xref: /freebsd/contrib/sendmail/src/queue.c (revision bfe691b2f75de2224c7ceb304ebcdef2b42d4179)
1 /*
2  * Copyright (c) 1998-2007 Sendmail, Inc. and its suppliers.
3  *	All rights reserved.
4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
5  * Copyright (c) 1988, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * By using this file, you agree to the terms and conditions set
9  * forth in the LICENSE file which can be found at the top level of
10  * the sendmail distribution.
11  *
12  */
13 
14 #include <sendmail.h>
15 #include <sm/sem.h>
16 
17 SM_RCSID("@(#)$Id: queue.c,v 8.972 2007/03/29 22:55:17 ca Exp $")
18 
19 #include <dirent.h>
20 
21 # define RELEASE_QUEUE	(void) 0
22 # define ST_INODE(st)	(st).st_ino
23 
24 #  define sm_file_exists(errno) ((errno) == EEXIST)
25 
26 # if HASFLOCK && defined(O_EXLOCK)
27 #   define SM_OPEN_EXLOCK 1
28 #   define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL|O_EXLOCK)
29 # else /* HASFLOCK && defined(O_EXLOCK) */
30 #  define TF_OPEN_FLAGS (O_CREAT|O_WRONLY|O_EXCL)
31 # endif /* HASFLOCK && defined(O_EXLOCK) */
32 
33 #ifndef SM_OPEN_EXLOCK
34 # define SM_OPEN_EXLOCK 0
35 #endif /* ! SM_OPEN_EXLOCK */
36 
37 /*
38 **  Historical notes:
39 **	QF_VERSION == 4 was sendmail 8.10/8.11 without _FFR_QUEUEDELAY
40 **	QF_VERSION == 5 was sendmail 8.10/8.11 with    _FFR_QUEUEDELAY
41 **	QF_VERSION == 6 was sendmail 8.12      without _FFR_QUEUEDELAY
42 **	QF_VERSION == 7 was sendmail 8.12      with    _FFR_QUEUEDELAY
43 **	QF_VERSION == 8 is  sendmail 8.13
44 */
45 
46 #define QF_VERSION	8	/* version number of this queue format */
47 
48 static char	queue_letter __P((ENVELOPE *, int));
49 static bool	quarantine_queue_item __P((int, int, ENVELOPE *, char *));
50 
51 /* Naming convention: qgrp: index of queue group, qg: QUEUEGROUP */
52 
53 /*
54 **  Work queue.
55 */
56 
57 struct work
58 {
59 	char		*w_name;	/* name of control file */
60 	char		*w_host;	/* name of recipient host */
61 	bool		w_lock;		/* is message locked? */
62 	bool		w_tooyoung;	/* is it too young to run? */
63 	long		w_pri;		/* priority of message, see below */
64 	time_t		w_ctime;	/* creation time */
65 	time_t		w_mtime;	/* modification time */
66 	int		w_qgrp;		/* queue group located in */
67 	int		w_qdir;		/* queue directory located in */
68 	struct work	*w_next;	/* next in queue */
69 };
70 
71 typedef struct work	WORK;
72 
73 static WORK	*WorkQ;		/* queue of things to be done */
74 static int	NumWorkGroups;	/* number of work groups */
75 static time_t	Current_LA_time = 0;
76 
77 /* Get new load average every 30 seconds. */
78 #define GET_NEW_LA_TIME	30
79 
80 #define SM_GET_LA(now)	\
81 	do							\
82 	{							\
83 		now = curtime();				\
84 		if (Current_LA_time < now - GET_NEW_LA_TIME)	\
85 		{						\
86 			sm_getla();				\
87 			Current_LA_time = now;			\
88 		}						\
89 	} while (0)
90 
91 /*
92 **  DoQueueRun indicates that a queue run is needed.
93 **	Notice: DoQueueRun is modified in a signal handler!
94 */
95 
96 static bool	volatile DoQueueRun; /* non-interrupt time queue run needed */
97 
98 /*
99 **  Work group definition structure.
100 **	Each work group contains one or more queue groups. This is done
101 **	to manage the number of queue group runners active at the same time
102 **	to be within the constraints of MaxQueueChildren (if it is set).
103 **	The number of queue groups that can be run on the next work run
104 **	is kept track of. The queue groups are run in a round robin.
105 */
106 
107 struct workgrp
108 {
109 	int		wg_numqgrp;	/* number of queue groups in work grp */
110 	int		wg_runners;	/* total runners */
111 	int		wg_curqgrp;	/* current queue group */
112 	QUEUEGRP	**wg_qgs;	/* array of queue groups */
113 	int		wg_maxact;	/* max # of active runners */
114 	time_t		wg_lowqintvl;	/* lowest queue interval */
115 	int		wg_restart;	/* needs restarting? */
116 	int		wg_restartcnt;	/* count of times restarted */
117 };
118 
119 typedef struct workgrp WORKGRP;
120 
121 static WORKGRP	volatile WorkGrp[MAXWORKGROUPS + 1];	/* work groups */
122 
123 #if SM_HEAP_CHECK
124 static SM_DEBUG_T DebugLeakQ = SM_DEBUG_INITIALIZER("leak_q",
125 	"@(#)$Debug: leak_q - trace memory leaks during queue processing $");
126 #endif /* SM_HEAP_CHECK */
127 
128 /*
129 **  We use EmptyString instead of "" to avoid
130 **  'zero-length format string' warnings from gcc
131 */
132 
133 static const char EmptyString[] = "";
134 
135 static void	grow_wlist __P((int, int));
136 static int	multiqueue_cache __P((char *, int, QUEUEGRP *, int, unsigned int *));
137 static int	gatherq __P((int, int, bool, bool *, bool *));
138 static int	sortq __P((int));
139 static void	printctladdr __P((ADDRESS *, SM_FILE_T *));
140 static bool	readqf __P((ENVELOPE *, bool));
141 static void	restart_work_group __P((int));
142 static void	runner_work __P((ENVELOPE *, int, bool, int, int));
143 static void	schedule_queue_runs __P((bool, int, bool));
144 static char	*strrev __P((char *));
145 static ADDRESS	*setctluser __P((char *, int, ENVELOPE *));
146 #if _FFR_RHS
147 static int	sm_strshufflecmp __P((char *, char *));
148 static void	init_shuffle_alphabet __P(());
149 #endif /* _FFR_RHS */
150 
151 /*
152 **  Note: workcmpf?() don't use a prototype because it will cause a conflict
153 **  with the qsort() call (which expects something like
154 **  int (*compar)(const void *, const void *), not (WORK *, WORK *))
155 */
156 
157 static int	workcmpf0();
158 static int	workcmpf1();
159 static int	workcmpf2();
160 static int	workcmpf3();
161 static int	workcmpf4();
162 static int	randi = 3;	/* index for workcmpf5() */
163 static int	workcmpf5();
164 static int	workcmpf6();
165 #if _FFR_RHS
166 static int	workcmpf7();
167 #endif /* _FFR_RHS */
168 
169 #if RANDOMSHIFT
170 # define get_rand_mod(m)	((get_random() >> RANDOMSHIFT) % (m))
171 #else /* RANDOMSHIFT */
172 # define get_rand_mod(m)	(get_random() % (m))
173 #endif /* RANDOMSHIFT */
174 
175 /*
176 **  File system definition.
177 **	Used to keep track of how much free space is available
178 **	on a file system in which one or more queue directories reside.
179 */
180 
181 typedef struct filesys_shared	FILESYS;
182 
183 struct filesys_shared
184 {
185 	dev_t	fs_dev;		/* unique device id */
186 	long	fs_avail;	/* number of free blocks available */
187 	long	fs_blksize;	/* block size, in bytes */
188 };
189 
190 /* probably kept in shared memory */
191 static FILESYS	FileSys[MAXFILESYS];	/* queue file systems */
192 static const char *FSPath[MAXFILESYS];	/* pathnames for file systems */
193 
194 #if SM_CONF_SHM
195 
196 /*
197 **  Shared memory data
198 **
199 **  Current layout:
200 **	size -- size of shared memory segment
201 **	pid -- pid of owner, should be a unique id to avoid misinterpretations
202 **		by other processes.
203 **	tag -- should be a unique id to avoid misinterpretations by others.
204 **		idea: hash over configuration data that will be stored here.
205 **	NumFileSys -- number of file systems.
206 **	FileSys -- (arrary of) structure for used file systems.
207 **	RSATmpCnt -- counter for number of uses of ephemeral RSA key.
208 **	QShm -- (array of) structure for information about queue directories.
209 */
210 
211 /*
212 **  Queue data in shared memory
213 */
214 
215 typedef struct queue_shared	QUEUE_SHM_T;
216 
217 struct queue_shared
218 {
219 	int	qs_entries;	/* number of entries */
220 	/* XXX more to follow? */
221 };
222 
223 static void	*Pshm;		/* pointer to shared memory */
224 static FILESYS	*PtrFileSys;	/* pointer to queue file system array */
225 int		ShmId = SM_SHM_NO_ID;	/* shared memory id */
226 static QUEUE_SHM_T	*QShm;		/* pointer to shared queue data */
227 static size_t shms;
228 
229 # define SHM_OFF_PID(p)	(((char *) (p)) + sizeof(int))
230 # define SHM_OFF_TAG(p)	(((char *) (p)) + sizeof(pid_t) + sizeof(int))
231 # define SHM_OFF_HEAD	(sizeof(pid_t) + sizeof(int) * 2)
232 
233 /* how to access FileSys */
234 # define FILE_SYS(i)	(PtrFileSys[i])
235 
236 /* first entry is a tag, for now just the size */
237 # define OFF_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD)
238 
239 /* offset for PNumFileSys */
240 # define OFF_NUM_FILE_SYS(p)	(((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys))
241 
242 /* offset for PRSATmpCnt */
243 # define OFF_RSA_TMP_CNT(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int))
244 int	*PRSATmpCnt;
245 
246 /* offset for queue_shm */
247 # define OFF_QUEUE_SHM(p) (((char *) (p)) + SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
248 
249 # define QSHM_ENTRIES(i)	QShm[i].qs_entries
250 
251 /* basic size of shared memory segment */
252 # define SM_T_SIZE	(SHM_OFF_HEAD + sizeof(FileSys) + sizeof(int) * 2)
253 
254 static unsigned int	hash_q __P((char *, unsigned int));
255 
256 /*
257 **  HASH_Q -- simple hash function
258 **
259 **	Parameters:
260 **		p -- string to hash.
261 **		h -- hash start value (from previous run).
262 **
263 **	Returns:
264 **		hash value.
265 */
266 
267 static unsigned int
268 hash_q(p, h)
269 	char *p;
270 	unsigned int h;
271 {
272 	int c, d;
273 
274 	while (*p != '\0')
275 	{
276 		d = *p++;
277 		c = d;
278 		c ^= c<<6;
279 		h += (c<<11) ^ (c>>1);
280 		h ^= (d<<14) + (d<<7) + (d<<4) + d;
281 	}
282 	return h;
283 }
284 
285 
286 #else /* SM_CONF_SHM */
287 # define FILE_SYS(i)	FileSys[i]
288 #endif /* SM_CONF_SHM */
289 
290 /* access to the various components of file system data */
291 #define FILE_SYS_NAME(i)	FSPath[i]
292 #define FILE_SYS_AVAIL(i)	FILE_SYS(i).fs_avail
293 #define FILE_SYS_BLKSIZE(i)	FILE_SYS(i).fs_blksize
294 #define FILE_SYS_DEV(i)	FILE_SYS(i).fs_dev
295 
296 
297 /*
298 **  Current qf file field assignments:
299 **
300 **	A	AUTH= parameter
301 **	B	body type
302 **	C	controlling user
303 **	D	data file name
304 **	d	data file directory name (added in 8.12)
305 **	E	error recipient
306 **	F	flag bits
307 **	G	free (was: queue delay algorithm if _FFR_QUEUEDELAY)
308 **	H	header
309 **	I	data file's inode number
310 **	K	time of last delivery attempt
311 **	L	Solaris Content-Length: header (obsolete)
312 **	M	message
313 **	N	number of delivery attempts
314 **	P	message priority
315 **	q	quarantine reason
316 **	Q	original recipient (ORCPT=)
317 **	r	final recipient (Final-Recipient: DSN field)
318 **	R	recipient
319 **	S	sender
320 **	T	init time
321 **	V	queue file version
322 **	X	free (was: character set if _FFR_SAVE_CHARSET)
323 **	Y	free (was: current delay if _FFR_QUEUEDELAY)
324 **	Z	original envelope id from ESMTP
325 **	!	deliver by (added in 8.12)
326 **	$	define macro
327 **	.	terminate file
328 */
329 
330 /*
331 **  QUEUEUP -- queue a message up for future transmission.
332 **
333 **	Parameters:
334 **		e -- the envelope to queue up.
335 **		announce -- if true, tell when you are queueing up.
336 **		msync -- if true, then fsync() if SuperSafe interactive mode.
337 **
338 **	Returns:
339 **		none.
340 **
341 **	Side Effects:
342 **		The current request is saved in a control file.
343 **		The queue file is left locked.
344 */
345 
346 void
347 queueup(e, announce, msync)
348 	register ENVELOPE *e;
349 	bool announce;
350 	bool msync;
351 {
352 	register SM_FILE_T *tfp;
353 	register HDR *h;
354 	register ADDRESS *q;
355 	int tfd = -1;
356 	int i;
357 	bool newid;
358 	register char *p;
359 	MAILER nullmailer;
360 	MCI mcibuf;
361 	char qf[MAXPATHLEN];
362 	char tf[MAXPATHLEN];
363 	char df[MAXPATHLEN];
364 	char buf[MAXLINE];
365 
366 	/*
367 	**  Create control file.
368 	*/
369 
370 #define OPEN_TF	do							\
371 		{							\
372 			MODE_T oldumask = 0;				\
373 									\
374 			if (bitset(S_IWGRP, QueueFileMode))		\
375 				oldumask = umask(002);			\
376 			tfd = open(tf, TF_OPEN_FLAGS, QueueFileMode);	\
377 			if (bitset(S_IWGRP, QueueFileMode))		\
378 				(void) umask(oldumask);			\
379 		} while (0)
380 
381 
382 	newid = (e->e_id == NULL) || !bitset(EF_INQUEUE, e->e_flags);
383 	(void) sm_strlcpy(tf, queuename(e, NEWQFL_LETTER), sizeof(tf));
384 	tfp = e->e_lockfp;
385 	if (tfp == NULL && newid)
386 	{
387 		/*
388 		**  open qf file directly: this will give an error if the file
389 		**  already exists and hence prevent problems if a queue-id
390 		**  is reused (e.g., because the clock is set back).
391 		*/
392 
393 		(void) sm_strlcpy(tf, queuename(e, ANYQFL_LETTER), sizeof(tf));
394 		OPEN_TF;
395 		if (tfd < 0 ||
396 #if !SM_OPEN_EXLOCK
397 		    !lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB) ||
398 #endif /* !SM_OPEN_EXLOCK */
399 		    (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
400 					 (void *) &tfd, SM_IO_WRONLY,
401 					 NULL)) == NULL)
402 		{
403 			int save_errno = errno;
404 
405 			printopenfds(true);
406 			errno = save_errno;
407 			syserr("!queueup: cannot create queue file %s, euid=%d, fd=%d, fp=%p",
408 				tf, (int) geteuid(), tfd, tfp);
409 			/* NOTREACHED */
410 		}
411 		e->e_lockfp = tfp;
412 		upd_qs(e, 1, 0, "queueup");
413 	}
414 
415 	/* if newid, write the queue file directly (instead of temp file) */
416 	if (!newid)
417 	{
418 		/* get a locked tf file */
419 		for (i = 0; i < 128; i++)
420 		{
421 			if (tfd < 0)
422 			{
423 				OPEN_TF;
424 				if (tfd < 0)
425 				{
426 					if (errno != EEXIST)
427 						break;
428 					if (LogLevel > 0 && (i % 32) == 0)
429 						sm_syslog(LOG_ALERT, e->e_id,
430 							  "queueup: cannot create %s, uid=%d: %s",
431 							  tf, (int) geteuid(),
432 							  sm_errstring(errno));
433 				}
434 #if SM_OPEN_EXLOCK
435 				else
436 					break;
437 #endif /* SM_OPEN_EXLOCK */
438 			}
439 			if (tfd >= 0)
440 			{
441 #if SM_OPEN_EXLOCK
442 				/* file is locked by open() */
443 				break;
444 #else /* SM_OPEN_EXLOCK */
445 				if (lockfile(tfd, tf, NULL, LOCK_EX|LOCK_NB))
446 					break;
447 				else
448 #endif /* SM_OPEN_EXLOCK */
449 				if (LogLevel > 0 && (i % 32) == 0)
450 					sm_syslog(LOG_ALERT, e->e_id,
451 						  "queueup: cannot lock %s: %s",
452 						  tf, sm_errstring(errno));
453 				if ((i % 32) == 31)
454 				{
455 					(void) close(tfd);
456 					tfd = -1;
457 				}
458 			}
459 
460 			if ((i % 32) == 31)
461 			{
462 				/* save the old temp file away */
463 				(void) rename(tf, queuename(e, TEMPQF_LETTER));
464 			}
465 			else
466 				(void) sleep(i % 32);
467 		}
468 		if (tfd < 0 || (tfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
469 						 (void *) &tfd, SM_IO_WRONLY_B,
470 						 NULL)) == NULL)
471 		{
472 			int save_errno = errno;
473 
474 			printopenfds(true);
475 			errno = save_errno;
476 			syserr("!queueup: cannot create queue temp file %s, uid=%d",
477 				tf, (int) geteuid());
478 		}
479 	}
480 
481 	if (tTd(40, 1))
482 		sm_dprintf("\n>>>>> queueing %s/%s%s >>>>>\n",
483 			   qid_printqueue(e->e_qgrp, e->e_qdir),
484 			   queuename(e, ANYQFL_LETTER),
485 			   newid ? " (new id)" : "");
486 	if (tTd(40, 3))
487 	{
488 		sm_dprintf("  e_flags=");
489 		printenvflags(e);
490 	}
491 	if (tTd(40, 32))
492 	{
493 		sm_dprintf("  sendq=");
494 		printaddr(sm_debug_file(), e->e_sendqueue, true);
495 	}
496 	if (tTd(40, 9))
497 	{
498 		sm_dprintf("  tfp=");
499 		dumpfd(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL), true, false);
500 		sm_dprintf("  lockfp=");
501 		if (e->e_lockfp == NULL)
502 			sm_dprintf("NULL\n");
503 		else
504 			dumpfd(sm_io_getinfo(e->e_lockfp, SM_IO_WHAT_FD, NULL),
505 			       true, false);
506 	}
507 
508 	/*
509 	**  If there is no data file yet, create one.
510 	*/
511 
512 	(void) sm_strlcpy(df, queuename(e, DATAFL_LETTER), sizeof(df));
513 	if (bitset(EF_HAS_DF, e->e_flags))
514 	{
515 		if (e->e_dfp != NULL &&
516 		    SuperSafe != SAFE_REALLY &&
517 		    SuperSafe != SAFE_REALLY_POSTMILTER &&
518 		    sm_io_setinfo(e->e_dfp, SM_BF_COMMIT, NULL) < 0 &&
519 		    errno != EINVAL)
520 		{
521 			syserr("!queueup: cannot commit data file %s, uid=%d",
522 			       queuename(e, DATAFL_LETTER), (int) geteuid());
523 		}
524 		if (e->e_dfp != NULL &&
525 		    SuperSafe == SAFE_INTERACTIVE && msync)
526 		{
527 			if (tTd(40,32))
528 				sm_syslog(LOG_INFO, e->e_id,
529 					  "queueup: fsync(e->e_dfp)");
530 
531 			if (fsync(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD,
532 						NULL)) < 0)
533 			{
534 				if (newid)
535 					syserr("!552 Error writing data file %s",
536 					       df);
537 				else
538 					syserr("!452 Error writing data file %s",
539 					       df);
540 			}
541 		}
542 	}
543 	else
544 	{
545 		int dfd;
546 		MODE_T oldumask = 0;
547 		register SM_FILE_T *dfp = NULL;
548 		struct stat stbuf;
549 
550 		if (e->e_dfp != NULL &&
551 		    sm_io_getinfo(e->e_dfp, SM_IO_WHAT_ISTYPE, BF_FILE_TYPE))
552 			syserr("committing over bf file");
553 
554 		if (bitset(S_IWGRP, QueueFileMode))
555 			oldumask = umask(002);
556 		dfd = open(df, O_WRONLY|O_CREAT|O_TRUNC|QF_O_EXTRA,
557 			   QueueFileMode);
558 		if (bitset(S_IWGRP, QueueFileMode))
559 			(void) umask(oldumask);
560 		if (dfd < 0 || (dfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
561 						 (void *) &dfd, SM_IO_WRONLY_B,
562 						 NULL)) == NULL)
563 			syserr("!queueup: cannot create data temp file %s, uid=%d",
564 				df, (int) geteuid());
565 		if (fstat(dfd, &stbuf) < 0)
566 			e->e_dfino = -1;
567 		else
568 		{
569 			e->e_dfdev = stbuf.st_dev;
570 			e->e_dfino = ST_INODE(stbuf);
571 		}
572 		e->e_flags |= EF_HAS_DF;
573 		memset(&mcibuf, '\0', sizeof(mcibuf));
574 		mcibuf.mci_out = dfp;
575 		mcibuf.mci_mailer = FileMailer;
576 		(*e->e_putbody)(&mcibuf, e, NULL);
577 
578 		if (SuperSafe == SAFE_REALLY ||
579 		    SuperSafe == SAFE_REALLY_POSTMILTER ||
580 		    (SuperSafe == SAFE_INTERACTIVE && msync))
581 		{
582 			if (tTd(40,32))
583 				sm_syslog(LOG_INFO, e->e_id,
584 					  "queueup: fsync(dfp)");
585 
586 			if (fsync(sm_io_getinfo(dfp, SM_IO_WHAT_FD, NULL)) < 0)
587 			{
588 				if (newid)
589 					syserr("!552 Error writing data file %s",
590 					       df);
591 				else
592 					syserr("!452 Error writing data file %s",
593 					       df);
594 			}
595 		}
596 
597 		if (sm_io_close(dfp, SM_TIME_DEFAULT) < 0)
598 			syserr("!queueup: cannot save data temp file %s, uid=%d",
599 				df, (int) geteuid());
600 		e->e_putbody = putbody;
601 	}
602 
603 	/*
604 	**  Output future work requests.
605 	**	Priority and creation time should be first, since
606 	**	they are required by gatherq.
607 	*/
608 
609 	/* output queue version number (must be first!) */
610 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "V%d\n", QF_VERSION);
611 
612 	/* output creation time */
613 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "T%ld\n", (long) e->e_ctime);
614 
615 	/* output last delivery time */
616 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "K%ld\n", (long) e->e_dtime);
617 
618 	/* output number of delivery attempts */
619 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "N%d\n", e->e_ntries);
620 
621 	/* output message priority */
622 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "P%ld\n", e->e_msgpriority);
623 
624 	/*
625 	**  If data file is in a different directory than the queue file,
626 	**  output a "d" record naming the directory of the data file.
627 	*/
628 
629 	if (e->e_dfqgrp != e->e_qgrp)
630 	{
631 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "d%s\n",
632 			Queue[e->e_dfqgrp]->qg_qpaths[e->e_dfqdir].qp_name);
633 	}
634 
635 	/* output inode number of data file */
636 	/* XXX should probably include device major/minor too */
637 	if (e->e_dfino != -1)
638 	{
639 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "I%ld/%ld/%llu\n",
640 				     (long) major(e->e_dfdev),
641 				     (long) minor(e->e_dfdev),
642 				     (ULONGLONG_T) e->e_dfino);
643 	}
644 
645 	/* output body type */
646 	if (e->e_bodytype != NULL)
647 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "B%s\n",
648 				     denlstring(e->e_bodytype, true, false));
649 
650 	/* quarantine reason */
651 	if (e->e_quarmsg != NULL)
652 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "q%s\n",
653 				     denlstring(e->e_quarmsg, true, false));
654 
655 	/* message from envelope, if it exists */
656 	if (e->e_message != NULL)
657 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
658 				     denlstring(e->e_message, true, false));
659 
660 	/* send various flag bits through */
661 	p = buf;
662 	if (bitset(EF_WARNING, e->e_flags))
663 		*p++ = 'w';
664 	if (bitset(EF_RESPONSE, e->e_flags))
665 		*p++ = 'r';
666 	if (bitset(EF_HAS8BIT, e->e_flags))
667 		*p++ = '8';
668 	if (bitset(EF_DELETE_BCC, e->e_flags))
669 		*p++ = 'b';
670 	if (bitset(EF_RET_PARAM, e->e_flags))
671 		*p++ = 'd';
672 	if (bitset(EF_NO_BODY_RETN, e->e_flags))
673 		*p++ = 'n';
674 	if (bitset(EF_SPLIT, e->e_flags))
675 		*p++ = 's';
676 	*p++ = '\0';
677 	if (buf[0] != '\0')
678 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "F%s\n", buf);
679 
680 	/* save $={persistentMacros} macro values */
681 	queueup_macros(macid("{persistentMacros}"), tfp, e);
682 
683 	/* output name of sender */
684 	if (bitnset(M_UDBENVELOPE, e->e_from.q_mailer->m_flags))
685 		p = e->e_sender;
686 	else
687 		p = e->e_from.q_paddr;
688 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "S%s\n",
689 			     denlstring(p, true, false));
690 
691 	/* output ESMTP-supplied "original" information */
692 	if (e->e_envid != NULL)
693 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Z%s\n",
694 				     denlstring(e->e_envid, true, false));
695 
696 	/* output AUTH= parameter */
697 	if (e->e_auth_param != NULL)
698 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "A%s\n",
699 				     denlstring(e->e_auth_param, true, false));
700 	if (e->e_dlvr_flag != 0)
701 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "!%c %ld\n",
702 				     (char) e->e_dlvr_flag, e->e_deliver_by);
703 
704 	/* output list of recipient addresses */
705 	printctladdr(NULL, NULL);
706 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
707 	{
708 		if (!QS_IS_UNDELIVERED(q->q_state))
709 			continue;
710 
711 		/* message for this recipient, if it exists */
712 		if (q->q_message != NULL)
713 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "M%s\n",
714 					     denlstring(q->q_message, true,
715 							false));
716 
717 		printctladdr(q, tfp);
718 		if (q->q_orcpt != NULL)
719 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "Q%s\n",
720 					     denlstring(q->q_orcpt, true,
721 							false));
722 		if (q->q_finalrcpt != NULL)
723 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "r%s\n",
724 					     denlstring(q->q_finalrcpt, true,
725 							false));
726 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'R');
727 		if (bitset(QPRIMARY, q->q_flags))
728 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'P');
729 		if (bitset(QHASNOTIFY, q->q_flags))
730 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'N');
731 		if (bitset(QPINGONSUCCESS, q->q_flags))
732 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'S');
733 		if (bitset(QPINGONFAILURE, q->q_flags))
734 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'F');
735 		if (bitset(QPINGONDELAY, q->q_flags))
736 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'D');
737 		if (q->q_alias != NULL &&
738 		    bitset(QALIAS, q->q_alias->q_flags))
739 			(void) sm_io_putc(tfp, SM_TIME_DEFAULT, 'A');
740 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, ':');
741 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s\n",
742 				     denlstring(q->q_paddr, true, false));
743 		if (announce)
744 		{
745 			char *tag = "queued";
746 
747 			if (e->e_quarmsg != NULL)
748 				tag = "quarantined";
749 
750 			e->e_to = q->q_paddr;
751 			message(tag);
752 			if (LogLevel > 8)
753 				logdelivery(q->q_mailer, NULL, q->q_status,
754 					    tag, NULL, (time_t) 0, e);
755 			e->e_to = NULL;
756 		}
757 		if (tTd(40, 1))
758 		{
759 			sm_dprintf("queueing ");
760 			printaddr(sm_debug_file(), q, false);
761 		}
762 	}
763 
764 	/*
765 	**  Output headers for this message.
766 	**	Expand macros completely here.  Queue run will deal with
767 	**	everything as absolute headers.
768 	**		All headers that must be relative to the recipient
769 	**		can be cracked later.
770 	**	We set up a "null mailer" -- i.e., a mailer that will have
771 	**	no effect on the addresses as they are output.
772 	*/
773 
774 	memset((char *) &nullmailer, '\0', sizeof(nullmailer));
775 	nullmailer.m_re_rwset = nullmailer.m_rh_rwset =
776 			nullmailer.m_se_rwset = nullmailer.m_sh_rwset = -1;
777 	nullmailer.m_eol = "\n";
778 	memset(&mcibuf, '\0', sizeof(mcibuf));
779 	mcibuf.mci_mailer = &nullmailer;
780 	mcibuf.mci_out = tfp;
781 
782 	macdefine(&e->e_macro, A_PERM, 'g', "\201f");
783 	for (h = e->e_header; h != NULL; h = h->h_link)
784 	{
785 		if (h->h_value == NULL)
786 			continue;
787 
788 		/* don't output resent headers on non-resent messages */
789 		if (bitset(H_RESENT, h->h_flags) &&
790 		    !bitset(EF_RESENT, e->e_flags))
791 			continue;
792 
793 		/* expand macros; if null, don't output header at all */
794 		if (bitset(H_DEFAULT, h->h_flags))
795 		{
796 			(void) expand(h->h_value, buf, sizeof(buf), e);
797 			if (buf[0] == '\0')
798 				continue;
799 			if (buf[0] == ' ' && buf[1] == '\0')
800 				continue;
801 		}
802 
803 		/* output this header */
804 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "H?");
805 
806 		/* output conditional macro if present */
807 		if (h->h_macro != '\0')
808 		{
809 			if (bitset(0200, h->h_macro))
810 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
811 						     "${%s}",
812 						      macname(bitidx(h->h_macro)));
813 			else
814 				(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT,
815 						     "$%c", h->h_macro);
816 		}
817 		else if (!bitzerop(h->h_mflags) &&
818 			 bitset(H_CHECK|H_ACHECK, h->h_flags))
819 		{
820 			int j;
821 
822 			/* if conditional, output the set of conditions */
823 			for (j = '\0'; j <= '\177'; j++)
824 				if (bitnset(j, h->h_mflags))
825 					(void) sm_io_putc(tfp, SM_TIME_DEFAULT,
826 							  j);
827 		}
828 		(void) sm_io_putc(tfp, SM_TIME_DEFAULT, '?');
829 
830 		/* output the header: expand macros, convert addresses */
831 		if (bitset(H_DEFAULT, h->h_flags) &&
832 		    !bitset(H_BINDLATE, h->h_flags))
833 		{
834 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s:%s\n",
835 					     h->h_field,
836 					     denlstring(buf, false, true));
837 		}
838 		else if (bitset(H_FROM|H_RCPT, h->h_flags) &&
839 			 !bitset(H_BINDLATE, h->h_flags))
840 		{
841 			bool oldstyle = bitset(EF_OLDSTYLE, e->e_flags);
842 			SM_FILE_T *savetrace = TrafficLogFile;
843 
844 			TrafficLogFile = NULL;
845 
846 			if (bitset(H_FROM, h->h_flags))
847 				oldstyle = false;
848 
849 			commaize(h, h->h_value, oldstyle, &mcibuf, e);
850 
851 			TrafficLogFile = savetrace;
852 		}
853 		else
854 		{
855 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "%s:%s\n",
856 					     h->h_field,
857 					     denlstring(h->h_value, false,
858 							true));
859 		}
860 	}
861 
862 	/*
863 	**  Clean up.
864 	**
865 	**	Write a terminator record -- this is to prevent
866 	**	scurrilous crackers from appending any data.
867 	*/
868 
869 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ".\n");
870 
871 	if (sm_io_flush(tfp, SM_TIME_DEFAULT) != 0 ||
872 	    ((SuperSafe == SAFE_REALLY ||
873 	      SuperSafe == SAFE_REALLY_POSTMILTER ||
874 	      (SuperSafe == SAFE_INTERACTIVE && msync)) &&
875 	     fsync(sm_io_getinfo(tfp, SM_IO_WHAT_FD, NULL)) < 0) ||
876 	    sm_io_error(tfp))
877 	{
878 		if (newid)
879 			syserr("!552 Error writing control file %s", tf);
880 		else
881 			syserr("!452 Error writing control file %s", tf);
882 	}
883 
884 	if (!newid)
885 	{
886 		char new = queue_letter(e, ANYQFL_LETTER);
887 
888 		/* rename (locked) tf to be (locked) [qh]f */
889 		(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER),
890 				  sizeof(qf));
891 		if (rename(tf, qf) < 0)
892 			syserr("cannot rename(%s, %s), uid=%d",
893 				tf, qf, (int) geteuid());
894 		else
895 		{
896 			/*
897 			**  Check if type has changed and only
898 			**  remove the old item if the rename above
899 			**  succeeded.
900 			*/
901 
902 			if (e->e_qfletter != '\0' &&
903 			    e->e_qfletter != new)
904 			{
905 				if (tTd(40, 5))
906 				{
907 					sm_dprintf("type changed from %c to %c\n",
908 						   e->e_qfletter, new);
909 				}
910 
911 				if (unlink(queuename(e, e->e_qfletter)) < 0)
912 				{
913 					/* XXX: something more drastic? */
914 					if (LogLevel > 0)
915 						sm_syslog(LOG_ERR, e->e_id,
916 							  "queueup: unlink(%s) failed: %s",
917 							  queuename(e, e->e_qfletter),
918 							  sm_errstring(errno));
919 				}
920 			}
921 		}
922 		e->e_qfletter = new;
923 
924 		/*
925 		**  fsync() after renaming to make sure metadata is
926 		**  written to disk on filesystems in which renames are
927 		**  not guaranteed.
928 		*/
929 
930 		if (SuperSafe != SAFE_NO)
931 		{
932 			/* for softupdates */
933 			if (tfd >= 0 && fsync(tfd) < 0)
934 			{
935 				syserr("!queueup: cannot fsync queue temp file %s",
936 				       tf);
937 			}
938 			SYNC_DIR(qf, true);
939 		}
940 
941 		/* close and unlock old (locked) queue file */
942 		if (e->e_lockfp != NULL)
943 			(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
944 		e->e_lockfp = tfp;
945 
946 		/* save log info */
947 		if (LogLevel > 79)
948 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", qf);
949 	}
950 	else
951 	{
952 		/* save log info */
953 		if (LogLevel > 79)
954 			sm_syslog(LOG_DEBUG, e->e_id, "queueup %s", tf);
955 
956 		e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
957 	}
958 
959 	errno = 0;
960 	e->e_flags |= EF_INQUEUE;
961 
962 	if (tTd(40, 1))
963 		sm_dprintf("<<<<< done queueing %s <<<<<\n\n", e->e_id);
964 	return;
965 }
966 
967 /*
968 **  PRINTCTLADDR -- print control address to file.
969 **
970 **	Parameters:
971 **		a -- address.
972 **		tfp -- file pointer.
973 **
974 **	Returns:
975 **		none.
976 **
977 **	Side Effects:
978 **		The control address (if changed) is printed to the file.
979 **		The last control address and uid are saved.
980 */
981 
982 static void
983 printctladdr(a, tfp)
984 	register ADDRESS *a;
985 	SM_FILE_T *tfp;
986 {
987 	char *user;
988 	register ADDRESS *q;
989 	uid_t uid;
990 	gid_t gid;
991 	static ADDRESS *lastctladdr = NULL;
992 	static uid_t lastuid;
993 
994 	/* initialization */
995 	if (a == NULL || a->q_alias == NULL || tfp == NULL)
996 	{
997 		if (lastctladdr != NULL && tfp != NULL)
998 			(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C\n");
999 		lastctladdr = NULL;
1000 		lastuid = 0;
1001 		return;
1002 	}
1003 
1004 	/* find the active uid */
1005 	q = getctladdr(a);
1006 	if (q == NULL)
1007 	{
1008 		user = NULL;
1009 		uid = 0;
1010 		gid = 0;
1011 	}
1012 	else
1013 	{
1014 		user = q->q_ruser != NULL ? q->q_ruser : q->q_user;
1015 		uid = q->q_uid;
1016 		gid = q->q_gid;
1017 	}
1018 	a = a->q_alias;
1019 
1020 	/* check to see if this is the same as last time */
1021 	if (lastctladdr != NULL && uid == lastuid &&
1022 	    strcmp(lastctladdr->q_paddr, a->q_paddr) == 0)
1023 		return;
1024 	lastuid = uid;
1025 	lastctladdr = a;
1026 
1027 	if (uid == 0 || user == NULL || user[0] == '\0')
1028 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C");
1029 	else
1030 		(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, "C%s:%ld:%ld",
1031 				     denlstring(user, true, false), (long) uid,
1032 				     (long) gid);
1033 	(void) sm_io_fprintf(tfp, SM_TIME_DEFAULT, ":%s\n",
1034 			     denlstring(a->q_paddr, true, false));
1035 }
1036 
1037 /*
1038 **  RUNNERS_SIGTERM -- propagate a SIGTERM to queue runner process
1039 **
1040 **	This propagates the signal to the child processes that are queue
1041 **	runners. This is for a queue runner "cleanup". After all of the
1042 **	child queue runner processes are signaled (it should be SIGTERM
1043 **	being the sig) then the old signal handler (Oldsh) is called
1044 **	to handle any cleanup set for this process (provided it is not
1045 **	SIG_DFL or SIG_IGN). The signal may not be handled immediately
1046 **	if the BlockOldsh flag is set. If the current process doesn't
1047 **	have a parent then handle the signal immediately, regardless of
1048 **	BlockOldsh.
1049 **
1050 **	Parameters:
1051 **		sig -- the signal number being sent
1052 **
1053 **	Returns:
1054 **		none.
1055 **
1056 **	Side Effects:
1057 **		Sets the NoMoreRunners boolean to true to stop more runners
1058 **		from being started in runqueue().
1059 **
1060 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1061 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1062 **		DOING.
1063 */
1064 
1065 static bool		volatile NoMoreRunners = false;
1066 static sigfunc_t	Oldsh_term = SIG_DFL;
1067 static sigfunc_t	Oldsh_hup = SIG_DFL;
1068 static sigfunc_t	volatile Oldsh = SIG_DFL;
1069 static bool		BlockOldsh = false;
1070 static int		volatile Oldsig = 0;
1071 static SIGFUNC_DECL	runners_sigterm __P((int));
1072 static SIGFUNC_DECL	runners_sighup __P((int));
1073 
1074 static SIGFUNC_DECL
1075 runners_sigterm(sig)
1076 	int sig;
1077 {
1078 	int save_errno = errno;
1079 
1080 	FIX_SYSV_SIGNAL(sig, runners_sigterm);
1081 	errno = save_errno;
1082 	CHECK_CRITICAL(sig);
1083 	NoMoreRunners = true;
1084 	Oldsh = Oldsh_term;
1085 	Oldsig = sig;
1086 	proc_list_signal(PROC_QUEUE, sig);
1087 
1088 	if (!BlockOldsh || getppid() <= 1)
1089 	{
1090 		/* Check that a valid 'old signal handler' is callable */
1091 		if (Oldsh_term != SIG_DFL && Oldsh_term != SIG_IGN &&
1092 		    Oldsh_term != runners_sigterm)
1093 			(*Oldsh_term)(sig);
1094 	}
1095 	errno = save_errno;
1096 	return SIGFUNC_RETURN;
1097 }
1098 /*
1099 **  RUNNERS_SIGHUP -- propagate a SIGHUP to queue runner process
1100 **
1101 **	This propagates the signal to the child processes that are queue
1102 **	runners. This is for a queue runner "cleanup". After all of the
1103 **	child queue runner processes are signaled (it should be SIGHUP
1104 **	being the sig) then the old signal handler (Oldsh) is called to
1105 **	handle any cleanup set for this process (provided it is not SIG_DFL
1106 **	or SIG_IGN). The signal may not be handled immediately if the
1107 **	BlockOldsh flag is set. If the current process doesn't have
1108 **	a parent then handle the signal immediately, regardless of
1109 **	BlockOldsh.
