xref: /freebsd/contrib/sendmail/src/queue.c (revision 9a14aa017b21c292740c00ee098195cd46642730)
1 /*
2  * Copyright (c) 1998-2009, 2011 Sendmail, Inc. and its suppliers.
3  *	All rights reserved.
4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
5  * Copyright (c) 1988, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * By using this file, you agree to the terms and conditions set
9  * forth in the LICENSE file which can be found at the top level of
10  * the sendmail distribution.
11  *
12  */
13 
14 #include <sendmail.h>
15 #include <sm/sem.h>
16 
17 SM_RCSID("@(#)$Id: queue.c,v 8.991 2011/03/15 23:14:36 ca Exp $")
18 
19 #include <dirent.h>
20 
21 # define RELEASE_QUEUE	(void) 0
22 # define ST_INODE(st)	(st).st_ino
23 
24 #  define sm_file_exists(errno) ((errno) == EEXIST)
25 
26 # if HASFLOCK && defined(O_EXLOCK)
27 #   define SM_OPEN_EXLOCK 1
28 #   define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL|O_EXLOCK)
29 # else /* HASFLOCK && defined(O_EXLOCK) */
30 #  define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL)
31 # endif /* HASFLOCK && defined(O_EXLOCK) */
32 
33 #ifndef SM_OPEN_EXLOCK
34 # define SM_OPEN_EXLOCK 0
35 #endif /* ! SM_OPEN_EXLOCK */
36 
37 /*
38 **  Historical notes:
39 **	QF_VERSION == 4 was sendmail 8.10/8.11 without _FFR_QUEUEDELAY
40 **	QF_VERSION == 5 was sendmail 8.10/8.11 with    _FFR_QUEUEDELAY
41 **	QF_VERSION == 6 was sendmail 8.12      without _FFR_QUEUEDELAY
42 **	QF_VERSION == 7 was sendmail 8.12      with    _FFR_QUEUEDELAY
43 **	QF_VERSION == 8 is  sendmail 8.13
44 */
45 
46 #define QF_VERSION	8	/* version number of this queue format */
47 
48 static char	queue_letter __P((ENVELOPE *, int));
49 static bool	quarantine_queue_item __P((int, int, ENVELOPE *, char *));
50 
51 /* Naming convention: qgrp: index of queue group, qg: QUEUEGROUP */
52 
53 /*
54 **  Work queue.
55 */
56 
57 struct work
58 {
59 	char		*w_name;	/* name of control file */
60 	char		*w_host;	/* name of recipient host */
61 	bool		w_lock;		/* is message locked? */
62 	bool		w_tooyoung;	/* is it too young to run? */
63 	long		w_pri;		/* priority of message, see below */
64 	time_t		w_ctime;	/* creation time */
65 	time_t		w_mtime;	/* modification time */
66 	int		w_qgrp;		/* queue group located in */
67 	int		w_qdir;		/* queue directory located in */
68 	struct work	*w_next;	/* next in queue */
69 };
70 
71 typedef struct work	WORK;
72 
73 static WORK	*WorkQ;		/* queue of things to be done */
74 static int	NumWorkGroups;	/* number of work groups */
75 static time_t	Current_LA_time = 0;
76 
77 /* Get new load average every 30 seconds. */
78 #define GET_NEW_LA_TIME	30
79 
80 #define SM_GET_LA(now)	\
81 	do							\
82 	{							\
83 		now = curtime();				\
84 		if (Current_LA_time < now - GET_NEW_LA_TIME)	\
85 		{						\
86 			sm_getla();				\
87 			Current_LA_time = now;			\
88 		}						\
89 	} while (0)
90 
91 /*
92 **  DoQueueRun indicates that a queue run is needed.
93 **	Notice: DoQueueRun is modified in a signal handler!
94 */
95 
96 static bool	volatile DoQueueRun; /* non-interrupt time queue run needed */
97 
98 /*
99 **  Work group definition structure.
100 **	Each work group contains one or more queue groups. This is done
101 **	to manage the number of queue group runners active at the same time
102 **	to be within the constraints of MaxQueueChildren (if it is set).
103 **	The number of queue groups that can be run on the next work run
104 **	is kept track of. The queue groups are run in a round robin.
105 */
106 
107 struct workgrp
108 {
109 	int		wg_numqgrp;	/* number of queue groups in work grp */
110 	int		wg_runners;	/* total runners */
111 	int		wg_curqgrp;	/* current queue group */
112 	QUEUEGRP	**wg_qgs;	/* array of queue groups */
113 	int		wg_maxact;	/* max # of active runners */
114 	time_t		wg_lowqintvl;	/* lowest queue interval */
115 	int		wg_restart;	/* needs restarting? */
116 	int		wg_restartcnt;	/* count of times restarted */
117 };
118 
119 typedef struct workgrp WORKGRP;
120 
121 static WORKGRP	volatile WorkGrp[MAXWORKGROUPS + 1];	/* work groups */
122 
123 #if SM_HEAP_CHECK
124 static SM_DEBUG_T DebugLeakQ = SM_DEBUG_INITIALIZER("leak_q",
125 	"@(#)$Debug: leak_q - trace memory leaks during queue processing $");
126 #endif /* SM_HEAP_CHECK */
127 
128 /*
129 **  We use EmptyString instead of "" to avoid
130 **  'zero-length format string' warnings from gcc
131 */
132 
133 static const char EmptyString[] = "";
134 
135 static void	grow_wlist __P((int, int));
136 static int	multiqueue_cache __P((char *, int, QUEUEGRP *, int, unsigned int *));
137 static int	gatherq __P((int, int, bool, bool *, bool *, int *));
138 static int	sortq __P((int));
139 static void	printctladdr __P((ADDRESS *, SM_FILE_T *));
140 static bool	readqf __P((ENVELOPE *, bool));
141 static void	restart_work_group __P((int));
142 static void	runner_work __P((ENVELOPE *, int, bool, int, int));
143 static void	schedule_queue_runs __P((bool, int, bool));
144 static char	*strrev __P((char *));
145 static ADDRESS	*setctluser __P((char *, int, ENVELOPE *));
146 #if _FFR_RHS
147 static int	sm_strshufflecmp __P((char *, char *));
148 static void	init_shuffle_alphabet __P(());
149 #endif /* _FFR_RHS */
150 
151 /*
152 **  Note: workcmpf?() don't use a prototype because it will cause a conflict
153 **  with the qsort() call (which expects something like
154 **  int (*compar)(const void *, const void *), not (WORK *, WORK *))
155 */
156 
157 static int	workcmpf0();
158 static int	workcmpf1();
159 static int	workcmpf2();
160 static int	workcmpf3();
161 static int	workcmpf4();
162 static int	randi = 3;	/* index for workcmpf5() */
163 static int	workcmpf5();
164 static int	workcmpf6();
165 #if _FFR_RHS
166 static int	workcmpf7();
167 #endif /* _FFR_RHS */
168 
169 #if RANDOMSHIFT
170 # define get_rand_mod(m)	((get_random() >> RANDOMSHIFT) % (m))
171 #else /* RANDOMSHIFT */
172 # define get_rand_mod(m)	(get_random() % (m))
173 #endif /* RANDOMSHIFT */
174 
175 /*
176 **  File system definition.
177 **	Used to keep track of how much free space is available
178 **	on a file system in which one or more queue directories reside.
179 */
180 
181 typedef struct filesys_shared	FILESYS;
182 
183 struct filesys_shared
184 {
185 	dev_t	fs_dev;		/* unique device id */
186 	long	fs_avail;	/* number of free blocks available */
187 	long	fs_blksize;	/* block size, in bytes */
188 };
189 
190 /* probably kept in shared memory */
191 static FILESYS	FileSys[MAXFILESYS];	/* queue file systems */
192 static const char *FSPath[MAXFILESYS];	/* pathnames for file systems */
193 
194 #if SM_CONF_SHM
195 
196 /*
197 **  Shared memory data
198 **
199 **  Current layout:
200 **	size -- size of shared memory segment
201 **	pid -- pid of owner, should be a unique id to avoid misinterpretations
202 **		by other processes.
203 **	tag -- should be a unique id to avoid misinterpretations by others.
204 **		idea: hash over configuration data that will be stored here.
205 **	NumFileSys -- number of file systems.
206 **	FileSys -- (array of) structure for used file systems.
207 **	RSATmpCnt -- counter for number of uses of ephemeral RSA key.
208 **	QShm -- (array of) structure for information about queue directories.
209 */
210 
211 /*
212 **  Queue data in shared memory
213 */
214 
215 typedef struct queue_shared	QUEUE_SHM_T;
216 
217 struct queue_shared
218 {
219 	int	qs_entries;	/* number of entries */
220 	/* XXX more to follow? */
221 };
222 
223 static void	*Pshm;		/* pointer to shared memory */
224 static FILESYS	*PtrFileSys;	/* pointer to queue file system array */
225 int		ShmId = SM_SHM_NO_ID;	/* shared memory id */
226 static QUEUE_SHM_T	*QShm;		/* pointer to shared queue data */
227 static size_t shms;
228 
229 # define SHM_OFF_PID(p)	(((char *) (p)) + sizeof(int))
230 # define SHM_OFF_TAG(p)	(((char *) (p)) + sizeof(pid_t) + sizeof(int))
231 # define SHM_OFF_HEAD	(sizeof(pid_t) + sizeof(int) * 2)
232 
233 /* how to access FileSys */
234 # define FILE_SYS(i)	(PtrFileSys[i])
235 
236 /* first entry is a tag, for now just the size */
237 # define OFF_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD)
238 
239 /* offset for PNumFileSys */
240 # define OFF_NUM_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys))
241 
242 /* offset for PRSATmpCnt */
243 # define OFF_RSA_TMP_CNT(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int))
244 int	*PRSATmpCnt;
245 
246 /* offset for queue_shm */
247 # define OFF_QUEUE_SHM(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
248 
249 # define QSHM_ENTRIES(i)	QShm[i].qs_entries
250 
251 /* basic size of shared memory segment */
252 # define SM_T_SIZE	(SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
253 
254 static unsigned int	hash_q __P((char *, unsigned int));
255 
256 /*
257 **  HASH_Q -- simple hash function
258 **
259 **	Parameters:
260 **		p -- string to hash.
261 **		h -- hash start value (from previous run).
262 **
263 **	Returns:
264 **		hash value.
265 */
266 
267 static unsigned int
268 hash_q(p, h)
269 	char *p;
270 	unsigned int h;
271 {
272 	int c, d;
273 
274 	while (*p != '\0')
275 	{
276 		d = *p++;
277 		c = d;
278 		c ^= c<<6;
279 		h += (c<<11) ^ (c>>1);
280 		h ^= (d<<14) + (d<<7) + (d<<4) + d;
281 	}
282 	return h;
283 }
284 
285 
286 #else /* SM_CONF_SHM */
287 # define FILE_SYS(i)	FileSys[i]
288 #endif /* SM_CONF_SHM */
289 
290 /* access to the various components of file system data */
291 #define FILE_SYS_NAME(i)	FSPath[i]
292 #define FILE_SYS_AVAIL(i)	FILE_SYS(i).fs_avail
293 #define FILE_SYS_BLKSIZE(i)	FILE_SYS(i).fs_blksize
294 #define FILE_SYS_DEV(i)	FILE_SYS(i).fs_dev
295 
296 
297 /*
298 **  Current qf file field assignments:
299 **
300 **	A	AUTH= parameter
301 **	B	body type
302 **	C	controlling user
303 **	D	data file name
304 **	d	data file directory name (added in 8.12)
305 **	E	error recipient
306 **	F	flag bits
307 **	G	free (was: queue delay algorithm if _FFR_QUEUEDELAY)
308 **	H	header
309 **	I	data file's inode number
310 **	K	time of last delivery attempt
311 **	L	Solaris Content-Length: header (obsolete)
312 **	M	message
313 **	N	number of delivery attempts
314 **	P	message priority
315 **	q	quarantine reason
316 **	Q	original recipient (ORCPT=)
317 **	r	final recipient (Final-Recipient: DSN field)
318 **	R	recipient
319 **	S	sender
320 **	T	init time
321 **	V	queue file version
322 **	X	free (was: character set if _FFR_SAVE_CHARSET)
323 **	Y	free (was: current delay if _FFR_QUEUEDELAY)
324 **	Z	original envelope id from ESMTP
325 **	!	deliver by (added in 8.12)
326 **	$	define macro
327 **	.	terminate file
328 */
329 
330 /*
331 **  QUEUEUP -- queue a message up for future transmission.
332 **
333 **	Parameters:
334 **		e -- the envelope to queue up.
335 **		announce -- if true, tell when you are queueing up.
336 **		msync -- if true, then fsync() if SuperSafe interactive mode.
337 **
338 **	Returns:
339 **		none.
340 **
341 **	Side Effects:
342 **		The current request is saved in a control file.
343 **		The queue file is left locked.
344 */
345 
346 void
347 queueup(e, announce, msync)
348 	register ENVELOPE *e;
349 	bool announce;
350 	bool msync;
351 {
352 	register SM_FILE_T *tfp;
353 	register HDR *h;
354 	register ADDRESS *q;
355 	int tfd = -1;
356 	int i;
357 	bool newid;
358 	register char *p;
359 	MAILER nullmailer;
360 	MCI mcibuf;
361 	char qf[MAXPATHLEN];
362 	char tf[MAXPATHLEN];
363 	char df[MAXPATHLEN];
364 	char buf[MAXLINE];
365 
366 	/*
367 	**  Create control file.
368 	*/
369 
370 #define OPEN_TF	do							\
371 		{							\
372 			MODE_T oldumask = 0;				\
373 									\
374 			if (bitset(S_IWGRP, QueueFileMode))		\
375 				oldumask = umask(002);			\
376 			tfd = open(tf, TF_OPEN_FLAGS, QueueFileMode);	\
377 			if (bitset(S_IWGRP, QueueFileMode))		\
378 				(void) umask(oldumask);			\
379 		} while (0)
380 
381 
382 	newid = (e->e_id == NULL) || !bitset(EF_INQUEUE, e->e_flags);
383 	(void) sm_strlcpy(tf, queuename(e, NEWQFL_LETTER), sizeof(tf));
384 	tfp = e->e_lockfp;
385 	if (tfp == NULL && newid)
386 	{
387 		/*
388 		**  open qf file directly: this will give an error if the file
389 		**  already exists and hence prevent problems if a queue-id
390 		**  is reused (e.g., because the clock is set back).
391 		*/
392 
393 		(void) sm_strlcpy(tf, queuename(e, ANYQFL_LETTER), sizeof(tf));
394 		OPEN_TF;
395 		if (tfd < 0 ||
396 #if !SM_OPEN_EXLOCK
397 		    !lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB) ||
398 #endif /* !SM_OPEN_EXLOCK */
399 		    (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
400 					 (void *) &tfd, SM_IO_WRONLY,
401 					 NULL)) == NULL)
402 		{
403 			int save_errno = errno;
404 
405 			printopenfds(true);
406 			errno = save_errno;
407 			syserr("!queueup: cannot create queue file %s, euid=%d, fd=%d, fp=%p",
408 				tf, (int) geteuid(), tfd, tfp);
409 			/* NOTREACHED */
410 		}
411 		e->e_lockfp = tfp;
412 		upd_qs(e, 1, 0, "queueup");
413 	}
414 
415 	/* if newid, write the queue file directly (instead of temp file) */
416 	if (!newid)
417 	{
418 		/* get a locked tf file */
419 		for (i = 0; i < 128; i++)
420 		{
421 			if (tfd < 0)
422 			{
423 				OPEN_TF;
424 				if (tfd < 0)
425 				{
426 					if (errno != EEXIST)
427 						break;
428 					if (LogLevel > 0 && (i % 32) == 0)
429 						sm_syslog(LOG_ALERT, e->e_id,
430 							  "queueup: cannot create %s, euid=%d: %s",
431 							  tf, (int) geteuid(),
432 							  sm_errstring(errno));
433 				}
434 #if SM_OPEN_EXLOCK
435 				else
436 					break;
437 #endif /* SM_OPEN_EXLOCK */
438 			}
439 			if (tfd >= 0)
440 			{
441 #if SM_OPEN_EXLOCK
442 				/* file is locked by open() */
443 				break;
444 #else /* SM_OPEN_EXLOCK */
445 				if (lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB))
446 					break;
447 				else
448 #endif /* SM_OPEN_EXLOCK */
449 				if (LogLevel > 0 && (i % 32) == 0)
450 					sm_syslog(LOG_ALERT, e->e_id,
451 						  "queueup: cannot lock %s: %s",
452 						  tf, sm_errstring(errno));
453 				if ((i % 32) == 31)
454 				{
455 					(void) close(tfd);
456 					tfd = -1;
457 				}
458 			}
459 
460 			if ((i % 32) == 31)
461 			{
462 				/* save the old temp file away */
463 				(void) rename(tf, queuename(e, TEMPQF_LETTER));
464 			}
465 			else
466 				(void) sleep(i % 32);
467 		}
468 		if (tfd < 0 || (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
469 						 (void *) &tfd, SM_IO_WRONLY_B,
470 						 NULL)) == NULL)
471 		{
472 			int save_errno = errno;
473 
474 			printopenfds(true);
475 			errno = save_errno;
476 			syserr("!queueup: cannot create queue temp file %s, uid=%d",
477 				tf, (int) geteuid());
478 		}
479 	}
480 
481 	if (tTd(40, 1))
482 		sm_dprintf("\n>>>>> queueing %s/%s%s >>>>>\n",
483 			   qid_printqueue(e->e_qgrp, e->e_qdir),
484 			   queuename(e, ANYQFL_LETTER),
485 			   newid ? " (new id)" : "");
486 	if (tTd(40, 3))
487 	{
488 		sm_dprintf("  e_flags=");
489 		printenvflags(e);
490 	}
491 	if (tTd(40, 32))
492 	{
493 		sm_dprintf("  sendq=");
494 		printaddr(sm_debug_file(), e->e_sendqueue, true);
495 	}
496 	if (tTd(40, 9))
497 	{
498 		sm_dprintf("  tfp=");
499 		dumpfd(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL), true, false);
500 		sm_dprintf("  lockfp=");
501 		if (e->e_lockfp == NULL)
502 			sm_dprintf("NULL\n");
503 		else
504 			dumpfd(sm_io_getinfo(e->e_lockfp, SM_IO_WHAT_FD, NULL),
505 			       true, false);
506 	}
507 
508 	/*
509 	**  If there is no data file yet, create one.
510 	*/
511 
512 	(void) sm_strlcpy(df, queuename(e, DATAFL_LETTER), sizeof(df));
513 	if (bitset(EF_HAS_DF, e->e_flags))
514 	{
515 		if (e->e_dfp != NULL &&
516 		    SuperSafe != SAFE_REALLY &&
517 		    SuperSafe != SAFE_REALLY_POSTMILTER &&
518 		    sm_io_setinfo(e->e_dfp, SM_BF_COMMIT, NULL) < 0 &&
519 		    errno != EINVAL)
520 		{
521 			syserr("!queueup: cannot commit data file %s, uid=%d",
522 			       queuename(e, DATAFL_LETTER), (int) geteuid());
523 		}
524 		if (e->e_dfp != NULL &&
525 		    SuperSafe == SAFE_INTERACTIVE && msync)
526 		{
527 			if (tTd(40,32))
528 				sm_syslog(LOG_INFO, e->e_id,
529 					  "queueup: fsync(e->e_dfp)");
530 
531 			if (fsync(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD,
532 						NULL)) < 0)
533 			{
534 				if (newid)
535 					syserr("!552 Error writing data file %s",
536 					       df);
537 				else
538 					syserr("!452 Error writing data file %s",
539 					       df);
540 			}
541 		}
542 	}
543 	else
544 	{
545 		int dfd;
546 		MODE_T oldumask = 0;
547 		register SM_FILE_T *dfp = NULL;
548 		struct stat stbuf;
549 
550 		if (e->e_dfp != NULL &&
551 		    sm_io_getinfo(e->e_dfp, SM_IO_WHAT_ISTYPE, BF_FILE_TYPE))
552 			syserr("committing over bf file");
553 
554 		if (bitset(S_IWGRP, QueueFileMode))
555 			oldumask = umask(002);
556 		dfd = open(df, O_WRONLY|O_CREAT|O_TRUNC|QF_O_EXTRA,
557 			   QueueFileMode);
558 		if (bitset(S_IWGRP, QueueFileMode))
559 			(void) umask(oldumask);
560 		if (dfd < 0 || (dfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
561 						 (void *) &dfd, SM_IO_WRONLY_B,
562 						 NULL)) == NULL)
563 			syserr("!queueup: cannot create data temp file %s, uid=%d",
564 				df, (int) geteuid());
565 		if (fstat(dfd, &stbuf) < 0)
566 			e->e_dfino = -1;
567 		else
568 		{
569 			e->e_dfdev = stbuf.st_dev;
570 			e->e_dfino = ST_INODE(stbuf);
571 		}
572 		e->e_flags |= EF_HAS_DF;
573 		memset(&mcibuf, '\0', sizeof(mcibuf));
574 		mcibuf.mci_out = dfp;
575 		mcibuf.mci_mailer = FileMailer;
576 		(*e->e_putbody)(&mcibuf, e, NULL);
577 
578 		if (SuperSafe == SAFE_REALLY ||
579 		    SuperSafe == SAFE_REALLY_POSTMILTER ||
580 		    (SuperSafe == SAFE_INTERACTIVE && msync))
581 		{
582 			if (tTd(40,32))
583 				sm_syslog(LOG_INFO, e->e_id,
584 					  "queueup: fsync(dfp)");
585 
586 			if (fsync(sm_io_getinfo(dfp, SM_IO_WHAT_FD, NULL)) < 0)
587 			{
588 				if (newid)
589 					syserr("!552 Error writing data file %s",
590 					       df);
591 				else
592 					syserr("!452 Error writing data file %s",
593 					       df);
594 			}
595 		}
596 
597 		if (sm_io_close(dfp, SM_TIME_DEFAULT) < 0)
598 			syserr("!queueup: cannot save data temp file %s, uid=%d",
599 				df, (int) geteuid());
600 		e->e_putbody = putbody;
601 	}
602 
603 	/*
604 	**  Output future work requests.
605 	**	Priority and creation time should be first, since
606 	**	they are required by gatherq.
607 	*/
608 
609 	/* output queue version number (must be first!) */
610 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "V%d\n", QF_VERSION);
611 
612 	/* output creation time */
613 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "T%ld\n", (long) e->e_ctime);
614 
615 	/* output last delivery time */
616 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "K%ld\n", (long) e->e_dtime);
617 
618 	/* output number of delivery attempts */
619 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "N%d\n", e->e_ntries);
620 
621 	/* output message priority */
622 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "P%ld\n", e->e_msgpriority);
623 
624 	/*
625 	**  If data file is in a different directory than the queue file,
626 	**  output a "d" record naming the directory of the data file.
627 	*/
628 
629 	if (e->e_dfqgrp != e->e_qgrp)
630 	{
631 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "d%s\n",
632 			Queue[e->e_dfqgrp]->qg_qpaths[e->e_dfqdir].qp_name);
633 	}
634 
635 	/* output inode number of data file */
636 	if (e->e_dfino != -1)
637 	{
638 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "I%ld/%ld/%llu\n",
639 				     (long) major(e->e_dfdev),
640 				     (long) minor(e->e_dfdev),
641 				     (ULONGLONG_T) e->e_dfino);
642 	}
643 
644 	/* output body type */
645 	if (e->e_bodytype != NULL)
646 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "B%s\n",
647 				     denlstring(e->e_bodytype, true, false));
648 
649 	/* quarantine reason */
650 	if (e->e_quarmsg != NULL)
651 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "q%s\n",
652 				     denlstring(e->e_quarmsg, true, false));
653 
654 	/* message from envelope, if it exists */
655 	if (e->e_message != NULL)
656 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
657 				     denlstring(e->e_message, true, false));
658 
659 	/* send various flag bits through */
660 	p = buf;
661 	if (bitset(EF_WARNING, e->e_flags))
662 		*p++ = 'w';
663 	if (bitset(EF_RESPONSE, e->e_flags))
664 		*p++ = 'r';
665 	if (bitset(EF_HAS8BIT, e->e_flags))
666 		*p++ = '8';
667 	if (bitset(EF_DELETE_BCC, e->e_flags))
668 		*p++ = 'b';
669 	if (bitset(EF_RET_PARAM, e->e_flags))
670 		*p++ = 'd';
671 	if (bitset(EF_NO_BODY_RETN, e->e_flags))
672 		*p++ = 'n';
673 	if (bitset(EF_SPLIT, e->e_flags))
674 		*p++ = 's';
675 	*p++ = '\0';
676 	if (buf[0] != '\0')
677 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "F%s\n", buf);
678 
679 	/* save $={persistentMacros} macro values */
680 	queueup_macros(macid("{persistentMacros}"), tfp, e);
681 
682 	/* output name of sender */
683 	if (bitnset(M_UDBENVELOPE, e->e_from.q_mailer->m_flags))
684 		p = e->e_sender;
685 	else
686 		p = e->e_from.q_paddr;
687 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "S%s\n",
688 			     denlstring(p, true, false));
689 
690 	/* output ESMTP-supplied "original" information */
691 	if (e->e_envid != NULL)
692 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Z%s\n",
693 				     denlstring(e->e_envid, true, false));
694 
695 	/* output AUTH= parameter */
696 	if (e->e_auth_param != NULL)
697 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "A%s\n",
698 				     denlstring(e->e_auth_param, true, false));
699 	if (e->e_dlvr_flag != 0)
700 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "!%c %ld\n",
701 				     (char) e->e_dlvr_flag, e->e_deliver_by);
702 
703 	/* output list of recipient addresses */
704 	printctladdr(NULL, NULL);
705 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
706 	{
707 		if (!QS_IS_UNDELIVERED(q->q_state))
708 			continue;
709 
710 		/* message for this recipient, if it exists */
711 		if (q->q_message != NULL)
712 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
713 					     denlstring(q->q_message, true,
714 							false));
715 
716 		printctladdr(q, tfp);
717 		if (q->q_orcpt != NULL)
718 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Q%s\n",
719 					     denlstring(q->q_orcpt, true,
720 							false));
721 		if (q->q_finalrcpt != NULL)
722 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "r%s\n",
723 					     denlstring(q->q_finalrcpt, true,
724 							false));
725 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'R');
726 		if (bitset(QPRIMARY, q->q_flags))
727 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'P');
728 		if (bitset(QHASNOTIFY, q->q_flags))
729 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'N');
730 		if (bitset(QPINGONSUCCESS, q->q_flags))
731 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'S');
732 		if (bitset(QPINGONFAILURE, q->q_flags))
733 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'F');
734 		if (bitset(QPINGONDELAY, q->q_flags))
735 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'D');
736 		if (q->q_alias != NULL &&
737 		    bitset(QALIAS, q->q_alias->q_flags))
738 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'A');
739 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, ':');
740 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s\n",
741 				     denlstring(q->q_paddr, true, false));
742 		if (announce)
743 		{
744 			char *tag = "queued";
745 
746 			if (e->e_quarmsg != NULL)
747 				tag = "quarantined";
748 
749 			e->e_to = q->q_paddr;
750 			message(tag);
751 			if (LogLevel > 8)
752 				logdelivery(q->q_mailer, NULL, q->q_status,
753 					    tag, NULL, (time_t) 0, e);
754 			e->e_to = NULL;
755 		}
756 		if (tTd(40, 1))
757 		{
758 			sm_dprintf("queueing ");
759 			printaddr(sm_debug_file(), q, false);
760 		}
761 	}
762 
763 	/*
764 	**  Output headers for this message.
765 	**	Expand macros completely here.  Queue run will deal with
766 	**	everything as absolute headers.
767 	**		All headers that must be relative to the recipient
768 	**		can be cracked later.
769 	**	We set up a "null mailer" -- i.e., a mailer that will have
770 	**	no effect on the addresses as they are output.
771 	*/
772 
773 	memset((char *) &nullmailer, '\0', sizeof(nullmailer));
774 	nullmailer.m_re_rwset = nullmailer.m_rh_rwset =
775 			nullmailer.m_se_rwset = nullmailer.m_sh_rwset = -1;
776 	nullmailer.m_eol = "\n";
777 	memset(&mcibuf, '\0', sizeof(mcibuf));
778 	mcibuf.mci_mailer = &nullmailer;
779 	mcibuf.mci_out = tfp;
780 
781 	macdefine(&e->e_macro, A_PERM, 'g', "\201f");
782 	for (h = e->e_header; h != NULL; h = h->h_link)
783 	{
784 		if (h->h_value == NULL)
785 			continue;
786 
787 		/* don't output resent headers on non-resent messages */
788 		if (bitset(H_RESENT, h->h_flags) &&
789 		    !bitset(EF_RESENT, e->e_flags))
790 			continue;
791 
792 		/* expand macros; if null, don't output header at all */
793 		if (bitset(H_DEFAULT, h->h_flags))
794 		{
795 			(void) expand(h->h_value, buf, sizeof(buf), e);
796 			if (buf[0] == '\0')
797 				continue;
798 			if (buf[0] == ' ' && buf[1] == '\0')
799 				continue;
800 		}
801 
802 		/* output this header */
803 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "H?");
804 
805 		/* output conditional macro if present */
806 		if (h->h_macro != '\0')
807 		{
808 			if (bitset(0200, h->h_macro))
809 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
810 						     "${%s}",
811 						      macname(bitidx(h->h_macro)));
812 			else
813 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
814 						     "$%c", h->h_macro);
815 		}
816 		else if (!bitzerop(h->h_mflags) &&
817 			 bitset(H_CHECK|H_ACHECK, h->h_flags))
818 		{
819 			int j;
820 
821 			/* if conditional, output the set of conditions */
822 			for (j = '\0'; j <= '\177'; j++)
823 				if (bitnset(j, h->h_mflags))
824 					(void) sm_io_putc(tfp, SM_TIME_DEFAULT,
825 							  j);
826 		}
827 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, '?');
828 
829 		/* output the header: expand macros, convert addresses */
830 		if (bitset(H_DEFAULT, h->h_flags) &&
831 		    !bitset(H_BINDLATE, h->h_flags))
832 		{
833 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s:%s\n",
834 					     h->h_field,
835 					     denlstring(buf, false, true));
836 		}
837 		else if (bitset(H_FROM|H_RCPT, h->h_flags) &&
838 			 !bitset(H_BINDLATE, h->h_flags))
839 		{
840 			bool oldstyle = bitset(EF_OLDSTYLE, e->e_flags);
841 			SM_FILE_T *savetrace = TrafficLogFile;
842 
843 			TrafficLogFile = NULL;
844 
845 			if (bitset(H_FROM, h->h_flags))
846 				oldstyle = false;
847 			commaize(h, h->h_value, oldstyle, &mcibuf, e,
848 				 PXLF_HEADER);
849 
850 			TrafficLogFile = savetrace;
851 		}
852 		else
853 		{
854 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s:%s\n",
855 					     h->h_field,
856 					     denlstring(h->h_value, false,
857 							true));
858 		}
859 	}
860 
861 	/*
862 	**  Clean up.
863 	**
864 	**	Write a terminator record -- this is to prevent
865 	**	scurrilous crackers from appending any data.
866 	*/
867 
868 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ".\n");
869 
870 	if (sm_io_flush(tfp, SM_TIME_DEFAULT) != 0 ||
871 	    ((SuperSafe == SAFE_REALLY ||
872 	      SuperSafe == SAFE_REALLY_POSTMILTER ||
873 	      (SuperSafe == SAFE_INTERACTIVE && msync)) &&
874 	     fsync(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL)) < 0) ||
875 	    sm_io_error(tfp))
876 	{
877 		if (newid)
878 			syserr("!552 Error writing control file %s", tf);
879 		else
880 			syserr("!452 Error writing control file %s", tf);
881 	}
882 
883 	if (!newid)
884 	{
885 		char new = queue_letter(e, ANYQFL_LETTER);
886 
887 		/* rename (locked) tf to be (locked) [qh]f */
888 		(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER),
889 				  sizeof(qf));
890 		if (rename(tf, qf) < 0)
891 			syserr("cannot rename(%s, %s), uid=%d",
892 				tf, qf, (int) geteuid());
893 		else
894 		{
895 			/*
896 			**  Check if type has changed and only
897 			**  remove the old item if the rename above
898 			**  succeeded.
899 			*/
900 
901 			if (e->e_qfletter != '\0' &&
902 			    e->e_qfletter != new)
903 			{
904 				if (tTd(40, 5))
905 				{
906 					sm_dprintf("type changed from %c to %c\n",
907 						   e->e_qfletter, new);
908 				}
909 
910 				if (unlink(queuename(e, e->e_qfletter)) < 0)
911 				{
912 					/* XXX: something more drastic? */
913 					if (LogLevel > 0)
914 						sm_syslog(LOG_ERR, e->e_id,
915 							  "queueup: unlink(%s) failed: %s",
916 							  queuename(e, e->e_qfletter),
917 							  sm_errstring(errno));
918 				}
919 			}
920 		}
921 		e->e_qfletter = new;
922 
923 		/*
924 		**  fsync() after renaming to make sure metadata is
925 		**  written to disk on filesystems in which renames are
926 		**  not guaranteed.
927 		*/
928 
929 		if (SuperSafe != SAFE_NO)
930 		{
931 			/* for softupdates */
932 			if (tfd >= 0 && fsync(tfd) < 0)
933 			{
934 				syserr("!queueup: cannot fsync queue temp file %s",
935 				       tf);
936 			}
937 			SYNC_DIR(qf, true);
938 		}
939 
940 		/* close and unlock old (locked) queue file */
941 		if (e->e_lockfp != NULL)
942 			(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
943 		e->e_lockfp = tfp;
944 
945 		/* save log info */
946 		if (LogLevel > 79)
947 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", qf);
948 	}
949 	else
950 	{
951 		/* save log info */
952 		if (LogLevel > 79)
953 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", tf);
954 
955 		e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
956 	}
957 
958 	errno = 0;
959 	e->e_flags |= EF_INQUEUE;
960 
961 	if (tTd(40, 1))
962 		sm_dprintf("<<<<< done queueing %s <<<<<\n\n", e->e_id);
963 	return;
964 }
965 
966 /*
967 **  PRINTCTLADDR -- print control address to file.
968 **
969 **	Parameters:
970 **		a -- address.
971 **		tfp -- file pointer.
972 **
973 **	Returns:
974 **		none.
975 **
976 **	Side Effects:
977 **		The control address (if changed) is printed to the file.
978 **		The last control address and uid are saved.
979 */
980 
981 static void
982 printctladdr(a, tfp)
983 	register ADDRESS *a;
984 	SM_FILE_T *tfp;
985 {
986 	char *user;
987 	register ADDRESS *q;
988 	uid_t uid;
989 	gid_t gid;
990 	static ADDRESS *lastctladdr = NULL;
991 	static uid_t lastuid;
992 
993 	/* initialization */
994 	if (a == NULL || a->q_alias == NULL || tfp == NULL)
995 	{
996 		if (lastctladdr != NULL && tfp != NULL)
997 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C\n");
998 		lastctladdr = NULL;
999 		lastuid = 0;
1000 		return;
1001 	}
1002 
1003 	/* find the active uid */
1004 	q = getctladdr(a);
1005 	if (q == NULL)
1006 	{
1007 		user = NULL;
1008 		uid = 0;
1009 		gid = 0;
1010 	}
1011 	else
1012 	{
1013 		user = q->q_ruser != NULL ? q->q_ruser : q->q_user;
1014 		uid = q->q_uid;
1015 		gid = q->q_gid;
1016 	}
1017 	a = a->q_alias;
1018 
1019 	/* check to see if this is the same as last time */
1020 	if (lastctladdr != NULL && uid == lastuid &&
1021 	    strcmp(lastctladdr->q_paddr, a->q_paddr) == 0)
1022 		return;
1023 	lastuid = uid;
1024 	lastctladdr = a;
1025 
1026 	if (uid == 0 || user == NULL || user[0] == '\0')
1027 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C");
1028 	else
1029 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C%s:%ld:%ld",
1030 				     denlstring(user, true, false), (long) uid,
1031 				     (long) gid);
1032 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ":%s\n",
1033 			     denlstring(a->q_paddr, true, false));
1034 }
1035 
1036 /*
1037 **  RUNNERS_SIGTERM -- propagate a SIGTERM to queue runner process
1038 **
1039 **	This propagates the signal to the child processes that are queue
1040 **	runners. This is for a queue runner "cleanup". After all of the
1041 **	child queue runner processes are signaled (it should be SIGTERM
1042 **	being the sig) then the old signal handler (Oldsh) is called
1043 **	to handle any cleanup set for this process (provided it is not
1044 **	SIG_DFL or SIG_IGN). The signal may not be handled immediately
1045 **	if the BlockOldsh flag is set. If the current process doesn't
1046 **	have a parent then handle the signal immediately, regardless of
1047 **	BlockOldsh.
1048 **
1049 **	Parameters:
1050 **		sig -- the signal number being sent
1051 **
1052 **	Returns:
1053 **		none.
1054 **
1055 **	Side Effects:
1056 **		Sets the NoMoreRunners boolean to true to stop more runners
1057 **		from being started in runqueue().
1058 **
1059 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1060 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1061 **		DOING.
1062 */
1063 
1064 static bool		volatile NoMoreRunners = false;
1065 static sigfunc_t	Oldsh_term = SIG_DFL;
1066 static sigfunc_t	Oldsh_hup = SIG_DFL;
1067 static sigfunc_t	volatile Oldsh = SIG_DFL;
1068 static bool		BlockOldsh = false;
1069 static int		volatile Oldsig = 0;
1070 static SIGFUNC_DECL	runners_sigterm __P((int));
1071 static SIGFUNC_DECL	runners_sighup __P((int));
1072 
1073 static SIGFUNC_DECL
1074 runners_sigterm(sig)
1075 	int sig;
1076 {
1077 	int save_errno = errno;
1078 
1079 	FIX_SYSV_SIGNAL(sig, runners_sigterm);
1080 	errno = save_errno;
1081 	CHECK_CRITICAL(sig);
1082 	NoMoreRunners = true;
1083 	Oldsh = Oldsh_term;
1084 	Oldsig = sig;
1085 	proc_list_signal(PROC_QUEUE, sig);
1086 
1087 	if (!BlockOldsh || getppid() <= 1)
1088 	{
1089 		/* Check that a valid 'old signal handler' is callable */
1090 		if (Oldsh_term != SIG_DFL && Oldsh_term != SIG_IGN &&
1091 		    Oldsh_term != runners_sigterm)
1092 			(*Oldsh_term)(sig);
1093 	}
1094 	errno = save_errno;
1095 	return SIGFUNC_RETURN;
1096 }
1097 /*
1098 **  RUNNERS_SIGHUP -- propagate a SIGHUP to queue runner process
1099 **
1100 **	This propagates the signal to the child processes that are queue
1101 **	runners. This is for a queue runner "cleanup". After all of the
1102 **	child queue runner processes are signaled (it should be SIGHUP
1103 **	being the sig) then the old signal handler (Oldsh) is called to
1104 **	handle any cleanup set for this process (provided it is not SIG_DFL
1105 **	or SIG_IGN). The signal may not be handled immediately if the
1106 **	BlockOldsh flag is set. If the current process doesn't have
1107 **	a parent then handle the signal immediately, regardless of
1108 **	BlockOldsh.
