xref: /freebsd/usr.sbin/lpr/common_source/ctlinfo.c (revision 6990ffd8a95caaba6858ad44ff1b3157d1efba8f)
1 /*
2  * ------+---------+---------+---------+---------+---------+---------+---------*
3  * Copyright (c) 2001  - Garance Alistair Drosehn <gad@FreeBSD.org>.
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *   1. Redistributions of source code must retain the above copyright
10  *      notice, this list of conditions and the following disclaimer.
11  *   2. Redistributions in binary form must reproduce the above copyright
12  *      notice, this list of conditions and the following disclaimer in the
13  *      documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  *
27  * The views and conclusions contained in the software and documentation
28  * are those of the authors and should not be interpreted as representing
29  * official policies, either expressed or implied, of the FreeBSD Project.
30  *
31  * ------+---------+---------+---------+---------+---------+---------+---------*
32  */
33 
34 #ifndef lint
35 static const char rcsid[] =
36   "$FreeBSD$";
37 #endif /* not lint */
38 
39 /*
40  * ctlinfo - This collection of routines will know everything there is to
41  * know about the information inside a control file ('cf*') which is used
42  * to describe a print job in lpr & friends.  The eventual goal is that it
43  * will be the ONLY source file to know what's inside these control-files.
44  */
45 
46 /*
47  * Some define's useful for debuging.
48  * TRIGGERTEST_FNAME and DEBUGREADCF_FNAME, allow us to do testing on
49  * a per-spool-directory basis.
50  */
51 /* #define TRIGGERTEST_FNAME "LpdTestRenameTF" */
52 /* #define DEBUGREADCF_FNAME "LpdDebugReadCF" */
53 /* #define LEAVE_TMPCF_FILES 1 */
54 
55 #include <sys/types.h>
56 #include <sys/stat.h>
57 #include <ctype.h>
58 #include <errno.h>
59 #include <fcntl.h>
60 #include <limits.h>
61 #include <netdb.h>
62 #include <stdio.h>
63 #include <stdlib.h>
64 #include <string.h>
65 #include <syslog.h>
66 #include <unistd.h>
67 #include "ctlinfo.h"
68 
69 struct cjprivate {
70 	struct cjobinfo pub;
71 	char	*cji_buff;		/* buffer for getline */
72 	char	*cji_eobuff;		/* last byte IN the buffer */
73 	FILE	*cji_fstream;
74 	int	 cji_buffsize;		/* # bytes in the buffer */
75 	int	 cji_dumpit;
76 };
77 
78 #define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))
79 
80 /*
81  * This has to be large enough to fit the maximum length of a single line
82  * in a control-file, including the leading 'command id', a trailing '\n'
83  * and ending '\0'.  The max size of an 'U'nlink line, for instance, is
84  * 1 ('U') + PATH_MAX (filename) + 2 ('\n\0').  The maximum 'H'ost line is
85  * 1 ('H') + NI_MAXHOST (remote hostname) + 2 ('\n\0').  Other lines can be
86  * even longer than those.  So, pick some nice, large, arbitrary value.
87  */
88 #define CTI_LINEMAX  PATH_MAX+NI_MAXHOST+5
89 
90 extern const char	*from_host;	/* client's machine name */
91 extern const char	*from_ip;	/* client machine's IP address */
92 
93 __BEGIN_DECLS
94 void		 ctl_dumpcji(FILE *_dbg_stream, const char *_heading,
95 		    struct cjobinfo *_cjinf);
96 void		 ctl_freeinf(struct cjobinfo *_cjinf);
97 static char	*ctl_getline(struct cjobinfo *_cjinf);
98 struct cjobinfo	*ctl_readcf(const char *_ptrname, const char *_cfname);
99 static void	 ctl_rewindcf(struct cjobinfo *_cjinf);
100 char		*ctl_rmjob(const char *_ptrname, const char *_cfname);
101 __END_DECLS
102 
103 /*
104  * Here are some things which might be needed when compiling this under
105  * platforms other than FreeBSD.
106  */
107 #ifndef __FreeBSD__
108 #   ifndef NAME_MAX
109 #	define NAME_MAX	255
110 #   endif
111 #   ifndef NI_MAXHOST
112 #	define NI_MAXHOST	1025
113 #   endif
114 #   ifndef PATH_MAX
115 #	define PATH_MAX	1024
116 #   endif
117 __BEGIN_DECLS
118 char		*strdup(const char *_src);
119 size_t		 strlcpy(char *_dst, const char *_src, size_t _siz);
120 __END_DECLS
121 #endif
122 
123 /*
124  *	Control-files (cf*) have the following format.