1110 **
1111 **	Parameters:
1112 **		sig -- the signal number being sent
1113 **
1114 **	Returns:
1115 **		none.
1116 **
1117 **	Side Effects:
1118 **		Sets the NoMoreRunners boolean to true to stop more runners
1119 **		from being started in runqueue().
1120 **
1121 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1122 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1123 **		DOING.
1124 */
1125 
1126 static SIGFUNC_DECL
1127 runners_sighup(sig)
1128 	int sig;
1129 {
1130 	int save_errno = errno;
1131 
1132 	FIX_SYSV_SIGNAL(sig, runners_sighup);
1133 	errno = save_errno;
1134 	CHECK_CRITICAL(sig);
1135 	NoMoreRunners = true;
1136 	Oldsh = Oldsh_hup;
1137 	Oldsig = sig;
1138 	proc_list_signal(PROC_QUEUE, sig);
1139 
1140 	if (!BlockOldsh || getppid() <= 1)
1141 	{
1142 		/* Check that a valid 'old signal handler' is callable */
1143 		if (Oldsh_hup != SIG_DFL && Oldsh_hup != SIG_IGN &&
1144 		    Oldsh_hup != runners_sighup)
1145 			(*Oldsh_hup)(sig);
1146 	}
1147 	errno = save_errno;
1148 	return SIGFUNC_RETURN;
1149 }
1150 /*
1151 **  MARK_WORK_GROUP_RESTART -- mark a work group as needing a restart
1152 **
1153 **  Sets a workgroup for restarting.
1154 **
1155 **	Parameters:
1156 **		wgrp -- the work group id to restart.
1157 **		reason -- why (signal?), -1 to turn off restart
1158 **
1159 **	Returns:
1160 **		none.
1161 **
1162 **	Side effects:
1163 **		May set global RestartWorkGroup to true.
1164 **
1165 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
1166 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
1167 **		DOING.
1168 */
1169 
1170 void
1171 mark_work_group_restart(wgrp, reason)
1172 	int wgrp;
1173 	int reason;
1174 {
1175 	if (wgrp < 0 || wgrp > NumWorkGroups)
1176 		return;
1177 
1178 	WorkGrp[wgrp].wg_restart = reason;
1179 	if (reason >= 0)
1180 		RestartWorkGroup = true;
1181 }
1182 /*
1183 **  RESTART_MARKED_WORK_GROUPS -- restart work groups marked as needing restart
1184 **
1185 **  Restart any workgroup marked as needing a restart provided more
1186 **  runners are allowed.
1187 **
1188 **	Parameters:
1189 **		none.
1190 **
1191 **	Returns:
1192 **		none.
1193 **
1194 **	Side effects:
1195 **		Sets global RestartWorkGroup to false.
1196 */
1197 
1198 void
1199 restart_marked_work_groups()
1200 {
1201 	int i;
1202 	int wasblocked;
1203 
1204 	if (NoMoreRunners)
1205 		return;
1206 
1207 	/* Block SIGCHLD so reapchild() doesn't mess with us */
1208 	wasblocked = sm_blocksignal(SIGCHLD);
1209 
1210 	for (i = 0; i < NumWorkGroups; i++)
1211 	{
1212 		if (WorkGrp[i].wg_restart >= 0)
1213 		{
1214 			if (LogLevel > 8)
1215 				sm_syslog(LOG_ERR, NOQID,
1216 					  "restart queue runner=%d due to signal 0x%x",
1217 					  i, WorkGrp[i].wg_restart);
1218 			restart_work_group(i);
1219 		}
1220 	}
1221 	RestartWorkGroup = false;
1222 
1223 	if (wasblocked == 0)
1224 		(void) sm_releasesignal(SIGCHLD);
1225 }
1226 /*
1227 **  RESTART_WORK_GROUP -- restart a specific work group
1228 **
1229 **  Restart a specific workgroup provided more runners are allowed.
1230 **  If the requested work group has been restarted too many times log
1231 **  this and refuse to restart.
1232 **
1233 **	Parameters:
1234 **		wgrp -- the work group id to restart
1235 **
1236 **	Returns:
1237 **		none.
1238 **
1239 **	Side Effects:
1240 **		starts another process doing the work of wgrp
1241 */
1242 
1243 #define MAX_PERSIST_RESTART	10	/* max allowed number of restarts */
1244 
1245 static void
1246 restart_work_group(wgrp)
1247 	int wgrp;
1248 {
1249 	if (NoMoreRunners ||
1250 	    wgrp < 0 || wgrp > NumWorkGroups)
1251 		return;
1252 
1253 	WorkGrp[wgrp].wg_restart = -1;
1254 	if (WorkGrp[wgrp].wg_restartcnt < MAX_PERSIST_RESTART)
1255 	{
1256 		/* avoid overflow; increment here */
1257 		WorkGrp[wgrp].wg_restartcnt++;
1258 		(void) run_work_group(wgrp, RWG_FORK|RWG_PERSISTENT|RWG_RUNALL);
1259 	}
1260 	else
1261 	{
1262 		sm_syslog(LOG_ERR, NOQID,
1263 			  "ERROR: persistent queue runner=%d restarted too many times, queue runner lost",
1264 			  wgrp);
1265 	}
1266 }
1267 /*
1268 **  SCHEDULE_QUEUE_RUNS -- schedule the next queue run for a work group.
1269 **
1270 **	Parameters:
1271 **		runall -- schedule even if individual bit is not set.
1272 **		wgrp -- the work group id to schedule.
1273 **		didit -- the queue run was performed for this work group.
1274 **
1275 **	Returns:
1276 **		nothing
1277 */
1278 
1279 #define INCR_MOD(v, m)	if (++v >= m)	\
1280 				v = 0;	\
1281 			else
1282 
1283 static void
1284 schedule_queue_runs(runall, wgrp, didit)
1285 	bool runall;
1286 	int wgrp;
1287 	bool didit;
1288 {
1289 	int qgrp, cgrp, endgrp;
1290 #if _FFR_QUEUE_SCHED_DBG
1291 	time_t lastsched;
1292 	bool sched;
1293 #endif /* _FFR_QUEUE_SCHED_DBG */
1294 	time_t now;
1295 	time_t minqintvl;
1296 
1297 	/*
1298 	**  This is a bit ugly since we have to duplicate the
1299 	**  code that "walks" through a work queue group.
1300 	*/
1301 
1302 	now = curtime();
1303 	minqintvl = 0;
1304 	cgrp = endgrp = WorkGrp[wgrp].wg_curqgrp;
1305 	do
1306 	{
1307 		time_t qintvl;
1308 
1309 #if _FFR_QUEUE_SCHED_DBG
1310 		lastsched = 0;
1311 		sched = false;
1312 #endif /* _FFR_QUEUE_SCHED_DBG */
1313 		qgrp = WorkGrp[wgrp].wg_qgs[cgrp]->qg_index;
1314 		if (Queue[qgrp]->qg_queueintvl > 0)
1315 			qintvl = Queue[qgrp]->qg_queueintvl;
1316 		else if (QueueIntvl > 0)
1317 			qintvl = QueueIntvl;
1318 		else
1319 			qintvl = (time_t) 0;
1320 #if _FFR_QUEUE_SCHED_DBG
1321 		lastsched = Queue[qgrp]->qg_nextrun;
1322 #endif /* _FFR_QUEUE_SCHED_DBG */
1323 		if ((runall || Queue[qgrp]->qg_nextrun <= now) && qintvl > 0)
1324 		{
1325 #if _FFR_QUEUE_SCHED_DBG
1326 			sched = true;
1327 #endif /* _FFR_QUEUE_SCHED_DBG */
1328 			if (minqintvl == 0 || qintvl < minqintvl)
1329 				minqintvl = qintvl;
1330 
1331 			/*
1332 			**  Only set a new time if a queue run was performed
1333 			**  for this queue group.  If the queue was not run,
1334 			**  we could starve it by setting a new time on each
1335 			**  call.
1336 			*/
1337 
1338 			if (didit)
1339 				Queue[qgrp]->qg_nextrun += qintvl;
1340 		}
1341 #if _FFR_QUEUE_SCHED_DBG
1342 		if (tTd(69, 10))
1343 			sm_syslog(LOG_INFO, NOQID,
1344 				"sqr: wgrp=%d, cgrp=%d, qgrp=%d, intvl=%ld, QI=%ld, runall=%d, lastrun=%ld, nextrun=%ld, sched=%d",
1345 				wgrp, cgrp, qgrp, Queue[qgrp]->qg_queueintvl,
1346 				QueueIntvl, runall, lastsched,
1347 				Queue[qgrp]->qg_nextrun, sched);
1348 #endif /* _FFR_QUEUE_SCHED_DBG */
1349 		INCR_MOD(cgrp, WorkGrp[wgrp].wg_numqgrp);
1350 	} while (endgrp != cgrp);
1351 	if (minqintvl > 0)
1352 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1353 }
1354 
1355 #if _FFR_QUEUE_RUN_PARANOIA
1356 /*
1357 **  CHECKQUEUERUNNER -- check whether a queue group hasn't been run.
1358 **
1359 **	Use this if events may get lost and hence queue runners may not
1360 **	be started and mail will pile up in a queue.
1361 **
1362 **	Parameters:
1363 **		none.
1364 **
1365 **	Returns:
1366 **		true if a queue run is necessary.
1367 **
1368 **	Side Effects:
1369 **		may schedule a queue run.
1370 */
1371 
1372 bool
1373 checkqueuerunner()
1374 {
1375 	int qgrp;
1376 	time_t now, minqintvl;
1377 
1378 	now = curtime();
1379 	minqintvl = 0;
1380 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
1381 	{
1382 		time_t qintvl;
1383 
1384 		if (Queue[qgrp]->qg_queueintvl > 0)
1385 			qintvl = Queue[qgrp]->qg_queueintvl;
1386 		else if (QueueIntvl > 0)
1387 			qintvl = QueueIntvl;
1388 		else
1389 			qintvl = (time_t) 0;
1390 		if (Queue[qgrp]->qg_nextrun <= now - qintvl)
1391 		{
1392 			if (minqintvl == 0 || qintvl < minqintvl)
1393 				minqintvl = qintvl;
1394 			if (LogLevel > 1)
1395 				sm_syslog(LOG_WARNING, NOQID,
1396 					"checkqueuerunner: queue %d should have been run at %s, queue interval %ld",
1397 					qgrp,
1398 					arpadate(ctime(&Queue[qgrp]->qg_nextrun)),
1399 					qintvl);
1400 		}
1401 	}
1402 	if (minqintvl > 0)
1403 	{
1404 		(void) sm_setevent(minqintvl, runqueueevent, 0);
1405 		return true;
1406 	}
1407 	return false;
1408 }
1409 #endif /* _FFR_QUEUE_RUN_PARANOIA */
1410 
1411 /*
1412 **  RUNQUEUE -- run the jobs in the queue.
1413 **
1414 **	Gets the stuff out of the queue in some presumably logical
1415 **	order and processes them.
1416 **
1417 **	Parameters:
1418 **		forkflag -- true if the queue scanning should be done in
1419 **			a child process.  We double-fork so it is not our
1420 **			child and we don't have to clean up after it.
1421 **			false can be ignored if we have multiple queues.
1422 **		verbose -- if true, print out status information.
1423 **		persistent -- persistent queue runner?
1424 **		runall -- run all groups or only a subset (DoQueueRun)?
1425 **
1426 **	Returns:
1427 **		true if the queue run successfully began.
1428 **
1429 **	Side Effects:
1430 **		runs things in the mail queue using run_work_group().
1431 **		maybe schedules next queue run.
1432 */
1433 
1434 static ENVELOPE	QueueEnvelope;		/* the queue run envelope */
1435 static time_t	LastQueueTime = 0;	/* last time a queue ID assigned */
1436 static pid_t	LastQueuePid = -1;	/* last PID which had a queue ID */
1437 
1438 /* values for qp_supdirs */
1439 #define QP_NOSUB	0x0000	/* No subdirectories */
1440 #define QP_SUBDF	0x0001	/* "df" subdirectory */
1441 #define QP_SUBQF	0x0002	/* "qf" subdirectory */
1442 #define QP_SUBXF	0x0004	/* "xf" subdirectory */
1443 
1444 bool
1445 runqueue(forkflag, verbose, persistent, runall)
1446 	bool forkflag;
1447 	bool verbose;
1448 	bool persistent;
1449 	bool runall;
1450 {
1451 	int i;
1452 	bool ret = true;
1453 	static int curnum = 0;
1454 	sigfunc_t cursh;
1455 #if SM_HEAP_CHECK
1456 	SM_NONVOLATILE int oldgroup = 0;
1457 
1458 	if (sm_debug_active(&DebugLeakQ, 1))
1459 	{
1460 		oldgroup = sm_heap_group();
1461 		sm_heap_newgroup();
1462 		sm_dprintf("runqueue() heap group #%d\n", sm_heap_group());
1463 	}
1464 #endif /* SM_HEAP_CHECK */
1465 
1466 	/* queue run has been started, don't do any more this time */
1467 	DoQueueRun = false;
1468 
1469 	/* more than one queue or more than one directory per queue */
1470 	if (!forkflag && !verbose &&
1471 	    (WorkGrp[0].wg_qgs[0]->qg_numqueues > 1 || NumWorkGroups > 1 ||
1472 	     WorkGrp[0].wg_numqgrp > 1))
1473 		forkflag = true;
1474 
1475 	/*
1476 	**  For controlling queue runners via signals sent to this process.
1477 	**  Oldsh* will get called too by runners_sig* (if it is not SIG_IGN
1478 	**  or SIG_DFL) to preserve cleanup behavior. Now that this process
1479 	**  will have children (and perhaps grandchildren) this handler will
1480 	**  be left in place. This is because this process, once it has
1481 	**  finished spinning off queue runners, may go back to doing something
1482 	**  else (like being a daemon). And we still want on a SIG{TERM,HUP} to
1483 	**  clean up the child queue runners. Only install 'runners_sig*' once
1484 	**  else we'll get stuck looping forever.
1485 	*/
1486 
1487 	cursh = sm_signal(SIGTERM, runners_sigterm);
1488 	if (cursh != runners_sigterm)
1489 		Oldsh_term = cursh;
1490 	cursh = sm_signal(SIGHUP, runners_sighup);
1491 	if (cursh != runners_sighup)
1492 		Oldsh_hup = cursh;
1493 
1494 	for (i = 0; i < NumWorkGroups && !NoMoreRunners; i++)
1495 	{
1496 		int rwgflags = RWG_NONE;
1497 
1498 		/*
1499 		**  If MaxQueueChildren active then test whether the start
1500 		**  of the next queue group's additional queue runners (maximum)
1501 		**  will result in MaxQueueChildren being exceeded.
1502 		**
1503 		**  Note: do not use continue; even though another workgroup
1504 		**	may have fewer queue runners, this would be "unfair",
1505 		**	i.e., this work group might "starve" then.
1506 		*/
1507 
1508 #if _FFR_QUEUE_SCHED_DBG
1509 		if (tTd(69, 10))
1510 			sm_syslog(LOG_INFO, NOQID,
1511 				"rq: curnum=%d, MaxQueueChildren=%d, CurRunners=%d, WorkGrp[curnum].wg_maxact=%d",
1512 				curnum, MaxQueueChildren, CurRunners,
1513 				WorkGrp[curnum].wg_maxact);
1514 #endif /* _FFR_QUEUE_SCHED_DBG */
1515 		if (MaxQueueChildren > 0 &&
1516 		    CurRunners + WorkGrp[curnum].wg_maxact > MaxQueueChildren)
1517 			break;
1518 
1519 		/*
1520 		**  Pick up where we left off (curnum), in case we
1521 		**  used up all the children last time without finishing.
1522 		**  This give a round-robin fairness to queue runs.
1523 		**
1524 		**  Increment CurRunners before calling run_work_group()
1525 		**  to avoid a "race condition" with proc_list_drop() which
1526 		**  decrements CurRunners if the queue runners terminate.
1527 		**  Notice: CurRunners is an upper limit, in some cases
1528 		**  (too few jobs in the queue) this value is larger than
1529 		**  the actual number of queue runners. The discrepancy can
1530 		**  increase if some queue runners "hang" for a long time.
1531 		*/
1532 
1533 		CurRunners += WorkGrp[curnum].wg_maxact;
1534 		if (forkflag)
1535 			rwgflags |= RWG_FORK;
1536 		if (verbose)
1537 			rwgflags |= RWG_VERBOSE;
1538 		if (persistent)
1539 			rwgflags |= RWG_PERSISTENT;
1540 		if (runall)
1541 			rwgflags |= RWG_RUNALL;
1542 		ret = run_work_group(curnum, rwgflags);
1543 
1544 		/*
1545 		**  Failure means a message was printed for ETRN
1546 		**  and subsequent queues are likely to fail as well.
1547 		**  Decrement CurRunners in that case because
1548 		**  none have been started.
1549 		*/
1550 
1551 		if (!ret)
1552 		{
1553 			CurRunners -= WorkGrp[curnum].wg_maxact;
1554 			break;
1555 		}
1556 
1557 		if (!persistent)
1558 			schedule_queue_runs(runall, curnum, true);
1559 		INCR_MOD(curnum, NumWorkGroups);
1560 	}
1561 
1562 	/* schedule left over queue runs */
1563 	if (i < NumWorkGroups && !NoMoreRunners && !persistent)
1564 	{
1565 		int h;
1566 
1567 		for (h = curnum; i < NumWorkGroups; i++)
1568 		{
1569 			schedule_queue_runs(runall, h, false);
1570 			INCR_MOD(h, NumWorkGroups);
1571 		}
1572 	}
1573 
1574 
1575 #if SM_HEAP_CHECK
1576 	if (sm_debug_active(&DebugLeakQ, 1))
1577 		sm_heap_setgroup(oldgroup);
1578 #endif /* SM_HEAP_CHECK */
1579 	return ret;
1580 }
1581 
1582 #if _FFR_SKIP_DOMAINS
1583 /*
1584 **  SKIP_DOMAINS -- Skip 'skip' number of domains in the WorkQ.
1585 **
1586 **  Added by Stephen Frost <sfrost@snowman.net> to support
1587 **  having each runner process every N'th domain instead of
1588 **  every N'th message.
1589 **
1590 **	Parameters:
1591 **		skip -- number of domains in WorkQ to skip.
1592 **
1593 **	Returns:
1594 **		total number of messages skipped.
1595 **
1596 **	Side Effects:
1597 **		may change WorkQ
1598 */
1599 
1600 static int
1601 skip_domains(skip)
1602 	int skip;
1603 {
1604 	int n, seqjump;
1605 
1606 	for (n = 0, seqjump = 0; n < skip && WorkQ != NULL; seqjump++)
1607 	{
1608 		if (WorkQ->w_next != NULL)
1609 		{
1610 			if (WorkQ->w_host != NULL &&
1611 			    WorkQ->w_next->w_host != NULL)
1612 			{
1613 				if (sm_strcasecmp(WorkQ->w_host,
1614 						WorkQ->w_next->w_host) != 0)
1615 					n++;
1616 			}
1617 			else
1618 			{
1619 				if ((WorkQ->w_host != NULL &&
1620 				     WorkQ->w_next->w_host == NULL) ||
1621 				    (WorkQ->w_host == NULL &&
1622 				     WorkQ->w_next->w_host != NULL))
1623 					     n++;
1624 			}
1625 		}
1626 		WorkQ = WorkQ->w_next;
1627 	}
1628 	return seqjump;
1629 }
1630 #endif /* _FFR_SKIP_DOMAINS */
1631 
1632 /*
1633 **  RUNNER_WORK -- have a queue runner do its work
1634 **
1635 **  Have a queue runner do its work a list of entries.
1636 **  When work isn't directly being done then this process can take a signal
1637 **  and terminate immediately (in a clean fashion of course).
1638 **  When work is directly being done, it's not to be interrupted
1639 **  immediately: the work should be allowed to finish at a clean point
1640 **  before termination (in a clean fashion of course).
1641 **
1642 **	Parameters:
1643 **		e -- envelope.
1644 **		sequenceno -- 'th process to run WorkQ.
1645 **		didfork -- did the calling process fork()?
1646 **		skip -- process only each skip'th item.
1647 **		njobs -- number of jobs in WorkQ.
1648 **
1649 **	Returns:
1650 **		none.
1651 **
1652 **	Side Effects:
1653 **		runs things in the mail queue.
1654 */
1655 
1656 static void
1657 runner_work(e, sequenceno, didfork, skip, njobs)
1658 	register ENVELOPE *e;
1659 	int sequenceno;
1660 	bool didfork;
1661 	int skip;
1662 	int njobs;
1663 {
1664 	int n, seqjump;
1665 	WORK *w;
1666 	time_t now;
1667 
1668 	SM_GET_LA(now);
1669 
1670 	/*
1671 	**  Here we temporarily block the second calling of the handlers.
1672 	**  This allows us to handle the signal without terminating in the
1673 	**  middle of direct work. If a signal does come, the test for
1674 	**  NoMoreRunners will find it.
1675 	*/
1676 
1677 	BlockOldsh = true;
1678 	seqjump = skip;
1679 
1680 	/* process them once at a time */
1681 	while (WorkQ != NULL)
1682 	{
1683 #if SM_HEAP_CHECK
1684 		SM_NONVOLATILE int oldgroup = 0;
1685 
1686 		if (sm_debug_active(&DebugLeakQ, 1))
1687 		{
1688 			oldgroup = sm_heap_group();
1689 			sm_heap_newgroup();
1690 			sm_dprintf("run_queue_group() heap group #%d\n",
1691 				sm_heap_group());
1692 		}
1693 #endif /* SM_HEAP_CHECK */
1694 
1695 		/* do no more work */
1696 		if (NoMoreRunners)
1697 		{
1698 			/* Check that a valid signal handler is callable */
1699 			if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1700 			    Oldsh != runners_sighup &&
1701 			    Oldsh != runners_sigterm)
1702 				(*Oldsh)(Oldsig);
1703 			break;
1704 		}
1705 
1706 		w = WorkQ; /* assign current work item */
1707 
1708 		/*
1709 		**  Set the head of the WorkQ to the next work item.
1710 		**  It is set 'skip' ahead (the number of parallel queue
1711 		**  runners working on WorkQ together) since each runner
1712 		**  works on every 'skip'th (N-th) item.
1713 #if _FFR_SKIP_DOMAINS
1714 		**  In the case of the BYHOST Queue Sort Order, the 'item'
1715 		**  is a domain, so we work on every 'skip'th (N-th) domain.
1716 #endif * _FFR_SKIP_DOMAINS *
1717 		*/
1718 
1719 #if _FFR_SKIP_DOMAINS
1720 		if (QueueSortOrder == QSO_BYHOST)
1721 		{
1722 			seqjump = 1;
1723 			if (WorkQ->w_next != NULL)
1724 			{
1725 				if (WorkQ->w_host != NULL &&
1726 				    WorkQ->w_next->w_host != NULL)
1727 				{
1728 					if (sm_strcasecmp(WorkQ->w_host,
1729 							WorkQ->w_next->w_host)
1730 								!= 0)
1731 						seqjump = skip_domains(skip);
1732 					else
1733 						WorkQ = WorkQ->w_next;
1734 				}
1735 				else
1736 				{
1737 					if ((WorkQ->w_host != NULL &&
1738 					     WorkQ->w_next->w_host == NULL) ||
1739 					    (WorkQ->w_host == NULL &&
1740 					     WorkQ->w_next->w_host != NULL))
1741 						seqjump = skip_domains(skip);
1742 					else
1743 						WorkQ = WorkQ->w_next;
1744 				}
1745 			}
1746 			else
1747 				WorkQ = WorkQ->w_next;
1748 		}
1749 		else
1750 #endif /* _FFR_SKIP_DOMAINS */
1751 		{
1752 			for (n = 0; n < skip && WorkQ != NULL; n++)
1753 				WorkQ = WorkQ->w_next;
1754 		}
1755 
1756 		e->e_to = NULL;
1757 
1758 		/*
1759 		**  Ignore jobs that are too expensive for the moment.
1760 		**
1761 		**	Get new load average every GET_NEW_LA_TIME seconds.
1762 		*/
1763 
1764 		SM_GET_LA(now);
1765 		if (shouldqueue(WkRecipFact, Current_LA_time))
1766 		{
1767 			char *msg = "Aborting queue run: load average too high";
1768 
1769 			if (Verbose)
1770 				message("%s", msg);
1771 			if (LogLevel > 8)
1772 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1773 			break;
1774 		}
1775 		if (shouldqueue(w->w_pri, w->w_ctime))
1776 		{
1777 			if (Verbose)
1778 				message(EmptyString);
1779 			if (QueueSortOrder == QSO_BYPRIORITY)
1780 			{
1781 				if (Verbose)
1782 					message("Skipping %s/%s (sequence %d of %d) and flushing rest of queue",
1783 						qid_printqueue(w->w_qgrp,
1784 							       w->w_qdir),
1785 						w->w_name + 2, sequenceno,
1786 						njobs);
1787 				if (LogLevel > 8)
1788 					sm_syslog(LOG_INFO, NOQID,
1789 						  "runqueue: Flushing queue from %s/%s (pri %ld, LA %d, %d of %d)",
1790 						  qid_printqueue(w->w_qgrp,
1791 								 w->w_qdir),
1792 						  w->w_name + 2, w->w_pri,
1793 						  CurrentLA, sequenceno,
1794 						  njobs);
1795 				break;
1796 			}
1797 			else if (Verbose)
1798 				message("Skipping %s/%s (sequence %d of %d)",
1799 					qid_printqueue(w->w_qgrp, w->w_qdir),
1800 					w->w_name + 2, sequenceno, njobs);
1801 		}
1802 		else
1803 		{
1804 			if (Verbose)
1805 			{
1806 				message(EmptyString);
1807 				message("Running %s/%s (sequence %d of %d)",
1808 					qid_printqueue(w->w_qgrp, w->w_qdir),
1809 					w->w_name + 2, sequenceno, njobs);
1810 			}
1811 			if (didfork && MaxQueueChildren > 0)
1812 			{
1813 				sm_blocksignal(SIGCHLD);
1814 				(void) sm_signal(SIGCHLD, reapchild);
1815 			}
1816 			if (tTd(63, 100))
1817 				sm_syslog(LOG_DEBUG, NOQID,
1818 					  "runqueue %s dowork(%s)",
1819 					  qid_printqueue(w->w_qgrp, w->w_qdir),
1820 					  w->w_name + 2);
1821 
1822 			(void) dowork(w->w_qgrp, w->w_qdir, w->w_name + 2,
1823 				      ForkQueueRuns, false, e);
1824 			errno = 0;
1825 		}
1826 		sm_free(w->w_name); /* XXX */
1827 		if (w->w_host != NULL)
1828 			sm_free(w->w_host); /* XXX */
1829 		sm_free((char *) w); /* XXX */
1830 		sequenceno += seqjump; /* next sequence number */
1831 #if SM_HEAP_CHECK
1832 		if (sm_debug_active(&DebugLeakQ, 1))
1833 			sm_heap_setgroup(oldgroup);
1834 #endif /* SM_HEAP_CHECK */
1835 	}
1836 
1837 	BlockOldsh = false;
1838 
1839 	/* check the signals didn't happen during the revert */
1840 	if (NoMoreRunners)
1841 	{
1842 		/* Check that a valid signal handler is callable */
1843 		if (Oldsh != SIG_DFL && Oldsh != SIG_IGN &&
1844 		    Oldsh != runners_sighup && Oldsh != runners_sigterm)
1845 			(*Oldsh)(Oldsig);
1846 	}
1847 
1848 	Oldsh = SIG_DFL; /* after the NoMoreRunners check */
1849 }
1850 /*
1851 **  RUN_WORK_GROUP -- run the jobs in a queue group from a work group.
1852 **
1853 **	Gets the stuff out of the queue in some presumably logical
1854 **	order and processes them.
1855 **
1856 **	Parameters:
1857 **		wgrp -- work group to process.
1858 **		flags -- RWG_* flags
1859 **
1860 **	Returns:
1861 **		true if the queue run successfully began.
1862 **
1863 **	Side Effects:
1864 **		runs things in the mail queue.
1865 */
1866 
1867 /* Minimum sleep time for persistent queue runners */
1868 #define MIN_SLEEP_TIME	5
1869 
1870 bool
1871 run_work_group(wgrp, flags)
1872 	int wgrp;
1873 	int flags;
1874 {
1875 	register ENVELOPE *e;
1876 	int njobs, qdir;
1877 	int sequenceno = 1;
1878 	int qgrp, endgrp, h, i;
1879 	time_t now;
1880 	bool full, more;
1881 	SM_RPOOL_T *rpool;
1882 	extern ENVELOPE BlankEnvelope;
1883 	extern SIGFUNC_DECL reapchild __P((int));
1884 
1885 	if (wgrp < 0)
1886 		return false;
1887 
1888 	/*
1889 	**  If no work will ever be selected, don't even bother reading
1890 	**  the queue.
1891 	*/
1892 
1893 	SM_GET_LA(now);
1894 
1895 	if (!bitset(RWG_PERSISTENT, flags) &&
1896 	    shouldqueue(WkRecipFact, Current_LA_time))
1897 	{
1898 		char *msg = "Skipping queue run -- load average too high";
1899 
1900 		if (bitset(RWG_VERBOSE, flags))
1901 			message("458 %s\n", msg);
1902 		if (LogLevel > 8)
1903 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s", msg);
1904 		return false;
1905 	}
1906 
1907 	/*
1908 	**  See if we already have too many children.
1909 	*/
1910 
1911 	if (bitset(RWG_FORK, flags) &&
1912 	    WorkGrp[wgrp].wg_lowqintvl > 0 &&
1913 	    !bitset(RWG_PERSISTENT, flags) &&
1914 	    MaxChildren > 0 && CurChildren >= MaxChildren)
1915 	{
1916 		char *msg = "Skipping queue run -- too many children";
1917 
1918 		if (bitset(RWG_VERBOSE, flags))
1919 			message("458 %s (%d)\n", msg, CurChildren);
1920 		if (LogLevel > 8)
1921 			sm_syslog(LOG_INFO, NOQID, "runqueue: %s (%d)",
1922 				  msg, CurChildren);
1923 		return false;
1924 	}
1925 
1926 	/*
1927 	**  See if we want to go off and do other useful work.
1928 	*/
1929 
1930 	if (bitset(RWG_FORK, flags))
1931 	{
1932 		pid_t pid;
1933 
1934 		(void) sm_blocksignal(SIGCHLD);
1935 		(void) sm_signal(SIGCHLD, reapchild);
1936 
1937 		pid = dofork();
1938 		if (pid == -1)
1939 		{
1940 			const char *msg = "Skipping queue run -- fork() failed";
1941 			const char *err = sm_errstring(errno);
1942 
1943 			if (bitset(RWG_VERBOSE, flags))
1944 				message("458 %s: %s\n", msg, err);
1945 			if (LogLevel > 8)
1946 				sm_syslog(LOG_INFO, NOQID, "runqueue: %s: %s",
1947 					  msg, err);
1948 			(void) sm_releasesignal(SIGCHLD);
1949 			return false;
1950 		}
1951 		if (pid != 0)
1952 		{
1953 			/* parent -- pick up intermediate zombie */
1954 			(void) sm_blocksignal(SIGALRM);
1955 
1956 			/* wgrp only used when queue runners are persistent */
1957 			proc_list_add(pid, "Queue runner", PROC_QUEUE,
1958 				      WorkGrp[wgrp].wg_maxact,
1959 				      bitset(RWG_PERSISTENT, flags) ? wgrp : -1,
1960 				      NULL);
1961 			(void) sm_releasesignal(SIGALRM);
1962 			(void) sm_releasesignal(SIGCHLD);
1963 			return true;
1964 		}
1965 
1966 		/* child -- clean up signals */
1967 
1968 		/* Reset global flags */
1969 		RestartRequest = NULL;
1970 		RestartWorkGroup = false;
1971 		ShutdownRequest = NULL;
1972 		PendingSignal = 0;
1973 		CurrentPid = getpid();
1974 		close_sendmail_pid();
1975 
1976 		/*
1977 		**  Initialize exception stack and default exception
1978 		**  handler for child process.
1979 		*/
1980 
1981 		sm_exc_newthread(fatal_error);
1982 		clrcontrol();
1983 		proc_list_clear();
1984 
1985 		/* Add parent process as first child item */
1986 		proc_list_add(CurrentPid, "Queue runner child process",
1987 			      PROC_QUEUE_CHILD, 0, -1, NULL);
1988 		(void) sm_releasesignal(SIGCHLD);
1989 		(void) sm_signal(SIGCHLD, SIG_DFL);
1990 		(void) sm_signal(SIGHUP, SIG_DFL);
1991 		(void) sm_signal(SIGTERM, intsig);
1992 	}
1993 
1994 	/*
1995 	**  Release any resources used by the daemon code.
1996 	*/
1997 
1998 	clrdaemon();
1999 
2000 	/* force it to run expensive jobs */
2001 	NoConnect = false;
2002 
2003 	/* drop privileges */
2004 	if (geteuid() == (uid_t) 0)
2005 		(void) drop_privileges(false);
2006 
2007 	/*
2008 	**  Create ourselves an envelope
2009 	*/
2010 
2011 	CurEnv = &QueueEnvelope;
2012 	rpool = sm_rpool_new_x(NULL);
2013 	e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2014 	e->e_flags = BlankEnvelope.e_flags;
2015 	e->e_parent = NULL;
2016 
2017 	/* make sure we have disconnected from parent */
2018 	if (bitset(RWG_FORK, flags))
2019 	{
2020 		disconnect(1, e);
2021 		QuickAbort = false;
2022 	}
2023 
2024 	/*
2025 	**  If we are running part of the queue, always ignore stored
2026 	**  host status.
2027 	*/
2028 
2029 	if (QueueLimitId != NULL || QueueLimitSender != NULL ||
2030 	    QueueLimitQuarantine != NULL ||
2031 	    QueueLimitRecipient != NULL)
2032 	{
2033 		IgnoreHostStatus = true;
2034 		MinQueueAge = 0;
2035 	}
2036 
2037 	/*
2038 	**  Here is where we choose the queue group from the work group.
2039 	**  The caller of the "domorework" label must setup a new envelope.
2040 	*/
2041 
2042 	endgrp = WorkGrp[wgrp].wg_curqgrp; /* to not spin endlessly */
2043 
2044   domorework:
2045 
2046 	/*
2047 	**  Run a queue group if:
2048 	**  RWG_RUNALL bit is set or the bit for this group is set.
2049 	*/
2050 
2051 	now = curtime();
2052 	for (;;)
2053 	{
2054 		/*
2055 		**  Find the next queue group within the work group that
2056 		**  has been marked as needing a run.
2057 		*/
2058 
2059 		qgrp = WorkGrp[wgrp].wg_qgs[WorkGrp[wgrp].wg_curqgrp]->qg_index;
2060 		WorkGrp[wgrp].wg_curqgrp++; /* advance */
2061 		WorkGrp[wgrp].wg_curqgrp %= WorkGrp[wgrp].wg_numqgrp; /* wrap */
2062 		if (bitset(RWG_RUNALL, flags) ||
2063 		    (Queue[qgrp]->qg_nextrun <= now &&
2064 		     Queue[qgrp]->qg_nextrun != (time_t) -1))
2065 			break;
2066 		if (endgrp == WorkGrp[wgrp].wg_curqgrp)
2067 		{
2068 			e->e_id = NULL;
2069 			if (bitset(RWG_FORK, flags))
2070 				finis(true, true, ExitStat);
2071 			return true; /* we're done */
2072 		}
2073 	}
2074 
2075 	qdir = Queue[qgrp]->qg_curnum; /* round-robin init of queue position */
2076 #if _FFR_QUEUE_SCHED_DBG
2077 	if (tTd(69, 12))
2078 		sm_syslog(LOG_INFO, NOQID,
2079 			"rwg: wgrp=%d, qgrp=%d, qdir=%d, name=%s, curqgrp=%d, numgrps=%d",
2080 			wgrp, qgrp, qdir, qid_printqueue(qgrp, qdir),
2081 			WorkGrp[wgrp].wg_curqgrp, WorkGrp[wgrp].wg_numqgrp);
2082 #endif /* _FFR_QUEUE_SCHED_DBG */
2083 
2084 #if HASNICE
2085 	/* tweak niceness of queue runs */
2086 	if (Queue[qgrp]->qg_nice > 0)
2087 		(void) nice(Queue[qgrp]->qg_nice);
2088 #endif /* HASNICE */
2089 
2090 	/* XXX running queue group... */
2091 	sm_setproctitle(true, CurEnv, "running queue: %s",
2092 			qid_printqueue(qgrp, qdir));
2093 
2094 	if (LogLevel > 69 || tTd(63, 99))
2095 		sm_syslog(LOG_DEBUG, NOQID,
2096 			  "runqueue %s, pid=%d, forkflag=%d",
2097 			  qid_printqueue(qgrp, qdir), (int) CurrentPid,
2098 			  bitset(RWG_FORK, flags));
2099 
2100 	/*
2101 	**  Start making passes through the queue.
2102 	**	First, read and sort the entire queue.
2103 	**	Then, process the work in that order.
2104 	**		But if you take too long, start over.
2105 	*/
2106 
2107 	for (i = 0; i < Queue[qgrp]->qg_numqueues; i++)
2108 	{
2109 		h = gatherq(qgrp, qdir, false, &full, &more);
2110 #if SM_CONF_SHM
2111 		if (ShmId != SM_SHM_NO_ID)
2112 			QSHM_ENTRIES(Queue[qgrp]->qg_qpaths[qdir].qp_idx) = h;
2113 #endif /* SM_CONF_SHM */
2114 		/* If there are no more items in this queue advance */
2115 		if (!more)
2116 		{
2117 			/* A round-robin advance */
2118 			qdir++;
2119 			qdir %= Queue[qgrp]->qg_numqueues;
2120 		}
2121 
2122 		/* Has the WorkList reached the limit? */
2123 		if (full)
2124 			break; /* don't try to gather more */
2125 	}
2126 
2127 	/* order the existing work requests */
2128 	njobs = sortq(Queue[qgrp]->qg_maxlist);
2129 	Queue[qgrp]->qg_curnum = qdir; /* update */
2130 
2131 
2132 	if (!Verbose && bitnset(QD_FORK, Queue[qgrp]->qg_flags))
2133 	{
2134 		int loop, maxrunners;
2135 		pid_t pid;
2136 
2137 		/*
2138 		**  For this WorkQ we want to fork off N children (maxrunners)
2139 		**  at this point. Each child has a copy of WorkQ. Each child
2140 		**  will process every N-th item. The parent will wait for all
2141 		**  of the children to finish before moving on to the next
2142 		**  queue group within the work group. This saves us forking
2143 		**  a new runner-child for each work item.