1109 **
1110 **	Parameters:
1111 **		sig -- the signal number being sent
1112 **
1113 **	Returns:
1114 **		none.
1115 **
1116 **	Side Effects:
1117 **		Sets the NoMoreRunners boolean to true to stop more runners
1118 **		from being started in runqueue().
1119 **
1120 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1121 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1122 **		DOING.
1123 */
1124 
1125 static SIGFUNC_DECL
1126 runners_sighup(sig)
1127 	int sig;
1128 {
1129 	int save_errno = errno;
1130 
1131 	FIX_SYSV_SIGNAL(sig, runners_sighup);
1132 	errno = save_errno;
1133 	CHECK_CRITICAL(sig);
1134 	NoMoreRunners = true;
1135 	Oldsh = Oldsh_hup;
1136 	Oldsig = sig;
1137 	proc_list_signal(PROC_QUEUE, sig);
1138 
1139 	if (!BlockOldsh || getppid() <= 1)
1140 	{
1141 		/* Check that a valid 'old signal handler' is callable */
1142 		if (Oldsh_hup != SIG_DFL && Oldsh_hup != SIG_IGN &&
1143 		    Oldsh_hup != runners_sighup)
1144 			(*Oldsh_hup)(sig);
1145 	}
1146 	errno = save_errno;
1147 	return SIGFUNC_RETURN;
1148 }
1149 /*
1150 **  MARK_WORK_GROUP_RESTART -- mark a work group as needing a restart
1151 **
1152 **  Sets a workgroup for restarting.
1153 **
1154 **	Parameters:
1155 **		wgrp -- the work group id to restart.
1156 **		reason -- why (signal?), -1 to turn off restart
1157 **
1158 **	Returns:
1159 **		none.
1160 **
1161 **	Side effects:
1162 **		May set global RestartWorkGroup to true.
1163 **
1164 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1165 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1166 **		DOING.
1167 */
1168 
1169 void
1170 mark_work_group_restart(wgrp, reason)
1171 	int wgrp;
1172 	int reason;
1173 {
1174 	if (wgrp < 0 || wgrp > NumWorkGroups)
1175 		return;
1176 
1177 	WorkGrp[wgrp].wg_restart = reason;
1178 	if (reason >= 0)
1179 		RestartWorkGroup = true;
1180 }
1181 /*
1182 **  RESTART_MARKED_WORK_GROUPS -- restart work groups marked as needing restart
1183 **
1184 **  Restart any workgroup marked as needing a restart provided more
1185 **  runners are allowed.
1186 **
1187 **	Parameters:
1188 **		none.
1189 **
1190 **	Returns:
1191 **		none.
1192 **
1193 **	Side effects:
1194 **		Sets global RestartWorkGroup to false.
1195 */
1196 
1197 void
1198 restart_marked_work_groups()
1199 {
1200 	int i;
1201 	int wasblocked;
1202 
1203 	if (NoMoreRunners)
1204 		return;
1205 
1206 	/* Block SIGCHLD so reapchild() doesn't mess with us */
1207 	wasblocked = sm_blocksignal(SIGCHLD);
1208 
1209 	for (i = 0; i < NumWorkGroups; i++)
1210 	{
1211 		if (WorkGrp[i].wg_restart >= 0)
1212 		{
1213 			if (LogLevel > 8)
1214 				sm_syslog(LOG_ERR, NOQID,
1215 					  "restart queue runner=%d due to signal 0x%x",
1216 					  i, WorkGrp[i].wg_restart);
1217 			restart_work_group(i);
1218 		}
1219 	}
1220 	RestartWorkGroup = false;
1221 
1222 	if (wasblocked == 0)
1223 		(void) sm_releasesignal(SIGCHLD);
1224 }
1225 /*
1226 **  RESTART_WORK_GROUP -- restart a specific work group
1227 **
1228 **  Restart a specific workgroup provided more runners are allowed.
1229 **  If the requested work group has been restarted too many times log
1230 **  this and refuse to restart.
1231 **
1232 **	Parameters:
1233 **		wgrp -- the work group id to restart
1234 **
1235 **	Returns:
1236 **		none.
1237 **
1238 **	Side Effects:
1239 **		starts another process doing the work of wgrp
1240 */
1241 
1242 #define MAX_PERSIST_RESTART	10	/* max allowed number of restarts */
1243 
1244 static void
1245 restart_work_group(wgrp)
1246 	int wgrp;
1247 {
1248 	if (NoMoreRunners ||
1249 	    wgrp < 0 || wgrp > NumWorkGroups)
1250 		return;
1251 
1252 	WorkGrp[wgrp].wg_restart = -1;
1253 	if (WorkGrp[wgrp].wg_restartcnt < MAX_PERSIST_RESTART)
1254 	{
1255 		/* avoid overflow; increment here */
1256 		WorkGrp[wgrp].wg_restartcnt++;
1257 		(void) run_work_group(wgrp, RWG_FORK|RWG_PERSISTENT|RWG_RUNALL);
1258 	}
1259 	else
1260 	{
1261 		sm_syslog(LOG_ERR, NOQID,
1262 			  "ERROR: persistent queue runner=%d restarted too many times, queue runner lost",
1263 			  wgrp);
1264 	}
1265 }
1266 /*
1267 **  SCHEDULE_QUEUE_RUNS -- schedule the next queue run for a work group.
1268 **
1269 **	Parameters:
1270 **		runall -- schedule even if individual bit is not set.
1271 **		wgrp -- the work group id to schedule.
1272 **		didit -- the queue run was performed for this work group.
1273 **
1274 **	Returns:
1275 **		nothing
1276 */
1277 
1278 #define INCR_MOD(v, m)	if (++v >= m)	\
1279 				v = 0;	\
1280 			else
1281 
1282 static void
1283 schedule_queue_runs(runall, wgrp, didit)
1284 	bool runall;
1285 	int wgrp;
1286 	bool didit;
1287 {
1288 	int qgrp, cgrp, endgrp;
1289 #if _FFR_QUEUE_SCHED_DBG
1290 	time_t lastsched;
1291 	bool sched;
1292 #endif /* _FFR_QUEUE_SCHED_DBG */
1293 	time_t now;
1294 	time_t minqintvl;
1295 
1296 	/*
1297 	**  This is a bit ugly since we have to duplicate the
1298 	**  code that "walks" through a work queue group.
1299 	*/
1300 
1301 	now = curtime();
1302 	minqintvl = 0;
1303 	cgrp = endgrp = WorkGrp[wgrp].wg_curqgrp;
1304 	do
1305 	{
1306 		time_t qintvl;
1307 
1308 #if _FFR_QUEUE_SCHED_DBG
1309 		lastsched = 0;
1310 		sched = false;
1311 #endif /* _FFR_QUEUE_SCHED_DBG */
1312 		qgrp = WorkGrp[wgrp].wg_qgs[cgrp]->qg_index;
1313 		if (Queue[qgrp]->qg_queueintvl > 0)
1314 			qintvl = Queue[qgrp]->qg_queueintvl;
1315 		else if (QueueIntvl > 0)
1316 			qintvl = QueueIntvl;
1317 		else
1318 			qintvl = (time_t) 0;
1319 #if _FFR_QUEUE_SCHED_DBG
1320 		lastsched = Queue[qgrp]->qg_nextrun;
1321 #endif /* _FFR_QUEUE_SCHED_DBG */
1322 		if ((runall || Queue[qgrp]->qg_nextrun <= now) && qintvl > 0)
1323 		{
1324 #if _FFR_QUEUE_SCHED_DBG
1325 			sched = true;
1326 #endif /* _FFR_QUEUE_SCHED_DBG */
1327 			if (minqintvl == 0 || qintvl < minqintvl)
1328 				minqintvl = qintvl;
1329 
1330 			/*
1331 			**  Only set a new time if a queue run was performed
1332 			**  for this queue group.  If the queue was not run,
1333 			**  we could starve it by setting a new time on each
1334 			**  call.
1335 			*/
1336 
1337 			if (didit)
1338 				Queue[qgrp]->qg_nextrun += qintvl;
1339 		}
1340 #if _FFR_QUEUE_SCHED_DBG
1341 		if (tTd(69, 10))
1342 			sm_syslog(LOG_INFO, NOQID,
1343 				"sqr: wgrp=%d, cgrp=%d, qgrp=%d, intvl=%ld, QI=%ld, runall=%d, lastrun=%ld, nextrun=%ld, sched=%d",
1344 				wgrp, cgrp, qgrp, Queue[qgrp]->qg_queueintvl,
1345 				QueueIntvl, runall, lastsched,
1346 				Queue[qgrp]->qg_nextrun, sched);
1347 #endif /* _FFR_QUEUE_SCHED_DBG */
1348 		INCR_MOD(cgrp, WorkGrp[wgrp].wg_numqgrp);
1349 	} while (endgrp != cgrp);
1350 	if (minqintvl > 0)
1351 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1352 }
1353 
1354 #if _FFR_QUEUE_RUN_PARANOIA
1355 /*
1356 **  CHECKQUEUERUNNER -- check whether a queue group hasn't been run.
1357 **
1358 **	Use this if events may get lost and hence queue runners may not
1359 **	be started and mail will pile up in a queue.
1360 **
1361 **	Parameters:
1362 **		none.
1363 **
1364 **	Returns:
1365 **		true if a queue run is necessary.
1366 **
1367 **	Side Effects:
1368 **		may schedule a queue run.
1369 */
1370 
1371 bool
1372 checkqueuerunner()
1373 {
1374 	int qgrp;
1375 	time_t now, minqintvl;
1376 
1377 	now = curtime();
1378 	minqintvl = 0;
1379 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
1380 	{
1381 		time_t qintvl;
1382 
1383 		if (Queue[qgrp]->qg_queueintvl > 0)
1384 			qintvl = Queue[qgrp]->qg_queueintvl;
1385 		else if (QueueIntvl > 0)
1386 			qintvl = QueueIntvl;
1387 		else
1388 			qintvl = (time_t) 0;
1389 		if (Queue[qgrp]->qg_nextrun <= now - qintvl)
1390 		{
1391 			if (minqintvl == 0 || qintvl < minqintvl)
1392 				minqintvl = qintvl;
1393 			if (LogLevel > 1)
1394 				sm_syslog(LOG_WARNING, NOQID,
1395 					"checkqueuerunner: queue %d should have been run at %s, queue interval %ld",
1396 					qgrp,
1397 					arpadate(ctime(&Queue[qgrp]->qg_nextrun)),
1398 					qintvl);
1399 		}
1400 	}
1401 	if (minqintvl > 0)
1402 	{
1403 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1404 		return true;
1405 	}
1406 	return false;
1407 }
1408 #endif /* _FFR_QUEUE_RUN_PARANOIA */
1409 
1410 /*
1411 **  RUNQUEUE -- run the jobs in the queue.
1412 **
1413 **	Gets the stuff out of the queue in some presumably logical
1414 **	order and processes them.
1415 **
1416 **	Parameters:
1417 **		forkflag -- true if the queue scanning should be done in
1418 **			a child process.  We double-fork so it is not our
1419 **			child and we don't have to clean up after it.
1420 **			false can be ignored if we have multiple queues.
1421 **		verbose -- if true, print out status information.
1422 **		persistent -- persistent queue runner?
1423 **		runall -- run all groups or only a subset (DoQueueRun)?
1424 **
1425 **	Returns:
1426 **		true if the queue run successfully began.
1427 **
1428 **	Side Effects:
1429 **		runs things in the mail queue using run_work_group().
1430 **		maybe schedules next queue run.
1431 */
1432 
1433 static ENVELOPE	QueueEnvelope;		/* the queue run envelope */
1434 static time_t	LastQueueTime = 0;	/* last time a queue ID assigned */
1435 static pid_t	LastQueuePid = -1;	/* last PID which had a queue ID */
1436 
1437 /* values for qp_supdirs */
1438 #define QP_NOSUB	0x0000	/* No subdirectories */
1439 #define QP_SUBDF	0x0001	/* "df" subdirectory */
1440 #define QP_SUBQF	0x0002	/* "qf" subdirectory */
1441 #define QP_SUBXF	0x0004	/* "xf" subdirectory */
1442 
1443 bool
1444 runqueue(forkflag, verbose, persistent, runall)
1445 	bool forkflag;
1446 	bool verbose;
1447 	bool persistent;
1448 	bool runall;
1449 {
1450 	int i;
1451 	bool ret = true;
1452 	static int curnum = 0;
1453 	sigfunc_t cursh;
1454 #if SM_HEAP_CHECK
1455 	SM_NONVOLATILE int oldgroup = 0;
1456 
1457 	if (sm_debug_active(&DebugLeakQ, 1))
1458 	{
1459 		oldgroup = sm_heap_group();
1460 		sm_heap_newgroup();
1461 		sm_dprintf("runqueue() heap group #%d\n", sm_heap_group());
1462 	}
1463 #endif /* SM_HEAP_CHECK */
1464 
1465 	/* queue run has been started, don't do any more this time */
1466 	DoQueueRun = false;
1467 
1468 	/* more than one queue or more than one directory per queue */
1469 	if (!forkflag && !verbose &&
1470 	    (WorkGrp[0].wg_qgs[0]->qg_numqueues > 1 || NumWorkGroups > 1 ||
1471 	     WorkGrp[0].wg_numqgrp > 1))
1472 		forkflag = true;
1473 
1474 	/*
1475 	**  For controlling queue runners via signals sent to this process.
1476 	**  Oldsh* will get called too by runners_sig* (if it is not SIG_IGN
1477 	**  or SIG_DFL) to preserve cleanup behavior. Now that this process
1478 	**  will have children (and perhaps grandchildren) this handler will
1479 	**  be left in place. This is because this process, once it has
1480 	**  finished spinning off queue runners, may go back to doing something
1481 	**  else (like being a daemon). And we still want on a SIG{TERM,HUP} to
1482 	**  clean up the child queue runners. Only install 'runners_sig*' once
1483 	**  else we'll get stuck looping forever.
1484 	*/
1485 
1486 	cursh = sm_signal(SIGTERM, runners_sigterm);
1487 	if (cursh != runners_sigterm)
1488 		Oldsh_term = cursh;
1489 	cursh = sm_signal(SIGHUP, runners_sighup);
1490 	if (cursh != runners_sighup)
1491 		Oldsh_hup = cursh;
1492 
1493 	for (i = 0; i < NumWorkGroups && !NoMoreRunners; i++)
1494 	{
1495 		int rwgflags = RWG_NONE;
1496 
1497 		/*
1498 		**  If MaxQueueChildren active then test whether the start
1499 		**  of the next queue group's additional queue runners (maximum)
1500 		**  will result in MaxQueueChildren being exceeded.
1501 		**
1502 		**  Note: do not use continue; even though another workgroup
1503 		**	may have fewer queue runners, this would be "unfair",
1504 		**	i.e., this work group might "starve" then.
1505 		*/
1506 
1507 #if _FFR_QUEUE_SCHED_DBG
1508 		if (tTd(69, 10))
1509 			sm_syslog(LOG_INFO, NOQID,
1510 				"rq: curnum=%d, MaxQueueChildren=%d, CurRunners=%d, WorkGrp[curnum].wg_maxact=%d",
1511 				curnum, MaxQueueChildren, CurRunners,
1512 				WorkGrp[curnum].wg_maxact);
1513 #endif /* _FFR_QUEUE_SCHED_DBG */
1514 		if (MaxQueueChildren > 0 &&
1515 		    CurRunners + WorkGrp[curnum].wg_maxact > MaxQueueChildren)
1516 			break;
1517 
1518 		/*
1519 		**  Pick up where we left off (curnum), in case we
1520 		**  used up all the children last time without finishing.
1521 		**  This give a round-robin fairness to queue runs.
1522 		**
1523 		**  Increment CurRunners before calling run_work_group()
1524 		**  to avoid a "race condition" with proc_list_drop() which
1525 		**  decrements CurRunners if the queue runners terminate.
1526 		**  Notice: CurRunners is an upper limit, in some cases
1527 		**  (too few jobs in the queue) this value is larger than
1528 		**  the actual number of queue runners. The discrepancy can
1529 		**  increase if some queue runners "hang" for a long time.
1530 		*/
1531 
1532 		CurRunners += WorkGrp[curnum].wg_maxact;
1533 		if (forkflag)
1534 			rwgflags |= RWG_FORK;
1535 		if (verbose)
1536 			rwgflags |= RWG_VERBOSE;
1537 		if (persistent)
1538 			rwgflags |= RWG_PERSISTENT;
1539 		if (runall)
1540 			rwgflags |= RWG_RUNALL;
1541 		ret = run_work_group(curnum, rwgflags);
1542 
1543 		/*
1544 		**  Failure means a message was printed for ETRN
1545 		**  and subsequent queues are likely to fail as well.
1546 		**  Decrement CurRunners in that case because
1547 		**  none have been started.
1548 		*/
1549 
1550 		if (!ret)
1551 		{
1552 			CurRunners -= WorkGrp[curnum].wg_maxact;
1553 			break;
1554 		}
1555 
1556 		if (!persistent)
1557 			schedule_queue_runs(runall, curnum, true);
1558 		INCR_MOD(curnum, NumWorkGroups);
1559 	}
1560 
1561 	/* schedule left over queue runs */
1562 	if (i < NumWorkGroups && !NoMoreRunners && !persistent)
1563 	{
1564 		int h;
1565 
1566 		for (h = curnum; i < NumWorkGroups; i++)
1567 		{
1568 			schedule_queue_runs(runall, h, false);
1569 			INCR_MOD(h, NumWorkGroups);
1570 		}
1571 	}
1572 
1573 
1574 #if SM_HEAP_CHECK
1575 	if (sm_debug_active(&DebugLeakQ, 1))
1576 		sm_heap_setgroup(oldgroup);
1577 #endif /* SM_HEAP_CHECK */
1578 	return ret;
1579 }
1580 
1581 #if _FFR_SKIP_DOMAINS
1582 /*
1583 **  SKIP_DOMAINS -- Skip 'skip' number of domains in the WorkQ.
1584 **
1585 **  Added by Stephen Frost <sfrost@snowman.net> to support
1586 **  having each runner process every N'th domain instead of
1587 **  every N'th message.
1588 **
1589 **	Parameters:
1590 **		skip -- number of domains in WorkQ to skip.
1591 **
1592 **	Returns:
1593 **		total number of messages skipped.
1594 **
1595 **	Side Effects:
1596 **		may change WorkQ
1597 */
1598 
1599 static int
1600 skip_domains(skip)
1601 	int skip;
1602 {
1603 	int n, seqjump;
1604 
1605 	for (n = 0, seqjump = 0; n < skip && WorkQ != NULL; seqjump++)
1606 	{
1607 		if (WorkQ->w_next != NULL)
1608 		{
1609 			if (WorkQ->w_host != NULL &&
1610 			    WorkQ->w_next->w_host != NULL)
1611 			{
1612 				if (sm_strcasecmp(WorkQ->w_host,
1613 						WorkQ->w_next->w_host) != 0)
1614 					n++;
1615 			}
1616 			else
1617 			{
1618 				if ((WorkQ->w_host != NULL &&
1619 				     WorkQ->w_next->w_host == NULL) ||
1620 				    (WorkQ->w_host == NULL &&
1621 				     WorkQ->w_next->w_host != NULL))
1622 					     n++;
1623 			}
1624 		}
1625 		WorkQ = WorkQ->w_next;
1626 	}
1627 	return seqjump;
1628 }
1629 #endif /* _FFR_SKIP_DOMAINS */
1630 
1631 /*
1632 **  RUNNER_WORK -- have a queue runner do its work
1633 **
1634 **  Have a queue runner do its work a list of entries.
1635 **  When work isn't directly being done then this process can take a signal
1636 **  and terminate immediately (in a clean fashion of course).
1637 **  When work is directly being done, it's not to be interrupted
1638 **  immediately: the work should be allowed to finish at a clean point
1639 **  before termination (in a clean fashion of course).
1640 **
1641 **	Parameters:
1642 **		e -- envelope.
1643 **		sequenceno -- 'th process to run WorkQ.
1644 **		didfork -- did the calling process fork()?
1645 **		skip -- process only each skip'th item.
1646 **		njobs -- number of jobs in WorkQ.
1647 **
1648 **	Returns:
1649 **		none.
1650 **
1651 **	Side Effects:
1652 **		runs things in the mail queue.
1653 */
1654 
1655 static void
1656 runner_work(e, sequenceno, didfork, skip, njobs)
1657 	register ENVELOPE *e;
1658 	int sequenceno;
1659 	bool didfork;
1660 	int skip;
1661 	int njobs;
1662 {
1663 	int n, seqjump;
1664 	WORK *w;
1665 	time_t now;
1666 
1667 	SM_GET_LA(now);
1668 
1669 	/*
1670 	**  Here we temporarily block the second calling of the handlers.
1671 	**  This allows us to handle the signal without terminating in the
1672 	**  middle of direct work. If a signal does come, the test for
1673 	**  NoMoreRunners will find it.
1674 	*/
1675 
1676 	BlockOldsh = true;
1677 	seqjump = skip;
1678 
1679 	/* process them once at a time */
1680 	while (WorkQ != NULL)
1681 	{
1682 #if SM_HEAP_CHECK
1683 		SM_NONVOLATILE int oldgroup = 0;
1684 
1685 		if (sm_debug_active(&DebugLeakQ, 1))
1686 		{
1687 			oldgroup = sm_heap_group();
1688 			sm_heap_newgroup();
1689 			sm_dprintf("run_queue_group() heap group #%d\n",
1690 				sm_heap_group());
1691 		}
1692 #endif /* SM_HEAP_CHECK */
1693 
1694 		/* do no more work */
1695 		if (NoMoreRunners)
1696 		{
1697 			/* Check that a valid signal handler is callable */
1698 			if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1699 			    Oldsh != runners_sighup &&
1700 			    Oldsh != runners_sigterm)
1701 				(*Oldsh)(Oldsig);
1702 			break;
1703 		}
1704 
1705 		w = WorkQ; /* assign current work item */
1706 
1707 		/*
1708 		**  Set the head of the WorkQ to the next work item.
1709 		**  It is set 'skip' ahead (the number of parallel queue
1710 		**  runners working on WorkQ together) since each runner
1711 		**  works on every 'skip'th (N-th) item.
1712 #if _FFR_SKIP_DOMAINS
1713 		**  In the case of the BYHOST Queue Sort Order, the 'item'
1714 		**  is a domain, so we work on every 'skip'th (N-th) domain.
1715 #endif * _FFR_SKIP_DOMAINS *
1716 		*/
1717 
1718 #if _FFR_SKIP_DOMAINS
1719 		if (QueueSortOrder == QSO_BYHOST)
1720 		{
1721 			seqjump = 1;
1722 			if (WorkQ->w_next != NULL)
1723 			{
1724 				if (WorkQ->w_host != NULL &&
1725 				    WorkQ->w_next->w_host != NULL)
1726 				{
1727 					if (sm_strcasecmp(WorkQ->w_host,
1728 							WorkQ->w_next->w_host)
1729 								!= 0)
1730 						seqjump = skip_domains(skip);
1731 					else
1732 						WorkQ = WorkQ->w_next;
1733 				}
1734 				else
1735 				{
1736 					if ((WorkQ->w_host != NULL &&
1737 					     WorkQ->w_next->w_host == NULL) ||
1738 					    (WorkQ->w_host == NULL &&
1739 					     WorkQ->w_next->w_host != NULL))
1740 						seqjump = skip_domains(skip);
1741 					else
1742 						WorkQ = WorkQ->w_next;
1743 				}
1744 			}
1745 			else
1746 				WorkQ = WorkQ->w_next;
1747 		}
1748 		else
1749 #endif /* _FFR_SKIP_DOMAINS */
1750 		{
1751 			for (n = 0; n < skip && WorkQ != NULL; n++)
1752 				WorkQ = WorkQ->w_next;
1753 		}
1754 
1755 		e->e_to = NULL;
1756 
1757 		/*
1758 		**  Ignore jobs that are too expensive for the moment.
1759 		**
1760 		**	Get new load average every GET_NEW_LA_TIME seconds.
1761 		*/
1762 
1763 		SM_GET_LA(now);
1764 		if (shouldqueue(WkRecipFact, Current_LA_time))
1765 		{
1766 			char *msg = "Aborting queue run: load average too high";
1767 
1768 			if (Verbose)
1769 				message("%s", msg);
1770 			if (LogLevel > 8)
1771 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1772 			break;
1773 		}
1774 		if (shouldqueue(w->w_pri, w->w_ctime))
1775 		{
1776 			if (Verbose)
1777 				message(EmptyString);
1778 			if (QueueSortOrder == QSO_BYPRIORITY)
1779 			{
1780 				if (Verbose)
1781 					message("Skipping %s/%s (sequence %d of %d) and flushing rest of queue",
1782 						qid_printqueue(w->w_qgrp,
1783 							       w->w_qdir),
1784 						w->w_name + 2, sequenceno,
1785 						njobs);
1786 				if (LogLevel > 8)
1787 					sm_syslog(LOG_INFO, NOQID,
1788 						  "runqueue: Flushing queue from %s/%s (pri %ld, LA %d, %d of %d)",
1789 						  qid_printqueue(w->w_qgrp,
1790 								 w->w_qdir),
1791 						  w->w_name + 2, w->w_pri,
1792 						  CurrentLA, sequenceno,
1793 						  njobs);
1794 				break;
1795 			}
1796 			else if (Verbose)
1797 				message("Skipping %s/%s (sequence %d of %d)",
1798 					qid_printqueue(w->w_qgrp, w->w_qdir),
1799 					w->w_name + 2, sequenceno, njobs);
1800 		}
1801 		else
1802 		{
1803 			if (Verbose)
1804 			{
1805 				message(EmptyString);
1806 				message("Running %s/%s (sequence %d of %d)",
1807 					qid_printqueue(w->w_qgrp, w->w_qdir),
1808 					w->w_name + 2, sequenceno, njobs);
1809 			}
1810 			if (didfork && MaxQueueChildren > 0)
1811 			{
1812 				sm_blocksignal(SIGCHLD);
1813 				(void) sm_signal(SIGCHLD, reapchild);
1814 			}
1815 			if (tTd(63, 100))
1816 				sm_syslog(LOG_DEBUG, NOQID,
1817 					  "runqueue %s dowork(%s)",
1818 					  qid_printqueue(w->w_qgrp, w->w_qdir),
1819 					  w->w_name + 2);
1820 
1821 			(void) dowork(w->w_qgrp, w->w_qdir, w->w_name + 2,
1822 				      ForkQueueRuns, false, e);
1823 			errno = 0;
1824 		}
1825 		sm_free(w->w_name); /* XXX */
1826 		if (w->w_host != NULL)
1827 			sm_free(w->w_host); /* XXX */
1828 		sm_free((char *) w); /* XXX */
1829 		sequenceno += seqjump; /* next sequence number */
1830 #if SM_HEAP_CHECK
1831 		if (sm_debug_active(&DebugLeakQ, 1))
1832 			sm_heap_setgroup(oldgroup);
1833 #endif /* SM_HEAP_CHECK */
1834 	}
1835 
1836 	BlockOldsh = false;
1837 
1838 	/* check the signals didn't happen during the revert */
1839 	if (NoMoreRunners)
1840 	{
1841 		/* Check that a valid signal handler is callable */
1842 		if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1843 		    Oldsh != runners_sighup && Oldsh != runners_sigterm)
1844 			(*Oldsh)(Oldsig);
1845 	}
1846 
1847 	Oldsh = SIG_DFL; /* after the NoMoreRunners check */
1848 }
1849 /*
1850 **  RUN_WORK_GROUP -- run the jobs in a queue group from a work group.
1851 **
1852 **	Gets the stuff out of the queue in some presumably logical
1853 **	order and processes them.
1854 **
1855 **	Parameters:
1856 **		wgrp -- work group to process.
1857 **		flags -- RWG_* flags
1858 **
1859 **	Returns:
1860 **		true if the queue run successfully began.
1861 **
1862 **	Side Effects:
1863 **		runs things in the mail queue.
1864 */
1865 
1866 /* Minimum sleep time for persistent queue runners */
1867 #define MIN_SLEEP_TIME	5
1868 
1869 bool
1870 run_work_group(wgrp, flags)
1871 	int wgrp;
1872 	int flags;
1873 {
1874 	register ENVELOPE *e;
1875 	int njobs, qdir;
1876 	int sequenceno = 1;
1877 	int qgrp, endgrp, h, i;
1878 	time_t now;
1879 	bool full, more;
1880 	SM_RPOOL_T *rpool;
1881 	extern ENVELOPE BlankEnvelope;
1882 	extern SIGFUNC_DECL reapchild __P((int));
1883 
1884 	if (wgrp < 0)
1885 		return false;
1886 
1887 	/*
1888 	**  If no work will ever be selected, don't even bother reading
1889 	**  the queue.
1890 	*/
1891 
1892 	SM_GET_LA(now);
1893 
1894 	if (!bitset(RWG_PERSISTENT, flags) &&
1895 	    shouldqueue(WkRecipFact, Current_LA_time))
1896 	{
1897 		char *msg = "Skipping queue run -- load average too high";
1898 
1899 		if (bitset(RWG_VERBOSE, flags))
1900 			message("458 %s\n", msg);
1901 		if (LogLevel > 8)
1902 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1903 		return false;
1904 	}
1905 
1906 	/*
1907 	**  See if we already have too many children.
1908 	*/
1909 
1910 	if (bitset(RWG_FORK, flags) &&
1911 	    WorkGrp[wgrp].wg_lowqintvl > 0 &&
1912 	    !bitset(RWG_PERSISTENT, flags) &&
1913 	    MaxChildren > 0 && CurChildren >= MaxChildren)
1914 	{
1915 		char *msg = "Skipping queue run -- too many children";
1916 
1917 		if (bitset(RWG_VERBOSE, flags))
1918 			message("458 %s (%d)\n", msg, CurChildren);
1919 		if (LogLevel > 8)
1920 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s (%d)",
1921 				  msg, CurChildren);
1922 		return false;
1923 	}
1924 
1925 	/*
1926 	**  See if we want to go off and do other useful work.
1927 	*/
1928 
1929 	if (bitset(RWG_FORK, flags))
1930 	{
1931 		pid_t pid;
1932 
1933 		(void) sm_blocksignal(SIGCHLD);
1934 		(void) sm_signal(SIGCHLD, reapchild);
1935 
1936 		pid = dofork();
1937 		if (pid == -1)
1938 		{
1939 			const char *msg = "Skipping queue run -- fork() failed";
1940 			const char *err = sm_errstring(errno);
1941 
1942 			if (bitset(RWG_VERBOSE, flags))
1943 				message("458 %s: %s\n", msg, err);
1944 			if (LogLevel > 8)
1945 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s: %s",
1946 					  msg, err);
1947 			(void) sm_releasesignal(SIGCHLD);
1948 			return false;
1949 		}
1950 		if (pid != 0)
1951 		{
1952 			/* parent -- pick up intermediate zombie */
1953 			(void) sm_blocksignal(SIGALRM);
1954 
1955 			/* wgrp only used when queue runners are persistent */
1956 			proc_list_add(pid, "Queue runner", PROC_QUEUE,
1957 				      WorkGrp[wgrp].wg_maxact,
1958 				      bitset(RWG_PERSISTENT, flags) ? wgrp : -1,
1959 				      NULL);
1960 			(void) sm_releasesignal(SIGALRM);
1961 			(void) sm_releasesignal(SIGCHLD);
1962 			return true;
1963 		}
1964 
1965 		/* child -- clean up signals */
1966 
1967 		/* Reset global flags */
1968 		RestartRequest = NULL;
1969 		RestartWorkGroup = false;
1970 		ShutdownRequest = NULL;
1971 		PendingSignal = 0;
1972 		CurrentPid = getpid();
1973 		close_sendmail_pid();
1974 
1975 		/*
1976 		**  Initialize exception stack and default exception
1977 		**  handler for child process.
1978 		*/
1979 
1980 		sm_exc_newthread(fatal_error);
1981 		clrcontrol();
1982 		proc_list_clear();
1983 
1984 		/* Add parent process as first child item */
1985 		proc_list_add(CurrentPid, "Queue runner child process",
1986 			      PROC_QUEUE_CHILD, 0, -1, NULL);
1987 		(void) sm_releasesignal(SIGCHLD);
1988 		(void) sm_signal(SIGCHLD, SIG_DFL);
1989 		(void) sm_signal(SIGHUP, SIG_DFL);
1990 		(void) sm_signal(SIGTERM, intsig);
1991 	}
1992 
1993 	/*
1994 	**  Release any resources used by the daemon code.
1995 	*/
1996 
1997 	clrdaemon();
1998 
1999 	/* force it to run expensive jobs */
2000 	NoConnect = false;
2001 
2002 	/* drop privileges */
2003 	if (geteuid() == (uid_t) 0)
2004 		(void) drop_privileges(false);
2005 
2006 	/*
2007 	**  Create ourselves an envelope
2008 	*/
2009 
2010 	CurEnv = &QueueEnvelope;
2011 	rpool = sm_rpool_new_x(NULL);
2012 	e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2013 	e->e_flags = BlankEnvelope.e_flags;
2014 	e->e_parent = NULL;
2015 
2016 	/* make sure we have disconnected from parent */
2017 	if (bitset(RWG_FORK, flags))
2018 	{
2019 		disconnect(1, e);
2020 		QuickAbort = false;
2021 	}
2022 
2023 	/*
2024 	**  If we are running part of the queue, always ignore stored
2025 	**  host status.
2026 	*/
2027 
2028 	if (QueueLimitId != NULL || QueueLimitSender != NULL ||
2029 	    QueueLimitQuarantine != NULL ||
2030 	    QueueLimitRecipient != NULL)
2031 	{
2032 		IgnoreHostStatus = true;
2033 		MinQueueAge = 0;
2034 	}
2035 
2036 	/*
2037 	**  Here is where we choose the queue group from the work group.
2038 	**  The caller of the "domorework" label must setup a new envelope.
2039 	*/
2040 
2041 	endgrp = WorkGrp[wgrp].wg_curqgrp; /* to not spin endlessly */
2042 
2043   domorework:
2044 
2045 	/*
2046 	**  Run a queue group if:
2047 	**  RWG_RUNALL bit is set or the bit for this group is set.
2048 	*/
2049 
2050 	now = curtime();
2051 	for (;;)
2052 	{
2053 		/*
2054 		**  Find the next queue group within the work group that
2055 		**  has been marked as needing a run.
2056 		*/
2057 
2058 		qgrp = WorkGrp[wgrp].wg_qgs[WorkGrp[wgrp].wg_curqgrp]->qg_index;
2059 		WorkGrp[wgrp].wg_curqgrp++; /* advance */
2060 		WorkGrp[wgrp].wg_curqgrp %= WorkGrp[wgrp].wg_numqgrp; /* wrap */
2061 		if (bitset(RWG_RUNALL, flags) ||
2062 		    (Queue[qgrp]->qg_nextrun <= now &&
2063 		     Queue[qgrp]->qg_nextrun != (time_t) -1))
2064 			break;
2065 		if (endgrp == WorkGrp[wgrp].wg_curqgrp)
2066 		{
2067 			e->e_id = NULL;
2068 			if (bitset(RWG_FORK, flags))
2069 				finis(true, true, ExitStat);
2070 			return true; /* we're done */
2071 		}
2072 	}
2073 
2074 	qdir = Queue[qgrp]->qg_curnum; /* round-robin init of queue position */
2075 #if _FFR_QUEUE_SCHED_DBG
2076 	if (tTd(69, 12))
2077 		sm_syslog(LOG_INFO, NOQID,
2078 			"rwg: wgrp=%d, qgrp=%d, qdir=%d, name=%s, curqgrp=%d, numgrps=%d",
2079 			wgrp, qgrp, qdir, qid_printqueue(qgrp, qdir),
2080 			WorkGrp[wgrp].wg_curqgrp, WorkGrp[wgrp].wg_numqgrp);
2081 #endif /* _FFR_QUEUE_SCHED_DBG */
2082 
2083 #if HASNICE
2084 	/* tweak niceness of queue runs */
2085 	if (Queue[qgrp]->qg_nice > 0)
2086 		(void) nice(Queue[qgrp]->qg_nice);
2087 #endif /* HASNICE */
2088 
2089 	/* XXX running queue group... */
2090 	sm_setproctitle(true, CurEnv, "running queue: %s",
2091 			qid_printqueue(qgrp, qdir));
2092 
2093 	if (LogLevel > 69 || tTd(63, 99))
2094 		sm_syslog(LOG_DEBUG, NOQID,
2095 			  "runqueue %s, pid=%d, forkflag=%d",
2096 			  qid_printqueue(qgrp, qdir), (int) CurrentPid,
2097 			  bitset(RWG_FORK, flags));
2098 
2099 	/*
2100 	**  Start making passes through the queue.
2101 	**	First, read and sort the entire queue.
2102 	**	Then, process the work in that order.
2103 	**		But if you take too long, start over.
2104 	*/
2105 
2106 	for (i = 0; i < Queue[qgrp]->qg_numqueues; i++)
2107 	{
2108 		(void) gatherq(qgrp, qdir, false, &full, &more, &h);
2109 #if SM_CONF_SHM
2110 		if (ShmId != SM_SHM_NO_ID)
2111 			QSHM_ENTRIES(Queue[qgrp]->qg_qpaths[qdir].qp_idx) = h;
2112 #endif /* SM_CONF_SHM */
2113 		/* If there are no more items in this queue advance */
2114 		if (!more)
2115 		{
2116 			/* A round-robin advance */
2117 			qdir++;
2118 			qdir %= Queue[qgrp]->qg_numqueues;
2119 		}
2120 
2121 		/* Has the WorkList reached the limit? */
2122 		if (full)
2123 			break; /* don't try to gather more */
2124 	}
2125 
2126 	/* order the existing work requests */
2127 	njobs = sortq(Queue[qgrp]->qg_maxlist);
2128 	Queue[qgrp]->qg_curnum = qdir; /* update */
2129 
2130 
2131 	if (!Verbose && bitnset(QD_FORK, Queue[qgrp]->qg_flags))
2132 	{
2133 		int loop, maxrunners;
2134 		pid_t pid;
2135 
2136 		/*
2137 		**  For this WorkQ we want to fork off N children (maxrunners)
2138 		**  at this point. Each child has a copy of WorkQ. Each child
2139 		**  will process every N-th item. The parent will wait for all
2140 		**  of the children to finish before moving on to the next
2141 		**  queue group within the work group. This saves us forking
2142 		**  a new runner-child for each work item.
2143 		**  It's valid for qg_maxqrun == 0 since this may be an
2144 		**  explicit "don't run this queue" setting.
2145 		*/
2146 
2147 		maxrunners = Queue[qgrp]->qg_maxqrun;
2148 
2149 		/*
2150 		**  If no runners are configured for this group but
2151 		**  the queue is "forced" then lets use 1 runner.