125  *
126  *	Each control-file describes a single job.  It will list one or more
127  *	"datafiles" (df*) which should be copied to some printer.  Usually
128  *	there is only one datafile per job.  For the curious, RFC 1179 is an
129  *	informal and out-of-date description of lpr/lpd circa 1990.
130  *
131  *	Each line in the file gives an attribute of the job as a whole, or one
132  *	of the datafiles in the job, or a "command" indicating something to do
133  *	with one of the datafiles.  Each line starts with an 'id' that indicates
134  *	what that line is there for.  The 'id' is historically a single byte,
135  *	but may be multiple bytes (obviously it would be best if multi-byte ids
136  *	started with some letter not already used as a single-byte id!).
137  *	After the 'id', the remainder of the line will be the value of the
138  *	indicated attribute, or a name of the datafile to be operated on.
139  *
140  *	In the following lists of ids, the ids with a '!' in front of them are
141  *	NOT explicitly supported by this version of lpd, or at least "not yet
142  *	supported".  They are only listed for reference purposes, so people
143  *	won't be tempted to reuse the same id for a different purpose.
144  *
145  *	The following are attributes of the job which should not appear more
146  *	than once in a control file.  Only the 'H' and 'P' lines are required
147  *	by the RFC, but some implementations of lpr won't even get that right.
148  *
149  *	! A   - [used by lprNG]
150  *	  B   - As far as I know, this is never used as a single-byte id.
151  *		Therefore, I intend to use it for multi-byte id codes.
152  *	  C   - "class name" to display on banner page (this is sometimes
153  *		used to hold options for print filters)
154  *	! D   - [in lprNG, "timestamp" of when the job was submitted]
155  *	! E   - "environment variables" to set [some versions of linux]
156  *	  H   - "host name" of machine where the original 'lpr' was done
157  *	  I   - "indent", the amount to indent output
158  *	  J   - "job name" to display on banner page
159  *	  L   - "literal" user's name as it should be displayed on the
160  *		banner page (it is the existence of an 'L' line which
161  *		indicates that a job should have a banner page).
162  *	  M   - "mail", userid to mail to when done printing (with email
163  *		going to 'M'@'H', so to speak).
164  *	  P   - "person", the user's login name (e.g. for accounting)
165  *	! Q   - [used by lprNG for queue-name]
166  *	  R   - "resolution" in dpi, for some laser printer queues
167  *	  T   - "title" for files sent thru 'pr'
168  *	  W   - "width" to use for printing plain-text files
169  *	  Z   - In BSD, "locale" to use for datafiles sent thru 'pr'.
170  *		(this BSD usage should move to a different id...)
171  *		[in lprNG - this line holds the "Z options"]
172  *	  1   - "R font file" for files sent thru troff
173  *	  2   - "I font file" for files sent thru troff
174  *	  3   - "B font file" for files sent thru troff
175  *	  4   - "S font file" for files sent thru troff
176  *
177  *	The following are attributes attached to a datafile, and thus may
178  *	appear multiple times in a control file (once per datafile):
179  *
180  *	  N   - "name" of file (for display purposes, used by 'lpq')
181  *	  S   - "stat() info" used for symbolic link ('lpr -s')
182  *		security checks.
183  *
184  *	The following indicate actions to take on a given datafile.  The same
185  *	datafile may appear on more than one "print this file" command in the
186  *	control file.  Note that ALL ids with lowercase letters are commands
187  *	to "print this file":
188  *
189  *	  f   - "file name", a plain-text file to print
190  *	  l   - "file name", text file with control chars to print (some
191  *		printers recognize this id as a request to print a
192  *		postscript file)
193  *	  p   - "file name", text file to print with pr(1)
194  *	  t   - "file name", troff(1) file to print
195  *	  n   - "file name", ditroff(1) file to print
196  *	  d   - "file name", dvi file to print
197  *	  g   - "file name", plot(1G) file to print
198  *	  v   - "file name", plain raster file to print
199  *	  c   - "file name", cifplot file to print
200  *
201  *	  U   - "file name" of datafile to unlink (ie, remove file
202  *		from spool directory.  To be done in a 'Pass 2',
203  *		AFTER having processed all datafiles in the job).
