OpenSolaris_b135/cmd/sendmail/src/recipient.c
/*
* Copyright (c) 1998-2003, 2006 Sendmail, Inc. and its suppliers.
* All rights reserved.
* Copyright (c) 1983, 1995-1997 Eric P. Allman. All rights reserved.
* Copyright (c) 1988, 1993
* The Regents of the University of California. All rights reserved.
*
* By using this file, you agree to the terms and conditions set
* forth in the LICENSE file which can be found at the top level of
* the sendmail distribution.
*
*/
#pragma ident "%Z%%M% %I% %E% SMI"
#include <sendmail.h>
SM_RCSID("@(#)$Id: recipient.c,v 8.349 2007/07/10 17:01:22 ca Exp $")
static void includetimeout __P((int));
static ADDRESS *self_reference __P((ADDRESS *));
static int sortexpensive __P((ADDRESS *, ADDRESS *));
static int sortbysignature __P((ADDRESS *, ADDRESS *));
static int sorthost __P((ADDRESS *, ADDRESS *));
typedef int sortfn_t __P((ADDRESS *, ADDRESS *));
/*
** SORTHOST -- strcmp()-like func for host portion of an ADDRESS
**
** Parameters:
** xx -- first ADDRESS
** yy -- second ADDRESS
**
** Returns:
** <0 when xx->q_host is less than yy->q_host
** >0 when xx->q_host is greater than yy->q_host
** 0 when equal
*/
static int
sorthost(xx, yy)
register ADDRESS *xx;
register ADDRESS *yy;
{
#if _FFR_HOST_SORT_REVERSE
/* XXX maybe compare hostnames from the end? */
return sm_strrevcasecmp(xx->q_host, yy->q_host);
#else /* _FFR_HOST_SORT_REVERSE */
return sm_strcasecmp(xx->q_host, yy->q_host);
#endif /* _FFR_HOST_SORT_REVERSE */
}
/*
** SORTEXPENSIVE -- strcmp()-like func for expensive mailers
**
** The mailer has been noted already as "expensive" for 'xx'. This
** will give a result relative to 'yy'. Expensive mailers get rated
** "greater than" non-expensive mailers because during the delivery phase
** it will get queued -- no use it getting in the way of less expensive
** recipients. We avoid an MX RR lookup when both 'xx' and 'yy' are
** expensive since an MX RR lookup happens when extracted from the queue
** later.
**
** Parameters:
** xx -- first ADDRESS
** yy -- second ADDRESS
**
** Returns:
** <0 when xx->q_host is less than yy->q_host and both are
** expensive
** >0 when xx->q_host is greater than yy->q_host, or when
** 'yy' is non-expensive
** 0 when equal (by expense and q_host)
*/
static int
sortexpensive(xx, yy)
ADDRESS *xx;
ADDRESS *yy;
{
if (!bitnset(M_EXPENSIVE, yy->q_mailer->m_flags))
return 1; /* xx should go later */
#if _FFR_HOST_SORT_REVERSE
/* XXX maybe compare hostnames from the end? */
return sm_strrevcasecmp(xx->q_host, yy->q_host);
#else /* _FFR_HOST_SORT_REVERSE */
return sm_strcasecmp(xx->q_host, yy->q_host);
#endif /* _FFR_HOST_SORT_REVERSE */
}
/*
** SORTBYSIGNATURE -- a strcmp()-like func for q_mailer and q_host in ADDRESS
**
** Parameters:
** xx -- first ADDRESS
** yy -- second ADDRESS
**
** Returns:
** 0 when the "signature"'s are same
** <0 when xx->q_signature is less than yy->q_signature
** >0 when xx->q_signature is greater than yy->q_signature
**
** Side Effect:
** May set ADDRESS pointer for q_signature if not already set.
*/
static int
sortbysignature(xx, yy)
ADDRESS *xx;
ADDRESS *yy;
{
register int ret;
/* Let's avoid redoing the signature over and over again */
if (xx->q_signature == NULL)
xx->q_signature = hostsignature(xx->q_mailer, xx->q_host);
if (yy->q_signature == NULL)
yy->q_signature = hostsignature(yy->q_mailer, yy->q_host);
ret = strcmp(xx->q_signature, yy->q_signature);
/*
** If the two signatures are the same then we will return a sort
** value based on 'q_user'. But note that we have reversed xx and yy
** on purpose. This additional compare helps reduce the number of
** sameaddr() calls and loops in recipient() for the case when
** the rcpt list has been provided already in-order.
*/
if (ret == 0)
return strcmp(yy->q_user, xx->q_user);
else
return ret;