2152 		*/
2153 
2154 		if (maxrunners == 0 && bitset(RWG_FORCE, flags))
2155 			maxrunners = 1;
2156 
2157 		/* No need to have more runners then there are jobs */
2158 		if (maxrunners > njobs)
2159 			maxrunners = njobs;
2160 		for (loop = 0; loop < maxrunners; loop++)
2161 		{
2162 			/*
2163 			**  Since the delivery may happen in a child and the
2164 			**  parent does not wait, the parent may close the
2165 			**  maps thereby removing any shared memory used by
2166 			**  the map.  Therefore, close the maps now so the
2167 			**  child will dynamically open them if necessary.
2168 			*/
2169 
2170 			closemaps(false);
2171 
2172 			pid = fork();
2173 			if (pid < 0)
2174 			{
2175 				syserr("run_work_group: cannot fork");
2176 				return false;
2177 			}
2178 			else if (pid > 0)
2179 			{
2180 				/* parent -- clean out connection cache */
2181 				mci_flush(false, NULL);
2182 #if _FFR_SKIP_DOMAINS
2183 				if (QueueSortOrder == QSO_BYHOST)
2184 				{
2185 					sequenceno += skip_domains(1);
2186 				}
2187 				else
2188 #endif /* _FFR_SKIP_DOMAINS */
2189 				{
2190 					/* for the skip */
2191 					WorkQ = WorkQ->w_next;
2192 					sequenceno++;
2193 				}
2194 				proc_list_add(pid, "Queue child runner process",
2195 					      PROC_QUEUE_CHILD, 0, -1, NULL);
2196 
2197 				/* No additional work, no additional runners */
2198 				if (WorkQ == NULL)
2199 					break;
2200 			}
2201 			else
2202 			{
2203 				/* child -- Reset global flags */
2204 				RestartRequest = NULL;
2205 				RestartWorkGroup = false;
2206 				ShutdownRequest = NULL;
2207 				PendingSignal = 0;
2208 				CurrentPid = getpid();
2209 				close_sendmail_pid();
2210 
2211 				/*
2212 				**  Initialize exception stack and default
2213 				**  exception handler for child process.
2214 				**  When fork()'d the child now has a private
2215 				**  copy of WorkQ at its current position.
2216 				*/
2217 
2218 				sm_exc_newthread(fatal_error);
2219 
2220 				/*
2221 				**  SMTP processes (whether -bd or -bs) set
2222 				**  SIGCHLD to reapchild to collect
2223 				**  children status.  However, at delivery
2224 				**  time, that status must be collected
2225 				**  by sm_wait() to be dealt with properly
2226 				**  (check success of delivery based
2227 				**  on status code, etc).  Therefore, if we
2228 				**  are an SMTP process, reset SIGCHLD
2229 				**  back to the default so reapchild
2230 				**  doesn't collect status before
2231 				**  sm_wait().
2232 				*/
2233 
2234 				if (OpMode == MD_SMTP ||
2235 				    OpMode == MD_DAEMON ||
2236 				    MaxQueueChildren > 0)
2237 				{
2238 					proc_list_clear();
2239 					sm_releasesignal(SIGCHLD);
2240 					(void) sm_signal(SIGCHLD, SIG_DFL);
2241 				}
2242 
2243 				/* child -- error messages to the transcript */
2244 				QuickAbort = OnlyOneError = false;
2245 				runner_work(e, sequenceno, true,
2246 					    maxrunners, njobs);
2247 
2248 				/* This child is done */
2249 				finis(true, true, ExitStat);
2250 				/* NOTREACHED */
2251 			}
2252 		}
2253 
2254 		sm_releasesignal(SIGCHLD);
2255 
2256 		/*
2257 		**  Wait until all of the runners have completed before
2258 		**  seeing if there is another queue group in the
2259 		**  work group to process.
2260 		**  XXX Future enhancement: don't wait() for all children
2261 		**  here, just go ahead and make sure that overall the number
2262 		**  of children is not exceeded.
2263 		*/
2264 
2265 		while (CurChildren > 0)
2266 		{
2267 			int status;
2268 			pid_t ret;
2269 
2270 			while ((ret = sm_wait(&status)) <= 0)
2271 				continue;
2272 			proc_list_drop(ret, status, NULL);
2273 		}
2274 	}
2275 	else if (Queue[qgrp]->qg_maxqrun > 0 || bitset(RWG_FORCE, flags))
2276 	{
2277 		/*
2278 		**  When current process will not fork children to do the work,
2279 		**  it will do the work itself. The 'skip' will be 1 since
2280 		**  there are no child runners to divide the work across.
2281 		*/
2282 
2283 		runner_work(e, sequenceno, false, 1, njobs);
2284 	}
2285 
2286 	/* free memory allocated by newenvelope() above */
2287 	sm_rpool_free(rpool);
2288 	QueueEnvelope.e_rpool = NULL;
2289 
2290 	/* Are there still more queues in the work group to process? */
2291 	if (endgrp != WorkGrp[wgrp].wg_curqgrp)
2292 	{
2293 		rpool = sm_rpool_new_x(NULL);
2294 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2295 		e->e_flags = BlankEnvelope.e_flags;
2296 		goto domorework;
2297 	}
2298 
2299 	/* No more queues in work group to process. Now check persistent. */
2300 	if (bitset(RWG_PERSISTENT, flags))
2301 	{
2302 		sequenceno = 1;
2303 		sm_setproctitle(true, CurEnv, "running queue: %s",
2304 				qid_printqueue(qgrp, qdir));
2305 
2306 		/*
2307 		**  close bogus maps, i.e., maps which caused a tempfail,
2308 		**	so we get fresh map connections on the next lookup.
2309 		**  closemaps() is also called when children are started.
2310 		*/
2311 
2312 		closemaps(true);
2313 
2314 		/* Close any cached connections. */
2315 		mci_flush(true, NULL);
2316 
2317 		/* Clean out expired related entries. */
2318 		rmexpstab();
2319 
2320 #if NAMED_BIND
2321 		/* Update MX records for FallbackMX. */
2322 		if (FallbackMX != NULL)
2323 			(void) getfallbackmxrr(FallbackMX);
2324 #endif /* NAMED_BIND */
2325 
2326 #if USERDB
2327 		/* close UserDatabase */
2328 		_udbx_close();
2329 #endif /* USERDB */
2330 
2331 #if SM_HEAP_CHECK
2332 		if (sm_debug_active(&SmHeapCheck, 2)
2333 		    && access("memdump", F_OK) == 0
2334 		   )
2335 		{
2336 			SM_FILE_T *out;
2337 
2338 			remove("memdump");
2339 			out = sm_io_open(SmFtStdio, SM_TIME_DEFAULT,
2340 					 "memdump.out", SM_IO_APPEND, NULL);
2341 			if (out != NULL)
2342 			{
2343 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT, "----------------------\n");
2344 				sm_heap_report(out,
2345 					sm_debug_level(&SmHeapCheck) - 1);
2346 				(void) sm_io_close(out, SM_TIME_DEFAULT);
2347 			}
2348 		}
2349 #endif /* SM_HEAP_CHECK */
2350 
2351 		/* let me rest for a second to catch my breath */
2352 		if (njobs == 0 && WorkGrp[wgrp].wg_lowqintvl < MIN_SLEEP_TIME)
2353 			sleep(MIN_SLEEP_TIME);
2354 		else if (WorkGrp[wgrp].wg_lowqintvl <= 0)
2355 			sleep(QueueIntvl > 0 ? QueueIntvl : MIN_SLEEP_TIME);
2356 		else
2357 			sleep(WorkGrp[wgrp].wg_lowqintvl);
2358 
2359 		/*
2360 		**  Get the LA outside the WorkQ loop if necessary.
2361 		**  In a persistent queue runner the code is repeated over
2362 		**  and over but gatherq() may ignore entries due to
2363 		**  shouldqueue() (do we really have to do this twice?).
2364 		**  Hence the queue runners would just idle around when once
2365 		**  CurrentLA caused all entries in a queue to be ignored.
2366 		*/
2367 
2368 		if (njobs == 0)
2369 			SM_GET_LA(now);
2370 		rpool = sm_rpool_new_x(NULL);
2371 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2372 		e->e_flags = BlankEnvelope.e_flags;
2373 		goto domorework;
2374 	}
2375 
2376 	/* exit without the usual cleanup */
2377 	e->e_id = NULL;
2378 	if (bitset(RWG_FORK, flags))
2379 		finis(true, true, ExitStat);
2380 	/* NOTREACHED */
2381 	return true;
2382 }
2383 
2384 /*
2385 **  DOQUEUERUN -- do a queue run?
2386 */
2387 
2388 bool
2389 doqueuerun()
2390 {
2391 	return DoQueueRun;
2392 }
2393 
2394 /*
2395 **  RUNQUEUEEVENT -- Sets a flag to indicate that a queue run should be done.
2396 **
2397 **	Parameters:
2398 **		none.
2399 **
2400 **	Returns:
2401 **		none.
2402 **
2403 **	Side Effects:
2404 **		The invocation of this function via an alarm may interrupt
2405 **		a set of actions. Thus errno may be set in that context.
2406 **		We need to restore errno at the end of this function to ensure
2407 **		that any work done here that sets errno doesn't return a
2408 **		misleading/false errno value. Errno may	be EINTR upon entry to
2409 **		this function because of non-restartable/continuable system
2410 **		API was active. Iff this is true we will override errno as
2411 **		a timeout (as a more accurate error message).
2412 **
2413 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
2414 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
2415 **		DOING.
2416 */
2417 
2418 void
2419 runqueueevent(ignore)
2420 	int ignore;
2421 {
2422 	int save_errno = errno;
2423 
2424 	/*
2425 	**  Set the general bit that we want a queue run,
2426 	**  tested in doqueuerun()
2427 	*/
2428 
2429 	DoQueueRun = true;
2430 #if _FFR_QUEUE_SCHED_DBG
2431 	if (tTd(69, 10))
2432 		sm_syslog(LOG_INFO, NOQID, "rqe: done");
2433 #endif /* _FFR_QUEUE_SCHED_DBG */
2434 
2435 	errno = save_errno;
2436 	if (errno == EINTR)
2437 		errno = ETIMEDOUT;
2438 }
2439 /*
2440 **  GATHERQ -- gather messages from the message queue(s) the work queue.
2441 **
2442 **	Parameters:
2443 **		qgrp -- the index of the queue group.
2444 **		qdir -- the index of the queue directory.
2445 **		doall -- if set, include everything in the queue (even
2446 **			the jobs that cannot be run because the load
2447 **			average is too high, or MaxQueueRun is reached).
2448 **			Otherwise, exclude those jobs.
2449 **		full -- (optional) to be set 'true' if WorkList is full
2450 **		more -- (optional) to be set 'true' if there are still more
2451 **			messages in this queue not added to WorkList
2452 **		pnentries -- (optional) total nuber of entries in queue
2453 **
2454 **	Returns:
2455 **		The number of request in the queue (not necessarily
2456 **		the number of requests in WorkList however).
2457 **
2458 **	Side Effects:
2459 **		prepares available work into WorkList
2460 */
2461 
2462 #define NEED_P		0001	/* 'P': priority */
2463 #define NEED_T		0002	/* 'T': time */
2464 #define NEED_R		0004	/* 'R': recipient */
2465 #define NEED_S		0010	/* 'S': sender */
2466 #define NEED_H		0020	/* host */
2467 #define HAS_QUARANTINE	0040	/* has an unexpected 'q' line */
2468 #define NEED_QUARANTINE	0100	/* 'q': reason */
2469 
2470 static WORK	*WorkList = NULL;	/* list of unsort work */
2471 static int	WorkListSize = 0;	/* current max size of WorkList */
2472 static int	WorkListCount = 0;	/* # of work items in WorkList */
2473 
2474 static int
2475 gatherq(qgrp, qdir, doall, full, more, pnentries)
2476 	int qgrp;
2477 	int qdir;
2478 	bool doall;
2479 	bool *full;
2480 	bool *more;
2481 	int *pnentries;
2482 {
2483 	register struct dirent *d;
2484 	register WORK *w;
2485 	register char *p;
2486 	DIR *f;
2487 	int i, num_ent, wn, nentries;
2488 	QUEUE_CHAR *check;
2489 	char qd[MAXPATHLEN];
2490 	char qf[MAXPATHLEN];
2491 
2492 	wn = WorkListCount - 1;
2493 	num_ent = 0;
2494 	nentries = 0;
2495 	if (qdir == NOQDIR)
2496 		(void) sm_strlcpy(qd, ".", sizeof(qd));
2497 	else
2498 		(void) sm_strlcpyn(qd, sizeof(qd), 2,
2499 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
2500 			(bitset(QP_SUBQF,
2501 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
2502 					? "/qf" : ""));
2503 
2504 	if (tTd(41, 1))
2505 	{
2506 		sm_dprintf("gatherq:\n");
2507 
2508 		check = QueueLimitId;
2509 		while (check != NULL)
2510 		{
2511 			sm_dprintf("\tQueueLimitId = %s%s\n",
2512 				check->queue_negate ? "!" : "",
2513 				check->queue_match);
2514 			check = check->queue_next;
2515 		}
2516 
2517 		check = QueueLimitSender;
2518 		while (check != NULL)
2519 		{
2520 			sm_dprintf("\tQueueLimitSender = %s%s\n",
2521 				check->queue_negate ? "!" : "",
2522 				check->queue_match);
2523 			check = check->queue_next;
2524 		}
2525 
2526 		check = QueueLimitRecipient;
2527 		while (check != NULL)
2528 		{
2529 			sm_dprintf("\tQueueLimitRecipient = %s%s\n",
2530 				check->queue_negate ? "!" : "",
2531 				check->queue_match);
2532 			check = check->queue_next;
2533 		}
2534 
2535 		if (QueueMode == QM_QUARANTINE)
2536 		{
2537 			check = QueueLimitQuarantine;
2538 			while (check != NULL)
2539 			{
2540 				sm_dprintf("\tQueueLimitQuarantine = %s%s\n",
2541 					   check->queue_negate ? "!" : "",
2542 					   check->queue_match);
2543 				check = check->queue_next;
2544 			}
2545 		}
2546 	}
2547 
2548 	/* open the queue directory */
2549 	f = opendir(qd);
2550 	if (f == NULL)
2551 	{
2552 		syserr("gatherq: cannot open \"%s\"",
2553 			qid_printqueue(qgrp, qdir));
2554 		if (full != NULL)
2555 			*full = WorkListCount >= MaxQueueRun && MaxQueueRun > 0;
2556 		if (more != NULL)
2557 			*more = false;
2558 		return 0;
2559 	}
2560 
2561 	/*
2562 	**  Read the work directory.
2563 	*/
2564 
2565 	while ((d = readdir(f)) != NULL)
2566 	{
2567 		SM_FILE_T *cf;
2568 		int qfver = 0;
2569 		char lbuf[MAXNAME + 1];
2570 		struct stat sbuf;
2571 
2572 		if (tTd(41, 50))
2573 			sm_dprintf("gatherq: checking %s..", d->d_name);
2574 
2575 		/* is this an interesting entry? */
2576 		if (!(((QueueMode == QM_NORMAL &&
2577 			d->d_name[0] == NORMQF_LETTER) ||
2578 		       (QueueMode == QM_QUARANTINE &&
2579 			d->d_name[0] == QUARQF_LETTER) ||
2580 		       (QueueMode == QM_LOST &&
2581 			d->d_name[0] == LOSEQF_LETTER)) &&
2582 		      d->d_name[1] == 'f'))
2583 		{
2584 			if (tTd(41, 50))
2585 				sm_dprintf("  skipping\n");
2586 			continue;
2587 		}
2588 		if (tTd(41, 50))
2589 			sm_dprintf("\n");
2590 
2591 		if (strlen(d->d_name) >= MAXQFNAME)
2592 		{
2593 			if (Verbose)
2594 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
2595 						     "gatherq: %s too long, %d max characters\n",
2596 						     d->d_name, MAXQFNAME);
2597 			if (LogLevel > 0)
2598 				sm_syslog(LOG_ALERT, NOQID,
2599 					  "gatherq: %s too long, %d max characters",
2600 					  d->d_name, MAXQFNAME);
2601 			continue;
2602 		}
2603 
2604 		++nentries;
2605 		check = QueueLimitId;
2606 		while (check != NULL)
2607 		{
2608 			if (strcontainedin(false, check->queue_match,
2609 					   d->d_name) != check->queue_negate)
2610 				break;
2611 			else
2612 				check = check->queue_next;
2613 		}
2614 		if (QueueLimitId != NULL && check == NULL)
2615 			continue;
2616 
2617 		/* grow work list if necessary */
2618 		if (++wn >= MaxQueueRun && MaxQueueRun > 0)
2619 		{
2620 			if (wn == MaxQueueRun && LogLevel > 0)
2621 				sm_syslog(LOG_WARNING, NOQID,
2622 					  "WorkList for %s maxed out at %d",
2623 					  qid_printqueue(qgrp, qdir),
2624 					  MaxQueueRun);
2625 			if (doall)
2626 				continue;	/* just count entries */
2627 			break;
2628 		}
2629 		if (wn >= WorkListSize)
2630 		{
2631 			grow_wlist(qgrp, qdir);
2632 			if (wn >= WorkListSize)
2633 				continue;
2634 		}
2635 		SM_ASSERT(wn >= 0);
2636 		w = &WorkList[wn];
2637 
2638 		(void) sm_strlcpyn(qf, sizeof(qf), 3, qd, "/", d->d_name);
2639 		if (stat(qf, &sbuf) < 0)
2640 		{
2641 			if (errno != ENOENT)
2642 				sm_syslog(LOG_INFO, NOQID,
2643 					  "gatherq: can't stat %s/%s",
2644 					  qid_printqueue(qgrp, qdir),
2645 					  d->d_name);
2646 			wn--;
2647 			continue;
2648 		}
2649 		if (!bitset(S_IFREG, sbuf.st_mode))
2650 		{
2651 			/* Yikes!  Skip it or we will hang on open! */
2652 			if (!((d->d_name[0] == DATAFL_LETTER ||
2653 			       d->d_name[0] == NORMQF_LETTER ||
2654 			       d->d_name[0] == QUARQF_LETTER ||
2655 			       d->d_name[0] == LOSEQF_LETTER ||
2656 			       d->d_name[0] == XSCRPT_LETTER) &&
2657 			      d->d_name[1] == 'f' && d->d_name[2] == '\0'))
2658 				syserr("gatherq: %s/%s is not a regular file",
2659 				       qid_printqueue(qgrp, qdir), d->d_name);
2660 			wn--;
2661 			continue;
2662 		}
2663 
2664 		/* avoid work if possible */
2665 		if ((QueueSortOrder == QSO_BYFILENAME ||
2666 		     QueueSortOrder == QSO_BYMODTIME ||
2667 		     QueueSortOrder == QSO_NONE ||
2668 		     QueueSortOrder == QSO_RANDOM) &&
2669 		    QueueLimitQuarantine == NULL &&
2670 		    QueueLimitSender == NULL &&
2671 		    QueueLimitRecipient == NULL)
2672 		{
2673 			w->w_qgrp = qgrp;
2674 			w->w_qdir = qdir;
2675 			w->w_name = newstr(d->d_name);
2676 			w->w_host = NULL;
2677 			w->w_lock = w->w_tooyoung = false;
2678 			w->w_pri = 0;
2679 			w->w_ctime = 0;
2680 			w->w_mtime = sbuf.st_mtime;
2681 			++num_ent;
2682 			continue;
2683 		}
2684 
2685 		/* open control file */
2686 		cf = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
2687 				NULL);
2688 		if (cf == NULL && OpMode != MD_PRINT)
2689 		{
2690 			/* this may be some random person sending hir msgs */
2691 			if (tTd(41, 2))
2692 				sm_dprintf("gatherq: cannot open %s: %s\n",
2693 					d->d_name, sm_errstring(errno));
2694 			errno = 0;
2695 			wn--;
2696 			continue;
2697 		}
2698 		w->w_qgrp = qgrp;
2699 		w->w_qdir = qdir;
2700 		w->w_name = newstr(d->d_name);
2701 		w->w_host = NULL;
2702 		if (cf != NULL)
2703 		{
2704 			w->w_lock = !lockfile(sm_io_getinfo(cf, SM_IO_WHAT_FD,
2705 							    NULL),
2706 					      w->w_name, NULL,
2707 					      LOCK_SH|LOCK_NB);
2708 		}
2709 		w->w_tooyoung = false;
2710 
2711 		/* make sure jobs in creation don't clog queue */
2712 		w->w_pri = 0x7fffffff;
2713 		w->w_ctime = 0;
2714 		w->w_mtime = sbuf.st_mtime;
2715 
2716 		/* extract useful information */
2717 		i = NEED_P|NEED_T;
2718 		if (QueueSortOrder == QSO_BYHOST
2719 #if _FFR_RHS
2720 		    || QueueSortOrder == QSO_BYSHUFFLE
2721 #endif /* _FFR_RHS */
2722 		   )
2723 		{
2724 			/* need w_host set for host sort order */
2725 			i |= NEED_H;
2726 		}
2727 		if (QueueLimitSender != NULL)
2728 			i |= NEED_S;
2729 		if (QueueLimitRecipient != NULL)
2730 			i |= NEED_R;
2731 		if (QueueLimitQuarantine != NULL)
2732 			i |= NEED_QUARANTINE;
2733 		while (cf != NULL && i != 0 &&
2734 		       sm_io_fgets(cf, SM_TIME_DEFAULT, lbuf,
2735 				   sizeof(lbuf)) != NULL)
2736 		{
2737 			int c;
2738 			time_t age;
2739 
2740 			p = strchr(lbuf, '\n');
2741 			if (p != NULL)
2742 				*p = '\0';
2743 			else
2744 			{
2745 				/* flush rest of overly long line */
2746 				while ((c = sm_io_getc(cf, SM_TIME_DEFAULT))
2747 				       != SM_IO_EOF && c != '\n')
2748 					continue;
2749 			}
2750 
2751 			switch (lbuf[0])
2752 			{
2753 			  case 'V':
2754 				qfver = atoi(&lbuf[1]);
2755 				break;
2756 
2757 			  case 'P':
2758 				w->w_pri = atol(&lbuf[1]);
2759 				i &= ~NEED_P;
2760 				break;
2761 
2762 			  case 'T':
2763 				w->w_ctime = atol(&lbuf[1]);
2764 				i &= ~NEED_T;
2765 				break;
2766 
2767 			  case 'q':
2768 				if (QueueMode != QM_QUARANTINE &&
2769 				    QueueMode != QM_LOST)
2770 				{
2771 					if (tTd(41, 49))
2772 						sm_dprintf("%s not marked as quarantined but has a 'q' line\n",
2773 							   w->w_name);
2774 					i |= HAS_QUARANTINE;
2775 				}
2776 				else if (QueueMode == QM_QUARANTINE)
2777 				{
2778 					if (QueueLimitQuarantine == NULL)
2779 					{
2780 						i &= ~NEED_QUARANTINE;
2781 						break;
2782 					}
2783 					p = &lbuf[1];
2784 					check = QueueLimitQuarantine;
2785 					while (check != NULL)
2786 					{
2787 						if (strcontainedin(false,
2788 								   check->queue_match,
2789 								   p) !=
2790 						    check->queue_negate)
2791 							break;
2792 						else
2793 							check = check->queue_next;
2794 					}
2795 					if (check != NULL)
2796 						i &= ~NEED_QUARANTINE;
2797 				}
2798 				break;
2799 
2800 			  case 'R':
2801 				if (w->w_host == NULL &&
2802 				    (p = strrchr(&lbuf[1], '@')) != NULL)
2803 				{
2804 #if _FFR_RHS
2805 					if (QueueSortOrder == QSO_BYSHUFFLE)
2806 						w->w_host = newstr(&p[1]);
2807 					else
2808 #endif /* _FFR_RHS */
2809 						w->w_host = strrev(&p[1]);
2810 					makelower(w->w_host);
2811 					i &= ~NEED_H;
2812 				}
2813 				if (QueueLimitRecipient == NULL)
2814 				{
2815 					i &= ~NEED_R;
2816 					break;
2817 				}
2818 				if (qfver > 0)
2819 				{
2820 					p = strchr(&lbuf[1], ':');
2821 					if (p == NULL)
2822 						p = &lbuf[1];
2823 					else
2824 						++p; /* skip over ':' */
2825 				}
2826 				else
2827 					p = &lbuf[1];
2828 				check = QueueLimitRecipient;
2829 				while (check != NULL)
2830 				{
2831 					if (strcontainedin(true,
2832 							   check->queue_match,
2833 							   p) !=
2834 					    check->queue_negate)
2835 						break;
2836 					else
2837 						check = check->queue_next;
2838 				}
2839 				if (check != NULL)
2840 					i &= ~NEED_R;
2841 				break;
2842 
2843 			  case 'S':
2844 				check = QueueLimitSender;
2845 				while (check != NULL)
2846 				{
2847 					if (strcontainedin(true,
2848 							   check->queue_match,
2849 							   &lbuf[1]) !=
2850 					    check->queue_negate)
2851 						break;
2852 					else
2853 						check = check->queue_next;
2854 				}
2855 				if (check != NULL)
2856 					i &= ~NEED_S;
2857 				break;
2858 
2859 			  case 'K':
2860 #if _FFR_EXPDELAY
2861 				if (MaxQueueAge > 0)
2862 				{
2863 					time_t lasttry, delay;
2864 
2865 					lasttry = (time_t) atol(&lbuf[1]);
2866 					delay = MIN(lasttry - w->w_ctime,
2867 						    MaxQueueAge);
2868 					age = curtime() - lasttry;
2869 					if (age < delay)
2870 						w->w_tooyoung = true;
2871 					break;
2872 				}
2873 #endif /* _FFR_EXPDELAY */
2874 
2875 				age = curtime() - (time_t) atol(&lbuf[1]);
2876 				if (age >= 0 && MinQueueAge > 0 &&
2877 				    age < MinQueueAge)
2878 					w->w_tooyoung = true;
2879 				break;
2880 
2881 			  case 'N':
2882 				if (atol(&lbuf[1]) == 0)
2883 					w->w_tooyoung = false;
2884 				break;
2885 			}
2886 		}
2887 		if (cf != NULL)
2888 			(void) sm_io_close(cf, SM_TIME_DEFAULT);
2889 
2890 		if ((!doall && (shouldqueue(w->w_pri, w->w_ctime) ||
2891 		    w->w_tooyoung)) ||
2892 		    bitset(HAS_QUARANTINE, i) ||
2893 		    bitset(NEED_QUARANTINE, i) ||
2894 		    bitset(NEED_R|NEED_S, i))
2895 		{
2896 			/* don't even bother sorting this job in */
2897 			if (tTd(41, 49))
2898 				sm_dprintf("skipping %s (%x)\n", w->w_name, i);
2899 			sm_free(w->w_name); /* XXX */
2900 			if (w->w_host != NULL)
2901 				sm_free(w->w_host); /* XXX */
2902 			wn--;
2903 		}
2904 		else
2905 			++num_ent;
2906 	}
2907 	(void) closedir(f);
2908 	wn++;
2909 
2910 	i = wn - WorkListCount;
2911 	WorkListCount += SM_MIN(num_ent, WorkListSize);
2912 
2913 	if (more != NULL)
2914 		*more = WorkListCount < wn;
2915 
2916 	if (full != NULL)
2917 		*full = (wn >= MaxQueueRun && MaxQueueRun > 0) ||
2918 			(WorkList == NULL && wn > 0);
2919 
2920 	if (pnentries != NULL)
2921 		*pnentries = nentries;
2922 	return i;
2923 }
2924 /*
2925 **  SORTQ -- sort the work list
2926 **
2927 **	First the old WorkQ is cleared away. Then the WorkList is sorted
2928 **	for all items so that important (higher sorting value) items are not
2929 **	trunctated off. Then the most important items are moved from
2930 **	WorkList to WorkQ. The lower count of 'max' or MaxListCount items
2931 **	are moved.
2932 **
2933 **	Parameters:
2934 **		max -- maximum number of items to be placed in WorkQ
2935 **
2936 **	Returns:
2937 **		the number of items in WorkQ
2938 **
2939 **	Side Effects:
2940 **		WorkQ gets released and filled with new work. WorkList
2941 **		gets released. Work items get sorted in order.
2942 */
2943 
2944 static int
2945 sortq(max)
2946 	int max;
2947 {
2948 	register int i;			/* local counter */
2949 	register WORK *w;		/* tmp item pointer */
2950 	int wc = WorkListCount;		/* trim size for WorkQ */
2951 
2952 	if (WorkQ != NULL)
2953 	{
2954 		WORK *nw;
2955 
2956 		/* Clear out old WorkQ. */
2957 		for (w = WorkQ; w != NULL; w = nw)
2958 		{
2959 			nw = w->w_next;
2960 			sm_free(w->w_name); /* XXX */
2961 			if (w->w_host != NULL)
2962 				sm_free(w->w_host); /* XXX */
2963 			sm_free((char *) w); /* XXX */
2964 		}
2965 		WorkQ = NULL;
2966 	}
2967 
2968 	if (WorkList == NULL || wc <= 0)
2969 		return 0;
2970 
2971 	/*
2972 	**  The sort now takes place using all of the items in WorkList.
2973 	**  The list gets trimmed to the most important items after the sort.
2974 	**  If the trim were to happen before the sort then one or more
2975 	**  important items might get truncated off -- not what we want.
2976 	*/
2977 
2978 	if (QueueSortOrder == QSO_BYHOST)
2979 	{
2980 		/*
2981 		**  Sort the work directory for the first time,
2982 		**  based on host name, lock status, and priority.
2983 		*/
2984 
2985 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf1);
2986 
2987 		/*
2988 		**  If one message to host is locked, "lock" all messages
2989 		**  to that host.
2990 		*/
2991 
2992 		i = 0;
2993 		while (i < wc)
2994 		{
2995 			if (!WorkList[i].w_lock)
2996 			{
2997 				i++;
2998 				continue;
2999 			}
3000 			w = &WorkList[i];
3001 			while (++i < wc)
3002 			{
3003 				if (WorkList[i].w_host == NULL &&
3004 				    w->w_host == NULL)
3005 					WorkList[i].w_lock = true;
3006 				else if (WorkList[i].w_host != NULL &&
3007 					 w->w_host != NULL &&
3008 					 sm_strcasecmp(WorkList[i].w_host,
3009 						       w->w_host) == 0)
3010 					WorkList[i].w_lock = true;
3011 				else
3012 					break;
3013 			}
3014 		}
3015 
3016 		/*
3017 		**  Sort the work directory for the second time,
3018 		**  based on lock status, host name, and priority.
3019 		*/
3020 
3021 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf2);
3022 	}
3023 	else if (QueueSortOrder == QSO_BYTIME)
3024 	{
3025 		/*
3026 		**  Simple sort based on submission time only.
3027 		*/
3028 
3029 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf3);
3030 	}
3031 	else if (QueueSortOrder == QSO_BYFILENAME)
3032 	{
3033 		/*
3034 		**  Sort based on queue filename.
3035 		*/
3036 
3037 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf4);
3038 	}
3039 	else if (QueueSortOrder == QSO_RANDOM)
3040 	{
3041 		/*
3042 		**  Sort randomly.  To avoid problems with an instable sort,
3043 		**  use a random index into the queue file name to start
3044 		**  comparison.
3045 		*/
3046 
3047 		randi = get_rand_mod(MAXQFNAME);
3048 		if (randi < 2)
3049 			randi = 3;
3050 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf5);
3051 	}
3052 	else if (QueueSortOrder == QSO_BYMODTIME)
3053 	{
3054 		/*
3055 		**  Simple sort based on modification time of queue file.
3056 		**  This puts the oldest items first.
3057 		*/
3058 
3059 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf6);
3060 	}
3061 #if _FFR_RHS
3062 	else if (QueueSortOrder == QSO_BYSHUFFLE)
3063 	{
3064 		/*
3065 		**  Simple sort based on shuffled host name.
3066 		*/
3067 
3068 		init_shuffle_alphabet();
3069 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf7);
3070 	}
3071 #endif /* _FFR_RHS */
3072 	else if (QueueSortOrder == QSO_BYPRIORITY)
3073 	{
3074 		/*
3075 		**  Simple sort based on queue priority only.
3076 		*/
3077 
3078 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf0);
3079 	}
3080 	/* else don't sort at all */
3081 
3082 	/* Check if the per queue group item limit will be exceeded */
3083 	if (wc > max && max > 0)
3084 		wc = max;
3085 
3086 	/*
3087 	**  Convert the work list into canonical form.
3088 	**	Should be turning it into a list of envelopes here perhaps.
3089 	**  Only take the most important items up to the per queue group
3090 	**  maximum.
3091 	*/
3092 
3093 	for (i = wc; --i >= 0; )
3094 	{
3095 		w = (WORK *) xalloc(sizeof(*w));
3096 		w->w_qgrp = WorkList[i].w_qgrp;
3097 		w->w_qdir = WorkList[i].w_qdir;
3098 		w->w_name = WorkList[i].w_name;
3099 		w->w_host = WorkList[i].w_host;
3100 		w->w_lock = WorkList[i].w_lock;
3101 		w->w_tooyoung = WorkList[i].w_tooyoung;
3102 		w->w_pri = WorkList[i].w_pri;
3103 		w->w_ctime = WorkList[i].w_ctime;
3104 		w->w_mtime = WorkList[i].w_mtime;
3105 		w->w_next = WorkQ;
3106 		WorkQ = w;
3107 	}
3108 
3109 	/* free the rest of the list */
3110 	for (i = WorkListCount; --i >= wc; )
3111 	{
3112 		sm_free(WorkList[i].w_name);
3113 		if (WorkList[i].w_host != NULL)
3114 			sm_free(WorkList[i].w_host);
3115 	}
3116 
3117 	if (WorkList != NULL)
3118 		sm_free(WorkList); /* XXX */
3119 	WorkList = NULL;
3120 	WorkListSize = 0;
3121 	WorkListCount = 0;
3122 
3123 	if (tTd(40, 1))
3124 	{
3125 		for (w = WorkQ; w != NULL; w = w->w_next)
3126 		{
3127 			if (w->w_host != NULL)
3128 				sm_dprintf("%22s: pri=%ld %s\n",
3129 					w->w_name, w->w_pri, w->w_host);
3130 			else
3131 				sm_dprintf("%32s: pri=%ld\n",
3132 					w->w_name, w->w_pri);
3133 		}
3134 	}
3135 
3136 	return wc; /* return number of WorkQ items */
3137 }
3138 /*
3139 **  GROW_WLIST -- make the work list larger
3140 **
3141 **	Parameters:
3142 **		qgrp -- the index for the queue group.
3143 **		qdir -- the index for the queue directory.
3144 **
3145 **	Returns:
3146 **		none.
3147 **
3148 **	Side Effects:
3149 **		Adds another QUEUESEGSIZE entries to WorkList if possible.
3150 **		It can fail if there isn't enough memory, so WorkListSize
3151 **		should be checked again upon return.
3152 */
3153 
3154 static void
3155 grow_wlist(qgrp, qdir)
3156 	int qgrp;
3157 	int qdir;
3158 {
3159 	if (tTd(41, 1))
3160 		sm_dprintf("grow_wlist: WorkListSize=%d\n", WorkListSize);
3161 	if (WorkList == NULL)
3162 	{
3163 		WorkList = (WORK *) xalloc((sizeof(*WorkList)) *
3164 					   (QUEUESEGSIZE + 1));
3165 		WorkListSize = QUEUESEGSIZE;
3166 	}
3167 	else
3168 	{
3169 		int newsize = WorkListSize + QUEUESEGSIZE;
3170 		WORK *newlist = (WORK *) sm_realloc((char *) WorkList,
3171 					  (unsigned) sizeof(WORK) * (newsize + 1));
3172 
3173 		if (newlist != NULL)
3174 		{
3175 			WorkListSize = newsize;
3176 			WorkList = newlist;
3177 			if (LogLevel > 1)
3178 			{
3179 				sm_syslog(LOG_INFO, NOQID,
3180 					  "grew WorkList for %s to %d",
3181 					  qid_printqueue(qgrp, qdir),
3182 					  WorkListSize);
3183 			}
3184 		}
3185 		else if (LogLevel > 0)
3186 		{
3187 			sm_syslog(LOG_ALERT, NOQID,
3188 				  "FAILED to grow WorkList for %s to %d",
3189 				  qid_printqueue(qgrp, qdir), newsize);
3190 		}
3191 	}
3192 	if (tTd(41, 1))
3193 		sm_dprintf("grow_wlist: WorkListSize now %d\n", WorkListSize);
3194 }
3195 /*
3196 **  WORKCMPF0 -- simple priority-only compare function.
3197 **
3198 **	Parameters:
3199 **		a -- the first argument.
3200 **		b -- the second argument.
3201 **
3202 **	Returns:
3203 **		-1 if a < b
3204 **		 0 if a == b
3205 **		+1 if a > b
3206 **
3207 */
3208 
3209 static int
3210 workcmpf0(a, b)
3211 	register WORK *a;
3212 	register WORK *b;
3213 {
3214 	long pa = a->w_pri;
3215 	long pb = b->w_pri;
3216 
3217 	if (pa == pb)
3218 		return 0;
3219 	else if (pa > pb)
3220 		return 1;
3221 	else
3222 		return -1;
3223 }
3224 /*
3225 **  WORKCMPF1 -- first compare function for ordering work based on host name.
3226 **
3227 **	Sorts on host name, lock status, and priority in that order.
3228 **
3229 **	Parameters:
3230 **		a -- the first argument.
3231 **		b -- the second argument.
3232 **
3233 **	Returns:
3234 **		<0 if a < b
3235 **		 0 if a == b
3236 **		>0 if a > b
3237 **
3238 */
3239 
3240 static int
3241 workcmpf1(a, b)
3242 	register WORK *a;
3243 	register WORK *b;
3244 {
3245 	int i;
3246 
3247 	/* host name */
3248 	if (a->w_host != NULL && b->w_host == NULL)
3249 		return 1;
3250 	else if (a->w_host == NULL && b->w_host != NULL)
3251 		return -1;
3252 	if (a->w_host != NULL && b->w_host != NULL &&
3253 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3254 		return i;
3255 
3256 	/* lock status */
3257 	if (a->w_lock != b->w_lock)
3258 		return b->w_lock - a->w_lock;
3259 
3260 	/* job priority */
3261 	return workcmpf0(a, b);
3262 }
3263 /*
3264 **  WORKCMPF2 -- second compare function for ordering work based on host name.
3265 **
3266 **	Sorts on lock status, host name, and priority in that order.
3267 **
3268 **	Parameters:
3269 **		a -- the first argument.
3270 **		b -- the second argument.
3271 **
3272 **	Returns:
3273 **		<0 if a < b
3274 **		 0 if a == b
3275 **		>0 if a > b
3276 **
3277 */
3278 
3279 static int
3280 workcmpf2(a, b)
3281 	register WORK *a;
3282 	register WORK *b;
3283 {
3284 	int i;
3285 
3286 	/* lock status */
3287 	if (a->w_lock != b->w_lock)
3288 		return a->w_lock - b->w_lock;
3289 
3290 	/* host name */
3291 	if (a->w_host != NULL && b->w_host == NULL)
3292 		return 1;
3293 	else if (a->w_host == NULL && b->w_host != NULL)
3294 		return -1;
3295 	if (a->w_host != NULL && b->w_host != NULL &&
3296 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3297 		return i;
3298 
3299 	/* job priority */
3300 	return workcmpf0(a, b);
3301 }
3302 /*
3303 **  WORKCMPF3 -- simple submission-time-only compare function.
