snprintf(idbuf, sizeof(idbuf), "%.32s/%s",
5709 			   Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_name,
5710 			   id);
5711 	return idbuf;
5712 }
5713 /*
5714 **  QID_PRINTQUEUE -- create full version of queue directory for data files
5715 **
5716 **	Parameters:
5717 **		qgrp -- index in queue group.
5718 **		qdir -- the short version of the queue directory
5719 **
5720 **	Returns:
5721 **		the full pathname to the queue (might point to a static var)
5722 */
5723 
5724 char *
5725 qid_printqueue(qgrp, qdir)
5726 	int qgrp;
5727 	int qdir;
5728 {
5729 	char *subdir;
5730 	static char dir[MAXPATHLEN];
5731 
5732 	if (qdir == NOQDIR)
5733 		return Queue[qgrp]->qg_qdir;
5734 
5735 	if (strcmp(Queue[qgrp]->qg_qpaths[qdir].qp_name, ".") == 0)
5736 		subdir = NULL;
5737 	else
5738 		subdir = Queue[qgrp]->qg_qpaths[qdir].qp_name;
5739 
5740 	(void) sm_strlcpyn(dir, sizeof(dir), 4,
5741 			Queue[qgrp]->qg_qdir,
5742 			subdir == NULL ? "" : "/",
5743 			subdir == NULL ? "" : subdir,
5744 			(bitset(QP_SUBDF,
5745 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
5746 					? "/df" : ""));
5747 	return dir;
5748 }
5749 
5750 /*
5751 **  PICKQDIR -- Pick a queue directory from a queue group
5752 **
5753 **	Parameters:
5754 **		qg -- queue group
5755 **		fsize -- file size in bytes
5756 **		e -- envelope, or NULL
5757 **
5758 **	Result:
5759 **		NOQDIR if no queue directory in qg has enough free space to
5760 **		hold a file of size 'fsize', otherwise the index of
5761 **		a randomly selected queue directory which resides on a
5762 **		file system with enough disk space.
5763 **		XXX This could be extended to select a queuedir with
5764 **			a few (the fewest?) number of entries. That data
5765 **			is available if shared memory is used.
5766 **
5767 **	Side Effects:
5768 **		If the request fails and e != NULL then sm_syslog is called.
5769 */
5770 
5771 int
5772 pickqdir(qg, fsize, e)
5773 	QUEUEGRP *qg;
5774 	long fsize;
5775 	ENVELOPE *e;
5776 {
5777 	int qdir;
5778 	int i;
5779 	long avail = 0;
5780 
5781 	/* Pick a random directory, as a starting point. */
5782 	if (qg->qg_numqueues <= 1)
5783 		qdir = 0;
5784 	else
5785 		qdir = get_rand_mod(qg->qg_numqueues);
5786 
5787 #if _FFR_TESTS
5788 	if (tTd(4, 101))
5789 		return NOQDIR;
5790 #endif /* _FFR_TESTS */
5791 	if (MinBlocksFree <= 0 && fsize <= 0)
5792 		return qdir;
5793 
5794 	/*
5795 	**  Now iterate over the queue directories,
5796 	**  looking for a directory with enough space for this message.
5797 	*/
5798 
5799 	i = qdir;
5800 	do
5801 	{
5802 		QPATHS *qp = &qg->qg_qpaths[i];
5803 		long needed = 0;
5804 		long fsavail = 0;
5805 
5806 		if (fsize > 0)
5807 			needed += fsize / FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5808 				  + ((fsize % FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5809 				      > 0) ? 1 : 0);
5810 		if (MinBlocksFree > 0)
5811 			needed += MinBlocksFree;
5812 		fsavail = FILE_SYS_AVAIL(qp->qp_fsysidx);
5813 #if SM_CONF_SHM
5814 		if (fsavail <= 0)
5815 		{
5816 			long blksize;
5817 
5818 			/*
5819 			**  might be not correctly updated,
5820 			**  let's try to get the info directly.
5821 			*/
5822 
5823 			fsavail = freediskspace(FILE_SYS_NAME(qp->qp_fsysidx),
5824 						&blksize);
5825 			if (fsavail < 0)
5826 				fsavail = 0;
5827 		}
5828 #endif /* SM_CONF_SHM */
5829 		if (needed <= fsavail)
5830 			return i;
5831 		if (avail < fsavail)
5832 			avail = fsavail;
5833 
5834 		if (qg->qg_numqueues > 0)
5835 			i = (i + 1) % qg->qg_numqueues;
5836 	} while (i != qdir);
5837 
5838 	if (e != NULL && LogLevel > 0)
5839 		sm_syslog(LOG_ALERT, e->e_id,
5840 			"low on space (%s needs %ld bytes + %ld blocks in %s), max avail: %ld",
5841 			CurHostName == NULL ? "SMTP-DAEMON" : CurHostName,
5842 			fsize, MinBlocksFree,
5843 			qg->qg_qdir, avail);
5844 	return NOQDIR;
5845 }
5846 /*
5847 **  SETNEWQUEUE -- Sets a new queue group and directory
5848 **
5849 **	Assign a queue group and directory to an envelope and store the
5850 **	directory in e->e_qdir.
5851 **
5852 **	Parameters:
5853 **		e -- envelope to assign a queue for.
5854 **
5855 **	Returns:
5856 **		true if successful
5857 **		false otherwise
5858 **
5859 **	Side Effects:
5860 **		On success, e->e_qgrp and e->e_qdir are non-negative.
5861 **		On failure (not enough disk space),
5862 **		e->qgrp = NOQGRP, e->e_qdir = NOQDIR
5863 **		and usrerr() is invoked (which could raise an exception).
5864 */
5865 
5866 bool
5867 setnewqueue(e)
5868 	ENVELOPE *e;
5869 {
5870 	if (tTd(41, 20))
5871 		sm_dprintf("setnewqueue: called\n");
5872 
5873 	/* not set somewhere else */
5874 	if (e->e_qgrp == NOQGRP)
5875 	{
5876 		ADDRESS *q;
5877 
5878 		/*
5879 		**  Use the queue group of the "first" recipient, as set by
5880 		**  the "queuegroup" rule set.  If that is not defined, then
5881 		**  use the queue group of the mailer of the first recipient.
5882 		**  If that is not defined either, then use the default
5883 		**  queue group.
5884 		**  Notice: "first" depends on the sorting of sendqueue
5885 		**  in recipient().
5886 		**  To avoid problems with "bad" recipients look
5887 		**  for a valid address first.
5888 		*/
5889 
5890 		q = e->e_sendqueue;
5891 		while (q != NULL &&
5892 		       (QS_IS_BADADDR(q->q_state) || QS_IS_DEAD(q->q_state)))
5893 		{
5894 			q = q->q_next;
5895 		}
5896 		if (q == NULL)
5897 			e->e_qgrp = 0;
5898 		else if (q->q_qgrp >= 0)
5899 			e->e_qgrp = q->q_qgrp;
5900 		else if (q->q_mailer != NULL &&
5901 			 ISVALIDQGRP(q->q_mailer->m_qgrp))
5902 			e->e_qgrp = q->q_mailer->m_qgrp;
5903 		else
5904 			e->e_qgrp = 0;
5905 		e->e_dfqgrp = e->e_qgrp;
5906 	}
5907 
5908 	if (ISVALIDQDIR(e->e_qdir) && ISVALIDQDIR(e->e_dfqdir))
5909 	{
5910 		if (tTd(41, 20))
5911 			sm_dprintf("setnewqueue: e_qdir already assigned (%s)\n",
5912 				qid_printqueue(e->e_qgrp, e->e_qdir));
5913 		return true;
5914 	}
5915 
5916 	filesys_update();
5917 	e->e_qdir = pickqdir(Queue[e->e_qgrp], e->e_msgsize, e);
5918 	if (e->e_qdir == NOQDIR)
5919 	{
5920 		e->e_qgrp = NOQGRP;
5921 		if (!bitset(EF_FATALERRS, e->e_flags))
5922 			usrerr("452 4.4.5 Insufficient disk space; try again later");
5923 		e->e_flags |= EF_FATALERRS;
5924 		return false;
5925 	}
5926 
5927 	if (tTd(41, 3))
5928 		sm_dprintf("setnewqueue: Assigned queue directory %s\n",
5929 			qid_printqueue(e->e_qgrp, e->e_qdir));
5930 
5931 	if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5932 	{
5933 		e->e_xfqgrp = e->e_qgrp;
5934 		e->e_xfqdir = e->e_qdir;
5935 	}
5936 	e->e_dfqdir = e->e_qdir;
5937 	return true;
5938 }
5939 /*
5940 **  CHKQDIR -- check a queue directory
5941 **
5942 **	Parameters:
5943 **		name -- name of queue directory
5944 **		sff -- flags for safefile()
5945 **
5946 **	Returns:
5947 **		is it a queue directory?
5948 */
5949 
5950 static bool chkqdir __P((char *, long));
5951 
5952 static bool
5953 chkqdir(name, sff)
5954 	char *name;
5955 	long sff;
5956 {
5957 	struct stat statb;
5958 	int i;
5959 
5960 	/* skip over . and .. directories */
5961 	if (name[0] == '.' &&
5962 	    (name[1] == '\0' || (name[1] == '.' && name[2] == '\0')))
5963 		return false;
5964 #if HASLSTAT
5965 	if (lstat(name, &statb) < 0)
5966 #else /* HASLSTAT */
5967 	if (stat(name, &statb) < 0)
5968 #endif /* HASLSTAT */
5969 	{
5970 		if (tTd(41, 2))
5971 			sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5972 				   name, sm_errstring(errno));
5973 		return false;
5974 	}
5975 #if HASLSTAT
5976 	if (S_ISLNK(statb.st_mode))
5977 	{
5978 		/*
5979 		**  For a symlink we need to make sure the
5980 		**  target is a directory
5981 		*/
5982 
5983 		if (stat(name, &statb) < 0)
5984 		{
5985 			if (tTd(41, 2))
5986 				sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5987 					   name, sm_errstring(errno));
5988 			return false;
5989 		}
5990 	}
5991 #endif /* HASLSTAT */
5992 
5993 	if (!S_ISDIR(statb.st_mode))
5994 	{
5995 		if (tTd(41, 2))
5996 			sm_dprintf("chkqdir: \"%s\": Not a directory\n",
5997 				name);
5998 		return false;
5999 	}
6000 
6001 	/* Print a warning if unsafe (but still use it) */
6002 	/* XXX do this only if we want the warning? */
6003 	i = safedirpath(name, RunAsUid, RunAsGid, NULL, sff, 0, 0);
6004 	if (i != 0)
6005 	{
6006 		if (tTd(41, 2))
6007 			sm_dprintf("chkqdir: \"%s\": Not safe: %s\n",
6008 				   name, sm_errstring(i));
6009 #if _FFR_CHK_QUEUE
6010 		if (LogLevel > 8)
6011 			sm_syslog(LOG_WARNING, NOQID,
6012 				  "queue directory \"%s\": Not safe: %s",
6013 				  name, sm_errstring(i));
6014 #endif /* _FFR_CHK_QUEUE */
6015 	}
6016 	return true;
6017 }
6018 /*
6019 **  MULTIQUEUE_CACHE -- cache a list of paths to queues.
6020 **
6021 **	Each potential queue is checked as the cache is built.
6022 **	Thereafter, each is blindly trusted.
6023 **	Note that we can be called again after a timeout to rebuild
6024 **	(although code for that is not ready yet).
6025 **
6026 **	Parameters:
6027 **		basedir -- base of all queue directories.
6028 **		blen -- strlen(basedir).
6029 **		qg -- queue group.
6030 **		qn -- number of queue directories already cached.
6031 **		phash -- pointer to hash value over queue dirs.
6032 #if SM_CONF_SHM
6033 **			only used if shared memory is active.
6034 #endif * SM_CONF_SHM *
6035 **
6036 **	Returns:
6037 **		new number of queue directories.
6038 */
6039 
6040 #define INITIAL_SLOTS	20
6041 #define ADD_SLOTS	10
6042 
6043 static int
6044 multiqueue_cache(basedir, blen, qg, qn, phash)
6045 	char *basedir;
6046 	int blen;
6047 	QUEUEGRP *qg;
6048 	int qn;
6049 	unsigned int *phash;
6050 {
6051 	char *cp;
6052 	int i, len;
6053 	int slotsleft = 0;
6054 	long sff = SFF_ANYFILE;
6055 	char qpath[MAXPATHLEN];
6056 	char subdir[MAXPATHLEN];
6057 	char prefix[MAXPATHLEN];	/* dir relative to basedir */
6058 
6059 	if (tTd(41, 20))
6060 		sm_dprintf("multiqueue_cache: called\n");
6061 
6062 	/* Initialize to current directory */
6063 	prefix[0] = '.';
6064 	prefix[1] = '\0';
6065 	if (qg->qg_numqueues != 0 && qg->qg_qpaths != NULL)
6066 	{
6067 		for (i = 0; i < qg->qg_numqueues; i++)
6068 		{
6069 			if (qg->qg_qpaths[i].qp_name != NULL)
6070 				(void) sm_free(qg->qg_qpaths[i].qp_name); /* XXX */
6071 		}
6072 		(void) sm_free((char *) qg->qg_qpaths); /* XXX */
6073 		qg->qg_qpaths = NULL;
6074 		qg->qg_numqueues = 0;
6075 	}
6076 
6077 	/* If running as root, allow safedirpath() checks to use privs */
6078 	if (RunAsUid == 0)
6079 		sff |= SFF_ROOTOK;
6080 #if _FFR_CHK_QUEUE
6081 	sff |= SFF_SAFEDIRPATH|SFF_NOWWFILES;
6082 	if (!UseMSP)
6083 		sff |= SFF_NOGWFILES;
6084 #endif /* _FFR_CHK_QUEUE */
6085 
6086 	if (!SM_IS_DIR_START(qg->qg_qdir))
6087 	{
6088 		/*
6089 		**  XXX we could add basedir, but then we have to realloc()
6090 		**  the string... Maybe another time.