}
/*
** SENDTOLIST -- Designate a send list.
**
** The parameter is a comma-separated list of people to send to.
** This routine arranges to send to all of them.
**
** Parameters:
** list -- the send list.
** ctladdr -- the address template for the person to
** send to -- effective uid/gid are important.
** This is typically the alias that caused this
** expansion.
** sendq -- a pointer to the head of a queue to put
** these people into.
** aliaslevel -- the current alias nesting depth -- to
** diagnose loops.
** e -- the envelope in which to add these recipients.
**
** Returns:
** The number of addresses actually on the list.
*/
/* q_flags bits inherited from ctladdr */
#define QINHERITEDBITS (QPINGONSUCCESS|QPINGONFAILURE|QPINGONDELAY|QHASNOTIFY)
int
sendtolist(list, ctladdr, sendq, aliaslevel, e)
char *list;
ADDRESS *ctladdr;
ADDRESS **sendq;
int aliaslevel;
register ENVELOPE *e;
{
register char *p;
register ADDRESS *SM_NONVOLATILE al; /* list of addresses to send to */
SM_NONVOLATILE char delimiter; /* the address delimiter */
SM_NONVOLATILE int naddrs;
SM_NONVOLATILE int i;
char *endp;
char *oldto = e->e_to;
char *SM_NONVOLATILE bufp;
char buf[MAXNAME + 1];
if (list == NULL)
{
syserr("sendtolist: null list");
return 0;
}
if (tTd(25, 1))
{
sm_dprintf("sendto: %s\n ctladdr=", list);
printaddr(sm_debug_file(), ctladdr, false);
}
/* heuristic to determine old versus new style addresses */
if (ctladdr == NULL &&
(strchr(list, ',') != NULL || strchr(list, ';') != NULL ||
strchr(list, '<') != NULL || strchr(list, '(') != NULL))
e->e_flags &= ~EF_OLDSTYLE;
delimiter = ' ';
if (!bitset(EF_OLDSTYLE, e->e_flags) || ctladdr != NULL)
delimiter = ',';
al = NULL;
naddrs = 0;
/* make sure we have enough space to copy the string */
i = strlen(list) + 1;
if (i <= sizeof(buf))
{
bufp = buf;
i = sizeof(buf);
}
else
bufp = sm_malloc_x(i);
endp = bufp + i;
SM_TRY
{
(void) sm_strlcpy(bufp, denlstring(list, false, true), i);
macdefine(&e->e_macro, A_PERM, macid("{addr_type}"), "e r");
for (p = bufp; *p != '\0'; )
{
auto char *delimptr;
register ADDRESS *a;
SM_ASSERT(p < endp);
/* parse the address */
while ((isascii(*p) && isspace(*p)) || *p == ',')
p++;
SM_ASSERT(p < endp);
a = parseaddr(p, NULLADDR, RF_COPYALL, delimiter,
&delimptr, e, true);
p = delimptr;
SM_ASSERT(p < endp);
if (a == NULL)
continue;
a->q_next = al;
a->q_alias = ctladdr;
/* arrange to inherit attributes from parent */
if (ctladdr != NULL)
{
ADDRESS *b;
/* self reference test */
if (sameaddr(ctladdr, a))
{
if (tTd(27, 5))
{
sm_dprintf("sendtolist: QSELFREF ");
printaddr(sm_debug_file(), ctladdr, false);
}
ctladdr->q_flags |= QSELFREF;
}
/* check for address loops */
b = self_reference(a);
if (b != NULL)
{
b->q_flags |= QSELFREF;
if (tTd(27, 5))
{
sm_dprintf("sendtolist: QSELFREF ");
printaddr(sm_debug_file(), b, false);
}
if (a != b)
{
if (tTd(27, 5))
{
sm_dprintf("sendtolist: QS_DONTSEND ");
printaddr(sm_debug_file(), a, false);
}
a->q_state = QS_DONTSEND;
b->q_flags |= a->q_flags & QNOTREMOTE;
continue;
}
}
/* full name */
if (a->q_fullname == NULL)
a->q_fullname = ctladdr->q_fullname;
/* various flag bits */
a->q_flags &= ~QINHERITEDBITS;
a->q_flags |= ctladdr->q_flags & QINHERITEDBITS;
/* DSN recipient information */
a->q_finalrcpt = ctladdr->q_finalrcpt;
a->q_orcpt = ctladdr->q_orcpt;
}
al = a;
}
/* arrange to send to everyone on the local send list */
while (al != NULL)
{
register ADDRESS *a = al;
al = a->q_next;
a = recipient(a, sendq, aliaslevel, e);
naddrs++;
}
}
SM_FINALLY
{
e->e_to = oldto;
if (bufp != buf)
sm_free(bufp);
macdefine(&e->e_macro, A_PERM, macid("{addr_type}"), NULL);
}
SM_END_TRY
return naddrs;
}
#if MILTER
/*
** REMOVEFROMLIST -- Remove addresses from a send list.
**
** The parameter is a comma-separated list of recipients to remove.
** Note that it only deletes matching addresses. If those addresses
** have been expanded already in the sendq, it won't mark the
** expanded recipients as QS_REMOVED.
**
** Parameters:
** list -- the list to remove.
** sendq -- a pointer to the head of a queue to remove
** these addresses from.
** e -- the envelope in which to remove these recipients.
**
** Returns:
** The number of addresses removed from the list.
**
*/
int
removefromlist(list, sendq, e)
char *list;
ADDRESS **sendq;
ENVELOPE *e;
{
SM_NONVOLATILE char delimiter; /* the address delimiter */
SM_NONVOLATILE int naddrs;
SM_NONVOLATILE int i;
char *p;
char *oldto = e->e_to;
char *SM_NONVOLATILE bufp;
char buf[MAXNAME + 1];
if (list == NULL)
{
syserr("removefromlist: null list");
return 0;
}
if (tTd(25, 1))
sm_dprintf("removefromlist: %s\n", list);
/* heuristic to determine old versus new style addresses */
if (strchr(list, ',') != NULL || strchr(list, ';') != NULL ||
strchr(list, '<') != NULL || strchr(list, '(') != NULL)
e->e_flags &= ~EF_OLDSTYLE;
delimiter = ' ';
if (!bitset(EF_OLDSTYLE, e->e_flags))
delimiter = ',';
naddrs = 0;
/* make sure we have enough space to copy the string */
i = strlen(list) + 1;
if (i <= sizeof(buf))
{
bufp = buf;
i = sizeof(buf);
}
else
bufp = sm_malloc_x(i);
SM_TRY
{
(void) sm_strlcpy(bufp, denlstring(list, false, true), i);
#if _FFR_ADDR_TYPE_MODES
if (AddrTypeModes)
macdefine(&e->e_macro, A_PERM, macid("{addr_type}"),
"e r d");
else
#endif /* _FFR_ADDR_TYPE_MODES */
macdefine(&e->e_macro, A_PERM, macid("{addr_type}"), "e r");
for (p = bufp; *p != '\0'; )
{
ADDRESS a; /* parsed address to be removed */
ADDRESS *q;
ADDRESS **pq;
char *delimptr;
/* parse the address */
while ((isascii(*p) && isspace(*p)) || *p == ',')
p++;
if (parseaddr(p, &a, RF_COPYALL|RF_RM_ADDR,
delimiter, &delimptr, e, true) == NULL)
{
p = delimptr;
continue;
}
p = delimptr;
for (pq = sendq; (q = *pq) != NULL; pq = &q->q_next)
{
if (!QS_IS_DEAD(q->q_state) &&
(sameaddr(q, &a) ||
strcmp(q->q_paddr, a.q_paddr) == 0))
{
if (tTd(25, 5))
{
sm_dprintf("removefromlist: QS_REMOVED ");
printaddr(sm_debug_file(), &a, false);
}
q->q_state = QS_REMOVED;
naddrs++;
break;
}
}
}
}
SM_FINALLY
{
e->e_to = oldto;
if (bufp != buf)
sm_free(bufp);
macdefine(&e->e_macro, A_PERM, macid("{addr_type}"), NULL);
}
SM_END_TRY
return naddrs;