3304 **
3305 **	Parameters:
3306 **		a -- the first argument.
3307 **		b -- the second argument.
3308 **
3309 **	Returns:
3310 **		-1 if a < b
3311 **		 0 if a == b
3312 **		+1 if a > b
3313 **
3314 */
3315 
3316 static int
3317 workcmpf3(a, b)
3318 	register WORK *a;
3319 	register WORK *b;
3320 {
3321 	if (a->w_ctime > b->w_ctime)
3322 		return 1;
3323 	else if (a->w_ctime < b->w_ctime)
3324 		return -1;
3325 	else
3326 		return 0;
3327 }
3328 /*
3329 **  WORKCMPF4 -- compare based on file name
3330 **
3331 **	Parameters:
3332 **		a -- the first argument.
3333 **		b -- the second argument.
3334 **
3335 **	Returns:
3336 **		-1 if a < b
3337 **		 0 if a == b
3338 **		+1 if a > b
3339 **
3340 */
3341 
3342 static int
3343 workcmpf4(a, b)
3344 	register WORK *a;
3345 	register WORK *b;
3346 {
3347 	return strcmp(a->w_name, b->w_name);
3348 }
3349 /*
3350 **  WORKCMPF5 -- compare based on assigned random number
3351 **
3352 **	Parameters:
3353 **		a -- the first argument.
3354 **		b -- the second argument.
3355 **
3356 **	Returns:
3357 **		randomly 1/-1
3358 */
3359 
3360 /* ARGSUSED0 */
3361 static int
3362 workcmpf5(a, b)
3363 	register WORK *a;
3364 	register WORK *b;
3365 {
3366 	if (strlen(a->w_name) < randi || strlen(b->w_name) < randi)
3367 		return -1;
3368 	return a->w_name[randi] - b->w_name[randi];
3369 }
3370 /*
3371 **  WORKCMPF6 -- simple modification-time-only compare function.
3372 **
3373 **	Parameters:
3374 **		a -- the first argument.
3375 **		b -- the second argument.
3376 **
3377 **	Returns:
3378 **		-1 if a < b
3379 **		 0 if a == b
3380 **		+1 if a > b
3381 **
3382 */
3383 
3384 static int
3385 workcmpf6(a, b)
3386 	register WORK *a;
3387 	register WORK *b;
3388 {
3389 	if (a->w_mtime > b->w_mtime)
3390 		return 1;
3391 	else if (a->w_mtime < b->w_mtime)
3392 		return -1;
3393 	else
3394 		return 0;
3395 }
3396 #if _FFR_RHS
3397 /*
3398 **  WORKCMPF7 -- compare function for ordering work based on shuffled host name.
3399 **
3400 **	Sorts on lock status, host name, and priority in that order.
3401 **
3402 **	Parameters:
3403 **		a -- the first argument.
3404 **		b -- the second argument.
3405 **
3406 **	Returns:
3407 **		<0 if a < b
3408 **		 0 if a == b
3409 **		>0 if a > b
3410 **
3411 */
3412 
3413 static int
3414 workcmpf7(a, b)
3415 	register WORK *a;
3416 	register WORK *b;
3417 {
3418 	int i;
3419 
3420 	/* lock status */
3421 	if (a->w_lock != b->w_lock)
3422 		return a->w_lock - b->w_lock;
3423 
3424 	/* host name */
3425 	if (a->w_host != NULL && b->w_host == NULL)
3426 		return 1;
3427 	else if (a->w_host == NULL && b->w_host != NULL)
3428 		return -1;
3429 	if (a->w_host != NULL && b->w_host != NULL &&
3430 	    (i = sm_strshufflecmp(a->w_host, b->w_host)) != 0)
3431 		return i;
3432 
3433 	/* job priority */
3434 	return workcmpf0(a, b);
3435 }
3436 #endif /* _FFR_RHS */
3437 /*
3438 **  STRREV -- reverse string
3439 **
3440 **	Returns a pointer to a new string that is the reverse of
3441 **	the string pointed to by fwd.  The space for the new
3442 **	string is obtained using xalloc().
3443 **
3444 **	Parameters:
3445 **		fwd -- the string to reverse.
3446 **
3447 **	Returns:
3448 **		the reversed string.
3449 */
3450 
3451 static char *
3452 strrev(fwd)
3453 	char *fwd;
3454 {
3455 	char *rev = NULL;
3456 	int len, cnt;
3457 
3458 	len = strlen(fwd);
3459 	rev = xalloc(len + 1);
3460 	for (cnt = 0; cnt < len; ++cnt)
3461 		rev[cnt] = fwd[len - cnt - 1];
3462 	rev[len] = '\0';
3463 	return rev;
3464 }
3465 
3466 #if _FFR_RHS
3467 
3468 # define NASCII	128
3469 # define NCHAR	256
3470 
3471 static unsigned char ShuffledAlphabet[NCHAR];
3472 
3473 void
3474 init_shuffle_alphabet()
3475 {
3476 	static bool init = false;
3477 	int i;
3478 
3479 	if (init)
3480 		return;
3481 
3482 	/* fill the ShuffledAlphabet */
3483 	for (i = 0; i < NASCII; i++)
3484 		ShuffledAlphabet[i] = i;
3485 
3486 	/* mix it */
3487 	for (i = 1; i < NASCII; i++)
3488 	{
3489 		register int j = get_random() % NASCII;
3490 		register int tmp;
3491 
3492 		tmp = ShuffledAlphabet[j];
3493 		ShuffledAlphabet[j] = ShuffledAlphabet[i];
3494 		ShuffledAlphabet[i] = tmp;
3495 	}
3496 
3497 	/* make it case insensitive */
3498 	for (i = 'A'; i <= 'Z'; i++)
3499 		ShuffledAlphabet[i] = ShuffledAlphabet[i + 'a' - 'A'];
3500 
3501 	/* fill the upper part */
3502 	for (i = 0; i < NASCII; i++)
3503 		ShuffledAlphabet[i + NASCII] = ShuffledAlphabet[i];
3504 	init = true;
3505 }
3506 
3507 static int
3508 sm_strshufflecmp(a, b)
3509 	char *a;
3510 	char *b;
3511 {
3512 	const unsigned char *us1 = (const unsigned char *) a;
3513 	const unsigned char *us2 = (const unsigned char *) b;
3514 
3515 	while (ShuffledAlphabet[*us1] == ShuffledAlphabet[*us2++])
3516 	{
3517 		if (*us1++ == '\0')
3518 			return 0;
3519 	}
3520 	return (ShuffledAlphabet[*us1] - ShuffledAlphabet[*--us2]);
3521 }
3522 #endif /* _FFR_RHS */
3523 
3524 /*
3525 **  DOWORK -- do a work request.
3526 **
3527 **	Parameters:
3528 **		qgrp -- the index of the queue group for the job.
3529 **		qdir -- the index of the queue directory for the job.
3530 **		id -- the ID of the job to run.
3531 **		forkflag -- if set, run this in background.
3532 **		requeueflag -- if set, reinstantiate the queue quickly.
3533 **			This is used when expanding aliases in the queue.
3534 **			If forkflag is also set, it doesn't wait for the
3535 **			child.
3536 **		e - the envelope in which to run it.
3537 **
3538 **	Returns:
3539 **		process id of process that is running the queue job.
3540 **
3541 **	Side Effects:
3542 **		The work request is satisfied if possible.
3543 */
3544 
3545 pid_t
3546 dowork(qgrp, qdir, id, forkflag, requeueflag, e)
3547 	int qgrp;
3548 	int qdir;
3549 	char *id;
3550 	bool forkflag;
3551 	bool requeueflag;
3552 	register ENVELOPE *e;
3553 {
3554 	register pid_t pid;
3555 	SM_RPOOL_T *rpool;
3556 
3557 	if (tTd(40, 1))
3558 		sm_dprintf("dowork(%s/%s)\n", qid_printqueue(qgrp, qdir), id);
3559 
3560 	/*
3561 	**  Fork for work.
3562 	*/
3563 
3564 	if (forkflag)
3565 	{
3566 		/*
3567 		**  Since the delivery may happen in a child and the
3568 		**  parent does not wait, the parent may close the
3569 		**  maps thereby removing any shared memory used by
3570 		**  the map.  Therefore, close the maps now so the
3571 		**  child will dynamically open them if necessary.
3572 		*/
3573 
3574 		closemaps(false);
3575 
3576 		pid = fork();
3577 		if (pid < 0)
3578 		{
3579 			syserr("dowork: cannot fork");
3580 			return 0;
3581 		}
3582 		else if (pid > 0)
3583 		{
3584 			/* parent -- clean out connection cache */
3585 			mci_flush(false, NULL);
3586 		}
3587 		else
3588 		{
3589 			/*
3590 			**  Initialize exception stack and default exception
3591 			**  handler for child process.
3592 			*/
3593 
3594 			/* Reset global flags */
3595 			RestartRequest = NULL;
3596 			RestartWorkGroup = false;
3597 			ShutdownRequest = NULL;
3598 			PendingSignal = 0;
3599 			CurrentPid = getpid();
3600 			sm_exc_newthread(fatal_error);
3601 
3602 			/*
3603 			**  See note above about SMTP processes and SIGCHLD.
3604 			*/
3605 
3606 			if (OpMode == MD_SMTP ||
3607 			    OpMode == MD_DAEMON ||
3608 			    MaxQueueChildren > 0)
3609 			{
3610 				proc_list_clear();
3611 				sm_releasesignal(SIGCHLD);
3612 				(void) sm_signal(SIGCHLD, SIG_DFL);
3613 			}
3614 
3615 			/* child -- error messages to the transcript */
3616 			QuickAbort = OnlyOneError = false;
3617 		}
3618 	}
3619 	else
3620 	{
3621 		pid = 0;
3622 	}
3623 
3624 	if (pid == 0)
3625 	{
3626 		/*
3627 		**  CHILD
3628 		**	Lock the control file to avoid duplicate deliveries.
3629 		**		Then run the file as though we had just read it.
3630 		**	We save an idea of the temporary name so we
3631 		**		can recover on interrupt.
3632 		*/
3633 
3634 		if (forkflag)
3635 		{
3636 			/* Reset global flags */
3637 			RestartRequest = NULL;
3638 			RestartWorkGroup = false;
3639 			ShutdownRequest = NULL;
3640 			PendingSignal = 0;
3641 		}
3642 
3643 		/* set basic modes, etc. */
3644 		sm_clear_events();
3645 		clearstats();
3646 		rpool = sm_rpool_new_x(NULL);
3647 		clearenvelope(e, false, rpool);
3648 		e->e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3649 		set_delivery_mode(SM_DELIVER, e);
3650 		e->e_errormode = EM_MAIL;
3651 		e->e_id = id;
3652 		e->e_qgrp = qgrp;
3653 		e->e_qdir = qdir;
3654 		GrabTo = UseErrorsTo = false;
3655 		ExitStat = EX_OK;
3656 		if (forkflag)
3657 		{
3658 			disconnect(1, e);
3659 			set_op_mode(MD_QUEUERUN);
3660 		}
3661 		sm_setproctitle(true, e, "%s from queue", qid_printname(e));
3662 		if (LogLevel > 76)
3663 			sm_syslog(LOG_DEBUG, e->e_id, "dowork, pid=%d",
3664 				  (int) CurrentPid);
3665 
3666 		/* don't use the headers from sendmail.cf... */
3667 		e->e_header = NULL;
3668 
3669 		/* read the queue control file -- return if locked */
3670 		if (!readqf(e, false))
3671 		{
3672 			if (tTd(40, 4) && e->e_id != NULL)
3673 				sm_dprintf("readqf(%s) failed\n",
3674 					qid_printname(e));
3675 			e->e_id = NULL;
3676 			if (forkflag)
3677 				finis(false, true, EX_OK);
3678 			else
3679 			{
3680 				/* adding this frees 8 bytes */
3681 				clearenvelope(e, false, rpool);
3682 
3683 				/* adding this frees 12 bytes */
3684 				sm_rpool_free(rpool);
3685 				e->e_rpool = NULL;
3686 				return 0;
3687 			}
3688 		}
3689 
3690 		e->e_flags |= EF_INQUEUE;
3691 		eatheader(e, requeueflag, true);
3692 
3693 		if (requeueflag)
3694 			queueup(e, false, false);
3695 
3696 		/* do the delivery */
3697 		sendall(e, SM_DELIVER);
3698 
3699 		/* finish up and exit */
3700 		if (forkflag)
3701 			finis(true, true, ExitStat);
3702 		else
3703 		{
3704 			(void) dropenvelope(e, true, false);
3705 			sm_rpool_free(rpool);
3706 			e->e_rpool = NULL;
3707 		}
3708 	}
3709 	e->e_id = NULL;
3710 	return pid;
3711 }
3712 
3713 /*
3714 **  DOWORKLIST -- process a list of envelopes as work requests
3715 **
3716 **	Similar to dowork(), except that after forking, it processes an
3717 **	envelope and its siblings, treating each envelope as a work request.
3718 **
3719 **	Parameters:
3720 **		el -- envelope to be processed including its siblings.
3721 **		forkflag -- if set, run this in background.
3722 **		requeueflag -- if set, reinstantiate the queue quickly.
3723 **			This is used when expanding aliases in the queue.
3724 **			If forkflag is also set, it doesn't wait for the
3725 **			child.
3726 **
3727 **	Returns:
3728 **		process id of process that is running the queue job.
3729 **
3730 **	Side Effects:
3731 **		The work request is satisfied if possible.
3732 */
3733 
3734 pid_t
3735 doworklist(el, forkflag, requeueflag)
3736 	ENVELOPE *el;
3737 	bool forkflag;
3738 	bool requeueflag;
3739 {
3740 	register pid_t pid;
3741 	ENVELOPE *ei;
3742 
3743 	if (tTd(40, 1))
3744 		sm_dprintf("doworklist()\n");
3745 
3746 	/*
3747 	**  Fork for work.
3748 	*/
3749 
3750 	if (forkflag)
3751 	{
3752 		/*
3753 		**  Since the delivery may happen in a child and the
3754 		**  parent does not wait, the parent may close the
3755 		**  maps thereby removing any shared memory used by
3756 		**  the map.  Therefore, close the maps now so the
3757 		**  child will dynamically open them if necessary.
3758 		*/
3759 
3760 		closemaps(false);
3761 
3762 		pid = fork();
3763 		if (pid < 0)
3764 		{
3765 			syserr("doworklist: cannot fork");
3766 			return 0;
3767 		}
3768 		else if (pid > 0)
3769 		{
3770 			/* parent -- clean out connection cache */
3771 			mci_flush(false, NULL);
3772 		}
3773 		else
3774 		{
3775 			/*
3776 			**  Initialize exception stack and default exception
3777 			**  handler for child process.
3778 			*/
3779 
3780 			/* Reset global flags */
3781 			RestartRequest = NULL;
3782 			RestartWorkGroup = false;
3783 			ShutdownRequest = NULL;
3784 			PendingSignal = 0;
3785 			CurrentPid = getpid();
3786 			sm_exc_newthread(fatal_error);
3787 
3788 			/*
3789 			**  See note above about SMTP processes and SIGCHLD.
3790 			*/
3791 
3792 			if (OpMode == MD_SMTP ||
3793 			    OpMode == MD_DAEMON ||
3794 			    MaxQueueChildren > 0)
3795 			{
3796 				proc_list_clear();
3797 				sm_releasesignal(SIGCHLD);
3798 				(void) sm_signal(SIGCHLD, SIG_DFL);
3799 			}
3800 
3801 			/* child -- error messages to the transcript */
3802 			QuickAbort = OnlyOneError = false;
3803 		}
3804 	}
3805 	else
3806 	{
3807 		pid = 0;
3808 	}
3809 
3810 	if (pid != 0)
3811 		return pid;
3812 
3813 	/*
3814 	**  IN CHILD
3815 	**	Lock the control file to avoid duplicate deliveries.
3816 	**		Then run the file as though we had just read it.
3817 	**	We save an idea of the temporary name so we
3818 	**		can recover on interrupt.
3819 	*/
3820 
3821 	if (forkflag)
3822 	{
3823 		/* Reset global flags */
3824 		RestartRequest = NULL;
3825 		RestartWorkGroup = false;
3826 		ShutdownRequest = NULL;
3827 		PendingSignal = 0;
3828 	}
3829 
3830 	/* set basic modes, etc. */
3831 	sm_clear_events();
3832 	clearstats();
3833 	GrabTo = UseErrorsTo = false;
3834 	ExitStat = EX_OK;
3835 	if (forkflag)
3836 	{
3837 		disconnect(1, el);
3838 		set_op_mode(MD_QUEUERUN);
3839 	}
3840 	if (LogLevel > 76)
3841 		sm_syslog(LOG_DEBUG, el->e_id, "doworklist, pid=%d",
3842 			  (int) CurrentPid);
3843 
3844 	for (ei = el; ei != NULL; ei = ei->e_sibling)
3845 	{
3846 		ENVELOPE e;
3847 		SM_RPOOL_T *rpool;
3848 
3849 		if (WILL_BE_QUEUED(ei->e_sendmode))
3850 			continue;
3851 		else if (QueueMode != QM_QUARANTINE &&
3852 			 ei->e_quarmsg != NULL)
3853 			continue;
3854 
3855 		rpool = sm_rpool_new_x(NULL);
3856 		clearenvelope(&e, true, rpool);
3857 		e.e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3858 		set_delivery_mode(SM_DELIVER, &e);
3859 		e.e_errormode = EM_MAIL;
3860 		e.e_id = ei->e_id;
3861 		e.e_qgrp = ei->e_qgrp;
3862 		e.e_qdir = ei->e_qdir;
3863 		openxscript(&e);
3864 		sm_setproctitle(true, &e, "%s from queue", qid_printname(&e));
3865 
3866 		/* don't use the headers from sendmail.cf... */
3867 		e.e_header = NULL;
3868 		CurEnv = &e;
3869 
3870 		/* read the queue control file -- return if locked */
3871 		if (readqf(&e, false))
3872 		{
3873 			e.e_flags |= EF_INQUEUE;
3874 			eatheader(&e, requeueflag, true);
3875 
3876 			if (requeueflag)
3877 				queueup(&e, false, false);
3878 
3879 			/* do the delivery */
3880 			sendall(&e, SM_DELIVER);
3881 			(void) dropenvelope(&e, true, false);
3882 		}
3883 		else
3884 		{
3885 			if (tTd(40, 4) && e.e_id != NULL)
3886 				sm_dprintf("readqf(%s) failed\n",
3887 					qid_printname(&e));
3888 		}
3889 		sm_rpool_free(rpool);
3890 		ei->e_id = NULL;
3891 	}
3892 
3893 	/* restore CurEnv */
3894 	CurEnv = el;
3895 
3896 	/* finish up and exit */
3897 	if (forkflag)
3898 		finis(true, true, ExitStat);
3899 	return 0;
3900 }
3901 /*
3902 **  READQF -- read queue file and set up environment.
3903 **
3904 **	Parameters:
3905 **		e -- the envelope of the job to run.
3906 **		openonly -- only open the qf (returned as e_lockfp)
3907 **
3908 **	Returns:
3909 **		true if it successfully read the queue file.
3910 **		false otherwise.
3911 **
3912 **	Side Effects:
3913 **		The queue file is returned locked.
3914 */
3915 
3916 static bool
3917 readqf(e, openonly)
3918 	register ENVELOPE *e;
3919 	bool openonly;
3920 {
3921 	register SM_FILE_T *qfp;
3922 	ADDRESS *ctladdr;
3923 	struct stat st, stf;
3924 	char *bp;
3925 	int qfver = 0;
3926 	long hdrsize = 0;
3927 	register char *p;
3928 	char *frcpt = NULL;
3929 	char *orcpt = NULL;
3930 	bool nomore = false;
3931 	bool bogus = false;
3932 	MODE_T qsafe;
3933 	char *err;
3934 	char qf[MAXPATHLEN];
3935 	char buf[MAXLINE];
3936 	int bufsize;
3937 
3938 	/*
3939 	**  Read and process the file.
3940 	*/
3941 
3942 	SM_REQUIRE(e != NULL);
3943 	bp = NULL;
3944 	(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER), sizeof(qf));
3945 	qfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDWR_B, NULL);
3946 	if (qfp == NULL)
3947 	{
3948 		int save_errno = errno;
3949 
3950 		if (tTd(40, 8))
3951 			sm_dprintf("readqf(%s): sm_io_open failure (%s)\n",
3952 				qf, sm_errstring(errno));
3953 		errno = save_errno;
3954 		if (errno != ENOENT
3955 		    )
3956 			syserr("readqf: no control file %s", qf);
3957 		RELEASE_QUEUE;
3958 		return false;
3959 	}
3960 
3961 	if (!lockfile(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), qf, NULL,
3962 		      LOCK_EX|LOCK_NB))
3963 	{
3964 		/* being processed by another queuer */
3965 		if (Verbose)
3966 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3967 					     "%s: locked\n", e->e_id);
3968 		if (tTd(40, 8))
3969 			sm_dprintf("%s: locked\n", e->e_id);
3970 		if (LogLevel > 19)
3971 			sm_syslog(LOG_DEBUG, e->e_id, "locked");
3972 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3973 		RELEASE_QUEUE;
3974 		return false;
3975 	}
3976 
3977 	RELEASE_QUEUE;
3978 
3979 	/*
3980 	**  Prevent locking race condition.
3981 	**
3982 	**  Process A: readqf(): qfp = fopen(qffile)
3983 	**  Process B: queueup(): rename(tf, qf)
3984 	**  Process B: unlocks(tf)
3985 	**  Process A: lockfile(qf);
3986 	**
3987 	**  Process A (us) has the old qf file (before the rename deleted
3988 	**  the directory entry) and will be delivering based on old data.
3989 	**  This can lead to multiple deliveries of the same recipients.
3990 	**
3991 	**  Catch this by checking if the underlying qf file has changed
3992 	**  *after* acquiring our lock and if so, act as though the file
3993 	**  was still locked (i.e., just return like the lockfile() case
3994 	**  above.
3995 	*/
3996 
3997 	if (stat(qf, &stf) < 0 ||
3998 	    fstat(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), &st) < 0)
3999 	{
4000 		/* must have been being processed by someone else */
4001 		if (tTd(40, 8))
4002 			sm_dprintf("readqf(%s): [f]stat failure (%s)\n",
4003 				qf, sm_errstring(errno));
4004 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4005 		return false;
4006 	}
4007 
4008 	if (st.st_nlink != stf.st_nlink ||
4009 	    st.st_dev != stf.st_dev ||
4010 	    ST_INODE(st) != ST_INODE(stf) ||
4011 #if HAS_ST_GEN && 0		/* AFS returns garbage in st_gen */
4012 	    st.st_gen != stf.st_gen ||
4013 #endif /* HAS_ST_GEN && 0 */
4014 	    st.st_uid != stf.st_uid ||
4015 	    st.st_gid != stf.st_gid ||
4016 	    st.st_size != stf.st_size)
4017 	{
4018 		/* changed after opened */
4019 		if (Verbose)
4020 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4021 					     "%s: changed\n", e->e_id);
4022 		if (tTd(40, 8))
4023 			sm_dprintf("%s: changed\n", e->e_id);
4024 		if (LogLevel > 19)
4025 			sm_syslog(LOG_DEBUG, e->e_id, "changed");
4026 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4027 		return false;
4028 	}
4029 
4030 	/*
4031 	**  Check the queue file for plausibility to avoid attacks.
4032 	*/
4033 
4034 	qsafe = S_IWOTH|S_IWGRP;
4035 	if (bitset(S_IWGRP, QueueFileMode))
4036 		qsafe &= ~S_IWGRP;
4037 
4038 	bogus = st.st_uid != geteuid() &&
4039 		st.st_uid != TrustedUid &&
4040 		geteuid() != RealUid;
4041 
4042 	/*
4043 	**  If this qf file results from a set-group-ID binary, then
4044 	**  we check whether the directory is group-writable,
4045 	**  the queue file mode contains the group-writable bit, and
4046 	**  the groups are the same.
4047 	**  Notice: this requires that the set-group-ID binary is used to
4048 	**  run the queue!
4049 	*/
4050 
4051 	if (bogus && st.st_gid == getegid() && UseMSP)
4052 	{
4053 		char delim;
4054 		struct stat dst;
4055 
4056 		bp = SM_LAST_DIR_DELIM(qf);
4057 		if (bp == NULL)
4058 			delim = '\0';
4059 		else
4060 		{
4061 			delim = *bp;
4062 			*bp = '\0';
4063 		}
4064 		if (stat(delim == '\0' ? "." : qf, &dst) < 0)
4065 			syserr("readqf: cannot stat directory %s",
4066 				delim == '\0' ? "." : qf);
4067 		else
4068 		{
4069 			bogus = !(bitset(S_IWGRP, QueueFileMode) &&
4070 				  bitset(S_IWGRP, dst.st_mode) &&
4071 				  dst.st_gid == st.st_gid);
4072 		}
4073 		if (delim != '\0')
4074 			*bp = delim;
4075 		bp = NULL;
4076 	}
4077 	if (!bogus)
4078 		bogus = bitset(qsafe, st.st_mode);
4079 	if (bogus)
4080 	{
4081 		if (LogLevel > 0)
4082 		{
4083 			sm_syslog(LOG_ALERT, e->e_id,
4084 				  "bogus queue file, uid=%d, gid=%d, mode=%o",
4085 				  st.st_uid, st.st_gid, st.st_mode);
4086 		}
4087 		if (tTd(40, 8))
4088 			sm_dprintf("readqf(%s): bogus file\n", qf);
4089 		e->e_flags |= EF_INQUEUE;
4090 		if (!openonly)
4091 			loseqfile(e, "bogus file uid/gid in mqueue");
4092 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4093 		return false;
4094 	}
4095 
4096 	if (st.st_size == 0)
4097 	{
4098 		/* must be a bogus file -- if also old, just remove it */
4099 		if (!openonly && st.st_ctime + 10 * 60 < curtime())
4100 		{
4101 			(void) xunlink(queuename(e, DATAFL_LETTER));
4102 			(void) xunlink(queuename(e, ANYQFL_LETTER));
4103 		}
4104 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4105 		return false;
4106 	}
4107 
4108 	if (st.st_nlink == 0)
4109 	{
4110 		/*
4111 		**  Race condition -- we got a file just as it was being
4112 		**  unlinked.  Just assume it is zero length.
4113 		*/
4114 
4115 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4116 		return false;
4117 	}
4118 
4119 #if _FFR_TRUSTED_QF
4120 	/*
4121 	**  If we don't own the file mark it as unsafe.
4122 	**  However, allow TrustedUser to own it as well
4123 	**  in case TrustedUser manipulates the queue.
4124 	*/
4125 
4126 	if (st.st_uid != geteuid() && st.st_uid != TrustedUid)
4127 		e->e_flags |= EF_UNSAFE;
4128 #else /* _FFR_TRUSTED_QF */
4129 	/* If we don't own the file mark it as unsafe */
4130 	if (st.st_uid != geteuid())
4131 		e->e_flags |= EF_UNSAFE;
4132 #endif /* _FFR_TRUSTED_QF */
4133 
4134 	/* good file -- save this lock */
4135 	e->e_lockfp = qfp;
4136 
4137 	/* Just wanted the open file */
4138 	if (openonly)
4139 		return true;
4140 
4141 	/* do basic system initialization */
4142 	initsys(e);
4143 	macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
4144 
4145 	LineNumber = 0;
4146 	e->e_flags |= EF_GLOBALERRS;
4147 	set_op_mode(MD_QUEUERUN);
4148 	ctladdr = NULL;
4149 	e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
4150 	e->e_dfqgrp = e->e_qgrp;
4151 	e->e_dfqdir = e->e_qdir;
4152 #if _FFR_QUEUE_MACRO
4153 	macdefine(&e->e_macro, A_TEMP, macid("{queue}"),
4154 		  qid_printqueue(e->e_qgrp, e->e_qdir));
4155 #endif /* _FFR_QUEUE_MACRO */
4156 	e->e_dfino = -1;
4157 	e->e_msgsize = -1;
4158 	while (bufsize = sizeof(buf),
4159 	       (bp = fgetfolded(buf, &bufsize, qfp)) != NULL)
4160 	{
4161 		unsigned long qflags;
4162 		ADDRESS *q;
4163 		int r;
4164 		time_t now;
4165 		auto char *ep;
4166 
4167 		if (tTd(40, 4))
4168 			sm_dprintf("+++++ %s\n", bp);
4169 		if (nomore)
4170 		{
4171 			/* hack attack */
4172   hackattack:
4173 			syserr("SECURITY ALERT: extra or bogus data in queue file: %s",
4174 			       bp);
4175 			err = "bogus queue line";
4176 			goto fail;
4177 		}
4178 		switch (bp[0])
4179 		{
4180 		  case 'A':		/* AUTH= parameter */
4181 			if (!xtextok(&bp[1]))
4182 				goto hackattack;
4183 			e->e_auth_param = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4184 			break;
4185 
4186 		  case 'B':		/* body type */
4187 			r = check_bodytype(&bp[1]);
4188 			if (!BODYTYPE_VALID(r))
4189 				goto hackattack;
4190 			e->e_bodytype = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4191 			break;
4192 
4193 		  case 'C':		/* specify controlling user */
4194 			ctladdr = setctluser(&bp[1], qfver, e);
4195 			break;
4196 
4197 		  case 'D':		/* data file name */
4198 			/* obsolete -- ignore */
4199 			break;
4200 
4201 		  case 'd':		/* data file directory name */
4202 			{
4203 				int qgrp, qdir;
4204 
4205 #if _FFR_MSP_PARANOIA
4206 				/* forbid queue groups in MSP? */
4207 				if (UseMSP)
4208 					goto hackattack;
4209 #endif /* _FFR_MSP_PARANOIA */
4210 				for (qgrp = 0;
4211 				     qgrp < NumQueue && Queue[qgrp] != NULL;
4212 				     ++qgrp)
4213 				{
4214 					for (qdir = 0;
4215 					     qdir < Queue[qgrp]->qg_numqueues;
4216 					     ++qdir)
4217 					{
4218 						if (strcmp(&bp[1],
4219 							   Queue[qgrp]->qg_qpaths[qdir].qp_name)
4220 						    == 0)
4221 						{
4222 							e->e_dfqgrp = qgrp;
4223 							e->e_dfqdir = qdir;
4224 							goto done;
4225 						}
4226 					}
4227 				}
4228 				err = "bogus queue file directory";
4229 				goto fail;
4230 			  done:
4231 				break;
4232 			}
4233 
4234 		  case 'E':		/* specify error recipient */
4235 			/* no longer used */
4236 			break;
4237 
4238 		  case 'F':		/* flag bits */
4239 			if (strncmp(bp, "From ", 5) == 0)
4240 			{
4241 				/* we are being spoofed! */
4242 				syserr("SECURITY ALERT: bogus qf line %s", bp);
4243 				err = "bogus queue line";
4244 				goto fail;
4245 			}
4246 			for (p = &bp[1]; *p != '\0'; p++)
4247 			{
4248 				switch (*p)
4249 				{
4250 				  case '8':	/* has 8 bit data */
4251 					e->e_flags |= EF_HAS8BIT;
4252 					break;
4253 
4254 				  case 'b':	/* delete Bcc: header */
4255 					e->e_flags |= EF_DELETE_BCC;
4256 					break;
4257 
4258 				  case 'd':	/* envelope has DSN RET= */
4259 					e->e_flags |= EF_RET_PARAM;
4260 					break;
4261 
4262 				  case 'n':	/* don't return body */
4263 					e->e_flags |= EF_NO_BODY_RETN;
4264 					break;
4265 
4266 				  case 'r':	/* response */
4267 					e->e_flags |= EF_RESPONSE;
4268 					break;
4269 
4270 				  case 's':	/* split */
4271 					e->e_flags |= EF_SPLIT;
4272 					break;
4273 
4274 				  case 'w':	/* warning sent */
4275 					e->e_flags |= EF_WARNING;
4276 					break;
4277 				}
4278 			}
4279 			break;
4280 
4281 		  case 'q':		/* quarantine reason */
4282 			e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4283 			macdefine(&e->e_macro, A_PERM,
4284 				  macid("{quarantine}"), e->e_quarmsg);
4285 			break;
4286 
4287 		  case 'H':		/* header */
4288 
4289 			/*
4290 			**  count size before chompheader() destroys the line.
4291 			**  this isn't accurate due to macro expansion, but
4292 			**  better than before. "-3" to skip H?? at least.
4293 			*/
4294 
4295 			hdrsize += strlen(bp) - 3;
4296 			(void) chompheader(&bp[1], CHHDR_QUEUE, NULL, e);
4297 			break;
4298 
4299 		  case 'I':		/* data file's inode number */
4300 			/* regenerated below */
4301 			break;
4302 
4303 		  case 'K':		/* time of last delivery attempt */
4304 			e->e_dtime = atol(&buf[1]);
4305 			break;
4306 
4307 		  case 'L':		/* Solaris Content-Length: */
4308 		  case 'M':		/* message */
4309 			/* ignore this; we want a new message next time */
4310 			break;
4311 
4312 		  case 'N':		/* number of delivery attempts */
4313 			e->e_ntries = atoi(&buf[1]);
4314 
4315 			/* if this has been tried recently, let it be */
4316 			now = curtime();
4317 			if (e->e_ntries > 0 && e->e_dtime <= now &&
4318 			    now < e->e_dtime + MinQueueAge)
4319 			{
4320 				char *howlong;
4321 
4322 				howlong = pintvl(now - e->e_dtime, true);
4323 				if (Verbose)
4324 					(void) sm_io_fprintf(smioout,
4325 							     SM_TIME_DEFAULT,
4326 							     "%s: too young (%s)\n",
4327 							     e->e_id, howlong);
4328 				if (tTd(40, 8))
4329 					sm_dprintf("%s: too young (%s)\n",
4330 						e->e_id, howlong);
4331 				if (LogLevel > 19)
4332 					sm_syslog(LOG_DEBUG, e->e_id,
4333 						  "too young (%s)",
4334 						  howlong);
4335 				e->e_id = NULL;
4336 				unlockqueue(e);
4337 				if (bp != buf)
4338 					sm_free(bp);
4339 				return false;
4340 			}
4341 			macdefine(&e->e_macro, A_TEMP,
4342 				macid("{ntries}"), &buf[1]);
4343 
4344 #if NAMED_BIND
4345 			/* adjust BIND parameters immediately */
4346 			if (e->e_ntries == 0)
4347 			{
4348 				_res.retry = TimeOuts.res_retry[RES_TO_FIRST];
4349 				_res.retrans = TimeOuts.res_retrans[RES_TO_FIRST];
4350 			}
4351 			else
4352 			{
4353 				_res.retry = TimeOuts.res_retry[RES_TO_NORMAL];
4354 				_res.retrans = TimeOuts.res_retrans[RES_TO_NORMAL];
4355 			}
4356 #endif /* NAMED_BIND */
4357 			break;
4358 
4359 		  case 'P':		/* message priority */
4360 			e->e_msgpriority = atol(&bp[1]) + WkTimeFact;
4361 			break;
4362 
4363 		  case 'Q':		/* original recipient */
4364 			orcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4365 			break;
4366 
4367 		  case 'r':		/* final recipient */
4368 			frcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4369 			break;
4370 
4371 		  case 'R':		/* specify recipient */
4372 			p = bp;
4373 			qflags = 0;
4374 			if (qfver >= 1)
4375 			{
4376 				/* get flag bits */
4377 				while (*++p != '\0' && *p != ':')
4378 				{
4379 					switch (*p)
4380 					{
4381 					  case 'N':
4382 						qflags |= QHASNOTIFY;
4383 						break;
4384 
4385 					  case 'S':
4386 						qflags |= QPINGONSUCCESS;
4387 						break;
4388 
4389 					  case 'F':
4390 						qflags |= QPINGONFAILURE;
4391 						break;
4392 
4393 					  case 'D':
4394 						qflags |= QPINGONDELAY;
4395 						break;
4396 
4397 					  case 'P':
4398 						qflags |= QPRIMARY;
4399 						break;
4400 
4401 					  case 'A':
4402 						if (ctladdr != NULL)
4403 							ctladdr->q_flags |= QALIAS;
4404 						break;
4405 
4406 					  default: /* ignore or complain? */
4407 						break;
4408 					}
4409 				}
4410 			}
4411 			else
4412 				qflags |= QPRIMARY;
4413 			macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4414 				"e r");
4415 			if (*p != '\0')
4416 				q = parseaddr(++p, NULLADDR, RF_COPYALL, '\0',
4417 						NULL, e, true);
4418 			else
4419 				q = NULL;
4420 			if (q != NULL)
4421 			{
4422 				/* make sure we keep the current qgrp */
4423 				if (ISVALIDQGRP(e->e_qgrp))
4424 					q->q_qgrp = e->e_qgrp;
4425 				q->q_alias = ctladdr;
4426 				if (qfver >= 1)
4427 					q->q_flags &= ~Q_PINGFLAGS;
4428 				q->q_flags |= qflags;
4429 				q->q_finalrcpt = frcpt;
4430 				q->q_orcpt = orcpt;
4431 				(void) recipient(q, &e->e_sendqueue, 0, e);
4432 			}
4433 			frcpt = NULL;
4434 			orcpt = NULL;
4435 			macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4436 				NULL);
4437 			break;
4438 
4439 		  case 'S':		/* sender */
4440 			setsender(sm_rpool_strdup_x(e->e_rpool, &bp[1]),
4441 				  e, NULL, '\0', true);
4442 			break;
4443 
4444 		  case 'T':		/* init time */
4445 			e->e_ctime = atol(&bp[1]);
4446 			break;
4447 
4448 		  case 'V':		/* queue file version number */
4449 			qfver = atoi(&bp[1]);
4450 			if (qfver <= QF_VERSION)
4451 				break;
4452 			syserr("Version number in queue file (%d) greater than max (%d)",
4453 				qfver, QF_VERSION);
4454 			err = "unsupported queue file version";
4455 			goto fail;
4456 			/* NOTREACHED */
4457 			break;
4458 
4459 		  case 'Z':		/* original envelope id from ESMTP */
4460 			e->e_envid = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4461 			macdefine(&e->e_macro, A_PERM,
4462 				macid("{dsn_envid}"), e->e_envid);
4463 			break;
4464 
4465 		  case '!':		/* deliver by */
4466 
4467 			/* format: flag (1 char) space long-integer */
4468 			e->e_dlvr_flag = buf[1];
4469 			e->e_deliver_by = strtol(&buf[3], NULL, 10);
4470 
4471 		  case '$':		/* define macro */
4472 			{
4473 				char *p;
4474 
4475 				/* XXX elimate p? */
4476 				r = macid_parse(&bp[1], &ep);
4477 				if (r == 0)
4478 					break;
4479 				p = sm_rpool_strdup_x(e->e_rpool, ep);
4480 				macdefine(&e->e_macro, A_PERM, r, p);
4481 			}
4482 			break;
4483 
4484 		  case '.':		/* terminate file */
4485 			nomore = true;
4486 			break;
4487 
4488 #if _FFR_QUEUEDELAY
4489 		  case 'G':
4490 		  case 'Y':
4491 
4492 			/*
4493 			**  Maintain backward compatibility for
4494 			**  users who defined _FFR_QUEUEDELAY in
4495 			**  previous releases.  Remove this
4496 			**  code in 8.14 or 8.15.