6091 		*/
6092 
6093 		syserr("QueuePath %s not absolute", qg->qg_qdir);
6094 		ExitStat = EX_CONFIG;
6095 		return qn;
6096 	}
6097 
6098 	/* qpath: directory of current workgroup */
6099 	len = sm_strlcpy(qpath, qg->qg_qdir, sizeof(qpath));
6100 	if (len >= sizeof(qpath))
6101 	{
6102 		syserr("QueuePath %.256s too long (%d max)",
6103 		       qg->qg_qdir, (int) sizeof(qpath));
6104 		ExitStat = EX_CONFIG;
6105 		return qn;
6106 	}
6107 
6108 	/* begin of qpath must be same as basedir */
6109 	if (strncmp(basedir, qpath, blen) != 0 &&
6110 	    (strncmp(basedir, qpath, blen - 1) != 0 || len != blen - 1))
6111 	{
6112 		syserr("QueuePath %s not subpath of QueueDirectory %s",
6113 			qpath, basedir);
6114 		ExitStat = EX_CONFIG;
6115 		return qn;
6116 	}
6117 
6118 	/* Do we have a nested subdirectory? */
6119 	if (blen < len && SM_FIRST_DIR_DELIM(qg->qg_qdir + blen) != NULL)
6120 	{
6121 
6122 		/* Copy subdirectory into prefix for later use */
6123 		if (sm_strlcpy(prefix, qg->qg_qdir + blen, sizeof(prefix)) >=
6124 		    sizeof(prefix))
6125 		{
6126 			syserr("QueuePath %.256s too long (%d max)",
6127 				qg->qg_qdir, (int) sizeof(qpath));
6128 			ExitStat = EX_CONFIG;
6129 			return qn;
6130 		}
6131 		cp = SM_LAST_DIR_DELIM(prefix);
6132 		SM_ASSERT(cp != NULL);
6133 		*cp = '\0';	/* cut off trailing / */
6134 	}
6135 
6136 	/* This is guaranteed by the basedir check above */
6137 	SM_ASSERT(len >= blen - 1);
6138 	cp = &qpath[len - 1];
6139 	if (*cp == '*')
6140 	{
6141 		register DIR *dp;
6142 		register struct dirent *d;
6143 		int off;
6144 		char *delim;
6145 		char relpath[MAXPATHLEN];
6146 
6147 		*cp = '\0';	/* Overwrite wildcard */
6148 		if ((cp = SM_LAST_DIR_DELIM(qpath)) == NULL)
6149 		{
6150 			syserr("QueueDirectory: can not wildcard relative path");
6151 			if (tTd(41, 2))
6152 				sm_dprintf("multiqueue_cache: \"%s*\": Can not wildcard relative path.\n",
6153 					qpath);
6154 			ExitStat = EX_CONFIG;
6155 			return qn;
6156 		}
6157 		if (cp == qpath)
6158 		{
6159 			/*
6160 			**  Special case of top level wildcard, like /foo*
6161 			**	Change to //foo*
6162 			*/
6163 
6164 			(void) sm_strlcpy(qpath + 1, qpath, sizeof(qpath) - 1);
6165 			++cp;
6166 		}
6167 		delim = cp;
6168 		*(cp++) = '\0';		/* Replace / with \0 */
6169 		len = strlen(cp);	/* Last component of queue directory */
6170 
6171 		/*
6172 		**  Path relative to basedir, with trailing /
6173 		**  It will be modified below to specify the subdirectories
6174 		**  so they can be opened without chdir().
6175 		*/
6176 
6177 		off = sm_strlcpyn(relpath, sizeof(relpath), 2, prefix, "/");
6178 		SM_ASSERT(off < sizeof(relpath));
6179 
6180 		if (tTd(41, 2))
6181 			sm_dprintf("multiqueue_cache: prefix=\"%s%s\"\n",
6182 				   relpath, cp);
6183 
6184 		/* It is always basedir: we don't need to store it per group */
6185 		/* XXX: optimize this! -> one more global? */
6186 		qg->qg_qdir = newstr(basedir);
6187 		qg->qg_qdir[blen - 1] = '\0';	/* cut off trailing / */
6188 
6189 		/*
6190 		**  XXX Should probably wrap this whole loop in a timeout
6191 		**  in case some wag decides to NFS mount the queues.
6192 		*/
6193 
6194 		/* Test path to get warning messages. */
6195 		if (qn == 0)
6196 		{
6197 			/*  XXX qg_runasuid and qg_runasgid for specials? */
6198 			i = safedirpath(basedir, RunAsUid, RunAsGid, NULL,
6199 					sff, 0, 0);
6200 			if (i != 0 && tTd(41, 2))
6201 				sm_dprintf("multiqueue_cache: \"%s\": Not safe: %s\n",
6202 					   basedir, sm_errstring(i));
6203 		}
6204 
6205 		if ((dp = opendir(prefix)) == NULL)
6206 		{
6207 			syserr("can not opendir(%s/%s)", qg->qg_qdir, prefix);
6208 			if (tTd(41, 2))
6209 				sm_dprintf("multiqueue_cache: opendir(\"%s/%s\"): %s\n",
6210 					   qg->qg_qdir, prefix,
6211 					   sm_errstring(errno));
6212 			ExitStat = EX_CONFIG;
6213 			return qn;
6214 		}
6215 		while ((d = readdir(dp)) != NULL)
6216 		{
6217 			/* Skip . and .. directories */
6218 			if (strcmp(d->d_name, ".") == 0 ||
6219 			    strcmp(d->d_name, "..") == 0)
6220 				continue;
6221 
6222 			i = strlen(d->d_name);
6223 			if (i < len || strncmp(d->d_name, cp, len) != 0)
6224 			{
6225 				if (tTd(41, 5))
6226 					sm_dprintf("multiqueue_cache: \"%s\", skipped\n",
6227 						d->d_name);
6228 				continue;
6229 			}
6230 
6231 			/* Create relative pathname: prefix + local directory */
6232 			i = sizeof(relpath) - off;
6233 			if (sm_strlcpy(relpath + off, d->d_name, i) >= i)
6234 				continue;	/* way too long */
6235 
6236 			if (!chkqdir(relpath, sff))
6237 				continue;
6238 
6239 			if (qg->qg_qpaths == NULL)
6240 			{
6241 				slotsleft = INITIAL_SLOTS;
6242 				qg->qg_qpaths = (QPATHS *)xalloc((sizeof(*qg->qg_qpaths)) *
6243 								slotsleft);
6244 				qg->qg_numqueues = 0;
6245 			}
6246 			else if (slotsleft < 1)
6247 			{
6248 				qg->qg_qpaths = (QPATHS *)sm_realloc((char *)qg->qg_qpaths,
6249 							  (sizeof(*qg->qg_qpaths)) *
6250 							  (qg->qg_numqueues +
6251 							   ADD_SLOTS));
6252 				if (qg->qg_qpaths == NULL)
6253 				{
6254 					(void) closedir(dp);
6255 					return qn;
6256 				}
6257 				slotsleft += ADD_SLOTS;
6258 			}
6259 
6260 			/* check subdirs */
6261 			qg->qg_qpaths[qg->qg_numqueues].qp_subdirs = QP_NOSUB;
6262 
6263 #define CHKRSUBDIR(name, flag)	\
6264 	(void) sm_strlcpyn(subdir, sizeof(subdir), 3, relpath, "/", name); \
6265 	if (chkqdir(subdir, sff))	\
6266 		qg->qg_qpaths[qg->qg_numqueues].qp_subdirs |= flag;	\
6267 	else
6268 
6269 
6270 			CHKRSUBDIR("qf", QP_SUBQF);
6271 			CHKRSUBDIR("df", QP_SUBDF);
6272 			CHKRSUBDIR("xf", QP_SUBXF);
6273 
6274 			/* assert(strlen(d->d_name) < MAXPATHLEN - 14) */
6275 			/* maybe even - 17 (subdirs) */
6276 
6277 			if (prefix[0] != '.')
6278 				qg->qg_qpaths[qg->qg_numqueues].qp_name =
6279 					newstr(relpath);
6280 			else
6281 				qg->qg_qpaths[qg->qg_numqueues].qp_name =
6282 					newstr(d->d_name);
6283 
6284 			if (tTd(41, 2))
6285 				sm_dprintf("multiqueue_cache: %d: \"%s\" cached (%x).\n",
6286 					qg->qg_numqueues, relpath,
6287 					qg->qg_qpaths[qg->qg_numqueues].qp_subdirs);
6288 #if SM_CONF_SHM
6289 			qg->qg_qpaths[qg->qg_numqueues].qp_idx = qn;
6290 			*phash = hash_q(relpath, *phash);
6291 #endif /* SM_CONF_SHM */
6292 			qg->qg_numqueues++;
6293 			++qn;
6294 			slotsleft--;
6295 		}
6296 		(void) closedir(dp);
6297 
6298 		/* undo damage */
6299 		*delim = '/';
6300 	}
6301 	if (qg->qg_numqueues == 0)
6302 	{
6303 		qg->qg_qpaths = (QPATHS *) xalloc(sizeof(*qg->qg_qpaths));
6304 
6305 		/* test path to get warning messages */
6306 		i = safedirpath(qpath, RunAsUid, RunAsGid, NULL, sff, 0, 0);
6307 		if (i == ENOENT)
6308 		{
6309 			syserr("can not opendir(%s)", qpath);
6310 			if (tTd(41, 2))
6311 				sm_dprintf("multiqueue_cache: opendir(\"%s\"): %s\n",
6312 					   qpath, sm_errstring(i));
6313 			ExitStat = EX_CONFIG;
6314 			return qn;
6315 		}
6316 
6317 		qg->qg_qpaths[0].qp_subdirs = QP_NOSUB;
6318 		qg->qg_numqueues = 1;
6319 
6320 		/* check subdirs */
6321 #define CHKSUBDIR(name, flag)	\
6322 	(void) sm_strlcpyn(subdir, sizeof(subdir), 3, qg->qg_qdir, "/", name); \
6323 	if (chkqdir(subdir, sff))	\
6324 		qg->qg_qpaths[0].qp_subdirs |= flag;	\
6325 	else
6326 
6327 		CHKSUBDIR("qf", QP_SUBQF);
6328 		CHKSUBDIR("df", QP_SUBDF);
6329 		CHKSUBDIR("xf", QP_SUBXF);
6330 
6331 		if (qg->qg_qdir[blen - 1] != '\0' &&
6332 		    qg->qg_qdir[blen] != '\0')
6333 		{
6334 			/*
6335 			**  Copy the last component into qpaths and
6336 			**  cut off qdir
6337 			*/
6338 
6339 			qg->qg_qpaths[0].qp_name = newstr(qg->qg_qdir + blen);
6340 			qg->qg_qdir[blen - 1] = '\0';
6341 		}
6342 		else
6343 			qg->qg_qpaths[0].qp_name = newstr(".");
6344 
6345 #if SM_CONF_SHM
6346 		qg->qg_qpaths[0].qp_idx = qn;
6347 		*phash = hash_q(qg->qg_qpaths[0].qp_name, *phash);
6348 #endif /* SM_CONF_SHM */
6349 		++qn;
6350 	}
6351 	return qn;
6352 }
6353 
6354 /*
6355 **  FILESYS_FIND -- find entry in FileSys table, or add new one
6356 **
6357 **	Given the pathname of a directory, determine the file system
6358 **	in which that directory resides, and return a pointer to the
6359 **	entry in the FileSys table that describes the file system.
6360 **	A new entry is added if necessary (and requested).
6361 **	If the directory does not exist, -1 is returned.
6362 **
6363 **	Parameters:
6364 **		name -- name of directory (must be persistent!)
6365 **		path -- pathname of directory (name plus maybe "/df")
6366 **		add -- add to structure if not found.
6367 **
6368 **	Returns:
6369 **		>=0: found: index in file system table
6370 **		<0: some error, i.e.,
6371 **		FSF_TOO_MANY: too many filesystems (-> syserr())
6372 **		FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6373 **		FSF_NOT_FOUND: not in list
6374 */
6375 
6376 static short filesys_find __P((const char *, const char *, bool));
6377 
6378 #define FSF_NOT_FOUND	(-1)
6379 #define FSF_STAT_FAIL	(-2)
6380 #define FSF_TOO_MANY	(-3)
6381 
6382 static short
6383 filesys_find(name, path, add)
6384 	const char *name;
6385 	const char *path;
6386 	bool add;
6387 {
6388 	struct stat st;
6389 	short i;
6390 
6391 	if (stat(path, &st) < 0)
6392 	{
6393 		syserr("cannot stat queue directory %s", path);
6394 		return FSF_STAT_FAIL;
6395 	}
6396 	for (i = 0; i < NumFileSys; ++i)
6397 	{
6398 		if (FILE_SYS_DEV(i) == st.st_dev)
6399 		{
6400 			/*
6401 			**  Make sure the file system (FS) name is set:
6402 			**  even though the source code indicates that
6403 			**  FILE_SYS_DEV() is only set below, it could be
6404 			**  set via shared memory, hence we need to perform
6405 			**  this check/assignment here.
6406 			*/
6407 
6408 			if (NULL == FILE_SYS_NAME(i))
6409 				FILE_SYS_NAME(i) = name;
6410 			return i;
6411 		}
6412 	}
6413 	if (i >= MAXFILESYS)
6414 	{
6415 		syserr("too many queue file systems (%d max)", MAXFILESYS);
6416 		return FSF_TOO_MANY;
6417 	}
6418 	if (!add)
6419 		return FSF_NOT_FOUND;
6420 
6421 	++NumFileSys;
6422 	FILE_SYS_NAME(i) = name;
6423 	FILE_SYS_DEV(i) = st.st_dev;
6424 	FILE_SYS_AVAIL(i) = 0;
6425 	FILE_SYS_BLKSIZE(i) = 1024; /* avoid divide by zero */
6426 	return i;
6427 }
6428 
6429 /*
6430 **  FILESYS_SETUP -- set up mapping from queue directories to file systems
6431 **
6432 **	This data structure is used to efficiently check the amount of
6433 **	free space available in a set of queue directories.
6434 **
6435 **	Parameters:
6436 **		add -- initialize structure if necessary.
6437 **
6438 **	Returns:
6439 **		0: success
6440 **		<0: some error, i.e.,
6441 **		FSF_NOT_FOUND: not in list
6442 **		FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6443 **		FSF_TOO_MANY: too many filesystems (-> syserr())
6444 */
6445 
6446 static int filesys_setup __P((bool));
6447 
6448 static int
6449 filesys_setup(add)
6450 	bool add;
6451 {
6452 	int i, j;
6453 	short fs;
6454 	int ret;
6455 
6456 	ret = 0;
6457 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
6458 	{
6459 		for (j = 0; j < Queue[i]->qg_numqueues; ++j)
6460 		{
6461 			QPATHS *qp = &Queue[i]->qg_qpaths[j];
6462 			char qddf[MAXPATHLEN];
6463 
6464 			(void) sm_strlcpyn(qddf, sizeof(qddf), 2, qp->qp_name,
6465 					(bitset(QP_SUBDF, qp->qp_subdirs)
6466 						? "/df" : ""));
6467 			fs = filesys_find(qp->qp_name, qddf, add);
6468 			if (fs >= 0)
6469 				qp->qp_fsysidx = fs;
6470 			else
6471 				qp->qp_fsysidx = 0;
6472 			if (fs < ret)
6473 				ret = fs;
6474 		}
6475 	}
6476 	return ret;
6477 }
6478 
6479 /*
6480 **  FILESYS_UPDATE -- update amount of free space on all file systems
6481 **
6482 **	The FileSys table is used to cache the amount of free space
6483 **	available on all queue directory file systems.