}
#endif /* MILTER */
/*
** RECIPIENT -- Designate a message recipient
** Saves the named person for future mailing (after some checks).
**
** Parameters:
** new -- the (preparsed) address header for the recipient.
** sendq -- a pointer to the head of a queue to put the
** recipient in. Duplicate suppression is done
** in this queue.
** aliaslevel -- the current alias nesting depth.
** e -- the current envelope.
**
** Returns:
** The actual address in the queue. This will be "a" if
** the address is not a duplicate, else the original address.
**
*/
ADDRESS *
recipient(new, sendq, aliaslevel, e)
register ADDRESS *new;
register ADDRESS **sendq;
int aliaslevel;
register ENVELOPE *e;
{
register ADDRESS *q;
ADDRESS **pq;
ADDRESS **prev;
register struct mailer *m;
register char *p;
int i, buflen;
bool quoted; /* set if the addr has a quote bit */
bool insert;
int findusercount;
bool initialdontsend;
char *buf;
char buf0[MAXNAME + 1]; /* unquoted image of the user name */
sortfn_t *sortfn;
p = NULL;
quoted = false;
insert = false;
findusercount = 0;
initialdontsend = QS_IS_DEAD(new->q_state);
e->e_to = new->q_paddr;
m = new->q_mailer;
errno = 0;
if (aliaslevel == 0)
new->q_flags |= QPRIMARY;
if (tTd(26, 1))
{
sm_dprintf("\nrecipient (%d): ", aliaslevel);
printaddr(sm_debug_file(), new, false);
}
/* if this is primary, use it as original recipient */
if (new->q_alias == NULL)
{
if (e->e_origrcpt == NULL)
e->e_origrcpt = new->q_paddr;
else if (e->e_origrcpt != new->q_paddr)
e->e_origrcpt = "";
}
/* find parent recipient for finalrcpt and orcpt */
for (q = new; q->q_alias != NULL; q = q->q_alias)
continue;
/* find final recipient DSN address */
if (new->q_finalrcpt == NULL &&
e->e_from.q_mailer != NULL)
{
char frbuf[MAXLINE];
p = e->e_from.q_mailer->m_addrtype;
if (p == NULL)
p = "rfc822";
if (sm_strcasecmp(p, "rfc822") != 0)
{
(void) sm_snprintf(frbuf, sizeof(frbuf), "%s; %.800s",
q->q_mailer->m_addrtype,
q->q_user);
}
else if (strchr(q->q_user, '@') != NULL)
{
(void) sm_snprintf(frbuf, sizeof(frbuf), "%s; %.800s",
p, q->q_user);
}
else if (strchr(q->q_paddr, '@') != NULL)
{
char *qp;
bool b;
qp = q->q_paddr;
/* strip brackets from address */
b = false;
if (*qp == '<')
{
b = qp[strlen(qp) - 1] == '>';
if (b)
qp[strlen(qp) - 1] = '\0';
qp++;
}
(void) sm_snprintf(frbuf, sizeof(frbuf), "%s; %.800s",
p, qp);
/* undo damage */
if (b)
qp[strlen(qp)] = '>';
}
else
{
(void) sm_snprintf(frbuf, sizeof(frbuf),
"%s; %.700s@%.100s",
p, q->q_user, MyHostName);
}
new->q_finalrcpt = sm_rpool_strdup_x(e->e_rpool, frbuf);
}
#if _FFR_GEN_ORCPT
/* set ORCPT DSN arg if not already set */
if (new->q_orcpt == NULL)
{
/* check for an existing ORCPT */
if (q->q_orcpt != NULL)
new->q_orcpt = q->q_orcpt;
else
{
/* make our own */
bool b = false;
char *qp;
char obuf[MAXLINE];
if (e->e_from.q_mailer != NULL)
p = e->e_from.q_mailer->m_addrtype;
if (p == NULL)
p = "rfc822";
(void) sm_strlcpyn(obuf, sizeof(obuf), 2, p, ";");
qp = q->q_paddr;
/* FFR: Needs to strip comments from stdin addrs */
/* strip brackets from address */
if (*qp == '<')
{
b = qp[strlen(qp) - 1] == '>';
if (b)
qp[strlen(qp) - 1] = '\0';
qp++;
}
p = xtextify(denlstring(qp, true, false), "=");
if (sm_strlcat(obuf, p, sizeof(obuf)) >= sizeof(obuf))
{
/* if too big, don't use it */
obuf[0] = '\0';
}
/* undo damage */
if (b)
qp[strlen(qp)] = '>';
if (obuf[0] != '\0')
new->q_orcpt =
sm_rpool_strdup_x(e->e_rpool, obuf);
}
}
#endif /* _FFR_GEN_ORCPT */
/* break aliasing loops */
if (aliaslevel > MaxAliasRecursion)
{
new->q_state = QS_BADADDR;
new->q_status = "5.4.6";
if (new->q_alias != NULL)
{
new->q_alias->q_state = QS_BADADDR;
new->q_alias->q_status = "5.4.6";
}
if ((SuprErrs || !LogUsrErrs) && LogLevel > 0)
{
sm_syslog(LOG_ERR, e->e_id,
"aliasing/forwarding loop broken: %s (%d aliases deep; %d max)",
FileName != NULL ? FileName : "", aliaslevel,
MaxAliasRecursion);
}
usrerrenh(new->q_status,
"554 aliasing/forwarding loop broken (%d aliases deep; %d max)",
aliaslevel, MaxAliasRecursion);
return new;
}
/*
** Finish setting up address structure.
*/
/* get unquoted user for file, program or user.name check */
i = strlen(new->q_user);
if (i >= sizeof(buf0))
{
buflen = i + 1;
buf = xalloc(buflen);
}
else
{
buf = buf0;
buflen = sizeof(buf0);
}
(void) sm_strlcpy(buf, new->q_user, buflen);
for (p = buf; *p != '\0' && !quoted; p++)
{
if (*p == '\\')
quoted = true;
}
stripquotes(buf);
/* check for direct mailing to restricted mailers */
if (m == ProgMailer)
{
if (new->q_alias == NULL || UseMSP ||
bitset(EF_UNSAFE, e->e_flags))
{
new->q_state = QS_BADADDR;
new->q_status = "5.7.1";
usrerrenh(new->q_status,
"550 Cannot mail directly to programs");
}
else if (bitset(QBOGUSSHELL, new->q_alias->q_flags))
{
new->q_state = QS_BADADDR;
new->q_status = "5.7.1";
if (new->q_alias->q_ruser == NULL)
usrerrenh(new->q_status,
"550 UID %d is an unknown user: cannot mail to programs",
new->q_alias->q_uid);
else
usrerrenh(new->q_status,
"550 User %s@%s doesn't have a valid shell for mailing to programs",
new->q_alias->q_ruser, MyHostName);
}
else if (bitset(QUNSAFEADDR, new->q_alias->q_flags))
{
new->q_state = QS_BADADDR;
new->q_status = "5.7.1";
new->q_rstatus = "550 Unsafe for mailing to programs";
usrerrenh(new->q_status,
"550 Address %s is unsafe for mailing to programs",
new->q_alias->q_paddr);