2144 		**  It's valid for qg_maxqrun == 0 since this may be an
2145 		**  explicit "don't run this queue" setting.
2146 		*/
2147 
2148 		maxrunners = Queue[qgrp]->qg_maxqrun;
2149 
2150 		/* No need to have more runners then there are jobs */
2151 		if (maxrunners > njobs)
2152 			maxrunners = njobs;
2153 		for (loop = 0; loop < maxrunners; loop++)
2154 		{
2155 			/*
2156 			**  Since the delivery may happen in a child and the
2157 			**  parent does not wait, the parent may close the
2158 			**  maps thereby removing any shared memory used by
2159 			**  the map.  Therefore, close the maps now so the
2160 			**  child will dynamically open them if necessary.
2161 			*/
2162 
2163 			closemaps(false);
2164 
2165 			pid = fork();
2166 			if (pid < 0)
2167 			{
2168 				syserr("run_work_group: cannot fork");
2169 				return false;
2170 			}
2171 			else if (pid > 0)
2172 			{
2173 				/* parent -- clean out connection cache */
2174 				mci_flush(false, NULL);
2175 #if _FFR_SKIP_DOMAINS
2176 				if (QueueSortOrder == QSO_BYHOST)
2177 				{
2178 					sequenceno += skip_domains(1);
2179 				}
2180 				else
2181 #endif /* _FFR_SKIP_DOMAINS */
2182 				{
2183 					/* for the skip */
2184 					WorkQ = WorkQ->w_next;
2185 					sequenceno++;
2186 				}
2187 				proc_list_add(pid, "Queue child runner process",
2188 					      PROC_QUEUE_CHILD, 0, -1, NULL);
2189 
2190 				/* No additional work, no additional runners */
2191 				if (WorkQ == NULL)
2192 					break;
2193 			}
2194 			else
2195 			{
2196 				/* child -- Reset global flags */
2197 				RestartRequest = NULL;
2198 				RestartWorkGroup = false;
2199 				ShutdownRequest = NULL;
2200 				PendingSignal = 0;
2201 				CurrentPid = getpid();
2202 				close_sendmail_pid();
2203 
2204 				/*
2205 				**  Initialize exception stack and default
2206 				**  exception handler for child process.
2207 				**  When fork()'d the child now has a private
2208 				**  copy of WorkQ at its current position.
2209 				*/
2210 
2211 				sm_exc_newthread(fatal_error);
2212 
2213 				/*
2214 				**  SMTP processes (whether -bd or -bs) set
2215 				**  SIGCHLD to reapchild to collect
2216 				**  children status.  However, at delivery
2217 				**  time, that status must be collected
2218 				**  by sm_wait() to be dealt with properly
2219 				**  (check success of delivery based
2220 				**  on status code, etc).  Therefore, if we
2221 				**  are an SMTP process, reset SIGCHLD
2222 				**  back to the default so reapchild
2223 				**  doesn't collect status before
2224 				**  sm_wait().
2225 				*/
2226 
2227 				if (OpMode == MD_SMTP ||
2228 				    OpMode == MD_DAEMON ||
2229 				    MaxQueueChildren > 0)
2230 				{
2231 					proc_list_clear();
2232 					sm_releasesignal(SIGCHLD);
2233 					(void) sm_signal(SIGCHLD, SIG_DFL);
2234 				}
2235 
2236 				/* child -- error messages to the transcript */
2237 				QuickAbort = OnlyOneError = false;
2238 				runner_work(e, sequenceno, true,
2239 					    maxrunners, njobs);
2240 
2241 				/* This child is done */
2242 				finis(true, true, ExitStat);
2243 				/* NOTREACHED */
2244 			}
2245 		}
2246 
2247 		sm_releasesignal(SIGCHLD);
2248 
2249 		/*
2250 		**  Wait until all of the runners have completed before
2251 		**  seeing if there is another queue group in the
2252 		**  work group to process.
2253 		**  XXX Future enhancement: don't wait() for all children
2254 		**  here, just go ahead and make sure that overall the number
2255 		**  of children is not exceeded.
2256 		*/
2257 
2258 		while (CurChildren > 0)
2259 		{
2260 			int status;
2261 			pid_t ret;
2262 
2263 			while ((ret = sm_wait(&status)) <= 0)
2264 				continue;
2265 			proc_list_drop(ret, status, NULL);
2266 		}
2267 	}
2268 	else if (Queue[qgrp]->qg_maxqrun > 0 || bitset(RWG_FORCE, flags))
2269 	{
2270 		/*
2271 		**  When current process will not fork children to do the work,
2272 		**  it will do the work itself. The 'skip' will be 1 since
2273 		**  there are no child runners to divide the work across.
2274 		*/
2275 
2276 		runner_work(e, sequenceno, false, 1, njobs);
2277 	}
2278 
2279 	/* free memory allocated by newenvelope() above */
2280 	sm_rpool_free(rpool);
2281 	QueueEnvelope.e_rpool = NULL;
2282 
2283 	/* Are there still more queues in the work group to process? */
2284 	if (endgrp != WorkGrp[wgrp].wg_curqgrp)
2285 	{
2286 		rpool = sm_rpool_new_x(NULL);
2287 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2288 		e->e_flags = BlankEnvelope.e_flags;
2289 		goto domorework;
2290 	}
2291 
2292 	/* No more queues in work group to process. Now check persistent. */
2293 	if (bitset(RWG_PERSISTENT, flags))
2294 	{
2295 		sequenceno = 1;
2296 		sm_setproctitle(true, CurEnv, "running queue: %s",
2297 				qid_printqueue(qgrp, qdir));
2298 
2299 		/*
2300 		**  close bogus maps, i.e., maps which caused a tempfail,
2301 		**	so we get fresh map connections on the next lookup.
2302 		**  closemaps() is also called when children are started.
2303 		*/
2304 
2305 		closemaps(true);
2306 
2307 		/* Close any cached connections. */
2308 		mci_flush(true, NULL);
2309 
2310 		/* Clean out expired related entries. */
2311 		rmexpstab();
2312 
2313 #if NAMED_BIND
2314 		/* Update MX records for FallbackMX. */
2315 		if (FallbackMX != NULL)
2316 			(void) getfallbackmxrr(FallbackMX);
2317 #endif /* NAMED_BIND */
2318 
2319 #if USERDB
2320 		/* close UserDatabase */
2321 		_udbx_close();
2322 #endif /* USERDB */
2323 
2324 #if SM_HEAP_CHECK
2325 		if (sm_debug_active(&SmHeapCheck, 2)
2326 		    && access("memdump", F_OK) == 0
2327 		   )
2328 		{
2329 			SM_FILE_T *out;
2330 
2331 			remove("memdump");
2332 			out = sm_io_open(SmFtStdio, SM_TIME_DEFAULT,
2333 					 "memdump.out", SM_IO_APPEND, NULL);
2334 			if (out != NULL)
2335 			{
2336 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT, "----------------------\n");
2337 				sm_heap_report(out,
2338 					sm_debug_level(&SmHeapCheck) - 1);
2339 				(void) sm_io_close(out, SM_TIME_DEFAULT);
2340 			}
2341 		}
2342 #endif /* SM_HEAP_CHECK */
2343 
2344 		/* let me rest for a second to catch my breath */
2345 		if (njobs == 0 && WorkGrp[wgrp].wg_lowqintvl < MIN_SLEEP_TIME)
2346 			sleep(MIN_SLEEP_TIME);
2347 		else if (WorkGrp[wgrp].wg_lowqintvl <= 0)
2348 			sleep(QueueIntvl > 0 ? QueueIntvl : MIN_SLEEP_TIME);
2349 		else
2350 			sleep(WorkGrp[wgrp].wg_lowqintvl);
2351 
2352 		/*
2353 		**  Get the LA outside the WorkQ loop if necessary.
2354 		**  In a persistent queue runner the code is repeated over
2355 		**  and over but gatherq() may ignore entries due to
2356 		**  shouldqueue() (do we really have to do this twice?).
2357 		**  Hence the queue runners would just idle around when once
2358 		**  CurrentLA caused all entries in a queue to be ignored.
2359 		*/
2360 
2361 		if (njobs == 0)
2362 			SM_GET_LA(now);
2363 		rpool = sm_rpool_new_x(NULL);
2364 		e = newenvelope(&QueueEnvelope, CurEnv, rpool);
2365 		e->e_flags = BlankEnvelope.e_flags;
2366 		goto domorework;
2367 	}
2368 
2369 	/* exit without the usual cleanup */
2370 	e->e_id = NULL;
2371 	if (bitset(RWG_FORK, flags))
2372 		finis(true, true, ExitStat);
2373 	/* NOTREACHED */
2374 	return true;
2375 }
2376 
2377 /*
2378 **  DOQUEUERUN -- do a queue run?
2379 */
2380 
2381 bool
2382 doqueuerun()
2383 {
2384 	return DoQueueRun;
2385 }
2386 
2387 /*
2388 **  RUNQUEUEEVENT -- Sets a flag to indicate that a queue run should be done.
2389 **
2390 **	Parameters:
2391 **		none.
2392 **
2393 **	Returns:
2394 **		none.
2395 **
2396 **	Side Effects:
2397 **		The invocation of this function via an alarm may interrupt
2398 **		a set of actions. Thus errno may be set in that context.
2399 **		We need to restore errno at the end of this function to ensure
2400 **		that any work done here that sets errno doesn't return a
2401 **		misleading/false errno value. Errno may	be EINTR upon entry to
2402 **		this function because of non-restartable/continuable system
2403 **		API was active. Iff this is true we will override errno as
2404 **		a timeout (as a more accurate error message).
2405 **
2406 **	NOTE:	THIS CAN BE CALLED FROM A SIGNAL HANDLER.  DO NOT ADD
2407 **		ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
2408 **		DOING.
2409 */
2410 
2411 void
2412 runqueueevent(ignore)
2413 	int ignore;
2414 {
2415 	int save_errno = errno;
2416 
2417 	/*
2418 	**  Set the general bit that we want a queue run,
2419 	**  tested in doqueuerun()
2420 	*/
2421 
2422 	DoQueueRun = true;
2423 #if _FFR_QUEUE_SCHED_DBG
2424 	if (tTd(69, 10))
2425 		sm_syslog(LOG_INFO, NOQID, "rqe: done");
2426 #endif /* _FFR_QUEUE_SCHED_DBG */
2427 
2428 	errno = save_errno;
2429 	if (errno == EINTR)
2430 		errno = ETIMEDOUT;
2431 }
2432 /*
2433 **  GATHERQ -- gather messages from the message queue(s) the work queue.
2434 **
2435 **	Parameters:
2436 **		qgrp -- the index of the queue group.
2437 **		qdir -- the index of the queue directory.
2438 **		doall -- if set, include everything in the queue (even
2439 **			the jobs that cannot be run because the load
2440 **			average is too high, or MaxQueueRun is reached).
2441 **			Otherwise, exclude those jobs.
2442 **		full -- (optional) to be set 'true' if WorkList is full
2443 **		more -- (optional) to be set 'true' if there are still more
2444 **			messages in this queue not added to WorkList
2445 **
2446 **	Returns:
2447 **		The number of request in the queue (not necessarily
2448 **		the number of requests in WorkList however).
2449 **
2450 **	Side Effects:
2451 **		prepares available work into WorkList
2452 */
2453 
2454 #define NEED_P		0001	/* 'P': priority */
2455 #define NEED_T		0002	/* 'T': time */
2456 #define NEED_R		0004	/* 'R': recipient */
2457 #define NEED_S		0010	/* 'S': sender */
2458 #define NEED_H		0020	/* host */
2459 #define HAS_QUARANTINE	0040	/* has an unexpected 'q' line */
2460 #define NEED_QUARANTINE	0100	/* 'q': reason */
2461 
2462 static WORK	*WorkList = NULL;	/* list of unsort work */
2463 static int	WorkListSize = 0;	/* current max size of WorkList */
2464 static int	WorkListCount = 0;	/* # of work items in WorkList */
2465 
2466 static int
2467 gatherq(qgrp, qdir, doall, full, more)
2468 	int qgrp;
2469 	int qdir;
2470 	bool doall;
2471 	bool *full;
2472 	bool *more;
2473 {
2474 	register struct dirent *d;
2475 	register WORK *w;
2476 	register char *p;
2477 	DIR *f;
2478 	int i, num_ent;
2479 	int wn;
2480 	QUEUE_CHAR *check;
2481 	char qd[MAXPATHLEN];
2482 	char qf[MAXPATHLEN];
2483 
2484 	wn = WorkListCount - 1;
2485 	num_ent = 0;
2486 	if (qdir == NOQDIR)
2487 		(void) sm_strlcpy(qd, ".", sizeof(qd));
2488 	else
2489 		(void) sm_strlcpyn(qd, sizeof(qd), 2,
2490 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
2491 			(bitset(QP_SUBQF,
2492 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
2493 					? "/qf" : ""));
2494 
2495 	if (tTd(41, 1))
2496 	{
2497 		sm_dprintf("gatherq:\n");
2498 
2499 		check = QueueLimitId;
2500 		while (check != NULL)
2501 		{
2502 			sm_dprintf("\tQueueLimitId = %s%s\n",
2503 				check->queue_negate ? "!" : "",
2504 				check->queue_match);
2505 			check = check->queue_next;
2506 		}
2507 
2508 		check = QueueLimitSender;
2509 		while (check != NULL)
2510 		{
2511 			sm_dprintf("\tQueueLimitSender = %s%s\n",
2512 				check->queue_negate ? "!" : "",
2513 				check->queue_match);
2514 			check = check->queue_next;
2515 		}
2516 
2517 		check = QueueLimitRecipient;
2518 		while (check != NULL)
2519 		{
2520 			sm_dprintf("\tQueueLimitRecipient = %s%s\n",
2521 				check->queue_negate ? "!" : "",
2522 				check->queue_match);
2523 			check = check->queue_next;
2524 		}
2525 
2526 		if (QueueMode == QM_QUARANTINE)
2527 		{
2528 			check = QueueLimitQuarantine;
2529 			while (check != NULL)
2530 			{
2531 				sm_dprintf("\tQueueLimitQuarantine = %s%s\n",
2532 					   check->queue_negate ? "!" : "",
2533 					   check->queue_match);
2534 				check = check->queue_next;
2535 			}
2536 		}
2537 	}
2538 
2539 	/* open the queue directory */
2540 	f = opendir(qd);
2541 	if (f == NULL)
2542 	{
2543 		syserr("gatherq: cannot open \"%s\"",
2544 			qid_printqueue(qgrp, qdir));
2545 		if (full != NULL)
2546 			*full = WorkListCount >= MaxQueueRun && MaxQueueRun > 0;
2547 		if (more != NULL)
2548 			*more = false;
2549 		return 0;
2550 	}
2551 
2552 	/*
2553 	**  Read the work directory.
2554 	*/
2555 
2556 	while ((d = readdir(f)) != NULL)
2557 	{
2558 		SM_FILE_T *cf;
2559 		int qfver = 0;
2560 		char lbuf[MAXNAME + 1];
2561 		struct stat sbuf;
2562 
2563 		if (tTd(41, 50))
2564 			sm_dprintf("gatherq: checking %s..", d->d_name);
2565 
2566 		/* is this an interesting entry? */
2567 		if (!(((QueueMode == QM_NORMAL &&
2568 			d->d_name[0] == NORMQF_LETTER) ||
2569 		       (QueueMode == QM_QUARANTINE &&
2570 			d->d_name[0] == QUARQF_LETTER) ||
2571 		       (QueueMode == QM_LOST &&
2572 			d->d_name[0] == LOSEQF_LETTER)) &&
2573 		      d->d_name[1] == 'f'))
2574 		{
2575 			if (tTd(41, 50))
2576 				sm_dprintf("  skipping\n");
2577 			continue;
2578 		}
2579 		if (tTd(41, 50))
2580 			sm_dprintf("\n");
2581 
2582 		if (strlen(d->d_name) >= MAXQFNAME)
2583 		{
2584 			if (Verbose)
2585 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
2586 						     "gatherq: %s too long, %d max characters\n",
2587 						     d->d_name, MAXQFNAME);
2588 			if (LogLevel > 0)
2589 				sm_syslog(LOG_ALERT, NOQID,
2590 					  "gatherq: %s too long, %d max characters",
2591 					  d->d_name, MAXQFNAME);
2592 			continue;
2593 		}
2594 
2595 		check = QueueLimitId;
2596 		while (check != NULL)
2597 		{
2598 			if (strcontainedin(false, check->queue_match,
2599 					   d->d_name) != check->queue_negate)
2600 				break;
2601 			else
2602 				check = check->queue_next;
2603 		}
2604 		if (QueueLimitId != NULL && check == NULL)
2605 			continue;
2606 
2607 		/* grow work list if necessary */
2608 		if (++wn >= MaxQueueRun && MaxQueueRun > 0)
2609 		{
2610 			if (wn == MaxQueueRun && LogLevel > 0)
2611 				sm_syslog(LOG_WARNING, NOQID,
2612 					  "WorkList for %s maxed out at %d",
2613 					  qid_printqueue(qgrp, qdir),
2614 					  MaxQueueRun);
2615 			if (doall)
2616 				continue;	/* just count entries */
2617 			break;
2618 		}
2619 		if (wn >= WorkListSize)
2620 		{
2621 			grow_wlist(qgrp, qdir);
2622 			if (wn >= WorkListSize)
2623 				continue;
2624 		}
2625 		SM_ASSERT(wn >= 0);
2626 		w = &WorkList[wn];
2627 
2628 		(void) sm_strlcpyn(qf, sizeof(qf), 3, qd, "/", d->d_name);
2629 		if (stat(qf, &sbuf) < 0)
2630 		{
2631 			if (errno != ENOENT)
2632 				sm_syslog(LOG_INFO, NOQID,
2633 					  "gatherq: can't stat %s/%s",
2634 					  qid_printqueue(qgrp, qdir),
2635 					  d->d_name);
2636 			wn--;
2637 			continue;
2638 		}
2639 		if (!bitset(S_IFREG, sbuf.st_mode))
2640 		{
2641 			/* Yikes!  Skip it or we will hang on open! */
2642 			if (!((d->d_name[0] == DATAFL_LETTER ||
2643 			       d->d_name[0] == NORMQF_LETTER ||
2644 			       d->d_name[0] == QUARQF_LETTER ||
2645 			       d->d_name[0] == LOSEQF_LETTER ||
2646 			       d->d_name[0] == XSCRPT_LETTER) &&
2647 			      d->d_name[1] == 'f' && d->d_name[2] == '\0'))
2648 				syserr("gatherq: %s/%s is not a regular file",
2649 				       qid_printqueue(qgrp, qdir), d->d_name);
2650 			wn--;
2651 			continue;
2652 		}
2653 
2654 		/* avoid work if possible */
2655 		if ((QueueSortOrder == QSO_BYFILENAME ||
2656 		     QueueSortOrder == QSO_BYMODTIME ||
2657 		     QueueSortOrder == QSO_NONE ||
2658 		     QueueSortOrder == QSO_RANDOM) &&
2659 		    QueueLimitQuarantine == NULL &&
2660 		    QueueLimitSender == NULL &&
2661 		    QueueLimitRecipient == NULL)
2662 		{
2663 			w->w_qgrp = qgrp;
2664 			w->w_qdir = qdir;
2665 			w->w_name = newstr(d->d_name);
2666 			w->w_host = NULL;
2667 			w->w_lock = w->w_tooyoung = false;
2668 			w->w_pri = 0;
2669 			w->w_ctime = 0;
2670 			w->w_mtime = sbuf.st_mtime;
2671 			++num_ent;
2672 			continue;
2673 		}
2674 
2675 		/* open control file */
2676 		cf = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
2677 				NULL);
2678 		if (cf == NULL && OpMode != MD_PRINT)
2679 		{
2680 			/* this may be some random person sending hir msgs */
2681 			if (tTd(41, 2))
2682 				sm_dprintf("gatherq: cannot open %s: %s\n",
2683 					d->d_name, sm_errstring(errno));
2684 			errno = 0;
2685 			wn--;
2686 			continue;
2687 		}
2688 		w->w_qgrp = qgrp;
2689 		w->w_qdir = qdir;
2690 		w->w_name = newstr(d->d_name);
2691 		w->w_host = NULL;
2692 		if (cf != NULL)
2693 		{
2694 			w->w_lock = !lockfile(sm_io_getinfo(cf, SM_IO_WHAT_FD,
2695 							    NULL),
2696 					      w->w_name, NULL,
2697 					      LOCK_SH|LOCK_NB);
2698 		}
2699 		w->w_tooyoung = false;
2700 
2701 		/* make sure jobs in creation don't clog queue */
2702 		w->w_pri = 0x7fffffff;
2703 		w->w_ctime = 0;
2704 		w->w_mtime = sbuf.st_mtime;
2705 
2706 		/* extract useful information */
2707 		i = NEED_P|NEED_T;
2708 		if (QueueSortOrder == QSO_BYHOST
2709 #if _FFR_RHS
2710 		    || QueueSortOrder == QSO_BYSHUFFLE
2711 #endif /* _FFR_RHS */
2712 		   )
2713 		{
2714 			/* need w_host set for host sort order */
2715 			i |= NEED_H;
2716 		}
2717 		if (QueueLimitSender != NULL)
2718 			i |= NEED_S;
2719 		if (QueueLimitRecipient != NULL)
2720 			i |= NEED_R;
2721 		if (QueueLimitQuarantine != NULL)
2722 			i |= NEED_QUARANTINE;
2723 		while (cf != NULL && i != 0 &&
2724 		       sm_io_fgets(cf, SM_TIME_DEFAULT, lbuf,
2725 				   sizeof(lbuf)) != NULL)
2726 		{
2727 			int c;
2728 			time_t age;
2729 
2730 			p = strchr(lbuf, '\n');
2731 			if (p != NULL)
2732 				*p = '\0';
2733 			else
2734 			{
2735 				/* flush rest of overly long line */
2736 				while ((c = sm_io_getc(cf, SM_TIME_DEFAULT))
2737 				       != SM_IO_EOF && c != '\n')
2738 					continue;
2739 			}
2740 
2741 			switch (lbuf[0])
2742 			{
2743 			  case 'V':
2744 				qfver = atoi(&lbuf[1]);
2745 				break;
2746 
2747 			  case 'P':
2748 				w->w_pri = atol(&lbuf[1]);
2749 				i &= ~NEED_P;
2750 				break;
2751 
2752 			  case 'T':
2753 				w->w_ctime = atol(&lbuf[1]);
2754 				i &= ~NEED_T;
2755 				break;
2756 
2757 			  case 'q':
2758 				if (QueueMode != QM_QUARANTINE &&
2759 				    QueueMode != QM_LOST)
2760 				{
2761 					if (tTd(41, 49))
2762 						sm_dprintf("%s not marked as quarantined but has a 'q' line\n",
2763 							   w->w_name);
2764 					i |= HAS_QUARANTINE;
2765 				}
2766 				else if (QueueMode == QM_QUARANTINE)
2767 				{
2768 					if (QueueLimitQuarantine == NULL)
2769 					{
2770 						i &= ~NEED_QUARANTINE;
2771 						break;
2772 					}
2773 					p = &lbuf[1];
2774 					check = QueueLimitQuarantine;
2775 					while (check != NULL)
2776 					{
2777 						if (strcontainedin(false,
2778 								   check->queue_match,
2779 								   p) !=
2780 						    check->queue_negate)
2781 							break;
2782 						else
2783 							check = check->queue_next;
2784 					}
2785 					if (check != NULL)
2786 						i &= ~NEED_QUARANTINE;
2787 				}
2788 				break;
2789 
2790 			  case 'R':
2791 				if (w->w_host == NULL &&
2792 				    (p = strrchr(&lbuf[1], '@')) != NULL)
2793 				{
2794 #if _FFR_RHS
2795 					if (QueueSortOrder == QSO_BYSHUFFLE)
2796 						w->w_host = newstr(&p[1]);
2797 					else
2798 #endif /* _FFR_RHS */
2799 						w->w_host = strrev(&p[1]);
2800 					makelower(w->w_host);
2801 					i &= ~NEED_H;
2802 				}
2803 				if (QueueLimitRecipient == NULL)
2804 				{
2805 					i &= ~NEED_R;
2806 					break;
2807 				}
2808 				if (qfver > 0)
2809 				{
2810 					p = strchr(&lbuf[1], ':');
2811 					if (p == NULL)
2812 						p = &lbuf[1];
2813 					else
2814 						++p; /* skip over ':' */
2815 				}
2816 				else
2817 					p = &lbuf[1];
2818 				check = QueueLimitRecipient;
2819 				while (check != NULL)
2820 				{
2821 					if (strcontainedin(true,
2822 							   check->queue_match,
2823 							   p) !=
2824 					    check->queue_negate)
2825 						break;
2826 					else
2827 						check = check->queue_next;
2828 				}
2829 				if (check != NULL)
2830 					i &= ~NEED_R;
2831 				break;
2832 
2833 			  case 'S':
2834 				check = QueueLimitSender;
2835 				while (check != NULL)
2836 				{
2837 					if (strcontainedin(true,
2838 							   check->queue_match,
2839 							   &lbuf[1]) !=
2840 					    check->queue_negate)
2841 						break;
2842 					else
2843 						check = check->queue_next;
2844 				}
2845 				if (check != NULL)
2846 					i &= ~NEED_S;
2847 				break;
2848 
2849 			  case 'K':
2850 				age = curtime() - (time_t) atol(&lbuf[1]);
2851 				if (age >= 0 && MinQueueAge > 0 &&
2852 				    age < MinQueueAge)
2853 					w->w_tooyoung = true;
2854 				break;
2855 
2856 			  case 'N':
2857 				if (atol(&lbuf[1]) == 0)
2858 					w->w_tooyoung = false;
2859 				break;
2860 			}
2861 		}
2862 		if (cf != NULL)
2863 			(void) sm_io_close(cf, SM_TIME_DEFAULT);
2864 
2865 		if ((!doall && (shouldqueue(w->w_pri, w->w_ctime) ||
2866 		    w->w_tooyoung)) ||
2867 		    bitset(HAS_QUARANTINE, i) ||
2868 		    bitset(NEED_QUARANTINE, i) ||
2869 		    bitset(NEED_R|NEED_S, i))
2870 		{
2871 			/* don't even bother sorting this job in */
2872 			if (tTd(41, 49))
2873 				sm_dprintf("skipping %s (%x)\n", w->w_name, i);
2874 			sm_free(w->w_name); /* XXX */
2875 			if (w->w_host != NULL)
2876 				sm_free(w->w_host); /* XXX */
2877 			wn--;
2878 		}
2879 		else
2880 			++num_ent;
2881 	}
2882 	(void) closedir(f);
2883 	wn++;
2884 
2885 	i = wn - WorkListCount;
2886 	WorkListCount += SM_MIN(num_ent, WorkListSize);
2887 
2888 	if (more != NULL)
2889 		*more = WorkListCount < wn;
2890 
2891 	if (full != NULL)
2892 		*full = (wn >= MaxQueueRun && MaxQueueRun > 0) ||
2893 			(WorkList == NULL && wn > 0);
2894 
2895 	return i;
2896 }
2897 /*
2898 **  SORTQ -- sort the work list
2899 **
2900 **	First the old WorkQ is cleared away. Then the WorkList is sorted
2901 **	for all items so that important (higher sorting value) items are not
2902 **	trunctated off. Then the most important items are moved from
2903 **	WorkList to WorkQ. The lower count of 'max' or MaxListCount items
2904 **	are moved.
2905 **
2906 **	Parameters:
2907 **		max -- maximum number of items to be placed in WorkQ
2908 **
2909 **	Returns:
2910 **		the number of items in WorkQ
2911 **
2912 **	Side Effects:
2913 **		WorkQ gets released and filled with new work. WorkList
2914 **		gets released. Work items get sorted in order.
2915 */
2916 
2917 static int
2918 sortq(max)
2919 	int max;
2920 {
2921 	register int i;			/* local counter */
2922 	register WORK *w;		/* tmp item pointer */
2923 	int wc = WorkListCount;		/* trim size for WorkQ */
2924 
2925 	if (WorkQ != NULL)
2926 	{
2927 		WORK *nw;
2928 
2929 		/* Clear out old WorkQ. */
2930 		for (w = WorkQ; w != NULL; w = nw)
2931 		{
2932 			nw = w->w_next;
2933 			sm_free(w->w_name); /* XXX */
2934 			if (w->w_host != NULL)
2935 				sm_free(w->w_host); /* XXX */
2936 			sm_free((char *) w); /* XXX */
2937 		}
2938 		WorkQ = NULL;
2939 	}
2940 
2941 	if (WorkList == NULL || wc <= 0)
2942 		return 0;
2943 
2944 	/*
2945 	**  The sort now takes place using all of the items in WorkList.
2946 	**  The list gets trimmed to the most important items after the sort.
2947 	**  If the trim were to happen before the sort then one or more
2948 	**  important items might get truncated off -- not what we want.
2949 	*/
2950 
2951 	if (QueueSortOrder == QSO_BYHOST)
2952 	{
2953 		/*
2954 		**  Sort the work directory for the first time,
2955 		**  based on host name, lock status, and priority.
2956 		*/
2957 
2958 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf1);
2959 
2960 		/*
2961 		**  If one message to host is locked, "lock" all messages
2962 		**  to that host.
2963 		*/
2964 
2965 		i = 0;
2966 		while (i < wc)
2967 		{
2968 			if (!WorkList[i].w_lock)
2969 			{
2970 				i++;
2971 				continue;
2972 			}
2973 			w = &WorkList[i];
2974 			while (++i < wc)
2975 			{
2976 				if (WorkList[i].w_host == NULL &&
2977 				    w->w_host == NULL)
2978 					WorkList[i].w_lock = true;
2979 				else if (WorkList[i].w_host != NULL &&
2980 					 w->w_host != NULL &&
2981 					 sm_strcasecmp(WorkList[i].w_host,
2982 						       w->w_host) == 0)
2983 					WorkList[i].w_lock = true;
2984 				else
2985 					break;
2986 			}
2987 		}
2988 
2989 		/*
2990 		**  Sort the work directory for the second time,
2991 		**  based on lock status, host name, and priority.
2992 		*/
2993 
2994 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf2);
2995 	}
2996 	else if (QueueSortOrder == QSO_BYTIME)
2997 	{
2998 		/*
2999 		**  Simple sort based on submission time only.
3000 		*/
3001 
3002 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf3);
3003 	}
3004 	else if (QueueSortOrder == QSO_BYFILENAME)
3005 	{
3006 		/*
3007 		**  Sort based on queue filename.
3008 		*/
3009 
3010 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf4);
3011 	}
3012 	else if (QueueSortOrder == QSO_RANDOM)
3013 	{
3014 		/*
3015 		**  Sort randomly.  To avoid problems with an instable sort,
3016 		**  use a random index into the queue file name to start
3017 		**  comparison.
3018 		*/
3019 
3020 		randi = get_rand_mod(MAXQFNAME);
3021 		if (randi < 2)
3022 			randi = 3;
3023 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf5);
3024 	}
3025 	else if (QueueSortOrder == QSO_BYMODTIME)
3026 	{
3027 		/*
3028 		**  Simple sort based on modification time of queue file.
3029 		**  This puts the oldest items first.
3030 		*/
3031 
3032 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf6);
3033 	}
3034 #if _FFR_RHS
3035 	else if (QueueSortOrder == QSO_BYSHUFFLE)
3036 	{
3037 		/*
3038 		**  Simple sort based on shuffled host name.
3039 		*/
3040 
3041 		init_shuffle_alphabet();
3042 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf7);
3043 	}
3044 #endif /* _FFR_RHS */
3045 	else if (QueueSortOrder == QSO_BYPRIORITY)
3046 	{
3047 		/*
3048 		**  Simple sort based on queue priority only.
3049 		*/
3050 
3051 		qsort((char *) WorkList, wc, sizeof(*WorkList), workcmpf0);
3052 	}
3053 	/* else don't sort at all */
3054 
3055 	/* Check if the per queue group item limit will be exceeded */
3056 	if (wc > max && max > 0)
3057 		wc = max;
3058 
3059 	/*
3060 	**  Convert the work list into canonical form.
3061 	**	Should be turning it into a list of envelopes here perhaps.
3062 	**  Only take the most important items up to the per queue group
3063 	**  maximum.
3064 	*/
3065 
3066 	for (i = wc; --i >= 0; )
3067 	{
3068 		w = (WORK *) xalloc(sizeof(*w));
3069 		w->w_qgrp = WorkList[i].w_qgrp;
3070 		w->w_qdir = WorkList[i].w_qdir;
3071 		w->w_name = WorkList[i].w_name;
3072 		w->w_host = WorkList[i].w_host;
3073 		w->w_lock = WorkList[i].w_lock;
3074 		w->w_tooyoung = WorkList[i].w_tooyoung;
3075 		w->w_pri = WorkList[i].w_pri;
3076 		w->w_ctime = WorkList[i].w_ctime;
3077 		w->w_mtime = WorkList[i].w_mtime;
3078 		w->w_next = WorkQ;
3079 		WorkQ = w;
3080 	}
3081 
3082 	/* free the rest of the list */
3083 	for (i = WorkListCount; --i >= wc; )
3084 	{
3085 		sm_free(WorkList[i].w_name);
3086 		if (WorkList[i].w_host != NULL)
3087 			sm_free(WorkList[i].w_host);
3088 	}
3089 
3090 	if (WorkList != NULL)
3091 		sm_free(WorkList); /* XXX */
3092 	WorkList = NULL;
3093 	WorkListSize = 0;
3094 	WorkListCount = 0;
3095 
3096 	if (tTd(40, 1))
3097 	{
3098 		for (w = WorkQ; w != NULL; w = w->w_next)
3099 		{
3100 			if (w->w_host != NULL)
3101 				sm_dprintf("%22s: pri=%ld %s\n",
3102 					w->w_name, w->w_pri, w->w_host);
3103 			else
3104 				sm_dprintf("%32s: pri=%ld\n",
3105 					w->w_name, w->w_pri);
3106 		}
3107 	}
3108 
3109 	return wc; /* return number of WorkQ items */
3110 }
3111 /*
3112 **  GROW_WLIST -- make the work list larger
3113 **
3114 **	Parameters:
3115 **		qgrp -- the index for the queue group.
3116 **		qdir -- the index for the queue directory.
3117 **
3118 **	Returns:
3119 **		none.
3120 **
3121 **	Side Effects:
3122 **		Adds another QUEUESEGSIZE entries to WorkList if possible.
3123 **		It can fail if there isn't enough memory, so WorkListSize
3124 **		should be checked again upon return.
3125 */
3126 
3127 static void
3128 grow_wlist(qgrp, qdir)
3129 	int qgrp;
3130 	int qdir;
3131 {
3132 	if (tTd(41, 1))
3133 		sm_dprintf("grow_wlist: WorkListSize=%d\n", WorkListSize);
3134 	if (WorkList == NULL)
3135 	{
3136 		WorkList = (WORK *) xalloc((sizeof(*WorkList)) *
3137 					   (QUEUESEGSIZE + 1));
3138 		WorkListSize = QUEUESEGSIZE;
3139 	}
3140 	else
3141 	{
3142 		int newsize = WorkListSize + QUEUESEGSIZE;
3143 		WORK *newlist = (WORK *) sm_realloc((char *) WorkList,
3144 					  (unsigned) sizeof(WORK) * (newsize + 1));
3145 
3146 		if (newlist != NULL)
3147 		{
3148 			WorkListSize = newsize;
3149 			WorkList = newlist;
3150 			if (LogLevel > 1)
3151 			{
3152 				sm_syslog(LOG_INFO, NOQID,
3153 					  "grew WorkList for %s to %d",
3154 					  qid_printqueue(qgrp, qdir),
3155 					  WorkListSize);
3156 			}
3157 		}
3158 		else if (LogLevel > 0)
3159 		{
3160 			sm_syslog(LOG_ALERT, NOQID,
3161 				  "FAILED to grow WorkList for %s to %d",
3162 				  qid_printqueue(qgrp, qdir), newsize);
3163 		}
3164 	}
3165 	if (tTd(41, 1))
3166 		sm_dprintf("grow_wlist: WorkListSize now %d\n", WorkListSize);
3167 }
3168 /*
3169 **  WORKCMPF0 -- simple priority-only compare function.
3170 **
3171 **	Parameters:
3172 **		a -- the first argument.
3173 **		b -- the second argument.
3174 **
3175 **	Returns:
3176 **		-1 if a < b
3177 **		 0 if a == b
3178 **		+1 if a > b
3179 **
3180 */
3181 
3182 static int
3183 workcmpf0(a, b)
3184 	register WORK *a;
3185 	register WORK *b;
3186 {
3187 	long pa = a->w_pri;
3188 	long pb = b->w_pri;
3189 
3190 	if (pa == pb)
3191 		return 0;
3192 	else if (pa > pb)
3193 		return 1;
3194 	else
3195 		return -1;
3196 }
3197 /*
3198 **  WORKCMPF1 -- first compare function for ordering work based on host name.
3199 **
3200 **	Sorts on host name, lock status, and priority in that order.
3201 **
3202 **	Parameters:
3203 **		a -- the first argument.
3204 **		b -- the second argument.
3205 **
3206 **	Returns:
3207 **		<0 if a < b
3208 **		 0 if a == b
3209 **		>0 if a > b
3210 **
3211 */
3212 
3213 static int
3214 workcmpf1(a, b)
3215 	register WORK *a;
3216 	register WORK *b;
3217 {
3218 	int i;
3219 
3220 	/* host name */
3221 	if (a->w_host != NULL && b->w_host == NULL)
3222 		return 1;
3223 	else if (a->w_host == NULL && b->w_host != NULL)
3224 		return -1;
3225 	if (a->w_host != NULL && b->w_host != NULL &&
3226 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3227 		return i;
3228 
3229 	/* lock status */
3230 	if (a->w_lock != b->w_lock)
3231 		return b->w_lock - a->w_lock;
3232 
3233 	/* job priority */
3234 	return workcmpf0(a, b);
3235 }
3236 /*
3237 **  WORKCMPF2 -- second compare function for ordering work based on host name.
3238 **
3239 **	Sorts on lock status, host name, and priority in that order.
3240 **
3241 **	Parameters:
3242 **		a -- the first argument.
3243 **		b -- the second argument.
3244 **
3245 **	Returns:
3246 **		<0 if a < b
3247 **		 0 if a == b
3248 **		>0 if a > b
3249 **
3250 */
3251 
3252 static int
3253 workcmpf2(a, b)
3254 	register WORK *a;
3255 	register WORK *b;
3256 {
3257 	int i;
3258 
3259 	/* lock status */
3260 	if (a->w_lock != b->w_lock)
3261 		return a->w_lock - b->w_lock;
3262 
3263 	/* host name */
3264 	if (a->w_host != NULL && b->w_host == NULL)
3265 		return 1;
3266 	else if (a->w_host == NULL && b->w_host != NULL)
3267 		return -1;
3268 	if (a->w_host != NULL && b->w_host != NULL &&
3269 	    (i = sm_strcasecmp(a->w_host, b->w_host)) != 0)
3270 		return i;
3271 
3272 	/* job priority */
3273 	return workcmpf0(a, b);
3274 }
3275 /*
3276 **  WORKCMPF3 -- simple submission-time-only compare function.
3277 **
3278 **	Parameters:
3279 **		a -- the first argument.
3280 **		b -- the second argument.