6484 **	This function updates the cached information if it has expired.
6485 **
6486 **	Parameters:
6487 **		none.
6488 **
6489 **	Returns:
6490 **		none.
6491 **
6492 **	Side Effects:
6493 **		Updates FileSys table.
6494 */
6495 
6496 void
6497 filesys_update()
6498 {
6499 	int i;
6500 	long avail, blksize;
6501 	time_t now;
6502 	static time_t nextupdate = 0;
6503 
6504 #if SM_CONF_SHM
6505 	/*
6506 	**  Only the daemon updates the shared memory, i.e.,
6507 	**  if shared memory is available but the pid is not the
6508 	**  one of the daemon, then don't do anything.
6509 	*/
6510 
6511 	if (ShmId != SM_SHM_NO_ID && DaemonPid != CurrentPid)
6512 		return;
6513 #endif /* SM_CONF_SHM */
6514 	now = curtime();
6515 	if (now < nextupdate)
6516 		return;
6517 	nextupdate = now + FILESYS_UPDATE_INTERVAL;
6518 	for (i = 0; i < NumFileSys; ++i)
6519 	{
6520 		FILESYS *fs = &FILE_SYS(i);
6521 
6522 		avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6523 		if (avail < 0 || blksize <= 0)
6524 		{
6525 			if (LogLevel > 5)
6526 				sm_syslog(LOG_ERR, NOQID,
6527 					"filesys_update failed: %s, fs=%s, avail=%ld, blocksize=%ld",
6528 					sm_errstring(errno),
6529 					FILE_SYS_NAME(i), avail, blksize);
6530 			fs->fs_avail = 0;
6531 			fs->fs_blksize = 1024; /* avoid divide by zero */
6532 			nextupdate = now + 2; /* let's do this soon again */
6533 		}
6534 		else
6535 		{
6536 			fs->fs_avail = avail;
6537 			fs->fs_blksize = blksize;
6538 		}
6539 	}
6540 }
6541 
6542 #if _FFR_ANY_FREE_FS
6543 /*
6544 **  FILESYS_FREE -- check whether there is at least one fs with enough space.
6545 **
6546 **	Parameters:
6547 **		fsize -- file size in bytes
6548 **
6549 **	Returns:
6550 **		true iff there is one fs with more than fsize bytes free.
6551 */
6552 
6553 bool
6554 filesys_free(fsize)
6555 	long fsize;
6556 {
6557 	int i;
6558 
6559 	if (fsize <= 0)
6560 		return true;
6561 	for (i = 0; i < NumFileSys; ++i)
6562 	{
6563 		long needed = 0;
6564 
6565 		if (FILE_SYS_AVAIL(i) < 0 || FILE_SYS_BLKSIZE(i) <= 0)
6566 			continue;
6567 		needed += fsize / FILE_SYS_BLKSIZE(i)
6568 			  + ((fsize % FILE_SYS_BLKSIZE(i)
6569 			      > 0) ? 1 : 0)
6570 			  + MinBlocksFree;
6571 		if (needed <= FILE_SYS_AVAIL(i))
6572 			return true;
6573 	}
6574 	return false;
6575 }
6576 #endif /* _FFR_ANY_FREE_FS */
6577 
6578 /*
6579 **  DISK_STATUS -- show amount of free space in queue directories
6580 **
6581 **	Parameters:
6582 **		out -- output file pointer.
6583 **		prefix -- string to output in front of each line.
6584 **
6585 **	Returns:
6586 **		none.
6587 */
6588 
6589 void
6590 disk_status(out, prefix)
6591 	SM_FILE_T *out;
6592 	char *prefix;
6593 {
6594 	int i;
6595 	long avail, blksize;
6596 	long free;
6597 
6598 	for (i = 0; i < NumFileSys; ++i)
6599 	{
6600 		avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6601 		if (avail >= 0 && blksize > 0)
6602 		{
6603 			free = (long)((double) avail *
6604 				((double) blksize / 1024));
6605 		}
6606 		else
6607 			free = -1;
6608 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
6609 				"%s%d/%s/%ld\r\n",
6610 				prefix, i,
6611 				FILE_SYS_NAME(i),
6612 					free);
6613 	}
6614 }
6615 
6616 #if SM_CONF_SHM
6617 
6618 /*
6619 **  INIT_SEM -- initialize semaphore system
6620 **
6621 **	Parameters:
6622 **		owner -- is this the owner of semaphores?
6623 **
6624 **	Returns:
6625 **		none.
6626 */
6627 
6628 #if _FFR_USE_SEM_LOCKING
6629 #if SM_CONF_SEM
6630 static int SemId = -1;		/* Semaphore Id */
6631 int SemKey = SM_SEM_KEY;
6632 #endif /* SM_CONF_SEM */
6633 #endif /* _FFR_USE_SEM_LOCKING */
6634 
6635 static void init_sem __P((bool));
6636 
6637 static void
6638 init_sem(owner)
6639 	bool owner;
6640 {
6641 #if _FFR_USE_SEM_LOCKING
6642 #if SM_CONF_SEM
6643 	SemId = sm_sem_start(SemKey, 1, 0, owner);
6644 	if (SemId < 0)
6645 	{
6646 		sm_syslog(LOG_ERR, NOQID,
6647 			"func=init_sem, sem_key=%ld, sm_sem_start=%d, error=%s",
6648 			(long) SemKey, SemId, sm_errstring(-SemId));
6649 		return;
6650 	}
6651 	if (owner && RunAsUid != 0)
6652 	{
6653 		int r;
6654 
6655 		r = sm_semsetowner(SemId, RunAsUid, RunAsGid, 0660);
6656 		if (r != 0)
6657 			sm_syslog(LOG_ERR, NOQID,
6658 				"key=%ld, sm_semsetowner=%d, RunAsUid=%ld, RunAsGid=%ld",
6659 				(long) SemKey, r, (long) RunAsUid, (long) RunAsGid);
6660 	}
6661 #endif /* SM_CONF_SEM */
6662 #endif /* _FFR_USE_SEM_LOCKING */
6663 	return;
6664 }
6665 
6666 /*
6667 **  STOP_SEM -- stop semaphore system
6668 **
6669 **	Parameters:
6670 **		owner -- is this the owner of semaphores?
6671 **
6672 **	Returns:
6673 **		none.
6674 */
6675 
6676 static void stop_sem __P((bool));
6677 
6678 static void
6679 stop_sem(owner)
6680 	bool owner;
6681 {
6682 #if _FFR_USE_SEM_LOCKING
6683 #if SM_CONF_SEM
6684 	if (owner && SemId >= 0)
6685 		sm_sem_stop(SemId);
6686 #endif /* SM_CONF_SEM */
6687 #endif /* _FFR_USE_SEM_LOCKING */
6688 	return;
6689 }
6690 
6691 /*
6692 **  UPD_QS -- update information about queue when adding/deleting an entry
6693 **
6694 **	Parameters:
6695 **		e -- envelope.
6696 **		count -- add/remove entry (+1/0/-1: add/no change/remove)
6697 **		space -- update the space available as well.
6698 **			(>0/0/<0: add/no change/remove)
6699 **		where -- caller (for logging)
6700 **
6701 **	Returns:
6702 **		none.
6703 **
6704 **	Side Effects:
6705 **		Modifies available space in filesystem.
6706 **		Changes number of entries in queue directory.
6707 */
6708 
6709 void
6710 upd_qs(e, count, space, where)
6711 	ENVELOPE *e;
6712 	int count;
6713 	int space;
6714 	char *where;
6715 {
6716 	short fidx;
6717 	int idx;
6718 # if _FFR_USE_SEM_LOCKING
6719 	int r;
6720 # endif /* _FFR_USE_SEM_LOCKING */
6721 	long s;
6722 
6723 	if (ShmId == SM_SHM_NO_ID || e == NULL)
6724 		return;
6725 	if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
6726 		return;
6727 	idx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_idx;
6728 	if (tTd(73,2))
6729 		sm_dprintf("func=upd_qs, count=%d, space=%d, where=%s, idx=%d, entries=%d\n",
6730 			count, space, where, idx, QSHM_ENTRIES(idx));
6731 
6732 	/* XXX in theory this needs to be protected with a mutex */
6733 	if (QSHM_ENTRIES(idx) >= 0 && count != 0)
6734 	{
6735 # if _FFR_USE_SEM_LOCKING
6736 		if (SemId >= 0)
6737 			r = sm_sem_acq(SemId, 0, 1);
6738 # endif /* _FFR_USE_SEM_LOCKING */
6739 		QSHM_ENTRIES(idx) += count;
6740 # if _FFR_USE_SEM_LOCKING
6741 		if (SemId >= 0 && r >= 0)
6742 			r = sm_sem_rel(SemId, 0, 1);
6743 # endif /* _FFR_USE_SEM_LOCKING */
6744 	}
6745 
6746 	fidx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_fsysidx;
6747 	if (fidx < 0)
6748 		return;
6749 
6750 	/* update available space also?  (might be loseqfile) */
6751 	if (space == 0)
6752 		return;
6753 
6754 	/* convert size to blocks; this causes rounding errors */
6755 	s = e->e_msgsize / FILE_SYS_BLKSIZE(fidx);
6756 	if (s == 0)
6757 		return;
6758 
6759 	/* XXX in theory this needs to be protected with a mutex */
6760 	if (space > 0)
6761 		FILE_SYS_AVAIL(fidx) += s;
6762 	else
6763 		FILE_SYS_AVAIL(fidx) -= s;
6764 
6765 }
6766 
6767 static bool write_key_file __P((char *, long));
6768 static long read_key_file __P((char *, long));
6769 
6770 /*
6771 **  WRITE_KEY_FILE -- record some key into a file.
6772 **
6773 **	Parameters:
6774 **		keypath -- file name.
6775 **		key -- key to write.
6776 **
6777 **	Returns:
6778 **		true iff file could be written.
6779 **
6780 **	Side Effects:
6781 **		writes file.
6782 */
6783 
6784 static bool
6785 write_key_file(keypath, key)
6786 	char *keypath;
6787 	long key;
6788 {
6789 	bool ok;
6790 	long sff;
6791 	SM_FILE_T *keyf;
6792 
6793 	ok = false;
6794 	if (keypath == NULL || *keypath == '\0')
6795 		return ok;
6796 	sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY|SFF_CREAT;
6797 	if (TrustedUid != 0 && RealUid == TrustedUid)
6798 		sff |= SFF_OPENASROOT;
6799 	keyf = safefopen(keypath, O_WRONLY|O_TRUNC, FileMode, sff);
6800 	if (keyf == NULL)
6801 	{
6802 		sm_syslog(LOG_ERR, NOQID, "unable to write %s: %s",
6803 			  keypath, sm_errstring(errno));
6804 	}
6805 	else
6806 	{
6807 		if (geteuid() == 0 && RunAsUid != 0)
6808 		{
6809 #  if HASFCHOWN
6810 			int fd;
6811 
6812 			fd = keyf->f_file;
6813 			if (fd >= 0 && fchown(fd, RunAsUid, -1) < 0)
6814 			{
6815 				int err = errno;
6816 
6817 				sm_syslog(LOG_ALERT, NOQID,
6818 					  "ownership change on %s to %ld failed: %s",
6819 					  keypath, (long) RunAsUid, sm_errstring(err));
6820 			}
6821 #  endif /* HASFCHOWN */
6822 		}
6823 		ok = sm_io_fprintf(keyf, SM_TIME_DEFAULT, "%ld\n", key) !=
6824 		     SM_IO_EOF;
6825 		ok = (sm_io_close(keyf, SM_TIME_DEFAULT) != SM_IO_EOF) && ok;
6826 	}
6827 	return ok;
6828 }
6829 
6830 /*
6831 **  READ_KEY_FILE -- read a key from a file.
6832 **
6833 **	Parameters:
6834 **		keypath -- file name.
6835 **		key -- default key.
6836 **
6837 **	Returns:
6838 **		key.
6839 */
6840 
6841 static long
6842 read_key_file(keypath, key)
6843 	char *keypath;
6844 	long key;
6845 {
6846 	int r;
6847 	long sff, n;
6848 	SM_FILE_T *keyf;
6849 
6850 	if (keypath == NULL || *keypath == '\0')
6851 		return key;
6852 	sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY;
6853 	if (RealUid == 0 || (TrustedUid != 0 && RealUid == TrustedUid))
6854 		sff |= SFF_OPENASROOT;
6855 	keyf = safefopen(keypath, O_RDONLY, FileMode, sff);
6856 	if (keyf == NULL)
6857 	{
6858 		sm_syslog(LOG_ERR, NOQID, "unable to read %s: %s",
6859 			  keypath, sm_errstring(errno));
6860 	}
6861 	else
6862 	{
6863 		r = sm_io_fscanf(keyf, SM_TIME_DEFAULT, "%ld", &n);
6864 		if (r == 1)
6865 			key = n;
6866 		(void) sm_io_close(keyf, SM_TIME_DEFAULT);
6867 	}
6868 	return key;
6869 }
6870 
6871 /*
6872 **  INIT_SHM -- initialize shared memory structure
6873 **
6874 **	Initialize or attach to shared memory segment.
6875 **	Currently it is not a fatal error if this doesn't work.
6876 **	However, it causes us to have a "fallback" storage location
6877 **	for everything that is supposed to be in the shared memory,
6878 **	which makes the code slightly ugly.
6879 **
6880 **	Parameters:
6881 **		qn -- number of queue directories.
6882 **		owner -- owner of shared memory.
6883 **		hash -- identifies data that is stored in shared memory.
6884 **
6885 **	Returns:
6886 **		none.