4497 			*/
4498 
4499 			if (qfver == 5 || qfver == 7)
4500 				break;
4501 
4502 			/* If not qfver 5 or 7, then 'G' or 'Y' is invalid */
4503 			/* FALLTHROUGH */
4504 #endif /* _FFR_QUEUEDELAY */
4505 
4506 		  default:
4507 			syserr("readqf: %s: line %d: bad line \"%s\"",
4508 				qf, LineNumber, shortenstring(bp, MAXSHORTSTR));
4509 			err = "unrecognized line";
4510 			goto fail;
4511 		}
4512 
4513 		if (bp != buf)
4514 			SM_FREE(bp);
4515 	}
4516 
4517 	/*
4518 	**  If we haven't read any lines, this queue file is empty.
4519 	**  Arrange to remove it without referencing any null pointers.
4520 	*/
4521 
4522 	if (LineNumber == 0)
4523 	{
4524 		errno = 0;
4525 		e->e_flags |= EF_CLRQUEUE|EF_FATALERRS|EF_RESPONSE;
4526 		return true;
4527 	}
4528 
4529 	/* Check to make sure we have a complete queue file read */
4530 	if (!nomore)
4531 	{
4532 		syserr("readqf: %s: incomplete queue file read", qf);
4533 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4534 		return false;
4535 	}
4536 
4537 #if _FFR_QF_PARANOIA
4538 	/* Check to make sure key fields were read */
4539 	if (e->e_from.q_mailer == NULL)
4540 	{
4541 		syserr("readqf: %s: sender not specified in queue file", qf);
4542 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4543 		return false;
4544 	}
4545 	/* other checks? */
4546 #endif /* _FFR_QF_PARANOIA */
4547 
4548 	/* possibly set ${dsn_ret} macro */
4549 	if (bitset(EF_RET_PARAM, e->e_flags))
4550 	{
4551 		if (bitset(EF_NO_BODY_RETN, e->e_flags))
4552 			macdefine(&e->e_macro, A_PERM,
4553 				macid("{dsn_ret}"), "hdrs");
4554 		else
4555 			macdefine(&e->e_macro, A_PERM,
4556 				macid("{dsn_ret}"), "full");
4557 	}
4558 
4559 	/*
4560 	**  Arrange to read the data file.
4561 	*/
4562 
4563 	p = queuename(e, DATAFL_LETTER);
4564 	e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, p, SM_IO_RDONLY_B,
4565 			      NULL);
4566 	if (e->e_dfp == NULL)
4567 	{
4568 		syserr("readqf: cannot open %s", p);
4569 	}
4570 	else
4571 	{
4572 		e->e_flags |= EF_HAS_DF;
4573 		if (fstat(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD, NULL), &st)
4574 		    >= 0)
4575 		{
4576 			e->e_msgsize = st.st_size + hdrsize;
4577 			e->e_dfdev = st.st_dev;
4578 			e->e_dfino = ST_INODE(st);
4579 			(void) sm_snprintf(buf, sizeof(buf), "%ld",
4580 					   e->e_msgsize);
4581 			macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"),
4582 				  buf);
4583 		}
4584 	}
4585 
4586 	return true;
4587 
4588   fail:
4589 	/*
4590 	**  There was some error reading the qf file (reason is in err var.)
4591 	**  Cleanup:
4592 	**	close file; clear e_lockfp since it is the same as qfp,
4593 	**	hence it is invalid (as file) after qfp is closed;
4594 	**	the qf file is on disk, so set the flag to avoid calling
4595 	**	queueup() with bogus data.
4596 	*/
4597 
4598 	if (bp != buf)
4599 		SM_FREE(bp);
4600 	if (qfp != NULL)
4601 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4602 	e->e_lockfp = NULL;
4603 	e->e_flags |= EF_INQUEUE;
4604 	loseqfile(e, err);
4605 	return false;
4606 }
4607 /*
4608 **  PRTSTR -- print a string, "unprintable" characters are shown as \oct
4609 **
4610 **	Parameters:
4611 **		s -- string to print
4612 **		ml -- maximum length of output
4613 **
4614 **	Returns:
4615 **		number of entries
4616 **
4617 **	Side Effects:
4618 **		Prints a string on stdout.
4619 */
4620 
4621 static void prtstr __P((char *, int));
4622 
4623 static void
4624 prtstr(s, ml)
4625 	char *s;
4626 	int ml;
4627 {
4628 	int c;
4629 
4630 	if (s == NULL)
4631 		return;
4632 	while (ml-- > 0 && ((c = *s++) != '\0'))
4633 	{
4634 		if (c == '\\')
4635 		{
4636 			if (ml-- > 0)
4637 			{
4638 				(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4639 				(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4640 			}
4641 		}
4642 		else if (isascii(c) && isprint(c))
4643 			(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4644 		else
4645 		{
4646 			if ((ml -= 3) > 0)
4647 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4648 						     "\\%03o", c & 0xFF);
4649 		}
4650 	}
4651 }
4652 /*
4653 **  PRINTNQE -- print out number of entries in the mail queue
4654 **
4655 **	Parameters:
4656 **		out -- output file pointer.
4657 **		prefix -- string to output in front of each line.
4658 **
4659 **	Returns:
4660 **		none.
4661 */
4662 
4663 void
4664 printnqe(out, prefix)
4665 	SM_FILE_T *out;
4666 	char *prefix;
4667 {
4668 #if SM_CONF_SHM
4669 	int i, k = 0, nrequests = 0;
4670 	bool unknown = false;
4671 
4672 	if (ShmId == SM_SHM_NO_ID)
4673 	{
4674 		if (prefix == NULL)
4675 			(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4676 					"Data unavailable: shared memory not updated\n");
4677 		else
4678 			(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4679 					"%sNOTCONFIGURED:-1\r\n", prefix);
4680 		return;
4681 	}
4682 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4683 	{
4684 		int j;
4685 
4686 		k++;
4687 		for (j = 0; j < Queue[i]->qg_numqueues; j++)
4688 		{
4689 			int n;
4690 
4691 			if (StopRequest)
4692 				stop_sendmail();
4693 
4694 			n = QSHM_ENTRIES(Queue[i]->qg_qpaths[j].qp_idx);
4695 			if (prefix != NULL)
4696 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4697 					"%s%s:%d\r\n",
4698 					prefix, qid_printqueue(i, j), n);
4699 			else if (n < 0)
4700 			{
4701 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4702 					"%s: unknown number of entries\n",
4703 					qid_printqueue(i, j));
4704 				unknown = true;
4705 			}
4706 			else if (n == 0)
4707 			{
4708 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4709 					"%s is empty\n",
4710 					qid_printqueue(i, j));
4711 			}
4712 			else if (n > 0)
4713 			{
4714 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4715 					"%s: entries=%d\n",
4716 					qid_printqueue(i, j), n);
4717 				nrequests += n;
4718 				k++;
4719 			}
4720 		}
4721 	}
4722 	if (prefix == NULL && k > 1)
4723 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4724 				     "\t\tTotal requests: %d%s\n",
4725 				     nrequests, unknown ? " (about)" : "");
4726 #else /* SM_CONF_SHM */
4727 	if (prefix == NULL)
4728 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4729 			     "Data unavailable without shared memory support\n");
4730 	else
4731 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4732 			     "%sNOTAVAILABLE:-1\r\n", prefix);
4733 #endif /* SM_CONF_SHM */
4734 }
4735 /*
4736 **  PRINTQUEUE -- print out a representation of the mail queue
4737 **
4738 **	Parameters:
4739 **		none.
4740 **
4741 **	Returns:
4742 **		none.
4743 **
4744 **	Side Effects:
4745 **		Prints a listing of the mail queue on the standard output.
4746 */
4747 
4748 void
4749 printqueue()
4750 {
4751 	int i, k = 0, nrequests = 0;
4752 
4753 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4754 	{
4755 		int j;
4756 
4757 		k++;
4758 		for (j = 0; j < Queue[i]->qg_numqueues; j++)
4759 		{
4760 			if (StopRequest)
4761 				stop_sendmail();
4762 			nrequests += print_single_queue(i, j);
4763 			k++;
4764 		}
4765 	}
4766 	if (k > 1)
4767 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4768 				     "\t\tTotal requests: %d\n",
4769 				     nrequests);
4770 }
4771 /*
4772 **  PRINT_SINGLE_QUEUE -- print out a representation of a single mail queue
4773 **
4774 **	Parameters:
4775 **		qgrp -- the index of the queue group.
4776 **		qdir -- the queue directory.
4777 **
4778 **	Returns:
4779 **		number of requests in mail queue.
4780 **
4781 **	Side Effects:
4782 **		Prints a listing of the mail queue on the standard output.
4783 */
4784 
4785 int
4786 print_single_queue(qgrp, qdir)
4787 	int qgrp;
4788 	int qdir;
4789 {
4790 	register WORK *w;
4791 	SM_FILE_T *f;
4792 	int nrequests;
4793 	char qd[MAXPATHLEN];
4794 	char qddf[MAXPATHLEN];
4795 	char buf[MAXLINE];
4796 
4797 	if (qdir == NOQDIR)
4798 	{
4799 		(void) sm_strlcpy(qd, ".", sizeof(qd));
4800 		(void) sm_strlcpy(qddf, ".", sizeof(qddf));
4801 	}
4802 	else
4803 	{
4804 		(void) sm_strlcpyn(qd, sizeof(qd), 2,
4805 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
4806 			(bitset(QP_SUBQF,
4807 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4808 					? "/qf" : ""));
4809 		(void) sm_strlcpyn(qddf, sizeof(qddf), 2,
4810 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
4811 			(bitset(QP_SUBDF,
4812 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4813 					? "/df" : ""));
4814 	}
4815 
4816 	/*
4817 	**  Check for permission to print the queue
4818 	*/
4819 
4820 	if (bitset(PRIV_RESTRICTMAILQ, PrivacyFlags) && RealUid != 0)
4821 	{
4822 		struct stat st;
4823 #ifdef NGROUPS_MAX
4824 		int n;
4825 		extern GIDSET_T InitialGidSet[NGROUPS_MAX];
4826 #endif /* NGROUPS_MAX */
4827 
4828 		if (stat(qd, &st) < 0)
4829 		{
4830 			syserr("Cannot stat %s",
4831 				qid_printqueue(qgrp, qdir));
4832 			return 0;
4833 		}
4834 #ifdef NGROUPS_MAX
4835 		n = NGROUPS_MAX;
4836 		while (--n >= 0)
4837 		{
4838 			if (InitialGidSet[n] == st.st_gid)
4839 				break;
4840 		}
4841 		if (n < 0 && RealGid != st.st_gid)
4842 #else /* NGROUPS_MAX */
4843 		if (RealGid != st.st_gid)
4844 #endif /* NGROUPS_MAX */
4845 		{
4846 			usrerr("510 You are not permitted to see the queue");
4847 			setstat(EX_NOPERM);
4848 			return 0;
4849 		}
4850 	}
4851 
4852 	/*
4853 	**  Read and order the queue.
4854 	*/
4855 
4856 	nrequests = gatherq(qgrp, qdir, true, NULL, NULL, NULL);
4857 	(void) sortq(Queue[qgrp]->qg_maxlist);
4858 
4859 	/*
4860 	**  Print the work list that we have read.
4861 	*/
4862 
4863 	/* first see if there is anything */
4864 	if (nrequests <= 0)
4865 	{
4866 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%s is empty\n",
4867 				     qid_printqueue(qgrp, qdir));
4868 		return 0;
4869 	}
4870 
4871 	sm_getla();	/* get load average */
4872 
4873 	(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\t\t%s (%d request%s",
4874 			     qid_printqueue(qgrp, qdir),
4875 			     nrequests, nrequests == 1 ? "" : "s");
4876 	if (MaxQueueRun > 0 && nrequests > MaxQueueRun)
4877 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4878 				     ", only %d printed", MaxQueueRun);
4879 	if (Verbose)
4880 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4881 			")\n-----Q-ID----- --Size-- -Priority- ---Q-Time--- --------Sender/Recipient--------\n");
4882 	else
4883 		(void) sm_io_fprintf(smioout,  SM_TIME_DEFAULT,
4884 			")\n-----Q-ID----- --Size-- -----Q-Time----- ------------Sender/Recipient-----------\n");
4885 	for (w = WorkQ; w != NULL; w = w->w_next)
4886 	{
4887 		struct stat st;
4888 		auto time_t submittime = 0;
4889 		long dfsize;
4890 		int flags = 0;
4891 		int qfver;
4892 		char quarmsg[MAXLINE];
4893 		char statmsg[MAXLINE];
4894 		char bodytype[MAXNAME + 1];
4895 		char qf[MAXPATHLEN];
4896 
4897 		if (StopRequest)
4898 			stop_sendmail();
4899 
4900 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%13s",
4901 				     w->w_name + 2);
4902 		(void) sm_strlcpyn(qf, sizeof(qf), 3, qd, "/", w->w_name);
4903 		f = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
4904 			       NULL);
4905 		if (f == NULL)
4906 		{
4907 			if (errno == EPERM)
4908 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4909 						     " (permission denied)\n");
4910 			else if (errno == ENOENT)
4911 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4912 						     " (job completed)\n");
4913 			else
4914 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4915 						     " (%s)\n",
4916 						     sm_errstring(errno));
4917 			errno = 0;
4918 			continue;
4919 		}
4920 		w->w_name[0] = DATAFL_LETTER;
4921 		(void) sm_strlcpyn(qf, sizeof(qf), 3, qddf, "/", w->w_name);
4922 		if (stat(qf, &st) >= 0)
4923 			dfsize = st.st_size;
4924 		else
4925 		{
4926 			ENVELOPE e;
4927 
4928 			/*
4929 			**  Maybe the df file can't be statted because
4930 			**  it is in a different directory than the qf file.
4931 			**  In order to find out, we must read the qf file.
4932 			*/
4933 
4934 			newenvelope(&e, &BlankEnvelope, sm_rpool_new_x(NULL));
4935 			e.e_id = w->w_name + 2;
4936 			e.e_qgrp = qgrp;
4937 			e.e_qdir = qdir;
4938 			dfsize = -1;
4939 			if (readqf(&e, false))
4940 			{
4941 				char *df = queuename(&e, DATAFL_LETTER);
4942 				if (stat(df, &st) >= 0)
4943 					dfsize = st.st_size;
4944 			}
4945 			if (e.e_lockfp != NULL)
4946 			{
4947 				(void) sm_io_close(e.e_lockfp, SM_TIME_DEFAULT);
4948 				e.e_lockfp = NULL;
4949 			}
4950 			clearenvelope(&e, false, e.e_rpool);
4951 			sm_rpool_free(e.e_rpool);
4952 		}
4953 		if (w->w_lock)
4954 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "*");
4955 		else if (QueueMode == QM_LOST)
4956 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "?");
4957 		else if (w->w_tooyoung)
4958 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "-");
4959 		else if (shouldqueue(w->w_pri, w->w_ctime))
4960 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "X");
4961 		else
4962 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, " ");
4963 
4964 		errno = 0;
4965 
4966 		quarmsg[0] = '\0';
4967 		statmsg[0] = bodytype[0] = '\0';
4968 		qfver = 0;
4969 		while (sm_io_fgets(f, SM_TIME_DEFAULT, buf, sizeof(buf)) != NULL)
4970 		{
4971 			register int i;
4972 			register char *p;
4973 
4974 			if (StopRequest)
4975 				stop_sendmail();
4976 
4977 			fixcrlf(buf, true);
4978 			switch (buf[0])
4979 			{
4980 			  case 'V':	/* queue file version */
4981 				qfver = atoi(&buf[1]);
4982 				break;
4983 
4984 			  case 'M':	/* error message */
4985 				if ((i = strlen(&buf[1])) >= sizeof(statmsg))
4986 					i = sizeof(statmsg) - 1;
4987 				memmove(statmsg, &buf[1], i);
4988 				statmsg[i] = '\0';
4989 				break;
4990 
4991 			  case 'q':	/* quarantine reason */
4992 				if ((i = strlen(&buf[1])) >= sizeof(quarmsg))
4993 					i = sizeof(quarmsg) - 1;
4994 				memmove(quarmsg, &buf[1], i);
4995 				quarmsg[i] = '\0';
4996 				break;
4997 
4998 			  case 'B':	/* body type */
4999 				if ((i = strlen(&buf[1])) >= sizeof(bodytype))
5000 					i = sizeof(bodytype) - 1;
5001 				memmove(bodytype, &buf[1], i);
5002 				bodytype[i] = '\0';
5003 				break;
5004 
5005 			  case 'S':	/* sender name */
5006 				if (Verbose)
5007 				{
5008 					(void) sm_io_fprintf(smioout,
5009 						SM_TIME_DEFAULT,
5010 						"%8ld %10ld%c%.12s ",
5011 						dfsize,
5012 						w->w_pri,
5013 						bitset(EF_WARNING, flags)
5014 							? '+' : ' ',
5015 						ctime(&submittime) + 4);
5016 					prtstr(&buf[1], 78);
5017 				}
5018 				else
5019 				{
5020 					(void) sm_io_fprintf(smioout,
5021 						SM_TIME_DEFAULT,
5022 						"%8ld %.16s ",
5023 						dfsize,
5024 						ctime(&submittime));
5025 					prtstr(&buf[1], 39);
5026 				}
5027 
5028 				if (quarmsg[0] != '\0')
5029 				{
5030 					(void) sm_io_fprintf(smioout,
5031 							     SM_TIME_DEFAULT,
5032 							     "\n     QUARANTINE: %.*s",
5033 							     Verbose ? 100 : 60,
5034 							     quarmsg);
5035 					quarmsg[0] = '\0';
5036 				}
5037 
5038 				if (statmsg[0] != '\0' || bodytype[0] != '\0')
5039 				{
5040 					(void) sm_io_fprintf(smioout,
5041 						SM_TIME_DEFAULT,
5042 						"\n    %10.10s",
5043 						bodytype);
5044 					if (statmsg[0] != '\0')
5045 						(void) sm_io_fprintf(smioout,
5046 							SM_TIME_DEFAULT,
5047 							"   (%.*s)",
5048 							Verbose ? 100 : 60,
5049 							statmsg);
5050 					statmsg[0] = '\0';
5051 				}
5052 				break;
5053 
5054 			  case 'C':	/* controlling user */
5055 				if (Verbose)
5056 					(void) sm_io_fprintf(smioout,
5057 						SM_TIME_DEFAULT,
5058 						"\n\t\t\t\t\t\t(---%.64s---)",
5059 						&buf[1]);
5060 				break;
5061 
5062 			  case 'R':	/* recipient name */
5063 				p = &buf[1];
5064 				if (qfver >= 1)
5065 				{
5066 					p = strchr(p, ':');
5067 					if (p == NULL)
5068 						break;
5069 					p++;
5070 				}
5071 				if (Verbose)
5072 				{
5073 					(void) sm_io_fprintf(smioout,
5074 							SM_TIME_DEFAULT,
5075 							"\n\t\t\t\t\t\t");
5076 					prtstr(p, 71);
5077 				}
5078 				else
5079 				{
5080 					(void) sm_io_fprintf(smioout,
5081 							SM_TIME_DEFAULT,
5082 							"\n\t\t\t\t\t ");
5083 					prtstr(p, 38);
5084 				}
5085 				if (Verbose && statmsg[0] != '\0')
5086 				{
5087 					(void) sm_io_fprintf(smioout,
5088 							SM_TIME_DEFAULT,
5089 							"\n\t\t (%.100s)",
5090 							statmsg);
5091 					statmsg[0] = '\0';
5092 				}
5093 				break;
5094 
5095 			  case 'T':	/* creation time */
5096 				submittime = atol(&buf[1]);
5097 				break;
5098 
5099 			  case 'F':	/* flag bits */
5100 				for (p = &buf[1]; *p != '\0'; p++)
5101 				{
5102 					switch (*p)
5103 					{
5104 					  case 'w':
5105 						flags |= EF_WARNING;
5106 						break;
5107 					}
5108 				}
5109 			}
5110 		}
5111 		if (submittime == (time_t) 0)
5112 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
5113 					     " (no control file)");
5114 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\n");
5115 		(void) sm_io_close(f, SM_TIME_DEFAULT);
5116 	}
5117 	return nrequests;
5118 }
5119 
5120 /*
5121 **  QUEUE_LETTER -- get the proper queue letter for the current QueueMode.
5122 **
5123 **	Parameters:
5124 **		e -- envelope to build it in/from.
5125 **		type -- the file type, used as the first character
5126 **			of the file name.
5127 **
5128 **	Returns:
5129 **		the letter to use
5130 */
5131 
5132 static char
5133 queue_letter(e, type)
5134 	ENVELOPE *e;
5135 	int type;
5136 {
5137 	/* Change type according to QueueMode */
5138 	if (type == ANYQFL_LETTER)
5139 	{
5140 		if (e->e_quarmsg != NULL)
5141 			type = QUARQF_LETTER;
5142 		else
5143 		{
5144 			switch (QueueMode)
5145 			{
5146 			  case QM_NORMAL:
5147 				type = NORMQF_LETTER;
5148 				break;
5149 
5150 			  case QM_QUARANTINE:
5151 				type = QUARQF_LETTER;
5152 				break;
5153 
5154 			  case QM_LOST:
5155 				type = LOSEQF_LETTER;
5156 				break;
5157 
5158 			  default:
5159 				/* should never happen */
5160 				abort();
5161 				/* NOTREACHED */
5162 			}
5163 		}
5164 	}
5165 	return type;
5166 }
5167 
5168 /*
5169 **  QUEUENAME -- build a file name in the queue directory for this envelope.
5170 **
5171 **	Parameters:
5172 **		e -- envelope to build it in/from.
5173 **		type -- the file type, used as the first character
5174 **			of the file name.
5175 **
5176 **	Returns:
5177 **		a pointer to the queue name (in a static buffer).
5178 **
5179 **	Side Effects:
5180 **		If no id code is already assigned, queuename() will
5181 **		assign an id code with assign_queueid().  If no queue
5182 **		directory is assigned, one will be set with setnewqueue().
5183 */
5184 
5185 char *
5186 queuename(e, type)
5187 	register ENVELOPE *e;
5188 	int type;
5189 {
5190 	int qd, qg;
5191 	char *sub = "/";
5192 	char pref[3];
5193 	static char buf[MAXPATHLEN];
5194 
5195 	/* Assign an ID if needed */
5196 	if (e->e_id == NULL)
5197 	{
5198 		if (IntSig)
5199 			return NULL;
5200 		assign_queueid(e);
5201 	}
5202 	type = queue_letter(e, type);
5203 
5204 	/* begin of filename */
5205 	pref[0] = (char) type;
5206 	pref[1] = 'f';
5207 	pref[2] = '\0';
5208 
5209 	/* Assign a queue group/directory if needed */
5210 	if (type == XSCRPT_LETTER)
5211 	{
5212 		/*
5213 		**  We don't want to call setnewqueue() if we are fetching
5214 		**  the pathname of the transcript file, because setnewqueue
5215 		**  chooses a queue, and sometimes we need to write to the
5216 		**  transcript file before we have gathered enough information
5217 		**  to choose a queue.
5218 		*/
5219 
5220 		if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5221 		{
5222 			if (e->e_qgrp != NOQGRP && e->e_qdir != NOQDIR)
5223 			{
5224 				e->e_xfqgrp = e->e_qgrp;
5225 				e->e_xfqdir = e->e_qdir;
5226 			}
5227 			else
5228 			{
5229 				e->e_xfqgrp = 0;
5230 				if (Queue[e->e_xfqgrp]->qg_numqueues <= 1)
5231 					e->e_xfqdir = 0;
5232 				else
5233 				{
5234 					e->e_xfqdir = get_rand_mod(
5235 					      Queue[e->e_xfqgrp]->qg_numqueues);
5236 				}
5237 			}
5238 		}
5239 		qd = e->e_xfqdir;
5240 		qg = e->e_xfqgrp;
5241 	}
5242 	else
5243 	{
5244 		if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
5245 		{
5246 			if (IntSig)
5247 				return NULL;
5248 			(void) setnewqueue(e);
5249 		}
5250 		if (type ==  DATAFL_LETTER)
5251 		{
5252 			qd = e->e_dfqdir;
5253 			qg = e->e_dfqgrp;
5254 		}
5255 		else
5256 		{
5257 			qd = e->e_qdir;
5258 			qg = e->e_qgrp;
5259 		}
5260 	}
5261 
5262 	/* xf files always have a valid qd and qg picked above */
5263 	if ((qd == NOQDIR || qg == NOQGRP) && type != XSCRPT_LETTER)
5264 		(void) sm_strlcpyn(buf, sizeof(buf), 2, pref, e->e_id);
5265 	else
5266 	{
5267 		switch (type)
5268 		{
5269 		  case DATAFL_LETTER:
5270 			if (bitset(QP_SUBDF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5271 				sub = "/df/";
5272 			break;
5273 
5274 		  case QUARQF_LETTER:
5275 		  case TEMPQF_LETTER:
5276 		  case NEWQFL_LETTER:
5277 		  case LOSEQF_LETTER:
5278 		  case NORMQF_LETTER:
5279 			if (bitset(QP_SUBQF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5280 				sub = "/qf/";
5281 			break;
5282 
5283 		  case XSCRPT_LETTER:
5284 			if (bitset(QP_SUBXF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5285 				sub = "/xf/";
5286 			break;
5287 
5288 		  default:
5289 			if (IntSig)
5290 				return NULL;
5291 			sm_abort("queuename: bad queue file type %d", type);
5292 		}
5293 
5294 		(void) sm_strlcpyn(buf, sizeof(buf), 4,
5295 				Queue[qg]->qg_qpaths[qd].qp_name,
5296 				sub, pref, e->e_id);
5297 	}
5298 
5299 	if (tTd(7, 2))
5300 		sm_dprintf("queuename: %s\n", buf);
5301 	return buf;
5302 }
5303 
5304 /*
5305 **  INIT_QID_ALG -- Initialize the (static) parameters that are used to
5306 **	generate a queue ID.
5307 **
5308 **	This function is called by the daemon to reset
5309 **	LastQueueTime and LastQueuePid which are used by assign_queueid().
5310 **	Otherwise the algorithm may cause problems because
5311 **	LastQueueTime and LastQueuePid are set indirectly by main()
5312 **	before the daemon process is started, hence LastQueuePid is not
5313 **	the pid of the daemon and therefore a child of the daemon can
5314 **	actually have the same pid as LastQueuePid which means the section
5315 **	in  assign_queueid():
5316 **	* see if we need to get a new base time/pid *
5317 **	is NOT triggered which will cause the same queue id to be generated.
5318 **
5319 **	Parameters:
5320 **		none
5321 **
5322 **	Returns:
5323 **		none.
5324 */
5325 
5326 void
5327 init_qid_alg()
5328 {
5329 	LastQueueTime = 0;
5330 	LastQueuePid = -1;
5331 }
5332 
5333 /*
5334 **  ASSIGN_QUEUEID -- assign a queue ID for this envelope.
5335 **
5336 **	Assigns an id code if one does not already exist.
5337 **	This code assumes that nothing will remain in the queue for
5338 **	longer than 60 years.  It is critical that files with the given
5339 **	name do not already exist in the queue.
5340 **	[No longer initializes e_qdir to NOQDIR.]
5341 **
5342 **	Parameters:
5343 **		e -- envelope to set it in.
5344 **
5345 **	Returns:
5346 **		none.
5347 */
5348 
5349 static const char QueueIdChars[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
5350 # define QIC_LEN	60
5351 # define QIC_LEN_R	62
5352 
5353 /*
5354 **  Note: the length is "officially" 60 because minutes and seconds are
5355 **	usually only 0-59.  However (Linux):
5356 **       tm_sec The number of seconds after the minute, normally in
5357 **		the range 0 to 59, but can be up to 61 to allow for
5358 **		leap seconds.
5359 **	Hence the real length of the string is 62 to take this into account.
5360 **	Alternatively % QIC_LEN can (should) be used for access everywhere.
5361 */
5362 
5363 # define queuenextid() CurrentPid
5364 #define QIC_LEN_SQR	(QIC_LEN * QIC_LEN)
5365 
5366 void
5367 assign_queueid(e)
5368 	register ENVELOPE *e;
5369 {
5370 	pid_t pid = queuenextid();
5371 	static unsigned int cX = 0;
5372 	static unsigned int random_offset;
5373 	struct tm *tm;
5374 	char idbuf[MAXQFNAME - 2];
5375 	unsigned int seq;
5376 
5377 	if (e->e_id != NULL)
5378 		return;
5379 
5380 	/* see if we need to get a new base time/pid */
5381 	if (cX >= QIC_LEN_SQR || LastQueueTime == 0 || LastQueuePid != pid)
5382 	{
5383 		time_t then = LastQueueTime;
5384 
5385 		/* if the first time through, pick a random offset */
5386 		if (LastQueueTime == 0)
5387 			random_offset = ((unsigned int)get_random())
5388 					% QIC_LEN_SQR;
5389 
5390 		while ((LastQueueTime = curtime()) == then &&
5391 		       LastQueuePid == pid)
5392 		{
5393 			(void) sleep(1);
5394 		}
5395 		LastQueuePid = queuenextid();
5396 		cX = 0;
5397 	}
5398 
5399 	/*
5400 	**  Generate a new sequence number between 0 and QIC_LEN_SQR-1.
5401 	**  This lets us generate up to QIC_LEN_SQR unique queue ids
5402 	**  per second, per process.  With envelope splitting,
5403 	**  a single message can consume many queue ids.
5404 	*/
5405 
5406 	seq = (cX + random_offset) % QIC_LEN_SQR;
5407 	++cX;
5408 	if (tTd(7, 50))
5409 		sm_dprintf("assign_queueid: random_offset=%u (%u)\n",
5410 			random_offset, seq);
5411 
5412 	tm = gmtime(&LastQueueTime);
5413 	idbuf[0] = QueueIdChars[tm->tm_year % QIC_LEN];
5414 	idbuf[1] = QueueIdChars[tm->tm_mon];
5415 	idbuf[2] = QueueIdChars[tm->tm_mday];
5416 	idbuf[3] = QueueIdChars[tm->tm_hour];
5417 	idbuf[4] = QueueIdChars[tm->tm_min % QIC_LEN_R];
5418 	idbuf[5] = QueueIdChars[tm->tm_sec % QIC_LEN_R];
5419 	idbuf[6] = QueueIdChars[seq / QIC_LEN];
5420 	idbuf[7] = QueueIdChars[seq % QIC_LEN];
5421 	(void) sm_snprintf(&idbuf[8], sizeof(idbuf) - 8, "%06d",
5422 			   (int) LastQueuePid);
5423 	e->e_id = sm_rpool_strdup_x(e->e_rpool, idbuf);
5424 	macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
5425 #if 0
5426 	/* XXX: inherited from MainEnvelope */
5427 	e->e_qgrp = NOQGRP;  /* too early to do anything else */
5428 	e->e_qdir = NOQDIR;
5429 	e->e_xfqgrp = NOQGRP;
5430 #endif /* 0 */
5431 
5432 	/* New ID means it's not on disk yet */
5433 	e->e_qfletter = '\0';
5434 
5435 	if (tTd(7, 1))
5436 		sm_dprintf("assign_queueid: assigned id %s, e=%p\n",
5437 			e->e_id, e);
5438 	if (LogLevel > 93)
5439 		sm_syslog(LOG_DEBUG, e->e_id, "assigned id");
5440 }
5441 /*
5442 **  SYNC_QUEUE_TIME -- Assure exclusive PID in any given second
5443 **
5444 **	Make sure one PID can't be used by two processes in any one second.
5445 **
5446 **		If the system rotates PIDs fast enough, may get the
5447 **		same pid in the same second for two distinct processes.
5448 **		This will interfere with the queue file naming system.
5449 **
5450 **	Parameters:
5451 **		none
5452 **
5453 **	Returns:
5454 **		none
5455 */
5456 
5457 void
5458 sync_queue_time()
5459 {
5460 #if FAST_PID_RECYCLE
5461 	if (OpMode != MD_TEST &&
5462 	    OpMode != MD_CHECKCONFIG &&
5463 	    OpMode != MD_VERIFY &&
5464 	    LastQueueTime > 0 &&
5465 	    LastQueuePid == CurrentPid &&
5466 	    curtime() == LastQueueTime)
5467 		(void) sleep(1);
5468 #endif /* FAST_PID_RECYCLE */
5469 }
5470 /*
5471 **  UNLOCKQUEUE -- unlock the queue entry for a specified envelope
5472 **
5473 **	Parameters:
5474 **		e -- the envelope to unlock.
5475 **
5476 **	Returns:
5477 **		none
5478 **
5479 **	Side Effects:
5480 **		unlocks the queue for `e'.
5481 */
5482 
5483 void
5484 unlockqueue(e)
5485 	ENVELOPE *e;
5486 {
5487 	if (tTd(51, 4))
5488 		sm_dprintf("unlockqueue(%s)\n",
5489 			e->e_id == NULL ? "NOQUEUE" : e->e_id);
5490 
5491 
5492 	/* if there is a lock file in the envelope, close it */
5493 	if (e->e_lockfp != NULL)
5494 		(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
5495 	e->e_lockfp = NULL;
5496 
5497 	/* don't create a queue id if we don't already have one */
5498 	if (e->e_id == NULL)
5499 		return;
5500 
5501 	/* remove the transcript */
5502 	if (LogLevel > 87)
5503 		sm_syslog(LOG_DEBUG, e->e_id, "unlock");
5504 	if (!tTd(51, 104))
5505 		(void) xunlink(queuename(e, XSCRPT_LETTER));
5506 }
5507 /*
5508 **  SETCTLUSER -- create a controlling address
5509 **
5510 **	Create a fake "address" given only a local login name; this is
5511 **	used as a "controlling user" for future recipient addresses.
5512 **
5513 **	Parameters:
5514 **		user -- the user name of the controlling user.
5515 **		qfver -- the version stamp of this queue file.
5516 **		e -- envelope
5517 **
5518 **	Returns:
5519 **		An address descriptor for the controlling user,
5520 **		using storage allocated from e->e_rpool.
5521 **
5522 */
5523 
5524 static ADDRESS *
5525 setctluser(user, qfver, e)
5526 	char *user;
5527 	int qfver;
5528 	ENVELOPE *e;
5529 {
5530 	register ADDRESS *a;
5531 	struct passwd *pw;
5532 	char *p;
5533 
5534 	/*
5535 	**  See if this clears our concept of controlling user.
5536 	*/
5537 
5538 	if (user == NULL || *user == '\0')
5539 		return NULL;
5540 
5541 	/*
5542 	**  Set up addr fields for controlling user.
5543 	*/
5544 
5545 	a = (ADDRESS *) sm_rpool_malloc_x(e->e_rpool, sizeof(*a));
5546 	memset((char *) a, '\0', sizeof(*a));
5547 
5548 	if (*user == ':')
5549 	{
5550 		p = &user[1];
5551 		a->q_user = sm_rpool_strdup_x(e->e_rpool, p);
5552 	}
5553 	else
5554 	{
5555 		p = strtok(user, ":");
5556 		a->q_user = sm_rpool_strdup_x(e->e_rpool, user);
5557 		if (qfver >= 2)
5558 		{
5559 			if ((p = strtok(NULL, ":")) != NULL)
5560 				a->q_uid = atoi(p);
5561 			if ((p = strtok(NULL, ":")) != NULL)
5562 				a->q_gid = atoi(p);
5563 			if ((p = strtok(NULL, ":")) != NULL)
5564 			{
5565 				char *o;
5566 
5567 				a->q_flags |= QGOODUID;
5568 
5569 				/* if there is another ':': restore it */
5570 				if ((o = strtok(NULL, ":")) != NULL && o > p)
5571 					o[-1] = ':';
5572 			}
5573 		}
5574 		else if ((pw = sm_getpwnam(user)) != NULL)
5575 		{
5576 			if (*pw->pw_dir == '\0')
5577 				a->q_home = NULL;
5578 			else if (strcmp(pw->pw_dir, "/") == 0)
5579 				a->q_home = "";
5580 			else
5581 				a->q_home = sm_rpool_strdup_x(e->e_rpool, pw->pw_dir);
5582 			a->q_uid = pw->pw_uid;
5583 			a->q_gid = pw->pw_gid;
5584 			a->q_flags |= QGOODUID;
5585 		}
5586 	}
5587 
5588 	a->q_flags |= QPRIMARY;		/* flag as a "ctladdr" */
5589 	a->q_mailer = LocalMailer;
5590 	if (p == NULL)
5591 		a->q_paddr = sm_rpool_strdup_x(e->e_rpool, a->q_user);
5592 	else
5593 		a->q_paddr = sm_rpool_strdup_x(e->e_rpool, p);
5594 	return a;
5595 }
5596 /*
5597 **  LOSEQFILE -- rename queue file with LOSEQF_LETTER & try to let someone know
5598 **
5599 **	Parameters:
5600 **		e -- the envelope (e->e_id will be used).
5601 **		why -- reported to whomever can hear.
5602 **
5603 **	Returns:
5604 **		none.
5605 */
5606 
5607 void
5608 loseqfile(e, why)
5609 	register ENVELOPE *e;
5610 	char *why;
5611 {
5612 	bool loseit = true;
5613 	char *p;
5614 	char buf[MAXPATHLEN];
5615 
5616 	if (e == NULL || e->e_id == NULL)
5617 		return;
5618 	p = queuename(e, ANYQFL_LETTER);
5619 	if (sm_strlcpy(buf, p, sizeof(buf)) >= sizeof(buf))
5620 		return;
5621 	if (!bitset(EF_INQUEUE, e->e_flags))
5622 		queueup(e, false, true);
5623 	else if (QueueMode == QM_LOST)
5624 		loseit = false;
5625 
5626 	/* if already lost, no need to re-lose */
5627 	if (loseit)
5628 	{
5629 		p = queuename(e, LOSEQF_LETTER);
5630 		if (rename(buf, p) < 0)
5631 			syserr("cannot rename(%s, %s), uid=%d",
5632 			       buf, p, (int) geteuid());
5633 		else if (LogLevel > 0)
5634 			sm_syslog(LOG_ALERT, e->e_id,
5635 				  "Losing %s: %s", buf, why);
5636 	}
5637 	if (e->e_dfp != NULL)
5638 	{
5639 		(void) sm_io_close(e->e_dfp, SM_TIME_DEFAULT);
5640 		e->e_dfp = NULL;
5641 	}
5642 	e->e_flags &= ~EF_HAS_DF;
5643 }
5644 /*
5645 **  NAME2QID -- translate a queue group name to a queue group id
5646 **
5647 **	Parameters:
5648 **		queuename -- name of queue group.
5649 **
5650 **	Returns:
5651 **		queue group id if found.
5652 **		NOQGRP otherwise.