3281 **
3282 **	Returns:
3283 **		-1 if a < b
3284 **		 0 if a == b
3285 **		+1 if a > b
3286 **
3287 */
3288 
3289 static int
3290 workcmpf3(a, b)
3291 	register WORK *a;
3292 	register WORK *b;
3293 {
3294 	if (a->w_ctime > b->w_ctime)
3295 		return 1;
3296 	else if (a->w_ctime < b->w_ctime)
3297 		return -1;
3298 	else
3299 		return 0;
3300 }
3301 /*
3302 **  WORKCMPF4 -- compare based on file name
3303 **
3304 **	Parameters:
3305 **		a -- the first argument.
3306 **		b -- the second argument.
3307 **
3308 **	Returns:
3309 **		-1 if a < b
3310 **		 0 if a == b
3311 **		+1 if a > b
3312 **
3313 */
3314 
3315 static int
3316 workcmpf4(a, b)
3317 	register WORK *a;
3318 	register WORK *b;
3319 {
3320 	return strcmp(a->w_name, b->w_name);
3321 }
3322 /*
3323 **  WORKCMPF5 -- compare based on assigned random number
3324 **
3325 **	Parameters:
3326 **		a -- the first argument (ignored).
3327 **		b -- the second argument (ignored).
3328 **
3329 **	Returns:
3330 **		randomly 1/-1
3331 */
3332 
3333 /* ARGSUSED0 */
3334 static int
3335 workcmpf5(a, b)
3336 	register WORK *a;
3337 	register WORK *b;
3338 {
3339 	if (strlen(a->w_name) < randi || strlen(b->w_name) < randi)
3340 		return -1;
3341 	return a->w_name[randi] - b->w_name[randi];
3342 }
3343 /*
3344 **  WORKCMPF6 -- simple modification-time-only compare function.
3345 **
3346 **	Parameters:
3347 **		a -- the first argument.
3348 **		b -- the second argument.
3349 **
3350 **	Returns:
3351 **		-1 if a < b
3352 **		 0 if a == b
3353 **		+1 if a > b
3354 **
3355 */
3356 
3357 static int
3358 workcmpf6(a, b)
3359 	register WORK *a;
3360 	register WORK *b;
3361 {
3362 	if (a->w_mtime > b->w_mtime)
3363 		return 1;
3364 	else if (a->w_mtime < b->w_mtime)
3365 		return -1;
3366 	else
3367 		return 0;
3368 }
3369 #if _FFR_RHS
3370 /*
3371 **  WORKCMPF7 -- compare function for ordering work based on shuffled host name.
3372 **
3373 **	Sorts on lock status, host name, and priority in that order.
3374 **
3375 **	Parameters:
3376 **		a -- the first argument.
3377 **		b -- the second argument.
3378 **
3379 **	Returns:
3380 **		<0 if a < b
3381 **		 0 if a == b
3382 **		>0 if a > b
3383 **
3384 */
3385 
3386 static int
3387 workcmpf7(a, b)
3388 	register WORK *a;
3389 	register WORK *b;
3390 {
3391 	int i;
3392 
3393 	/* lock status */
3394 	if (a->w_lock != b->w_lock)
3395 		return a->w_lock - b->w_lock;
3396 
3397 	/* host name */
3398 	if (a->w_host != NULL && b->w_host == NULL)
3399 		return 1;
3400 	else if (a->w_host == NULL && b->w_host != NULL)
3401 		return -1;
3402 	if (a->w_host != NULL && b->w_host != NULL &&
3403 	    (i = sm_strshufflecmp(a->w_host, b->w_host)) != 0)
3404 		return i;
3405 
3406 	/* job priority */
3407 	return workcmpf0(a, b);
3408 }
3409 #endif /* _FFR_RHS */
3410 /*
3411 **  STRREV -- reverse string
3412 **
3413 **	Returns a pointer to a new string that is the reverse of
3414 **	the string pointed to by fwd.  The space for the new
3415 **	string is obtained using xalloc().
3416 **
3417 **	Parameters:
3418 **		fwd -- the string to reverse.
3419 **
3420 **	Returns:
3421 **		the reversed string.
3422 */
3423 
3424 static char *
3425 strrev(fwd)
3426 	char *fwd;
3427 {
3428 	char *rev = NULL;
3429 	int len, cnt;
3430 
3431 	len = strlen(fwd);
3432 	rev = xalloc(len + 1);
3433 	for (cnt = 0; cnt < len; ++cnt)
3434 		rev[cnt] = fwd[len - cnt - 1];
3435 	rev[len] = '\0';
3436 	return rev;
3437 }
3438 
3439 #if _FFR_RHS
3440 
3441 # define NASCII	128
3442 # define NCHAR	256
3443 
3444 static unsigned char ShuffledAlphabet[NCHAR];
3445 
3446 void
3447 init_shuffle_alphabet()
3448 {
3449 	static bool init = false;
3450 	int i;
3451 
3452 	if (init)
3453 		return;
3454 
3455 	/* fill the ShuffledAlphabet */
3456 	for (i = 0; i < NASCII; i++)
3457 		ShuffledAlphabet[i] = i;
3458 
3459 	/* mix it */
3460 	for (i = 1; i < NASCII; i++)
3461 	{
3462 		register int j = get_random() % NASCII;
3463 		register int tmp;
3464 
3465 		tmp = ShuffledAlphabet[j];
3466 		ShuffledAlphabet[j] = ShuffledAlphabet[i];
3467 		ShuffledAlphabet[i] = tmp;
3468 	}
3469 
3470 	/* make it case insensitive */
3471 	for (i = 'A'; i <= 'Z'; i++)
3472 		ShuffledAlphabet[i] = ShuffledAlphabet[i + 'a' - 'A'];
3473 
3474 	/* fill the upper part */
3475 	for (i = 0; i < NASCII; i++)
3476 		ShuffledAlphabet[i + NASCII] = ShuffledAlphabet[i];
3477 	init = true;
3478 }
3479 
3480 static int
3481 sm_strshufflecmp(a, b)
3482 	char *a;
3483 	char *b;
3484 {
3485 	const unsigned char *us1 = (const unsigned char *) a;
3486 	const unsigned char *us2 = (const unsigned char *) b;
3487 
3488 	while (ShuffledAlphabet[*us1] == ShuffledAlphabet[*us2++])
3489 	{
3490 		if (*us1++ == '\0')
3491 			return 0;
3492 	}
3493 	return (ShuffledAlphabet[*us1] - ShuffledAlphabet[*--us2]);
3494 }
3495 #endif /* _FFR_RHS */
3496 
3497 /*
3498 **  DOWORK -- do a work request.
3499 **
3500 **	Parameters:
3501 **		qgrp -- the index of the queue group for the job.
3502 **		qdir -- the index of the queue directory for the job.
3503 **		id -- the ID of the job to run.
3504 **		forkflag -- if set, run this in background.
3505 **		requeueflag -- if set, reinstantiate the queue quickly.
3506 **			This is used when expanding aliases in the queue.
3507 **			If forkflag is also set, it doesn't wait for the
3508 **			child.
3509 **		e - the envelope in which to run it.
3510 **
3511 **	Returns:
3512 **		process id of process that is running the queue job.
3513 **
3514 **	Side Effects:
3515 **		The work request is satisfied if possible.
3516 */
3517 
3518 pid_t
3519 dowork(qgrp, qdir, id, forkflag, requeueflag, e)
3520 	int qgrp;
3521 	int qdir;
3522 	char *id;
3523 	bool forkflag;
3524 	bool requeueflag;
3525 	register ENVELOPE *e;
3526 {
3527 	register pid_t pid;
3528 	SM_RPOOL_T *rpool;
3529 
3530 	if (tTd(40, 1))
3531 		sm_dprintf("dowork(%s/%s)\n", qid_printqueue(qgrp, qdir), id);
3532 
3533 	/*
3534 	**  Fork for work.
3535 	*/
3536 
3537 	if (forkflag)
3538 	{
3539 		/*
3540 		**  Since the delivery may happen in a child and the
3541 		**  parent does not wait, the parent may close the
3542 		**  maps thereby removing any shared memory used by
3543 		**  the map.  Therefore, close the maps now so the
3544 		**  child will dynamically open them if necessary.
3545 		*/
3546 
3547 		closemaps(false);
3548 
3549 		pid = fork();
3550 		if (pid < 0)
3551 		{
3552 			syserr("dowork: cannot fork");
3553 			return 0;
3554 		}
3555 		else if (pid > 0)
3556 		{
3557 			/* parent -- clean out connection cache */
3558 			mci_flush(false, NULL);
3559 		}
3560 		else
3561 		{
3562 			/*
3563 			**  Initialize exception stack and default exception
3564 			**  handler for child process.
3565 			*/
3566 
3567 			/* Reset global flags */
3568 			RestartRequest = NULL;
3569 			RestartWorkGroup = false;
3570 			ShutdownRequest = NULL;
3571 			PendingSignal = 0;
3572 			CurrentPid = getpid();
3573 			sm_exc_newthread(fatal_error);
3574 
3575 			/*
3576 			**  See note above about SMTP processes and SIGCHLD.
3577 			*/
3578 
3579 			if (OpMode == MD_SMTP ||
3580 			    OpMode == MD_DAEMON ||
3581 			    MaxQueueChildren > 0)
3582 			{
3583 				proc_list_clear();
3584 				sm_releasesignal(SIGCHLD);
3585 				(void) sm_signal(SIGCHLD, SIG_DFL);
3586 			}
3587 
3588 			/* child -- error messages to the transcript */
3589 			QuickAbort = OnlyOneError = false;
3590 		}
3591 	}
3592 	else
3593 	{
3594 		pid = 0;
3595 	}
3596 
3597 	if (pid == 0)
3598 	{
3599 		/*
3600 		**  CHILD
3601 		**	Lock the control file to avoid duplicate deliveries.
3602 		**		Then run the file as though we had just read it.
3603 		**	We save an idea of the temporary name so we
3604 		**		can recover on interrupt.
3605 		*/
3606 
3607 		if (forkflag)
3608 		{
3609 			/* Reset global flags */
3610 			RestartRequest = NULL;
3611 			RestartWorkGroup = false;
3612 			ShutdownRequest = NULL;
3613 			PendingSignal = 0;
3614 		}
3615 
3616 		/* set basic modes, etc. */
3617 		sm_clear_events();
3618 		clearstats();
3619 		rpool = sm_rpool_new_x(NULL);
3620 		clearenvelope(e, false, rpool);
3621 		e->e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3622 		set_delivery_mode(SM_DELIVER, e);
3623 		e->e_errormode = EM_MAIL;
3624 		e->e_id = id;
3625 		e->e_qgrp = qgrp;
3626 		e->e_qdir = qdir;
3627 		GrabTo = UseErrorsTo = false;
3628 		ExitStat = EX_OK;
3629 		if (forkflag)
3630 		{
3631 			disconnect(1, e);
3632 			set_op_mode(MD_QUEUERUN);
3633 		}
3634 		sm_setproctitle(true, e, "%s from queue", qid_printname(e));
3635 		if (LogLevel > 76)
3636 			sm_syslog(LOG_DEBUG, e->e_id, "dowork, pid=%d",
3637 				  (int) CurrentPid);
3638 
3639 		/* don't use the headers from sendmail.cf... */
3640 		e->e_header = NULL;
3641 
3642 		/* read the queue control file -- return if locked */
3643 		if (!readqf(e, false))
3644 		{
3645 			if (tTd(40, 4) && e->e_id != NULL)
3646 				sm_dprintf("readqf(%s) failed\n",
3647 					qid_printname(e));
3648 			e->e_id = NULL;
3649 			if (forkflag)
3650 				finis(false, true, EX_OK);
3651 			else
3652 			{
3653 				/* adding this frees 8 bytes */
3654 				clearenvelope(e, false, rpool);
3655 
3656 				/* adding this frees 12 bytes */
3657 				sm_rpool_free(rpool);
3658 				e->e_rpool = NULL;
3659 				return 0;
3660 			}
3661 		}
3662 
3663 		e->e_flags |= EF_INQUEUE;
3664 		eatheader(e, requeueflag, true);
3665 
3666 		if (requeueflag)
3667 			queueup(e, false, false);
3668 
3669 		/* do the delivery */
3670 		sendall(e, SM_DELIVER);
3671 
3672 		/* finish up and exit */
3673 		if (forkflag)
3674 			finis(true, true, ExitStat);
3675 		else
3676 		{
3677 			dropenvelope(e, true, false);
3678 			sm_rpool_free(rpool);
3679 			e->e_rpool = NULL;
3680 		}
3681 	}
3682 	e->e_id = NULL;
3683 	return pid;
3684 }
3685 
3686 /*
3687 **  DOWORKLIST -- process a list of envelopes as work requests
3688 **
3689 **	Similar to dowork(), except that after forking, it processes an
3690 **	envelope and its siblings, treating each envelope as a work request.
3691 **
3692 **	Parameters:
3693 **		el -- envelope to be processed including its siblings.
3694 **		forkflag -- if set, run this in background.
3695 **		requeueflag -- if set, reinstantiate the queue quickly.
3696 **			This is used when expanding aliases in the queue.
3697 **			If forkflag is also set, it doesn't wait for the
3698 **			child.
3699 **
3700 **	Returns:
3701 **		process id of process that is running the queue job.
3702 **
3703 **	Side Effects:
3704 **		The work request is satisfied if possible.
3705 */
3706 
3707 pid_t
3708 doworklist(el, forkflag, requeueflag)
3709 	ENVELOPE *el;
3710 	bool forkflag;
3711 	bool requeueflag;
3712 {
3713 	register pid_t pid;
3714 	ENVELOPE *ei;
3715 
3716 	if (tTd(40, 1))
3717 		sm_dprintf("doworklist()\n");
3718 
3719 	/*
3720 	**  Fork for work.
3721 	*/
3722 
3723 	if (forkflag)
3724 	{
3725 		/*
3726 		**  Since the delivery may happen in a child and the
3727 		**  parent does not wait, the parent may close the
3728 		**  maps thereby removing any shared memory used by
3729 		**  the map.  Therefore, close the maps now so the
3730 		**  child will dynamically open them if necessary.
3731 		*/
3732 
3733 		closemaps(false);
3734 
3735 		pid = fork();
3736 		if (pid < 0)
3737 		{
3738 			syserr("doworklist: cannot fork");
3739 			return 0;
3740 		}
3741 		else if (pid > 0)
3742 		{
3743 			/* parent -- clean out connection cache */
3744 			mci_flush(false, NULL);
3745 		}
3746 		else
3747 		{
3748 			/*
3749 			**  Initialize exception stack and default exception
3750 			**  handler for child process.
3751 			*/
3752 
3753 			/* Reset global flags */
3754 			RestartRequest = NULL;
3755 			RestartWorkGroup = false;
3756 			ShutdownRequest = NULL;
3757 			PendingSignal = 0;
3758 			CurrentPid = getpid();
3759 			sm_exc_newthread(fatal_error);
3760 
3761 			/*
3762 			**  See note above about SMTP processes and SIGCHLD.
3763 			*/
3764 
3765 			if (OpMode == MD_SMTP ||
3766 			    OpMode == MD_DAEMON ||
3767 			    MaxQueueChildren > 0)
3768 			{
3769 				proc_list_clear();
3770 				sm_releasesignal(SIGCHLD);
3771 				(void) sm_signal(SIGCHLD, SIG_DFL);
3772 			}
3773 
3774 			/* child -- error messages to the transcript */
3775 			QuickAbort = OnlyOneError = false;
3776 		}
3777 	}
3778 	else
3779 	{
3780 		pid = 0;
3781 	}
3782 
3783 	if (pid != 0)
3784 		return pid;
3785 
3786 	/*
3787 	**  IN CHILD
3788 	**	Lock the control file to avoid duplicate deliveries.
3789 	**		Then run the file as though we had just read it.
3790 	**	We save an idea of the temporary name so we
3791 	**		can recover on interrupt.
3792 	*/
3793 
3794 	if (forkflag)
3795 	{
3796 		/* Reset global flags */
3797 		RestartRequest = NULL;
3798 		RestartWorkGroup = false;
3799 		ShutdownRequest = NULL;
3800 		PendingSignal = 0;
3801 	}
3802 
3803 	/* set basic modes, etc. */
3804 	sm_clear_events();
3805 	clearstats();
3806 	GrabTo = UseErrorsTo = false;
3807 	ExitStat = EX_OK;
3808 	if (forkflag)
3809 	{
3810 		disconnect(1, el);
3811 		set_op_mode(MD_QUEUERUN);
3812 	}
3813 	if (LogLevel > 76)
3814 		sm_syslog(LOG_DEBUG, el->e_id, "doworklist, pid=%d",
3815 			  (int) CurrentPid);
3816 
3817 	for (ei = el; ei != NULL; ei = ei->e_sibling)
3818 	{
3819 		ENVELOPE e;
3820 		SM_RPOOL_T *rpool;
3821 
3822 		if (WILL_BE_QUEUED(ei->e_sendmode))
3823 			continue;
3824 		else if (QueueMode != QM_QUARANTINE &&
3825 			 ei->e_quarmsg != NULL)
3826 			continue;
3827 
3828 		rpool = sm_rpool_new_x(NULL);
3829 		clearenvelope(&e, true, rpool);
3830 		e.e_flags |= EF_QUEUERUN|EF_GLOBALERRS;
3831 		set_delivery_mode(SM_DELIVER, &e);
3832 		e.e_errormode = EM_MAIL;
3833 		e.e_id = ei->e_id;
3834 		e.e_qgrp = ei->e_qgrp;
3835 		e.e_qdir = ei->e_qdir;
3836 		openxscript(&e);
3837 		sm_setproctitle(true, &e, "%s from queue", qid_printname(&e));
3838 
3839 		/* don't use the headers from sendmail.cf... */
3840 		e.e_header = NULL;
3841 		CurEnv = &e;
3842 
3843 		/* read the queue control file -- return if locked */
3844 		if (readqf(&e, false))
3845 		{
3846 			e.e_flags |= EF_INQUEUE;
3847 			eatheader(&e, requeueflag, true);
3848 
3849 			if (requeueflag)
3850 				queueup(&e, false, false);
3851 
3852 			/* do the delivery */
3853 			sendall(&e, SM_DELIVER);
3854 			dropenvelope(&e, true, false);
3855 		}
3856 		else
3857 		{
3858 			if (tTd(40, 4) && e.e_id != NULL)
3859 				sm_dprintf("readqf(%s) failed\n",
3860 					qid_printname(&e));
3861 		}
3862 		sm_rpool_free(rpool);
3863 		ei->e_id = NULL;
3864 	}
3865 
3866 	/* restore CurEnv */
3867 	CurEnv = el;
3868 
3869 	/* finish up and exit */
3870 	if (forkflag)
3871 		finis(true, true, ExitStat);
3872 	return 0;
3873 }
3874 /*
3875 **  READQF -- read queue file and set up environment.
3876 **
3877 **	Parameters:
3878 **		e -- the envelope of the job to run.
3879 **		openonly -- only open the qf (returned as e_lockfp)
3880 **
3881 **	Returns:
3882 **		true if it successfully read the queue file.
3883 **		false otherwise.
3884 **
3885 **	Side Effects:
3886 **		The queue file is returned locked.
3887 */
3888 
3889 static bool
3890 readqf(e, openonly)
3891 	register ENVELOPE *e;
3892 	bool openonly;
3893 {
3894 	register SM_FILE_T *qfp;
3895 	ADDRESS *ctladdr;
3896 	struct stat st, stf;
3897 	char *bp;
3898 	int qfver = 0;
3899 	long hdrsize = 0;
3900 	register char *p;
3901 	char *frcpt = NULL;
3902 	char *orcpt = NULL;
3903 	bool nomore = false;
3904 	bool bogus = false;
3905 	MODE_T qsafe;
3906 	char *err;
3907 	char qf[MAXPATHLEN];
3908 	char buf[MAXLINE];
3909 	int bufsize;
3910 
3911 	/*
3912 	**  Read and process the file.
3913 	*/
3914 
3915 	SM_REQUIRE(e != NULL);
3916 	bp = NULL;
3917 	(void) sm_strlcpy(qf, queuename(e, ANYQFL_LETTER), sizeof(qf));
3918 	qfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDWR_B, NULL);
3919 	if (qfp == NULL)
3920 	{
3921 		int save_errno = errno;
3922 
3923 		if (tTd(40, 8))
3924 			sm_dprintf("readqf(%s): sm_io_open failure (%s)\n",
3925 				qf, sm_errstring(errno));
3926 		errno = save_errno;
3927 		if (errno != ENOENT
3928 		    )
3929 			syserr("readqf: no control file %s", qf);
3930 		RELEASE_QUEUE;
3931 		return false;
3932 	}
3933 
3934 	if (!lockfile(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), qf, NULL,
3935 		      LOCK_EX|LOCK_NB))
3936 	{
3937 		/* being processed by another queuer */
3938 		if (Verbose)
3939 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3940 					     "%s: locked\n", e->e_id);
3941 		if (tTd(40, 8))
3942 			sm_dprintf("%s: locked\n", e->e_id);
3943 		if (LogLevel > 19)
3944 			sm_syslog(LOG_DEBUG, e->e_id, "locked");
3945 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3946 		RELEASE_QUEUE;
3947 		return false;
3948 	}
3949 
3950 	RELEASE_QUEUE;
3951 
3952 	/*
3953 	**  Prevent locking race condition.
3954 	**
3955 	**  Process A: readqf(): qfp = fopen(qffile)
3956 	**  Process B: queueup(): rename(tf, qf)
3957 	**  Process B: unlocks(tf)
3958 	**  Process A: lockfile(qf);
3959 	**
3960 	**  Process A (us) has the old qf file (before the rename deleted
3961 	**  the directory entry) and will be delivering based on old data.
3962 	**  This can lead to multiple deliveries of the same recipients.
3963 	**
3964 	**  Catch this by checking if the underlying qf file has changed
3965 	**  *after* acquiring our lock and if so, act as though the file
3966 	**  was still locked (i.e., just return like the lockfile() case
3967 	**  above.
3968 	*/
3969 
3970 	if (stat(qf, &stf) < 0 ||
3971 	    fstat(sm_io_getinfo(qfp, SM_IO_WHAT_FD, NULL), &st) < 0)
3972 	{
3973 		/* must have been being processed by someone else */
3974 		if (tTd(40, 8))
3975 			sm_dprintf("readqf(%s): [f]stat failure (%s)\n",
3976 				qf, sm_errstring(errno));
3977 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
3978 		return false;
3979 	}
3980 
3981 	if (st.st_nlink != stf.st_nlink ||
3982 	    st.st_dev != stf.st_dev ||
3983 	    ST_INODE(st) != ST_INODE(stf) ||
3984 #if HAS_ST_GEN && 0		/* AFS returns garbage in st_gen */
3985 	    st.st_gen != stf.st_gen ||
3986 #endif /* HAS_ST_GEN && 0 */
3987 	    st.st_uid != stf.st_uid ||
3988 	    st.st_gid != stf.st_gid ||
3989 	    st.st_size != stf.st_size)
3990 	{
3991 		/* changed after opened */
3992 		if (Verbose)
3993 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3994 					     "%s: changed\n", e->e_id);
3995 		if (tTd(40, 8))
3996 			sm_dprintf("%s: changed\n", e->e_id);
3997 		if (LogLevel > 19)
3998 			sm_syslog(LOG_DEBUG, e->e_id, "changed");
3999 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4000 		return false;
4001 	}
4002 
4003 	/*
4004 	**  Check the queue file for plausibility to avoid attacks.
4005 	*/
4006 
4007 	qsafe = S_IWOTH|S_IWGRP;
4008 	if (bitset(S_IWGRP, QueueFileMode))
4009 		qsafe &= ~S_IWGRP;
4010 
4011 	bogus = st.st_uid != geteuid() &&
4012 		st.st_uid != TrustedUid &&
4013 		geteuid() != RealUid;
4014 
4015 	/*
4016 	**  If this qf file results from a set-group-ID binary, then
4017 	**  we check whether the directory is group-writable,
4018 	**  the queue file mode contains the group-writable bit, and
4019 	**  the groups are the same.
4020 	**  Notice: this requires that the set-group-ID binary is used to
4021 	**  run the queue!
4022 	*/
4023 
4024 	if (bogus && st.st_gid == getegid() && UseMSP)
4025 	{
4026 		char delim;
4027 		struct stat dst;
4028 
4029 		bp = SM_LAST_DIR_DELIM(qf);
4030 		if (bp == NULL)
4031 			delim = '\0';
4032 		else
4033 		{
4034 			delim = *bp;
4035 			*bp = '\0';
4036 		}
4037 		if (stat(delim == '\0' ? "." : qf, &dst) < 0)
4038 			syserr("readqf: cannot stat directory %s",
4039 				delim == '\0' ? "." : qf);
4040 		else
4041 		{
4042 			bogus = !(bitset(S_IWGRP, QueueFileMode) &&
4043 				  bitset(S_IWGRP, dst.st_mode) &&
4044 				  dst.st_gid == st.st_gid);
4045 		}
4046 		if (delim != '\0')
4047 			*bp = delim;
4048 		bp = NULL;
4049 	}
4050 	if (!bogus)
4051 		bogus = bitset(qsafe, st.st_mode);
4052 	if (bogus)
4053 	{
4054 		if (LogLevel > 0)
4055 		{
4056 			sm_syslog(LOG_ALERT, e->e_id,
4057 				  "bogus queue file, uid=%d, gid=%d, mode=%o",
4058 				  st.st_uid, st.st_gid, st.st_mode);
4059 		}
4060 		if (tTd(40, 8))
4061 			sm_dprintf("readqf(%s): bogus file\n", qf);
4062 		e->e_flags |= EF_INQUEUE;
4063 		if (!openonly)
4064 			loseqfile(e, "bogus file uid/gid in mqueue");
4065 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4066 		return false;
4067 	}
4068 
4069 	if (st.st_size == 0)
4070 	{
4071 		/* must be a bogus file -- if also old, just remove it */
4072 		if (!openonly && st.st_ctime + 10 * 60 < curtime())
4073 		{
4074 			(void) xunlink(queuename(e, DATAFL_LETTER));
4075 			(void) xunlink(queuename(e, ANYQFL_LETTER));
4076 		}
4077 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4078 		return false;
4079 	}
4080 
4081 	if (st.st_nlink == 0)
4082 	{
4083 		/*
4084 		**  Race condition -- we got a file just as it was being
4085 		**  unlinked.  Just assume it is zero length.
4086 		*/
4087 
4088 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4089 		return false;
4090 	}
4091 
4092 #if _FFR_TRUSTED_QF
4093 	/*
4094 	**  If we don't own the file mark it as unsafe.
4095 	**  However, allow TrustedUser to own it as well
4096 	**  in case TrustedUser manipulates the queue.
4097 	*/
4098 
4099 	if (st.st_uid != geteuid() && st.st_uid != TrustedUid)
4100 		e->e_flags |= EF_UNSAFE;
4101 #else /* _FFR_TRUSTED_QF */
4102 	/* If we don't own the file mark it as unsafe */
4103 	if (st.st_uid != geteuid())
4104 		e->e_flags |= EF_UNSAFE;
4105 #endif /* _FFR_TRUSTED_QF */
4106 
4107 	/* good file -- save this lock */
4108 	e->e_lockfp = qfp;
4109 
4110 	/* Just wanted the open file */
4111 	if (openonly)
4112 		return true;
4113 
4114 	/* do basic system initialization */
4115 	initsys(e);
4116 	macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
4117 
4118 	LineNumber = 0;
4119 	e->e_flags |= EF_GLOBALERRS;
4120 	set_op_mode(MD_QUEUERUN);
4121 	ctladdr = NULL;
4122 	e->e_qfletter = queue_letter(e, ANYQFL_LETTER);
4123 	e->e_dfqgrp = e->e_qgrp;
4124 	e->e_dfqdir = e->e_qdir;
4125 #if _FFR_QUEUE_MACRO
4126 	macdefine(&e->e_macro, A_TEMP, macid("{queue}"),
4127 		  qid_printqueue(e->e_qgrp, e->e_qdir));
4128 #endif /* _FFR_QUEUE_MACRO */
4129 	e->e_dfino = -1;
4130 	e->e_msgsize = -1;
4131 	while (bufsize = sizeof(buf),
4132 	       (bp = fgetfolded(buf, &bufsize, qfp)) != NULL)
4133 	{
4134 		unsigned long qflags;
4135 		ADDRESS *q;
4136 		int r;
4137 		time_t now;
4138 		auto char *ep;
4139 
4140 		if (tTd(40, 4))
4141 			sm_dprintf("+++++ %s\n", bp);
4142 		if (nomore)
4143 		{
4144 			/* hack attack */
4145   hackattack:
4146 			syserr("SECURITY ALERT: extra or bogus data in queue file: %s",
4147 			       bp);
4148 			err = "bogus queue line";
4149 			goto fail;
4150 		}
4151 		switch (bp[0])
4152 		{
4153 		  case 'A':		/* AUTH= parameter */
4154 			if (!xtextok(&bp[1]))
4155 				goto hackattack;
4156 			e->e_auth_param = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4157 			break;
4158 
4159 		  case 'B':		/* body type */
4160 			r = check_bodytype(&bp[1]);
4161 			if (!BODYTYPE_VALID(r))
4162 				goto hackattack;
4163 			e->e_bodytype = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4164 			break;
4165 
4166 		  case 'C':		/* specify controlling user */
4167 			ctladdr = setctluser(&bp[1], qfver, e);
4168 			break;
4169 
4170 		  case 'D':		/* data file name */
4171 			/* obsolete -- ignore */
4172 			break;
4173 
4174 		  case 'd':		/* data file directory name */
4175 			{
4176 				int qgrp, qdir;
4177 
4178 #if _FFR_MSP_PARANOIA
4179 				/* forbid queue groups in MSP? */
4180 				if (UseMSP)
4181 					goto hackattack;
4182 #endif /* _FFR_MSP_PARANOIA */
4183 				for (qgrp = 0;
4184 				     qgrp < NumQueue && Queue[qgrp] != NULL;
4185 				     ++qgrp)
4186 				{
4187 					for (qdir = 0;
4188 					     qdir < Queue[qgrp]->qg_numqueues;
4189 					     ++qdir)
4190 					{
4191 						if (strcmp(&bp[1],
4192 							   Queue[qgrp]->qg_qpaths[qdir].qp_name)
4193 						    == 0)
4194 						{
4195 							e->e_dfqgrp = qgrp;
4196 							e->e_dfqdir = qdir;
4197 							goto done;
4198 						}
4199 					}
4200 				}
4201 				err = "bogus queue file directory";
4202 				goto fail;
4203 			  done:
4204 				break;
4205 			}
4206 
4207 		  case 'E':		/* specify error recipient */
4208 			/* no longer used */
4209 			break;
4210 
4211 		  case 'F':		/* flag bits */
4212 			if (strncmp(bp, "From ", 5) == 0)
4213 			{
4214 				/* we are being spoofed! */
4215 				syserr("SECURITY ALERT: bogus qf line %s", bp);
4216 				err = "bogus queue line";
4217 				goto fail;
4218 			}
4219 			for (p = &bp[1]; *p != '\0'; p++)
4220 			{
4221 				switch (*p)
4222 				{
4223 				  case '8':	/* has 8 bit data */
4224 					e->e_flags |= EF_HAS8BIT;
4225 					break;
4226 
4227 				  case 'b':	/* delete Bcc: header */
4228 					e->e_flags |= EF_DELETE_BCC;
4229 					break;
4230 
4231 				  case 'd':	/* envelope has DSN RET= */
4232 					e->e_flags |= EF_RET_PARAM;
4233 					break;
4234 
4235 				  case 'n':	/* don't return body */
4236 					e->e_flags |= EF_NO_BODY_RETN;
4237 					break;
4238 
4239 				  case 'r':	/* response */
4240 					e->e_flags |= EF_RESPONSE;
4241 					break;
4242 
4243 				  case 's':	/* split */
4244 					e->e_flags |= EF_SPLIT;
4245 					break;
4246 
4247 				  case 'w':	/* warning sent */
4248 					e->e_flags |= EF_WARNING;
4249 					break;
4250 				}
4251 			}
4252 			break;
4253 
4254 		  case 'q':		/* quarantine reason */
4255 			e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4256 			macdefine(&e->e_macro, A_PERM,
4257 				  macid("{quarantine}"), e->e_quarmsg);
4258 			break;
4259 
4260 		  case 'H':		/* header */
4261 
4262 			/*
4263 			**  count size before chompheader() destroys the line.
4264 			**  this isn't accurate due to macro expansion, but
4265 			**  better than before. "-3" to skip H?? at least.
4266 			*/
4267 
4268 			hdrsize += strlen(bp) - 3;
4269 			(void) chompheader(&bp[1], CHHDR_QUEUE, NULL, e);
4270 			break;
4271 
4272 		  case 'I':		/* data file's inode number */
4273 			/* regenerated below */
4274 			break;
4275 
4276 		  case 'K':		/* time of last delivery attempt */
4277 			e->e_dtime = atol(&buf[1]);
4278 			break;
4279 
4280 		  case 'L':		/* Solaris Content-Length: */
4281 		  case 'M':		/* message */
4282 			/* ignore this; we want a new message next time */
4283 			break;
4284 
4285 		  case 'N':		/* number of delivery attempts */
4286 			e->e_ntries = atoi(&buf[1]);
4287 
4288 			/* if this has been tried recently, let it be */
4289 			now = curtime();
4290 			if (e->e_ntries > 0 && e->e_dtime <= now &&
4291 			    now < e->e_dtime + MinQueueAge)
4292 			{
4293 				char *howlong;
4294 
4295 				howlong = pintvl(now - e->e_dtime, true);
4296 				if (Verbose)
4297 					(void) sm_io_fprintf(smioout,
4298 							     SM_TIME_DEFAULT,
4299 							     "%s: too young (%s)\n",
4300 							     e->e_id, howlong);
4301 				if (tTd(40, 8))
4302 					sm_dprintf("%s: too young (%s)\n",
4303 						e->e_id, howlong);
4304 				if (LogLevel > 19)
4305 					sm_syslog(LOG_DEBUG, e->e_id,
4306 						  "too young (%s)",
4307 						  howlong);
4308 				e->e_id = NULL;
4309 				unlockqueue(e);
4310 				if (bp != buf)
4311 					sm_free(bp);
4312 				return false;
4313 			}
4314 			macdefine(&e->e_macro, A_TEMP,
4315 				macid("{ntries}"), &buf[1]);
4316 
4317 #if NAMED_BIND
4318 			/* adjust BIND parameters immediately */
4319 			if (e->e_ntries == 0)
4320 			{
4321 				_res.retry = TimeOuts.res_retry[RES_TO_FIRST];
4322 				_res.retrans = TimeOuts.res_retrans[RES_TO_FIRST];
4323 			}
4324 			else
4325 			{
4326 				_res.retry = TimeOuts.res_retry[RES_TO_NORMAL];
4327 				_res.retrans = TimeOuts.res_retrans[RES_TO_NORMAL];
4328 			}
4329 #endif /* NAMED_BIND */
4330 			break;
4331 
4332 		  case 'P':		/* message priority */
4333 			e->e_msgpriority = atol(&bp[1]) + WkTimeFact;
4334 			break;
4335 
4336 		  case 'Q':		/* original recipient */
4337 			orcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4338 			break;
4339 
4340 		  case 'r':		/* final recipient */
4341 			frcpt = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4342 			break;
4343 
4344 		  case 'R':		/* specify recipient */
4345 			p = bp;
4346 			qflags = 0;
4347 			if (qfver >= 1)
4348 			{
4349 				/* get flag bits */
4350 				while (*++p != '\0' && *p != ':')
4351 				{
4352 					switch (*p)
4353 					{
4354 					  case 'N':
4355 						qflags |= QHASNOTIFY;
4356 						break;
4357 
4358 					  case 'S':
4359 						qflags |= QPINGONSUCCESS;
4360 						break;
4361 
4362 					  case 'F':
4363 						qflags |= QPINGONFAILURE;
4364 						break;
4365 
4366 					  case 'D':
4367 						qflags |= QPINGONDELAY;
4368 						break;
4369 
4370 					  case 'P':
4371 						qflags |= QPRIMARY;
4372 						break;
4373 
4374 					  case 'A':
4375 						if (ctladdr != NULL)
4376 							ctladdr->q_flags |= QALIAS;
4377 						break;
4378 
4379 					  default: /* ignore or complain? */
4380 						break;
4381 					}
4382 				}
4383 			}
4384 			else
4385 				qflags |= QPRIMARY;
4386 			macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4387 				"e r");
4388 			if (*p != '\0')
4389 				q = parseaddr(++p, NULLADDR, RF_COPYALL, '\0',
4390 						NULL, e, true);
4391 			else
4392 				q = NULL;
4393 			if (q != NULL)
4394 			{
4395 				/* make sure we keep the current qgrp */
4396 				if (ISVALIDQGRP(e->e_qgrp))
4397 					q->q_qgrp = e->e_qgrp;
4398 				q->q_alias = ctladdr;
4399 				if (qfver >= 1)
4400 					q->q_flags &= ~Q_PINGFLAGS;
4401 				q->q_flags |= qflags;
4402 				q->q_finalrcpt = frcpt;
4403 				q->q_orcpt = orcpt;
4404 				(void) recipient(q, &e->e_sendqueue, 0, e);
4405 			}
4406 			frcpt = NULL;
4407 			orcpt = NULL;
4408 			macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
4409 				NULL);
4410 			break;
4411 
4412 		  case 'S':		/* sender */
4413 			setsender(sm_rpool_strdup_x(e->e_rpool, &bp[1]),
4414 				  e, NULL, '\0', true);
4415 			break;
4416 
4417 		  case 'T':		/* init time */
4418 			e->e_ctime = atol(&bp[1]);
4419 			break;
4420 
4421 		  case 'V':		/* queue file version number */
4422 			qfver = atoi(&bp[1]);
4423 			if (qfver <= QF_VERSION)
4424 				break;
4425 			syserr("Version number in queue file (%d) greater than max (%d)",
4426 				qfver, QF_VERSION);
4427 			err = "unsupported queue file version";
4428 			goto fail;
4429 			/* NOTREACHED */
4430 			break;
4431 
4432 		  case 'Z':		/* original envelope id from ESMTP */
4433 			e->e_envid = sm_rpool_strdup_x(e->e_rpool, &bp[1]);
4434 			macdefine(&e->e_macro, A_PERM,
4435 				macid("{dsn_envid}"), e->e_envid);
4436 			break;
4437 
4438 		  case '!':		/* deliver by */
4439 
4440 			/* format: flag (1 char) space long-integer */
4441 			e->e_dlvr_flag = buf[1];
4442 			e->e_deliver_by = strtol(&buf[3], NULL, 10);
4443 
4444 		  case '$':		/* define macro */
4445 			{
4446 				char *p;
4447 
4448 				/* XXX elimate p? */
4449 				r = macid_parse(&bp[1], &ep);
4450 				if (r == 0)
4451 					break;
4452 				p = sm_rpool_strdup_x(e->e_rpool, ep);
4453 				macdefine(&e->e_macro, A_PERM, r, p);
4454 			}
4455 			break;
4456 
4457 		  case '.':		/* terminate file */
4458 			nomore = true;
4459 			break;
4460 
4461 #if _FFR_QUEUEDELAY
4462 		  case 'G':
4463 		  case 'Y':
4464 
4465 			/*
4466 			**  Maintain backward compatibility for
4467 			**  users who defined _FFR_QUEUEDELAY in
4468 			**  previous releases.  Remove this
4469 			**  code in 8.14 or 8.15.