}
}
/*
** Look up this person in the recipient list.
** If they are there already, return, otherwise continue.
** If the list is empty, just add it. Notice the cute
** hack to make from addresses suppress things correctly:
** the QS_DUPLICATE state will be set in the send list.
** [Please note: the emphasis is on "hack."]
*/
prev = NULL;
/*
** If this message is going to the queue or FastSplit is set
** and it is the first try and the envelope hasn't split, then we
** avoid doing an MX RR lookup now because one will be done when the
** message is extracted from the queue later. It can go to the queue
** because all messages are going to the queue or this mailer of
** the current recipient is marked expensive.
*/
if (UseMSP || WILL_BE_QUEUED(e->e_sendmode) ||
(!bitset(EF_SPLIT, e->e_flags) && e->e_ntries == 0 &&
FastSplit > 0))
sortfn = sorthost;
else if (NoConnect && bitnset(M_EXPENSIVE, new->q_mailer->m_flags))
sortfn = sortexpensive;
else
sortfn = sortbysignature;
for (pq = sendq; (q = *pq) != NULL; pq = &q->q_next)
{
/*
** If address is "less than" it should be inserted now.
** If address is "greater than" current comparison it'll
** insert later in the list; so loop again (if possible).
** If address is "equal" (different equal than sameaddr()
** call) then check if sameaddr() will be true.
** Because this list is now sorted, it'll mean fewer
** comparisons and fewer loops which is important for more
** recipients.
*/
i = (*sortfn)(new, q);
if (i == 0) /* equal */
{
/*
** Sortbysignature() has said that the two have
** equal MX RR's and the same user. Calling sameaddr()
** now checks if the two hosts are as identical as the
** MX RR's are (which might not be the case)
** before saying these are the identical addresses.
*/
if (sameaddr(q, new) &&
(bitset(QRCPTOK, q->q_flags) ||
!bitset(QPRIMARY, q->q_flags)))
{
if (tTd(26, 1))
{
sm_dprintf("%s in sendq: ",
new->q_paddr);
printaddr(sm_debug_file(), q, false);
}
if (!bitset(QPRIMARY, q->q_flags))
{
if (!QS_IS_DEAD(new->q_state))
message("duplicate suppressed");
else
q->q_state = QS_DUPLICATE;
q->q_flags |= new->q_flags;
}
else if (bitset(QSELFREF, q->q_flags)
|| q->q_state == QS_REMOVED)
{
/*
** If an earlier milter removed the
** address, a later one can still add
** it back.
*/
q->q_state = new->q_state;
q->q_flags |= new->q_flags;
}
new = q;
goto done;
}
}
else if (i < 0) /* less than */
{
insert = true;
break;
}
prev = pq;
}
/* pq should point to an address, never NULL */
SM_ASSERT(pq != NULL);
/* add address on list */
if (insert)
{
/*
** insert before 'pq'. Only possible when at least 1
** ADDRESS is in the list already.
*/
new->q_next = *pq;
if (prev == NULL)
*sendq = new; /* To be the first ADDRESS */
else
(*prev)->q_next = new;
}
else
{
/*
** Place in list at current 'pq' position. Possible
** when there are 0 or more ADDRESS's in the list.
*/
new->q_next = NULL;
*pq = new;
}
/* added a new address: clear split flag */
e->e_flags &= ~EF_SPLIT;
/*
** Alias the name and handle special mailer types.
*/
trylocaluser:
if (tTd(29, 7))
{
sm_dprintf("at trylocaluser: ");
printaddr(sm_debug_file(), new, false);
}
if (!QS_IS_OK(new->q_state))
{
if (QS_IS_UNDELIVERED(new->q_state))
e->e_nrcpts++;
goto testselfdestruct;
}
if (m == InclMailer)
{
new->q_state = QS_INCLUDED;
if (new->q_alias == NULL || UseMSP ||
bitset(EF_UNSAFE, e->e_flags))
{
new->q_state = QS_BADADDR;
new->q_status = "5.7.1";
usrerrenh(new->q_status,
"550 Cannot mail directly to :include:s");
}
else
{
int ret;
message("including file %s", new->q_user);
ret = include(new->q_user, false, new,
sendq, aliaslevel, e);
if (transienterror(ret))
{
if (LogLevel > 2)
sm_syslog(LOG_ERR, e->e_id,
"include %s: transient error: %s",
shortenstring(new->q_user,
MAXSHORTSTR),
sm_errstring(ret));
new->q_state = QS_QUEUEUP;
usrerr("451 4.2.4 Cannot open %s: %s",
shortenstring(new->q_user,
MAXSHORTSTR),
sm_errstring(ret));
}
else if (ret != 0)
{
new->q_state = QS_BADADDR;
new->q_status = "5.2.4";
usrerrenh(new->q_status,
"550 Cannot open %s: %s",
shortenstring(new->q_user,
MAXSHORTSTR),
sm_errstring(ret));
}
}
}
else if (m == FileMailer)
{
/* check if allowed */
if (new->q_alias == NULL || UseMSP ||
bitset(EF_UNSAFE, e->e_flags))
{
new->q_state = QS_BADADDR;
new->q_status = "5.7.1";
usrerrenh(new->q_status,
"550 Cannot mail directly to files");
}
else if (bitset(QBOGUSSHELL, new->q_alias->q_flags))
{
new->q_state = QS_BADADDR;
new->q_status = "5.7.1";
if (new->q_alias->q_ruser == NULL)
usrerrenh(new->q_status,
"550 UID %d is an unknown user: cannot mail to files",
new->q_alias->q_uid);
else
usrerrenh(new->q_status,
"550 User %s@%s doesn't have a valid shell for mailing to files",
new->q_alias->q_ruser, MyHostName);
}
else if (bitset(QUNSAFEADDR, new->q_alias->q_flags))
{
new->q_state = QS_BADADDR;
new->q_status = "5.7.1";
new->q_rstatus = "550 Unsafe for mailing to files";
usrerrenh(new->q_status,
"550 Address %s is unsafe for mailing to files",
new->q_alias->q_paddr);
}
}
/* try aliasing */
if (!quoted && QS_IS_OK(new->q_state) &&
bitnset(M_ALIASABLE, m->m_flags))
alias(new, sendq, aliaslevel, e);
#if USERDB
/* if not aliased, look it up in the user database */
if (!bitset(QNOTREMOTE, new->q_flags) &&
QS_IS_SENDABLE(new->q_state) &&
bitnset(M_CHECKUDB, m->m_flags))
{
if (udbexpand(new, sendq, aliaslevel, e) == EX_TEMPFAIL)
{
new->q_state = QS_QUEUEUP;
if (e->e_message == NULL)
e->e_message = sm_rpool_strdup_x(e->e_rpool,
"Deferred: user database error");
if (new->q_message == NULL)
new->q_message = "Deferred: user database error";
if (LogLevel > 8)
sm_syslog(LOG_INFO, e->e_id,
"deferred: udbexpand: %s",
sm_errstring(errno));
message("queued (user database error): %s",
sm_errstring(errno));
e->e_nrcpts++;
goto testselfdestruct;