204  *
205  */
206 
207 void
208 ctl_freeinf(struct cjobinfo *cjinf)
209 {
210 #define FREESTR(xStr) \
211 	if (xStr != NULL) { \
212 		free(xStr); \
213 		xStr = NULL;\
214 	}
215 
216 	struct cjprivate *cpriv;
217 
218 	if (cjinf == NULL)
219 		return;
220 	cpriv = cjinf->cji_priv;
221 	if ((cpriv == NULL) || (cpriv != cpriv->pub.cji_priv)) {
222 		syslog(LOG_ERR, "in ctl_freeinf(%p): invalid cjinf (cpriv %p)",
223 		    cjinf, cpriv);
224 		return;
225 	}
226 
227 	FREESTR(cpriv->pub.cji_accthost);
228 	FREESTR(cpriv->pub.cji_acctuser);
229 	FREESTR(cpriv->pub.cji_class);
230 	FREESTR(cpriv->pub.cji_curqueue);
231 	/* [cpriv->pub.cji_fname is part of cpriv-malloced area] */
232 	FREESTR(cpriv->pub.cji_jobname);
233 	FREESTR(cpriv->pub.cji_mailto);
234 	FREESTR(cpriv->pub.cji_username);
235 
236 	if (cpriv->cji_fstream != NULL) {
237 		fclose(cpriv->cji_fstream);
238 		cpriv->cji_fstream = NULL;
239 	}
240 
241 	cjinf->cji_priv = NULL;
242 	free(cpriv);
243 #undef FREESTR
244 }
245 
246 #ifdef DEBUGREADCF_FNAME
247 static FILE *ctl_dbgfile = NULL;
248 static struct stat ctl_dbgstat;
249 #endif
250 static int ctl_dbgline = 0;
251 
252 struct cjobinfo *
253 ctl_readcf(const char *ptrname, const char *cfname)
254 {
255 	int id;
256 	char *lbuff;
257 	void *cstart;
258 	FILE *cfile;
259 	struct cjprivate *cpriv;
260 	struct cjobinfo *cjinf;
261 	size_t msize, sroom, sroom2;
262 
263 	cfile = fopen(cfname, "r");
264 	if (cfile == NULL) {
265 		syslog(LOG_ERR, "%s: ctl_readcf error fopen(%s): %s",
266 		    ptrname, cfname, strerror(errno));
267 		return NULL;
268 	}
269 
270 	sroom = roundup(sizeof(struct cjprivate), 8);
271 	sroom2 = sroom + strlen(cfname) + 1;
272 	sroom2 = roundup(sroom2, 8);
273 	msize = sroom2 + CTI_LINEMAX;
274 	msize = roundup(msize, 8);
275 	cstart = malloc(msize);
276 	if (cstart == NULL)
277 		return NULL;
278 	memset(cstart, 0, msize);
279 	cpriv = (struct cjprivate *)cstart;
280 	cpriv->pub.cji_priv = cpriv;
281 
282 	cpriv->pub.cji_fname = (char *)cstart + sroom;
283 	strcpy(cpriv->pub.cji_fname, cfname);
284 	cpriv->cji_buff = (char *)cstart + sroom2;
285 	cpriv->cji_buffsize = (int)(msize - sroom2);
286 	cpriv->cji_eobuff = (char *)cstart + msize - 1;
287 
288 	cpriv->cji_fstream = cfile;
289 	cpriv->pub.cji_curqueue = strdup(ptrname);
290 
291 	ctl_dbgline = 0;
292 #ifdef DEBUGREADCF_FNAME
293 	ctl_dbgfile = NULL;
294 	id = stat(DEBUGREADCF_FNAME, &ctl_dbgstat);
295 	if (id != -1) {
296 		/* the file exists in this spool directory, write some simple
297 		 * debugging info to it */
298 		ctl_dbgfile = fopen(DEBUGREADCF_FNAME, "a");
299 		if (ctl_dbgfile != NULL) {
300 			fprintf(ctl_dbgfile, "%s: s=%p r=%ld e=%p %p->%s\n",
301 			    ptrname, cpriv, (long)sroom, cpriv->cji_eobuff,
302 			    cpriv->pub.cji_fname, cpriv->pub.cji_fname);
303 		}
304 	}
305 #endif
306 	/*
307 	 * Copy job-attribute values from control file to the struct of
308 	 * "public" information.  In some cases, it is invalid for the
309 	 * value to be a null-string, so that is ignored.