4470 			*/
4471 
4472 			if (qfver == 5 || qfver == 7)
4473 				break;
4474 
4475 			/* If not qfver 5 or 7, then 'G' or 'Y' is invalid */
4476 			/* FALLTHROUGH */
4477 #endif /* _FFR_QUEUEDELAY */
4478 
4479 		  default:
4480 			syserr("readqf: %s: line %d: bad line \"%s\"",
4481 				qf, LineNumber, shortenstring(bp, MAXSHORTSTR));
4482 			err = "unrecognized line";
4483 			goto fail;
4484 		}
4485 
4486 		if (bp != buf)
4487 			SM_FREE(bp);
4488 	}
4489 
4490 	/*
4491 	**  If we haven't read any lines, this queue file is empty.
4492 	**  Arrange to remove it without referencing any null pointers.
4493 	*/
4494 
4495 	if (LineNumber == 0)
4496 	{
4497 		errno = 0;
4498 		e->e_flags |= EF_CLRQUEUE|EF_FATALERRS|EF_RESPONSE;
4499 		return true;
4500 	}
4501 
4502 	/* Check to make sure we have a complete queue file read */
4503 	if (!nomore)
4504 	{
4505 		syserr("readqf: %s: incomplete queue file read", qf);
4506 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4507 		return false;
4508 	}
4509 
4510 #if _FFR_QF_PARANOIA
4511 	/* Check to make sure key fields were read */
4512 	if (e->e_from.q_mailer == NULL)
4513 	{
4514 		syserr("readqf: %s: sender not specified in queue file", qf);
4515 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4516 		return false;
4517 	}
4518 	/* other checks? */
4519 #endif /* _FFR_QF_PARANOIA */
4520 
4521 	/* possibly set ${dsn_ret} macro */
4522 	if (bitset(EF_RET_PARAM, e->e_flags))
4523 	{
4524 		if (bitset(EF_NO_BODY_RETN, e->e_flags))
4525 			macdefine(&e->e_macro, A_PERM,
4526 				macid("{dsn_ret}"), "hdrs");
4527 		else
4528 			macdefine(&e->e_macro, A_PERM,
4529 				macid("{dsn_ret}"), "full");
4530 	}
4531 
4532 	/*
4533 	**  Arrange to read the data file.
4534 	*/
4535 
4536 	p = queuename(e, DATAFL_LETTER);
4537 	e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, p, SM_IO_RDONLY_B,
4538 			      NULL);
4539 	if (e->e_dfp == NULL)
4540 	{
4541 		syserr("readqf: cannot open %s", p);
4542 	}
4543 	else
4544 	{
4545 		e->e_flags |= EF_HAS_DF;
4546 		if (fstat(sm_io_getinfo(e->e_dfp, SM_IO_WHAT_FD, NULL), &st)
4547 		    >= 0)
4548 		{
4549 			e->e_msgsize = st.st_size + hdrsize;
4550 			e->e_dfdev = st.st_dev;
4551 			e->e_dfino = ST_INODE(st);
4552 			(void) sm_snprintf(buf, sizeof(buf), "%ld",
4553 					   e->e_msgsize);
4554 			macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"),
4555 				  buf);
4556 		}
4557 	}
4558 
4559 	return true;
4560 
4561   fail:
4562 	/*
4563 	**  There was some error reading the qf file (reason is in err var.)
4564 	**  Cleanup:
4565 	**	close file; clear e_lockfp since it is the same as qfp,
4566 	**	hence it is invalid (as file) after qfp is closed;
4567 	**	the qf file is on disk, so set the flag to avoid calling
4568 	**	queueup() with bogus data.
4569 	*/
4570 
4571 	if (bp != buf)
4572 		SM_FREE(bp);
4573 	if (qfp != NULL)
4574 		(void) sm_io_close(qfp, SM_TIME_DEFAULT);
4575 	e->e_lockfp = NULL;
4576 	e->e_flags |= EF_INQUEUE;
4577 	loseqfile(e, err);
4578 	return false;
4579 }
4580 /*
4581 **  PRTSTR -- print a string, "unprintable" characters are shown as \oct
4582 **
4583 **	Parameters:
4584 **		s -- string to print
4585 **		ml -- maximum length of output
4586 **
4587 **	Returns:
4588 **		number of entries
4589 **
4590 **	Side Effects:
4591 **		Prints a string on stdout.
4592 */
4593 
4594 static void prtstr __P((char *, int));
4595 
4596 static void
4597 prtstr(s, ml)
4598 	char *s;
4599 	int ml;
4600 {
4601 	int c;
4602 
4603 	if (s == NULL)
4604 		return;
4605 	while (ml-- > 0 && ((c = *s++) != '\0'))
4606 	{
4607 		if (c == '\\')
4608 		{
4609 			if (ml-- > 0)
4610 			{
4611 				(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4612 				(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4613 			}
4614 		}
4615 		else if (isascii(c) && isprint(c))
4616 			(void) sm_io_putc(smioout, SM_TIME_DEFAULT, c);
4617 		else
4618 		{
4619 			if ((ml -= 3) > 0)
4620 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4621 						     "\\%03o", c & 0xFF);
4622 		}
4623 	}
4624 }
4625 /*
4626 **  PRINTNQE -- print out number of entries in the mail queue
4627 **
4628 **	Parameters:
4629 **		out -- output file pointer.
4630 **		prefix -- string to output in front of each line.
4631 **
4632 **	Returns:
4633 **		none.
4634 */
4635 
4636 void
4637 printnqe(out, prefix)
4638 	SM_FILE_T *out;
4639 	char *prefix;
4640 {
4641 #if SM_CONF_SHM
4642 	int i, k = 0, nrequests = 0;
4643 	bool unknown = false;
4644 
4645 	if (ShmId == SM_SHM_NO_ID)
4646 	{
4647 		if (prefix == NULL)
4648 			(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4649 					"Data unavailable: shared memory not updated\n");
4650 		else
4651 			(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4652 					"%sNOTCONFIGURED:-1\r\n", prefix);
4653 		return;
4654 	}
4655 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4656 	{
4657 		int j;
4658 
4659 		k++;
4660 		for (j = 0; j < Queue[i]->qg_numqueues; j++)
4661 		{
4662 			int n;
4663 
4664 			if (StopRequest)
4665 				stop_sendmail();
4666 
4667 			n = QSHM_ENTRIES(Queue[i]->qg_qpaths[j].qp_idx);
4668 			if (prefix != NULL)
4669 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4670 					"%s%s:%d\r\n",
4671 					prefix, qid_printqueue(i, j), n);
4672 			else if (n < 0)
4673 			{
4674 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4675 					"%s: unknown number of entries\n",
4676 					qid_printqueue(i, j));
4677 				unknown = true;
4678 			}
4679 			else if (n == 0)
4680 			{
4681 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4682 					"%s is empty\n",
4683 					qid_printqueue(i, j));
4684 			}
4685 			else if (n > 0)
4686 			{
4687 				(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4688 					"%s: entries=%d\n",
4689 					qid_printqueue(i, j), n);
4690 				nrequests += n;
4691 				k++;
4692 			}
4693 		}
4694 	}
4695 	if (prefix == NULL && k > 1)
4696 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4697 				     "\t\tTotal requests: %d%s\n",
4698 				     nrequests, unknown ? " (about)" : "");
4699 #else /* SM_CONF_SHM */
4700 	if (prefix == NULL)
4701 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4702 			     "Data unavailable without shared memory support\n");
4703 	else
4704 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
4705 			     "%sNOTAVAILABLE:-1\r\n", prefix);
4706 #endif /* SM_CONF_SHM */
4707 }
4708 /*
4709 **  PRINTQUEUE -- print out a representation of the mail queue
4710 **
4711 **	Parameters:
4712 **		none.
4713 **
4714 **	Returns:
4715 **		none.
4716 **
4717 **	Side Effects:
4718 **		Prints a listing of the mail queue on the standard output.
4719 */
4720 
4721 void
4722 printqueue()
4723 {
4724 	int i, k = 0, nrequests = 0;
4725 
4726 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
4727 	{
4728 		int j;
4729 
4730 		k++;
4731 		for (j = 0; j < Queue[i]->qg_numqueues; j++)
4732 		{
4733 			if (StopRequest)
4734 				stop_sendmail();
4735 			nrequests += print_single_queue(i, j);
4736 			k++;
4737 		}
4738 	}
4739 	if (k > 1)
4740 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4741 				     "\t\tTotal requests: %d\n",
4742 				     nrequests);
4743 }
4744 /*
4745 **  PRINT_SINGLE_QUEUE -- print out a representation of a single mail queue
4746 **
4747 **	Parameters:
4748 **		qgrp -- the index of the queue group.
4749 **		qdir -- the queue directory.
4750 **
4751 **	Returns:
4752 **		number of requests in mail queue.
4753 **
4754 **	Side Effects:
4755 **		Prints a listing of the mail queue on the standard output.
4756 */
4757 
4758 int
4759 print_single_queue(qgrp, qdir)
4760 	int qgrp;
4761 	int qdir;
4762 {
4763 	register WORK *w;
4764 	SM_FILE_T *f;
4765 	int nrequests;
4766 	char qd[MAXPATHLEN];
4767 	char qddf[MAXPATHLEN];
4768 	char buf[MAXLINE];
4769 
4770 	if (qdir == NOQDIR)
4771 	{
4772 		(void) sm_strlcpy(qd, ".", sizeof(qd));
4773 		(void) sm_strlcpy(qddf, ".", sizeof(qddf));
4774 	}
4775 	else
4776 	{
4777 		(void) sm_strlcpyn(qd, sizeof(qd), 2,
4778 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
4779 			(bitset(QP_SUBQF,
4780 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4781 					? "/qf" : ""));
4782 		(void) sm_strlcpyn(qddf, sizeof(qddf), 2,
4783 			Queue[qgrp]->qg_qpaths[qdir].qp_name,
4784 			(bitset(QP_SUBDF,
4785 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
4786 					? "/df" : ""));
4787 	}
4788 
4789 	/*
4790 	**  Check for permission to print the queue
4791 	*/
4792 
4793 	if (bitset(PRIV_RESTRICTMAILQ, PrivacyFlags) && RealUid != 0)
4794 	{
4795 		struct stat st;
4796 #ifdef NGROUPS_MAX
4797 		int n;
4798 		extern GIDSET_T InitialGidSet[NGROUPS_MAX];
4799 #endif /* NGROUPS_MAX */
4800 
4801 		if (stat(qd, &st) < 0)
4802 		{
4803 			syserr("Cannot stat %s",
4804 				qid_printqueue(qgrp, qdir));
4805 			return 0;
4806 		}
4807 #ifdef NGROUPS_MAX
4808 		n = NGROUPS_MAX;
4809 		while (--n >= 0)
4810 		{
4811 			if (InitialGidSet[n] == st.st_gid)
4812 				break;
4813 		}
4814 		if (n < 0 && RealGid != st.st_gid)
4815 #else /* NGROUPS_MAX */
4816 		if (RealGid != st.st_gid)
4817 #endif /* NGROUPS_MAX */
4818 		{
4819 			usrerr("510 You are not permitted to see the queue");
4820 			setstat(EX_NOPERM);
4821 			return 0;
4822 		}
4823 	}
4824 
4825 	/*
4826 	**  Read and order the queue.
4827 	*/
4828 
4829 	nrequests = gatherq(qgrp, qdir, true, NULL, NULL);
4830 	(void) sortq(Queue[qgrp]->qg_maxlist);
4831 
4832 	/*
4833 	**  Print the work list that we have read.
4834 	*/
4835 
4836 	/* first see if there is anything */
4837 	if (nrequests <= 0)
4838 	{
4839 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%s is empty\n",
4840 				     qid_printqueue(qgrp, qdir));
4841 		return 0;
4842 	}
4843 
4844 	sm_getla();	/* get load average */
4845 
4846 	(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\t\t%s (%d request%s",
4847 			     qid_printqueue(qgrp, qdir),
4848 			     nrequests, nrequests == 1 ? "" : "s");
4849 	if (MaxQueueRun > 0 && nrequests > MaxQueueRun)
4850 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4851 				     ", only %d printed", MaxQueueRun);
4852 	if (Verbose)
4853 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4854 			")\n-----Q-ID----- --Size-- -Priority- ---Q-Time--- --------Sender/Recipient--------\n");
4855 	else
4856 		(void) sm_io_fprintf(smioout,  SM_TIME_DEFAULT,
4857 			")\n-----Q-ID----- --Size-- -----Q-Time----- ------------Sender/Recipient-----------\n");
4858 	for (w = WorkQ; w != NULL; w = w->w_next)
4859 	{
4860 		struct stat st;
4861 		auto time_t submittime = 0;
4862 		long dfsize;
4863 		int flags = 0;
4864 		int qfver;
4865 		char quarmsg[MAXLINE];
4866 		char statmsg[MAXLINE];
4867 		char bodytype[MAXNAME + 1];
4868 		char qf[MAXPATHLEN];
4869 
4870 		if (StopRequest)
4871 			stop_sendmail();
4872 
4873 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "%13s",
4874 				     w->w_name + 2);
4875 		(void) sm_strlcpyn(qf, sizeof(qf), 3, qd, "/", w->w_name);
4876 		f = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, qf, SM_IO_RDONLY_B,
4877 			       NULL);
4878 		if (f == NULL)
4879 		{
4880 			if (errno == EPERM)
4881 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4882 						     " (permission denied)\n");
4883 			else if (errno == ENOENT)
4884 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4885 						     " (job completed)\n");
4886 			else
4887 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
4888 						     " (%s)\n",
4889 						     sm_errstring(errno));
4890 			errno = 0;
4891 			continue;
4892 		}
4893 		w->w_name[0] = DATAFL_LETTER;
4894 		(void) sm_strlcpyn(qf, sizeof(qf), 3, qddf, "/", w->w_name);
4895 		if (stat(qf, &st) >= 0)
4896 			dfsize = st.st_size;
4897 		else
4898 		{
4899 			ENVELOPE e;
4900 
4901 			/*
4902 			**  Maybe the df file can't be statted because
4903 			**  it is in a different directory than the qf file.
4904 			**  In order to find out, we must read the qf file.
4905 			*/
4906 
4907 			newenvelope(&e, &BlankEnvelope, sm_rpool_new_x(NULL));
4908 			e.e_id = w->w_name + 2;
4909 			e.e_qgrp = qgrp;
4910 			e.e_qdir = qdir;
4911 			dfsize = -1;
4912 			if (readqf(&e, false))
4913 			{
4914 				char *df = queuename(&e, DATAFL_LETTER);
4915 				if (stat(df, &st) >= 0)
4916 					dfsize = st.st_size;
4917 			}
4918 			if (e.e_lockfp != NULL)
4919 			{
4920 				(void) sm_io_close(e.e_lockfp, SM_TIME_DEFAULT);
4921 				e.e_lockfp = NULL;
4922 			}
4923 			clearenvelope(&e, false, e.e_rpool);
4924 			sm_rpool_free(e.e_rpool);
4925 		}
4926 		if (w->w_lock)
4927 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "*");
4928 		else if (QueueMode == QM_LOST)
4929 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "?");
4930 		else if (w->w_tooyoung)
4931 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "-");
4932 		else if (shouldqueue(w->w_pri, w->w_ctime))
4933 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "X");
4934 		else
4935 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, " ");
4936 
4937 		errno = 0;
4938 
4939 		quarmsg[0] = '\0';
4940 		statmsg[0] = bodytype[0] = '\0';
4941 		qfver = 0;
4942 		while (sm_io_fgets(f, SM_TIME_DEFAULT, buf, sizeof(buf)) != NULL)
4943 		{
4944 			register int i;
4945 			register char *p;
4946 
4947 			if (StopRequest)
4948 				stop_sendmail();
4949 
4950 			fixcrlf(buf, true);
4951 			switch (buf[0])
4952 			{
4953 			  case 'V':	/* queue file version */
4954 				qfver = atoi(&buf[1]);
4955 				break;
4956 
4957 			  case 'M':	/* error message */
4958 				if ((i = strlen(&buf[1])) >= sizeof(statmsg))
4959 					i = sizeof(statmsg) - 1;
4960 				memmove(statmsg, &buf[1], i);
4961 				statmsg[i] = '\0';
4962 				break;
4963 
4964 			  case 'q':	/* quarantine reason */
4965 				if ((i = strlen(&buf[1])) >= sizeof(quarmsg))
4966 					i = sizeof(quarmsg) - 1;
4967 				memmove(quarmsg, &buf[1], i);
4968 				quarmsg[i] = '\0';
4969 				break;
4970 
4971 			  case 'B':	/* body type */
4972 				if ((i = strlen(&buf[1])) >= sizeof(bodytype))
4973 					i = sizeof(bodytype) - 1;
4974 				memmove(bodytype, &buf[1], i);
4975 				bodytype[i] = '\0';
4976 				break;
4977 
4978 			  case 'S':	/* sender name */
4979 				if (Verbose)
4980 				{
4981 					(void) sm_io_fprintf(smioout,
4982 						SM_TIME_DEFAULT,
4983 						"%8ld %10ld%c%.12s ",
4984 						dfsize,
4985 						w->w_pri,
4986 						bitset(EF_WARNING, flags)
4987 							? '+' : ' ',
4988 						ctime(&submittime) + 4);
4989 					prtstr(&buf[1], 78);
4990 				}
4991 				else
4992 				{
4993 					(void) sm_io_fprintf(smioout,
4994 						SM_TIME_DEFAULT,
4995 						"%8ld %.16s ",
4996 						dfsize,
4997 						ctime(&submittime));
4998 					prtstr(&buf[1], 39);
4999 				}
5000 
5001 				if (quarmsg[0] != '\0')
5002 				{
5003 					(void) sm_io_fprintf(smioout,
5004 							     SM_TIME_DEFAULT,
5005 							     "\n     QUARANTINE: %.*s",
5006 							     Verbose ? 100 : 60,
5007 							     quarmsg);
5008 					quarmsg[0] = '\0';
5009 				}
5010 
5011 				if (statmsg[0] != '\0' || bodytype[0] != '\0')
5012 				{
5013 					(void) sm_io_fprintf(smioout,
5014 						SM_TIME_DEFAULT,
5015 						"\n    %10.10s",
5016 						bodytype);
5017 					if (statmsg[0] != '\0')
5018 						(void) sm_io_fprintf(smioout,
5019 							SM_TIME_DEFAULT,
5020 							"   (%.*s)",
5021 							Verbose ? 100 : 60,
5022 							statmsg);
5023 					statmsg[0] = '\0';
5024 				}
5025 				break;
5026 
5027 			  case 'C':	/* controlling user */
5028 				if (Verbose)
5029 					(void) sm_io_fprintf(smioout,
5030 						SM_TIME_DEFAULT,
5031 						"\n\t\t\t\t\t\t(---%.64s---)",
5032 						&buf[1]);
5033 				break;
5034 
5035 			  case 'R':	/* recipient name */
5036 				p = &buf[1];
5037 				if (qfver >= 1)
5038 				{
5039 					p = strchr(p, ':');
5040 					if (p == NULL)
5041 						break;
5042 					p++;
5043 				}
5044 				if (Verbose)
5045 				{
5046 					(void) sm_io_fprintf(smioout,
5047 							SM_TIME_DEFAULT,
5048 							"\n\t\t\t\t\t\t");
5049 					prtstr(p, 71);
5050 				}
5051 				else
5052 				{
5053 					(void) sm_io_fprintf(smioout,
5054 							SM_TIME_DEFAULT,
5055 							"\n\t\t\t\t\t ");
5056 					prtstr(p, 38);
5057 				}
5058 				if (Verbose && statmsg[0] != '\0')
5059 				{
5060 					(void) sm_io_fprintf(smioout,
5061 							SM_TIME_DEFAULT,
5062 							"\n\t\t (%.100s)",
5063 							statmsg);
5064 					statmsg[0] = '\0';
5065 				}
5066 				break;
5067 
5068 			  case 'T':	/* creation time */
5069 				submittime = atol(&buf[1]);
5070 				break;
5071 
5072 			  case 'F':	/* flag bits */
5073 				for (p = &buf[1]; *p != '\0'; p++)
5074 				{
5075 					switch (*p)
5076 					{
5077 					  case 'w':
5078 						flags |= EF_WARNING;
5079 						break;
5080 					}
5081 				}
5082 			}
5083 		}
5084 		if (submittime == (time_t) 0)
5085 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
5086 					     " (no control file)");
5087 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, "\n");
5088 		(void) sm_io_close(f, SM_TIME_DEFAULT);
5089 	}
5090 	return nrequests;
5091 }
5092 
5093 /*
5094 **  QUEUE_LETTER -- get the proper queue letter for the current QueueMode.
5095 **
5096 **	Parameters:
5097 **		e -- envelope to build it in/from.
5098 **		type -- the file type, used as the first character
5099 **			of the file name.
5100 **
5101 **	Returns:
5102 **		the letter to use
5103 */
5104 
5105 static char
5106 queue_letter(e, type)
5107 	ENVELOPE *e;
5108 	int type;
5109 {
5110 	/* Change type according to QueueMode */
5111 	if (type == ANYQFL_LETTER)
5112 	{
5113 		if (e->e_quarmsg != NULL)
5114 			type = QUARQF_LETTER;
5115 		else
5116 		{
5117 			switch (QueueMode)
5118 			{
5119 			  case QM_NORMAL:
5120 				type = NORMQF_LETTER;
5121 				break;
5122 
5123 			  case QM_QUARANTINE:
5124 				type = QUARQF_LETTER;
5125 				break;
5126 
5127 			  case QM_LOST:
5128 				type = LOSEQF_LETTER;
5129 				break;
5130 
5131 			  default:
5132 				/* should never happen */
5133 				abort();
5134 				/* NOTREACHED */
5135 			}
5136 		}
5137 	}
5138 	return type;
5139 }
5140 
5141 /*
5142 **  QUEUENAME -- build a file name in the queue directory for this envelope.
5143 **
5144 **	Parameters:
5145 **		e -- envelope to build it in/from.
5146 **		type -- the file type, used as the first character
5147 **			of the file name.
5148 **
5149 **	Returns:
5150 **		a pointer to the queue name (in a static buffer).
5151 **
5152 **	Side Effects:
5153 **		If no id code is already assigned, queuename() will
5154 **		assign an id code with assign_queueid().  If no queue
5155 **		directory is assigned, one will be set with setnewqueue().
5156 */
5157 
5158 char *
5159 queuename(e, type)
5160 	register ENVELOPE *e;
5161 	int type;
5162 {
5163 	int qd, qg;
5164 	char *sub = "/";
5165 	char pref[3];
5166 	static char buf[MAXPATHLEN];
5167 
5168 	/* Assign an ID if needed */
5169 	if (e->e_id == NULL)
5170 		assign_queueid(e);
5171 	type = queue_letter(e, type);
5172 
5173 	/* begin of filename */
5174 	pref[0] = (char) type;
5175 	pref[1] = 'f';
5176 	pref[2] = '\0';
5177 
5178 	/* Assign a queue group/directory if needed */
5179 	if (type == XSCRPT_LETTER)
5180 	{
5181 		/*
5182 		**  We don't want to call setnewqueue() if we are fetching
5183 		**  the pathname of the transcript file, because setnewqueue
5184 		**  chooses a queue, and sometimes we need to write to the
5185 		**  transcript file before we have gathered enough information
5186 		**  to choose a queue.
5187 		*/
5188 
5189 		if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5190 		{
5191 			if (e->e_qgrp != NOQGRP && e->e_qdir != NOQDIR)
5192 			{
5193 				e->e_xfqgrp = e->e_qgrp;
5194 				e->e_xfqdir = e->e_qdir;
5195 			}
5196 			else
5197 			{
5198 				e->e_xfqgrp = 0;
5199 				if (Queue[e->e_xfqgrp]->qg_numqueues <= 1)
5200 					e->e_xfqdir = 0;
5201 				else
5202 				{
5203 					e->e_xfqdir = get_rand_mod(
5204 					      Queue[e->e_xfqgrp]->qg_numqueues);
5205 				}
5206 			}
5207 		}
5208 		qd = e->e_xfqdir;
5209 		qg = e->e_xfqgrp;
5210 	}
5211 	else
5212 	{
5213 		if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
5214 			(void) setnewqueue(e);
5215 		if (type ==  DATAFL_LETTER)
5216 		{
5217 			qd = e->e_dfqdir;
5218 			qg = e->e_dfqgrp;
5219 		}
5220 		else
5221 		{
5222 			qd = e->e_qdir;
5223 			qg = e->e_qgrp;
5224 		}
5225 	}
5226 
5227 	/* xf files always have a valid qd and qg picked above */
5228 	if ((qd == NOQDIR || qg == NOQGRP) && type != XSCRPT_LETTER)
5229 		(void) sm_strlcpyn(buf, sizeof(buf), 2, pref, e->e_id);
5230 	else
5231 	{
5232 		switch (type)
5233 		{
5234 		  case DATAFL_LETTER:
5235 			if (bitset(QP_SUBDF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5236 				sub = "/df/";
5237 			break;
5238 
5239 		  case QUARQF_LETTER:
5240 		  case TEMPQF_LETTER:
5241 		  case NEWQFL_LETTER:
5242 		  case LOSEQF_LETTER:
5243 		  case NORMQF_LETTER:
5244 			if (bitset(QP_SUBQF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5245 				sub = "/qf/";
5246 			break;
5247 
5248 		  case XSCRPT_LETTER:
5249 			if (bitset(QP_SUBXF, Queue[qg]->qg_qpaths[qd].qp_subdirs))
5250 				sub = "/xf/";
5251 			break;
5252 
5253 		  default:
5254 			sm_abort("queuename: bad queue file type %d", type);
5255 		}
5256 
5257 		(void) sm_strlcpyn(buf, sizeof(buf), 4,
5258 				Queue[qg]->qg_qpaths[qd].qp_name,
5259 				sub, pref, e->e_id);
5260 	}
5261 
5262 	if (tTd(7, 2))
5263 		sm_dprintf("queuename: %s\n", buf);
5264 	return buf;
5265 }
5266 
5267 /*
5268 **  INIT_QID_ALG -- Initialize the (static) parameters that are used to
5269 **	generate a queue ID.
5270 **
5271 **	This function is called by the daemon to reset
5272 **	LastQueueTime and LastQueuePid which are used by assign_queueid().
5273 **	Otherwise the algorithm may cause problems because
5274 **	LastQueueTime and LastQueuePid are set indirectly by main()
5275 **	before the daemon process is started, hence LastQueuePid is not
5276 **	the pid of the daemon and therefore a child of the daemon can
5277 **	actually have the same pid as LastQueuePid which means the section
5278 **	in  assign_queueid():
5279 **	* see if we need to get a new base time/pid *
5280 **	is NOT triggered which will cause the same queue id to be generated.
5281 **
5282 **	Parameters:
5283 **		none
5284 **
5285 **	Returns:
5286 **		none.
5287 */
5288 
5289 void
5290 init_qid_alg()
5291 {
5292 	LastQueueTime = 0;
5293 	LastQueuePid = -1;
5294 }
5295 
5296 /*
5297 **  ASSIGN_QUEUEID -- assign a queue ID for this envelope.
5298 **
5299 **	Assigns an id code if one does not already exist.
5300 **	This code assumes that nothing will remain in the queue for
5301 **	longer than 60 years.  It is critical that files with the given
5302 **	name do not already exist in the queue.
5303 **	[No longer initializes e_qdir to NOQDIR.]
5304 **
5305 **	Parameters:
5306 **		e -- envelope to set it in.
5307 **
5308 **	Returns:
5309 **		none.
5310 */
5311 
5312 static const char QueueIdChars[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
5313 # define QIC_LEN	60
5314 # define QIC_LEN_R	62
5315 
5316 /*
5317 **  Note: the length is "officially" 60 because minutes and seconds are
5318 **	usually only 0-59.  However (Linux):
5319 **       tm_sec The number of seconds after the minute, normally in
5320 **		the range 0 to 59, but can be up to 61 to allow for
5321 **		leap seconds.
5322 **	Hence the real length of the string is 62 to take this into account.
5323 **	Alternatively % QIC_LEN can (should) be used for access everywhere.
5324 */
5325 
5326 # define queuenextid() CurrentPid
5327 
5328 
5329 void
5330 assign_queueid(e)
5331 	register ENVELOPE *e;
5332 {
5333 	pid_t pid = queuenextid();
5334 	static int cX = 0;
5335 	static long random_offset;
5336 	struct tm *tm;
5337 	char idbuf[MAXQFNAME - 2];
5338 	int seq;
5339 
5340 	if (e->e_id != NULL)
5341 		return;
5342 
5343 	/* see if we need to get a new base time/pid */
5344 	if (cX >= QIC_LEN * QIC_LEN || LastQueueTime == 0 ||
5345 	    LastQueuePid != pid)
5346 	{
5347 		time_t then = LastQueueTime;
5348 
5349 		/* if the first time through, pick a random offset */
5350 		if (LastQueueTime == 0)
5351 			random_offset = get_random();
5352 
5353 		while ((LastQueueTime = curtime()) == then &&
5354 		       LastQueuePid == pid)
5355 		{
5356 			(void) sleep(1);
5357 		}
5358 		LastQueuePid = queuenextid();
5359 		cX = 0;
5360 	}
5361 
5362 	/*
5363 	**  Generate a new sequence number between 0 and QIC_LEN*QIC_LEN-1.
5364 	**  This lets us generate up to QIC_LEN*QIC_LEN unique queue ids
5365 	**  per second, per process.  With envelope splitting,
5366 	**  a single message can consume many queue ids.
5367 	*/
5368 
5369 	seq = (int)((cX + random_offset) % (QIC_LEN * QIC_LEN));
5370 	++cX;
5371 	if (tTd(7, 50))
5372 		sm_dprintf("assign_queueid: random_offset = %ld (%d)\n",
5373 			random_offset, seq);
5374 
5375 	tm = gmtime(&LastQueueTime);
5376 	idbuf[0] = QueueIdChars[tm->tm_year % QIC_LEN];
5377 	idbuf[1] = QueueIdChars[tm->tm_mon];
5378 	idbuf[2] = QueueIdChars[tm->tm_mday];
5379 	idbuf[3] = QueueIdChars[tm->tm_hour];
5380 	idbuf[4] = QueueIdChars[tm->tm_min % QIC_LEN_R];
5381 	idbuf[5] = QueueIdChars[tm->tm_sec % QIC_LEN_R];
5382 	idbuf[6] = QueueIdChars[seq / QIC_LEN];
5383 	idbuf[7] = QueueIdChars[seq % QIC_LEN];
5384 	(void) sm_snprintf(&idbuf[8], sizeof(idbuf) - 8, "%06d",
5385 			   (int) LastQueuePid);
5386 	e->e_id = sm_rpool_strdup_x(e->e_rpool, idbuf);
5387 	macdefine(&e->e_macro, A_PERM, 'i', e->e_id);
5388 #if 0
5389 	/* XXX: inherited from MainEnvelope */
5390 	e->e_qgrp = NOQGRP;  /* too early to do anything else */
5391 	e->e_qdir = NOQDIR;
5392 	e->e_xfqgrp = NOQGRP;
5393 #endif /* 0 */
5394 
5395 	/* New ID means it's not on disk yet */
5396 	e->e_qfletter = '\0';
5397 
5398 	if (tTd(7, 1))
5399 		sm_dprintf("assign_queueid: assigned id %s, e=%p\n",
5400 			e->e_id, e);
5401 	if (LogLevel > 93)
5402 		sm_syslog(LOG_DEBUG, e->e_id, "assigned id");
5403 }
5404 /*
5405 **  SYNC_QUEUE_TIME -- Assure exclusive PID in any given second
5406 **
5407 **	Make sure one PID can't be used by two processes in any one second.
5408 **
5409 **		If the system rotates PIDs fast enough, may get the
5410 **		same pid in the same second for two distinct processes.
5411 **		This will interfere with the queue file naming system.
5412 **
5413 **	Parameters:
5414 **		none
5415 **
5416 **	Returns:
5417 **		none
5418 */
5419 
5420 void
5421 sync_queue_time()
5422 {
5423 #if FAST_PID_RECYCLE
5424 	if (OpMode != MD_TEST &&
5425 	    OpMode != MD_VERIFY &&
5426 	    LastQueueTime > 0 &&
5427 	    LastQueuePid == CurrentPid &&
5428 	    curtime() == LastQueueTime)
5429 		(void) sleep(1);
5430 #endif /* FAST_PID_RECYCLE */
5431 }
5432 /*
5433 **  UNLOCKQUEUE -- unlock the queue entry for a specified envelope
5434 **
5435 **	Parameters:
5436 **		e -- the envelope to unlock.
5437 **
5438 **	Returns:
5439 **		none
5440 **
5441 **	Side Effects:
5442 **		unlocks the queue for `e'.
5443 */
5444 
5445 void
5446 unlockqueue(e)
5447 	ENVELOPE *e;
5448 {
5449 	if (tTd(51, 4))
5450 		sm_dprintf("unlockqueue(%s)\n",
5451 			e->e_id == NULL ? "NOQUEUE" : e->e_id);
5452 
5453 
5454 	/* if there is a lock file in the envelope, close it */
5455 	if (e->e_lockfp != NULL)
5456 		(void) sm_io_close(e->e_lockfp, SM_TIME_DEFAULT);
5457 	e->e_lockfp = NULL;
5458 
5459 	/* don't create a queue id if we don't already have one */
5460 	if (e->e_id == NULL)
5461 		return;
5462 
5463 	/* remove the transcript */
5464 	if (LogLevel > 87)
5465 		sm_syslog(LOG_DEBUG, e->e_id, "unlock");
5466 	if (!tTd(51, 104))
5467 		(void) xunlink(queuename(e, XSCRPT_LETTER));
5468 }
5469 /*
5470 **  SETCTLUSER -- create a controlling address
5471 **
5472 **	Create a fake "address" given only a local login name; this is
5473 **	used as a "controlling user" for future recipient addresses.
5474 **
5475 **	Parameters:
5476 **		user -- the user name of the controlling user.
5477 **		qfver -- the version stamp of this queue file.
5478 **		e -- envelope
5479 **
5480 **	Returns:
5481 **		An address descriptor for the controlling user,
5482 **		using storage allocated from e->e_rpool.
5483 **
5484 */
5485 
5486 static ADDRESS *
5487 setctluser(user, qfver, e)
5488 	char *user;
5489 	int qfver;
5490 	ENVELOPE *e;
5491 {
5492 	register ADDRESS *a;
5493 	struct passwd *pw;
5494 	char *p;
5495 
5496 	/*
5497 	**  See if this clears our concept of controlling user.
5498 	*/
5499 
5500 	if (user == NULL || *user == '\0')
5501 		return NULL;
5502 
5503 	/*
5504 	**  Set up addr fields for controlling user.
5505 	*/
5506 
5507 	a = (ADDRESS *) sm_rpool_malloc_x(e->e_rpool, sizeof(*a));
5508 	memset((char *) a, '\0', sizeof(*a));
5509 
5510 	if (*user == ':')
5511 	{
5512 		p = &user[1];
5513 		a->q_user = sm_rpool_strdup_x(e->e_rpool, p);
5514 	}
5515 	else
5516 	{
5517 		p = strtok(user, ":");
5518 		a->q_user = sm_rpool_strdup_x(e->e_rpool, user);
5519 		if (qfver >= 2)
5520 		{
5521 			if ((p = strtok(NULL, ":")) != NULL)
5522 				a->q_uid = atoi(p);
5523 			if ((p = strtok(NULL, ":")) != NULL)
5524 				a->q_gid = atoi(p);
5525 			if ((p = strtok(NULL, ":")) != NULL)
5526 			{
5527 				char *o;
5528 
5529 				a->q_flags |= QGOODUID;
5530 
5531 				/* if there is another ':': restore it */
5532 				if ((o = strtok(NULL, ":")) != NULL && o > p)
5533 					o[-1] = ':';
5534 			}
5535 		}
5536 		else if ((pw = sm_getpwnam(user)) != NULL)
5537 		{
5538 			if (*pw->pw_dir == '\0')
5539 				a->q_home = NULL;
5540 			else if (strcmp(pw->pw_dir, "/") == 0)
5541 				a->q_home = "";
5542 			else
5543 				a->q_home = sm_rpool_strdup_x(e->e_rpool, pw->pw_dir);
5544 			a->q_uid = pw->pw_uid;
5545 			a->q_gid = pw->pw_gid;
5546 			a->q_flags |= QGOODUID;
5547 		}
5548 	}
5549 
5550 	a->q_flags |= QPRIMARY;		/* flag as a "ctladdr" */
5551 	a->q_mailer = LocalMailer;
5552 	if (p == NULL)
5553 		a->q_paddr = sm_rpool_strdup_x(e->e_rpool, a->q_user);
5554 	else
5555 		a->q_paddr = sm_rpool_strdup_x(e->e_rpool, p);
5556 	return a;
5557 }
5558 /*
5559 **  LOSEQFILE -- rename queue file with LOSEQF_LETTER & try to let someone know
5560 **
5561 **	Parameters:
5562 **		e -- the envelope (e->e_id will be used).
5563 **		why -- reported to whomever can hear.
5564 **
5565 **	Returns:
5566 **		none.
5567 */
5568 
5569 void
5570 loseqfile(e, why)
5571 	register ENVELOPE *e;
5572 	char *why;
5573 {
5574 	bool loseit = true;
5575 	char *p;
5576 	char buf[MAXPATHLEN];
5577 
5578 	if (e == NULL || e->e_id == NULL)
5579 		return;
5580 	p = queuename(e, ANYQFL_LETTER);
5581 	if (sm_strlcpy(buf, p, sizeof(buf)) >= sizeof(buf))
5582 		return;
5583 	if (!bitset(EF_INQUEUE, e->e_flags))
5584 		queueup(e, false, true);
5585 	else if (QueueMode == QM_LOST)
5586 		loseit = false;
5587 
5588 	/* if already lost, no need to re-lose */
5589 	if (loseit)
5590 	{
5591 		p = queuename(e, LOSEQF_LETTER);
5592 		if (rename(buf, p) < 0)
5593 			syserr("cannot rename(%s, %s), uid=%d",
5594 			       buf, p, (int) geteuid());
5595 		else if (LogLevel > 0)
5596 			sm_syslog(LOG_ALERT, e->e_id,
5597 				  "Losing %s: %s", buf, why);
5598 	}
5599 	if (e->e_dfp != NULL)
5600 	{
5601 		(void) sm_io_close(e->e_dfp, SM_TIME_DEFAULT);
5602 		e->e_dfp = NULL;
5603 	}
5604 	e->e_flags &= ~EF_HAS_DF;
5605 }
5606 /*
5607 **  NAME2QID -- translate a queue group name to a queue group id
5608 **
5609 **	Parameters:
5610 **		queuename -- name of queue group.
5611 **
5612 **	Returns:
5613 **		queue group id if found.
5614 **		NOQGRP otherwise.
5615 */
5616 
5617 int
5618 name2qid(queuename)
5619 	char *queuename;
5620 {
5621 	register STAB *s;
5622 
5623 	s = stab(queuename, ST_QUEUE, ST_FIND);
5624 	if (s == NULL)
5625 		return NOQGRP;
5626 	return s->s_quegrp->qg_index;
5627 }
5628 /*
5629 **  QID_PRINTNAME -- create externally printable version of queue id
5630 **
5631 **	Parameters:
5632 **		e -- the envelope.