6887 */
6888 
6889 static void init_shm __P((int, bool, unsigned int));
6890 
6891 static void
6892 init_shm(qn, owner, hash)
6893 	int qn;
6894 	bool owner;
6895 	unsigned int hash;
6896 {
6897 	int i;
6898 	int count;
6899 	int save_errno;
6900 	bool keyselect;
6901 
6902 	PtrFileSys = &FileSys[0];
6903 	PNumFileSys = &Numfilesys;
6904 /* if this "key" is specified: select one yourself */
6905 #define SEL_SHM_KEY	((key_t) -1)
6906 #define FIRST_SHM_KEY	25
6907 
6908 	/* This allows us to disable shared memory at runtime. */
6909 	if (ShmKey == 0)
6910 		return;
6911 
6912 	count = 0;
6913 	shms = SM_T_SIZE + qn * sizeof(QUEUE_SHM_T);
6914 	keyselect = ShmKey == SEL_SHM_KEY;
6915 	if (keyselect)
6916 	{
6917 		if (owner)
6918 			ShmKey = FIRST_SHM_KEY;
6919 		else
6920 		{
6921 			errno = 0;
6922 			ShmKey = read_key_file(ShmKeyFile, ShmKey);
6923 			keyselect = false;
6924 			if (ShmKey == SEL_SHM_KEY)
6925 			{
6926 				save_errno = (errno != 0) ? errno : EINVAL;
6927 				goto error;
6928 			}
6929 		}
6930 	}
6931 	for (;;)
6932 	{
6933 		/* allow read/write access for group? */
6934 		Pshm = sm_shmstart(ShmKey, shms,
6935 				SHM_R|SHM_W|(SHM_R>>3)|(SHM_W>>3),
6936 				&ShmId, owner);
6937 		save_errno = errno;
6938 		if (Pshm != NULL || !sm_file_exists(save_errno))
6939 			break;
6940 		if (++count >= 3)
6941 		{
6942 			if (keyselect)
6943 			{
6944 				++ShmKey;
6945 
6946 				/* back where we started? */
6947 				if (ShmKey == SEL_SHM_KEY)
6948 					break;
6949 				continue;
6950 			}
6951 			break;
6952 		}
6953 
6954 		/* only sleep if we are at the first key */
6955 		if (!keyselect || ShmKey == SEL_SHM_KEY)
6956 			sleep(count);
6957 	}
6958 	if (Pshm != NULL)
6959 	{
6960 		int *p;
6961 
6962 		if (keyselect)
6963 			(void) write_key_file(ShmKeyFile, (long) ShmKey);
6964 		if (owner && RunAsUid != 0)
6965 		{
6966 			i = sm_shmsetowner(ShmId, RunAsUid, RunAsGid, 0660);
6967 			if (i != 0)
6968 				sm_syslog(LOG_ERR, NOQID,
6969 					"key=%ld, sm_shmsetowner=%d, RunAsUid=%ld, RunAsGid=%ld",
6970 					(long) ShmKey, i, (long) RunAsUid, (long) RunAsGid);
6971 		}
6972 		p = (int *) Pshm;
6973 		if (owner)
6974 		{
6975 			*p = (int) shms;
6976 			*((pid_t *) SHM_OFF_PID(Pshm)) = CurrentPid;
6977 			p = (int *) SHM_OFF_TAG(Pshm);
6978 			*p = hash;
6979 		}
6980 		else
6981 		{
6982 			if (*p != (int) shms)
6983 			{
6984 				save_errno = EINVAL;
6985 				cleanup_shm(false);
6986 				goto error;
6987 			}
6988 			p = (int *) SHM_OFF_TAG(Pshm);
6989 			if (*p != (int) hash)
6990 			{
6991 				save_errno = EINVAL;
6992 				cleanup_shm(false);
6993 				goto error;
6994 			}
6995 
6996 			/*
6997 			**  XXX how to check the pid?
6998 			**  Read it from the pid-file? That does
6999 			**  not need to exist.
7000 			**  We could disable shm if we can't confirm
7001 			**  that it is the right one.
7002 			*/
7003 		}
7004 
7005 		PtrFileSys = (FILESYS *) OFF_FILE_SYS(Pshm);
7006 		PNumFileSys = (int *) OFF_NUM_FILE_SYS(Pshm);
7007 		QShm = (QUEUE_SHM_T *) OFF_QUEUE_SHM(Pshm);
7008 		PRSATmpCnt = (int *) OFF_RSA_TMP_CNT(Pshm);
7009 		*PRSATmpCnt = 0;
7010 		if (owner)
7011 		{
7012 			/* initialize values in shared memory */
7013 			NumFileSys = 0;
7014 			for (i = 0; i < qn; i++)
7015 				QShm[i].qs_entries = -1;
7016 		}
7017 		init_sem(owner);
7018 		return;
7019 	}
7020   error:
7021 	if (LogLevel > (owner ? 8 : 11))
7022 	{
7023 		sm_syslog(owner ? LOG_ERR : LOG_NOTICE, NOQID,
7024 			  "can't %s shared memory, key=%ld: %s",
7025 			  owner ? "initialize" : "attach to",
7026 			  (long) ShmKey, sm_errstring(save_errno));
7027 	}
7028 }
7029 #endif /* SM_CONF_SHM */
7030 
7031 
7032 /*
7033 **  SETUP_QUEUES -- set up all queue groups
7034 **
7035 **	Parameters:
7036 **		owner -- owner of shared memory?
7037 **
7038 **	Returns:
7039 **		none.
7040 **
7041 #if SM_CONF_SHM
7042 **	Side Effects:
7043 **		attaches shared memory.
7044 #endif * SM_CONF_SHM *
7045 */
7046 
7047 void
7048 setup_queues(owner)
7049 	bool owner;
7050 {
7051 	int i, qn, len;
7052 	unsigned int hashval;
7053 	time_t now;
7054 	char basedir[MAXPATHLEN];
7055 	struct stat st;
7056 
7057 	/*
7058 	**  Determine basedir for all queue directories.
7059 	**  All queue directories must be (first level) subdirectories
7060 	**  of the basedir.  The basedir is the QueueDir
7061 	**  without wildcards, but with trailing /
7062 	*/
7063 
7064 	hashval = 0;
7065 	errno = 0;
7066 	len = sm_strlcpy(basedir, QueueDir, sizeof(basedir));
7067 
7068 	/* Provide space for trailing '/' */
7069 	if (len >= sizeof(basedir) - 1)
7070 	{
7071 		syserr("QueueDirectory: path too long: %d,  max %d",
7072 			len, (int) sizeof(basedir) - 1);
7073 		ExitStat = EX_CONFIG;
7074 		return;
7075 	}
7076 	SM_ASSERT(len > 0);
7077 	if (basedir[len - 1] == '*')
7078 	{
7079 		char *cp;
7080 
7081 		cp = SM_LAST_DIR_DELIM(basedir);
7082 		if (cp == NULL)
7083 		{
7084 			syserr("QueueDirectory: can not wildcard relative path \"%s\"",
7085 				QueueDir);
7086 			if (tTd(41, 2))
7087 				sm_dprintf("setup_queues: \"%s\": Can not wildcard relative path.\n",
7088 					QueueDir);
7089 			ExitStat = EX_CONFIG;
7090 			return;
7091 		}
7092 
7093 		/* cut off wildcard pattern */
7094 		*++cp = '\0';
7095 		len = cp - basedir;
7096 	}
7097 	else if (!SM_IS_DIR_DELIM(basedir[len - 1]))
7098 	{
7099 		/* append trailing slash since it is a directory */
7100 		basedir[len] = '/';
7101 		basedir[++len] = '\0';
7102 	}
7103 
7104 	/* len counts up to the last directory delimiter */
7105 	SM_ASSERT(basedir[len - 1] == '/');
7106 
7107 	if (chdir(basedir) < 0)
7108 	{
7109 		int save_errno = errno;
7110 
7111 		syserr("can not chdir(%s)", basedir);
7112 		if (save_errno == EACCES)
7113 			(void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT,
7114 				"Program mode requires special privileges, e.g., root or TrustedUser.\n");
7115 		if (tTd(41, 2))
7116 			sm_dprintf("setup_queues: \"%s\": %s\n",
7117 				   basedir, sm_errstring(errno));
7118 		ExitStat = EX_CONFIG;
7119 		return;
7120 	}
7121 #if SM_CONF_SHM
7122 	hashval = hash_q(basedir, hashval);
7123 #endif /* SM_CONF_SHM */
7124 
7125 	/* initialize for queue runs */
7126 	DoQueueRun = false;
7127 	now = curtime();
7128 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
7129 		Queue[i]->qg_nextrun = now;
7130 
7131 
7132 	if (UseMSP && OpMode != MD_TEST)
7133 	{
7134 		long sff = SFF_CREAT;
7135 
7136 		if (stat(".", &st) < 0)
7137 		{
7138 			syserr("can not stat(%s)", basedir);
7139 			if (tTd(41, 2))
7140 				sm_dprintf("setup_queues: \"%s\": %s\n",
7141 					   basedir, sm_errstring(errno));
7142 			ExitStat = EX_CONFIG;
7143 			return;
7144 		}
7145 		if (RunAsUid == 0)
7146 			sff |= SFF_ROOTOK;
7147 
7148 		/*
7149 		**  Check queue directory permissions.
7150 		**	Can we write to a group writable queue directory?
7151 		*/
7152 
7153 		if (bitset(S_IWGRP, QueueFileMode) &&
7154 		    bitset(S_IWGRP, st.st_mode) &&
7155 		    safefile(" ", RunAsUid, RunAsGid, RunAsUserName, sff,
7156 			     QueueFileMode, NULL) != 0)
7157 		{
7158 			syserr("can not write to queue directory %s (RunAsGid=%ld, required=%ld)",
7159 				basedir, (long) RunAsGid, (long) st.st_gid);
7160 		}
7161 		if (bitset(S_IWOTH|S_IXOTH, st.st_mode))
7162 		{
7163 #if _FFR_MSP_PARANOIA
7164 			syserr("dangerous permissions=%o on queue directory %s",
7165 				(unsigned int) st.st_mode, basedir);
7166 #else /* _FFR_MSP_PARANOIA */
7167 			if (LogLevel > 0)
7168 				sm_syslog(LOG_ERR, NOQID,
7169 					  "dangerous permissions=%o on queue directory %s",
7170 					  (unsigned int) st.st_mode, basedir);
7171 #endif /* _FFR_MSP_PARANOIA */
7172 		}
7173 #if _FFR_MSP_PARANOIA
7174 		if (NumQueue > 1)
7175 			syserr("can not use multiple queues for MSP");
7176 #endif /* _FFR_MSP_PARANOIA */
7177 	}
7178 
7179 	/* initial number of queue directories */
7180 	qn = 0;
7181 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
7182 		qn = multiqueue_cache(basedir, len, Queue[i], qn, &hashval);
7183 
7184 #if SM_CONF_SHM
7185 	init_shm(qn, owner, hashval);
7186 	i = filesys_setup(owner || ShmId == SM_SHM_NO_ID);
7187 	if (i == FSF_NOT_FOUND)
7188 	{
7189 		/*
7190 		**  We didn't get the right filesystem data
7191 		**  This may happen if we don't have the right shared memory.
7192 		**  So let's do this without shared memory.
7193 		*/
7194 
7195 		SM_ASSERT(!owner);
7196 		cleanup_shm(false);	/* release shared memory */
7197 		i = filesys_setup(false);
7198 		if (i < 0)
7199 			syserr("filesys_setup failed twice, result=%d", i);
7200 		else if (LogLevel > 8)
7201 			sm_syslog(LOG_WARNING, NOQID,
7202 				  "shared memory does not contain expected data, ignored");
7203 	}
7204 #else /* SM_CONF_SHM */
7205 	i = filesys_setup(true);
7206 #endif /* SM_CONF_SHM */
7207 	if (i < 0)
7208 		ExitStat = EX_CONFIG;
7209 }
7210 
7211 #if SM_CONF_SHM
7212 /*
7213 **  CLEANUP_SHM -- do some cleanup work for shared memory etc
7214 **
7215 **	Parameters:
7216 **		owner -- owner of shared memory?
7217 **
7218 **	Returns:
7219 **		none.
7220 **
7221 **	Side Effects:
7222 **		detaches shared memory.
7223 */
7224 
7225 void
7226 cleanup_shm(owner)
7227 	bool owner;
7228 {
7229 	if (ShmId != SM_SHM_NO_ID)
7230 	{
7231 		if (sm_shmstop(Pshm, ShmId, owner) < 0 && LogLevel > 8)
7232 			sm_syslog(LOG_INFO, NOQID, "sm_shmstop failed=%s",
7233 				  sm_errstring(errno));
7234 		Pshm = NULL;
7235 		ShmId = SM_SHM_NO_ID;
7236 	}
7237 	stop_sem(owner);
7238 }
7239 #endif /* SM_CONF_SHM */
7240 
7241 /*
7242 **  CLEANUP_QUEUES -- do some cleanup work for queues
7243 **
7244 **	Parameters:
7245 **		none.
7246 **
7247 **	Returns:
7248 **		none.
7249 **
7250 */
7251 
7252 void
7253 cleanup_queues()
7254 {
7255 	sync_queue_time();
7256 }
7257 /*
7258 **  SET_DEF_QUEUEVAL -- set default values for a queue group.
7259 **
7260 **	Parameters:
7261 **		qg -- queue group
7262 **		all -- set all values (true for default group)?
7263 **
7264 **	Returns:
7265 **		none.
7266 **
7267 **	Side Effects:
7268 **		sets default values for the queue group.
7269 */
7270 
7271 void
7272 set_def_queueval(qg, all)
7273 	QUEUEGRP *qg;
7274 	bool all;
7275 {
7276 	if (bitnset(QD_DEFINED, qg->qg_flags))
7277 		return;
7278 	if (all)
7279 		qg->qg_qdir = QueueDir;
7280 #if _FFR_QUEUE_GROUP_SORTORDER
7281 	qg->qg_sortorder = QueueSortOrder;
7282 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7283 	qg->qg_maxqrun = all ? MaxRunnersPerQueue : -1;
7284 	qg->qg_nice = NiceQueueRun;
7285 }
7286 /*
7287 **  MAKEQUEUE -- define a new queue.
7288 **
7289 **	Parameters:
7290 **		line -- description of queue.  This is in labeled fields.
7291 **			The fields are:
7292 **			   F -- the flags associated with the queue
7293 **			   I -- the interval between running the queue
7294 **			   J -- the maximum # of jobs in work list
7295 **			   [M -- the maximum # of jobs in a queue run]
7296 **			   N -- the niceness at which to run
7297 **			   P -- the path to the queue
7298 **			   S -- the queue sorting order
7299 **			   R -- number of parallel queue runners
7300 **			   r -- max recipients per envelope
7301 **			The first word is the canonical name of the queue.
7302 **		qdef -- this is a 'Q' definition from .cf
7303 **
7304 **	Returns:
7305 **		none.
7306 **
7307 **	Side Effects:
7308 **		enters the queue into the queue table.