310 	 */
311 	cjinf = &(cpriv->pub);
312 	lbuff = ctl_getline(cjinf);
313 	while (lbuff != NULL) {
314 		id = *lbuff++;
315 		switch (id) {
316 		case 'C':
317 			cpriv->pub.cji_class = strdup(lbuff);
318 			break;
319 		case 'H':
320 			if (*lbuff == '\0')
321 				break;
322 			cpriv->pub.cji_accthost = strdup(lbuff);
323 			break;
324 		case 'J':
325 			cpriv->pub.cji_jobname = strdup(lbuff);
326 			break;
327 		case 'L':
328 			cpriv->pub.cji_username = strdup(lbuff);
329 			break;
330 		case 'M':
331 			/*
332 			 * No valid mail-to address would start with a minus.
333 			 * If this one does, it is probably some trickster who
334 			 * is trying to trigger options on sendmail.  Ignore.
335 			 */
336 			if (*lbuff == '-')
337 				break;
338 			if (*lbuff == '\0')
339 				break;
340 			cpriv->pub.cji_mailto = strdup(lbuff);
341 			break;
342 		case 'P':
343 			/* don't allow userid's with a leading minus, either */
344 			if (*lbuff == '-')
345 				break;
346 			if (*lbuff == '\0')
347 				break;
348 			cpriv->pub.cji_acctuser = strdup(lbuff);
349 			break;
350 		default:
351 			if (islower(id)) {
352 				cpriv->pub.cji_dfcount++;
353 			}
354 			break;
355 		}
356 		lbuff = ctl_getline(cjinf);
357 	}
358 
359 	/* the 'H'ost and 'P'erson fields are *always* supposed to be there */
360 	if (cpriv->pub.cji_accthost == NULL)
361 		cpriv->pub.cji_accthost = strdup(".na.");
362 	if (cpriv->pub.cji_acctuser == NULL)
363 		cpriv->pub.cji_acctuser = strdup(".na.");
364 
365 #ifdef DEBUGREADCF_FNAME
366 	if (ctl_dbgfile != NULL) {
367 		if (cpriv->cji_dumpit)
368 			ctl_dumpcji(ctl_dbgfile, "end readcf", &(cpriv->pub));
369 		fclose(ctl_dbgfile);
370 		ctl_dbgfile = NULL;
371 	}
372 #endif
373 	return &(cpriv->pub);
374 }
375 
376 /*
377  * This routine renames the temporary control file as received from some
378  * other (remote) host.  That file will always start with 'tfA*', because
379  * that's the name it is created with in recvjob.c.  This will rewrite
380  * the file to 'tfB*' (correcting any lines which need correcting), rename
381  * 'tfB*' to 'cfA*', and then remove the original 'tfA*' file.
382  *
383  * The purpose of this routine is to be a little paranoid about the contents
384  * of that control file.  It is partially meant to protect against people
385  * TRYING to cause trouble (perhaps after breaking into root of some host
386  * that this host will accept print jobs from).  The fact that we're willing
387  * to print jobs from some remote host does not mean that we should blindly
388  * do anything that host tells us to do.
389  *
390  * This is also meant to protect us from errors in other implementations of
391  * lpr, particularly since we may want to use some values from the control
392  * file as environment variables when it comes time to print, or as parameters
393  * to commands which will be exec'ed, or values in statistics records.
394  *
395  * This may also do some "conversions" between how different versions of
396  * lpr or lprNG define the contents of various lines in a control file.
397  *
398  * If there is an error, it returns a pointer to a descriptive error message.
399  * Error messages which are RETURNED (as opposed to syslog-ed) do not include
400  * the printer-queue name.  Let the caller add that if it is wanted.