5633 **
5634 **	Returns:
5635 **		a printable version
5636 */
5637 
5638 char *
5639 qid_printname(e)
5640 	ENVELOPE *e;
5641 {
5642 	char *id;
5643 	static char idbuf[MAXQFNAME + 34];
5644 
5645 	if (e == NULL)
5646 		return "";
5647 
5648 	if (e->e_id == NULL)
5649 		id = "";
5650 	else
5651 		id = e->e_id;
5652 
5653 	if (e->e_qdir == NOQDIR)
5654 		return id;
5655 
5656 	(void) sm_snprintf(idbuf, sizeof(idbuf), "%.32s/%s",
5657 			   Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_name,
5658 			   id);
5659 	return idbuf;
5660 }
5661 /*
5662 **  QID_PRINTQUEUE -- create full version of queue directory for data files
5663 **
5664 **	Parameters:
5665 **		qgrp -- index in queue group.
5666 **		qdir -- the short version of the queue directory
5667 **
5668 **	Returns:
5669 **		the full pathname to the queue (might point to a static var)
5670 */
5671 
5672 char *
5673 qid_printqueue(qgrp, qdir)
5674 	int qgrp;
5675 	int qdir;
5676 {
5677 	char *subdir;
5678 	static char dir[MAXPATHLEN];
5679 
5680 	if (qdir == NOQDIR)
5681 		return Queue[qgrp]->qg_qdir;
5682 
5683 	if (strcmp(Queue[qgrp]->qg_qpaths[qdir].qp_name, ".") == 0)
5684 		subdir = NULL;
5685 	else
5686 		subdir = Queue[qgrp]->qg_qpaths[qdir].qp_name;
5687 
5688 	(void) sm_strlcpyn(dir, sizeof(dir), 4,
5689 			Queue[qgrp]->qg_qdir,
5690 			subdir == NULL ? "" : "/",
5691 			subdir == NULL ? "" : subdir,
5692 			(bitset(QP_SUBDF,
5693 				Queue[qgrp]->qg_qpaths[qdir].qp_subdirs)
5694 					? "/df" : ""));
5695 	return dir;
5696 }
5697 
5698 /*
5699 **  PICKQDIR -- Pick a queue directory from a queue group
5700 **
5701 **	Parameters:
5702 **		qg -- queue group
5703 **		fsize -- file size in bytes
5704 **		e -- envelope, or NULL
5705 **
5706 **	Result:
5707 **		NOQDIR if no queue directory in qg has enough free space to
5708 **		hold a file of size 'fsize', otherwise the index of
5709 **		a randomly selected queue directory which resides on a
5710 **		file system with enough disk space.
5711 **		XXX This could be extended to select a queuedir with
5712 **			a few (the fewest?) number of entries. That data
5713 **			is available if shared memory is used.
5714 **
5715 **	Side Effects:
5716 **		If the request fails and e != NULL then sm_syslog is called.
5717 */
5718 
5719 int
5720 pickqdir(qg, fsize, e)
5721 	QUEUEGRP *qg;
5722 	long fsize;
5723 	ENVELOPE *e;
5724 {
5725 	int qdir;
5726 	int i;
5727 	long avail = 0;
5728 
5729 	/* Pick a random directory, as a starting point. */
5730 	if (qg->qg_numqueues <= 1)
5731 		qdir = 0;
5732 	else
5733 		qdir = get_rand_mod(qg->qg_numqueues);
5734 
5735 	if (MinBlocksFree <= 0 && fsize <= 0)
5736 		return qdir;
5737 
5738 	/*
5739 	**  Now iterate over the queue directories,
5740 	**  looking for a directory with enough space for this message.
5741 	*/
5742 
5743 	i = qdir;
5744 	do
5745 	{
5746 		QPATHS *qp = &qg->qg_qpaths[i];
5747 		long needed = 0;
5748 		long fsavail = 0;
5749 
5750 		if (fsize > 0)
5751 			needed += fsize / FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5752 				  + ((fsize % FILE_SYS_BLKSIZE(qp->qp_fsysidx)
5753 				      > 0) ? 1 : 0);
5754 		if (MinBlocksFree > 0)
5755 			needed += MinBlocksFree;
5756 		fsavail = FILE_SYS_AVAIL(qp->qp_fsysidx);
5757 #if SM_CONF_SHM
5758 		if (fsavail <= 0)
5759 		{
5760 			long blksize;
5761 
5762 			/*
5763 			**  might be not correctly updated,
5764 			**  let's try to get the info directly.
5765 			*/
5766 
5767 			fsavail = freediskspace(FILE_SYS_NAME(qp->qp_fsysidx),
5768 						&blksize);
5769 			if (fsavail < 0)
5770 				fsavail = 0;
5771 		}
5772 #endif /* SM_CONF_SHM */
5773 		if (needed <= fsavail)
5774 			return i;
5775 		if (avail < fsavail)
5776 			avail = fsavail;
5777 
5778 		if (qg->qg_numqueues > 0)
5779 			i = (i + 1) % qg->qg_numqueues;
5780 	} while (i != qdir);
5781 
5782 	if (e != NULL && LogLevel > 0)
5783 		sm_syslog(LOG_ALERT, e->e_id,
5784 			"low on space (%s needs %ld bytes + %ld blocks in %s), max avail: %ld",
5785 			CurHostName == NULL ? "SMTP-DAEMON" : CurHostName,
5786 			fsize, MinBlocksFree,
5787 			qg->qg_qdir, avail);
5788 	return NOQDIR;
5789 }
5790 /*
5791 **  SETNEWQUEUE -- Sets a new queue group and directory
5792 **
5793 **	Assign a queue group and directory to an envelope and store the
5794 **	directory in e->e_qdir.
5795 **
5796 **	Parameters:
5797 **		e -- envelope to assign a queue for.
5798 **
5799 **	Returns:
5800 **		true if successful
5801 **		false otherwise
5802 **
5803 **	Side Effects:
5804 **		On success, e->e_qgrp and e->e_qdir are non-negative.
5805 **		On failure (not enough disk space),
5806 **		e->qgrp = NOQGRP, e->e_qdir = NOQDIR
5807 **		and usrerr() is invoked (which could raise an exception).
5808 */
5809 
5810 bool
5811 setnewqueue(e)
5812 	ENVELOPE *e;
5813 {
5814 	if (tTd(41, 20))
5815 		sm_dprintf("setnewqueue: called\n");
5816 
5817 	/* not set somewhere else */
5818 	if (e->e_qgrp == NOQGRP)
5819 	{
5820 		ADDRESS *q;
5821 
5822 		/*
5823 		**  Use the queue group of the "first" recipient, as set by
5824 		**  the "queuegroup" rule set.  If that is not defined, then
5825 		**  use the queue group of the mailer of the first recipient.
5826 		**  If that is not defined either, then use the default
5827 		**  queue group.
5828 		**  Notice: "first" depends on the sorting of sendqueue
5829 		**  in recipient().
5830 		**  To avoid problems with "bad" recipients look
5831 		**  for a valid address first.
5832 		*/
5833 
5834 		q = e->e_sendqueue;
5835 		while (q != NULL &&
5836 		       (QS_IS_BADADDR(q->q_state) || QS_IS_DEAD(q->q_state)))
5837 		{
5838 			q = q->q_next;
5839 		}
5840 		if (q == NULL)
5841 			e->e_qgrp = 0;
5842 		else if (q->q_qgrp >= 0)
5843 			e->e_qgrp = q->q_qgrp;
5844 		else if (q->q_mailer != NULL &&
5845 			 ISVALIDQGRP(q->q_mailer->m_qgrp))
5846 			e->e_qgrp = q->q_mailer->m_qgrp;
5847 		else
5848 			e->e_qgrp = 0;
5849 		e->e_dfqgrp = e->e_qgrp;
5850 	}
5851 
5852 	if (ISVALIDQDIR(e->e_qdir) && ISVALIDQDIR(e->e_dfqdir))
5853 	{
5854 		if (tTd(41, 20))
5855 			sm_dprintf("setnewqueue: e_qdir already assigned (%s)\n",
5856 				qid_printqueue(e->e_qgrp, e->e_qdir));
5857 		return true;
5858 	}
5859 
5860 	filesys_update();
5861 	e->e_qdir = pickqdir(Queue[e->e_qgrp], e->e_msgsize, e);
5862 	if (e->e_qdir == NOQDIR)
5863 	{
5864 		e->e_qgrp = NOQGRP;
5865 		if (!bitset(EF_FATALERRS, e->e_flags))
5866 			usrerr("452 4.4.5 Insufficient disk space; try again later");
5867 		e->e_flags |= EF_FATALERRS;
5868 		return false;
5869 	}
5870 
5871 	if (tTd(41, 3))
5872 		sm_dprintf("setnewqueue: Assigned queue directory %s\n",
5873 			qid_printqueue(e->e_qgrp, e->e_qdir));
5874 
5875 	if (e->e_xfqgrp == NOQGRP || e->e_xfqdir == NOQDIR)
5876 	{
5877 		e->e_xfqgrp = e->e_qgrp;
5878 		e->e_xfqdir = e->e_qdir;
5879 	}
5880 	e->e_dfqdir = e->e_qdir;
5881 	return true;
5882 }
5883 /*
5884 **  CHKQDIR -- check a queue directory
5885 **
5886 **	Parameters:
5887 **		name -- name of queue directory
5888 **		sff -- flags for safefile()
5889 **
5890 **	Returns:
5891 **		is it a queue directory?
5892 */
5893 
5894 static bool chkqdir __P((char *, long));
5895 
5896 static bool
5897 chkqdir(name, sff)
5898 	char *name;
5899 	long sff;
5900 {
5901 	struct stat statb;
5902 	int i;
5903 
5904 	/* skip over . and .. directories */
5905 	if (name[0] == '.' &&
5906 	    (name[1] == '\0' || (name[1] == '.' && name[2] == '\0')))
5907 		return false;
5908 #if HASLSTAT
5909 	if (lstat(name, &statb) < 0)
5910 #else /* HASLSTAT */
5911 	if (stat(name, &statb) < 0)
5912 #endif /* HASLSTAT */
5913 	{
5914 		if (tTd(41, 2))
5915 			sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5916 				   name, sm_errstring(errno));
5917 		return false;
5918 	}
5919 #if HASLSTAT
5920 	if (S_ISLNK(statb.st_mode))
5921 	{
5922 		/*
5923 		**  For a symlink we need to make sure the
5924 		**  target is a directory
5925 		*/
5926 
5927 		if (stat(name, &statb) < 0)
5928 		{
5929 			if (tTd(41, 2))
5930 				sm_dprintf("chkqdir: stat(\"%s\"): %s\n",
5931 					   name, sm_errstring(errno));
5932 			return false;
5933 		}
5934 	}
5935 #endif /* HASLSTAT */
5936 
5937 	if (!S_ISDIR(statb.st_mode))
5938 	{
5939 		if (tTd(41, 2))
5940 			sm_dprintf("chkqdir: \"%s\": Not a directory\n",
5941 				name);
5942 		return false;
5943 	}
5944 
5945 	/* Print a warning if unsafe (but still use it) */
5946 	/* XXX do this only if we want the warning? */
5947 	i = safedirpath(name, RunAsUid, RunAsGid, NULL, sff, 0, 0);
5948 	if (i != 0)
5949 	{
5950 		if (tTd(41, 2))
5951 			sm_dprintf("chkqdir: \"%s\": Not safe: %s\n",
5952 				   name, sm_errstring(i));
5953 #if _FFR_CHK_QUEUE
5954 		if (LogLevel > 8)
5955 			sm_syslog(LOG_WARNING, NOQID,
5956 				  "queue directory \"%s\": Not safe: %s",
5957 				  name, sm_errstring(i));
5958 #endif /* _FFR_CHK_QUEUE */
5959 	}
5960 	return true;
5961 }
5962 /*
5963 **  MULTIQUEUE_CACHE -- cache a list of paths to queues.
5964 **
5965 **	Each potential queue is checked as the cache is built.
5966 **	Thereafter, each is blindly trusted.
5967 **	Note that we can be called again after a timeout to rebuild
5968 **	(although code for that is not ready yet).
5969 **
5970 **	Parameters:
5971 **		basedir -- base of all queue directories.
5972 **		blen -- strlen(basedir).
5973 **		qg -- queue group.
5974 **		qn -- number of queue directories already cached.
5975 **		phash -- pointer to hash value over queue dirs.
5976 #if SM_CONF_SHM
5977 **			only used if shared memory is active.
5978 #endif * SM_CONF_SHM *
5979 **
5980 **	Returns:
5981 **		new number of queue directories.
5982 */
5983 
5984 #define INITIAL_SLOTS	20
5985 #define ADD_SLOTS	10
5986 
5987 static int
5988 multiqueue_cache(basedir, blen, qg, qn, phash)
5989 	char *basedir;
5990 	int blen;
5991 	QUEUEGRP *qg;
5992 	int qn;
5993 	unsigned int *phash;
5994 {
5995 	char *cp;
5996 	int i, len;
5997 	int slotsleft = 0;
5998 	long sff = SFF_ANYFILE;
5999 	char qpath[MAXPATHLEN];
6000 	char subdir[MAXPATHLEN];
6001 	char prefix[MAXPATHLEN];	/* dir relative to basedir */
6002 
6003 	if (tTd(41, 20))
6004 		sm_dprintf("multiqueue_cache: called\n");
6005 
6006 	/* Initialize to current directory */
6007 	prefix[0] = '.';
6008 	prefix[1] = '\0';
6009 	if (qg->qg_numqueues != 0 && qg->qg_qpaths != NULL)
6010 	{
6011 		for (i = 0; i < qg->qg_numqueues; i++)
6012 		{
6013 			if (qg->qg_qpaths[i].qp_name != NULL)
6014 				(void) sm_free(qg->qg_qpaths[i].qp_name); /* XXX */
6015 		}
6016 		(void) sm_free((char *) qg->qg_qpaths); /* XXX */
6017 		qg->qg_qpaths = NULL;
6018 		qg->qg_numqueues = 0;
6019 	}
6020 
6021 	/* If running as root, allow safedirpath() checks to use privs */
6022 	if (RunAsUid == 0)
6023 		sff |= SFF_ROOTOK;
6024 #if _FFR_CHK_QUEUE
6025 	sff |= SFF_SAFEDIRPATH|SFF_NOWWFILES;
6026 	if (!UseMSP)
6027 		sff |= SFF_NOGWFILES;
6028 #endif /* _FFR_CHK_QUEUE */
6029 
6030 	if (!SM_IS_DIR_START(qg->qg_qdir))
6031 	{
6032 		/*
6033 		**  XXX we could add basedir, but then we have to realloc()
6034 		**  the string... Maybe another time.
6035 		*/
6036 
6037 		syserr("QueuePath %s not absolute", qg->qg_qdir);
6038 		ExitStat = EX_CONFIG;
6039 		return qn;
6040 	}
6041 
6042 	/* qpath: directory of current workgroup */
6043 	len = sm_strlcpy(qpath, qg->qg_qdir, sizeof(qpath));
6044 	if (len >= sizeof(qpath))
6045 	{
6046 		syserr("QueuePath %.256s too long (%d max)",
6047 		       qg->qg_qdir, (int) sizeof(qpath));
6048 		ExitStat = EX_CONFIG;
6049 		return qn;
6050 	}
6051 
6052 	/* begin of qpath must be same as basedir */
6053 	if (strncmp(basedir, qpath, blen) != 0 &&
6054 	    (strncmp(basedir, qpath, blen - 1) != 0 || len != blen - 1))
6055 	{
6056 		syserr("QueuePath %s not subpath of QueueDirectory %s",
6057 			qpath, basedir);
6058 		ExitStat = EX_CONFIG;
6059 		return qn;
6060 	}
6061 
6062 	/* Do we have a nested subdirectory? */
6063 	if (blen < len && SM_FIRST_DIR_DELIM(qg->qg_qdir + blen) != NULL)
6064 	{
6065 
6066 		/* Copy subdirectory into prefix for later use */
6067 		if (sm_strlcpy(prefix, qg->qg_qdir + blen, sizeof(prefix)) >=
6068 		    sizeof(prefix))
6069 		{
6070 			syserr("QueuePath %.256s too long (%d max)",
6071 				qg->qg_qdir, (int) sizeof(qpath));
6072 			ExitStat = EX_CONFIG;
6073 			return qn;
6074 		}
6075 		cp = SM_LAST_DIR_DELIM(prefix);
6076 		SM_ASSERT(cp != NULL);
6077 		*cp = '\0';	/* cut off trailing / */
6078 	}
6079 
6080 	/* This is guaranteed by the basedir check above */
6081 	SM_ASSERT(len >= blen - 1);
6082 	cp = &qpath[len - 1];
6083 	if (*cp == '*')
6084 	{
6085 		register DIR *dp;
6086 		register struct dirent *d;
6087 		int off;
6088 		char *delim;
6089 		char relpath[MAXPATHLEN];
6090 
6091 		*cp = '\0';	/* Overwrite wildcard */
6092 		if ((cp = SM_LAST_DIR_DELIM(qpath)) == NULL)
6093 		{
6094 			syserr("QueueDirectory: can not wildcard relative path");
6095 			if (tTd(41, 2))
6096 				sm_dprintf("multiqueue_cache: \"%s*\": Can not wildcard relative path.\n",
6097 					qpath);
6098 			ExitStat = EX_CONFIG;
6099 			return qn;
6100 		}
6101 		if (cp == qpath)
6102 		{
6103 			/*
6104 			**  Special case of top level wildcard, like /foo*
6105 			**	Change to //foo*
6106 			*/
6107 
6108 			(void) sm_strlcpy(qpath + 1, qpath, sizeof(qpath) - 1);
6109 			++cp;
6110 		}
6111 		delim = cp;
6112 		*(cp++) = '\0';		/* Replace / with \0 */
6113 		len = strlen(cp);	/* Last component of queue directory */
6114 
6115 		/*
6116 		**  Path relative to basedir, with trailing /
6117 		**  It will be modified below to specify the subdirectories
6118 		**  so they can be opened without chdir().
6119 		*/
6120 
6121 		off = sm_strlcpyn(relpath, sizeof(relpath), 2, prefix, "/");
6122 		SM_ASSERT(off < sizeof(relpath));
6123 
6124 		if (tTd(41, 2))
6125 			sm_dprintf("multiqueue_cache: prefix=\"%s%s\"\n",
6126 				   relpath, cp);
6127 
6128 		/* It is always basedir: we don't need to store it per group */
6129 		/* XXX: optimize this! -> one more global? */
6130 		qg->qg_qdir = newstr(basedir);
6131 		qg->qg_qdir[blen - 1] = '\0';	/* cut off trailing / */
6132 
6133 		/*
6134 		**  XXX Should probably wrap this whole loop in a timeout
6135 		**  in case some wag decides to NFS mount the queues.
6136 		*/
6137 
6138 		/* Test path to get warning messages. */
6139 		if (qn == 0)
6140 		{
6141 			/*  XXX qg_runasuid and qg_runasgid for specials? */
6142 			i = safedirpath(basedir, RunAsUid, RunAsGid, NULL,
6143 					sff, 0, 0);
6144 			if (i != 0 && tTd(41, 2))
6145 				sm_dprintf("multiqueue_cache: \"%s\": Not safe: %s\n",
6146 					   basedir, sm_errstring(i));
6147 		}
6148 
6149 		if ((dp = opendir(prefix)) == NULL)
6150 		{
6151 			syserr("can not opendir(%s/%s)", qg->qg_qdir, prefix);
6152 			if (tTd(41, 2))
6153 				sm_dprintf("multiqueue_cache: opendir(\"%s/%s\"): %s\n",
6154 					   qg->qg_qdir, prefix,
6155 					   sm_errstring(errno));
6156 			ExitStat = EX_CONFIG;
6157 			return qn;
6158 		}
6159 		while ((d = readdir(dp)) != NULL)
6160 		{
6161 			/* Skip . and .. directories */
6162 			if (strcmp(d->d_name, ".") == 0 ||
6163 			    strcmp(d->d_name, "..") == 0)
6164 				continue;
6165 
6166 			i = strlen(d->d_name);
6167 			if (i < len || strncmp(d->d_name, cp, len) != 0)
6168 			{
6169 				if (tTd(41, 5))
6170 					sm_dprintf("multiqueue_cache: \"%s\", skipped\n",
6171 						d->d_name);
6172 				continue;
6173 			}
6174 
6175 			/* Create relative pathname: prefix + local directory */
6176 			i = sizeof(relpath) - off;
6177 			if (sm_strlcpy(relpath + off, d->d_name, i) >= i)
6178 				continue;	/* way too long */
6179 
6180 			if (!chkqdir(relpath, sff))
6181 				continue;
6182 
6183 			if (qg->qg_qpaths == NULL)
6184 			{
6185 				slotsleft = INITIAL_SLOTS;
6186 				qg->qg_qpaths = (QPATHS *)xalloc((sizeof(*qg->qg_qpaths)) *
6187 								slotsleft);
6188 				qg->qg_numqueues = 0;
6189 			}
6190 			else if (slotsleft < 1)
6191 			{
6192 				qg->qg_qpaths = (QPATHS *)sm_realloc((char *)qg->qg_qpaths,
6193 							  (sizeof(*qg->qg_qpaths)) *
6194 							  (qg->qg_numqueues +
6195 							   ADD_SLOTS));
6196 				if (qg->qg_qpaths == NULL)
6197 				{
6198 					(void) closedir(dp);
6199 					return qn;
6200 				}
6201 				slotsleft += ADD_SLOTS;
6202 			}
6203 
6204 			/* check subdirs */
6205 			qg->qg_qpaths[qg->qg_numqueues].qp_subdirs = QP_NOSUB;
6206 
6207 #define CHKRSUBDIR(name, flag)	\
6208 	(void) sm_strlcpyn(subdir, sizeof(subdir), 3, relpath, "/", name); \
6209 	if (chkqdir(subdir, sff))	\
6210 		qg->qg_qpaths[qg->qg_numqueues].qp_subdirs |= flag;	\
6211 	else
6212 
6213 
6214 			CHKRSUBDIR("qf", QP_SUBQF);
6215 			CHKRSUBDIR("df", QP_SUBDF);
6216 			CHKRSUBDIR("xf", QP_SUBXF);
6217 
6218 			/* assert(strlen(d->d_name) < MAXPATHLEN - 14) */
6219 			/* maybe even - 17 (subdirs) */
6220 
6221 			if (prefix[0] != '.')
6222 				qg->qg_qpaths[qg->qg_numqueues].qp_name =
6223 					newstr(relpath);
6224 			else
6225 				qg->qg_qpaths[qg->qg_numqueues].qp_name =
6226 					newstr(d->d_name);
6227 
6228 			if (tTd(41, 2))
6229 				sm_dprintf("multiqueue_cache: %d: \"%s\" cached (%x).\n",
6230 					qg->qg_numqueues, relpath,
6231 					qg->qg_qpaths[qg->qg_numqueues].qp_subdirs);
6232 #if SM_CONF_SHM
6233 			qg->qg_qpaths[qg->qg_numqueues].qp_idx = qn;
6234 			*phash = hash_q(relpath, *phash);
6235 #endif /* SM_CONF_SHM */
6236 			qg->qg_numqueues++;
6237 			++qn;
6238 			slotsleft--;
6239 		}
6240 		(void) closedir(dp);
6241 
6242 		/* undo damage */
6243 		*delim = '/';
6244 	}
6245 	if (qg->qg_numqueues == 0)
6246 	{
6247 		qg->qg_qpaths = (QPATHS *) xalloc(sizeof(*qg->qg_qpaths));
6248 
6249 		/* test path to get warning messages */
6250 		i = safedirpath(qpath, RunAsUid, RunAsGid, NULL, sff, 0, 0);
6251 		if (i == ENOENT)
6252 		{
6253 			syserr("can not opendir(%s)", qpath);
6254 			if (tTd(41, 2))
6255 				sm_dprintf("multiqueue_cache: opendir(\"%s\"): %s\n",
6256 					   qpath, sm_errstring(i));
6257 			ExitStat = EX_CONFIG;
6258 			return qn;
6259 		}
6260 
6261 		qg->qg_qpaths[0].qp_subdirs = QP_NOSUB;
6262 		qg->qg_numqueues = 1;
6263 
6264 		/* check subdirs */
6265 #define CHKSUBDIR(name, flag)	\
6266 	(void) sm_strlcpyn(subdir, sizeof(subdir), 3, qg->qg_qdir, "/", name); \
6267 	if (chkqdir(subdir, sff))	\
6268 		qg->qg_qpaths[0].qp_subdirs |= flag;	\
6269 	else
6270 
6271 		CHKSUBDIR("qf", QP_SUBQF);
6272 		CHKSUBDIR("df", QP_SUBDF);
6273 		CHKSUBDIR("xf", QP_SUBXF);
6274 
6275 		if (qg->qg_qdir[blen - 1] != '\0' &&
6276 		    qg->qg_qdir[blen] != '\0')
6277 		{
6278 			/*
6279 			**  Copy the last component into qpaths and
6280 			**  cut off qdir
6281 			*/
6282 
6283 			qg->qg_qpaths[0].qp_name = newstr(qg->qg_qdir + blen);
6284 			qg->qg_qdir[blen - 1] = '\0';
6285 		}
6286 		else
6287 			qg->qg_qpaths[0].qp_name = newstr(".");
6288 
6289 #if SM_CONF_SHM
6290 		qg->qg_qpaths[0].qp_idx = qn;
6291 		*phash = hash_q(qg->qg_qpaths[0].qp_name, *phash);
6292 #endif /* SM_CONF_SHM */
6293 		++qn;
6294 	}
6295 	return qn;
6296 }
6297 
6298 /*
6299 **  FILESYS_FIND -- find entry in FileSys table, or add new one
6300 **
6301 **	Given the pathname of a directory, determine the file system
6302 **	in which that directory resides, and return a pointer to the
6303 **	entry in the FileSys table that describes the file system.
6304 **	A new entry is added if necessary (and requested).
6305 **	If the directory does not exist, -1 is returned.
6306 **
6307 **	Parameters:
6308 **		name -- name of directory (must be persistent!)
6309 **		path -- pathname of directory (name plus maybe "/df")
6310 **		add -- add to structure if not found.
6311 **
6312 **	Returns:
6313 **		>=0: found: index in file system table
6314 **		<0: some error, i.e.,
6315 **		FSF_TOO_MANY: too many filesystems (-> syserr())
6316 **		FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6317 **		FSF_NOT_FOUND: not in list
6318 */
6319 
6320 static short filesys_find __P((const char *, const char *, bool));
6321 
6322 #define FSF_NOT_FOUND	(-1)
6323 #define FSF_STAT_FAIL	(-2)
6324 #define FSF_TOO_MANY	(-3)
6325 
6326 static short
6327 filesys_find(name, path, add)
6328 	const char *name;
6329 	const char *path;
6330 	bool add;
6331 {
6332 	struct stat st;
6333 	short i;
6334 
6335 	if (stat(path, &st) < 0)
6336 	{
6337 		syserr("cannot stat queue directory %s", path);
6338 		return FSF_STAT_FAIL;
6339 	}
6340 	for (i = 0; i < NumFileSys; ++i)
6341 	{
6342 		if (FILE_SYS_DEV(i) == st.st_dev)
6343 		{
6344 			/*
6345 			**  Make sure the file system (FS) name is set:
6346 			**  even though the source code indicates that
6347 			**  FILE_SYS_DEV() is only set below, it could be
6348 			**  set via shared memory, hence we need to perform
6349 			**  this check/assignment here.
6350 			*/
6351 
6352 			if (NULL == FILE_SYS_NAME(i))
6353 				FILE_SYS_NAME(i) = name;
6354 			return i;
6355 		}
6356 	}
6357 	if (i >= MAXFILESYS)
6358 	{
6359 		syserr("too many queue file systems (%d max)", MAXFILESYS);
6360 		return FSF_TOO_MANY;
6361 	}
6362 	if (!add)
6363 		return FSF_NOT_FOUND;
6364 
6365 	++NumFileSys;
6366 	FILE_SYS_NAME(i) = name;
6367 	FILE_SYS_DEV(i) = st.st_dev;
6368 	FILE_SYS_AVAIL(i) = 0;
6369 	FILE_SYS_BLKSIZE(i) = 1024; /* avoid divide by zero */
6370 	return i;
6371 }
6372 
6373 /*
6374 **  FILESYS_SETUP -- set up mapping from queue directories to file systems
6375 **
6376 **	This data structure is used to efficiently check the amount of
6377 **	free space available in a set of queue directories.
6378 **
6379 **	Parameters:
6380 **		add -- initialize structure if necessary.
6381 **
6382 **	Returns:
6383 **		0: success
6384 **		<0: some error, i.e.,
6385 **		FSF_NOT_FOUND: not in list
6386 **		FSF_STAT_FAIL: can't stat() filesystem (-> syserr())
6387 **		FSF_TOO_MANY: too many filesystems (-> syserr())
6388 */
6389 
6390 static int filesys_setup __P((bool));
6391 
6392 static int
6393 filesys_setup(add)
6394 	bool add;
6395 {
6396 	int i, j;
6397 	short fs;
6398 	int ret;
6399 
6400 	ret = 0;
6401 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
6402 	{
6403 		for (j = 0; j < Queue[i]->qg_numqueues; ++j)
6404 		{
6405 			QPATHS *qp = &Queue[i]->qg_qpaths[j];
6406 			char qddf[MAXPATHLEN];
6407 
6408 			(void) sm_strlcpyn(qddf, sizeof(qddf), 2, qp->qp_name,
6409 					(bitset(QP_SUBDF, qp->qp_subdirs)
6410 						? "/df" : ""));
6411 			fs = filesys_find(qp->qp_name, qddf, add);
6412 			if (fs >= 0)
6413 				qp->qp_fsysidx = fs;
6414 			else
6415 				qp->qp_fsysidx = 0;
6416 			if (fs < ret)
6417 				ret = fs;
6418 		}
6419 	}
6420 	return ret;
6421 }
6422 
6423 /*
6424 **  FILESYS_UPDATE -- update amount of free space on all file systems
6425 **
6426 **	The FileSys table is used to cache the amount of free space
6427 **	available on all queue directory file systems.
6428 **	This function updates the cached information if it has expired.
6429 **
6430 **	Parameters:
6431 **		none.
6432 **
6433 **	Returns:
6434 **		none.
6435 **
6436 **	Side Effects:
6437 **		Updates FileSys table.
6438 */
6439 
6440 void
6441 filesys_update()
6442 {
6443 	int i;
6444 	long avail, blksize;
6445 	time_t now;
6446 	static time_t nextupdate = 0;
6447 
6448 #if SM_CONF_SHM
6449 	/*
6450 	**  Only the daemon updates the shared memory, i.e.,
6451 	**  if shared memory is available but the pid is not the
6452 	**  one of the daemon, then don't do anything.
6453 	*/
6454 
6455 	if (ShmId != SM_SHM_NO_ID && DaemonPid != CurrentPid)
6456 		return;
6457 #endif /* SM_CONF_SHM */
6458 	now = curtime();
6459 	if (now < nextupdate)
6460 		return;
6461 	nextupdate = now + FILESYS_UPDATE_INTERVAL;
6462 	for (i = 0; i < NumFileSys; ++i)
6463 	{
6464 		FILESYS *fs = &FILE_SYS(i);
6465 
6466 		avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6467 		if (avail < 0 || blksize <= 0)
6468 		{
6469 			if (LogLevel > 5)
6470 				sm_syslog(LOG_ERR, NOQID,
6471 					"filesys_update failed: %s, fs=%s, avail=%ld, blocksize=%ld",
6472 					sm_errstring(errno),
6473 					FILE_SYS_NAME(i), avail, blksize);
6474 			fs->fs_avail = 0;
6475 			fs->fs_blksize = 1024; /* avoid divide by zero */
6476 			nextupdate = now + 2; /* let's do this soon again */
6477 		}
6478 		else
6479 		{
6480 			fs->fs_avail = avail;
6481 			fs->fs_blksize = blksize;
6482 		}
6483 	}
6484 }
6485 
6486 #if _FFR_ANY_FREE_FS
6487 /*
6488 **  FILESYS_FREE -- check whether there is at least one fs with enough space.
6489 **
6490 **	Parameters:
6491 **		fsize -- file size in bytes
6492 **
6493 **	Returns:
6494 **		true iff there is one fs with more than fsize bytes free.
6495 */
6496 
6497 bool
6498 filesys_free(fsize)
6499 	long fsize;
6500 {
6501 	int i;
6502 
6503 	if (fsize <= 0)
6504 		return true;
6505 	for (i = 0; i < NumFileSys; ++i)
6506 	{
6507 		long needed = 0;
6508 
6509 		if (FILE_SYS_AVAIL(i) < 0 || FILE_SYS_BLKSIZE(i) <= 0)
6510 			continue;
6511 		needed += fsize / FILE_SYS_BLKSIZE(i)
6512 			  + ((fsize % FILE_SYS_BLKSIZE(i)
6513 			      > 0) ? 1 : 0)
6514 			  + MinBlocksFree;
6515 		if (needed <= FILE_SYS_AVAIL(i))
6516 			return true;
6517 	}
6518 	return false;
6519 }
6520 #endif /* _FFR_ANY_FREE_FS */
6521 
6522 /*
6523 **  DISK_STATUS -- show amount of free space in queue directories
6524 **
6525 **	Parameters:
6526 **		out -- output file pointer.
6527 **		prefix -- string to output in front of each line.
6528 **
6529 **	Returns:
6530 **		none.
6531 */
6532 
6533 void
6534 disk_status(out, prefix)
6535 	SM_FILE_T *out;
6536 	char *prefix;
6537 {
6538 	int i;
6539 	long avail, blksize;
6540 	long free;
6541 
6542 	for (i = 0; i < NumFileSys; ++i)
6543 	{
6544 		avail = freediskspace(FILE_SYS_NAME(i), &blksize);
6545 		if (avail >= 0 && blksize > 0)
6546 		{
6547 			free = (long)((double) avail *
6548 				((double) blksize / 1024));
6549 		}
6550 		else
6551 			free = -1;
6552 		(void) sm_io_fprintf(out, SM_TIME_DEFAULT,
6553 				"%s%d/%s/%ld\r\n",
6554 				prefix, i,
6555 				FILE_SYS_NAME(i),
6556 					free);
6557 	}
6558 }
6559 
6560 #if SM_CONF_SHM
6561 
6562 /*
6563 **  INIT_SEM -- initialize semaphore system
6564 **
6565 **	Parameters:
6566 **		owner -- is this the owner of semaphores?
6567 **
6568 **	Returns:
6569 **		none.
6570 */
6571 
6572 #if _FFR_USE_SEM_LOCKING
6573 #if SM_CONF_SEM
6574 static int SemId = -1;		/* Semaphore Id */
6575 int SemKey = SM_SEM_KEY;
6576 #endif /* SM_CONF_SEM */
6577 #endif /* _FFR_USE_SEM_LOCKING */
6578 
6579 static void init_sem __P((bool));
6580 
6581 static void
6582 init_sem(owner)
6583 	bool owner;
6584 {
6585 #if _FFR_USE_SEM_LOCKING
6586 #if SM_CONF_SEM
6587 	SemId = sm_sem_start(SemKey, 1, 0, owner);
6588 	if (SemId < 0)
6589 	{
6590 		sm_syslog(LOG_ERR, NOQID,
6591 			"func=init_sem, sem_key=%ld, sm_sem_start=%d",
6592 			(long) SemKey, SemId);
6593 		return;
6594 	}
6595 #endif /* SM_CONF_SEM */
6596 #endif /* _FFR_USE_SEM_LOCKING */
6597 	return;
6598 }
6599 
6600 /*
6601 **  STOP_SEM -- stop semaphore system
6602 **
6603 **	Parameters:
6604 **		owner -- is this the owner of semaphores?
6605 **
6606 **	Returns:
6607 **		none.
6608 */
6609 
6610 static void stop_sem __P((bool));
6611 
6612 static void
6613 stop_sem(owner)
6614 	bool owner;
6615 {
6616 #if _FFR_USE_SEM_LOCKING
6617 #if SM_CONF_SEM
6618 	if (owner && SemId >= 0)
6619 		sm_sem_stop(SemId);
6620 #endif /* SM_CONF_SEM */
6621 #endif /* _FFR_USE_SEM_LOCKING */
6622 	return;
6623 }
6624 
6625 /*
6626 **  UPD_QS -- update information about queue when adding/deleting an entry
6627 **
6628 **	Parameters:
6629 **		e -- envelope.
6630 **		count -- add/remove entry (+1/0/-1: add/no change/remove)
6631 **		space -- update the space available as well.
6632 **			(>0/0/<0: add/no change/remove)
6633 **		where -- caller (for logging)
6634 **
6635 **	Returns:
6636 **		none.
6637 **
6638 **	Side Effects:
6639 **		Modifies available space in filesystem.
6640 **		Changes number of entries in queue directory.
6641 */
6642 
6643 void
6644 upd_qs(e, count, space, where)
6645 	ENVELOPE *e;
6646 	int count;
6647 	int space;
6648 	char *where;
6649 {
6650 	short fidx;
6651 	int idx;
6652 # if _FFR_USE_SEM_LOCKING
6653 	int r;
6654 # endif /* _FFR_USE_SEM_LOCKING */
6655 	long s;
6656 
6657 	if (ShmId == SM_SHM_NO_ID || e == NULL)
6658 		return;
6659 	if (e->e_qgrp == NOQGRP || e->e_qdir == NOQDIR)
6660 		return;
6661 	idx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_idx;
6662 	if (tTd(73,2))
6663 		sm_dprintf("func=upd_qs, count=%d, space=%d, where=%s, idx=%d, entries=%d\n",
6664 			count, space, where, idx, QSHM_ENTRIES(idx));
6665 
6666 	/* XXX in theory this needs to be protected with a mutex */
6667 	if (QSHM_ENTRIES(idx) >= 0 && count != 0)
6668 	{
6669 # if _FFR_USE_SEM_LOCKING
6670 		r = sm_sem_acq(SemId, 0, 1);
6671 # endif /* _FFR_USE_SEM_LOCKING */
6672 		QSHM_ENTRIES(idx) += count;
6673 # if _FFR_USE_SEM_LOCKING
6674 		if (r >= 0)
6675 			r = sm_sem_rel(SemId, 0, 1);
6676 # endif /* _FFR_USE_SEM_LOCKING */
6677 	}
6678 
6679 	fidx = Queue[e->e_qgrp]->qg_qpaths[e->e_qdir].qp_fsysidx;
6680 	if (fidx < 0)
6681 		return;
6682 
6683 	/* update available space also?  (might be loseqfile) */
6684 	if (space == 0)
6685 		return;
6686 
6687 	/* convert size to blocks; this causes rounding errors */
6688 	s = e->e_msgsize / FILE_SYS_BLKSIZE(fidx);
6689 	if (s == 0)
6690 		return;
6691 
6692 	/* XXX in theory this needs to be protected with a mutex */
6693 	if (space > 0)
6694 		FILE_SYS_AVAIL(fidx) += s;
6695 	else
6696 		FILE_SYS_AVAIL(fidx) -= s;
6697 
6698 }
6699 
6700 static bool write_key_file __P((char *, long));
6701 static long read_key_file __P((char *, long));
6702 
6703 /*
6704 **  WRITE_KEY_FILE -- record some key into a file.