7309 */
7310 
7311 void
7312 makequeue(line, qdef)
7313 	char *line;
7314 	bool qdef;
7315 {
7316 	register char *p;
7317 	register QUEUEGRP *qg;
7318 	register STAB *s;
7319 	int i;
7320 	char fcode;
7321 
7322 	/* allocate a queue and set up defaults */
7323 	qg = (QUEUEGRP *) xalloc(sizeof(*qg));
7324 	memset((char *) qg, '\0', sizeof(*qg));
7325 
7326 	if (line[0] == '\0')
7327 	{
7328 		syserr("name required for queue");
7329 		return;
7330 	}
7331 
7332 	/* collect the queue name */
7333 	for (p = line;
7334 	     *p != '\0' && *p != ',' && !(isascii(*p) && isspace(*p));
7335 	     p++)
7336 		continue;
7337 	if (*p != '\0')
7338 		*p++ = '\0';
7339 	qg->qg_name = newstr(line);
7340 
7341 	/* set default values, can be overridden below */
7342 	set_def_queueval(qg, false);
7343 
7344 	/* now scan through and assign info from the fields */
7345 	while (*p != '\0')
7346 	{
7347 		auto char *delimptr;
7348 
7349 		while (*p != '\0' &&
7350 		       (*p == ',' || (isascii(*p) && isspace(*p))))
7351 			p++;
7352 
7353 		/* p now points to field code */
7354 		fcode = *p;
7355 		while (*p != '\0' && *p != '=' && *p != ',')
7356 			p++;
7357 		if (*p++ != '=')
7358 		{
7359 			syserr("queue %s: `=' expected", qg->qg_name);
7360 			return;
7361 		}
7362 		while (isascii(*p) && isspace(*p))
7363 			p++;
7364 
7365 		/* p now points to the field body */
7366 		p = munchstring(p, &delimptr, ',');
7367 
7368 		/* install the field into the queue struct */
7369 		switch (fcode)
7370 		{
7371 		  case 'P':		/* pathname */
7372 			if (*p == '\0')
7373 				syserr("queue %s: empty path name",
7374 					qg->qg_name);
7375 			else
7376 				qg->qg_qdir = newstr(p);
7377 			break;
7378 
7379 		  case 'F':		/* flags */
7380 			for (; *p != '\0'; p++)
7381 				if (!(isascii(*p) && isspace(*p)))
7382 					setbitn(*p, qg->qg_flags);
7383 			break;
7384 
7385 			/*
7386 			**  Do we need two intervals here:
7387 			**  One for persistent queue runners,
7388 			**  one for "normal" queue runs?
7389 			*/
7390 
7391 		  case 'I':	/* interval between running the queue */
7392 			qg->qg_queueintvl = convtime(p, 'm');
7393 			break;
7394 
7395 		  case 'N':		/* run niceness */
7396 			qg->qg_nice = atoi(p);
7397 			break;
7398 
7399 		  case 'R':		/* maximum # of runners for the group */
7400 			i = atoi(p);
7401 
7402 			/* can't have more runners than allowed total */
7403 			if (MaxQueueChildren > 0 && i > MaxQueueChildren)
7404 			{
7405 				qg->qg_maxqrun = MaxQueueChildren;
7406 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7407 						     "Q=%s: R=%d exceeds MaxQueueChildren=%d, set to MaxQueueChildren\n",
7408 						     qg->qg_name, i,
7409 						     MaxQueueChildren);
7410 			}
7411 			else
7412 				qg->qg_maxqrun = i;
7413 			break;
7414 
7415 		  case 'J':		/* maximum # of jobs in work list */
7416 			qg->qg_maxlist = atoi(p);
7417 			break;
7418 
7419 		  case 'r':		/* max recipients per envelope */
7420 			qg->qg_maxrcpt = atoi(p);
7421 			break;
7422 
7423 #if _FFR_QUEUE_GROUP_SORTORDER
7424 		  case 'S':		/* queue sorting order */
7425 			switch (*p)
7426 			{
7427 			  case 'h':	/* Host first */
7428 			  case 'H':
7429 				qg->qg_sortorder = QSO_BYHOST;
7430 				break;
7431 
7432 			  case 'p':	/* Priority order */
7433 			  case 'P':
7434 				qg->qg_sortorder = QSO_BYPRIORITY;
7435 				break;
7436 
7437 			  case 't':	/* Submission time */
7438 			  case 'T':
7439 				qg->qg_sortorder = QSO_BYTIME;
7440 				break;
7441 
7442 			  case 'f':	/* File name */
7443 			  case 'F':
7444 				qg->qg_sortorder = QSO_BYFILENAME;
7445 				break;
7446 
7447 			  case 'm':	/* Modification time */
7448 			  case 'M':
7449 				qg->qg_sortorder = QSO_BYMODTIME;
7450 				break;
7451 
7452 			  case 'r':	/* Random */
7453 			  case 'R':
7454 				qg->qg_sortorder = QSO_RANDOM;
7455 				break;
7456 
7457 # if _FFR_RHS
7458 			  case 's':	/* Shuffled host name */
7459 			  case 'S':
7460 				qg->qg_sortorder = QSO_BYSHUFFLE;
7461 				break;
7462 # endif /* _FFR_RHS */
7463 
7464 			  case 'n':	/* none */
7465 			  case 'N':
7466 				qg->qg_sortorder = QSO_NONE;
7467 				break;
7468 
7469 			  default:
7470 				syserr("Invalid queue sort order \"%s\"", p);
7471 			}
7472 			break;
7473 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7474 
7475 		  default:
7476 			syserr("Q%s: unknown queue equate %c=",
7477 			       qg->qg_name, fcode);
7478 			break;
7479 		}
7480 
7481 		p = delimptr;
7482 	}
7483 
7484 #if !HASNICE
7485 	if (qg->qg_nice != NiceQueueRun)
7486 	{
7487 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7488 				     "Q%s: Warning: N= set on system that doesn't support nice()\n",
7489 				     qg->qg_name);
7490 	}
7491 #endif /* !HASNICE */
7492 
7493 	/* do some rationality checking */
7494 	if (NumQueue >= MAXQUEUEGROUPS)
7495 	{
7496 		syserr("too many queue groups defined (%d max)",
7497 			MAXQUEUEGROUPS);
7498 		return;
7499 	}
7500 
7501 	if (qg->qg_qdir == NULL)
7502 	{
7503 		if (QueueDir == NULL || *QueueDir == '\0')
7504 		{
7505 			syserr("QueueDir must be defined before queue groups");
7506 			return;
7507 		}
7508 		qg->qg_qdir = newstr(QueueDir);
7509 	}
7510 
7511 	if (qg->qg_maxqrun > 1 && !bitnset(QD_FORK, qg->qg_flags))
7512 	{
7513 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7514 				     "Warning: Q=%s: R=%d: multiple queue runners specified\n\tbut flag '%c' is not set\n",
7515 				     qg->qg_name, qg->qg_maxqrun, QD_FORK);
7516 	}
7517 
7518 	/* enter the queue into the symbol table */
7519 	if (tTd(37, 8))
7520 		sm_syslog(LOG_INFO, NOQID,
7521 			  "Adding %s to stab, path: %s", qg->qg_name,
7522 			  qg->qg_qdir);
7523 	s = stab(qg->qg_name, ST_QUEUE, ST_ENTER);
7524 	if (s->s_quegrp != NULL)
7525 	{
7526 		i = s->s_quegrp->qg_index;
7527 
7528 		/* XXX what about the pointers inside this struct? */
7529 		sm_free(s->s_quegrp); /* XXX */
7530 	}
7531 	else
7532 		i = NumQueue++;
7533 	Queue[i] = s->s_quegrp = qg;
7534 	qg->qg_index = i;
7535 
7536 	/* set default value for max queue runners */
7537 	if (qg->qg_maxqrun < 0)
7538 	{
7539 		if (MaxRunnersPerQueue > 0)
7540 			qg->qg_maxqrun = MaxRunnersPerQueue;
7541 		else
7542 			qg->qg_maxqrun = 1;
7543 	}
7544 	if (qdef)
7545 		setbitn(QD_DEFINED, qg->qg_flags);
7546 }
7547 #if 0
7548 /*
7549 **  HASHFQN -- calculate a hash value for a fully qualified host name
7550 **
7551 **	Arguments:
7552 **		fqn -- an all lower-case host.domain string
7553 **		buckets -- the number of buckets (queue directories)
7554 **
7555 **	Returns:
7556 **		a bucket number (signed integer)
7557 **		-1 on error
7558 **
7559 **	Contributed by Exactis.com, Inc.
7560 */
7561 
7562 int
7563 hashfqn(fqn, buckets)
7564 	register char *fqn;
7565 	int buckets;
7566 {
7567 	register char *p;
7568 	register int h = 0, hash, cnt;
7569 
7570 	if (fqn == NULL)
7571 		return -1;
7572 
7573 	/*
7574 	**  A variation on the gdb hash
7575 	**  This is the best as of Feb 19, 1996 --bcx
7576 	*/
7577 
7578 	p = fqn;
7579 	h = 0x238F13AF * strlen(p);
7580 	for (cnt = 0; *p != 0; ++p, cnt++)
7581 	{
7582 		h = (h + (*p << (cnt * 5 % 24))) & 0x7FFFFFFF;
7583 	}
7584 	h = (1103515243 * h + 12345) & 0x7FFFFFFF;
7585 	if (buckets < 2)
7586 		hash = 0;
7587 	else
7588 		hash = (h % buckets);
7589 
7590 	return hash;
7591 }
7592 #endif /* 0 */
7593 
7594 /*
7595 **  A structure for sorting Queue according to maxqrun without
7596 **	screwing up Queue itself.
7597 */
7598 
7599 struct sortqgrp
7600 {
7601 	int sg_idx;		/* original index */
7602 	int sg_maxqrun;		/* max queue runners */
7603 };
7604 typedef struct sortqgrp	SORTQGRP_T;
7605 static int cmpidx __P((const void *, const void *));
7606 
7607 static int
7608 cmpidx(a, b)
7609 	const void *a;
7610 	const void *b;
7611 {
7612 	/* The sort is highest to lowest, so the comparison is reversed */
7613 	if (((SORTQGRP_T *)a)->sg_maxqrun < ((SORTQGRP_T *)b)->sg_maxqrun)
7614 		return 1;
7615 	else if (((SORTQGRP_T *)a)->sg_maxqrun > ((SORTQGRP_T *)b)->sg_maxqrun)
7616 		return -1;
7617 	else
7618 		return 0;
7619 }
7620 
7621 /*
7622 **  MAKEWORKGROUPS -- balance queue groups into work groups per MaxQueueChildren
7623 **
7624 **  Take the now defined queue groups and assign them to work groups.
7625 **  This is done to balance out the number of concurrently active
7626 **  queue runners such that MaxQueueChildren is not exceeded. This may
7627 **  result in more than one queue group per work group. In such a case
7628 **  the number of running queue groups in that work group will have no
7629 **  more than the work group maximum number of runners (a "fair" portion
7630 **  of MaxQueueRunners). All queue groups within a work group will get a
7631 **  chance at running.
7632 **
7633 **	Parameters:
7634 **		none.
7635 **
7636 **	Returns:
7637 **		nothing.
7638 **
7639 **	Side Effects:
7640 **		Sets up WorkGrp structure.
7641 */
7642 
7643 void
7644 makeworkgroups()
7645 {
7646 	int i, j, total_runners, dir, h;
7647 	SORTQGRP_T si[MAXQUEUEGROUPS + 1];
7648 
7649 	total_runners = 0;
7650 	if (NumQueue == 1 && strcmp(Queue[0]->qg_name, "mqueue") == 0)
7651 	{
7652 		/*
7653 		**  There is only the "mqueue" queue group (a default)
7654 		**  containing all of the queues. We want to provide to
7655 		**  this queue group the maximum allowable queue runners.
7656 		**  To match older behavior (8.10/8.11) we'll try for
7657 		**  1 runner per queue capping it at MaxQueueChildren.
7658 		**  So if there are N queues, then there will be N runners
7659 		**  for the "mqueue" queue group (where N is kept less than
7660 		**  MaxQueueChildren).
7661 		*/
7662 
7663 		NumWorkGroups = 1;
7664 		WorkGrp[0].wg_numqgrp = 1;
7665 		WorkGrp[0].wg_qgs = (QUEUEGRP **) xalloc(sizeof(QUEUEGRP *));
7666 		WorkGrp[0].wg_qgs[0] = Queue[0];
7667 		if (MaxQueueChildren > 0 &&
7668 		    Queue[0]->qg_numqueues > MaxQueueChildren)
7669 			WorkGrp[0].wg_runners = MaxQueueChildren;
7670 		else
7671 			WorkGrp[0].wg_runners = Queue[0]->qg_numqueues;
7672 
7673 		Queue[0]->qg_wgrp = 0;
7674 
7675 		/* can't have more runners than allowed total */
7676 		if (MaxQueueChildren > 0 &&
7677 		    Queue[0]->qg_maxqrun > MaxQueueChildren)
7678 			Queue[0]->qg_maxqrun = MaxQueueChildren;
7679 		WorkGrp[0].wg_maxact = Queue[0]->qg_maxqrun;
7680 		WorkGrp[0].wg_lowqintvl = Queue[0]->qg_queueintvl;
7681 		return;
7682 	}
7683 
7684 	for (i = 0; i < NumQueue; i++)
7685 	{
7686 		si[i].sg_maxqrun = Queue[i]->qg_maxqrun;
7687 		si[i].sg_idx = i;
7688 	}
7689 	qsort(si, NumQueue, sizeof(si[0]), cmpidx);
7690 
7691 	NumWorkGroups = 0;
7692 	for (i = 0; i < NumQueue; i++)
7693 	{
7694 		SKIP_BOUNCE_QUEUE
7695 		total_runners += si[i].sg_maxqrun;
7696 		if (MaxQueueChildren <= 0 || total_runners <= MaxQueueChildren)
7697 			NumWorkGroups++;
7698 		else
7699 			break;
7700 	}
7701 
7702 	if (NumWorkGroups < 1)
7703 		NumWorkGroups = 1; /* gotta have one at least */
7704 	else if (NumWorkGroups > MAXWORKGROUPS)
7705 		NumWorkGroups = MAXWORKGROUPS; /* the limit */
7706 
7707 	/*
7708 	**  We now know the number of work groups to pack the queue groups
7709 	**  into. The queue groups in 'Queue' are sorted from highest
7710 	**  to lowest for the number of runners per queue group.
7711 	**  We put the queue groups with the largest number of runners
7712 	**  into work groups first. Then the smaller ones are fitted in
7713 	**  where it looks best.