401  */
402 char *
403 ctl_renametf(const char *ptrname, const char *tfname)
404 {
405 	int res, newfd, nogood;
406 	FILE *newcf;
407 	struct cjobinfo *cjinf;
408 	char *lbuff, *slash, *cp;
409 	char tfname2[NAME_MAX+1], cfname2[NAME_MAX+1];
410 	char errm[CTI_LINEMAX];
411 
412 #ifdef TRIGGERTEST_FNAME
413 	struct stat tstat;
414 	res = stat(TRIGGERTEST_FNAME, &tstat);
415 	if (res == -1) {
416 		/*
417 		 * if the trigger file does NOT exist in this spool directory,
418 		 * then do the exact same steps that the pre-ctlinfo code had
419 		 * been doing.  Ie, very little.
420 		 */
421 		strlcpy(cfname2, tfname, sizeof(cfname2));
422 		cfname2[0] = 'c';
423 		res = link(tfname, cfname2);
424 		if (res < 0) {
425 			snprintf(errm, sizeof(errm),
426 			    "ctl_renametf error link(%s,%s): %s", tfname,
427 			    cfname2, strerror(errno));
428 			return strdup(errm);
429 		}
430 		unlink(tfname);
431 		return NULL;
432 	}
433 #endif
434 	cjinf = NULL;		/* in case of early jump to error_ret */
435 	newcf = NULL;		/* in case of early jump to error_ret */
436 	*errm = '\0';		/* in case of early jump to error_ret */
437 
438 	if (strncmp(tfname, "tfA", (size_t)3) != 0) {
439 		snprintf(errm, sizeof(errm),
440 		    "ctl_renametf invalid filename: %s", tfname);
441 		goto error_ret;
442 	}
443 
444 	cjinf = ctl_readcf(ptrname, tfname);
445 	if (cjinf == NULL) {
446 		snprintf(errm, sizeof(errm),
447 		    "ctl_renametf error cti_readcf(%s)", tfname);
448 		goto error_ret;
449 	}
450 
451 	/*
452 	 * This uses open+fdopen instead of fopen because that combination
453 	 * gives us greater control over file-creation issues.
454 	 */
455 	strlcpy(tfname2, tfname, sizeof(tfname2));
456 	tfname2[2] = 'B';		/* tfB<job><hostname> */
457 	newfd = open(tfname2, O_WRONLY|O_CREAT|O_TRUNC, 0660);
458 	if (newfd == -1) {
459 		snprintf(errm, sizeof(errm),
460 		    "ctl_renametf error open(%s): %s", tfname2,
461 		    strerror(errno));
462 		goto error_ret;
463 	}
464 	newcf = fdopen(newfd, "w");
465 	if (newcf == NULL) {
466 		close(newfd);
467 		snprintf(errm, sizeof(errm),
468 		    "ctl_renametf error fopen(%s): %s", tfname2,
469 		    strerror(errno));
470 		goto error_ret;
471 	}
472 
473 	/*
474 	 * Do extra sanity checks on some key job-attribute fields, and
475 	 * write them out first (thus making sure they are written in the
476 	 * order we generally expect them to be in).
477 	 */
478 	/*
479 	 * Some lpr implementations on PC's set a null-string for their
480 	 * hostname.  A MacOS 10 system which has not correctly setup
481 	 * /etc/hostconfig will claim a hostname of 'localhost'.  Anything
482 	 * with blanks in it would be an invalid value for hostname.  For
483 	 * any of these invalid hostname values, replace the given value
484 	 * with the name of the host that this job is coming from.
485 	 */
486 	nogood = 0;
487 	if (cjinf->cji_accthost == NULL)
488 		nogood = 1;
489 	else if (strcmp(cjinf->cji_accthost, ".na.") == 0)
490 		nogood = 1;
491 	else if (strcmp(cjinf->cji_accthost, "localhost") == 0)
492 		nogood = 1;
493 	else {
494 		for (cp = cjinf->cji_accthost; *cp != '\0'; cp++) {
495 			if (*cp <= ' ') {
496 				nogood = 1;
497 				break;
498 			}
499 		}
500 	}
501 	if (nogood)
502 		fprintf(newcf, "H%s\n", from_host);
503 	else
504 		fprintf(newcf, "H%s\n", cjinf->cji_accthost);
505 
506 	/*
507 	 * Now do some sanity checks on the 'P' (original userid) value.  Note
508 	 * that the 'P'erson line is the second line which is ALWAYS supposed
509 	 * to be present in a control file.
510 	 *
511 	 * There is no particularly good value to use for replacements, but
512 	 * at least make sure the value is something reasonable to use in
513 	 * environment variables and statistics records.  Again, some PC
514 	 * implementations send a null-string for a value.  Various Mac
515 	 * implementations will set whatever string the user has set for
516 	 * their 'Owner Name', which usually includes blanks, etc.