6705 **
6706 **	Parameters:
6707 **		keypath -- file name.
6708 **		key -- key to write.
6709 **
6710 **	Returns:
6711 **		true iff file could be written.
6712 **
6713 **	Side Effects:
6714 **		writes file.
6715 */
6716 
6717 static bool
6718 write_key_file(keypath, key)
6719 	char *keypath;
6720 	long key;
6721 {
6722 	bool ok;
6723 	long sff;
6724 	SM_FILE_T *keyf;
6725 
6726 	ok = false;
6727 	if (keypath == NULL || *keypath == '\0')
6728 		return ok;
6729 	sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY|SFF_CREAT;
6730 	if (TrustedUid != 0 && RealUid == TrustedUid)
6731 		sff |= SFF_OPENASROOT;
6732 	keyf = safefopen(keypath, O_WRONLY|O_TRUNC, FileMode, sff);
6733 	if (keyf == NULL)
6734 	{
6735 		sm_syslog(LOG_ERR, NOQID, "unable to write %s: %s",
6736 			  keypath, sm_errstring(errno));
6737 	}
6738 	else
6739 	{
6740 		if (geteuid() == 0 && RunAsUid != 0)
6741 		{
6742 #  if HASFCHOWN
6743 			int fd;
6744 
6745 			fd = keyf->f_file;
6746 			if (fd >= 0 && fchown(fd, RunAsUid, -1) < 0)
6747 			{
6748 				int err = errno;
6749 
6750 				sm_syslog(LOG_ALERT, NOQID,
6751 					  "ownership change on %s to %d failed: %s",
6752 					  keypath, RunAsUid, sm_errstring(err));
6753 			}
6754 #  endif /* HASFCHOWN */
6755 		}
6756 		ok = sm_io_fprintf(keyf, SM_TIME_DEFAULT, "%ld\n", key) !=
6757 		     SM_IO_EOF;
6758 		ok = (sm_io_close(keyf, SM_TIME_DEFAULT) != SM_IO_EOF) && ok;
6759 	}
6760 	return ok;
6761 }
6762 
6763 /*
6764 **  READ_KEY_FILE -- read a key from a file.
6765 **
6766 **	Parameters:
6767 **		keypath -- file name.
6768 **		key -- default key.
6769 **
6770 **	Returns:
6771 **		key.
6772 */
6773 
6774 static long
6775 read_key_file(keypath, key)
6776 	char *keypath;
6777 	long key;
6778 {
6779 	int r;
6780 	long sff, n;
6781 	SM_FILE_T *keyf;
6782 
6783 	if (keypath == NULL || *keypath == '\0')
6784 		return key;
6785 	sff = SFF_NOLINK|SFF_ROOTOK|SFF_REGONLY;
6786 	if (RealUid == 0 || (TrustedUid != 0 && RealUid == TrustedUid))
6787 		sff |= SFF_OPENASROOT;
6788 	keyf = safefopen(keypath, O_RDONLY, FileMode, sff);
6789 	if (keyf == NULL)
6790 	{
6791 		sm_syslog(LOG_ERR, NOQID, "unable to read %s: %s",
6792 			  keypath, sm_errstring(errno));
6793 	}
6794 	else
6795 	{
6796 		r = sm_io_fscanf(keyf, SM_TIME_DEFAULT, "%ld", &n);
6797 		if (r == 1)
6798 			key = n;
6799 		(void) sm_io_close(keyf, SM_TIME_DEFAULT);
6800 	}
6801 	return key;
6802 }
6803 
6804 /*
6805 **  INIT_SHM -- initialize shared memory structure
6806 **
6807 **	Initialize or attach to shared memory segment.
6808 **	Currently it is not a fatal error if this doesn't work.
6809 **	However, it causes us to have a "fallback" storage location
6810 **	for everything that is supposed to be in the shared memory,
6811 **	which makes the code slightly ugly.
6812 **
6813 **	Parameters:
6814 **		qn -- number of queue directories.
6815 **		owner -- owner of shared memory.
6816 **		hash -- identifies data that is stored in shared memory.
6817 **
6818 **	Returns:
6819 **		none.
6820 */
6821 
6822 static void init_shm __P((int, bool, unsigned int));
6823 
6824 static void
6825 init_shm(qn, owner, hash)
6826 	int qn;
6827 	bool owner;
6828 	unsigned int hash;
6829 {
6830 	int i;
6831 	int count;
6832 	int save_errno;
6833 	bool keyselect;
6834 
6835 	PtrFileSys = &FileSys[0];
6836 	PNumFileSys = &Numfilesys;
6837 /* if this "key" is specified: select one yourself */
6838 #define SEL_SHM_KEY	((key_t) -1)
6839 #define FIRST_SHM_KEY	25
6840 
6841 	/* This allows us to disable shared memory at runtime. */
6842 	if (ShmKey == 0)
6843 		return;
6844 
6845 	count = 0;
6846 	shms = SM_T_SIZE + qn * sizeof(QUEUE_SHM_T);
6847 	keyselect = ShmKey == SEL_SHM_KEY;
6848 	if (keyselect)
6849 	{
6850 		if (owner)
6851 			ShmKey = FIRST_SHM_KEY;
6852 		else
6853 		{
6854 			errno = 0;
6855 			ShmKey = read_key_file(ShmKeyFile, ShmKey);
6856 			keyselect = false;
6857 			if (ShmKey == SEL_SHM_KEY)
6858 			{
6859 				save_errno = (errno != 0) ? errno : EINVAL;
6860 				goto error;
6861 			}
6862 		}
6863 	}
6864 	for (;;)
6865 	{
6866 		/* allow read/write access for group? */
6867 		Pshm = sm_shmstart(ShmKey, shms,
6868 				SHM_R|SHM_W|(SHM_R>>3)|(SHM_W>>3),
6869 				&ShmId, owner);
6870 		save_errno = errno;
6871 		if (Pshm != NULL || !sm_file_exists(save_errno))
6872 			break;
6873 		if (++count >= 3)
6874 		{
6875 			if (keyselect)
6876 			{
6877 				++ShmKey;
6878 
6879 				/* back where we started? */
6880 				if (ShmKey == SEL_SHM_KEY)
6881 					break;
6882 				continue;
6883 			}
6884 			break;
6885 		}
6886 
6887 		/* only sleep if we are at the first key */
6888 		if (!keyselect || ShmKey == SEL_SHM_KEY)
6889 			sleep(count);
6890 	}
6891 	if (Pshm != NULL)
6892 	{
6893 		int *p;
6894 
6895 		if (keyselect)
6896 			(void) write_key_file(ShmKeyFile, (long) ShmKey);
6897 		if (owner && RunAsUid != 0)
6898 		{
6899 			i = sm_shmsetowner(ShmId, RunAsUid, RunAsGid, 0660);
6900 			if (i != 0)
6901 				sm_syslog(LOG_ERR, NOQID,
6902 					"key=%ld, sm_shmsetowner=%d, RunAsUid=%d, RunAsGid=%d",
6903 					(long) ShmKey, i, RunAsUid, RunAsGid);
6904 		}
6905 		p = (int *) Pshm;
6906 		if (owner)
6907 		{
6908 			*p = (int) shms;
6909 			*((pid_t *) SHM_OFF_PID(Pshm)) = CurrentPid;
6910 			p = (int *) SHM_OFF_TAG(Pshm);
6911 			*p = hash;
6912 		}
6913 		else
6914 		{
6915 			if (*p != (int) shms)
6916 			{
6917 				save_errno = EINVAL;
6918 				cleanup_shm(false);
6919 				goto error;
6920 			}
6921 			p = (int *) SHM_OFF_TAG(Pshm);
6922 			if (*p != (int) hash)
6923 			{
6924 				save_errno = EINVAL;
6925 				cleanup_shm(false);
6926 				goto error;
6927 			}
6928 
6929 			/*
6930 			**  XXX how to check the pid?
6931 			**  Read it from the pid-file? That does
6932 			**  not need to exist.
6933 			**  We could disable shm if we can't confirm
6934 			**  that it is the right one.
6935 			*/
6936 		}
6937 
6938 		PtrFileSys = (FILESYS *) OFF_FILE_SYS(Pshm);
6939 		PNumFileSys = (int *) OFF_NUM_FILE_SYS(Pshm);
6940 		QShm = (QUEUE_SHM_T *) OFF_QUEUE_SHM(Pshm);
6941 		PRSATmpCnt = (int *) OFF_RSA_TMP_CNT(Pshm);
6942 		*PRSATmpCnt = 0;
6943 		if (owner)
6944 		{
6945 			/* initialize values in shared memory */
6946 			NumFileSys = 0;
6947 			for (i = 0; i < qn; i++)
6948 				QShm[i].qs_entries = -1;
6949 		}
6950 		init_sem(owner);
6951 		return;
6952 	}
6953   error:
6954 	if (LogLevel > (owner ? 8 : 11))
6955 	{
6956 		sm_syslog(owner ? LOG_ERR : LOG_NOTICE, NOQID,
6957 			  "can't %s shared memory, key=%ld: %s",
6958 			  owner ? "initialize" : "attach to",
6959 			  (long) ShmKey, sm_errstring(save_errno));
6960 	}
6961 }
6962 #endif /* SM_CONF_SHM */
6963 
6964 
6965 /*
6966 **  SETUP_QUEUES -- set up all queue groups
6967 **
6968 **	Parameters:
6969 **		owner -- owner of shared memory?
6970 **
6971 **	Returns:
6972 **		none.
6973 **
6974 #if SM_CONF_SHM
6975 **	Side Effects:
6976 **		attaches shared memory.
6977 #endif * SM_CONF_SHM *
6978 */
6979 
6980 void
6981 setup_queues(owner)
6982 	bool owner;
6983 {
6984 	int i, qn, len;
6985 	unsigned int hashval;
6986 	time_t now;
6987 	char basedir[MAXPATHLEN];
6988 	struct stat st;
6989 
6990 	/*
6991 	**  Determine basedir for all queue directories.
6992 	**  All queue directories must be (first level) subdirectories
6993 	**  of the basedir.  The basedir is the QueueDir
6994 	**  without wildcards, but with trailing /
6995 	*/
6996 
6997 	hashval = 0;
6998 	errno = 0;
6999 	len = sm_strlcpy(basedir, QueueDir, sizeof(basedir));
7000 
7001 	/* Provide space for trailing '/' */
7002 	if (len >= sizeof(basedir) - 1)
7003 	{
7004 		syserr("QueueDirectory: path too long: %d,  max %d",
7005 			len, (int) sizeof(basedir) - 1);
7006 		ExitStat = EX_CONFIG;
7007 		return;
7008 	}
7009 	SM_ASSERT(len > 0);
7010 	if (basedir[len - 1] == '*')
7011 	{
7012 		char *cp;
7013 
7014 		cp = SM_LAST_DIR_DELIM(basedir);
7015 		if (cp == NULL)
7016 		{
7017 			syserr("QueueDirectory: can not wildcard relative path \"%s\"",
7018 				QueueDir);
7019 			if (tTd(41, 2))
7020 				sm_dprintf("setup_queues: \"%s\": Can not wildcard relative path.\n",
7021 					QueueDir);
7022 			ExitStat = EX_CONFIG;
7023 			return;
7024 		}
7025 
7026 		/* cut off wildcard pattern */
7027 		*++cp = '\0';
7028 		len = cp - basedir;
7029 	}
7030 	else if (!SM_IS_DIR_DELIM(basedir[len - 1]))
7031 	{
7032 		/* append trailing slash since it is a directory */
7033 		basedir[len] = '/';
7034 		basedir[++len] = '\0';
7035 	}
7036 
7037 	/* len counts up to the last directory delimiter */
7038 	SM_ASSERT(basedir[len - 1] == '/');
7039 
7040 	if (chdir(basedir) < 0)
7041 	{
7042 		int save_errno = errno;
7043 
7044 		syserr("can not chdir(%s)", basedir);
7045 		if (save_errno == EACCES)
7046 			(void) sm_io_fprintf(smioerr, SM_TIME_DEFAULT,
7047 				"Program mode requires special privileges, e.g., root or TrustedUser.\n");
7048 		if (tTd(41, 2))
7049 			sm_dprintf("setup_queues: \"%s\": %s\n",
7050 				   basedir, sm_errstring(errno));
7051 		ExitStat = EX_CONFIG;
7052 		return;
7053 	}
7054 #if SM_CONF_SHM
7055 	hashval = hash_q(basedir, hashval);
7056 #endif /* SM_CONF_SHM */
7057 
7058 	/* initialize for queue runs */
7059 	DoQueueRun = false;
7060 	now = curtime();
7061 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
7062 		Queue[i]->qg_nextrun = now;
7063 
7064 
7065 	if (UseMSP && OpMode != MD_TEST)
7066 	{
7067 		long sff = SFF_CREAT;
7068 
7069 		if (stat(".", &st) < 0)
7070 		{
7071 			syserr("can not stat(%s)", basedir);
7072 			if (tTd(41, 2))
7073 				sm_dprintf("setup_queues: \"%s\": %s\n",
7074 					   basedir, sm_errstring(errno));
7075 			ExitStat = EX_CONFIG;
7076 			return;
7077 		}
7078 		if (RunAsUid == 0)
7079 			sff |= SFF_ROOTOK;
7080 
7081 		/*
7082 		**  Check queue directory permissions.
7083 		**	Can we write to a group writable queue directory?
7084 		*/
7085 
7086 		if (bitset(S_IWGRP, QueueFileMode) &&
7087 		    bitset(S_IWGRP, st.st_mode) &&
7088 		    safefile(" ", RunAsUid, RunAsGid, RunAsUserName, sff,
7089 			     QueueFileMode, NULL) != 0)
7090 		{
7091 			syserr("can not write to queue directory %s (RunAsGid=%d, required=%d)",
7092 				basedir, (int) RunAsGid, (int) st.st_gid);
7093 		}
7094 		if (bitset(S_IWOTH|S_IXOTH, st.st_mode))
7095 		{
7096 #if _FFR_MSP_PARANOIA
7097 			syserr("dangerous permissions=%o on queue directory %s",
7098 				(int) st.st_mode, basedir);
7099 #else /* _FFR_MSP_PARANOIA */
7100 			if (LogLevel > 0)
7101 				sm_syslog(LOG_ERR, NOQID,
7102 					  "dangerous permissions=%o on queue directory %s",
7103 					  (int) st.st_mode, basedir);
7104 #endif /* _FFR_MSP_PARANOIA */
7105 		}
7106 #if _FFR_MSP_PARANOIA
7107 		if (NumQueue > 1)
7108 			syserr("can not use multiple queues for MSP");
7109 #endif /* _FFR_MSP_PARANOIA */
7110 	}
7111 
7112 	/* initial number of queue directories */
7113 	qn = 0;
7114 	for (i = 0; i < NumQueue && Queue[i] != NULL; i++)
7115 		qn = multiqueue_cache(basedir, len, Queue[i], qn, &hashval);
7116 
7117 #if SM_CONF_SHM
7118 	init_shm(qn, owner, hashval);
7119 	i = filesys_setup(owner || ShmId == SM_SHM_NO_ID);
7120 	if (i == FSF_NOT_FOUND)
7121 	{
7122 		/*
7123 		**  We didn't get the right filesystem data
7124 		**  This may happen if we don't have the right shared memory.
7125 		**  So let's do this without shared memory.
7126 		*/
7127 
7128 		SM_ASSERT(!owner);
7129 		cleanup_shm(false);	/* release shared memory */
7130 		i = filesys_setup(false);
7131 		if (i < 0)
7132 			syserr("filesys_setup failed twice, result=%d", i);
7133 		else if (LogLevel > 8)
7134 			sm_syslog(LOG_WARNING, NOQID,
7135 				  "shared memory does not contain expected data, ignored");
7136 	}
7137 #else /* SM_CONF_SHM */
7138 	i = filesys_setup(true);
7139 #endif /* SM_CONF_SHM */
7140 	if (i < 0)
7141 		ExitStat = EX_CONFIG;
7142 }
7143 
7144 #if SM_CONF_SHM
7145 /*
7146 **  CLEANUP_SHM -- do some cleanup work for shared memory etc
7147 **
7148 **	Parameters:
7149 **		owner -- owner of shared memory?
7150 **
7151 **	Returns:
7152 **		none.
7153 **
7154 **	Side Effects:
7155 **		detaches shared memory.
7156 */
7157 
7158 void
7159 cleanup_shm(owner)
7160 	bool owner;
7161 {
7162 	if (ShmId != SM_SHM_NO_ID)
7163 	{
7164 		if (sm_shmstop(Pshm, ShmId, owner) < 0 && LogLevel > 8)
7165 			sm_syslog(LOG_INFO, NOQID, "sm_shmstop failed=%s",
7166 				  sm_errstring(errno));
7167 		Pshm = NULL;
7168 		ShmId = SM_SHM_NO_ID;
7169 	}
7170 	stop_sem(owner);
7171 }
7172 #endif /* SM_CONF_SHM */
7173 
7174 /*
7175 **  CLEANUP_QUEUES -- do some cleanup work for queues
7176 **
7177 **	Parameters:
7178 **		none.
7179 **
7180 **	Returns:
7181 **		none.
7182 **
7183 */
7184 
7185 void
7186 cleanup_queues()
7187 {
7188 	sync_queue_time();
7189 }
7190 /*
7191 **  SET_DEF_QUEUEVAL -- set default values for a queue group.
7192 **
7193 **	Parameters:
7194 **		qg -- queue group
7195 **		all -- set all values (true for default group)?
7196 **
7197 **	Returns:
7198 **		none.
7199 **
7200 **	Side Effects:
7201 **		sets default values for the queue group.
7202 */
7203 
7204 void
7205 set_def_queueval(qg, all)
7206 	QUEUEGRP *qg;
7207 	bool all;
7208 {
7209 	if (bitnset(QD_DEFINED, qg->qg_flags))
7210 		return;
7211 	if (all)
7212 		qg->qg_qdir = QueueDir;
7213 #if _FFR_QUEUE_GROUP_SORTORDER
7214 	qg->qg_sortorder = QueueSortOrder;
7215 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7216 	qg->qg_maxqrun = all ? MaxRunnersPerQueue : -1;
7217 	qg->qg_nice = NiceQueueRun;
7218 }
7219 /*
7220 **  MAKEQUEUE -- define a new queue.
7221 **
7222 **	Parameters:
7223 **		line -- description of queue.  This is in labeled fields.
7224 **			The fields are:
7225 **			   F -- the flags associated with the queue
7226 **			   I -- the interval between running the queue
7227 **			   J -- the maximum # of jobs in work list
7228 **			   [M -- the maximum # of jobs in a queue run]
7229 **			   N -- the niceness at which to run
7230 **			   P -- the path to the queue
7231 **			   S -- the queue sorting order
7232 **			   R -- number of parallel queue runners
7233 **			   r -- max recipients per envelope
7234 **			The first word is the canonical name of the queue.
7235 **		qdef -- this is a 'Q' definition from .cf
7236 **
7237 **	Returns:
7238 **		none.
7239 **
7240 **	Side Effects:
7241 **		enters the queue into the queue table.
7242 */
7243 
7244 void
7245 makequeue(line, qdef)
7246 	char *line;
7247 	bool qdef;
7248 {
7249 	register char *p;
7250 	register QUEUEGRP *qg;
7251 	register STAB *s;
7252 	int i;
7253 	char fcode;
7254 
7255 	/* allocate a queue and set up defaults */
7256 	qg = (QUEUEGRP *) xalloc(sizeof(*qg));
7257 	memset((char *) qg, '\0', sizeof(*qg));
7258 
7259 	if (line[0] == '\0')
7260 	{
7261 		syserr("name required for queue");
7262 		return;
7263 	}
7264 
7265 	/* collect the queue name */
7266 	for (p = line;
7267 	     *p != '\0' && *p != ',' && !(isascii(*p) && isspace(*p));
7268 	     p++)
7269 		continue;
7270 	if (*p != '\0')
7271 		*p++ = '\0';
7272 	qg->qg_name = newstr(line);
7273 
7274 	/* set default values, can be overridden below */
7275 	set_def_queueval(qg, false);
7276 
7277 	/* now scan through and assign info from the fields */
7278 	while (*p != '\0')
7279 	{
7280 		auto char *delimptr;
7281 
7282 		while (*p != '\0' &&
7283 		       (*p == ',' || (isascii(*p) && isspace(*p))))
7284 			p++;
7285 
7286 		/* p now points to field code */
7287 		fcode = *p;
7288 		while (*p != '\0' && *p != '=' && *p != ',')
7289 			p++;
7290 		if (*p++ != '=')
7291 		{
7292 			syserr("queue %s: `=' expected", qg->qg_name);
7293 			return;
7294 		}
7295 		while (isascii(*p) && isspace(*p))
7296 			p++;
7297 
7298 		/* p now points to the field body */
7299 		p = munchstring(p, &delimptr, ',');
7300 
7301 		/* install the field into the queue struct */
7302 		switch (fcode)
7303 		{
7304 		  case 'P':		/* pathname */
7305 			if (*p == '\0')
7306 				syserr("queue %s: empty path name",
7307 					qg->qg_name);
7308 			else
7309 				qg->qg_qdir = newstr(p);
7310 			break;
7311 
7312 		  case 'F':		/* flags */
7313 			for (; *p != '\0'; p++)
7314 				if (!(isascii(*p) && isspace(*p)))
7315 					setbitn(*p, qg->qg_flags);
7316 			break;
7317 
7318 			/*
7319 			**  Do we need two intervals here:
7320 			**  One for persistent queue runners,
7321 			**  one for "normal" queue runs?
7322 			*/
7323 
7324 		  case 'I':	/* interval between running the queue */
7325 			qg->qg_queueintvl = convtime(p, 'm');
7326 			break;
7327 
7328 		  case 'N':		/* run niceness */
7329 			qg->qg_nice = atoi(p);
7330 			break;
7331 
7332 		  case 'R':		/* maximum # of runners for the group */
7333 			i = atoi(p);
7334 
7335 			/* can't have more runners than allowed total */
7336 			if (MaxQueueChildren > 0 && i > MaxQueueChildren)
7337 			{
7338 				qg->qg_maxqrun = MaxQueueChildren;
7339 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7340 						     "Q=%s: R=%d exceeds MaxQueueChildren=%d, set to MaxQueueChildren\n",
7341 						     qg->qg_name, i,
7342 						     MaxQueueChildren);
7343 			}
7344 			else
7345 				qg->qg_maxqrun = i;
7346 			break;
7347 
7348 		  case 'J':		/* maximum # of jobs in work list */
7349 			qg->qg_maxlist = atoi(p);
7350 			break;
7351 
7352 		  case 'r':		/* max recipients per envelope */
7353 			qg->qg_maxrcpt = atoi(p);
7354 			break;
7355 
7356 #if _FFR_QUEUE_GROUP_SORTORDER
7357 		  case 'S':		/* queue sorting order */
7358 			switch (*p)
7359 			{
7360 			  case 'h':	/* Host first */
7361 			  case 'H':
7362 				qg->qg_sortorder = QSO_BYHOST;
7363 				break;
7364 
7365 			  case 'p':	/* Priority order */
7366 			  case 'P':
7367 				qg->qg_sortorder = QSO_BYPRIORITY;
7368 				break;
7369 
7370 			  case 't':	/* Submission time */
7371 			  case 'T':
7372 				qg->qg_sortorder = QSO_BYTIME;
7373 				break;
7374 
7375 			  case 'f':	/* File name */
7376 			  case 'F':
7377 				qg->qg_sortorder = QSO_BYFILENAME;
7378 				break;
7379 
7380 			  case 'm':	/* Modification time */
7381 			  case 'M':
7382 				qg->qg_sortorder = QSO_BYMODTIME;
7383 				break;
7384 
7385 			  case 'r':	/* Random */
7386 			  case 'R':
7387 				qg->qg_sortorder = QSO_RANDOM;
7388 				break;
7389 
7390 # if _FFR_RHS
7391 			  case 's':	/* Shuffled host name */
7392 			  case 'S':
7393 				qg->qg_sortorder = QSO_BYSHUFFLE;
7394 				break;
7395 # endif /* _FFR_RHS */
7396 
7397 			  case 'n':	/* none */
7398 			  case 'N':
7399 				qg->qg_sortorder = QSO_NONE;
7400 				break;
7401 
7402 			  default:
7403 				syserr("Invalid queue sort order \"%s\"", p);
7404 			}
7405 			break;
7406 #endif /* _FFR_QUEUE_GROUP_SORTORDER */
7407 
7408 		  default:
7409 			syserr("Q%s: unknown queue equate %c=",
7410 			       qg->qg_name, fcode);
7411 			break;
7412 		}
7413 
7414 		p = delimptr;
7415 	}
7416 
7417 #if !HASNICE
7418 	if (qg->qg_nice != NiceQueueRun)
7419 	{
7420 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7421 				     "Q%s: Warning: N= set on system that doesn't support nice()\n",
7422 				     qg->qg_name);
7423 	}
7424 #endif /* !HASNICE */
7425 
7426 	/* do some rationality checking */
7427 	if (NumQueue >= MAXQUEUEGROUPS)
7428 	{
7429 		syserr("too many queue groups defined (%d max)",
7430 			MAXQUEUEGROUPS);
7431 		return;
7432 	}
7433 
7434 	if (qg->qg_qdir == NULL)
7435 	{
7436 		if (QueueDir == NULL || *QueueDir == '\0')
7437 		{
7438 			syserr("QueueDir must be defined before queue groups");
7439 			return;
7440 		}
7441 		qg->qg_qdir = newstr(QueueDir);
7442 	}
7443 
7444 	if (qg->qg_maxqrun > 1 && !bitnset(QD_FORK, qg->qg_flags))
7445 	{
7446 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
7447 				     "Warning: Q=%s: R=%d: multiple queue runners specified\n\tbut flag '%c' is not set\n",
7448 				     qg->qg_name, qg->qg_maxqrun, QD_FORK);
7449 	}
7450 
7451 	/* enter the queue into the symbol table */
7452 	if (tTd(37, 8))
7453 		sm_syslog(LOG_INFO, NOQID,
7454 			  "Adding %s to stab, path: %s", qg->qg_name,
7455 			  qg->qg_qdir);
7456 	s = stab(qg->qg_name, ST_QUEUE, ST_ENTER);
7457 	if (s->s_quegrp != NULL)
7458 	{
7459 		i = s->s_quegrp->qg_index;
7460 
7461 		/* XXX what about the pointers inside this struct? */
7462 		sm_free(s->s_quegrp); /* XXX */
7463 	}
7464 	else
7465 		i = NumQueue++;
7466 	Queue[i] = s->s_quegrp = qg;
7467 	qg->qg_index = i;
7468 
7469 	/* set default value for max queue runners */
7470 	if (qg->qg_maxqrun < 0)
7471 	{
7472 		if (MaxRunnersPerQueue > 0)
7473 			qg->qg_maxqrun = MaxRunnersPerQueue;
7474 		else
7475 			qg->qg_maxqrun = 1;
7476 	}
7477 	if (qdef)
7478 		setbitn(QD_DEFINED, qg->qg_flags);
7479 }
7480 #if 0
7481 /*
7482 **  HASHFQN -- calculate a hash value for a fully qualified host name
7483 **
7484 **	Arguments:
7485 **		fqn -- an all lower-case host.domain string
7486 **		buckets -- the number of buckets (queue directories)
7487 **
7488 **	Returns:
7489 **		a bucket number (signed integer)
7490 **		-1 on error
7491 **
7492 **	Contributed by Exactis.com, Inc.
7493 */
7494 
7495 int
7496 hashfqn(fqn, buckets)
7497 	register char *fqn;
7498 	int buckets;
7499 {
7500 	register char *p;
7501 	register int h = 0, hash, cnt;
7502 
7503 	if (fqn == NULL)
7504 		return -1;
7505 
7506 	/*
7507 	**  A variation on the gdb hash
7508 	**  This is the best as of Feb 19, 1996 --bcx
7509 	*/
7510 
7511 	p = fqn;
7512 	h = 0x238F13AF * strlen(p);
7513 	for (cnt = 0; *p != 0; ++p, cnt++)
7514 	{
7515 		h = (h + (*p << (cnt * 5 % 24))) & 0x7FFFFFFF;
7516 	}
7517 	h = (1103515243 * h + 12345) & 0x7FFFFFFF;
7518 	if (buckets < 2)
7519 		hash = 0;
7520 	else
7521 		hash = (h % buckets);
7522 
7523 	return hash;
7524 }
7525 #endif /* 0 */
7526 
7527 /*
7528 **  A structure for sorting Queue according to maxqrun without
7529 **	screwing up Queue itself.
7530 */
7531 
7532 struct sortqgrp
7533 {
7534 	int sg_idx;		/* original index */
7535 	int sg_maxqrun;		/* max queue runners */
7536 };
7537 typedef struct sortqgrp	SORTQGRP_T;
7538 static int cmpidx __P((const void *, const void *));
7539 
7540 static int
7541 cmpidx(a, b)
7542 	const void *a;
7543 	const void *b;
7544 {
7545 	/* The sort is highest to lowest, so the comparison is reversed */
7546 	if (((SORTQGRP_T *)a)->sg_maxqrun < ((SORTQGRP_T *)b)->sg_maxqrun)
7547 		return 1;
7548 	else if (((SORTQGRP_T *)a)->sg_maxqrun > ((SORTQGRP_T *)b)->sg_maxqrun)
7549 		return -1;
7550 	else
7551 		return 0;
7552 }
7553 
7554 /*
7555 **  MAKEWORKGROUP -- balance queue groups into work groups per MaxQueueChildren
7556 **
7557 **  Take the now defined queue groups and assign them to work groups.
7558 **  This is done to balance out the number of concurrently active
7559 **  queue runners such that MaxQueueChildren is not exceeded. This may
7560 **  result in more than one queue group per work group. In such a case
7561 **  the number of running queue groups in that work group will have no
7562 **  more than the work group maximum number of runners (a "fair" portion
7563 **  of MaxQueueRunners). All queue groups within a work group will get a
7564 **  chance at running.
7565 **
7566 **	Parameters:
7567 **		none.
7568 **
7569 **	Returns:
7570 **		nothing.
7571 **
7572 **	Side Effects:
7573 **		Sets up WorkGrp structure.
7574 */
7575 
7576 void
7577 makeworkgroups()
7578 {
7579 	int i, j, total_runners, dir, h;
7580 	SORTQGRP_T si[MAXQUEUEGROUPS + 1];
7581 
7582 	total_runners = 0;
7583 	if (NumQueue == 1 && strcmp(Queue[0]->qg_name, "mqueue") == 0)
7584 	{
7585 		/*
7586 		**  There is only the "mqueue" queue group (a default)
7587 		**  containing all of the queues. We want to provide to
7588 		**  this queue group the maximum allowable queue runners.
7589 		**  To match older behavior (8.10/8.11) we'll try for
7590 		**  1 runner per queue capping it at MaxQueueChildren.
7591 		**  So if there are N queues, then there will be N runners
7592 		**  for the "mqueue" queue group (where N is kept less than
7593 		**  MaxQueueChildren).
7594 		*/
7595 
7596 		NumWorkGroups = 1;
7597 		WorkGrp[0].wg_numqgrp = 1;
7598 		WorkGrp[0].wg_qgs = (QUEUEGRP **) xalloc(sizeof(QUEUEGRP *));
7599 		WorkGrp[0].wg_qgs[0] = Queue[0];
7600 		if (MaxQueueChildren > 0 &&
7601 		    Queue[0]->qg_numqueues > MaxQueueChildren)
7602 			WorkGrp[0].wg_runners = MaxQueueChildren;
7603 		else
7604 			WorkGrp[0].wg_runners = Queue[0]->qg_numqueues;
7605 
7606 		Queue[0]->qg_wgrp = 0;
7607 
7608 		/* can't have more runners than allowed total */
7609 		if (MaxQueueChildren > 0 &&
7610 		    Queue[0]->qg_maxqrun > MaxQueueChildren)
7611 			Queue[0]->qg_maxqrun = MaxQueueChildren;
7612 		WorkGrp[0].wg_maxact = Queue[0]->qg_maxqrun;
7613 		WorkGrp[0].wg_lowqintvl = Queue[0]->qg_queueintvl;
7614 		return;
7615 	}
7616 
7617 	for (i = 0; i < NumQueue; i++)
7618 	{
7619 		si[i].sg_maxqrun = Queue[i]->qg_maxqrun;
7620 		si[i].sg_idx = i;
7621 	}
7622 	qsort(si, NumQueue, sizeof(si[0]), cmpidx);
7623 
7624 	NumWorkGroups = 0;
7625 	for (i = 0; i < NumQueue; i++)
7626 	{
7627 		total_runners += si[i].sg_maxqrun;
7628 		if (MaxQueueChildren <= 0 || total_runners <= MaxQueueChildren)
7629 			NumWorkGroups++;
7630 		else
7631 			break;
7632 	}
7633 
7634 	if (NumWorkGroups < 1)
7635 		NumWorkGroups = 1; /* gotta have one at least */
7636 	else if (NumWorkGroups > MAXWORKGROUPS)
7637 		NumWorkGroups = MAXWORKGROUPS; /* the limit */
7638 
7639 	/*
7640 	**  We now know the number of work groups to pack the queue groups
7641 	**  into. The queue groups in 'Queue' are sorted from highest
7642 	**  to lowest for the number of runners per queue group.
7643 	**  We put the queue groups with the largest number of runners
7644 	**  into work groups first. Then the smaller ones are fitted in
7645 	**  where it looks best.
7646 	*/
7647 
7648 	j = 0;
7649 	dir = 1;
7650 	for (i = 0; i < NumQueue; i++)
7651 	{
7652 		/* a to-and-fro packing scheme, continue from last position */
7653 		if (j >= NumWorkGroups)
7654 		{
7655 			dir = -1;
7656 			j = NumWorkGroups - 1;
7657 		}
7658 		else if (j < 0)
7659 		{
7660 			j = 0;
7661 			dir = 1;
7662 		}
7663 
7664 		if (WorkGrp[j].wg_qgs == NULL)
7665 			WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_malloc(sizeof(QUEUEGRP *) *
7666 							(WorkGrp[j].wg_numqgrp + 1));
7667 		else
7668 			WorkGrp[j].wg_qgs = (QUEUEGRP **)sm_realloc(WorkGrp[j].wg_qgs,
7669 							sizeof(QUEUEGRP *) *
7670 							(WorkGrp[j].wg_numqgrp + 1));
7671 		if (WorkGrp[j].wg_qgs == NULL)
7672 		{
7673 			syserr("!cannot allocate memory for work queues, need %d bytes",
7674 			       (int) (sizeof(QUEUEGRP *) *
7675 				      (WorkGrp[j].wg_numqgrp + 1)));
7676 		}
7677 
7678 		h = si[i].sg_idx;
7679 		WorkGrp[j].wg_qgs[WorkGrp[j].wg_numqgrp] = Queue[h];
7680 		WorkGrp[j].wg_numqgrp++;
7681 		WorkGrp[j].wg_runners += Queue[h]->qg_maxqrun;
7682 		Queue[h]->qg_wgrp = j;
7683 
7684 		if (WorkGrp[j].wg_maxact == 0)
7685 		{
7686 			/* can't have more runners than allowed total */
7687 			if (MaxQueueChildren > 0 &&
7688 			    Queue[h]->qg_maxqrun > MaxQueueChildren)
7689 				Queue[h]->qg_maxqrun = MaxQueueChildren;
7690 			WorkGrp[j].wg_maxact = Queue[h]->qg_maxqrun;
7691 		}
7692 
7693 		/*
7694 		**  XXX: must wg_lowqintvl be the GCD?
7695 		**  qg1: 2m, qg2: 3m, minimum: 2m, when do queue runs for
7696 		**  qg2 occur?
7697 		*/
7698 
7699 		/* keep track of the lowest interval for a persistent runner */
7700 		if (Queue[h]->qg_queueintvl > 0 &&
7701 		    WorkGrp[j].wg_lowqintvl < Queue[h]->qg_queueintvl)
7702 			WorkGrp[j].wg_lowqintvl = Queue[h]->qg_queueintvl;
7703 		j += dir;
7704 	}
7705 	if (tTd(41, 9))
7706 	{
7707 		for (i = 0; i < NumWorkGroups; i++)
7708 		{
7709 			sm_dprintf("Workgroup[%d]=", i);
7710 			for (j = 0; j < WorkGrp[i].wg_numqgrp; j++)
7711 			{
7712 				sm_dprintf("%s, ",
7713 					WorkGrp[i].wg_qgs[j]->qg_name);
7714 			}
7715 			sm_dprintf("\n");
7716 		}
7717 	}
7718 }
7719 
7720 /*
7721 **  DUP_DF -- duplicate envelope data file
7722 **
7723 **	Copy the data file from the 'old' envelope to the 'new' envelope
7724 **	in the most efficient way possible.
7725 **
7726 **	Create a hard link from the 'old' data file to the 'new' data file.
7727 **	If the old and new queue directories are on different file systems,
7728 **	then the new data file link is created in the old queue directory,
7729 **	and the new queue file will contain a 'd' record pointing to the
7730 **	directory containing the new data file.
7731 **
7732 **	Parameters:
7733 **		old -- old envelope.
7734 **		new -- new envelope.
7735 **
7736 **	Results:
7737 **		Returns true on success, false on failure.
7738 **
7739 **	Side Effects:
7740 **		On success, the new data file is created.
7741 **		On fatal failure, EF_FATALERRS is set in old->e_flags.
7742 */
7743 
7744 static bool	dup_df __P((ENVELOPE *, ENVELOPE *));
7745 
7746 static bool
7747 dup_df(old, new)
7748 	ENVELOPE *old;
7749 	ENVELOPE *new;
7750 {
7751 	int ofs, nfs, r;
7752 	char opath[MAXPATHLEN];
7753 	char npath[MAXPATHLEN];
7754 
7755 	if (!bitset(EF_HAS_DF, old->e_flags))
7756 	{
7757 		/*
7758 		**  this can happen if: SuperSafe != True
7759 		**  and a bounce mail is sent that is split.
7760 		*/
7761 
7762 		queueup(old, false, true);
7763 	}
7764 	SM_REQUIRE(ISVALIDQGRP(old->e_qgrp) && ISVALIDQDIR(old->e_qdir));
7765 	SM_REQUIRE(ISVALIDQGRP(new->e_qgrp) && ISVALIDQDIR(new->e_qdir));
7766 
7767 	(void) sm_strlcpy(opath, queuename(old, DATAFL_LETTER), sizeof(opath));
7768 	(void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof(npath));
7769 
7770 	if (old->e_dfp != NULL)
7771 	{
7772 		r = sm_io_setinfo(old->e_dfp, SM_BF_COMMIT, NULL);
7773 		if (r < 0 && errno != EINVAL)
7774 		{
7775 			syserr("@can't commit %s", opath);
7776 			old->e_flags |= EF_FATALERRS;
7777 			return false;
7778 		}
7779 	}
7780 
7781 	/*
7782 	**  Attempt to create a hard link, if we think both old and new
7783 	**  are on the same file system, otherwise copy the file.
7784 	**
7785 	**  Don't waste time attempting a hard link unless old and new
7786 	**  are on the same file system.