7714 	*/
7715 
7716 	j = 0;
7717 	dir = 1;
7718 	for (i = 0; i < NumQueue; i++)
7719 	{
7720 		SKIP_BOUNCE_QUEUE
7721 
7722 		/* a to-and-fro packing scheme, continue from last position */
7723 		if (j >= NumWorkGroups)
7724 		{
7725 			dir = -1;
7726 			j = NumWorkGroups - 1;
7727 		}
7728 		else if (j < 0)
7729 		{
7730 			j = 0;
7731 			dir = 1;
7732 		}
7733 
7734 		if (WorkGrp[j].wg_qgs == NULL)
7735 			WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_malloc(sizeof(QUEUEGRP *) *
7736 							(WorkGrp[j].wg_numqgrp + 1));
7737 		else
7738 			WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_realloc(WorkGrp[j].wg_qgs,
7739 							sizeof(QUEUEGRP *) *
7740 							(WorkGrp[j].wg_numqgrp + 1));
7741 		if (WorkGrp[j].wg_qgs == NULL)
7742 		{
7743 			syserr("!cannot allocate memory for work queues, need %d bytes",
7744 			       (int) (sizeof(QUEUEGRP *) *
7745 				      (WorkGrp[j].wg_numqgrp + 1)));
7746 		}
7747 
7748 		h = si[i].sg_idx;
7749 		WorkGrp[j].wg_qgs[WorkGrp[j].wg_numqgrp] = Queue[h];
7750 		WorkGrp[j].wg_numqgrp++;
7751 		WorkGrp[j].wg_runners += Queue[h]->qg_maxqrun;
7752 		Queue[h]->qg_wgrp = j;
7753 
7754 		if (WorkGrp[j].wg_maxact == 0)
7755 		{
7756 			/* can't have more runners than allowed total */
7757 			if (MaxQueueChildren > 0 &&
7758 			    Queue[h]->qg_maxqrun > MaxQueueChildren)
7759 				Queue[h]->qg_maxqrun = MaxQueueChildren;
7760 			WorkGrp[j].wg_maxact = Queue[h]->qg_maxqrun;
7761 		}
7762 
7763 		/*
7764 		**  XXX: must wg_lowqintvl be the GCD?
7765 		**  qg1: 2m, qg2: 3m, minimum: 2m, when do queue runs for
7766 		**  qg2 occur?
7767 		*/
7768 
7769 		/* keep track of the lowest interval for a persistent runner */
7770 		if (Queue[h]->qg_queueintvl > 0 &&
7771 		    WorkGrp[j].wg_lowqintvl < Queue[h]->qg_queueintvl)
7772 			WorkGrp[j].wg_lowqintvl = Queue[h]->qg_queueintvl;
7773 		j += dir;
7774 	}
7775 	if (tTd(41, 9))
7776 	{
7777 		for (i = 0; i < NumWorkGroups; i++)
7778 		{
7779 			sm_dprintf("Workgroup[%d]=", i);
7780 			for (j = 0; j < WorkGrp[i].wg_numqgrp; j++)
7781 			{
7782 				sm_dprintf("%s, ",
7783 					WorkGrp[i].wg_qgs[j]->qg_name);
7784 			}
7785 			sm_dprintf("\n");
7786 		}
7787 	}
7788 }
7789 
7790 /*
7791 **  DUP_DF -- duplicate envelope data file
7792 **
7793 **	Copy the data file from the 'old' envelope to the 'new' envelope
7794 **	in the most efficient way possible.
7795 **
7796 **	Create a hard link from the 'old' data file to the 'new' data file.
7797 **	If the old and new queue directories are on different file systems,
7798 **	then the new data file link is created in the old queue directory,
7799 **	and the new queue file will contain a 'd' record pointing to the
7800 **	directory containing the new data file.
7801 **
7802 **	Parameters:
7803 **		old -- old envelope.
7804 **		new -- new envelope.
7805 **
7806 **	Results:
7807 **		Returns true on success, false on failure.
7808 **
7809 **	Side Effects:
7810 **		On success, the new data file is created.
7811 **		On fatal failure, EF_FATALERRS is set in old->e_flags.
7812 */
7813 
7814 static bool	dup_df __P((ENVELOPE *, ENVELOPE *));
7815 
7816 static bool
7817 dup_df(old, new)
7818 	ENVELOPE *old;
7819 	ENVELOPE *new;
7820 {
7821 	int ofs, nfs, r;
7822 	char opath[MAXPATHLEN];
7823 	char npath[MAXPATHLEN];
7824 
7825 	if (!bitset(EF_HAS_DF, old->e_flags))
7826 	{
7827 		/*
7828 		**  this can happen if: SuperSafe != True
7829 		**  and a bounce mail is sent that is split.
7830 		*/
7831 
7832 		queueup(old, false, true);
7833 	}
7834 	SM_REQUIRE(ISVALIDQGRP(old->e_qgrp) && ISVALIDQDIR(old->e_qdir));
7835 	SM_REQUIRE(ISVALIDQGRP(new->e_qgrp) && ISVALIDQDIR(new->e_qdir));
7836 
7837 	(void) sm_strlcpy(opath, queuename(old, DATAFL_LETTER), sizeof(opath));
7838 	(void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof(npath));
7839 
7840 	if (old->e_dfp != NULL)
7841 	{
7842 		r = sm_io_setinfo(old->e_dfp, SM_BF_COMMIT, NULL);
7843 		if (r < 0 && errno != EINVAL)
7844 		{
7845 			syserr("@can't commit %s", opath);
7846 			old->e_flags |= EF_FATALERRS;
7847 			return false;
7848 		}
7849 	}
7850 
7851 	/*
7852 	**  Attempt to create a hard link, if we think both old and new
7853 	**  are on the same file system, otherwise copy the file.
7854 	**
7855 	**  Don't waste time attempting a hard link unless old and new
7856 	**  are on the same file system.
7857 	*/
7858 
7859 	SM_REQUIRE(ISVALIDQGRP(old->e_dfqgrp) && ISVALIDQDIR(old->e_dfqdir));
7860 	SM_REQUIRE(ISVALIDQGRP(new->e_dfqgrp) && ISVALIDQDIR(new->e_dfqdir));
7861 
7862 	ofs = Queue[old->e_dfqgrp]->qg_qpaths[old->e_dfqdir].qp_fsysidx;
7863 	nfs = Queue[new->e_dfqgrp]->qg_qpaths[new->e_dfqdir].qp_fsysidx;
7864 	if (FILE_SYS_DEV(ofs) == FILE_SYS_DEV(nfs))
7865 	{
7866 		if (link(opath, npath) == 0)
7867 		{
7868 			new->e_flags |= EF_HAS_DF;
7869 			SYNC_DIR(npath, true);
7870 			return true;
7871 		}
7872 		goto error;
7873 	}
7874 
7875 	/*
7876 	**  Can't link across queue directories, so try to create a hard
7877 	**  link in the same queue directory as the old df file.
7878 	**  The qf file will refer to the new df file using a 'd' record.
7879 	*/
7880 
7881 	new->e_dfqgrp = old->e_dfqgrp;
7882 	new->e_dfqdir = old->e_dfqdir;
7883 	(void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof(npath));
7884 	if (link(opath, npath) == 0)
7885 	{
7886 		new->e_flags |= EF_HAS_DF;
7887 		SYNC_DIR(npath, true);
7888 		return true;
7889 	}
7890 
7891   error:
7892 	if (LogLevel > 0)
7893 		sm_syslog(LOG_ERR, old->e_id,
7894 			  "dup_df: can't link %s to %s, error=%s, envelope splitting failed",
7895 			  opath, npath, sm_errstring(errno));
7896 	return false;
7897 }
7898 
7899 /*
7900 **  SPLIT_ENV -- Allocate a new envelope based on a given envelope.
7901 **
7902 **	Parameters:
7903 **		e -- envelope.
7904 **		sendqueue -- sendqueue for new envelope.
7905 **		qgrp -- index of queue group.
7906 **		qdir -- queue directory.
7907 **
7908 **	Results:
7909 **		new envelope.
7910 **
7911 */
7912 
7913 static ENVELOPE	*split_env __P((ENVELOPE *, ADDRESS *, int, int));
7914 
7915 static ENVELOPE *
7916 split_env(e, sendqueue, qgrp, qdir)
7917 	ENVELOPE *e;
7918 	ADDRESS *sendqueue;
7919 	int qgrp;
7920 	int qdir;
7921 {
7922 	ENVELOPE *ee;
7923 
7924 	ee = (ENVELOPE *) sm_rpool_malloc_x(e->e_rpool, sizeof(*ee));
7925 	STRUCTCOPY(*e, *ee);
7926 	ee->e_message = NULL;	/* XXX use original message? */
7927 	ee->e_id = NULL;
7928 	assign_queueid(ee);
7929 	ee->e_sendqueue = sendqueue;
7930 	ee->e_flags &= ~(EF_INQUEUE|EF_CLRQUEUE|EF_FATALERRS
7931 			 |EF_SENDRECEIPT|EF_RET_PARAM|EF_HAS_DF);
7932 	ee->e_flags |= EF_NORECEIPT;	/* XXX really? */
7933 	ee->e_from.q_state = QS_SENDER;
7934 	ee->e_dfp = NULL;
7935 	ee->e_lockfp = NULL;
7936 	if (e->e_xfp != NULL)
7937 		ee->e_xfp = sm_io_dup(e->e_xfp);
7938 
7939 	/* failed to dup e->e_xfp, start a new transcript */
7940 	if (ee->e_xfp == NULL)
7941 		openxscript(ee);
7942 
7943 	ee->e_qgrp = ee->e_dfqgrp = qgrp;
7944 	ee->e_qdir = ee->e_dfqdir = qdir;
7945 	ee->e_errormode = EM_MAIL;
7946 	ee->e_statmsg = NULL;
7947 	if (e->e_quarmsg != NULL)
7948 		ee->e_quarmsg = sm_rpool_strdup_x(ee->e_rpool,
7949 						  e->e_quarmsg);
7950 
7951 	/*
7952 	**  XXX Not sure if this copying is necessary.
7953 	**  sendall() does this copying, but I (dm) don't know if that is
7954 	**  because of the storage management discipline we were using
7955 	**  before rpools were introduced, or if it is because these lists
7956 	**  can be modified later.
7957 	*/
7958 
7959 	ee->e_header = copyheader(e->e_header, ee->e_rpool);
7960 	ee->e_errorqueue = copyqueue(e->e_errorqueue, ee->e_rpool);
7961 
7962 	return ee;
7963 }
7964 
7965 /* return values from split functions, check also below! */
7966 #define SM_SPLIT_FAIL	(0)
7967 #define SM_SPLIT_NONE	(1)
7968 #define SM_SPLIT_NEW(n)	(1 + (n))
7969 
7970 /*
7971 **  SPLIT_ACROSS_QUEUE_GROUPS
7972 **
7973 **	This function splits an envelope across multiple queue groups
7974 **	based on the queue group of each recipient.
7975 **
7976 **	Parameters:
7977 **		e -- envelope.
7978 **
7979 **	Results:
7980 **		SM_SPLIT_FAIL on failure
7981 **		SM_SPLIT_NONE if no splitting occurred,
7982 **		or 1 + the number of additional envelopes created.
7983 **
7984 **	Side Effects:
7985 **		On success, e->e_sibling points to a list of zero or more
7986 **		additional envelopes, and the associated data files exist
7987 **		on disk.  But the queue files are not created.
7988 **
7989 **		On failure, e->e_sibling is not changed.
7990 **		The order of recipients in e->e_sendqueue is permuted.
7991 **		Abandoned data files for additional envelopes that failed
7992 **		to be created may exist on disk.
7993 */
7994 
7995 static int	q_qgrp_compare __P((const void *, const void *));
7996 static int	e_filesys_compare __P((const void *, const void *));
7997 
7998 static int
7999 q_qgrp_compare(p1, p2)
8000 	const void *p1;
8001 	const void *p2;
8002 {
8003 	ADDRESS **pq1 = (ADDRESS **) p1;
8004 	ADDRESS **pq2 = (ADDRESS **) p2;
8005 
8006 	return (*pq1)->q_qgrp - (*pq2)->q_qgrp;
8007 }
8008 
8009 static int
8010 e_filesys_compare(p1, p2)
8011 	const void *p1;
8012 	const void *p2;
8013 {
8014 	ENVELOPE **pe1 = (ENVELOPE **) p1;
8015 	ENVELOPE **pe2 = (ENVELOPE **) p2;
8016 	int fs1, fs2;
8017 
8018 	fs1 = Queue[(*pe1)->e_qgrp]->qg_qpaths[(*pe1)->e_qdir].qp_fsysidx;
8019 	fs2 = Queue[(*pe2)->e_qgrp]->qg_qpaths[(*pe2)->e_qdir].qp_fsysidx;
8020 	if (FILE_SYS_DEV(fs1) < FILE_SYS_DEV(fs2))
8021 		return -1;
8022 	if (FILE_SYS_DEV(fs1) > FILE_SYS_DEV(fs2))
8023 		return 1;
8024 	return 0;
8025 }
8026 
8027 static int split_across_queue_groups __P((ENVELOPE *));
8028 static int
8029 split_across_queue_groups(e)
8030 	ENVELOPE *e;
8031 {
8032 	int naddrs, nsplits, i;
8033 	bool changed;
8034 	char **pvp;
8035 	ADDRESS *q, **addrs;
8036 	ENVELOPE *ee, *es;
8037 	ENVELOPE *splits[MAXQUEUEGROUPS];
8038 	char pvpbuf[PSBUFSIZE];
8039 
8040 	SM_REQUIRE(ISVALIDQGRP(e->e_qgrp));
8041 
8042 	/* Count addresses and assign queue groups. */
8043 	naddrs = 0;
8044 	changed = false;
8045 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
8046 	{
8047 		if (QS_IS_DEAD(q->q_state))
8048 			continue;
8049 		++naddrs;
8050 
8051 		/* bad addresses and those already sent stay put */
8052 		if (QS_IS_BADADDR(q->q_state) ||
8053 		    QS_IS_SENT(q->q_state))
8054 			q->q_qgrp = e->e_qgrp;
8055 		else if (!ISVALIDQGRP(q->q_qgrp))
8056 		{
8057 			/* call ruleset which should return a queue group */
8058 			i = rscap(RS_QUEUEGROUP, q->q_user, NULL, e, &pvp,
8059 				  pvpbuf, sizeof(pvpbuf));
8060 			if (i == EX_OK &&
8061 			    pvp != NULL && pvp[0] != NULL &&
8062 			    (pvp[0][0] & 0377) == CANONNET &&
8063 			    pvp[1] != NULL && pvp[1][0] != '\0')
8064 			{
8065 				i = name2qid(pvp[1]);
8066 				if (ISVALIDQGRP(i))
8067 				{
8068 					q->q_qgrp = i;
8069 					changed = true;
8070 					if (tTd(20, 4))
8071 						sm_syslog(LOG_INFO, NOQID,
8072 							"queue group name %s -> %d",
8073 							pvp[1], i);
8074 					continue;
8075 				}
8076 				else if (LogLevel > 10)
8077 					sm_syslog(LOG_INFO, NOQID,
8078 						"can't find queue group name %s, selection ignored",
8079 						pvp[1]);
8080 			}
8081 			if (q->q_mailer != NULL &&
8082 			    ISVALIDQGRP(q->q_mailer->m_qgrp))
8083 			{
8084 				changed = true;
8085 				q->q_qgrp = q->q_mailer->m_qgrp;
8086 			}
8087 			else if (ISVALIDQGRP(e->e_qgrp))
8088 				q->q_qgrp = e->e_qgrp;
8089 			else
8090 				q->q_qgrp = 0;
8091 		}
8092 	}
8093 
8094 	/* only one address? nothing to split. */
8095 	if (naddrs <= 1 && !changed)
8096 		return SM_SPLIT_NONE;
8097 
8098 	/* sort the addresses by queue group */
8099 	addrs = sm_rpool_malloc_x(e->e_rpool, naddrs * sizeof(ADDRESS *));
8100 	for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8101 	{
8102 		if (QS_IS_DEAD(q->q_state))
8103 			continue;
8104 		addrs[i++] = q;
8105 	}
8106 	qsort(addrs, naddrs, sizeof(ADDRESS *), q_qgrp_compare);
8107 
8108 	/* split into multiple envelopes, by queue group */
8109 	nsplits = 0;
8110 	es = NULL;
8111 	e->e_sendqueue = NULL;
8112 	for (i = 0; i < naddrs; ++i)
8113 	{
8114 		if (i == naddrs - 1 || addrs[i]->q_qgrp != addrs[i + 1]->q_qgrp)
8115 			addrs[i]->q_next = NULL;
8116 		else
8117 			addrs[i]->q_next = addrs[i + 1];
8118 
8119 		/* same queue group as original envelope? */
8120 		if (addrs[i]->q_qgrp == e->e_qgrp)
8121 		{
8122 			if (e->e_sendqueue == NULL)
8123 				e->e_sendqueue = addrs[i];
8124 			continue;
8125 		}
8126 
8127 		/* different queue group than original envelope */
8128 		if (es == NULL || addrs[i]->q_qgrp != es->e_qgrp)
8129 		{
8130 			ee = split_env(e, addrs[i], addrs[i]->q_qgrp, NOQDIR);
8131 			es = ee;
8132 			splits[nsplits++] = ee;
8133 		}
8134 	}
8135 
8136 	/* no splits? return right now. */
8137 	if (nsplits <= 0)
8138 		return SM_SPLIT_NONE;
8139 
8140 	/* assign a queue directory to each additional envelope */
8141 	for (i = 0; i < nsplits; ++i)
8142 	{
8143 		es = splits[i];
8144 #if 0
8145 		es->e_qdir = pickqdir(Queue[es->e_qgrp], es->e_msgsize, es);
8146 #endif /* 0 */
8147 		if (!setnewqueue(es))
8148 			goto failure;
8149 	}
8150 
8151 	/* sort the additional envelopes by queue file system */
8152 	qsort(splits, nsplits, sizeof(ENVELOPE *), e_filesys_compare);
8153 
8154 	/* create data files for each additional envelope */
8155 	if (!dup_df(e, splits[0]))
8156 	{
8157 		i = 0;
8158 		goto failure;
8159 	}
8160 	for (i = 1; i < nsplits; ++i)
8161 	{
8162 		/* copy or link to the previous data file */
8163 		if (!dup_df(splits[i - 1], splits[i]))
8164 			goto failure;
8165 	}
8166 
8167 	/* success: prepend the new envelopes to the e->e_sibling list */
8168 	for (i = 0; i < nsplits; ++i)
8169 	{
8170 		es = splits[i];
8171 		es->e_sibling = e->e_sibling;
8172 		e->e_sibling = es;
8173 	}
8174 	return SM_SPLIT_NEW(nsplits);
8175 
8176 	/* failure: clean up */
8177   failure:
8178 	if (i > 0)
8179 	{
8180 		int j;
8181 
8182 		for (j = 0; j < i; j++)
8183 			(void) unlink(queuename(splits[j], DATAFL_LETTER));
8184 	}
8185 	e->e_sendqueue = addrs[0];
8186 	for (i = 0; i < naddrs - 1; ++i)
8187 		addrs[i]->q_next = addrs[i + 1];
8188 	addrs[naddrs - 1]->q_next = NULL;
8189 	return SM_SPLIT_FAIL;
8190 }
8191 
8192 /*
8193 **  SPLIT_WITHIN_QUEUE
8194 **
8195 **	Split an envelope with multiple recipients into several
8196 **	envelopes within the same queue directory, if the number of
8197 **	recipients exceeds the limit for the queue group.