517 	 */
518 	nogood = 0;
519 	if (cjinf->cji_acctuser == NULL)
520 		nogood = 1;
521 	else {
522 		for (cp = cjinf->cji_acctuser; *cp != '\0'; cp++) {
523 			if (*cp <= ' ')
524 				*cp = '_';
525 		}
526 	}
527 	if (nogood)
528 		fprintf(newcf, "P%s\n", ".na.");
529 	else
530 		fprintf(newcf, "P%s\n", cjinf->cji_acctuser);
531 
532 	/* No need for sanity checks on class, jobname, "literal" user. */
533 	if (cjinf->cji_class != NULL)
534 		fprintf(newcf, "C%s\n", cjinf->cji_class);
535 	if (cjinf->cji_jobname != NULL)
536 		fprintf(newcf, "J%s\n", cjinf->cji_jobname);
537 	if (cjinf->cji_username != NULL)
538 		fprintf(newcf, "L%s\n", cjinf->cji_username);
539 
540 	/*
541 	 * This should probably add more sanity checks on mailto value.
542 	 * Note that if the mailto value is "wrong", then there's no good
543 	 * way to know what the "correct" value would be, and we should not
544 	 * semd email to some random address.  At least for now, just ignore
545 	 * any invalid values.
546 	 */
547 	nogood = 0;
548 	if (cjinf->cji_mailto == NULL)
549 		nogood = 1;
550 	else {
551 		for (cp = cjinf->cji_acctuser; *cp != '\0'; cp++) {
552 			if (*cp <= ' ') {
553 				nogood = 1;
554 				break;
555 			}
556 		}
557 	}
558 	if (!nogood)
559 		fprintf(newcf, "M%s\n", cjinf->cji_mailto);
560 
561 	/*
562 	 * Now go thru the old control file, copying all information which
563 	 * hasn't already been written into the new file.
564 	 */
565 	ctl_rewindcf(cjinf);
566 	lbuff = ctl_getline(cjinf);
567 	while (lbuff != NULL) {
568 		switch (lbuff[0]) {
569 		case 'H':
570 		case 'P':
571 		case 'C':
572 		case 'J':
573 		case 'L':
574 		case 'M':
575 			/* already wrote values for these to the newcf */
576 			break;
577 		case 'N':
578 			/* see comments under 'U'... */
579 			if (cjinf->cji_dfcount == 0) {
580 				/* in this case, 'N's will be done in 'U' */
581 				break;
582 			}
583 			fprintf(newcf, "%s\n", lbuff);
584 			break;
585 		case 'U':
586 			/*
587 			 * check for the very common case where the remote
588 			 * host had to process 'lpr -s -r', but it did not
589 			 * remove the Unlink line from the control file.
590 			 * Such Unlink lines will legitimately have a '/' in
591 			 * them, but it is the original lpr host which would
592 			 * have done the unlink of such files, and not any
593 			 * host receiving that job.
594 			 */
595 			slash = strchr(lbuff, '/');
596 			if (slash != NULL) {
597 				break;		/* skip this line */
598 			}
599 			/*
600 			 * Okay, another kind of broken lpr implementation
601 			 * is one which send datafiles, and Unlink's those
602 			 * datafiles, but never includes any PRINT request
603 			 * for those files.  Experimentation shows that one
604 			 * copy of those datafiles should be printed with a
605 			 * format of 'f'.  If this is an example of such a
606 			 * screwed-up control file, fix it here.