}
}
#endif /* USERDB */
/*
** If we have a level two config file, then pass the name through
** Ruleset 5 before sending it off. Ruleset 5 has the right
** to rewrite it to another mailer. This gives us a hook
** after local aliasing has been done.
*/
if (tTd(29, 5))
{
sm_dprintf("recipient: testing local? cl=%d, rr5=%p\n\t",
ConfigLevel, RewriteRules[5]);
printaddr(sm_debug_file(), new, false);
}
if (ConfigLevel >= 2 && RewriteRules[5] != NULL &&
bitnset(M_TRYRULESET5, m->m_flags) &&
!bitset(QNOTREMOTE, new->q_flags) &&
QS_IS_OK(new->q_state))
{
maplocaluser(new, sendq, aliaslevel + 1, e);
}
/*
** If it didn't get rewritten to another mailer, go ahead
** and deliver it.
*/
if (QS_IS_OK(new->q_state) &&
bitnset(M_HASPWENT, m->m_flags))
{
auto bool fuzzy;
SM_MBDB_T user;
int status;
/* warning -- finduser may trash buf */
status = finduser(buf, &fuzzy, &user);
switch (status)
{
case EX_TEMPFAIL:
new->q_state = QS_QUEUEUP;
new->q_status = "4.5.2";
giveresponse(EX_TEMPFAIL, new->q_status, m, NULL,
new->q_alias, (time_t) 0, e, new);
break;
default:
new->q_state = QS_BADADDR;
new->q_status = "5.1.1";
new->q_rstatus = "550 5.1.1 User unknown";
giveresponse(EX_NOUSER, new->q_status, m, NULL,
new->q_alias, (time_t) 0, e, new);
break;
case EX_OK:
if (fuzzy)
{
/* name was a fuzzy match */
new->q_user = sm_rpool_strdup_x(e->e_rpool,
user.mbdb_name);
if (findusercount++ > 3)
{
new->q_state = QS_BADADDR;
new->q_status = "5.4.6";
usrerrenh(new->q_status,
"554 aliasing/forwarding loop for %s broken",
user.mbdb_name);
goto done;
}
/* see if it aliases */
(void) sm_strlcpy(buf, user.mbdb_name, buflen);
goto trylocaluser;
}
if (*user.mbdb_homedir == '\0')
new->q_home = NULL;
else if (strcmp(user.mbdb_homedir, "/") == 0)
new->q_home = "";
else
new->q_home = sm_rpool_strdup_x(e->e_rpool,
user.mbdb_homedir);
if (user.mbdb_uid != SM_NO_UID)
{
new->q_uid = user.mbdb_uid;
new->q_gid = user.mbdb_gid;
new->q_flags |= QGOODUID;
}
new->q_ruser = sm_rpool_strdup_x(e->e_rpool,
user.mbdb_name);
if (user.mbdb_fullname[0] != '\0')
new->q_fullname = sm_rpool_strdup_x(e->e_rpool,
user.mbdb_fullname);
if (!usershellok(user.mbdb_name, user.mbdb_shell))
{
new->q_flags |= QBOGUSSHELL;
}
if (bitset(EF_VRFYONLY, e->e_flags))
{
/* don't do any more now */
new->q_state = QS_VERIFIED;
}
else if (!quoted)
forward(new, sendq, aliaslevel, e);
}
}
if (!QS_IS_DEAD(new->q_state))
e->e_nrcpts++;
testselfdestruct:
new->q_flags |= QTHISPASS;
if (tTd(26, 8))
{
sm_dprintf("testselfdestruct: ");
printaddr(sm_debug_file(), new, false);
if (tTd(26, 10))
{
sm_dprintf("SENDQ:\n");
printaddr(sm_debug_file(), *sendq, true);
sm_dprintf("----\n");
}
}
if (new->q_alias == NULL && new != &e->e_from &&
QS_IS_DEAD(new->q_state))
{
for (q = *sendq; q != NULL; q = q->q_next)
{
if (!QS_IS_DEAD(q->q_state))
break;
}
if (q == NULL)
{
new->q_state = QS_BADADDR;
new->q_status = "5.4.6";
usrerrenh(new->q_status,
"554 aliasing/forwarding loop broken");
}
}
done:
new->q_flags |= QTHISPASS;
if (buf != buf0)