8198 **
8199 **	Parameters:
8200 **		e -- envelope.
8201 **
8202 **	Results:
8203 **		SM_SPLIT_FAIL on failure
8204 **		SM_SPLIT_NONE if no splitting occurred,
8205 **		or 1 + the number of additional envelopes created.
8206 */
8207 
8208 #define SPLIT_LOG_LEVEL	8
8209 
8210 static int	split_within_queue __P((ENVELOPE *));
8211 
8212 static int
8213 split_within_queue(e)
8214 	ENVELOPE *e;
8215 {
8216 	int maxrcpt, nrcpt, ndead, nsplit, i;
8217 	int j, l;
8218 	char *lsplits;
8219 	ADDRESS *q, **addrs;
8220 	ENVELOPE *ee, *firstsibling;
8221 
8222 	if (!ISVALIDQGRP(e->e_qgrp) || bitset(EF_SPLIT, e->e_flags))
8223 		return SM_SPLIT_NONE;
8224 
8225 	/* don't bother if there is no recipient limit */
8226 	maxrcpt = Queue[e->e_qgrp]->qg_maxrcpt;
8227 	if (maxrcpt <= 0)
8228 		return SM_SPLIT_NONE;
8229 
8230 	/* count recipients */
8231 	nrcpt = 0;
8232 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
8233 	{
8234 		if (QS_IS_DEAD(q->q_state))
8235 			continue;
8236 		++nrcpt;
8237 	}
8238 	if (nrcpt <= maxrcpt)
8239 		return SM_SPLIT_NONE;
8240 
8241 	/*
8242 	**  Preserve the recipient list
8243 	**  so that we can restore it in case of error.
8244 	**  (But we discard dead addresses.)
8245 	*/
8246 
8247 	addrs = sm_rpool_malloc_x(e->e_rpool, nrcpt * sizeof(ADDRESS *));
8248 	for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8249 	{
8250 		if (QS_IS_DEAD(q->q_state))
8251 			continue;
8252 		addrs[i++] = q;
8253 	}
8254 
8255 	/*
8256 	**  Partition the recipient list so that bad and sent addresses
8257 	**  come first. These will go with the original envelope, and
8258 	**  do not count towards the maxrcpt limit.
8259 	**  addrs[] does not contain QS_IS_DEAD() addresses.
8260 	*/
8261 
8262 	ndead = 0;
8263 	for (i = 0; i < nrcpt; ++i)
8264 	{
8265 		if (QS_IS_BADADDR(addrs[i]->q_state) ||
8266 		    QS_IS_SENT(addrs[i]->q_state) ||
8267 		    QS_IS_DEAD(addrs[i]->q_state)) /* for paranoia's sake */
8268 		{
8269 			if (i > ndead)
8270 			{
8271 				ADDRESS *tmp = addrs[i];
8272 
8273 				addrs[i] = addrs[ndead];
8274 				addrs[ndead] = tmp;
8275 			}
8276 			++ndead;
8277 		}
8278 	}
8279 
8280 	/* Check if no splitting required. */
8281 	if (nrcpt - ndead <= maxrcpt)
8282 		return SM_SPLIT_NONE;
8283 
8284 	/* fix links */
8285 	for (i = 0; i < nrcpt - 1; ++i)
8286 		addrs[i]->q_next = addrs[i + 1];
8287 	addrs[nrcpt - 1]->q_next = NULL;
8288 	e->e_sendqueue = addrs[0];
8289 
8290 	/* prepare buffer for logging */
8291 	if (LogLevel > SPLIT_LOG_LEVEL)
8292 	{
8293 		l = MAXLINE;
8294 		lsplits = sm_malloc(l);
8295 		if (lsplits != NULL)
8296 			*lsplits = '\0';
8297 		j = 0;
8298 	}
8299 	else
8300 	{
8301 		/* get rid of stupid compiler warnings */
8302 		lsplits = NULL;
8303 		j = l = 0;
8304 	}
8305 
8306 	/* split the envelope */
8307 	firstsibling = e->e_sibling;
8308 	i = maxrcpt + ndead;
8309 	nsplit = 0;
8310 	for (;;)
8311 	{
8312 		addrs[i - 1]->q_next = NULL;
8313 		ee = split_env(e, addrs[i], e->e_qgrp, e->e_qdir);
8314 		if (!dup_df(e, ee))
8315 		{
8316 
8317 			ee = firstsibling;
8318 			while (ee != NULL)
8319 			{
8320 				(void) unlink(queuename(ee, DATAFL_LETTER));
8321 				ee = ee->e_sibling;
8322 			}
8323 
8324 			/* Error.  Restore e's sibling & recipient lists. */
8325 			e->e_sibling = firstsibling;
8326 			for (i = 0; i < nrcpt - 1; ++i)
8327 				addrs[i]->q_next = addrs[i + 1];
8328 			if (lsplits != NULL)
8329 				sm_free(lsplits);
8330 			return SM_SPLIT_FAIL;
8331 		}
8332 
8333 		/* prepend the new envelope to e->e_sibling */
8334 		ee->e_sibling = e->e_sibling;
8335 		e->e_sibling = ee;
8336 		++nsplit;
8337 		if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8338 		{
8339 			if (j >= l - strlen(ee->e_id) - 3)
8340 			{
8341 				char *p;
8342 
8343 				l += MAXLINE;
8344 				p = sm_realloc(lsplits, l);
8345 				if (p == NULL)
8346 				{
8347 					/* let's try to get this done */
8348 					sm_free(lsplits);
8349 					lsplits = NULL;
8350 				}
8351 				else
8352 					lsplits = p;
8353 			}
8354 			if (lsplits != NULL)
8355 			{
8356 				if (j == 0)
8357 					j += sm_strlcat(lsplits + j,
8358 							ee->e_id,
8359 							l - j);
8360 				else
8361 					j += sm_strlcat2(lsplits + j,
8362 							 "; ",
8363 							 ee->e_id,
8364 							 l - j);
8365 				SM_ASSERT(j < l);
8366 			}
8367 		}
8368 		if (nrcpt - i <= maxrcpt)
8369 			break;
8370 		i += maxrcpt;
8371 	}
8372 	if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8373 	{
8374 		if (nsplit > 0)
8375 		{
8376 			sm_syslog(LOG_NOTICE, e->e_id,
8377 				  "split: maxrcpts=%d, rcpts=%d, count=%d, id%s=%s",
8378 				  maxrcpt, nrcpt - ndead, nsplit,
8379 				  nsplit > 1 ? "s" : "", lsplits);
8380 		}
8381 		sm_free(lsplits);
8382 	}
8383 	return SM_SPLIT_NEW(nsplit);
8384 }
8385 /*
8386 **  SPLIT_BY_RECIPIENT
8387 **
8388 **	Split an envelope with multiple recipients into multiple
8389 **	envelopes as required by the sendmail configuration.
8390 **
8391 **	Parameters:
8392 **		e -- envelope.
8393 **
8394 **	Results:
8395 **		Returns true on success, false on failure.
8396 **
8397 **	Side Effects:
8398 **		see split_across_queue_groups(), split_within_queue(e)
8399 */
8400 
8401 bool
8402 split_by_recipient(e)
8403 	ENVELOPE *e;
8404 {
8405 	int split, n, i, j, l;
8406 	char *lsplits;
8407 	ENVELOPE *ee, *next, *firstsibling;
8408 
8409 	if (OpMode == SM_VERIFY || !ISVALIDQGRP(e->e_qgrp) ||
8410 	    bitset(EF_SPLIT, e->e_flags))
8411 		return true;
8412 	n = split_across_queue_groups(e);
8413 	if (n == SM_SPLIT_FAIL)
8414 		return false;
8415 	firstsibling = ee = e->e_sibling;
8416 	if (n > 1 && LogLevel > SPLIT_LOG_LEVEL)
8417 	{
8418 		l = MAXLINE;
8419 		lsplits = sm_malloc(l);
8420 		if (lsplits != NULL)
8421 			*lsplits = '\0';
8422 		j = 0;
8423 	}
8424 	else
8425 	{
8426 		/* get rid of stupid compiler warnings */
8427 		lsplits = NULL;
8428 		j = l = 0;
8429 	}
8430 	for (i = 1; i < n; ++i)
8431 	{
8432 		next = ee->e_sibling;
8433 		if (split_within_queue(ee) == SM_SPLIT_FAIL)
8434 		{
8435 			e->e_sibling = firstsibling;
8436 			return false;
8437 		}
8438 		ee->e_flags |= EF_SPLIT;
8439 		if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8440 		{
8441 			if (j >= l - strlen(ee->e_id) - 3)
8442 			{
8443 				char *p;
8444 
8445 				l += MAXLINE;
8446 				p = sm_realloc(lsplits, l);
8447 				if (p == NULL)
8448 				{
8449 					/* let's try to get this done */
8450 					sm_free(lsplits);
8451 					lsplits = NULL;
8452 				}
8453 				else
8454 					lsplits = p;
8455 			}
8456 			if (lsplits != NULL)
8457 			{
8458 				if (j == 0)
8459 					j += sm_strlcat(lsplits + j,
8460 							ee->e_id, l - j);
8461 				else
8462 					j += sm_strlcat2(lsplits + j, "; ",
8463 							 ee->e_id, l - j);
8464 				SM_ASSERT(j < l);
8465 			}
8466 		}
8467 		ee = next;
8468 	}
8469 	if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL && n > 1)
8470 	{
8471 		sm_syslog(LOG_NOTICE, e->e_id, "split: count=%d, id%s=%s",
8472 			  n - 1, n > 2 ? "s" : "", lsplits);
8473 		sm_free(lsplits);
8474 	}
8475 	split = split_within_queue(e) != SM_SPLIT_FAIL;
8476 	if (split)
8477 		e->e_flags |= EF_SPLIT;
8478 	return split;
8479 }
8480 
8481 /*
8482 **  QUARANTINE_QUEUE_ITEM -- {un,}quarantine a single envelope
8483 **
8484 **	Add/remove quarantine reason and requeue appropriately.
8485 **
8486 **	Parameters:
8487 **		qgrp -- queue group for the item
8488 **		qdir -- queue directory in the given queue group
8489 **		e -- envelope information for the item
8490 **		reason -- quarantine reason, NULL means unquarantine.
8491 **
8492 **	Results:
8493 **		true if item changed, false otherwise
8494 **
8495 **	Side Effects:
8496 **		Changes quarantine tag in queue file and renames it.