607 			 */
608 			if (cjinf->cji_dfcount == 0) {
609 				lbuff++;
610 				if (strncmp(lbuff, "df", (size_t)2) == 0) {
611 					fprintf(newcf, "f%s\n", lbuff);
612 					fprintf(newcf, "U%s\n", lbuff);
613 					fprintf(newcf, "N%s\n", lbuff);
614 				}
615 				break;
616 			}
617 			fprintf(newcf, "%s\n", lbuff);
618 			break;
619 		default:
620 			fprintf(newcf, "%s\n", lbuff);
621 			break;
622 		}
623 		lbuff = ctl_getline(cjinf);
624 	}
625 
626 	ctl_freeinf(cjinf);
627 	cjinf = NULL;
628 
629 	res = fclose(newcf);
630 	newcf = NULL;
631 	if (res != 0) {
632 		snprintf(errm, sizeof(errm),
633 		    "ctl_renametf error fclose(%s): %s", tfname2,
634 		    strerror(errno));
635 		goto error_ret;
636 	}
637 
638 	strlcpy(cfname2, tfname, sizeof(cfname2));
639 	cfname2[0] = 'c';		/* rename new file to 'cfA*' */
640 	res = link(tfname2, cfname2);
641 	if (res != 0) {
642 		snprintf(errm, sizeof(errm),
643 		    "ctl_renametf error link(%s,%s): %s", tfname2, cfname2,
644 		    strerror(errno));
645 		goto error_ret;
646 	}
647 
648 	/* All the important work is done.  Now just remove temp files */
649 #ifdef LEAVE_TMPCF_FILES
650 	{
651 		struct stat tfstat;
652 		size_t size1;
653 		tfstat.st_size = 1;	/* certainly invalid value */
654 		res = stat(tfname, &tfstat);
655 		size1 = tfstat.st_size;
656 		tfstat.st_size = 2;	/* certainly invalid value */
657 		res = stat(tfname2, &tfstat);
658 		/* if the sizes do not match, or either stat call failed,
659 		 * then do not remove the temp files, but return "all OK".
660 		 * This is just so I can see what this routine had changed.
661 		 */
662 		if (size1 != tfstat.st_size)
663 			return NULL;
664 	}
665 #endif
666 	unlink(tfname);
667 	unlink(tfname2);
668 
669 	return NULL;
670 
671 error_ret:
672 	if (cjinf != NULL)
673 		ctl_freeinf(cjinf);
674 	if (newcf != NULL)
675 		fclose(newcf);
676 
677 	if (*errm != '\0')
678 		return strdup(errm);
679 	return strdup("ctl_renametf internal (missed) error");
680 }
681 
682 void
683 ctl_rewindcf(struct cjobinfo *cjinf)
684 {
685 	struct cjprivate *cpriv;
686 
687 	if (cjinf == NULL)
688 		return;
689 	cpriv = cjinf->cji_priv;
690 	if ((cpriv == NULL) || (cpriv != cpriv->pub.cji_priv)) {
691 		syslog(LOG_ERR, "in ctl_rewindcf(%p): invalid cjinf (cpriv %p)",
692 		    cjinf, cpriv);
693 		return;
694 	}
695 
696 	rewind(cpriv->cji_fstream);		/* assume no errors... :-) */
697 }
698 
699 char *
700 ctl_rmjob(const char *ptrname, const char *cfname)
701 {
702 	struct cjobinfo	*cjinf;
703 	char *lbuff;
704 	char errm[CTI_LINEMAX];
705 
706 	cjinf = ctl_readcf(ptrname, cfname);
707 	if (cjinf == NULL) {
708 		snprintf(errm, sizeof(errm),
709 		    "ctl_renametf error cti_readcf(%s)", cfname);
710 		return strdup(errm);
711 	}
712 
713 	ctl_rewindcf(cjinf);
714 	lbuff = ctl_getline(cjinf);
715 	while (lbuff != NULL) {
716 		/* obviously we need to fill in the following... */
717 		switch (lbuff[0]) {
718 		case 'S':
719 			break;
720 		case 'U':
721 			break;
722 		default:
723 			break;
724 		}
725 		lbuff = ctl_getline(cjinf);
726 	}
727 
728 	ctl_freeinf(cjinf);
729 	cjinf = NULL;
730 
731 	return NULL;
732 }
733 
734 /*
735  * The following routine was originally written to pin down a bug.  It is
736  * no longer needed for that problem, but may be useful to keep around for
737  * other debugging.