5653 */
5654 
5655 int
5656 name2qid(queuename)
5657 	char *queuename;
5658 {
5659 	register STAB *s;
5660 
5661 	s = stab(queuename, ST_QUEUE, ST_FIND);
5662 	if (s == NULL)
5663 		return NOQGRP;
5664 	return s->s_quegrp->qg_index;
5665 }
5666 /*
5667 **  QID_PRINTNAME -- create externally printable version of queue id
5668 **
5669 **	Parameters:
5670 **		e -- the envelope.
5671 **
5672 **	Returns:
5673 **		a printable version
5674 */
5675 
5676 char *
5677 qid_printname(e)
5678 	ENVELOPE *e;
5679 {
5680 	char *id;
5681 	static char idbuf[MAXQFNAME + 34];
5682 
5683 	if (e == NULL)
5684 		return "";
5685 
5686 	if (e->e_id == NULL)
5687 		id = "";
5688 	else
5689 		id = e->e_id;
5690 
5691 	if (e->e_qdir == NOQDIR)
5692 		return id;
5693 
5694 	(void) sm_snprintf(idbuf, sizeof(idbuf), "%.32s/%s",
5695 			   Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_name,
5696 			   id);
5697 	return idbuf;
5698 }
5699 /*
5700 **  QID_PRINTQUEUE -- create full version of queue directory for data files
5701 **
5702 **	Parameters:
5703 **		qgrp -- index in queue group.
5704 **		qdir -- the short version of the queue directory
5705 **
5706 **	Returns:
5707 **		the full pathname to the queue (might point to a static var)
5708 */
5709 
5710 char *
5711 qid_printqueue(qgrp, qdir)
5712 	int qgrp;
5713 	int qdir;
5714 {
5715 	char *subdir;
5716 	static char dir[MAXPATHLEN];
5717 
5718 	if (qdir == NOQDIR)
5719 		return Queue[qgrp]->qg_qdir;
5720 
5721 	if (strcmp(Queue[qgrp]->qg_qpaths[qdir].qp_name, ".") == 0)
5722 		subdir = NULL;
5723 	else
5724 		subdir = Queue[qgrp]->qg_qpaths[qdir].qp_name;
5725 
5726 	(void) sm_strlcpyn(dir, sizeof(dir), 4,
5727 			Queue[qgrp]->qg_qdir,
5728 			subdir == NULL ? "" : "/",
5729 			subdir == NULL ? "" : subdir,
5730 			(bitset(QP_SUBDF,
5731 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
5732 					? "/df" : ""));
5733 	return dir;
5734 }
5735 
5736 /*
5737 **  PICKQDIR -- Pick a queue directory from a queue group
5738 **
5739 **	Parameters:
5740 **		qg -- queue group
5741 **		fsize -- file size in bytes
5742 **		e -- envelope, or NULL
5743 **
5744 **	Result:
5745 **		NOQDIR if no queue directory in qg has enough free space to
5746 **		hold a file of size 'fsize', otherwise the index of
5747 **		a randomly selected queue directory which resides on a
5748 **		file system with enough disk space.
5749 **		XXX This could be extended to select a queuedir with
5750 **			a few (the fewest?) number of entries. That data
5751 **			is available if shared memory is used.
5752 **
5753 **	Side Effects:
5754 **		If the request fails and e != NULL then sm_syslog is called.
5755 */
5756 
5757 int
5758 pickqdir(qg, fsize, e)
5759 	QUEUEGRP *qg;
5760 	long fsize;
5761 	ENVELOPE *e;
5762 {
5763 	int qdir;
5764 	int i;
5765 	long avail = 0;
5766 
5767 	/* Pick a random directory, as a starting point. */
5768 	if (qg->qg_numqueues <= 1)
5769 		qdir = 0;
5770 	else
5771 		qdir = get_rand_mod(qg->qg_numqueues);
5772 
5773 #if _FFR_TESTS
5774 	if (tTd(4, 101))
5775 		return NOQDIR;
5776 #endif /* _FFR_TESTS */
5777 	if (MinBlocksFree <= 0 && fsize <= 0)
5778 		return qdir;
5779 
5780 	/*
5781 	**  Now iterate over the queue directories,
5782 	**  looking for a directory with enough space for this message.
5783 	*/
5784 
5785 	i = qdir;
5786 	do
5787 	{
5788 		QPATHS *qp = &qg->qg_qpaths[i];
5789 		long needed = 0;
5790 		long fsavail = 0;
5791 
5792 		if (fsize > 0)
5793 			needed += fsize / FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5794 				  + ((fsize % FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5795 				      > 0) ? 1 : 0);
5796 		if (MinBlocksFree > 0)
5797 			needed += MinBlocksFree;
5798 		fsavail = FILE_SYS_AVAIL(qp->qp_fsysidx);
5799 #if SM_CONF_SHM
5800 		if (fsavail <= 0)
5801 		{
5802 			long blksize;
5803 
5804 			/*
5805 			**  might be not correctly updated,
5806 			**  let's try to get the info directly.
5807 			*/
5808 
5809 			fsavail = freediskspace(FILE_SYS_NAME(qp->qp_fsysidx),
5810 						&blksize);
5811 			if (fsavail < 0)
5812 				fsavail = 0;
5813 		}
5814 #endif /* SM_CONF_SHM */
5815 		if (needed <= fsavail)
5816 			return i;
5817 		if (avail < fsavail)
5818 			avail = fsavail;
5819 
5820 		if (qg->qg_numqueues > 0)
5821 			i = (i + 1) % qg->qg_numqueues;
5822 	} while (i != qdir);
5823 
5824 	if (e != NULL && LogLevel > 0)
5825 		sm_syslog(LOG_ALERT, e->e_id,
5826 			"low on space (%s needs %ld bytes + %ld blocks in %s), max avail: %ld",
5827 			CurHostName == NULL ? "SMTP-DAEMON" : CurHostName,
5828 			fsize, MinBlocksFree,
5829 			qg->qg_qdir, avail);
5830 	return NOQDIR;
5831 }
5832 /*
5833 **  SETNEWQUEUE -- Sets a new queue group and directory
5834 **
5835 **	Assign a queue group and directory to an envelope and store the
5836 **	directory in e->e_qdir.
5837 **
5838 **	Parameters:
5839 **		e -- envelope to assign a queue for.
5840 **
5841 **	Returns:
5842 **		true if successful
5843 **		false otherwise
5844 **
5845 **	Side Effects:
5846 **		On success, e->e_qgrp and e->e_qdir are non-negative.
5847 **		On failure (not enough disk space),
5848 **		e->qgrp = NOQGRP, e->e_qdir = NOQDIR
5849 **		and usrerr() is invoked (which could raise an exception).
5850 */
5851 
5852 bool
5853 setnewqueue(e)
5854 	ENVELOPE *e;
5855 {
5856 	if (tTd(41, 20))
5857 		sm_dprintf("setnewqueue: called\n");
5858 
5859 	/* not set somewhere else */
5860 	if (e->e_qgrp == NOQGRP)
5861 	{
5862 		ADDRESS *q;
5863 
5864 		/*
5865 		**  Use the queue group of the "first" recipient, as set by
5866 		**  the "queuegroup" rule set.  If that is not defined, then
5867 		**  use the queue group of the mailer of the first recipient.
5868 		**  If that is not defined either, then use the default
5869 		**  queue group.
5870 		**  Notice: "first" depends on the sorting of sendqueue
5871 		**  in recipient().
5872 		**  To avoid problems with "bad" recipients look
5873 		**  for a valid address first.
5874 		*/
5875 
5876 		q = e->e_sendqueue;
5877 		while (q != NULL &&
5878 		       (QS_IS_BADADDR(q->q_state) || QS_IS_DEAD(q->q_state)))
5879 		{
5880 			q = q->q_next;
5881 		}
5882 		if (q == NULL)
5883 			e->e_qgrp = 0;
5884 		else if (q->q_qgrp >= 0)
5885 			e->e_qgrp = q->q_qgrp;
5886 		else if (q->q_mailer != NULL &&
5887 			 ISVALIDQGRP(q->q_mailer->m_qgrp))
5888 			e->e_qgrp = q->q_mailer->m_qgrp;
5889 		else
5890 			e->e_qgrp = 0;
5891 		e->e_dfqgrp = e->e_qgrp;
5892 	}
5893 
5894 	if (ISVALIDQDIR(e->e_qdir) && ISVALIDQDIR(e->e_dfqdir))
5895 	{
5896 		if (tTd(41, 20))
5897 			sm_dprintf("setnewqueue: e_qdir already assigned (%s)\n",
5898 				qid_printqueue(e->e_qgrp, e->e_qdir));
5899 		return true;
5900 	}
5901 
5902 	filesys_update();
5903 	e->e_qdir = pickqdir(Queue[e->e_qgrp], e->e_msgsize, e);
5904 	if (e->e_qdir == NOQDIR)
5905 	{
5906 		e->e_qgrp = NOQGRP;
5907 		if (!bitset(EF_FATALERRS, e->e_flags))
5908 			usrerr("452 4.4.5 Insufficient disk space; try again later");
5909 		e->e_flags |= EF_FATALERRS;
5910 		return false;
5911 	}
5912 
5913 	if (tTd(41, 3))
5914 		sm_dprintf("setnewqueue: Assigned queue directory %s\n",
5915 			qid_printqueue(e->e_qgrp, e->e_qdir));
5916 
5917 	if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5918 	{
5919 		e->e_xfqgrp = e->e_qgrp;
5920 		e->e_xfqdir = e->e_qdir;
5921 	}
5922 	e->e_dfqdir = e->e_qdir;
5923 	return true;
5924 }
5925 /*
5926 **  CHKQDIR -- check a queue directory
5927 **
5928 **	Parameters:
5929 **		name -- name of queue directory
5930 **		sff -- flags for safefile()
5931 **
5932 **	Returns:
5933 **		is it a queue directory?
5934 */
5935 
5936 static bool chkqdir __P((char *, long));
5937 
5938 static bool
5939 chkqdir(name, sff)
5940 	char *name;
5941 	long sff;
5942 {
5943 	struct stat statb;
5944 	int i;
5945 
5946 	/* skip over . and .. directories */
5947 	if (name[0] == '.' &&
5948 	    (name[1] == '\0' || (name[1] == '.' && name[2] == '\0')))
5949 		return false;
5950 #if HASLSTAT
5951 	if (lstat(name, &statb) < 0)
5952 #else /* HASLSTAT */
5953 	if (stat(name, &statb) < 0)
5954 #endif /* HASLSTAT */
5955 	{
5956 		if (tTd(41, 2))
5957 			sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5958 				   name, sm_errstring(errno));
5959 		return false;
5960 	}
5961 #if HASLSTAT
5962 	if (S_ISLNK(statb.st_mode))
5963 	{
5964 		/*
5965 		**  For a symlink we need to make sure the
5966 		**  target is a directory
5967 		*/
5968 
5969 		if (stat(name, &statb) < 0)
5970 		{
5971 			if (tTd(41, 2))
5972 				sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5973 					   name, sm_errstring(errno));
5974 			return false;
5975 		}
5976 	}
5977 #endif /* HASLSTAT */
5978 
5979 	if (!S_ISDIR(statb.st_mode))
5980 	{
5981 		if (tTd(41, 2))
5982 			sm_dprintf("chkqdir: \"%s\": Not a directory\n",
5983 				name);
5984 		return false;
5985 	}
5986 
5987 	/* Print a warning if unsafe (but still use it) */
5988 	/* XXX do this only if we want the warning? */
5989 	i = safedirpath(name, RunAsUid, RunAsGid, NULL, sff, 0, 0);
5990 	if (i != 0)
5991 	{
5992 		if (tTd(41, 2))
5993 			sm_dprintf("chkqdir: \"%s\": Not safe: %s\n",
5994 				   name, sm_errstring(i));
5995 #if _FFR_CHK_QUEUE
5996 		if (LogLevel > 8)
5997 			sm_syslog(LOG_WARNING, NOQID,
5998 				  "queue directory \"%s\": Not safe: %s",
5999 				  name, sm_errstring(i));
6000 #endif /* _FFR_CHK_QUEUE */
6001 	}
6002 	return true;
6003 }
6004 /*
6005 **  MULTIQUEUE_CACHE -- cache a list of paths to queues.
6006 **
6007 **	Each potential queue is checked as the cache is built.
6008 **	Thereafter, each is blindly trusted.
6009 **	Note that we can be called again after a timeout to rebuild
6010 **	(although code for that is not ready yet).
6011 **
6012 **	Parameters:
6013 **		basedir -- base of all queue directories.
6014 **		blen -- strlen(basedir).
6015 **		qg -- queue group.
6016 **		qn -- number of queue directories already cached.
6017 **		phash -- pointer to hash value over queue dirs.
6018 #if SM_CONF_SHM
6019 **			only used if shared memory is active.
6020 #endif * SM_CONF_SHM *
6021 **
6022 **	Returns:
6023 **		new number of queue directories.
6024 */
6025 
6026 #define INITIAL_SLOTS	20
6027 #define ADD_SLOTS	10
6028 
6029 static int
6030 multiqueue_cache(basedir, blen, qg, qn, phash)
6031 	char *basedir;
6032 	int blen;
6033 	QUEUEGRP *qg;
6034 	int qn;
6035 	unsigned int *phash;
6036 {
6037 	char *cp;
6038 	int i, len;
6039 	int slotsleft = 0;
6040 	long sff = SFF_ANYFILE;
6041 	char qpath[MAXPATHLEN];
6042 	char subdir[MAXPATHLEN];
6043 	char prefix[MAXPATHLEN];	/* dir relative to basedir */
6044 
6045 	if (tTd(41, 20))
6046 		sm_dprintf("multiqueue_cache: called\n");
6047 
6048 	/* Initialize to current directory */
6049 	prefix[0] = '.';
6050 	prefix[1] = '\0';
6051 	if (qg->qg_numqueues != 0 && qg->qg_qpaths != NULL)
6052 	{
6053 		for (i = 0; i < qg->qg_numqueues; i++)
6054 		{
6055 			if (qg->qg_qpaths[i].qp_name != NULL)
6056 				(void) sm_free(qg->qg_qpaths[i].qp_name); /* XXX */
6057 		}
6058 		(void) sm_free((char *) qg->qg_qpaths); /* XXX */
6059 		qg->qg_qpaths = NULL;
6060 		qg->qg_numqueues = 0;
6061 	}
6062 
6063 	/* If running as root, allow safedirpath() checks to use privs */
6064 	if (RunAsUid == 0)
6065 		sff |= SFF_ROOTOK;
6066 #if _FFR_CHK_QUEUE
6067 	sff |= SFF_SAFEDIRPATH|SFF_NOWWFILES;
6068 	if (!UseMSP)
6069 		sff |= SFF_NOGWFILES;
6070 #endif /* _FFR_CHK_QUEUE */
6071 
6072 	if (!SM_IS_DIR_START(qg->qg_qdir))
6073 	{
6074 		/*
6075 		**  XXX we could add basedir, but then we have to realloc()
6076 		**  the string... Maybe another time.
6077 		*/
6078 
6079 		syserr("QueuePath %s not absolute", qg->qg_qdir);
6080 		ExitStat = EX_CONFIG;
6081 		return qn;
6082 	}
6083 
6084 	/* qpath: directory of current workgroup */
6085 	len = sm_strlcpy(qpath, qg->qg_qdir, sizeof(qpath));
6086 	if (len >= sizeof(qpath))
6087 	{
6088 		syserr("QueuePath %.256s too long (%d max)",
6089 		       qg->qg_qdir, (int) sizeof(qpath));
6090 		ExitStat = EX_CONFIG;
6091 		return qn;
6092 	}
6093 
6094 	/* begin of qpath must be same as basedir */
6095 	if (strncmp(basedir, qpath, blen) != 0 &&
6096 	    (strncmp(basedir, qpath, blen - 1) != 0 || len != blen - 1))
6097 	{
6098 		syserr("QueuePath %s not subpath of QueueDirectory %s",
6099 			qpath, basedir);
6100 		ExitStat = EX_CONFIG;
6101 		return qn;
6102 	}
6103 
6104 	/* Do we have a nested subdirectory? */
6105 	if (blen < len && SM_FIRST_DIR_DELIM(qg->qg_qdir + blen) != NULL)
6106 	{
6107 
6108 		/* Copy subdirectory into prefix for later use */
6109 		if (sm_strlcpy(prefix, qg->qg_qdir + blen, sizeof(prefix)) >=
6110 		    sizeof(prefix))
6111 		{
6112 			syserr("QueuePath %.256s too long (%d max)",
6113 				qg->qg_qdir, (int) sizeof(qpath));
6114 			ExitStat = EX_CONFIG;
6115 			return qn;
6116 		}
6117 		cp = SM_LAST_DIR_DELIM(prefix);
6118 		SM_ASSERT(cp != NULL);
6119 		*cp = '\0';	/* cut off trailing / */
6120 	}
6121 
6122 	/* This is guaranteed by the basedir check above */
6123 	SM_ASSERT(len >= blen - 1);
6124 	cp = &qpath[len - 1];
6125 	if (*cp == '*')
6126 	{
6127 		register DIR *dp;
6128 		register struct dirent *d;
6129 		int off;
6130 		char *delim;
6131 		char relpath[MAXPATHLEN];
6132 
6133 		*cp = '\0';	/* Overwrite wildcard */
6134 		if ((cp = SM_LAST_DIR_DELIM(qpath)) == NULL)
6135 		{
6136 			syserr("QueueDirectory: can not wildcard relative path");
6137 			if (tTd(41, 2))
6138 				sm_dprintf("multiqueue_cache: \"%s*\": Can not wildcard relative path.\n",
6139 					qpath);
6140 			ExitStat = EX_CONFIG;
6141 			return qn;
6142 		}
6143 		if (cp == qpath)
6144 		{
6145 			/*
6146 			**  Special case of top level wildcard, like /foo*
6147 			**	Change to //foo*
6148 			*/
6149 
6150 			(void) sm_strlcpy(qpath + 1, qpath, sizeof(qpath) - 1);
6151 			++cp;
6152 		}
6153 		delim = cp;
6154 		*(cp++) = '\0';		/* Replace / with \0 */
6155 		len = strlen(cp);	/* Last component of queue directory */
6156 
6157 		/*
6158 		**  Path relative to basedir, with trailing /
6159 		**  It will be modified below to specify the subdirectories
6160 		**  so they can be opened without chdir().
6161 		*/
6162 
6163 		off = sm_strlcpyn(relpath, sizeof(relpath), 2, prefix, "/");
6164 		SM_ASSERT(off < sizeof(relpath));
6165 
6166 		if (tTd(41, 2))
6167 			sm_dprintf("multiqueue_cache: prefix=\"%s%s\"\n",
6168 				   relpath, cp);
6169 
6170 		/* It is always basedir: we don't need to store it per group */
6171 		/* XXX: optimize this! -> one more global? */
6172 		qg->qg_qdir = newstr(basedir);
6173 		qg->qg_qdir[blen - 1] = '\0';	/* cut off trailing / */
6174 
6175 		/*
6176 		**  XXX Should probably wrap this whole loop in a timeout
6177 		**  in case some wag decides to NFS mount the queues.
6178 		*/
6179 
6180 		/* Test path to get warning messages. */
6181 		if (qn == 0)
6182 		{
6183 			/*  XXX qg_runasuid and qg_runasgid for specials? */
6184 			i = safedirpath(basedir, RunAsUid, RunAsGid, NULL,
6185 					sff, 0, 0);
6186 			if (i != 0 && tTd(41, 2))
6187 				sm_dprintf("multiqueue_cache: \"%s\": Not safe: %s\n",
6188 					   basedir, sm_errstring(i));
6189 		}
6190 
6191 		if ((dp = opendir(prefix)) == NULL)
6192 		{
6193 			syserr("can not opendir(%s/%s)", qg->qg_qdir, prefix);
6194 			if (tTd(41, 2))
6195 				sm_dprintf("multiqueue_cache: opendir(\"%s/%s\"): %s\n",
6196 					   qg->qg_qdir, prefix,
6197 					   sm_errstring(errno));
6198 			ExitStat = EX_CONFIG;
6199 			return qn;
6200 		}
6201 		while ((d = readdir(dp)) != NULL)
6202 		{
6203 			/* Skip . and .. directories */
6204 			if (strcmp(d->d_name, ".") == 0 ||
6205 			    strcmp(d->d_name, "..") == 0)
6206 				continue;
6207 
6208 			i = strlen(d->d_name);
6209 			if (i < len || strncmp(d->d_name, cp, len) != 0)
6210 			{
6211 				if (tTd(41, 5))
6212 					sm_dprintf("multiqueue_cache: \"%s\", skipped\n",
6213 						d->d_name);
6214 				continue;
6215 			}
6216 
6217 			/* Create relative pathname: prefix + local directory */
6218 			i = sizeof(relpath) - off;
6219 			if (sm_strlcpy(relpath + off, d->d_name, i) >= i)
6220 				continue;	/* way too long */
6221 
6222 			if (!chkqdir(relpath, sff))
6223 				continue;
6224 
6225 			if (qg->qg_qpaths == NULL)
6226 			{
6227 				slotsleft = INITIAL_SLOTS;
6228 				qg->qg_qpaths = (QPATHS *)xalloc((sizeof(*qg->qg_qpaths)) *
6229 								slotsleft);
6230 				qg->qg_numqueues = 0;
6231 			}
6232 			else if (slotsleft < 1)
6233 			{
6234 				qg->qg_qpaths = (QPATHS *)sm_realloc((char *)qg->qg_qpaths,
6235 							  (sizeof(*qg->qg_qpaths)) *
6236 							  (qg->qg_numqueues +
6237 							   ADD_SLOTS));
6238 				if (qg->qg_qpaths == NULL)
6239 				{
6240 					(void) closedir(dp);
6241 					return qn;
6242 				}
6243 				slotsleft += ADD_SLOTS;
6244 			}
6245 
6246 			/* check subdirs */
6247 			qg->qg_qpaths[qg->qg_numqueues].qp_subdirs = QP_NOSUB;
6248 
6249 #define CHKRSUBDIR(name, flag)	\
6250 	(void) sm_strlcpyn(subdir, sizeof(subdir), 3, relpath, "/", name); \
6251 	if (chkqdir(subdir, sff))	\
6252 		qg->qg_qpaths[qg->qg_numqueues].qp_subdirs |= flag;	\
6253 	else
6254 
6255 
6256 			CHKRSUBDIR("qf", QP_SUBQF);
6257 			CHKRSUBDIR("df", QP_SUBDF);
6258 			CHKRSUBDIR("xf", QP_SUBXF);
6259 
6260 			/* assert(strlen(d->d_name) < MAXPATHLEN - 14) */
6261 			/* maybe even - 17 (subdirs) */
6262 
6263 			if (prefix[0] != '.')
6264 				qg->qg_qpaths[qg->qg_numqueues].qp_name =
6265 					newstr(relpath);
6266 			else
6267 				qg->qg_qpaths[qg->qg_numqueues].qp_name =
6268 					newstr(d->d_name);
6269 
6270 			if (tTd(41, 2))
6271 				sm_dprintf("multiqueue_cache: %d: \"%s\" cached (%x).\n",
6272 					qg->qg_numqueues, relpath,
6273 					qg->qg_qpaths[qg->qg_numqueues].qp_subdirs);
6274 #if SM_CONF_SHM
6275 			qg->qg_qpaths[qg->qg_numqueues].qp_idx = qn;
6276 			*phash = hash_q(relpath, *phash);
6277 #endif /* SM_CONF_SHM */
6278 			qg->qg_numqueues++;
6279 			++qn;
6280 			slotsleft--;
6281 		}
6282 		(void) closedir(dp);
6283 
6284 		/* undo damage */
6285 		*delim = '/';
6286 	}
6287 	if (qg->qg_numqueues == 0)
6288 	{
6289 		qg->qg_qpaths = (QPATHS *) xalloc(sizeof(*qg->qg_qpaths));
6290 
6291 		/* test path to get warning messages */
6292 		i = safedirpath(qpath, RunAsUid, RunAsGid, NULL, sff, 0, 0);
6293 		if (i == ENOENT)
6294 		{
6295 			syserr("can not opendir(%s)", qpath);
6296 			if (tTd(41, 2))
6297 				sm_dprintf("multiqueue_cache: opendir(\"%s\"): %s\n",
6298 					   qpath, sm_errstring(i));
6299 			ExitStat = EX_CONFIG;
6300 			return qn;
6301 		}
6302 
6303 		qg->qg_qpaths[0].qp_subdirs = QP_NOSUB;
6304 		qg->qg_numqueues = 1;
6305 
6306 		/* check subdirs */
6307 #define CHKSUBDIR(name, flag)	\
6308 	(void) sm_strlcpyn(subdir, sizeof(subdir), 3, qg->qg_qdir, "/", name); \
6309 	if (chkqdir(subdir, sff))	\
6310 		qg->qg_qpaths[0].qp_subdirs |= flag;	\
6311 	else
6312 
6313 		CHKSUBDIR("qf", QP_SUBQF);
6314 		CHKSUBDIR("df", QP_SUBDF);
6315 		CHKSUBDIR("xf", QP_SUBXF);
6316 
6317 		if (qg->qg_qdir[blen - 1] != '\0' &&
6318 		    qg->qg_qdir[blen] != '\0')
6319 		{
6320 			/*
6321 			**  Copy the last component into qpaths and
6322 			**  cut off qdir
6323 			*/
6324 
6325 			qg->qg_qpaths[0].qp_name = newstr(qg->qg_qdir + blen);
6326 			qg->qg_qdir[blen - 1] = '\0';
6327 		}
6328 		else
6329 			qg->qg_qpaths[0].qp_name = newstr(".");
6330 
6331 #if SM_CONF_SHM
6332 		qg->qg_qpaths[0].qp_idx = qn;
6333 		*phash = hash_q(qg->qg_qpaths[0].qp_name, *phash);
6334 #endif /* SM_CONF_SHM */
6335 		++qn;
6336 	}
6337 	return qn;
6338 }
6339 
6340 /*
6341 **  FILESYS_FIND -- find entry in FileSys table, or add new one
6342 **
6343 **	Given the pathname of a directory, determine the file system
6344 **	in which that directory resides, and return a pointer to the
6345 **	entry in the FileSys table that describes the file system.
6346 **	A new entry is added if necessary (and requested).
6347 **	If the directory does not exist, -1 is returned.
6348 **
6349 **	Parameters:
6350 **		name -- name of directory (must be persistent!)
6351 **		path -- pathname of directory (name plus maybe "/df")
6352 **		add -- add to structure if not found.
6353 **
6354 **	Returns:
6355 **		>=0: found: index in file system table
6356 **		<0: some error, i.e.,
6357 **		FSF_TOO_MANY: too many filesystems (-> syserr())
6358 **		FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6359 **		FSF_NOT_FOUND: not in list
6360 */
6361 
6362 static short filesys_find __P((const char *, const char *, bool));
6363 
6364 #define FSF_NOT_FOUND	(-1)
6365 #define FSF_STAT_FAIL	(-2)
6366 #define FSF_TOO_MANY	(-3)
6367 
6368 static short
6369 filesys_find(name, path, add)
6370 	const char *name;
6371 	const char *path;
6372 	bool add;
6373 {
6374 	struct stat st;
6375 	short i;
6376 
6377 	if (stat(path, &st) < 0)
6378 	{
6379 		syserr("cannot stat queue directory %s", path);
6380 		return FSF_STAT_FAIL;
6381 	}
6382 	for (i = 0; i < NumFileSys; ++i)
6383 	{
6384 		if (FILE_SYS_DEV(i) == st.st_dev)
6385 		{
6386 			/*
6387 			**  Make sure the file system (FS) name is set:
6388 			**  even though the source code indicates that
6389 			**  FILE_SYS_DEV() is only set below, it could be
6390 			**  set via shared memory, hence we need to perform
6391 			**  this check/assignment here.
6392 			*/
6393 
6394 			if (NULL == FILE_SYS_NAME(i))
6395 				FILE_SYS_NAME(i) = name;
6396 			return i;
6397 		}
6398 	}
6399 	if (i >= MAXFILESYS)
6400 	{
6401 		syserr("too many queue file systems (%d max)", MAXFILESYS);
6402 		return FSF_TOO_MANY;
6403 	}
6404 	if (!add)
6405 		return FSF_NOT_FOUND;
6406 
6407 	++NumFileSys;
6408 	FILE_SYS_NAME(i) = name;
6409 	FILE_SYS_DEV(i) = st.st_dev;
6410 	FILE_SYS_AVAIL(i) = 0;
6411 	FILE_SYS_BLKSIZE(i) = 1024; /* avoid divide by zero */
6412 	return i;
6413 }
6414 
6415 /*
6416 **  FILESYS_SETUP -- set up mapping from queue directories to file systems
6417 **
6418 **	This data structure is used to efficiently check the amount of
6419 **	free space available in a set of queue directories.
6420 **
6421 **	Parameters:
6422 **		add -- initialize structure if necessary.
6423 **
6424 **	Returns:
6425 **		0: success
6426 **		<0: some error, i.e.,
6427 **		FSF_NOT_FOUND: not in list
6428 **		FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6429 **		FSF_TOO_MANY: too many filesystems (-> syserr())
6430 */
6431 
6432 static int filesys_setup __P((bool));
6433 
6434 static int
6435 filesys_setup(add)
6436 	bool add;
6437 {
6438 	int i, j;
6439 	short fs;
6440 	int ret;
6441 
6442 	ret = 0;
6443 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
6444 	{
6445 		for (j = 0; j < Queue[i]->qg_numqueues; ++j)
6446 		{
6447 			QPATHS *qp = &Queue[i]->qg_qpaths[j];
6448 			char qddf[MAXPATHLEN];
6449 
6450 			(void) sm_strlcpyn(qddf, sizeof(qddf), 2, qp->qp_name,
6451 					(bitset(QP_SUBDF, qp->qp_subdirs)
6452 						? "/df" : ""));
6453 			fs = filesys_find(qp->qp_name, qddf, add);
6454 			if (fs >= 0)
6455 				qp->qp_fsysidx = fs;
6456 			else
6457 				qp->qp_fsysidx = 0;
6458 			if (fs < ret)
6459 				ret = fs;
6460 		}
6461 	}
6462 	return ret;
6463 }
6464 
6465 /*
6466 **  FILESYS_UPDATE -- update amount of free space on all file systems
6467 **
6468 **	The FileSys table is used to cache the amount of free space
6469 **	available on all queue directory file systems.
6470 **	This function updates the cached information if it has expired.
6471 **
6472 **	Parameters:
6473 **		none.
6474 **
6475 **	Returns:
6476 **		none.
6477 **
6478 **	Side Effects:
6479 **		Updates FileSys table.
6480 */
6481 
6482 void
6483 filesys_update()
6484 {
6485 	int i;
6486 	long avail, blksize;
6487 	time_t now;
6488 	static time_t nextupdate = 0;
6489 
6490 #if SM_CONF_SHM
6491 	/*
6492 	**  Only the daemon updates the shared memory, i.e.,
6493 	**  if shared memory is available but the pid is not the
6494 	**  one of the daemon, then don't do anything.
6495 	*/
6496 
6497 	if (ShmId != SM_SHM_NO_ID && DaemonPid != CurrentPid)
6498 		return;
6499 #endif /* SM_CONF_SHM */
6500 	now = curtime();
6501 	if (now < nextupdate)
6502 		return;
6503 	nextupdate = now + FILESYS_UPDATE_INTERVAL;
6504 	for (i = 0; i < NumFileSys; ++i)
6505 	{
6506 		FILESYS *fs = &FILE_SYS(i);
6507 
6508 		avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6509 		if (avail < 0 || blksize <= 0)
6510 		{
6511 			if (LogLevel > 5)
6512 				sm_syslog(LOG_ERR, NOQID,
6513 					"filesys_update failed: %s, fs=%s, avail=%ld, blocksize=%ld",
6514 					sm_errstring(errno),
6515 					FILE_SYS_NAME(i), avail, blksize);
6516 			fs->fs_avail = 0;
6517 			fs->fs_blksize = 1024; /* avoid divide by zero */
6518 			nextupdate = now + 2; /* let's do this soon again */
6519 		}
6520 		else
6521 		{
6522 			fs->fs_avail = avail;
6523 			fs->fs_blksize = blksize;
6524 		}
6525 	}
6526 }
6527 
6528 #if _FFR_ANY_FREE_FS
6529 /*
6530 **  FILESYS_FREE -- check whether there is at least one fs with enough space.
6531 **
6532 **	Parameters:
6533 **		fsize -- file size in bytes
6534 **
6535 **	Returns:
6536 **		true iff there is one fs with more than fsize bytes free.
6537 */
6538 
6539 bool
6540 filesys_free(fsize)
6541 	long fsize;
6542 {
6543 	int i;
6544 
6545 	if (fsize <= 0)
6546 		return true;
6547 	for (i = 0; i < NumFileSys; ++i)
6548 	{
6549 		long needed = 0;
6550 
6551 		if (FILE_SYS_AVAIL(i) < 0 || FILE_SYS_BLKSIZE(i) <= 0)
6552 			continue;
6553 		needed += fsize / FILE_SYS_BLKSIZE(i)
6554 			  + ((fsize % FILE_SYS_BLKSIZE(i)
6555 			      > 0) ? 1 : 0)
6556 			  + MinBlocksFree;
6557 		if (needed <= FILE_SYS_AVAIL(i))
6558 			return true;
6559 	}
6560 	return false;
6561 }
6562 #endif /* _FFR_ANY_FREE_FS */
6563 
6564 /*
6565 **  DISK_STATUS -- show amount of free space in queue directories
6566 **
6567 **	Parameters:
6568 **		out -- output file pointer.
6569 **		prefix -- string to output in front of each line.
6570 **
6571 **	Returns:
6572 **		none.
6573 */
6574 
6575 void
6576 disk_status(out, prefix)
6577 	SM_FILE_T *out;
6578 	char *prefix;
6579 {
6580 	int i;
6581 	long avail, blksize;
6582 	long free;
6583 
6584 	for (i = 0; i < NumFileSys; ++i)
6585 	{
6586 		avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6587 		if (avail >= 0 && blksize > 0)
6588 		{
6589 			free = (long)((double) avail *
6590 				((double) blksize / 1024));
6591 		}
6592 		else
6593 			free = -1;
6594 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
6595 				"%s%d/%s/%ld\r\n",
6596 				prefix, i,
6597 				FILE_SYS_NAME(i),
6598 					free);
6599 	}
6600 }
6601 
6602 #if SM_CONF_SHM
6603 
6604 /*
6605 **  INIT_SEM -- initialize semaphore system
6606 **
6607 **	Parameters:
6608 **		owner -- is this the owner of semaphores?
6609 **
6610 **	Returns:
6611 **		none.
6612 */
6613 
6614 #if _FFR_USE_SEM_LOCKING
6615 #if SM_CONF_SEM
6616 static int SemId = -1;		/* Semaphore Id */
6617 int SemKey = SM_SEM_KEY;
6618 #endif /* SM_CONF_SEM */
6619 #endif /* _FFR_USE_SEM_LOCKING */
6620 
6621 static void init_sem __P((bool));
6622 
6623 static void
6624 init_sem(owner)
6625 	bool owner;
6626 {
6627 #if _FFR_USE_SEM_LOCKING
6628 #if SM_CONF_SEM
6629 	SemId = sm_sem_start(SemKey, 1, 0, owner);
6630 	if (SemId < 0)
6631 	{
6632 		sm_syslog(LOG_ERR, NOQID,
6633 			"func=init_sem, sem_key=%ld, sm_sem_start=%d, error=%s",
6634 			(long) SemKey, SemId, sm_errstring(-SemId));
6635 		return;
6636 	}
6637 	if (owner && RunAsUid != 0)
6638 	{
6639 		int r;
6640 
6641 		r = sm_semsetowner(SemId, RunAsUid, RunAsGid, 0660);
6642 		if (r != 0)
6643 			sm_syslog(LOG_ERR, NOQID,
6644 				"key=%ld, sm_semsetowner=%d, RunAsUid=%d, RunAsGid=%d",
6645 				(long) SemKey, r, RunAsUid, RunAsGid);
6646 	}
6647 #endif /* SM_CONF_SEM */
6648 #endif /* _FFR_USE_SEM_LOCKING */
6649 	return;
6650 }
6651 
6652 /*
6653 **  STOP_SEM -- stop semaphore system
6654 **
6655 **	Parameters:
6656 **		owner -- is this the owner of semaphores?
6657 **
6658 **	Returns:
6659 **		none.
6660 */
6661 
6662 static void stop_sem __P((bool));
6663 
6664 static void
6665 stop_sem(owner)
6666 	bool owner;
6667 {
6668 #if _FFR_USE_SEM_LOCKING
6669 #if SM_CONF_SEM
6670 	if (owner && SemId >= 0)
6671 		sm_sem_stop(SemId);
6672 #endif /* SM_CONF_SEM */
6673 #endif /* _FFR_USE_SEM_LOCKING */
6674 	return;
6675 }
6676 
6677 /*
6678 **  UPD_QS -- update information about queue when adding/deleting an entry
6679 **
6680 **	Parameters:
6681 **		e -- envelope.
6682 **		count -- add/remove entry (+1/0/-1: add/no change/remove)
6683 **		space -- update the space available as well.
6684 **			(>0/0/<0: add/no change/remove)
6685 **		where -- caller (for logging)
6686 **
6687 **	Returns:
6688 **		none.
6689 **
6690 **	Side Effects:
6691 **		Modifies available space in filesystem.
6692 **		Changes number of entries in queue directory.
6693 */
6694 
6695 void
6696 upd_qs(e, count, space, where)
6697 	ENVELOPE *e;
6698 	int count;
6699 	int space;
6700 	char *where;
6701 {
6702 	short fidx;
6703 	int idx;
6704 # if _FFR_USE_SEM_LOCKING
6705 	int r;
6706 # endif /* _FFR_USE_SEM_LOCKING */
6707 	long s;
6708 
6709 	if (ShmId == SM_SHM_NO_ID || e == NULL)
6710 		return;
6711 	if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
6712 		return;
6713 	idx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_idx;
6714 	if (tTd(73,2))
6715 		sm_dprintf("func=upd_qs, count=%d, space=%d, where=%s, idx=%d, entries=%d\n",
6716 			count, space, where, idx, QSHM_ENTRIES(idx));
6717 
6718 	/* XXX in theory this needs to be protected with a mutex */
6719 	if (QSHM_ENTRIES(idx) >= 0 && count != 0)
6720 	{
6721 # if _FFR_USE_SEM_LOCKING
6722 		r = sm_sem_acq(SemId, 0, 1);
6723 # endif /* _FFR_USE_SEM_LOCKING */
6724 		QSHM_ENTRIES(idx) += count;
6725 # if _FFR_USE_SEM_LOCKING
6726 		if (r >= 0)
6727 			r = sm_sem_rel(SemId, 0, 1);
6728 # endif /* _FFR_USE_SEM_LOCKING */
6729 	}
6730 
6731 	fidx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_fsysidx;
6732 	if (fidx < 0)
6733 		return;
6734 
6735 	/* update available space also?  (might be loseqfile) */
6736 	if (space == 0)
6737 		return;
6738 
6739 	/* convert size to blocks; this causes rounding errors */
6740 	s = e->e_msgsize / FILE_SYS_BLKSIZE(fidx);
6741 	if (s == 0)
6742 		return;
6743 
6744 	/* XXX in theory this needs to be protected with a mutex */
6745 	if (space > 0)
6746 		FILE_SYS_AVAIL(fidx) += s;
6747 	else
6748 		FILE_SYS_AVAIL(fidx) -= s;
6749 
6750 }
6751 
6752 static bool write_key_file __P((char *, long));
6753 static long read_key_file __P((char *, long));
6754 
6755 /*
6756 **  WRITE_KEY_FILE -- record some key into a file.