sm_free(buf); /* XXX leak if above code raises exception */
/*
** If we are at the top level, check to see if this has
** expanded to exactly one address. If so, it can inherit
** the primaryness of the address.
**
** While we're at it, clear the QTHISPASS bits.
*/
if (aliaslevel == 0)
{
int nrcpts = 0;
ADDRESS *only = NULL;
for (q = *sendq; q != NULL; q = q->q_next)
{
if (bitset(QTHISPASS, q->q_flags) &&
QS_IS_SENDABLE(q->q_state))
{
nrcpts++;
only = q;
}
q->q_flags &= ~QTHISPASS;
}
if (nrcpts == 1)
{
/* check to see if this actually got a new owner */
q = only;
while ((q = q->q_alias) != NULL)
{
if (q->q_owner != NULL)
break;
}
if (q == NULL)
only->q_flags |= QPRIMARY;
}
else if (!initialdontsend && nrcpts > 0)
{
/* arrange for return receipt */
e->e_flags |= EF_SENDRECEIPT;
new->q_flags |= QEXPANDED;
if (e->e_xfp != NULL &&
bitset(QPINGONSUCCESS, new->q_flags))
(void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT,
"%s... expanded to multiple addresses\n",
new->q_paddr);
}
}
new->q_flags |= QRCPTOK;
(void) sm_snprintf(buf0, sizeof(buf0), "%d", e->e_nrcpts);
macdefine(&e->e_macro, A_TEMP, macid("{nrcpts}"), buf0);
return new;
}
/*
** FINDUSER -- find the password entry for a user.
**
** This looks a lot like getpwnam, except that it may want to
** do some fancier pattern matching in /etc/passwd.
**
** This routine contains most of the time of many sendmail runs.
** It deserves to be optimized.
**
** Parameters:
** name -- the name to match against.
** fuzzyp -- an outarg that is set to true if this entry
** was found using the fuzzy matching algorithm;
** set to false otherwise.
** user -- structure to fill in if user is found
**
** Returns:
** On success, fill in *user, set *fuzzyp and return EX_OK.
** If the user was not found, return EX_NOUSER.
** On error, return EX_TEMPFAIL or EX_OSERR.
**
** Side Effects:
** may modify name.
*/
int
finduser(name, fuzzyp, user)
char *name;
bool *fuzzyp;
SM_MBDB_T *user;
{
#if MATCHGECOS
register struct passwd *pw;
#endif /* MATCHGECOS */
register char *p;
bool tryagain;
int status;
if (tTd(29, 4))
sm_dprintf("finduser(%s): ", name);
*fuzzyp = false;
#if HESIOD
/* DEC Hesiod getpwnam accepts numeric strings -- short circuit it */
for (p = name; *p != '\0'; p++)
if (!isascii(*p) || !isdigit(*p))
break;
if (*p == '\0')
{
if (tTd(29, 4))
sm_dprintf("failed (numeric input)\n");
return EX_NOUSER;
}
#endif /* HESIOD */
/* look up this login name using fast path */
status = sm_mbdb_lookup(name, user);
if (status != EX_NOUSER)
{
if (tTd(29, 4))
sm_dprintf("%s (non-fuzzy)\n", sm_strexit(status));
return status;
}
/* try mapping it to lower case */
tryagain = false;
for (p = name; *p != '\0'; p++)
{
if (isascii(*p) && isupper(*p))
{
*p = tolower(*p);
tryagain = true;
}
}
if (tryagain && (status = sm_mbdb_lookup(name, user)) != EX_NOUSER)
{
if (tTd(29, 4))
sm_dprintf("%s (lower case)\n", sm_strexit(status));
*fuzzyp = true;
return status;
}
#if MATCHGECOS
/* see if fuzzy matching allowed */
if (!MatchGecos)
{
if (tTd(29, 4))
sm_dprintf("not found (fuzzy disabled)\n");
return EX_NOUSER;
}
/* search for a matching full name instead */
for (p = name; *p != '\0'; p++)
{
if (*p == (SpaceSub & 0177) || *p == '_')
*p = ' ';
}
(void) setpwent();
while ((pw = getpwent()) != NULL)
{
char buf[MAXNAME + 1];
# if 0
if (sm_strcasecmp(pw->pw_name, name) == 0)
{
if (tTd(29, 4))
sm_dprintf("found (case wrapped)\n");
break;
}
# endif /* 0 */
sm_pwfullname(pw->pw_gecos, pw->pw_name, buf, sizeof(buf));
if (strchr(buf, ' ') != NULL && sm_strcasecmp(buf, name) == 0)
{
if (tTd(29, 4))
sm_dprintf("fuzzy matches %s\n", pw->pw_name);
message("sending to login name %s", pw->pw_name);
break;
}
}
if (pw != NULL)
*fuzzyp = true;
else if (tTd(29, 4))
sm_dprintf("no fuzzy match found\n");
# if DEC_OSF_BROKEN_GETPWENT /* DEC OSF/1 3.2 or earlier */
endpwent();
# endif /* DEC_OSF_BROKEN_GETPWENT */
if (pw == NULL)
return EX_NOUSER;
sm_mbdb_frompw(user, pw);
return EX_OK;
#else /* MATCHGECOS */
if (tTd(29, 4))
sm_dprintf("not found (fuzzy disabled)\n");
return EX_NOUSER;
#endif /* MATCHGECOS */
}
/*
** WRITABLE -- predicate returning if the file is writable.
**
** This routine must duplicate the algorithm in sys/fio.c.
** Unfortunately, we cannot use the access call since we
** won't necessarily be the real uid when we try to
** actually open the file.
**
** Notice that ANY file with ANY execute bit is automatically
** not writable. This is also enforced by mailfile.
**
** Parameters:
** filename -- the file name to check.
** ctladdr -- the controlling address for this file.
** flags -- SFF_* flags to control the function.
**
** Returns:
** true -- if we will be able to write this file.
** false -- if we cannot write this file.
**
** Side Effects:
** none.
*/
bool
writable(filename, ctladdr, flags)
char *filename;
ADDRESS *ctladdr;
long flags;
{
uid_t euid = 0;
gid_t egid = 0;
char *user = NULL;
if (tTd(44, 5))
sm_dprintf("writable(%s, 0x%lx)\n", filename, flags);