738  */
739 void
740 ctl_dumpcji(FILE *dbg_stream, const char *heading, struct cjobinfo *cjinf)
741 {
742 #define PRINTSTR(xHdr,xStr) \
743 	astr = xStr; \
744 	ctl_dbgline++; \
745 	fprintf(dbg_stream, "%4d] %12s = ", ctl_dbgline, xHdr); \
746 	if (astr == NULL) \
747 		fprintf(dbg_stream, "NULL\n"); \
748 	else \
749 		fprintf(dbg_stream, "%p -> %s\n", astr, astr)
750 
751 	struct cjprivate *cpriv;
752 	char *astr;
753 
754 	if (cjinf == NULL) {
755 		fprintf(dbg_stream,
756 		    "ctl_dumpcji: ptr to cjobinfo for '%s' is NULL\n",
757 		    heading);
758 		return;
759 	}
760 	cpriv = cjinf->cji_priv;
761 
762 	fprintf(dbg_stream, "ctl_dumpcji: Dump '%s' of cjobinfo at %p->%p\n",
763 	    heading, cjinf, cpriv->cji_buff);
764 
765 	PRINTSTR("accthost.H", cpriv->pub.cji_accthost);
766 	PRINTSTR("acctuser.P", cpriv->pub.cji_acctuser);
767 	PRINTSTR("class.C", cpriv->pub.cji_class);
768 	PRINTSTR("cf-qname", cpriv->pub.cji_curqueue);
769 	PRINTSTR("cf-fname", cpriv->pub.cji_fname);
770 	PRINTSTR("jobname.J", cpriv->pub.cji_jobname);
771 	PRINTSTR("mailto.M", cpriv->pub.cji_mailto);
772 	PRINTSTR("hdruser.L", cpriv->pub.cji_username);
773 
774 	ctl_dbgline++;
775 	fprintf(dbg_stream, "%4d] %12s = ", ctl_dbgline, "*cjprivate");
776 	if (cpriv->pub.cji_priv == NULL)
777 		fprintf(dbg_stream, "NULL !!\n");
778 	else
779 		fprintf(dbg_stream, "%p\n", cpriv->pub.cji_priv);
780 
781 	fprintf(dbg_stream, "|- - - - --> Dump '%s' complete\n", heading);
782 
783 	/* flush output for the benefit of anyone doing a 'tail -f' */
784 	fflush(dbg_stream);
785 
786 #undef PRINTSTR
787 }
788 
789 /*
790  * This routine reads in the next line from the control-file, and removes
791  * the trailing newline character.
792  *
793  * Historical note: Earlier versions of this routine did tab-expansion for
794  * ALL lines read in, which did not make any sense for most of the lines
795  * in a control file.  For the lines where tab-expansion is useful, it will
796  * now have to be done by the calling routine.
797  */
798 static char *
799 ctl_getline(struct cjobinfo *cjinf)
800 {
801 	char *strp, *nl;
802 	struct cjprivate *cpriv;
803 
804 	if (cjinf == NULL)
805 		return NULL;
806 	cpriv = cjinf->cji_priv;
807 	if ((cpriv == NULL) || (cpriv != cpriv->pub.cji_priv)) {
808 		syslog(LOG_ERR, "in ctl_getline(%p): invalid cjinf (cpriv %p)",
809 		    cjinf, cpriv);
810 		return NULL;
811 	}
812 
813 	errno = 0;
814 	strp = fgets(cpriv->cji_buff, cpriv->cji_buffsize, cpriv->cji_fstream);
815 	if (strp == NULL) {
816 		if (errno != 0)
817 			syslog(LOG_ERR, "%s: ctl_getline error fgets(%s): %s",
818 			    cpriv->pub.cji_curqueue, cpriv->pub.cji_fname,
819 			    strerror(errno));
820 		return NULL;
821 	}
822 	nl = strchr(strp, '\n');
823 	if (nl != NULL)
824 		*nl = '\0';
825 
826 #ifdef DEBUGREADCF_FNAME
827 	/* I'd like to find out if the previous work to expand tabs was ever
828 	 * really used, and if so, on what lines and for what reason.
829 	 * Yes, all this work probably means I'm obsessed about this 'tab'
830 	 * issue, but isn't programming a matter of obsession?
831 	 */
832 	{
833 		int tabcnt;
834 		char *ch;
835 
836 		tabcnt = 0;
837 		ch = strp;
838 		for (ch = strp; *ch != '\0'; ch++) {
839 			if (*ch == '\t')
840 				tabcnt++;
841 		}
842 
843 		if (tabcnt && (ctl_dbgfile != NULL)) {
844 			cpriv->cji_dumpit++;
845 			fprintf(ctl_dbgfile, "%s: tabs=%d '%s'\n",
846 			    cpriv->pub.cji_fname, tabcnt, cpriv->cji_buff);
847 		}
848 	}
849 #endif
850 	return strp;
851 }
852