6757 **
6758 **	Parameters:
6759 **		keypath -- file name.
6760 **		key -- key to write.
6761 **
6762 **	Returns:
6763 **		true iff file could be written.
6764 **
6765 **	Side Effects:
6766 **		writes file.
6767 */
6768 
6769 static bool
6770 write_key_file(keypath, key)
6771 	char *keypath;
6772 	long key;
6773 {
6774 	bool ok;
6775 	long sff;
6776 	SM_FILE_T *keyf;
6777 
6778 	ok = false;
6779 	if (keypath == NULL || *keypath == '\0')
6780 		return ok;
6781 	sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY|SFF_CREAT;
6782 	if (TrustedUid != 0 && RealUid == TrustedUid)
6783 		sff |= SFF_OPENASROOT;
6784 	keyf = safefopen(keypath, O_WRONLY|O_TRUNC, FileMode, sff);
6785 	if (keyf == NULL)
6786 	{
6787 		sm_syslog(LOG_ERR, NOQID, "unable to write %s: %s",
6788 			  keypath, sm_errstring(errno));
6789 	}
6790 	else
6791 	{
6792 		if (geteuid() == 0 && RunAsUid != 0)
6793 		{
6794 #  if HASFCHOWN
6795 			int fd;
6796 
6797 			fd = keyf->f_file;
6798 			if (fd >= 0 && fchown(fd, RunAsUid, -1) < 0)
6799 			{
6800 				int err = errno;
6801 
6802 				sm_syslog(LOG_ALERT, NOQID,
6803 					  "ownership change on %s to %d failed: %s",
6804 					  keypath, RunAsUid, sm_errstring(err));
6805 			}
6806 #  endif /* HASFCHOWN */
6807 		}
6808 		ok = sm_io_fprintf(keyf, SM_TIME_DEFAULT, "%ld\n", key) !=
6809 		     SM_IO_EOF;
6810 		ok = (sm_io_close(keyf, SM_TIME_DEFAULT) != SM_IO_EOF) && ok;
6811 	}
6812 	return ok;
6813 }
6814 
6815 /*
6816 **  READ_KEY_FILE -- read a key from a file.
6817 **
6818 **	Parameters:
6819 **		keypath -- file name.
6820 **		key -- default key.
6821 **
6822 **	Returns:
6823 **		key.
6824 */
6825 
6826 static long
6827 read_key_file(keypath, key)
6828 	char *keypath;
6829 	long key;
6830 {
6831 	int r;
6832 	long sff, n;
6833 	SM_FILE_T *keyf;
6834 
6835 	if (keypath == NULL || *keypath == '\0')
6836 		return key;
6837 	sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY;
6838 	if (RealUid == 0 || (TrustedUid != 0 && RealUid == TrustedUid))
6839 		sff |= SFF_OPENASROOT;
6840 	keyf = safefopen(keypath, O_RDONLY, FileMode, sff);
6841 	if (keyf == NULL)
6842 	{
6843 		sm_syslog(LOG_ERR, NOQID, "unable to read %s: %s",
6844 			  keypath, sm_errstring(errno));
6845 	}
6846 	else
6847 	{
6848 		r = sm_io_fscanf(keyf, SM_TIME_DEFAULT, "%ld", &n);
6849 		if (r == 1)
6850 			key = n;
6851 		(void) sm_io_close(keyf, SM_TIME_DEFAULT);
6852 	}
6853 	return key;
6854 }
6855 
6856 /*
6857 **  INIT_SHM -- initialize shared memory structure
6858 **
6859 **	Initialize or attach to shared memory segment.
6860 **	Currently it is not a fatal error if this doesn't work.
6861 **	However, it causes us to have a "fallback" storage location
6862 **	for everything that is supposed to be in the shared memory,
6863 **	which makes the code slightly ugly.
6864 **
6865 **	Parameters:
6866 **		qn -- number of queue directories.
6867 **		owner -- owner of shared memory.
6868 **		hash -- identifies data that is stored in shared memory.
6869 **
6870 **	Returns:
6871 **		none.
6872 */
6873 
6874 static void init_shm __P((int, bool, unsigned int));
6875 
6876 static void
6877 init_shm(qn, owner, hash)
6878 	int qn;
6879 	bool owner;
6880 	unsigned int hash;
6881 {
6882 	int i;
6883 	int count;
6884 	int save_errno;
6885 	bool keyselect;
6886 
6887 	PtrFileSys = &FileSys[0];
6888 	PNumFileSys = &Numfilesys;
6889 /* if this "key" is specified: select one yourself */
6890 #define SEL_SHM_KEY	((key_t) -1)
6891 #define FIRST_SHM_KEY	25
6892 
6893 	/* This allows us to disable shared memory at runtime. */
6894 	if (ShmKey == 0)
6895 		return;
6896 
6897 	count = 0;
6898 	shms = SM_T_SIZE + qn * sizeof(QUEUE_SHM_T);
6899 	keyselect = ShmKey == SEL_SHM_KEY;
6900 	if (keyselect)
6901 	{
6902 		if (owner)
6903 			ShmKey = FIRST_SHM_KEY;
6904 		else
6905 		{
6906 			errno = 0;
6907 			ShmKey = read_key_file(ShmKeyFile, ShmKey);
6908 			keyselect = false;
6909 			if (ShmKey == SEL_SHM_KEY)
6910 			{
6911 				save_errno = (errno != 0) ? errno : EINVAL;
6912 				goto error;
6913 			}
6914 		}
6915 	}
6916 	for (;;)
6917 	{
6918 		/* allow read/write access for group? */
6919 		Pshm = sm_shmstart(ShmKey, shms,
6920 				SHM_R|SHM_W|(SHM_R>>3)|(SHM_W>>3),
6921 				&ShmId, owner);
6922 		save_errno = errno;
6923 		if (Pshm != NULL || !sm_file_exists(save_errno))
6924 			break;
6925 		if (++count >= 3)
6926 		{
6927 			if (keyselect)
6928 			{
6929 				++ShmKey;
6930 
6931 				/* back where we started? */
6932 				if (ShmKey == SEL_SHM_KEY)
6933 					break;
6934 				continue;
6935 			}
6936 			break;
6937 		}
6938 
6939 		/* only sleep if we are at the first key */
6940 		if (!keyselect || ShmKey == SEL_SHM_KEY)
6941 			sleep(count);
6942 	}
6943 	if (Pshm != NULL)
6944 	{
6945 		int *p;
6946 
6947 		if (keyselect)
6948 			(void) write_key_file(ShmKeyFile, (long) ShmKey);
6949 		if (owner && RunAsUid != 0)
6950 		{
6951 			i = sm_shmsetowner(ShmId, RunAsUid, RunAsGid, 0660);
6952 			if (i != 0)
6953 				sm_syslog(LOG_ERR, NOQID,
6954 					"key=%ld, sm_shmsetowner=%d, RunAsUid=%d, RunAsGid=%d",
6955 					(long) ShmKey, i, RunAsUid, RunAsGid);
6956 		}
6957 		p = (int *) Pshm;
6958 		if (owner)
6959 		{
6960 			*p = (int) shms;
6961 			*((pid_t *) SHM_OFF_PID(Pshm)) = CurrentPid;
6962 			p = (int *) SHM_OFF_TAG(Pshm);
6963 			*p = hash;
6964 		}
6965 		else
6966 		{
6967 			if (*p != (int) shms)
6968 			{
6969 				save_errno = EINVAL;
6970 				cleanup_shm(false);
6971 				goto error;
6972 			}
6973 			p = (int *) SHM_OFF_TAG(Pshm);
6974 			if (*p != (int) hash)
6975 			{
6976 				save_errno = EINVAL;
6977 				cleanup_shm(false);
6978 				goto error;
6979 			}
6980 
6981 			/*
6982 			**  XXX how to check the pid?
6983 			**  Read it from the pid-file? That does
6984 			**  not need to exist.
6985 			**  We could disable shm if we can't confirm
6986 			**  that it is the right one.
6987 			*/
6988 		}
6989 
6990 		PtrFileSys = (FILESYS *) OFF_FILE_SYS(Pshm);
6991 		PNumFileSys = (int *) OFF_NUM_FILE_SYS(Pshm);
6992 		QShm = (QUEUE_SHM_T *) OFF_QUEUE_SHM(Pshm);
6993 		PRSATmpCnt = (int *) OFF_RSA_TMP_CNT(Pshm);
6994 		*PRSATmpCnt = 0;
6995 		if (owner)
6996 		{
6997 			/* initialize values in shared memory */
6998 			NumFileSys = 0;
6999 			for (i = 0; i < qn; i++)
7000 				QShm[i].qs_entries = -1;
7001 		}
7002 		init_sem(owner);
7003 		return;
7004 	}
7005   error:
7006 	if (LogLevel > (owner ? 8 : 11))
7007 	{
7008 		sm_syslog(owner ? LOG_ERR : LOG_NOTICE, NOQID,
7009 			  "can't %s shared memory, key=%ld: %s",
7010 			  owner ? "initialize" : "attach to",
7011 			  (long) ShmKey, sm_errstring(save_errno));
7012 	}
7013 }
7014 #endif /* SM_CONF_SHM */
7015 
7016 
7017 /*
7018 **  SETUP_QUEUES -- set up all queue groups
7019 **
7020 **	Parameters:
7021 **		owner -- owner of shared memory?
7022 **
7023 **	Returns:
7024 **		none.
7025 **
7026 #if SM_CONF_SHM
7027 **	Side Effects:
7028 **		attaches shared memory.
7029 #endif * SM_CONF_SHM *
7030 */
7031 
7032 void
7033 setup_queues(owner)
7034 	bool owner;
7035 {
7036 	int i, qn, len;
7037 	unsigned int hashval;
7038 	time_t now;
7039 	char basedir[MAXPATHLEN];
7040 	struct stat st;
7041 
7042 	/*
7043 	**  Determine basedir for all queue directories.
7044 	**  All queue directories must be (first level) subdirectories
7045 	**  of the basedir.  The basedir is the QueueDir
7046 	**  without wildcards, but with trailing /
7047 	*/
7048 
7049 	hashval = 0;
7050 	errno = 0;
7051 	len = sm_strlcpy(basedir, QueueDir, sizeof(basedir));
7052 
7053 	/* Provide space for trailing '/' */
7054 	if (len >= sizeof(basedir) - 1)
7055 	{
7056 		syserr("QueueDirectory: path too long: %d,  max %d",
7057 			len, (int) sizeof(basedir) - 1);
7058 		ExitStat = EX_CONFIG;
7059 		return;
7060 	}
7061 	SM_ASSERT(len > 0);
7062 	if (basedir[len - 1] == '*')
7063 	{
7064 		char *cp;
7065 
7066 		cp = SM_LAST_DIR_DELIM(basedir);
7067 		if (cp == NULL)
7068 		{
7069 			syserr("QueueDirectory: can not wildcard relative path \"%s\"",
7070 				QueueDir);
7071 			if (tTd(41, 2))
7072 				sm_dprintf("setup_queues: \"%s\": Can not wildcard relative path.\n",
7073 					QueueDir);
7074 			ExitStat = EX_CONFIG;
7075 			return;
7076 		}
7077 
7078 		/* cut off wildcard pattern */
7079 		*++cp = '\0';
7080 		len = cp - basedir;
7081 	}
7082 	else if (!SM_IS_DIR_DELIM(basedir[len - 1]))
7083 	{
7084 		/* append trailing slash since it is a directory */
7085 		basedir[len] = '/';
7086 		basedir[++len] = '\0';
7087 	}
7088 
7089 	/* len counts up to the last directory delimiter */
7090 	SM_ASSERT(basedir[len - 1] == '/');
7091 
7092 	if (chdir(basedir) < 0)
7093 	{
7094 		int save_errno = errno;
7095 
7096 		syserr("can not chdir(%s)", basedir);
7097 		if (save_errno == EACCES)
7098 			(void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT,
7099 				"Program mode requires special privileges, e.g., root or TrustedUser.\n");
7100 		if (tTd(41, 2))
7101 			sm_dprintf("setup_queues: \"%s\": %s\n",
7102 				   basedir, sm_errstring(errno));
7103 		ExitStat = EX_CONFIG;
7104 		return;
7105 	}
7106 #if SM_CONF_SHM
7107 	hashval = hash_q(basedir, hashval);
7108 #endif /* SM_CONF_SHM */
7109 
7110 	/* initialize for queue runs */
7111 	DoQueueRun = false;
7112 	now = curtime();
7113 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
7114 		Queue[i]->qg_nextrun = now;
7115 
7116 
7117 	if (UseMSP && OpMode != MD_TEST)
7118 	{
7119 		long sff = SFF_CREAT;
7120 
7121 		if (stat(".", &st) < 0)
7122 		{
7123 			syserr("can not stat(%s)", basedir);
7124 			if (tTd(41, 2))
7125 				sm_dprintf("setup_queues: \"%s\": %s\n",
7126 					   basedir, sm_errstring(errno));
7127 			ExitStat = EX_CONFIG;
7128 			return;
7129 		}
7130 		if (RunAsUid == 0)
7131 			sff |= SFF_ROOTOK;
7132 
7133 		/*
7134 		**  Check queue directory permissions.
7135 		**	Can we write to a group writable queue directory?
7136 		*/
7137 
7138 		if (bitset(S_IWGRP, QueueFileMode) &&
7139 		    bitset(S_IWGRP, st.st_mode) &&
7140 		    safefile(" ", RunAsUid, RunAsGid, RunAsUserName, sff,
7141 			     QueueFileMode, NULL) != 0)
7142 		{
7143 			syserr("can not write to queue directory %s (RunAsGid=%d, required=%d)",
7144 				basedir, (int) RunAsGid, (int) st.st_gid);
7145 		}
7146 		if (bitset(S_IWOTH|S_IXOTH, st.st_mode))
7147 		{
7148 #if _FFR_MSP_PARANOIA
7149 			syserr("dangerous permissions=%o on queue directory %s",
7150 				(int) st.st_mode, basedir);
7151 #else /* _FFR_MSP_PARANOIA */
7152 			if (LogLevel > 0)
7153 				sm_syslog(LOG_ERR, NOQID,
7154 					  "dangerous permissions=%o on queue directory %s",
7155 					  (int) st.st_mode, basedir);
7156 #endif /* _FFR_MSP_PARANOIA */
7157 		}
7158 #if _FFR_MSP_PARANOIA
7159 		if (NumQueue > 1)
7160 			syserr("can not use multiple queues for MSP");
7161 #endif /* _FFR_MSP_PARANOIA */
7162 	}
7163 
7164 	/* initial number of queue directories */
7165 	qn = 0;
7166 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
7167 		qn = multiqueue_cache(basedir, len, Queue[i], qn, &hashval);
7168 
7169 #if SM_CONF_SHM
7170 	init_shm(qn, owner, hashval);
7171 	i = filesys_setup(owner || ShmId == SM_SHM_NO_ID);
7172 	if (i == FSF_NOT_FOUND)
7173 	{
7174 		/*
7175 		**  We didn't get the right filesystem data
7176 		**  This may happen if we don't have the right shared memory.
7177 		**  So let's do this without shared memory.
7178 		*/
7179 
7180 		SM_ASSERT(!owner);
7181 		cleanup_shm(false);	/* release shared memory */
7182 		i = filesys_setup(false);
7183 		if (i < 0)
7184 			syserr("filesys_setup failed twice, result=%d", i);
7185 		else if (LogLevel > 8)
7186 			sm_syslog(LOG_WARNING, NOQID,
7187 				  "shared memory does not contain expected data, ignored");
7188 	}
7189 #else /* SM_CONF_SHM */
7190 	i = filesys_setup(true);
7191 #endif /* SM_CONF_SHM */
7192 	if (i < 0)
7193 		ExitStat = EX_CONFIG;
7194 }
7195 
7196 #if SM_CONF_SHM
7197 /*
7198 **  CLEANUP_SHM -- do some cleanup work for shared memory etc
7199 **
7200 **	Parameters:
7201 **		owner -- owner of shared memory?
7202 **
7203 **	Returns:
7204 **		none.
7205 **
7206 **	Side Effects:
7207 **		detaches shared memory.
7208 */
7209 
7210 void
7211 cleanup_shm(owner)
7212 	bool owner;
7213 {
7214 	if (ShmId != SM_SHM_NO_ID)
7215 	{
7216 		if (sm_shmstop(Pshm, ShmId, owner) < 0 && LogLevel > 8)
7217 			sm_syslog(LOG_INFO, NOQID, "sm_shmstop failed=%s",
7218 				  sm_errstring(errno));
7219 		Pshm = NULL;
7220 		ShmId = SM_SHM_NO_ID;
7221 	}
7222 	stop_sem(owner);
7223 }
7224 #endif /* SM_CONF_SHM */
7225 
7226 /*
7227 **  CLEANUP_QUEUES -- do some cleanup work for queues
7228 **
7229 **	Parameters:
7230 **		none.
7231 **
7232 **	Returns:
7233 **		none.
7234 **
7235 */
7236 
7237 void
7238 cleanup_queues()
7239 {
7240 	sync_queue_time();
7241 }
7242 /*
7243 **  SET_DEF_QUEUEVAL -- set default values for a queue group.
7244 **
7245 **	Parameters:
7246 **		qg -- queue group
7247 **		all -- set all values (true for default group)?
7248 **
7249 **	Returns:
7250 **		none.
7251 **
7252 **	Side Effects:
7253 **		sets default values for the queue group.
7254 */
7255 
7256 void
7257 set_def_queueval(qg, all)
7258 	QUEUEGRP *qg;
7259 	bool all;
7260 {
7261 	if (bitnset(QD_DEFINED, qg->qg_flags))
7262 		return;
7263 	if (all)
7264 		qg->qg_qdir = QueueDir;
7265 #if _FFR_QUEUE_GROUP_SORTORDER
7266 	qg->qg_sortorder = QueueSortOrder;
7267 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7268 	qg->qg_maxqrun = all ? MaxRunnersPerQueue : -1;
7269 	qg->qg_nice = NiceQueueRun;
7270 }
7271 /*
7272 **  MAKEQUEUE -- define a new queue.
7273 **
7274 **	Parameters:
7275 **		line -- description of queue.  This is in labeled fields.
7276 **			The fields are:
7277 **			   F -- the flags associated with the queue
7278 **			   I -- the interval between running the queue
7279 **			   J -- the maximum # of jobs in work list
7280 **			   [M -- the maximum # of jobs in a queue run]
7281 **			   N -- the niceness at which to run
7282 **			   P -- the path to the queue
7283 **			   S -- the queue sorting order
7284 **			   R -- number of parallel queue runners
7285 **			   r -- max recipients per envelope
7286 **			The first word is the canonical name of the queue.
7287 **		qdef -- this is a 'Q' definition from .cf
7288 **
7289 **	Returns:
7290 **		none.
7291 **
7292 **	Side Effects:
7293 **		enters the queue into the queue table.
7294 */
7295 
7296 void
7297 makequeue(line, qdef)
7298 	char *line;
7299 	bool qdef;
7300 {
7301 	register char *p;
7302 	register QUEUEGRP *qg;
7303 	register STAB *s;
7304 	int i;
7305 	char fcode;
7306 
7307 	/* allocate a queue and set up defaults */
7308 	qg = (QUEUEGRP *) xalloc(sizeof(*qg));
7309 	memset((char *) qg, '\0', sizeof(*qg));
7310 
7311 	if (line[0] == '\0')
7312 	{
7313 		syserr("name required for queue");
7314 		return;
7315 	}
7316 
7317 	/* collect the queue name */
7318 	for (p = line;
7319 	     *p != '\0' && *p != ',' && !(isascii(*p) && isspace(*p));
7320 	     p++)
7321 		continue;
7322 	if (*p != '\0')
7323 		*p++ = '\0';
7324 	qg->qg_name = newstr(line);
7325 
7326 	/* set default values, can be overridden below */
7327 	set_def_queueval(qg, false);
7328 
7329 	/* now scan through and assign info from the fields */
7330 	while (*p != '\0')
7331 	{
7332 		auto char *delimptr;
7333 
7334 		while (*p != '\0' &&
7335 		       (*p == ',' || (isascii(*p) && isspace(*p))))
7336 			p++;
7337 
7338 		/* p now points to field code */
7339 		fcode = *p;
7340 		while (*p != '\0' && *p != '=' && *p != ',')
7341 			p++;
7342 		if (*p++ != '=')
7343 		{
7344 			syserr("queue %s: `=' expected", qg->qg_name);
7345 			return;
7346 		}
7347 		while (isascii(*p) && isspace(*p))
7348 			p++;
7349 
7350 		/* p now points to the field body */
7351 		p = munchstring(p, &delimptr, ',');
7352 
7353 		/* install the field into the queue struct */
7354 		switch (fcode)
7355 		{
7356 		  case 'P':		/* pathname */
7357 			if (*p == '\0')
7358 				syserr("queue %s: empty path name",
7359 					qg->qg_name);
7360 			else
7361 				qg->qg_qdir = newstr(p);
7362 			break;
7363 
7364 		  case 'F':		/* flags */
7365 			for (; *p != '\0'; p++)
7366 				if (!(isascii(*p) && isspace(*p)))
7367 					setbitn(*p, qg->qg_flags);
7368 			break;
7369 
7370 			/*
7371 			**  Do we need two intervals here:
7372 			**  One for persistent queue runners,
7373 			**  one for "normal" queue runs?
7374 			*/
7375 
7376 		  case 'I':	/* interval between running the queue */
7377 			qg->qg_queueintvl = convtime(p, 'm');
7378 			break;
7379 
7380 		  case 'N':		/* run niceness */
7381 			qg->qg_nice = atoi(p);
7382 			break;
7383 
7384 		  case 'R':		/* maximum # of runners for the group */
7385 			i = atoi(p);
7386 
7387 			/* can't have more runners than allowed total */
7388 			if (MaxQueueChildren > 0 && i > MaxQueueChildren)
7389 			{
7390 				qg->qg_maxqrun = MaxQueueChildren;
7391 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7392 						     "Q=%s: R=%d exceeds MaxQueueChildren=%d, set to MaxQueueChildren\n",
7393 						     qg->qg_name, i,
7394 						     MaxQueueChildren);
7395 			}
7396 			else
7397 				qg->qg_maxqrun = i;
7398 			break;
7399 
7400 		  case 'J':		/* maximum # of jobs in work list */
7401 			qg->qg_maxlist = atoi(p);
7402 			break;
7403 
7404 		  case 'r':		/* max recipients per envelope */
7405 			qg->qg_maxrcpt = atoi(p);
7406 			break;
7407 
7408 #if _FFR_QUEUE_GROUP_SORTORDER
7409 		  case 'S':		/* queue sorting order */
7410 			switch (*p)
7411 			{
7412 			  case 'h':	/* Host first */
7413 			  case 'H':
7414 				qg->qg_sortorder = QSO_BYHOST;
7415 				break;
7416 
7417 			  case 'p':	/* Priority order */
7418 			  case 'P':
7419 				qg->qg_sortorder = QSO_BYPRIORITY;
7420 				break;
7421 
7422 			  case 't':	/* Submission time */
7423 			  case 'T':
7424 				qg->qg_sortorder = QSO_BYTIME;
7425 				break;
7426 
7427 			  case 'f':	/* File name */
7428 			  case 'F':
7429 				qg->qg_sortorder = QSO_BYFILENAME;
7430 				break;
7431 
7432 			  case 'm':	/* Modification time */
7433 			  case 'M':
7434 				qg->qg_sortorder = QSO_BYMODTIME;
7435 				break;
7436 
7437 			  case 'r':	/* Random */
7438 			  case 'R':
7439 				qg->qg_sortorder = QSO_RANDOM;
7440 				break;
7441 
7442 # if _FFR_RHS
7443 			  case 's':	/* Shuffled host name */
7444 			  case 'S':
7445 				qg->qg_sortorder = QSO_BYSHUFFLE;
7446 				break;
7447 # endif /* _FFR_RHS */
7448 
7449 			  case 'n':	/* none */
7450 			  case 'N':
7451 				qg->qg_sortorder = QSO_NONE;
7452 				break;
7453 
7454 			  default:
7455 				syserr("Invalid queue sort order \"%s\"", p);
7456 			}
7457 			break;
7458 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7459 
7460 		  default:
7461 			syserr("Q%s: unknown queue equate %c=",
7462 			       qg->qg_name, fcode);
7463 			break;
7464 		}
7465 
7466 		p = delimptr;
7467 	}
7468 
7469 #if !HASNICE
7470 	if (qg->qg_nice != NiceQueueRun)
7471 	{
7472 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7473 				     "Q%s: Warning: N= set on system that doesn't support nice()\n",
7474 				     qg->qg_name);
7475 	}
7476 #endif /* !HASNICE */
7477 
7478 	/* do some rationality checking */
7479 	if (NumQueue >= MAXQUEUEGROUPS)
7480 	{
7481 		syserr("too many queue groups defined (%d max)",
7482 			MAXQUEUEGROUPS);
7483 		return;
7484 	}
7485 
7486 	if (qg->qg_qdir == NULL)
7487 	{
7488 		if (QueueDir == NULL || *QueueDir == '\0')
7489 		{
7490 			syserr("QueueDir must be defined before queue groups");
7491 			return;
7492 		}
7493 		qg->qg_qdir = newstr(QueueDir);
7494 	}
7495 
7496 	if (qg->qg_maxqrun > 1 && !bitnset(QD_FORK, qg->qg_flags))
7497 	{
7498 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7499 				     "Warning: Q=%s: R=%d: multiple queue runners specified\n\tbut flag '%c' is not set\n",
7500 				     qg->qg_name, qg->qg_maxqrun, QD_FORK);
7501 	}
7502 
7503 	/* enter the queue into the symbol table */
7504 	if (tTd(37, 8))
7505 		sm_syslog(LOG_INFO, NOQID,
7506 			  "Adding %s to stab, path: %s", qg->qg_name,
7507 			  qg->qg_qdir);
7508 	s = stab(qg->qg_name, ST_QUEUE, ST_ENTER);
7509 	if (s->s_quegrp != NULL)
7510 	{
7511 		i = s->s_quegrp->qg_index;
7512 
7513 		/* XXX what about the pointers inside this struct? */
7514 		sm_free(s->s_quegrp); /* XXX */
7515 	}
7516 	else
7517 		i = NumQueue++;
7518 	Queue[i] = s->s_quegrp = qg;
7519 	qg->qg_index = i;
7520 
7521 	/* set default value for max queue runners */
7522 	if (qg->qg_maxqrun < 0)
7523 	{
7524 		if (MaxRunnersPerQueue > 0)
7525 			qg->qg_maxqrun = MaxRunnersPerQueue;
7526 		else
7527 			qg->qg_maxqrun = 1;
7528 	}
7529 	if (qdef)
7530 		setbitn(QD_DEFINED, qg->qg_flags);
7531 }
7532 #if 0
7533 /*
7534 **  HASHFQN -- calculate a hash value for a fully qualified host name
7535 **
7536 **	Arguments:
7537 **		fqn -- an all lower-case host.domain string
7538 **		buckets -- the number of buckets (queue directories)
7539 **
7540 **	Returns:
7541 **		a bucket number (signed integer)
7542 **		-1 on error
7543 **
7544 **	Contributed by Exactis.com, Inc.
7545 */
7546 
7547 int
7548 hashfqn(fqn, buckets)
7549 	register char *fqn;
7550 	int buckets;
7551 {
7552 	register char *p;
7553 	register int h = 0, hash, cnt;
7554 
7555 	if (fqn == NULL)
7556 		return -1;
7557 
7558 	/*
7559 	**  A variation on the gdb hash
7560 	**  This is the best as of Feb 19, 1996 --bcx
7561 	*/
7562 
7563 	p = fqn;
7564 	h = 0x238F13AF * strlen(p);
7565 	for (cnt = 0; *p != 0; ++p, cnt++)
7566 	{
7567 		h = (h + (*p << (cnt * 5 % 24))) & 0x7FFFFFFF;
7568 	}
7569 	h = (1103515243 * h + 12345) & 0x7FFFFFFF;
7570 	if (buckets < 2)
7571 		hash = 0;
7572 	else
7573 		hash = (h % buckets);
7574 
7575 	return hash;
7576 }
7577 #endif /* 0 */
7578 
7579 /*
7580 **  A structure for sorting Queue according to maxqrun without
7581 **	screwing up Queue itself.
7582 */
7583 
7584 struct sortqgrp
7585 {
7586 	int sg_idx;		/* original index */
7587 	int sg_maxqrun;		/* max queue runners */
7588 };
7589 typedef struct sortqgrp	SORTQGRP_T;
7590 static int cmpidx __P((const void *, const void *));
7591 
7592 static int
7593 cmpidx(a, b)
7594 	const void *a;
7595 	const void *b;
7596 {
7597 	/* The sort is highest to lowest, so the comparison is reversed */
7598 	if (((SORTQGRP_T *)a)->sg_maxqrun < ((SORTQGRP_T *)b)->sg_maxqrun)
7599 		return 1;
7600 	else if (((SORTQGRP_T *)a)->sg_maxqrun > ((SORTQGRP_T *)b)->sg_maxqrun)
7601 		return -1;
7602 	else
7603 		return 0;
7604 }
7605 
7606 /*
7607 **  MAKEWORKGROUP -- balance queue groups into work groups per MaxQueueChildren
7608 **
7609 **  Take the now defined queue groups and assign them to work groups.
7610 **  This is done to balance out the number of concurrently active
7611 **  queue runners such that MaxQueueChildren is not exceeded. This may
7612 **  result in more than one queue group per work group. In such a case
7613 **  the number of running queue groups in that work group will have no
7614 **  more than the work group maximum number of runners (a "fair" portion
7615 **  of MaxQueueRunners). All queue groups within a work group will get a
7616 **  chance at running.
7617 **
7618 **	Parameters:
7619 **		none.
7620 **
7621 **	Returns:
7622 **		nothing.
7623 **
7624 **	Side Effects:
7625 **		Sets up WorkGrp structure.
7626 */
7627 
7628 void
7629 makeworkgroups()
7630 {
7631 	int i, j, total_runners, dir, h;
7632 	SORTQGRP_T si[MAXQUEUEGROUPS + 1];
7633 
7634 	total_runners = 0;
7635 	if (NumQueue == 1 && strcmp(Queue[0]->qg_name, "mqueue") == 0)
7636 	{
7637 		/*
7638 		**  There is only the "mqueue" queue group (a default)
7639 		**  containing all of the queues. We want to provide to
7640 		**  this queue group the maximum allowable queue runners.
7641 		**  To match older behavior (8.10/8.11) we'll try for
7642 		**  1 runner per queue capping it at MaxQueueChildren.
7643 		**  So if there are N queues, then there will be N runners
7644 		**  for the "mqueue" queue group (where N is kept less than
7645 		**  MaxQueueChildren).
7646 		*/
7647 
7648 		NumWorkGroups = 1;
7649 		WorkGrp[0].wg_numqgrp = 1;
7650 		WorkGrp[0].wg_qgs = (QUEUEGRP **) xalloc(sizeof(QUEUEGRP *));
7651 		WorkGrp[0].wg_qgs[0] = Queue[0];
7652 		if (MaxQueueChildren > 0 &&
7653 		    Queue[0]->qg_numqueues > MaxQueueChildren)
7654 			WorkGrp[0].wg_runners = MaxQueueChildren;
7655 		else
7656 			WorkGrp[0].wg_runners = Queue[0]->qg_numqueues;
7657 
7658 		Queue[0]->qg_wgrp = 0;
7659 
7660 		/* can't have more runners than allowed total */
7661 		if (MaxQueueChildren > 0 &&
7662 		    Queue[0]->qg_maxqrun > MaxQueueChildren)
7663 			Queue[0]->qg_maxqrun = MaxQueueChildren;
7664 		WorkGrp[0].wg_maxact = Queue[0]->qg_maxqrun;
7665 		WorkGrp[0].wg_lowqintvl = Queue[0]->qg_queueintvl;
7666 		return;
7667 	}
7668 
7669 	for (i = 0; i < NumQueue; i++)
7670 	{
7671 		si[i].sg_maxqrun = Queue[i]->qg_maxqrun;
7672 		si[i].sg_idx = i;
7673 	}
7674 	qsort(si, NumQueue, sizeof(si[0]), cmpidx);
7675 
7676 	NumWorkGroups = 0;
7677 	for (i = 0; i < NumQueue; i++)
7678 	{
7679 		total_runners += si[i].sg_maxqrun;
7680 		if (MaxQueueChildren <= 0 || total_runners <= MaxQueueChildren)
7681 			NumWorkGroups++;
7682 		else
7683 			break;
7684 	}
7685 
7686 	if (NumWorkGroups < 1)
7687 		NumWorkGroups = 1; /* gotta have one at least */
7688 	else if (NumWorkGroups > MAXWORKGROUPS)
7689 		NumWorkGroups = MAXWORKGROUPS; /* the limit */
7690 
7691 	/*
7692 	**  We now know the number of work groups to pack the queue groups
7693 	**  into. The queue groups in 'Queue' are sorted from highest
7694 	**  to lowest for the number of runners per queue group.
7695 	**  We put the queue groups with the largest number of runners
7696 	**  into work groups first. Then the smaller ones are fitted in
7697 	**  where it looks best.
7698 	*/
7699 
7700 	j = 0;
7701 	dir = 1;
7702 	for (i = 0; i < NumQueue; i++)
7703 	{
7704 		/* a to-and-fro packing scheme, continue from last position */
7705 		if (j >= NumWorkGroups)
7706 		{
7707 			dir = -1;
7708 			j = NumWorkGroups - 1;
7709 		}
7710 		else if (j < 0)
7711 		{
7712 			j = 0;
7713 			dir = 1;
7714 		}
7715 
7716 		if (WorkGrp[j].wg_qgs == NULL)
7717 			WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_malloc(sizeof(QUEUEGRP *) *
7718 							(WorkGrp[j].wg_numqgrp + 1));
7719 		else
7720 			WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_realloc(WorkGrp[j].wg_qgs,
7721 							sizeof(QUEUEGRP *) *
7722 							(WorkGrp[j].wg_numqgrp + 1));
7723 		if (WorkGrp[j].wg_qgs == NULL)
7724 		{
7725 			syserr("!cannot allocate memory for work queues, need %d bytes",
7726 			       (int) (sizeof(QUEUEGRP *) *
7727 				      (WorkGrp[j].wg_numqgrp + 1)));
7728 		}
7729 
7730 		h = si[i].sg_idx;
7731 		WorkGrp[j].wg_qgs[WorkGrp[j].wg_numqgrp] = Queue[h];
7732 		WorkGrp[j].wg_numqgrp++;
7733 		WorkGrp[j].wg_runners += Queue[h]->qg_maxqrun;
7734 		Queue[h]->qg_wgrp = j;
7735 
7736 		if (WorkGrp[j].wg_maxact == 0)
7737 		{
7738 			/* can't have more runners than allowed total */
7739 			if (MaxQueueChildren > 0 &&
7740 			    Queue[h]->qg_maxqrun > MaxQueueChildren)
7741 				Queue[h]->qg_maxqrun = MaxQueueChildren;
7742 			WorkGrp[j].wg_maxact = Queue[h]->qg_maxqrun;
7743 		}
7744 
7745 		/*
7746 		**  XXX: must wg_lowqintvl be the GCD?
7747 		**  qg1: 2m, qg2: 3m, minimum: 2m, when do queue runs for
7748 		**  qg2 occur?
7749 		*/
7750 
7751 		/* keep track of the lowest interval for a persistent runner */
7752 		if (Queue[h]->qg_queueintvl > 0 &&
7753 		    WorkGrp[j].wg_lowqintvl < Queue[h]->qg_queueintvl)
7754 			WorkGrp[j].wg_lowqintvl = Queue[h]->qg_queueintvl;
7755 		j += dir;
7756 	}
7757 	if (tTd(41, 9))
7758 	{
7759 		for (i = 0; i < NumWorkGroups; i++)
7760 		{
7761 			sm_dprintf("Workgroup[%d]=", i);
7762 			for (j = 0; j < WorkGrp[i].wg_numqgrp; j++)
7763 			{
7764 				sm_dprintf("%s, ",
7765 					WorkGrp[i].wg_qgs[j]->qg_name);
7766 			}
7767 			sm_dprintf("\n");
7768 		}
7769 	}
7770 }
7771 
7772 /*
7773 **  DUP_DF -- duplicate envelope data file
7774 **
7775 **	Copy the data file from the 'old' envelope to the 'new' envelope
7776 **	in the most efficient way possible.
7777 **
7778 **	Create a hard link from the 'old' data file to the 'new' data file.
7779 **	If the old and new queue directories are on different file systems,
7780 **	then the new data file link is created in the old queue directory,
7781 **	and the new queue file will contain a 'd' record pointing to the
7782 **	directory containing the new data file.
7783 **
7784 **	Parameters:
7785 **		old -- old envelope.
7786 **		new -- new envelope.
7787 **
7788 **	Results:
7789 **		Returns true on success, false on failure.
7790 **
7791 **	Side Effects:
7792 **		On success, the new data file is created.
7793 **		On fatal failure, EF_FATALERRS is set in old->e_flags.
7794 */
7795 
7796 static bool	dup_df __P((ENVELOPE *, ENVELOPE *));
7797 
7798 static bool
7799 dup_df(old, new)
7800 	ENVELOPE *old;
7801 	ENVELOPE *new;
7802 {
7803 	int ofs, nfs, r;
7804 	char opath[MAXPATHLEN];
7805 	char npath[MAXPATHLEN];
7806 
7807 	if (!bitset(EF_HAS_DF, old->e_flags))
7808 	{
7809 		/*
7810 		**  this can happen if: SuperSafe != True
7811 		**  and a bounce mail is sent that is split.
7812 		*/
7813 
7814 		queueup(old, false, true);
7815 	}
7816 	SM_REQUIRE(ISVALIDQGRP(old->e_qgrp) && ISVALIDQDIR(old->e_qdir));
7817 	SM_REQUIRE(ISVALIDQGRP(new->e_qgrp) && ISVALIDQDIR(new->e_qdir));
7818 
7819 	(void) sm_strlcpy(opath, queuename(old, DATAFL_LETTER), sizeof(opath));
7820 	(void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof(npath));
7821 
7822 	if (old->e_dfp != NULL)
7823 	{
7824 		r = sm_io_setinfo(old->e_dfp, SM_BF_COMMIT, NULL);
7825 		if (r < 0 && errno != EINVAL)
7826 		{
7827 			syserr("@can't commit %s", opath);
7828 			old->e_flags |= EF_FATALERRS;
7829 			return false;
7830 		}
7831 	}
7832 
7833 	/*
7834 	**  Attempt to create a hard link, if we think both old and new
7835 	**  are on the same file system, otherwise copy the file.