/*
** File does exist -- check that it is writable.
*/
if (geteuid() != 0)
{
euid = geteuid();
egid = getegid();
user = NULL;
}
else if (ctladdr != NULL)
{
euid = ctladdr->q_uid;
egid = ctladdr->q_gid;
user = ctladdr->q_user;
}
else if (bitset(SFF_RUNASREALUID, flags))
{
euid = RealUid;
egid = RealGid;
user = RealUserName;
}
else if (FileMailer != NULL && !bitset(SFF_ROOTOK, flags))
{
if (FileMailer->m_uid == NO_UID)
{
euid = DefUid;
user = DefUser;
}
else
{
euid = FileMailer->m_uid;
user = NULL;
}
if (FileMailer->m_gid == NO_GID)
egid = DefGid;
else
egid = FileMailer->m_gid;
}
else
{
euid = egid = 0;
user = NULL;
}
if (!bitset(SFF_ROOTOK, flags))
{
if (euid == 0)
{
euid = DefUid;
user = DefUser;
}
if (egid == 0)
egid = DefGid;
}
if (geteuid() == 0 &&
(ctladdr == NULL || !bitset(QGOODUID, ctladdr->q_flags)))
flags |= SFF_SETUIDOK;
if (!bitnset(DBS_FILEDELIVERYTOSYMLINK, DontBlameSendmail))
flags |= SFF_NOSLINK;
if (!bitnset(DBS_FILEDELIVERYTOHARDLINK, DontBlameSendmail))
flags |= SFF_NOHLINK;
errno = safefile(filename, euid, egid, user, flags, S_IWRITE, NULL);
return errno == 0;
}
/*
** INCLUDE -- handle :include: specification.
**
** Parameters:
** fname -- filename to include.
** forwarding -- if true, we are reading a .forward file.
** if false, it's a :include: file.
** ctladdr -- address template to use to fill in these
** addresses -- effective user/group id are
** the important things.
** sendq -- a pointer to the head of the send queue
** to put these addresses in.
** aliaslevel -- the alias nesting depth.
** e -- the current envelope.
**
** Returns:
** open error status
**
** Side Effects:
** reads the :include: file and sends to everyone
** listed in that file.
**
** Security Note:
** If you have restricted chown (that is, you can't
** give a file away), it is reasonable to allow programs
** and files called from this :include: file to be to be
** run as the owner of the :include: file. This is bogus
** if there is any chance of someone giving away a file.
** We assume that pre-POSIX systems can give away files.
**
** There is an additional restriction that if you
** forward to a :include: file, it will not take on
** the ownership of the :include: file. This may not
** be necessary, but shouldn't hurt.
*/
static jmp_buf CtxIncludeTimeout;
int
include(fname, forwarding, ctladdr, sendq, aliaslevel, e)
char *fname;
bool forwarding;
ADDRESS *ctladdr;
ADDRESS **sendq;
int aliaslevel;
ENVELOPE *e;
{
SM_FILE_T *volatile fp = NULL;
char *oldto = e->e_to;
char *oldfilename = FileName;
int oldlinenumber = LineNumber;
register SM_EVENT *ev = NULL;
int nincludes;
int mode;
volatile bool maxreached = false;
register ADDRESS *ca;
volatile uid_t saveduid;
volatile gid_t savedgid;
volatile uid_t uid;
volatile gid_t gid;
char *volatile user;
int rval = 0;
volatile long sfflags = SFF_REGONLY;
register char *p;
bool safechown = false;
volatile bool safedir = false;
struct stat st;
char buf[MAXLINE];
if (tTd(27, 2))
sm_dprintf("include(%s)\n", fname);
if (tTd(27, 4))
sm_dprintf(" ruid=%d euid=%d\n",
(int) getuid(), (int) geteuid());
if (tTd(27, 14))
{
sm_dprintf("ctladdr ");
printaddr(sm_debug_file(), ctladdr, false);
}
if (tTd(27, 9))
sm_dprintf("include: old uid = %d/%d\n",
(int) getuid(), (int) geteuid());
if (forwarding)
{
sfflags |= SFF_MUSTOWN|SFF_ROOTOK;
if (!bitnset(DBS_GROUPWRITABLEFORWARDFILE, DontBlameSendmail))
sfflags |= SFF_NOGWFILES;
if (!bitnset(DBS_WORLDWRITABLEFORWARDFILE, DontBlameSendmail))
sfflags |= SFF_NOWWFILES;
}
else
{
if (!bitnset(DBS_GROUPWRITABLEINCLUDEFILE, DontBlameSendmail))
sfflags |= SFF_NOGWFILES;
if (!bitnset(DBS_WORLDWRITABLEINCLUDEFILE, DontBlameSendmail))
sfflags |= SFF_NOWWFILES;
}
/*
** If RunAsUser set, won't be able to run programs as user
** so mark them as unsafe unless the administrator knows better.
*/
if ((geteuid() != 0 || RunAsUid != 0) &&
!bitnset(DBS_NONROOTSAFEADDR, DontBlameSendmail))
{
if (tTd(27, 4))
sm_dprintf("include: not safe (euid=%d, RunAsUid=%d)\n",
(int) geteuid(), (int) RunAsUid);
ctladdr->q_flags |= QUNSAFEADDR;
}
ca = getctladdr(ctladdr);
if (ca == NULL ||
(ca->q_uid == DefUid && ca->q_gid == 0))
{
uid = DefUid;
gid = DefGid;
user = DefUser;
}
else
{
uid = ca->q_uid;
gid = ca->q_gid;
user = ca->q_user;
}
#if MAILER_SETUID_METHOD != USE_SETUID
saveduid = geteuid();
savedgid = getegid();
if (saveduid == 0)
{
if (!DontInitGroups)
{
if (initgroups(user, gid) == -1)
{
rval = EAGAIN;
syserr("include: initgroups(%s, %d) failed",
user, gid);
goto resetuid;
}
}
else
{
GIDSET_T gidset[1];
gidset[0] = gid;
if (setgroups(1, gidset) == -1)
{
rval = EAGAIN;
syserr("include: setgroups() failed");
goto resetuid;
}
}
if (gid != 0 && setgid(gid) < -1)
{
rval = EAGAIN;
syserr("setgid(%d) failure", gid);
goto resetuid;
}
if (uid != 0)
{
# if MAILER_SETUID_METHOD == USE_SETEUID
if (seteuid(uid) < 0)
{
rval = EAGAIN;
syserr("seteuid(%d) failure (real=%d, eff=%d)",
uid, (int) getuid(), (int) geteuid());
goto resetuid;
}
# endif /* MAILER_SETUID_METHOD == USE_SETEUID */
# if MAILER_SETUID_METHOD == USE_SETREUID
if (setreuid(0, uid) < 0)
{
rval = EAGAIN;
syserr("setreuid(0, %d) failure (real=%d, eff=%d)",
uid, (int) getuid(), (int) geteuid());
goto resetuid;
}
# endif /* MAILER_SETUID_METHOD == USE_SETREUID */
}
}
#endif /* MAILER_SETUID_METHOD != USE_SETUID */
if (tTd(27, 9))
sm_dprintf("include: new uid = %d/%d\n",
(int) getuid(), (int) geteuid());
/*
** If home directory is remote mounted but server is down,
** this can hang or give errors; use a timeout to avoid this
*/
if (setjmp(CtxIncludeTimeout) != 0)
{
ctladdr->q_state = QS_QUEUEUP;
errno = 0;
/* return pseudo-error code */
rval = E_SM_OPENTIMEOUT;
goto resetuid;
}
if (TimeOuts.to_fileopen > 0)
ev = sm_setevent(TimeOuts.to_fileopen, includetimeout, 0);
else
ev = NULL;
/* check for writable parent directory */
p = strrchr(fname, '/');
if (p != NULL)
{
int ret;
*p = '\0';
ret = safedirpath(fname, uid, gid, user,
sfflags|SFF_SAFEDIRPATH, 0, 0);
if (ret == 0)
{
/* in safe directory: relax chown & link rules */
safedir = true;
sfflags |= SFF_NOPATHCHECK;
}
else
{
if (bitnset((forwarding ?