7787 	*/
7788 
7789 	SM_REQUIRE(ISVALIDQGRP(old->e_dfqgrp) && ISVALIDQDIR(old->e_dfqdir));
7790 	SM_REQUIRE(ISVALIDQGRP(new->e_dfqgrp) && ISVALIDQDIR(new->e_dfqdir));
7791 
7792 	ofs = Queue[old->e_dfqgrp]->qg_qpaths[old->e_dfqdir].qp_fsysidx;
7793 	nfs = Queue[new->e_dfqgrp]->qg_qpaths[new->e_dfqdir].qp_fsysidx;
7794 	if (FILE_SYS_DEV(ofs) == FILE_SYS_DEV(nfs))
7795 	{
7796 		if (link(opath, npath) == 0)
7797 		{
7798 			new->e_flags |= EF_HAS_DF;
7799 			SYNC_DIR(npath, true);
7800 			return true;
7801 		}
7802 		goto error;
7803 	}
7804 
7805 	/*
7806 	**  Can't link across queue directories, so try to create a hard
7807 	**  link in the same queue directory as the old df file.
7808 	**  The qf file will refer to the new df file using a 'd' record.
7809 	*/
7810 
7811 	new->e_dfqgrp = old->e_dfqgrp;
7812 	new->e_dfqdir = old->e_dfqdir;
7813 	(void) sm_strlcpy(npath, queuename(new, DATAFL_LETTER), sizeof(npath));
7814 	if (link(opath, npath) == 0)
7815 	{
7816 		new->e_flags |= EF_HAS_DF;
7817 		SYNC_DIR(npath, true);
7818 		return true;
7819 	}
7820 
7821   error:
7822 	if (LogLevel > 0)
7823 		sm_syslog(LOG_ERR, old->e_id,
7824 			  "dup_df: can't link %s to %s, error=%s, envelope splitting failed",
7825 			  opath, npath, sm_errstring(errno));
7826 	return false;
7827 }
7828 
7829 /*
7830 **  SPLIT_ENV -- Allocate a new envelope based on a given envelope.
7831 **
7832 **	Parameters:
7833 **		e -- envelope.
7834 **		sendqueue -- sendqueue for new envelope.
7835 **		qgrp -- index of queue group.
7836 **		qdir -- queue directory.
7837 **
7838 **	Results:
7839 **		new envelope.
7840 **
7841 */
7842 
7843 static ENVELOPE	*split_env __P((ENVELOPE *, ADDRESS *, int, int));
7844 
7845 static ENVELOPE *
7846 split_env(e, sendqueue, qgrp, qdir)
7847 	ENVELOPE *e;
7848 	ADDRESS *sendqueue;
7849 	int qgrp;
7850 	int qdir;
7851 {
7852 	ENVELOPE *ee;
7853 
7854 	ee = (ENVELOPE *) sm_rpool_malloc_x(e->e_rpool, sizeof(*ee));
7855 	STRUCTCOPY(*e, *ee);
7856 	ee->e_message = NULL;	/* XXX use original message? */
7857 	ee->e_id = NULL;
7858 	assign_queueid(ee);
7859 	ee->e_sendqueue = sendqueue;
7860 	ee->e_flags &= ~(EF_INQUEUE|EF_CLRQUEUE|EF_FATALERRS
7861 			 |EF_SENDRECEIPT|EF_RET_PARAM|EF_HAS_DF);
7862 	ee->e_flags |= EF_NORECEIPT;	/* XXX really? */
7863 	ee->e_from.q_state = QS_SENDER;
7864 	ee->e_dfp = NULL;
7865 	ee->e_lockfp = NULL;
7866 	if (e->e_xfp != NULL)
7867 		ee->e_xfp = sm_io_dup(e->e_xfp);
7868 
7869 	/* failed to dup e->e_xfp, start a new transcript */
7870 	if (ee->e_xfp == NULL)
7871 		openxscript(ee);
7872 
7873 	ee->e_qgrp = ee->e_dfqgrp = qgrp;
7874 	ee->e_qdir = ee->e_dfqdir = qdir;
7875 	ee->e_errormode = EM_MAIL;
7876 	ee->e_statmsg = NULL;
7877 	if (e->e_quarmsg != NULL)
7878 		ee->e_quarmsg = sm_rpool_strdup_x(ee->e_rpool,
7879 						  e->e_quarmsg);
7880 
7881 	/*
7882 	**  XXX Not sure if this copying is necessary.
7883 	**  sendall() does this copying, but I (dm) don't know if that is
7884 	**  because of the storage management discipline we were using
7885 	**  before rpools were introduced, or if it is because these lists
7886 	**  can be modified later.
7887 	*/
7888 
7889 	ee->e_header = copyheader(e->e_header, ee->e_rpool);
7890 	ee->e_errorqueue = copyqueue(e->e_errorqueue, ee->e_rpool);
7891 
7892 	return ee;
7893 }
7894 
7895 /* return values from split functions, check also below! */
7896 #define SM_SPLIT_FAIL	(0)
7897 #define SM_SPLIT_NONE	(1)
7898 #define SM_SPLIT_NEW(n)	(1 + (n))
7899 
7900 /*
7901 **  SPLIT_ACROSS_QUEUE_GROUPS
7902 **
7903 **	This function splits an envelope across multiple queue groups
7904 **	based on the queue group of each recipient.
7905 **
7906 **	Parameters:
7907 **		e -- envelope.
7908 **
7909 **	Results:
7910 **		SM_SPLIT_FAIL on failure
7911 **		SM_SPLIT_NONE if no splitting occurred,
7912 **		or 1 + the number of additional envelopes created.
7913 **
7914 **	Side Effects:
7915 **		On success, e->e_sibling points to a list of zero or more
7916 **		additional envelopes, and the associated data files exist
7917 **		on disk.  But the queue files are not created.
7918 **
7919 **		On failure, e->e_sibling is not changed.
7920 **		The order of recipients in e->e_sendqueue is permuted.
7921 **		Abandoned data files for additional envelopes that failed
7922 **		to be created may exist on disk.
7923 */
7924 
7925 static int	q_qgrp_compare __P((const void *, const void *));
7926 static int	e_filesys_compare __P((const void *, const void *));
7927 
7928 static int
7929 q_qgrp_compare(p1, p2)
7930 	const void *p1;
7931 	const void *p2;
7932 {
7933 	ADDRESS **pq1 = (ADDRESS **) p1;
7934 	ADDRESS **pq2 = (ADDRESS **) p2;
7935 
7936 	return (*pq1)->q_qgrp - (*pq2)->q_qgrp;
7937 }
7938 
7939 static int
7940 e_filesys_compare(p1, p2)
7941 	const void *p1;
7942 	const void *p2;
7943 {
7944 	ENVELOPE **pe1 = (ENVELOPE **) p1;
7945 	ENVELOPE **pe2 = (ENVELOPE **) p2;
7946 	int fs1, fs2;
7947 
7948 	fs1 = Queue[(*pe1)->e_qgrp]->qg_qpaths[(*pe1)->e_qdir].qp_fsysidx;
7949 	fs2 = Queue[(*pe2)->e_qgrp]->qg_qpaths[(*pe2)->e_qdir].qp_fsysidx;
7950 	if (FILE_SYS_DEV(fs1) < FILE_SYS_DEV(fs2))
7951 		return -1;
7952 	if (FILE_SYS_DEV(fs1) > FILE_SYS_DEV(fs2))
7953 		return 1;
7954 	return 0;
7955 }
7956 
7957 static int split_across_queue_groups __P((ENVELOPE *));
7958 static int
7959 split_across_queue_groups(e)
7960 	ENVELOPE *e;
7961 {
7962 	int naddrs, nsplits, i;
7963 	bool changed;
7964 	char **pvp;
7965 	ADDRESS *q, **addrs;
7966 	ENVELOPE *ee, *es;
7967 	ENVELOPE *splits[MAXQUEUEGROUPS];
7968 	char pvpbuf[PSBUFSIZE];
7969 
7970 	SM_REQUIRE(ISVALIDQGRP(e->e_qgrp));
7971 
7972 	/* Count addresses and assign queue groups. */
7973 	naddrs = 0;
7974 	changed = false;
7975 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
7976 	{
7977 		if (QS_IS_DEAD(q->q_state))
7978 			continue;
7979 		++naddrs;
7980 
7981 		/* bad addresses and those already sent stay put */
7982 		if (QS_IS_BADADDR(q->q_state) ||
7983 		    QS_IS_SENT(q->q_state))
7984 			q->q_qgrp = e->e_qgrp;
7985 		else if (!ISVALIDQGRP(q->q_qgrp))
7986 		{
7987 			/* call ruleset which should return a queue group */
7988 			i = rscap(RS_QUEUEGROUP, q->q_user, NULL, e, &pvp,
7989 				  pvpbuf, sizeof(pvpbuf));
7990 			if (i == EX_OK &&
7991 			    pvp != NULL && pvp[0] != NULL &&
7992 			    (pvp[0][0] & 0377) == CANONNET &&
7993 			    pvp[1] != NULL && pvp[1][0] != '\0')
7994 			{
7995 				i = name2qid(pvp[1]);
7996 				if (ISVALIDQGRP(i))
7997 				{
7998 					q->q_qgrp = i;
7999 					changed = true;
8000 					if (tTd(20, 4))
8001 						sm_syslog(LOG_INFO, NOQID,
8002 							"queue group name %s -> %d",
8003 							pvp[1], i);
8004 					continue;
8005 				}
8006 				else if (LogLevel > 10)
8007 					sm_syslog(LOG_INFO, NOQID,
8008 						"can't find queue group name %s, selection ignored",
8009 						pvp[1]);
8010 			}
8011 			if (q->q_mailer != NULL &&
8012 			    ISVALIDQGRP(q->q_mailer->m_qgrp))
8013 			{
8014 				changed = true;
8015 				q->q_qgrp = q->q_mailer->m_qgrp;
8016 			}
8017 			else if (ISVALIDQGRP(e->e_qgrp))
8018 				q->q_qgrp = e->e_qgrp;
8019 			else
8020 				q->q_qgrp = 0;
8021 		}
8022 	}
8023 
8024 	/* only one address? nothing to split. */
8025 	if (naddrs <= 1 && !changed)
8026 		return SM_SPLIT_NONE;
8027 
8028 	/* sort the addresses by queue group */
8029 	addrs = sm_rpool_malloc_x(e->e_rpool, naddrs * sizeof(ADDRESS *));
8030 	for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8031 	{
8032 		if (QS_IS_DEAD(q->q_state))
8033 			continue;
8034 		addrs[i++] = q;
8035 	}
8036 	qsort(addrs, naddrs, sizeof(ADDRESS *), q_qgrp_compare);
8037 
8038 	/* split into multiple envelopes, by queue group */
8039 	nsplits = 0;
8040 	es = NULL;
8041 	e->e_sendqueue = NULL;
8042 	for (i = 0; i < naddrs; ++i)
8043 	{
8044 		if (i == naddrs - 1 || addrs[i]->q_qgrp != addrs[i + 1]->q_qgrp)
8045 			addrs[i]->q_next = NULL;
8046 		else
8047 			addrs[i]->q_next = addrs[i + 1];
8048 
8049 		/* same queue group as original envelope? */
8050 		if (addrs[i]->q_qgrp == e->e_qgrp)
8051 		{
8052 			if (e->e_sendqueue == NULL)
8053 				e->e_sendqueue = addrs[i];
8054 			continue;
8055 		}
8056 
8057 		/* different queue group than original envelope */
8058 		if (es == NULL || addrs[i]->q_qgrp != es->e_qgrp)
8059 		{
8060 			ee = split_env(e, addrs[i], addrs[i]->q_qgrp, NOQDIR);
8061 			es = ee;
8062 			splits[nsplits++] = ee;
8063 		}
8064 	}
8065 
8066 	/* no splits? return right now. */
8067 	if (nsplits <= 0)
8068 		return SM_SPLIT_NONE;
8069 
8070 	/* assign a queue directory to each additional envelope */
8071 	for (i = 0; i < nsplits; ++i)
8072 	{
8073 		es = splits[i];
8074 #if 0
8075 		es->e_qdir = pickqdir(Queue[es->e_qgrp], es->e_msgsize, es);
8076 #endif /* 0 */
8077 		if (!setnewqueue(es))
8078 			goto failure;
8079 	}
8080 
8081 	/* sort the additional envelopes by queue file system */
8082 	qsort(splits, nsplits, sizeof(ENVELOPE *), e_filesys_compare);
8083 
8084 	/* create data files for each additional envelope */
8085 	if (!dup_df(e, splits[0]))
8086 	{
8087 		i = 0;
8088 		goto failure;
8089 	}
8090 	for (i = 1; i < nsplits; ++i)
8091 	{
8092 		/* copy or link to the previous data file */
8093 		if (!dup_df(splits[i - 1], splits[i]))
8094 			goto failure;
8095 	}
8096 
8097 	/* success: prepend the new envelopes to the e->e_sibling list */
8098 	for (i = 0; i < nsplits; ++i)
8099 	{
8100 		es = splits[i];
8101 		es->e_sibling = e->e_sibling;
8102 		e->e_sibling = es;
8103 	}
8104 	return SM_SPLIT_NEW(nsplits);
8105 
8106 	/* failure: clean up */
8107   failure:
8108 	if (i > 0)
8109 	{
8110 		int j;
8111 
8112 		for (j = 0; j < i; j++)
8113 			(void) unlink(queuename(splits[j], DATAFL_LETTER));
8114 	}
8115 	e->e_sendqueue = addrs[0];
8116 	for (i = 0; i < naddrs - 1; ++i)
8117 		addrs[i]->q_next = addrs[i + 1];
8118 	addrs[naddrs - 1]->q_next = NULL;
8119 	return SM_SPLIT_FAIL;
8120 }
8121 
8122 /*
8123 **  SPLIT_WITHIN_QUEUE
8124 **
8125 **	Split an envelope with multiple recipients into several
8126 **	envelopes within the same queue directory, if the number of
8127 **	recipients exceeds the limit for the queue group.
8128 **
8129 **	Parameters:
8130 **		e -- envelope.
8131 **
8132 **	Results:
8133 **		SM_SPLIT_FAIL on failure
8134 **		SM_SPLIT_NONE if no splitting occurred,
8135 **		or 1 + the number of additional envelopes created.
8136 */
8137 
8138 #define SPLIT_LOG_LEVEL	8
8139 
8140 static int	split_within_queue __P((ENVELOPE *));
8141 
8142 static int
8143 split_within_queue(e)
8144 	ENVELOPE *e;
8145 {
8146 	int maxrcpt, nrcpt, ndead, nsplit, i;
8147 	int j, l;
8148 	char *lsplits;
8149 	ADDRESS *q, **addrs;
8150 	ENVELOPE *ee, *firstsibling;
8151 
8152 	if (!ISVALIDQGRP(e->e_qgrp) || bitset(EF_SPLIT, e->e_flags))
8153 		return SM_SPLIT_NONE;
8154 
8155 	/* don't bother if there is no recipient limit */
8156 	maxrcpt = Queue[e->e_qgrp]->qg_maxrcpt;
8157 	if (maxrcpt <= 0)
8158 		return SM_SPLIT_NONE;
8159 
8160 	/* count recipients */
8161 	nrcpt = 0;
8162 	for (q = e->e_sendqueue; q != NULL; q = q->q_next)
8163 	{
8164 		if (QS_IS_DEAD(q->q_state))
8165 			continue;
8166 		++nrcpt;
8167 	}
8168 	if (nrcpt <= maxrcpt)
8169 		return SM_SPLIT_NONE;
8170 
8171 	/*
8172 	**  Preserve the recipient list
8173 	**  so that we can restore it in case of error.
8174 	**  (But we discard dead addresses.)
8175 	*/
8176 
8177 	addrs = sm_rpool_malloc_x(e->e_rpool, nrcpt * sizeof(ADDRESS *));
8178 	for (i = 0, q = e->e_sendqueue; q != NULL; q = q->q_next)
8179 	{
8180 		if (QS_IS_DEAD(q->q_state))
8181 			continue;
8182 		addrs[i++] = q;
8183 	}
8184 
8185 	/*
8186 	**  Partition the recipient list so that bad and sent addresses
8187 	**  come first. These will go with the original envelope, and
8188 	**  do not count towards the maxrcpt limit.
8189 	**  addrs[] does not contain QS_IS_DEAD() addresses.
8190 	*/
8191 
8192 	ndead = 0;
8193 	for (i = 0; i < nrcpt; ++i)
8194 	{
8195 		if (QS_IS_BADADDR(addrs[i]->q_state) ||
8196 		    QS_IS_SENT(addrs[i]->q_state) ||
8197 		    QS_IS_DEAD(addrs[i]->q_state)) /* for paranoia's sake */
8198 		{
8199 			if (i > ndead)
8200 			{
8201 				ADDRESS *tmp = addrs[i];
8202 
8203 				addrs[i] = addrs[ndead];
8204 				addrs[ndead] = tmp;
8205 			}
8206 			++ndead;
8207 		}
8208 	}
8209 
8210 	/* Check if no splitting required. */
8211 	if (nrcpt - ndead <= maxrcpt)
8212 		return SM_SPLIT_NONE;
8213 
8214 	/* fix links */
8215 	for (i = 0; i < nrcpt - 1; ++i)
8216 		addrs[i]->q_next = addrs[i + 1];
8217 	addrs[nrcpt - 1]->q_next = NULL;
8218 	e->e_sendqueue = addrs[0];
8219 
8220 	/* prepare buffer for logging */
8221 	if (LogLevel > SPLIT_LOG_LEVEL)
8222 	{
8223 		l = MAXLINE;
8224 		lsplits = sm_malloc(l);
8225 		if (lsplits != NULL)
8226 			*lsplits = '\0';
8227 		j = 0;
8228 	}
8229 	else
8230 	{
8231 		/* get rid of stupid compiler warnings */
8232 		lsplits = NULL;
8233 		j = l = 0;
8234 	}
8235 
8236 	/* split the envelope */
8237 	firstsibling = e->e_sibling;
8238 	i = maxrcpt + ndead;
8239 	nsplit = 0;
8240 	for (;;)
8241 	{
8242 		addrs[i - 1]->q_next = NULL;
8243 		ee = split_env(e, addrs[i], e->e_qgrp, e->e_qdir);
8244 		if (!dup_df(e, ee))
8245 		{
8246 
8247 			ee = firstsibling;
8248 			while (ee != NULL)
8249 			{
8250 				(void) unlink(queuename(ee, DATAFL_LETTER));
8251 				ee = ee->e_sibling;
8252 			}
8253 
8254 			/* Error.  Restore e's sibling & recipient lists. */
8255 			e->e_sibling = firstsibling;
8256 			for (i = 0; i < nrcpt - 1; ++i)
8257 				addrs[i]->q_next = addrs[i + 1];
8258 			if (lsplits != NULL)
8259 				sm_free(lsplits);
8260 			return SM_SPLIT_FAIL;
8261 		}
8262 
8263 		/* prepend the new envelope to e->e_sibling */
8264 		ee->e_sibling = e->e_sibling;
8265 		e->e_sibling = ee;
8266 		++nsplit;
8267 		if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8268 		{
8269 			if (j >= l - strlen(ee->e_id) - 3)
8270 			{
8271 				char *p;
8272 
8273 				l += MAXLINE;
8274 				p = sm_realloc(lsplits, l);
8275 				if (p == NULL)
8276 				{
8277 					/* let's try to get this done */
8278 					sm_free(lsplits);
8279 					lsplits = NULL;
8280 				}
8281 				else
8282 					lsplits = p;
8283 			}
8284 			if (lsplits != NULL)
8285 			{
8286 				if (j == 0)
8287 					j += sm_strlcat(lsplits + j,
8288 							ee->e_id,
8289 							l - j);
8290 				else
8291 					j += sm_strlcat2(lsplits + j,
8292 							 "; ",
8293 							 ee->e_id,
8294 							 l - j);
8295 				SM_ASSERT(j < l);
8296 			}
8297 		}
8298 		if (nrcpt - i <= maxrcpt)
8299 			break;
8300 		i += maxrcpt;
8301 	}
8302 	if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8303 	{
8304 		if (nsplit > 0)
8305 		{
8306 			sm_syslog(LOG_NOTICE, e->e_id,
8307 				  "split: maxrcpts=%d, rcpts=%d, count=%d, id%s=%s",
8308 				  maxrcpt, nrcpt - ndead, nsplit,
8309 				  nsplit > 1 ? "s" : "", lsplits);
8310 		}
8311 		sm_free(lsplits);
8312 	}
8313 	return SM_SPLIT_NEW(nsplit);
8314 }
8315 /*
8316 **  SPLIT_BY_RECIPIENT
8317 **
8318 **	Split an envelope with multiple recipients into multiple
8319 **	envelopes as required by the sendmail configuration.
8320 **
8321 **	Parameters:
8322 **		e -- envelope.
8323 **
8324 **	Results:
8325 **		Returns true on success, false on failure.
8326 **
8327 **	Side Effects:
8328 **		see split_across_queue_groups(), split_within_queue(e)
8329 */
8330 
8331 bool
8332 split_by_recipient(e)
8333 	ENVELOPE *e;
8334 {
8335 	int split, n, i, j, l;
8336 	char *lsplits;
8337 	ENVELOPE *ee, *next, *firstsibling;
8338 
8339 	if (OpMode == SM_VERIFY || !ISVALIDQGRP(e->e_qgrp) ||
8340 	    bitset(EF_SPLIT, e->e_flags))
8341 		return true;
8342 	n = split_across_queue_groups(e);
8343 	if (n == SM_SPLIT_FAIL)
8344 		return false;
8345 	firstsibling = ee = e->e_sibling;
8346 	if (n > 1 && LogLevel > SPLIT_LOG_LEVEL)
8347 	{
8348 		l = MAXLINE;
8349 		lsplits = sm_malloc(l);
8350 		if (lsplits != NULL)
8351 			*lsplits = '\0';
8352 		j = 0;
8353 	}
8354 	else
8355 	{
8356 		/* get rid of stupid compiler warnings */
8357 		lsplits = NULL;
8358 		j = l = 0;
8359 	}
8360 	for (i = 1; i < n; ++i)
8361 	{
8362 		next = ee->e_sibling;
8363 		if (split_within_queue(ee) == SM_SPLIT_FAIL)
8364 		{
8365 			e->e_sibling = firstsibling;
8366 			return false;
8367 		}
8368 		ee->e_flags |= EF_SPLIT;
8369 		if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL)
8370 		{
8371 			if (j >= l - strlen(ee->e_id) - 3)
8372 			{
8373 				char *p;
8374 
8375 				l += MAXLINE;
8376 				p = sm_realloc(lsplits, l);
8377 				if (p == NULL)
8378 				{
8379 					/* let's try to get this done */
8380 					sm_free(lsplits);
8381 					lsplits = NULL;
8382 				}
8383 				else
8384 					lsplits = p;
8385 			}
8386 			if (lsplits != NULL)
8387 			{
8388 				if (j == 0)
8389 					j += sm_strlcat(lsplits + j,
8390 							ee->e_id, l - j);
8391 				else
8392 					j += sm_strlcat2(lsplits + j, "; ",
8393 							 ee->e_id, l - j);
8394 				SM_ASSERT(j < l);
8395 			}
8396 		}
8397 		ee = next;
8398 	}
8399 	if (LogLevel > SPLIT_LOG_LEVEL && lsplits != NULL && n > 1)
8400 	{
8401 		sm_syslog(LOG_NOTICE, e->e_id, "split: count=%d, id%s=%s",
8402 			  n - 1, n > 2 ? "s" : "", lsplits);
8403 		sm_free(lsplits);
8404 	}
8405 	split = split_within_queue(e) != SM_SPLIT_FAIL;
8406 	if (split)
8407 		e->e_flags |= EF_SPLIT;
8408 	return split;
8409 }
8410 
8411 /*
8412 **  QUARANTINE_QUEUE_ITEM -- {un,}quarantine a single envelope
8413 **
8414 **	Add/remove quarantine reason and requeue appropriately.
8415 **
8416 **	Parameters:
8417 **		qgrp -- queue group for the item
8418 **		qdir -- queue directory in the given queue group
8419 **		e -- envelope information for the item
8420 **		reason -- quarantine reason, NULL means unquarantine.
8421 **
8422 **	Results:
8423 **		true if item changed, false otherwise
8424 **
8425 **	Side Effects:
8426 **		Changes quarantine tag in queue file and renames it.
8427 */
8428 
8429 static bool
8430 quarantine_queue_item(qgrp, qdir, e, reason)
8431 	int qgrp;
8432 	int qdir;
8433 	ENVELOPE *e;
8434 	char *reason;
8435 {
8436 	bool dirty = false;
8437 	bool failing = false;
8438 	bool foundq = false;
8439 	bool finished = false;
8440 	int fd;
8441 	int flags;
8442 	int oldtype;
8443 	int newtype;
8444 	int save_errno;
8445 	MODE_T oldumask = 0;
8446 	SM_FILE_T *oldqfp, *tempqfp;
8447 	char *bp;
8448 	int bufsize;
8449 	char oldqf[MAXPATHLEN];
8450 	char tempqf[MAXPATHLEN];
8451 	char newqf[MAXPATHLEN];
8452 	char buf[MAXLINE];
8453 
8454 	oldtype = queue_letter(e, ANYQFL_LETTER);
8455 	(void) sm_strlcpy(oldqf, queuename(e, ANYQFL_LETTER), sizeof(oldqf));
8456 	(void) sm_strlcpy(tempqf, queuename(e, NEWQFL_LETTER), sizeof(tempqf));
8457 
8458 	/*
8459 	**  Instead of duplicating all the open
8460 	**  and lock code here, tell readqf() to
8461 	**  do that work and return the open
8462 	**  file pointer in e_lockfp.  Note that
8463 	**  we must release the locks properly when
8464 	**  we are done.
8465 	*/
8466 
8467 	if (!readqf(e, true))
8468 	{
8469 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8470 				     "Skipping %s\n", qid_printname(e));
8471 		return false;
8472 	}
8473 	oldqfp = e->e_lockfp;
8474 
8475 	/* open the new queue file */
8476 	flags = O_CREAT|O_WRONLY|O_EXCL;
8477 	if (bitset(S_IWGRP, QueueFileMode))
8478 		oldumask = umask(002);
8479 	fd = open(tempqf, flags, QueueFileMode);
8480 	if (bitset(S_IWGRP, QueueFileMode))
8481 		(void) umask(oldumask);
8482 	RELEASE_QUEUE;
8483 
8484 	if (fd < 0)
8485 	{
8486 		save_errno = errno;
8487 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8488 				     "Skipping %s: Could not open %s: %s\n",
8489 				     qid_printname(e), tempqf,
8490 				     sm_errstring(save_errno));
8491 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8492 		return false;
8493 	}
8494 	if (!lockfile(fd, tempqf, NULL, LOCK_EX|LOCK_NB))
8495 	{
8496 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8497 				     "Skipping %s: Could not lock %s\n",
8498 				     qid_printname(e), tempqf);
8499 		(void) close(fd);
8500 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8501 		return false;
8502 	}
8503 
8504 	tempqfp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT, (void *) &fd,
8505 			     SM_IO_WRONLY_B, NULL);
8506 	if (tempqfp == NULL)
8507 	{
8508 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8509 				     "Skipping %s: Could not lock %s\n",
8510 				     qid_printname(e), tempqf);
8511 		(void) close(fd);
8512 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8513 		return false;
8514 	}
8515 
8516 	/* Copy the data over, changing the quarantine reason */
8517 	while (bufsize = sizeof(buf),
8518 	       (bp = fgetfolded(buf, &bufsize, oldqfp)) != NULL)
8519 	{
8520 		if (tTd(40, 4))
8521 			sm_dprintf("+++++ %s\n", bp);
8522 		switch (bp[0])
8523 		{
8524 		  case 'q':		/* quarantine reason */
8525 			foundq = true;
8526 			if (reason == NULL)
8527 			{
8528 				if (Verbose)
8529 				{
8530 					(void) sm_io_fprintf(smioout,
8531 							     SM_TIME_DEFAULT,
8532 							     "%s: Removed quarantine of \"%s\"\n",
8533 							     e->e_id, &bp[1]);
8534 				}
8535 				sm_syslog(LOG_INFO, e->e_id, "unquarantine");
8536 				dirty = true;
8537 			}
8538 			else if (strcmp(reason, &bp[1]) == 0)
8539 			{
8540 				if (Verbose)
8541 				{
8542 					(void) sm_io_fprintf(smioout,
8543 							     SM_TIME_DEFAULT,
8544 							     "%s: Already quarantined with \"%s\"\n",
8545 							     e->e_id, reason);
8546 				}
8547 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8548 						     "q%s\n", reason);
8549 			}
8550 			else
8551 			{
8552 				if (Verbose)
8553 				{
8554 					(void) sm_io_fprintf(smioout,
8555 							     SM_TIME_DEFAULT,
8556 							     "%s: Quarantine changed from \"%s\" to \"%s\"\n",
8557 							     e->e_id, &bp[1],
8558 							     reason);
8559 				}
8560 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8561 						     "q%s\n", reason);
8562 				sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8563 					  reason);
8564 				dirty = true;
8565 			}
8566 			break;
8567 
8568 		  case 'S':
8569 			/*
8570 			**  If we are quarantining an unquarantined item,
8571 			**  need to put in a new 'q' line before it's
8572 			**  too late.
8573 			*/
8574 
8575 			if (!foundq && reason != NULL)
8576 			{
8577 				if (Verbose)
8578 				{
8579 					(void) sm_io_fprintf(smioout,
8580 							     SM_TIME_DEFAULT,
8581 							     "%s: Quarantined with \"%s\"\n",
8582 							     e->e_id, reason);
8583 				}
8584 				(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8585 						     "q%s\n", reason);
8586 				sm_syslog(LOG_INFO, e->e_id, "quarantine=%s",
8587 					  reason);
8588 				foundq = true;
8589 				dirty = true;
8590 			}
8591 
8592 			/* Copy the line to the new file */
8593 			(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8594 					     "%s\n", bp);
8595 			break;
8596 
8597 		  case '.':
8598 			finished = true;
8599 			/* FALLTHROUGH */
8600 
8601 		  default:
8602 			/* Copy the line to the new file */
8603 			(void) sm_io_fprintf(tempqfp, SM_TIME_DEFAULT,
8604 					     "%s\n", bp);
8605 			break;
8606 		}
8607 		if (bp != buf)
8608 			sm_free(bp);
8609 	}
8610 
8611 	/* Make sure we read the whole old file */
8612 	errno = sm_io_error(tempqfp);
8613 	if (errno != 0 && errno != SM_IO_EOF)
8614 	{
8615 		save_errno = errno;
8616 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8617 				     "Skipping %s: Error reading %s: %s\n",
8618 				     qid_printname(e), oldqf,
8619 				     sm_errstring(save_errno));
8620 		failing = true;
8621 	}
8622 
8623 	if (!failing && !finished)
8624 	{
8625 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8626 				     "Skipping %s: Incomplete file: %s\n",
8627 				     qid_printname(e), oldqf);
8628 		failing = true;
8629 	}
8630 
8631 	/* Check if we actually changed anything or we can just bail now */
8632 	if (!dirty)
8633 	{
8634 		/* pretend we failed, even though we technically didn't */
8635 		failing = true;
8636 	}
8637 
8638 	/* Make sure we wrote things out safely */
8639 	if (!failing &&
8640 	    (sm_io_flush(tempqfp, SM_TIME_DEFAULT) != 0 ||
8641 	     ((SuperSafe == SAFE_REALLY ||
8642 	       SuperSafe == SAFE_REALLY_POSTMILTER ||
8643 	       SuperSafe == SAFE_INTERACTIVE) &&
8644 	      fsync(sm_io_getinfo(tempqfp, SM_IO_WHAT_FD, NULL)) < 0) ||
8645 	     ((errno = sm_io_error(tempqfp)) != 0)))
8646 	{
8647 		save_errno = errno;
8648 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8649 				     "Skipping %s: Error writing %s: %s\n",
8650 				     qid_printname(e), tempqf,
8651 				     sm_errstring(save_errno));
8652 		failing = true;
8653 	}
8654 
8655 
8656 	/* Figure out the new filename */
8657 	newtype = (reason == NULL ? NORMQF_LETTER : QUARQF_LETTER);
8658 	if (oldtype == newtype)
8659 	{
8660 		/* going to rename tempqf to oldqf */
8661 		(void) sm_strlcpy(newqf, oldqf, sizeof(newqf));
8662 	}
8663 	else
8664 	{
8665 		/* going to rename tempqf to new name based on newtype */
8666 		(void) sm_strlcpy(newqf, queuename(e, newtype), sizeof(newqf));
8667 	}
8668 
8669 	save_errno = 0;
8670 
8671 	/* rename tempqf to newqf */
8672 	if (!failing &&
8673 	    rename(tempqf, newqf) < 0)
8674 		save_errno = (errno == 0) ? EINVAL : errno;
8675 
8676 	/* Check rename() success */
8677 	if (!failing && save_errno != 0)
8678 	{
8679 		sm_syslog(LOG_DEBUG, e->e_id,
8680 			  "quarantine_queue_item: rename(%s, %s): %s",
8681 			  tempqf, newqf, sm_errstring(save_errno));
8682 
8683 		(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8684 				     "Error renaming %s to %s: %s\n",
8685 				     tempqf, newqf,
8686 				     sm_errstring(save_errno));
8687 		if (oldtype == newtype)
8688 		{
8689 			/*
8690 			**  Bail here since we don't know the state of
8691 			**  the filesystem and may need to keep tempqf
8692 			**  for the user to rescue us.
8693 			*/
8694 
8695 			RELEASE_QUEUE;
8696 			errno = save_errno;
8697 			syserr("!452 Error renaming control file %s", tempqf);
8698 			/* NOTREACHED */
8699 		}
8700 		else
8701 		{
8702 			/* remove new file (if rename() half completed) */
8703 			if (xunlink(newqf) < 0)
8704 			{
8705 				save_errno = errno;
8706 				(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8707 						     "Error removing %s: %s\n",
8708 						     newqf,
8709 						     sm_errstring(save_errno));
8710 			}
8711 
8712 			/* tempqf removed below */
8713 			failing = true;
8714 		}
8715 
8716 	}
8717 
8718 	/* If changing file types, need to remove old type */
8719 	if (!failing && oldtype != newtype)
8720 	{
8721 		if (xunlink(oldqf) < 0)
8722 		{
8723 			save_errno = errno;
8724 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8725 					     "Error removing %s: %s\n",
8726 					     oldqf, sm_errstring(save_errno));
8727 		}
8728 	}
8729 
8730 	/* see if anything above failed */
8731 	if (failing)
8732 	{
8733 		/* Something failed: remove new file, old file still there */
8734 		(void) xunlink(tempqf);
8735 	}
8736 
8737 	/*
8738 	**  fsync() after file operations to make sure metadata is
8739 	**  written to disk on filesystems in which renames are
8740 	**  not guaranteed.  It's ok if they fail, mail won't be lost.
8741 	*/
8742 
8743 	if (SuperSafe != SAFE_NO)
8744 	{
8745 		/* for soft-updates */
8746 		(void) fsync(sm_io_getinfo(tempqfp,
8747 					   SM_IO_WHAT_FD, NULL));
8748 
8749 		if (!failing)
8750 		{
8751 			/* for soft-updates */
8752 			(void) fsync(sm_io_getinfo(oldqfp,
8753 						   SM_IO_WHAT_FD, NULL));
8754 		}
8755 
8756 		/* for other odd filesystems */
8757 		SYNC_DIR(tempqf, false);
8758 	}
8759 
8760 	/* Close up shop */
8761 	RELEASE_QUEUE;
8762 	if (tempqfp != NULL)
8763 		(void) sm_io_close(tempqfp, SM_TIME_DEFAULT);
8764 	if (oldqfp != NULL)
8765 		(void) sm_io_close(oldqfp, SM_TIME_DEFAULT);
8766 
8767 	/* All went well */
8768 	return !failing;
8769 }
8770 
8771 /*
8772 **  QUARANTINE_QUEUE -- {un,}quarantine matching items in the queue
8773 **
8774 **	Read all matching queue items, add/remove quarantine
8775 **	reason, and requeue appropriately.
8776 **
8777 **	Parameters:
8778 **		reason -- quarantine reason, "." means unquarantine.
8779 **		qgrplimit -- limit to single queue group unless NOQGRP
8780 **
8781 **	Results:
8782 **		none.
8783 **
8784 **	Side Effects:
8785 **		Lots of changes to the queue.
8786 */
8787 
8788 void
8789 quarantine_queue(reason, qgrplimit)
8790 	char *reason;
8791 	int qgrplimit;
8792 {
8793 	int changed = 0;
8794 	int qgrp;
8795 
8796 	/* Convert internal representation of unquarantine */
8797 	if (reason != NULL && reason[0] == '.' && reason[1] == '\0')
8798 		reason = NULL;
8799 
8800 	if (reason != NULL)
8801 	{
8802 		/* clean it */
8803 		reason = newstr(denlstring(reason, true, true));
8804 	}
8805 
8806 	for (qgrp = 0; qgrp < NumQueue && Queue[qgrp] != NULL; qgrp++)
8807 	{
8808 		int qdir;
8809 
8810 		if (qgrplimit != NOQGRP && qgrplimit != qgrp)
8811 			continue;
8812 
8813 		for (qdir = 0; qdir < Queue[qgrp]->qg_numqueues; qdir++)
8814 		{
8815 			int i;
8816 			int nrequests;
8817 
8818 			if (StopRequest)
8819 				stop_sendmail();
8820 
8821 			nrequests = gatherq(qgrp, qdir, true, NULL, NULL);
8822 
8823 			/* first see if there is anything */
8824 			if (nrequests <= 0)
8825 			{
8826 				if (Verbose)
8827 				{
8828 					(void) sm_io_fprintf(smioout,
8829 							     SM_TIME_DEFAULT, "%s: no matches\n",
8830 							     qid_printqueue(qgrp, qdir));
8831 				}
8832 				continue;
8833 			}
8834 
8835 			if (Verbose)
8836 			{
8837 				(void) sm_io_fprintf(smioout,
8838 						     SM_TIME_DEFAULT, "Processing %s:\n",
8839 						     qid_printqueue(qgrp, qdir));
8840 			}
8841 
8842 			for (i = 0; i < WorkListCount; i++)
8843 			{
8844 				ENVELOPE e;
8845 
8846 				if (StopRequest)
8847 					stop_sendmail();
8848 
8849 				/* setup envelope */
8850 				clearenvelope(&e, true, sm_rpool_new_x(NULL));
8851 				e.e_id = WorkList[i].w_name + 2;
8852 				e.e_qgrp = qgrp;
8853 				e.e_qdir = qdir;
8854 
8855 				if (tTd(70, 101))
8856 				{
8857 					sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8858 						      "Would do %s\n", e.e_id);
8859 					changed++;
8860 				}
8861 				else if (quarantine_queue_item(qgrp, qdir,
8862 							       &e, reason))
8863 					changed++;
8864 
8865 				/* clean up */
8866 				sm_rpool_free(e.e_rpool);
8867 				e.e_rpool = NULL;
8868 			}
8869 			if (WorkList != NULL)
8870 				sm_free(WorkList); /* XXX */
8871 			WorkList = NULL;
8872 			WorkListSize = 0;
8873 			WorkListCount = 0;
8874 		}
8875 	}
8876 	if (Verbose)
8877 	{
8878 		if (changed == 0)
8879 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8880 					     "No changes\n");
8881 		else
8882 			(void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
8883 					     "%d change%s\n",
8884 					     changed,
8885 					     changed == 1 ? "" : "s");
8886 	}
8887 }
8888