7836 	**
7837 	**  Don't waste time attempting a hard link unless old and new
7838 	**  are on the same file system.
7839 	*/
7840 
7841 	SM_REQUIRE(ISVALIDQGRP(old->e_dfqgrp) && ISVALIDQDIR(old->e_dfqdir));
7842 	SM_REQUIRE(ISVALIDQGRP(new->e_dfqgrp) && ISVALIDQDIR(new->e_dfqdir));
7843 
7844 	ofs = Queue[old->e_dfqgrp]->qg_qpaths[old->e_dfqdir].qp_fsysidx;
7845 	nfs = Queue[new->e_dfqgrp]->qg_qpaths[new->e_dfqdir].qp_fsysidx;
7846 	if (FILE_SYS_DEV(ofs) == FILE_SYS_DEV(nfs))
7847 	{
7848 		if (link(opath, npath) == 0)
7849 		{
7850 			new->e_flags |= EF_HAS_DF;
7851 			SYNC_DIR(npath, true);
7852 			return true;
7853 		}
7854 		goto error;
7855 	}
7856 
7857 	/*
7858 	**  Can't link across queue directories, so try to create a hard
7859 	**  link in the same queue directory as the old df file.
7860 	**  The qf file will refer to the new df file using a 'd' record.
7861 	*/
7862 
7863 	new->e_dfqgrp = old->e_dfqgrp;
7864 	new->e_dfqdir = old->e_dfqdir;
7865 	(void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof(npath));
7866 	if (link(opath, npath) == 0)
7867 	{
7868 		new->e_flags |= EF_HAS_DF;
7869 		SYNC_DIR(npath, true);
7870 		return true;
7871 	}
7872 
7873   error:
7874 	if (LogLevel > 0)
7875 		sm_syslog(LOG_ERR, old->e_id,
7876 			  "dup_df: can't link %s to %s, error=%s, envelope splitting failed",
7877 			  opath, npath, sm_errstring(errno));
7878 	return false;
7879 }
7880 
7881 /*
7882 **  SPLIT_ENV -- Allocate a new envelope based on a given envelope.
7883 **
7884 **	Parameters:
7885 **		e -- envelope.
7886 **		sendqueue -- sendqueue for new envelope.
7887 **		qgrp -- index of queue group.
7888 **		qdir -- queue directory.
7889 **
7890 **	Results:
7891 **		new envelope.
7892 **
7893 */
7894 
7895 static ENVELOPE	*split_env __P((ENVELOPE *, ADDRESS *, int, int));
7896 
7897 static ENVELOPE *
7898 split_env(e, sendqueue, qgrp, qdir)
7899 	ENVELOPE *e;
7900 	ADDRESS *sendqueue;
7901 	int qgrp;
7902 	int qdir;
7903 {
7904 	ENVELOPE *ee;
7905 
7906 	ee = (ENVELOPE *) sm_rpool_malloc_x(e->e_rpool, sizeof(*ee));
7907 	STRUCTCOPY(*e, *ee);
7908 	ee->e_message = NULL;	/* XXX use original message? */
7909 	ee->e_id = NULL;
7910 	assign_queueid(ee);
7911 	ee->e_sendqueue = sendqueue;
7912 	ee->e_flags &= ~(EF_INQUEUE|EF_CLRQUEUE|EF_FATALERRS
7913 			 |EF_SENDRECEIPT|EF_RET_PARAM|EF_HAS_DF);
7914 	ee->e_flags |= EF_NORECEIPT;	/* XXX really? */
7915 	ee->e_from.q_state = QS_SENDER;
7916 	ee->e_dfp = NULL;
7917 	ee->e_lockfp = NULL;
7918 	if (e->e_xfp != NULL)
7919 		ee->e_xfp = sm_io_dup(e->e_xfp);
7920 
7921 	/* failed to dup e->e_xfp, start a new transcript */
7922 	if (ee->e_xfp == NULL)
7923 		openxscript(ee);
7924 
7925 	ee->e_qgrp = ee->e_dfqgrp = qgrp;
7926 	ee->e_qdir = ee->e_dfqdir = qdir;
7927 	ee->e_errormode = EM_MAIL;
7928 	ee->e_statmsg = NULL;
7929 	if (e->e_quarmsg != NULL)
7930 		ee->e_quarmsg = sm_rpool_strdup_x(ee->e_rpool,
7931 						  e->e_quarmsg);
7932 
7933 	/*
7934 	**  XXX Not sure if this copying is necessary.
7935 	**  sendall() does this copying, but I (dm) don't know if that is
7936 	**  because of the storage management discipline we were using
7937 	**  before rpools were introduced, or if it is because these lists
7938 	**  can be modified later.
7939 	*/
7940 
7941 	ee->e_header = copyheader(e->e_header, ee->e_rpool);
7942 	ee->e_errorqueue = copyqueue(e->e_errorqueue, ee->e_rpool);
7943 
7944 	return ee;
7945 }
7946 
7947 /* return values from split functions, check also below! */
7948 #define SM_SPLIT_FAIL	(0)
7949 #define SM_SPLIT_NONE	(1)
7950 #define SM_SPLIT_NEW(n)	(1 + (n))
7951 
7952 /*
7953 **  SPLIT_ACROSS_QUEUE_GROUPS
7954 **
7955 **	This function splits an envelope across multiple queue groups
7956 **	based on the queue group of each recipient.
7957 **
7958 **	Parameters:
7959 **		e -- envelope.
7960 **
7961 **	Results:
7962 **		SM_SPLIT_FAIL on failure
7963 **		SM_SPLIT_NONE if no splitting occurred,
7964 **		or 1 + the number of additional envelopes created.
7965 **
7966 **	Side Effects:
7967 **		On success, e->e_sibling points to a list of zero or more
7968 **		additional envelopes, and the associated data files exist
7969 **		on disk.  But the queue files are not created.
7970 **
7971 **		On failure, e->e_sibling is not changed.
7972 **		The order of recipients in e->e_sendqueue is permuted.
7973 **		Abandoned data files for additional envelopes that failed
7974 **		to be created may exist on disk.
7975 */
7976 
7977 static int	q_qgrp_compare __P((const void *, const void *));
7978 static int	e_filesys_compare __P((const void *, const void *));
7979 
7980 static int
7981 q_qgrp_compare(p1, p2)
7982 	const void *p1;
7983 	const void *p2;
7984 {
7985 	ADDRESS **pq1 = (ADDRESS **) p1;
7986 	ADDRESS **pq2 = (ADDRESS **) p2;
7987 
7988 	return (*pq1)->q_qgrp - (*pq2)->q_qgrp;
7989 }
7990 
7991 static int
7992 e_filesys_compare(p1, p2)
7993 	const void *p1;
7994 	const void *p2;
7995 {
7996 	ENVELOPE **pe1 = (ENVELOPE **) p1;
7997 	ENVELOPE **pe2 = (ENVELOPE **) p2;
7998 	int fs1, fs2;
7999 
8000 	fs1 = Queue[(*pe1)->e_qgrp]->qg_qpaths[(*pe1)->e_qdir].qp_fsysidx;
8001 	fs2 = Queue[(*pe2)->e_qgrp]->qg_qpaths[(*pe2)->e_qdir].qp_fsysidx;
8002 	if (FILE_SYS_DEV(fs1) < FILE_SYS_DEV(fs2))
8003 		return -1;
8004 	if (FILE_SYS_DEV(fs1) > FILE_SYS_DEV(fs2))
8005 		return 1;
8006 	return 0;
8007 }
8008 
8009 static int split_across_queue_groups __P((ENVELOPE *));
8010 static int
8011 split_across_queue_groups(e)
8012 	ENVELOPE *e;
8013 {
8014 	int naddrs, nsplits, i;
8015 	bool changed;
8016 	char **pvp;
8017 	ADDRESS *q, **addrs;
8018 	ENVELOPE *ee, *es;
8019 	ENVELOPE *splits[MAXQUEUEGROUPS];
8020 	char pvpbuf[PSBUFSIZE];
8021 
8022 	SM_REQUIRE(ISVALIDQGRP(e->e_qgrp));
8023 
8024 	/* Count addresses and assign queue groups. */
8025 	naddrs = 0;
8026 	changed = false;
8027 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
8028 	{
8029 		if (QS_IS_DEAD(q->q_state))
8030 			continue;
8031 		++naddrs;
8032 
8033 		/* bad addresses and those already sent stay put */
8034 		if (QS_IS_BADADDR(q->q_state) ||
8035 		    QS_IS_SENT(q->q_state))
8036 			q->q_qgrp = e->e_qgrp;
8037 		else if (!ISVALIDQGRP(q->q_qgrp))
8038 		{
8039 			/* call ruleset which should return a queue group */
8040 			i = rscap(RS_QUEUEGROUP, q->q_user, NULL, e, &pvp,
8041 				  pvpbuf, sizeof(pvpbuf));
8042 			if (i == EX_OK &&
8043 			    pvp != NULL && pvp[0] != NULL &&
8044 			    (pvp[0][0] & 0377) == CANONNET &&
8045 			    pvp[1] != NULL && pvp[1][0] != '\0')
8046 			{
8047 				i = name2qid(pvp[1]);
8048 				if (ISVALIDQGRP(i))
8049 				{
8050 					q->q_qgrp = i;
8051 					changed = true;
8052 					if (tTd(20, 4))
8053 						sm_syslog(LOG_INFO, NOQID,
8054 							"queue group name %s -> %d",
8055 							pvp[1], i);
8056 					continue;
8057 				}
8058 				else if (LogLevel > 10)
8059 					sm_syslog(LOG_INFO, NOQID,
8060 						"can't find queue group name %s, selection ignored",
8061 						pvp[1]);
8062 			}
8063 			if (q->q_mailer != NULL &&
8064 			    ISVALIDQGRP(q->q_mailer->m_qgrp))
8065 			{
8066 				changed = true;
8067 				q->q_qgrp = q->q_mailer->m_qgrp;
8068 			}
8069 			else if (ISVALIDQGRP(e->e_qgrp))
8070 				q->q_qgrp = e->e_qgrp;
8071 			else
8072 				q->q_qgrp = 0;
8073 		}
8074 	}
8075 
8076 	/* only one address? nothing to split. */
8077 	if (naddrs <= 1 && !changed)
8078 		return SM_SPLIT_NONE;
8079 
8080 	/* sort the addresses by queue group */
8081 	addrs = sm_rpool_malloc_x(e->e_rpool, naddrs * sizeof(ADDRESS *));
8082 	for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8083 	{
8084 		if (QS_IS_DEAD(q->q_state))
8085 			continue;
8086 		addrs[i++] = q;
8087 	}
8088 	qsort(addrs, naddrs, sizeof(ADDRESS *), q_qgrp_compare);
8089 
8090 	/* split into multiple envelopes, by queue group */
8091 	nsplits = 0;
8092 	es = NULL;
8093 	e->e_sendqueue = NULL;
8094 	for (i = 0; i < naddrs; ++i)
8095 	{
8096 		if (i == naddrs - 1 || addrs[i]->q_qgrp != addrs[i + 1]->q_qgrp)
8097 			addrs[i]->q_next = NULL;
8098 		else
8099 			addrs[i]->q_next = addrs[i + 1];
8100 
8101 		/* same queue group as original envelope? */
8102 		if (addrs[i]->q_qgrp == e->e_qgrp)
8103 		{
8104 			if (e->e_sendqueue == NULL)
8105 				e->e_sendqueue = addrs[i];
8106 			continue;
8107 		}
8108 
8109 		/* different queue group than original envelope */
8110 		if (es == NULL || addrs[i]->q_qgrp != es->e_qgrp)
8111 		{
8112 			ee = split_env(e, addrs[i], addrs[i]->q_qgrp, NOQDIR);
8113 			es = ee;
8114 			splits[nsplits++] = ee;
8115 		}
8116 	}
8117 
8118 	/* no splits? return right now. */
8119 	if (nsplits <= 0)
8120 		return SM_SPLIT_NONE;
8121 
8122 	/* assign a queue directory to each additional envelope */
8123 	for (i = 0; i < nsplits; ++i)
8124 	{
8125 		es = splits[i];
8126 #if 0
8127 		es->e_qdir = pickqdir(Queue[es->e_qgrp], es->e_msgsize, es);
8128 #endif /* 0 */
8129 		if (!setnewqueue(es))
8130 			goto failure;
8131 	}
8132 
8133 	/* sort the additional envelopes by queue file system */
8134 	qsort(splits, nsplits, sizeof(ENVELOPE *), e_filesys_compare);
8135 
8136 	/* create data files for each additional envelope */
8137 	if (!dup_df(e, splits[0]))
8138 	{
8139 		i = 0;
8140 		goto failure;
8141 	}
8142 	for (i = 1; i < nsplits; ++i)
8143 	{
8144 		/* copy or link to the previous data file */
8145 		if (!dup_df(splits[i - 1], splits[i]))
8146 			goto failure;
8147 	}
8148 
8149 	/* success: prepend the new envelopes to the e->e_sibling list */
8150 	for (i = 0; i < nsplits; ++i)
8151 	{
8152 		es = splits[i];
8153 		es->e_sibling = e->e_sibling;
8154 		e->e_sibling = es;
8155 	}
8156 	return SM_SPLIT_NEW(nsplits);
8157 
8158 	/* failure: clean up */
8159   failure:
8160 	if (i > 0)
8161 	{
8162 		int j;
8163 
8164 		for (j = 0; j < i; j++)
8165 			(void) unlink(queuename(splits[j], DATAFL_LETTER));
8166 	}
8167 	e->e_sendqueue = addrs[0];
8168 	for (i = 0; i < naddrs - 1; ++i)
8169 		addrs[i]->q_next = addrs[i + 1];
8170 	addrs[naddrs - 1]->q_next = NULL;
8171 	return SM_SPLIT_FAIL;
8172 }
8173 
8174 /*
8175 **  SPLIT_WITHIN_QUEUE
8176 **
8177 **	Split an envelope with multiple recipients into several
8178 **	envelopes within the same queue directory, if the number of
8179 **	recipients exceeds the limit for the queue group.
8180 **
8181 **	Parameters:
8182 **		e -- envelope.
8183 **
8184 **	Results:
8185 **		SM_SPLIT_FAIL on failure
8186 **		SM_SPLIT_NONE if no splitting occurred,
8187 **		or 1 + the number of additional envelopes created.
8188 */
8189 
8190 #define SPLIT_LOG_LEVEL	8
8191 
8192 static int	split_within_queue __P((ENVELOPE *));
8193 
8194 static int
8195 split_within_queue(e)
8196 	ENVELOPE *e;
8197 {
8198 	int maxrcpt, nrcpt, ndead, nsplit, i;
8199 	int j, l;
8200 	char *lsplits;
8201 	ADDRESS *q, **addrs;
8202 	ENVELOPE *ee, *firstsibling;
8203 
8204 	if (!ISVALIDQGRP(e->e_qgrp) || bitset(EF_SPLIT, e->e_flags))
8205 		return SM_SPLIT_NONE;
8206 
8207 	/* don't bother if there is no recipient limit */
8208 	maxrcpt = Queue[e->e_qgrp]->qg_maxrcpt;
8209 	if (maxrcpt <= 0)
8210 		return SM_SPLIT_NONE;
8211 
8212 	/* count recipients */
8213 	nrcpt = 0;
8214 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
8215 	{
8216 		if (QS_IS_DEAD(q->q_state))
8217 			continue;
8218 		++nrcpt;
8219 	}
8220 	if (nrcpt <= maxrcpt)
8221 		return SM_SPLIT_NONE;
8222 
8223 	/*
8224 	**  Preserve the recipient list
8225 	**  so that we can restore it in case of error.
8226 	**  (But we discard dead addresses.)
8227 	*/
8228 
8229 	addrs = sm_rpool_malloc_x(e->e_rpool, nrcpt * sizeof(ADDRESS *));
8230 	for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8231 	{
8232 		if (QS_IS_DEAD(q->q_state))
8233 			continue;
8234 		addrs[i++] = q;
8235 	}
8236 
8237 	/*
8238 	**  Partition the recipient list so that bad and sent addresses
8239 	**  come first. These will go with the original envelope, and
8240 	**  do not count towards the maxrcpt limit.
8241 	**  addrs[] does not contain QS_IS_DEAD() addresses.
8242 	*/
8243 
8244 	ndead = 0;
8245 	for (i = 0; i < nrcpt; ++i)
8246 	{
8247 		if (QS_IS_BADADDR(addrs[i]->q_state) ||
8248 		    QS_IS_SENT(addrs[i]->q_state) ||
8249 		    QS_IS_DEAD(addrs[i]->q_state)) /* for paranoia's sake */
8250 		{
8251 			if (i > ndead)
8252 			{
8253 				ADDRESS *tmp = addrs[i];
8254 
8255 				addrs[i] = addrs[ndead];
8256 				addrs[ndead] = tmp;
8257 			}
8258 			++ndead;
8259 		}
8260 	}
8261 
8262 	/* Check if no splitting required. */
8263 	if (nrcpt - ndead <= maxrcpt)
8264 		return SM_SPLIT_NONE;
8265 
8266 	/* fix links */
8267 	for (i = 0; i < nrcpt - 1; ++i)
8268 		addrs[i]->q_next = addrs[i + 1];
8269 	addrs[nrcpt - 1]->q_next = NULL;
8270 	e->e_sendqueue = addrs[0];
8271 
8272 	/* prepare buffer for logging */
8273 	if (LogLevel > SPLIT_LOG_LEVEL)
8274 	{
8275 		l = MAXLINE;
8276 		lsplits = sm_malloc(l);
8277 		if (lsplits != NULL)
8278 			*lsplits = '\0';
8279 		j = 0;
8280 	}
8281 	else
8282 	{
8283 		/* get rid of stupid compiler warnings */
8284 		lsplits = NULL;
8285 		j = l = 0;
8286 	}
8287 
8288 	/* split the envelope */
8289 	firstsibling = e->e_sibling;
8290 	i = maxrcpt + ndead;
8291 	nsplit = 0;
8292 	for (;;)
8293 	{
8294 		addrs[i - 1]->q_next = NULL;
8295 		ee = split_env(e, addrs[i], e->e_qgrp, e->e_qdir);
8296 		if (!dup_df(e, ee))
8297 		{
8298 
8299 			ee = firstsibling;
8300 			while (ee != NULL)
8301 			{
8302 				(void) unlink(queuename(ee, DATAFL_LETTER));
8303 				ee = ee->e_sibling;
8304 			}
8305 
8306 			/* Error.  Restore e's sibling & recipient lists. */
8307 			e->e_sibling = firstsibling;
8308 			for (i = 0; i < nrcpt - 1; ++i)
8309 				addrs[i]->q_next = addrs[i + 1];
8310 			if (lsplits != NULL)
8311 				sm_free(lsplits);
8312 			return SM_SPLIT_FAIL;
8313 		}
8314 
8315 		/* prepend the new envelope to e->e_sibling */
8316 		ee->e_sibling = e->e_sibling;
8317 		e->e_sibling = ee;
8318 		++nsplit;
8319 		if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8320 		{
8321 			if (j >= l - strlen(ee->e_id) - 3)
8322 			{
8323 				char *p;
8324 
8325 				l += MAXLINE;
8326 				p = sm_realloc(lsplits, l);
8327 				if (p == NULL)
8328 				{
8329 					/* let's try to get this done */
8330 					sm_free(lsplits);
8331 					lsplits = NULL;
8332 				}
8333 				else
8334 					lsplits = p;
8335 			}
8336 			if (lsplits != NULL)
8337 			{
8338 				if (j == 0)
8339 					j += sm_strlcat(lsplits + j,
8340 							ee->e_id,
8341 							l - j);
8342 				else
8343 					j += sm_strlcat2(lsplits + j,
8344 							 "; ",
8345 							 ee->e_id,
8346 							 l - j);
8347 				SM_ASSERT(j < l);
8348 			}
8349 		}
8350 		if (nrcpt - i <= maxrcpt)
8351 			break;
8352 		i += maxrcpt;
8353 	}
8354 	if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8355 	{
8356 		if (nsplit > 0)
8357 		{
8358 			sm_syslog(LOG_NOTICE, e->e_id,
8359 				  "split: maxrcpts=%d, rcpts=%d, count=%d, id%s=%s",
8360 				  maxrcpt, nrcpt - ndead, nsplit,
8361 				  nsplit > 1 ? "s" : "", lsplits);
8362 		}
8363 		sm_free(lsplits);
8364 	}
8365 	return SM_SPLIT_NEW(nsplit);
8366 }
8367 /*
8368 **  SPLIT_BY_RECIPIENT
8369 **
8370 **	Split an envelope with multiple recipients into multiple
8371 **	envelopes as required by the sendmail configuration.
8372 **
8373 **	Parameters:
8374 **		e -- envelope.
8375 **
8376 **	Results:
8377 **		Returns true on success, false on failure.
8378 **
8379 **	Side Effects:
8380 **		see split_across_queue_groups(), split_within_queue(e)
8381 */
8382 
8383 bool
8384 split_by_recipient(e)
8385 	ENVELOPE *e;
8386 {
8387 	int split, n, i, j, l;
8388 	char *lsplits;
8389 	ENVELOPE *ee, *next, *firstsibling;
8390 
8391 	if (OpMode == SM_VERIFY || !ISVALIDQGRP(e->e_qgrp) ||
8392 	    bitset(EF_SPLIT, e->e_flags))
8393 		return true;
8394 	n = split_across_queue_groups(e);
8395 	if (n == SM_SPLIT_FAIL)
8396 		return false;
8397 	firstsibling = ee = e->e_sibling;
8398 	if (n > 1 && LogLevel > SPLIT_LOG_LEVEL)
8399 	{
8400 		l = MAXLINE;
8401 		lsplits = sm_malloc(l);
8402 		if (lsplits != NULL)
8403 			*lsplits = '\0';
8404 		j = 0;
8405 	}
8406 	else
8407 	{
8408 		/* get rid of stupid compiler warnings */
8409 		lsplits = NULL;
8410 		j = l = 0;
8411 	}
8412 	for (i = 1; i < n; ++i)
8413 	{
8414 		next = ee->e_sibling;
8415 		if (split_within_queue(ee) == SM_SPLIT_FAIL)
8416 		{
8417 			e->e_sibling = firstsibling;
8418 			return false;
8419 		}
8420 		ee->e_flags |= EF_SPLIT;
8421 		if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8422 		{
8423 			if (j >= l - strlen(ee->e_id) - 3)
8424 			{
8425 				char *p;
8426 
8427 				l += MAXLINE;
8428 				p = sm_realloc(lsplits, l);
8429 				if (p == NULL)
8430 				{
8431 					/* let's try to get this done */
8432 					sm_free(lsplits);
8433 					lsplits = NULL;
8434 				}
8435 				else
8436 					lsplits = p;
8437 			}
8438 			if (lsplits != NULL)
8439 			{
8440 				if (j == 0)
8441 					j += sm_strlcat(lsplits + j,
8442 							ee->e_id, l - j);
8443 				else
8444 					j += sm_strlcat2(lsplits + j, "; ",
8445 							 ee->e_id, l - j);
8446 				SM_ASSERT(j < l);
8447 			}
8448 		}
8449 		ee = next;
8450 	}
8451 	if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL && n > 1)
8452 	{
8453 		sm_syslog(LOG_NOTICE, e->e_id, "split: count=%d, id%s=%s",
8454 			  n - 1, n > 2 ? "s" : "", lsplits);
8455 		sm_free(lsplits);
8456 	}
8457 	split = split_within_queue(e) != SM_SPLIT_FAIL;
8458 	if (split)
8459 		e->e_flags |= EF_SPLIT;
8460 	return split;
8461 }
8462 
8463 /*
8464 **  QUARANTINE_QUEUE_ITEM -- {un,}quarantine a single envelope
8465 **
8466 **	Add/remove quarantine reason and requeue appropriately.
8467 **
8468 **	Parameters:
8469 **		qgrp -- queue group for the item
8470 **		qdir -- queue directory in the given queue group
8471 **		e -- envelope information for the item
8472 **		reason -- quarantine reason, NULL means unquarantine.
8473 **
8474 **	Results:
8475 **		true if item changed, false otherwise
8476 **
8477 **	Side Effects:
8478 **		Changes quarantine tag in queue file and renames it.
8479 */
8480 
8481 static bool
8482 quarantine_queue_item(qgrp, qdir, e, reason)
8483 	int qgrp;
8484 	int qdir;
8485 	ENVELOPE *e;
8486 	char *reason;
8487 {
8488 	bool dirty = false;
8489 	bool failing = false;
8490 	bool foundq = false;
8491 	bool finished = false;
8492 	int fd;
8493 	int flags;
8494 	int oldtype;
8495 	int newtype;
8496 	int save_errno;
8497 	MODE_T oldumask = 0;
8498 	SM_FILE_T *oldqfp, *tempqfp;
8499 	char *bp;
8500 	int bufsize;
8501 	char oldqf[MAXPATHLEN];
8502 	char tempqf[MAXPATHLEN];
8503 	char newqf[MAXPATHLEN];
8504 	char buf[MAXLINE];
8505 
8506 	oldtype = queue_letter(e, ANYQFL_LETTER);
8507 	(void) sm_strlcpy(oldqf, queuename(e, ANYQFL_LETTER), sizeof(oldqf));
8508 	(void) sm_strlcpy(tempqf, queuename(e, NEWQFL_LETTER), sizeof(tempqf));
8509 
8510 	/*
8511 	**  Instead of duplicating all the open
8512 	**  and lock code here, tell readqf() to
8513 	**  do that work and return the open
8514 	**  file pointer in e_lockfp.  Note that
8515 	**  we must release the locks properly when
8516 	**  we are done.
8517 	*/
8518 
8519 	if (!readqf(e, true))
8520 	{
8521 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8522 				     "Skipping %s\n", qid_printname(e));
8523 		return false;
8524 	}
8525 	oldqfp = e->e_lockfp;
8526 
8527 	/* open the new queue file */
8528 	flags = O_CREAT|O_WRONLY|O_EXCL;
8529 	if (bitset(S_IWGRP, QueueFileMode))
8530 		oldumask = umask(002);
8531 	fd = open(tempqf, flags, QueueFileMode);
8532 	if (bitset(S_IWGRP, QueueFileMode))
8533 		(void) umask(oldumask);
8534 	RELEASE_QUEUE;
8535 
8536 	if (fd < 0)
8537 	{
8538 		save_errno = errno;
8539 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8540 				     "Skipping %s: Could not open %s: %s\n",
8541 				     qid_printname(e), tempqf,
8542 				     sm_errstring(save_errno));
8543 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8544 		return false;
8545 	}
8546 	if (!lockfile(fd, tempqf, NULL, LOCK_EX|LOCK_NB))
8547 	{
8548 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8549 				     "Skipping %s: Could not lock %s\n",
8550 				     qid_printname(e), tempqf);
8551 		(void) close(fd);
8552 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8553 		return false;
8554 	}
8555 
8556 	tempqfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT, (void *) &fd,
8557 			     SM_IO_WRONLY_B, NULL);
8558 	if (tempqfp == NULL)
8559 	{
8560 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8561 				     "Skipping %s: Could not lock %s\n",
8562 				     qid_printname(e), tempqf);
8563 		(void) close(fd);
8564 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8565 		return false;
8566 	}
8567 
8568 	/* Copy the data over, changing the quarantine reason */
8569 	while (bufsize = sizeof(buf),
8570 	       (bp = fgetfolded(buf, &bufsize, oldqfp)) != NULL)
8571 	{
8572 		if (tTd(40, 4))
8573 			sm_dprintf("+++++ %s\n", bp);
8574 		switch (bp[0])
8575 		{
8576 		  case 'q':		/* quarantine reason */
8577 			foundq = true;
8578 			if (reason == NULL)
8579 			{
8580 				if (Verbose)
8581 				{
8582 					(void) sm_io_fprintf(smioout,
8583 							     SM_TIME_DEFAULT,
8584 							     "%s: Removed quarantine of \"%s\"\n",
8585 							     e->e_id, &bp[1]);
8586 				}
8587 				sm_syslog(LOG_INFO, e->e_id, "unquarantine");
8588 				dirty = true;
8589 			}
8590 			else if (strcmp(reason, &bp[1]) == 0)
8591 			{
8592 				if (Verbose)
8593 				{
8594 					(void) sm_io_fprintf(smioout,
8595 							     SM_TIME_DEFAULT,
8596 							     "%s: Already quarantined with \"%s\"\n",
8597 							     e->e_id, reason);
8598 				}
8599 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8600 						     "q%s\n", reason);
8601 			}
8602 			else
8603 			{
8604 				if (Verbose)
8605 				{
8606 					(void) sm_io_fprintf(smioout,
8607 							     SM_TIME_DEFAULT,
8608 							     "%s: Quarantine changed from \"%s\" to \"%s\"\n",
8609 							     e->e_id, &bp[1],
8610 							     reason);
8611 				}
8612 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8613 						     "q%s\n", reason);
8614 				sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8615 					  reason);
8616 				dirty = true;
8617 			}
8618 			break;
8619 
8620 		  case 'S':
8621 			/*
8622 			**  If we are quarantining an unquarantined item,
8623 			**  need to put in a new 'q' line before it's
8624 			**  too late.
8625 			*/
8626 
8627 			if (!foundq && reason != NULL)
8628 			{
8629 				if (Verbose)
8630 				{
8631 					(void) sm_io_fprintf(smioout,
8632 							     SM_TIME_DEFAULT,
8633 							     "%s: Quarantined with \"%s\"\n",
8634 							     e->e_id, reason);
8635 				}
8636 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8637 						     "q%s\n", reason);
8638 				sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8639 					  reason);
8640 				foundq = true;
8641 				dirty = true;
8642 			}
8643 
8644 			/* Copy the line to the new file */
8645 			(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8646 					     "%s\n", bp);
8647 			break;
8648 
8649 		  case '.':
8650 			finished = true;
8651 			/* FALLTHROUGH */
8652 
8653 		  default:
8654 			/* Copy the line to the new file */
8655 			(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8656 					     "%s\n", bp);
8657 			break;
8658 		}
8659 		if (bp != buf)
8660 			sm_free(bp);
8661 	}
8662 
8663 	/* Make sure we read the whole old file */
8664 	errno = sm_io_error(tempqfp);
8665 	if (errno != 0 && errno != SM_IO_EOF)
8666 	{
8667 		save_errno = errno;
8668 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8669 				     "Skipping %s: Error reading %s: %s\n",
8670 				     qid_printname(e), oldqf,
8671 				     sm_errstring(save_errno));
8672 		failing = true;
8673 	}
8674 
8675 	if (!failing && !finished)
8676 	{
8677 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8678 				     "Skipping %s: Incomplete file: %s\n",
8679 				     qid_printname(e), oldqf);
8680 		failing = true;
8681 	}
8682 
8683 	/* Check if we actually changed anything or we can just bail now */
8684 	if (!dirty)
8685 	{
8686 		/* pretend we failed, even though we technically didn't */
8687 		failing = true;
8688 	}
8689 
8690 	/* Make sure we wrote things out safely */
8691 	if (!failing &&
8692 	    (sm_io_flush(tempqfp, SM_TIME_DEFAULT) != 0 ||
8693 	     ((SuperSafe == SAFE_REALLY ||
8694 	       SuperSafe == SAFE_REALLY_POSTMILTER ||
8695 	       SuperSafe == SAFE_INTERACTIVE) &&
8696 	      fsync(sm_io_getinfo(tempqfp, SM_IO_WHAT_FD, NULL)) < 0) ||
8697 	     ((errno = sm_io_error(tempqfp)) != 0)))
8698 	{
8699 		save_errno = errno;
8700 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8701 				     "Skipping %s: Error writing %s: %s\n",
8702 				     qid_printname(e), tempqf,
8703 				     sm_errstring(save_errno));
8704 		failing = true;
8705 	}
8706 
8707 
8708 	/* Figure out the new filename */
8709 	newtype = (reason == NULL ? NORMQF_LETTER : QUARQF_LETTER);
8710 	if (oldtype == newtype)
8711 	{
8712 		/* going to rename tempqf to oldqf */
8713 		(void) sm_strlcpy(newqf, oldqf, sizeof(newqf));
8714 	}
8715 	else
8716 	{
8717 		/* going to rename tempqf to new name based on newtype */
8718 		(void) sm_strlcpy(newqf, queuename(e, newtype), sizeof(newqf));
8719 	}
8720 
8721 	save_errno = 0;
8722 
8723 	/* rename tempqf to newqf */
8724 	if (!failing &&
8725 	    rename(tempqf, newqf) < 0)
8726 		save_errno = (errno == 0) ? EINVAL : errno;
8727 
8728 	/* Check rename() success */
8729 	if (!failing && save_errno != 0)
8730 	{
8731 		sm_syslog(LOG_DEBUG, e->e_id,
8732 			  "quarantine_queue_item: rename(%s, %s): %s",
8733 			  tempqf, newqf, sm_errstring(save_errno));
8734 
8735 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8736 				     "Error renaming %s to %s: %s\n",
8737 				     tempqf, newqf,
8738 				     sm_errstring(save_errno));
8739 		if (oldtype == newtype)
8740 		{
8741 			/*
8742 			**  Bail here since we don't know the state of
8743 			**  the filesystem and may need to keep tempqf
8744 			**  for the user to rescue us.
8745 			*/
8746 
8747 			RELEASE_QUEUE;
8748 			errno = save_errno;
8749 			syserr("!452 Error renaming control file %s", tempqf);
8750 			/* NOTREACHED */
8751 		}
8752 		else
8753 		{
8754 			/* remove new file (if rename() half completed) */
8755 			if (xunlink(newqf) < 0)
8756 			{
8757 				save_errno = errno;
8758 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8759 						     "Error removing %s: %s\n",
8760 						     newqf,
8761 						     sm_errstring(save_errno));
8762 			}
8763 
8764 			/* tempqf removed below */
8765 			failing = true;
8766 		}
8767 
8768 	}
8769 
8770 	/* If changing file types, need to remove old type */
8771 	if (!failing && oldtype != newtype)
8772 	{
8773 		if (xunlink(oldqf) < 0)
8774 		{
8775 			save_errno = errno;
8776 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8777 					     "Error removing %s: %s\n",
8778 					     oldqf, sm_errstring(save_errno));
8779 		}
8780 	}
8781 
8782 	/* see if anything above failed */
8783 	if (failing)
8784 	{
8785 		/* Something failed: remove new file, old file still there */
8786 		(void) xunlink(tempqf);
8787 	}
8788 
8789 	/*
8790 	**  fsync() after file operations to make sure metadata is
8791 	**  written to disk on filesystems in which renames are
8792 	**  not guaranteed.  It's ok if they fail, mail won't be lost.
8793 	*/
8794 
8795 	if (SuperSafe != SAFE_NO)
8796 	{
8797 		/* for soft-updates */
8798 		(void) fsync(sm_io_getinfo(tempqfp,
8799 					   SM_IO_WHAT_FD, NULL));
8800 
8801 		if (!failing)
8802 		{
8803 			/* for soft-updates */
8804 			(void) fsync(sm_io_getinfo(oldqfp,
8805 						   SM_IO_WHAT_FD, NULL));
8806 		}
8807 
8808 		/* for other odd filesystems */
8809 		SYNC_DIR(tempqf, false);
8810 	}
8811 
8812 	/* Close up shop */
8813 	RELEASE_QUEUE;
8814 	if (tempqfp != NULL)
8815 		(void) sm_io_close(tempqfp, SM_TIME_DEFAULT);
8816 	if (oldqfp != NULL)
8817 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8818 
8819 	/* All went well */
8820 	return !failing;
8821 }
8822 
8823 /*
8824 **  QUARANTINE_QUEUE -- {un,}quarantine matching items in the queue
8825 **
8826 **	Read all matching queue items, add/remove quarantine
8827 **	reason, and requeue appropriately.
8828 **
8829 **	Parameters:
8830 **		reason -- quarantine reason, "." means unquarantine.
8831 **		qgrplimit -- limit to single queue group unless NOQGRP
8832 **
8833 **	Results:
8834 **		none.
8835 **
8836 **	Side Effects:
8837 **		Lots of changes to the queue.
8838 */
8839 
8840 void
8841 quarantine_queue(reason, qgrplimit)
8842 	char *reason;
8843 	int qgrplimit;
8844 {
8845 	int changed = 0;
8846 	int qgrp;
8847 
8848 	/* Convert internal representation of unquarantine */
8849 	if (reason != NULL && reason[0] == '.' && reason[1] == '\0')
8850 		reason = NULL;
8851 
8852 	if (reason != NULL)
8853 	{
8854 		/* clean it */
8855 		reason = newstr(denlstring(reason, true, true));
8856 	}
8857 
8858 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
8859 	{
8860 		int qdir;
8861 
8862 		if (qgrplimit != NOQGRP && qgrplimit != qgrp)
8863 			continue;
8864 
8865 		for (qdir = 0; qdir < Queue[qgrp]->qg_numqueues; qdir++)
8866 		{
8867 			int i;
8868 			int nrequests;
8869 
8870 			if (StopRequest)
8871 				stop_sendmail();
8872 
8873 			nrequests = gatherq(qgrp, qdir, true, NULL, NULL, NULL);
8874 
8875 			/* first see if there is anything */
8876 			if (nrequests <= 0)
8877 			{
8878 				if (Verbose)
8879 				{
8880 					(void) sm_io_fprintf(smioout,
8881 							     SM_TIME_DEFAULT, "%s: no matches\n",
8882 							     qid_printqueue(qgrp, qdir));
8883 				}
8884 				continue;
8885 			}
8886 
8887 			if (Verbose)
8888 			{
8889 				(void) sm_io_fprintf(smioout,
8890 						     SM_TIME_DEFAULT, "Processing %s:\n",
8891 						     qid_printqueue(qgrp, qdir));
8892 			}
8893 
8894 			for (i = 0; i < WorkListCount; i++)
8895 			{
8896 				ENVELOPE e;
8897 
8898 				if (StopRequest)
8899 					stop_sendmail();
8900 
8901 				/* setup envelope */
8902 				clearenvelope(&e, true, sm_rpool_new_x(NULL));
8903 				e.e_id = WorkList[i].w_name + 2;
8904 				e.e_qgrp = qgrp;
8905 				e.e_qdir = qdir;
8906 
8907 				if (tTd(70, 101))
8908 				{
8909 					sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8910 						      "Would do %s\n", e.e_id);
8911 					changed++;
8912 				}
8913 				else if (quarantine_queue_item(qgrp, qdir,
8914 							       &e, reason))
8915 					changed++;
8916 
8917 				/* clean up */
8918 				sm_rpool_free(e.e_rpool);
8919 				e.e_rpool = NULL;
8920 			}
8921 			if (WorkList != NULL)
8922 				sm_free(WorkList); /* XXX */
8923 			WorkList = NULL;
8924 			WorkListSize = 0;
8925 			WorkListCount = 0;
8926 		}
8927 	}
8928 	if (Verbose)
8929 	{
8930 		if (changed == 0)
8931 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8932 					     "No changes\n");
8933 		else
8934 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8935 					     "%d change%s\n",
8936 					     changed,
8937 					     changed == 1 ? "" : "s");
8938 	}
8939 }
8940