8497 */
8498 
8499 static bool
8500 quarantine_queue_item(qgrp, qdir, e, reason)
8501 	int qgrp;
8502 	int qdir;
8503 	ENVELOPE *e;
8504 	char *reason;
8505 {
8506 	bool dirty = false;
8507 	bool failing = false;
8508 	bool foundq = false;
8509 	bool finished = false;
8510 	int fd;
8511 	int flags;
8512 	int oldtype;
8513 	int newtype;
8514 	int save_errno;
8515 	MODE_T oldumask = 0;
8516 	SM_FILE_T *oldqfp, *tempqfp;
8517 	char *bp;
8518 	int bufsize;
8519 	char oldqf[MAXPATHLEN];
8520 	char tempqf[MAXPATHLEN];
8521 	char newqf[MAXPATHLEN];
8522 	char buf[MAXLINE];
8523 
8524 	oldtype = queue_letter(e, ANYQFL_LETTER);
8525 	(void) sm_strlcpy(oldqf, queuename(e, ANYQFL_LETTER), sizeof(oldqf));
8526 	(void) sm_strlcpy(tempqf, queuename(e, NEWQFL_LETTER), sizeof(tempqf));
8527 
8528 	/*
8529 	**  Instead of duplicating all the open
8530 	**  and lock code here, tell readqf() to
8531 	**  do that work and return the open
8532 	**  file pointer in e_lockfp.  Note that
8533 	**  we must release the locks properly when
8534 	**  we are done.
8535 	*/
8536 
8537 	if (!readqf(e, true))
8538 	{
8539 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8540 				     "Skipping %s\n", qid_printname(e));
8541 		return false;
8542 	}
8543 	oldqfp = e->e_lockfp;
8544 
8545 	/* open the new queue file */
8546 	flags = O_CREAT|O_WRONLY|O_EXCL;
8547 	if (bitset(S_IWGRP, QueueFileMode))
8548 		oldumask = umask(002);
8549 	fd = open(tempqf, flags, QueueFileMode);
8550 	if (bitset(S_IWGRP, QueueFileMode))
8551 		(void) umask(oldumask);
8552 	RELEASE_QUEUE;
8553 
8554 	if (fd < 0)
8555 	{
8556 		save_errno = errno;
8557 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8558 				     "Skipping %s: Could not open %s: %s\n",
8559 				     qid_printname(e), tempqf,
8560 				     sm_errstring(save_errno));
8561 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8562 		return false;
8563 	}
8564 	if (!lockfile(fd, tempqf, NULL, LOCK_EX|LOCK_NB))
8565 	{
8566 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8567 				     "Skipping %s: Could not lock %s\n",
8568 				     qid_printname(e), tempqf);
8569 		(void) close(fd);
8570 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8571 		return false;
8572 	}
8573 
8574 	tempqfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT, (void *) &fd,
8575 			     SM_IO_WRONLY_B, NULL);
8576 	if (tempqfp == NULL)
8577 	{
8578 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8579 				     "Skipping %s: Could not lock %s\n",
8580 				     qid_printname(e), tempqf);
8581 		(void) close(fd);
8582 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8583 		return false;
8584 	}
8585 
8586 	/* Copy the data over, changing the quarantine reason */
8587 	while (bufsize = sizeof(buf),
8588 	       (bp = fgetfolded(buf, &bufsize, oldqfp)) != NULL)
8589 	{
8590 		if (tTd(40, 4))
8591 			sm_dprintf("+++++ %s\n", bp);
8592 		switch (bp[0])
8593 		{
8594 		  case 'q':		/* quarantine reason */
8595 			foundq = true;
8596 			if (reason == NULL)
8597 			{
8598 				if (Verbose)
8599 				{
8600 					(void) sm_io_fprintf(smioout,
8601 							     SM_TIME_DEFAULT,
8602 							     "%s: Removed quarantine of \"%s\"\n",
8603 							     e->e_id, &bp[1]);
8604 				}
8605 				sm_syslog(LOG_INFO, e->e_id, "unquarantine");
8606 				dirty = true;
8607 			}
8608 			else if (strcmp(reason, &bp[1]) == 0)
8609 			{
8610 				if (Verbose)
8611 				{
8612 					(void) sm_io_fprintf(smioout,
8613 							     SM_TIME_DEFAULT,
8614 							     "%s: Already quarantined with \"%s\"\n",
8615 							     e->e_id, reason);
8616 				}
8617 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8618 						     "q%s\n", reason);
8619 			}
8620 			else
8621 			{
8622 				if (Verbose)
8623 				{
8624 					(void) sm_io_fprintf(smioout,
8625 							     SM_TIME_DEFAULT,
8626 							     "%s: Quarantine changed from \"%s\" to \"%s\"\n",
8627 							     e->e_id, &bp[1],
8628 							     reason);
8629 				}
8630 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8631 						     "q%s\n", reason);
8632 				sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8633 					  reason);
8634 				dirty = true;
8635 			}
8636 			break;
8637 
8638 		  case 'S':
8639 			/*
8640 			**  If we are quarantining an unquarantined item,
8641 			**  need to put in a new 'q' line before it's
8642 			**  too late.
8643 			*/
8644 
8645 			if (!foundq && reason != NULL)
8646 			{
8647 				if (Verbose)
8648 				{
8649 					(void) sm_io_fprintf(smioout,
8650 							     SM_TIME_DEFAULT,
8651 							     "%s: Quarantined with \"%s\"\n",
8652 							     e->e_id, reason);
8653 				}
8654 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8655 						     "q%s\n", reason);
8656 				sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8657 					  reason);
8658 				foundq = true;
8659 				dirty = true;
8660 			}
8661 
8662 			/* Copy the line to the new file */
8663 			(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8664 					     "%s\n", bp);
8665 			break;
8666 
8667 		  case '.':
8668 			finished = true;
8669 			/* FALLTHROUGH */
8670 
8671 		  default:
8672 			/* Copy the line to the new file */
8673 			(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8674 					     "%s\n", bp);
8675 			break;
8676 		}
8677 		if (bp != buf)
8678 			sm_free(bp);
8679 	}
8680 
8681 	/* Make sure we read the whole old file */
8682 	errno = sm_io_error(tempqfp);
8683 	if (errno != 0 && errno != SM_IO_EOF)
8684 	{
8685 		save_errno = errno;
8686 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8687 				     "Skipping %s: Error reading %s: %s\n",
8688 				     qid_printname(e), oldqf,
8689 				     sm_errstring(save_errno));
8690 		failing = true;
8691 	}
8692 
8693 	if (!failing && !finished)
8694 	{
8695 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8696 				     "Skipping %s: Incomplete file: %s\n",
8697 				     qid_printname(e), oldqf);
8698 		failing = true;
8699 	}
8700 
8701 	/* Check if we actually changed anything or we can just bail now */
8702 	if (!dirty)
8703 	{
8704 		/* pretend we failed, even though we technically didn't */
8705 		failing = true;
8706 	}
8707 
8708 	/* Make sure we wrote things out safely */
8709 	if (!failing &&
8710 	    (sm_io_flush(tempqfp, SM_TIME_DEFAULT) != 0 ||
8711 	     ((SuperSafe == SAFE_REALLY ||
8712 	       SuperSafe == SAFE_REALLY_POSTMILTER ||
8713 	       SuperSafe == SAFE_INTERACTIVE) &&
8714 	      fsync(sm_io_getinfo(tempqfp, SM_IO_WHAT_FD, NULL)) < 0) ||
8715 	     ((errno = sm_io_error(tempqfp)) != 0)))
8716 	{
8717 		save_errno = errno;
8718 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8719 				     "Skipping %s: Error writing %s: %s\n",
8720 				     qid_printname(e), tempqf,
8721 				     sm_errstring(save_errno));
8722 		failing = true;
8723 	}
8724 
8725 
8726 	/* Figure out the new filename */
8727 	newtype = (reason == NULL ? NORMQF_LETTER : QUARQF_LETTER);
8728 	if (oldtype == newtype)
8729 	{
8730 		/* going to rename tempqf to oldqf */
8731 		(void) sm_strlcpy(newqf, oldqf, sizeof(newqf));
8732 	}
8733 	else
8734 	{
8735 		/* going to rename tempqf to new name based on newtype */
8736 		(void) sm_strlcpy(newqf, queuename(e, newtype), sizeof(newqf));
8737 	}
8738 
8739 	save_errno = 0;
8740 
8741 	/* rename tempqf to newqf */
8742 	if (!failing &&
8743 	    rename(tempqf, newqf) < 0)
8744 		save_errno = (errno == 0) ? EINVAL : errno;
8745 
8746 	/* Check rename() success */
8747 	if (!failing && save_errno != 0)
8748 	{
8749 		sm_syslog(LOG_DEBUG, e->e_id,
8750 			  "quarantine_queue_item: rename(%s, %s): %s",
8751 			  tempqf, newqf, sm_errstring(save_errno));
8752 
8753 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8754 				     "Error renaming %s to %s: %s\n",
8755 				     tempqf, newqf,
8756 				     sm_errstring(save_errno));
8757 		if (oldtype == newtype)
8758 		{
8759 			/*
8760 			**  Bail here since we don't know the state of
8761 			**  the filesystem and may need to keep tempqf
8762 			**  for the user to rescue us.
8763 			*/
8764 
8765 			RELEASE_QUEUE;
8766 			errno = save_errno;
8767 			syserr("!452 Error renaming control file %s", tempqf);
8768 			/* NOTREACHED */
8769 		}
8770 		else
8771 		{
8772 			/* remove new file (if rename() half completed) */
8773 			if (xunlink(newqf) < 0)
8774 			{
8775 				save_errno = errno;
8776 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8777 						     "Error removing %s: %s\n",
8778 						     newqf,
8779 						     sm_errstring(save_errno));
8780 			}
8781 
8782 			/* tempqf removed below */
8783 			failing = true;
8784 		}
8785 
8786 	}
8787 
8788 	/* If changing file types, need to remove old type */
8789 	if (!failing && oldtype != newtype)
8790 	{
8791 		if (xunlink(oldqf) < 0)
8792 		{
8793 			save_errno = errno;
8794 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8795 					     "Error removing %s: %s\n",
8796 					     oldqf, sm_errstring(save_errno));
8797 		}
8798 	}
8799 
8800 	/* see if anything above failed */
8801 	if (failing)
8802 	{
8803 		/* Something failed: remove new file, old file still there */
8804 		(void) xunlink(tempqf);
8805 	}
8806 
8807 	/*
8808 	**  fsync() after file operations to make sure metadata is
8809 	**  written to disk on filesystems in which renames are
8810 	**  not guaranteed.  It's ok if they fail, mail won't be lost.
8811 	*/
8812 
8813 	if (SuperSafe != SAFE_NO)
8814 	{
8815 		/* for soft-updates */
8816 		(void) fsync(sm_io_getinfo(tempqfp,
8817 					   SM_IO_WHAT_FD, NULL));
8818 
8819 		if (!failing)
8820 		{
8821 			/* for soft-updates */
8822 			(void) fsync(sm_io_getinfo(oldqfp,
8823 						   SM_IO_WHAT_FD, NULL));
8824 		}
8825 
8826 		/* for other odd filesystems */
8827 		SYNC_DIR(tempqf, false);
8828 	}
8829 
8830 	/* Close up shop */
8831 	RELEASE_QUEUE;
8832 	if (tempqfp != NULL)
8833 		(void) sm_io_close(tempqfp, SM_TIME_DEFAULT);
8834 	if (oldqfp != NULL)
8835 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8836 
8837 	/* All went well */
8838 	return !failing;
8839 }
8840 
8841 /*
8842 **  QUARANTINE_QUEUE -- {un,}quarantine matching items in the queue
8843 **
8844 **	Read all matching queue items, add/remove quarantine
8845 **	reason, and requeue appropriately.
8846 **
8847 **	Parameters:
8848 **		reason -- quarantine reason, "." means unquarantine.
8849 **		qgrplimit -- limit to single queue group unless NOQGRP
8850 **
8851 **	Results:
8852 **		none.
8853 **
8854 **	Side Effects:
8855 **		Lots of changes to the queue.
8856 */
8857 
8858 void
8859 quarantine_queue(reason, qgrplimit)
8860 	char *reason;
8861 	int qgrplimit;
8862 {
8863 	int changed = 0;
8864 	int qgrp;
8865 
8866 	/* Convert internal representation of unquarantine */
8867 	if (reason != NULL && reason[0] == '.' && reason[1] == '\0')
8868 		reason = NULL;
8869 
8870 	if (reason != NULL)
8871 	{
8872 		/* clean it */
8873 		reason = newstr(denlstring(reason, true, true));
8874 	}
8875 
8876 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
8877 	{
8878 		int qdir;
8879 
8880 		if (qgrplimit != NOQGRP && qgrplimit != qgrp)
8881 			continue;
8882 
8883 		for (qdir = 0; qdir < Queue[qgrp]->qg_numqueues; qdir++)
8884 		{
8885 			int i;
8886 			int nrequests;
8887 
8888 			if (StopRequest)
8889 				stop_sendmail();
8890 
8891 			nrequests = gatherq(qgrp, qdir, true, NULL, NULL, NULL);
8892 
8893 			/* first see if there is anything */
8894 			if (nrequests <= 0)
8895 			{
8896 				if (Verbose)
8897 				{
8898 					(void) sm_io_fprintf(smioout,
8899 							     SM_TIME_DEFAULT, "%s: no matches\n",
8900 							     qid_printqueue(qgrp, qdir));
8901 				}
8902 				continue;
8903 			}
8904 
8905 			if (Verbose)
8906 			{
8907 				(void) sm_io_fprintf(smioout,
8908 						     SM_TIME_DEFAULT, "Processing %s:\n",
8909 						     qid_printqueue(qgrp, qdir));
8910 			}
8911 
8912 			for (i = 0; i < WorkListCount; i++)
8913 			{
8914 				ENVELOPE e;
8915 
8916 				if (StopRequest)
8917 					stop_sendmail();
8918 
8919 				/* setup envelope */
8920 				clearenvelope(&e, true, sm_rpool_new_x(NULL));
8921 				e.e_id = WorkList[i].w_name + 2;
8922 				e.e_qgrp = qgrp;
8923 				e.e_qdir = qdir;
8924 
8925 				if (tTd(70, 101))
8926 				{
8927 					sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8928 						      "Would do %s\n", e.e_id);
8929 					changed++;
8930 				}
8931 				else if (quarantine_queue_item(qgrp, qdir,
8932 							       &e, reason))
8933 					changed++;
8934 
8935 				/* clean up */
8936 				sm_rpool_free(e.e_rpool);
8937 				e.e_rpool = NULL;
8938 			}
8939 			if (WorkList != NULL)
8940 				sm_free(WorkList); /* XXX */
8941 			WorkList = NULL;
8942 			WorkListSize = 0;
8943 			WorkListCount = 0;
8944 		}
8945 	}
8946 	if (Verbose)
8947 	{
8948 		if (changed == 0)
8949 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8950 					     "No changes\n");
8951 		else
8952 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8953 					     "%d change%s\n",
8954 					     changed,
8955 					     changed == 1 ? "" : "s");
8956 	}
8957 }
8958