DBS_FORWARDFILEINUNSAFEDIRPATH :
DBS_INCLUDEFILEINUNSAFEDIRPATH),
DontBlameSendmail))
sfflags |= SFF_NOPATHCHECK;
else if (bitnset((forwarding ?
DBS_FORWARDFILEINGROUPWRITABLEDIRPATH :
DBS_INCLUDEFILEINGROUPWRITABLEDIRPATH),
DontBlameSendmail) &&
ret == E_SM_GWDIR)
{
setbitn(DBS_GROUPWRITABLEDIRPATHSAFE,
DontBlameSendmail);
ret = safedirpath(fname, uid, gid, user,
sfflags|SFF_SAFEDIRPATH,
0, 0);
clrbitn(DBS_GROUPWRITABLEDIRPATHSAFE,
DontBlameSendmail);
if (ret == 0)
sfflags |= SFF_NOPATHCHECK;
else
sfflags |= SFF_SAFEDIRPATH;
}
else
sfflags |= SFF_SAFEDIRPATH;
if (ret > E_PSEUDOBASE &&
!bitnset((forwarding ?
DBS_FORWARDFILEINUNSAFEDIRPATHSAFE :
DBS_INCLUDEFILEINUNSAFEDIRPATHSAFE),
DontBlameSendmail))
{
if (LogLevel > 11)
sm_syslog(LOG_INFO, e->e_id,
"%s: unsafe directory path, marked unsafe",
shortenstring(fname, MAXSHORTSTR));
ctladdr->q_flags |= QUNSAFEADDR;
}
}
*p = '/';
}
/* allow links only in unwritable directories */
if (!safedir &&
!bitnset((forwarding ?
DBS_LINKEDFORWARDFILEINWRITABLEDIR :
DBS_LINKEDINCLUDEFILEINWRITABLEDIR),
DontBlameSendmail))
sfflags |= SFF_NOLINK;
rval = safefile(fname, uid, gid, user, sfflags, S_IREAD, &st);
if (rval != 0)
{
/* don't use this :include: file */
if (tTd(27, 4))
sm_dprintf("include: not safe (uid=%d): %s\n",
(int) uid, sm_errstring(rval));
}
else if ((fp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, fname,
SM_IO_RDONLY, NULL)) == NULL)
{
rval = errno;
if (tTd(27, 4))
sm_dprintf("include: open: %s\n", sm_errstring(rval));
}
else if (filechanged(fname, sm_io_getinfo(fp,SM_IO_WHAT_FD, NULL), &st))
{
rval = E_SM_FILECHANGE;
if (tTd(27, 4))
sm_dprintf("include: file changed after open\n");
}
if (ev != NULL)
sm_clrevent(ev);
resetuid:
#if HASSETREUID || USESETEUID
if (saveduid == 0)
{
if (uid != 0)
{
# if USESETEUID
if (seteuid(0) < 0)
syserr("!seteuid(0) failure (real=%d, eff=%d)",
(int) getuid(), (int) geteuid());
# else /* USESETEUID */
if (setreuid(-1, 0) < 0)
syserr("!setreuid(-1, 0) failure (real=%d, eff=%d)",
(int) getuid(), (int) geteuid());
if (setreuid(RealUid, 0) < 0)
syserr("!setreuid(%d, 0) failure (real=%d, eff=%d)",
(int) RealUid, (int) getuid(),
(int) geteuid());
# endif /* USESETEUID */
}
if (setgid(savedgid) < 0)
syserr("!setgid(%d) failure (real=%d eff=%d)",
(int) savedgid, (int) getgid(),
(int) getegid());
}
#endif /* HASSETREUID || USESETEUID */
if (tTd(27, 9))
sm_dprintf("include: reset uid = %d/%d\n",
(int) getuid(), (int) geteuid());
if (rval == E_SM_OPENTIMEOUT)
usrerr("451 4.4.1 open timeout on %s", fname);
if (fp == NULL)
return rval;
if (fstat(sm_io_getinfo(fp, SM_IO_WHAT_FD, NULL), &st) < 0)
{
rval = errno;
syserr("Cannot fstat %s!", fname);
(void) sm_io_close(fp, SM_TIME_DEFAULT);
return rval;
}
/* if path was writable, check to avoid file giveaway tricks */
safechown = chownsafe(sm_io_getinfo(fp, SM_IO_WHAT_FD, NULL), safedir);
if (tTd(27, 6))
sm_dprintf("include: parent of %s is %s, chown is %ssafe\n",
fname, safedir ? "safe" : "dangerous",
safechown ? "" : "un");
/* if no controlling user or coming from an alias delivery */
if (safechown &&
(ca == NULL ||
(ca->q_uid == DefUid && ca->q_gid == 0)))
{
ctladdr->q_uid = st.st_uid;
ctladdr->q_gid = st.st_gid;
ctladdr->q_flags |= QGOODUID;
}
if (ca != NULL && ca->q_uid == st.st_uid)
{
/* optimization -- avoid getpwuid if we already have info */
ctladdr->q_flags |= ca->q_flags & QBOGUSSHELL;
ctladdr->q_ruser = ca->q_ruser;
}
else if (!forwarding)
{
register struct passwd *pw;
pw = sm_getpwuid(st.st_uid);
if (pw == NULL)
{
ctladdr->q_uid = st.st_uid;
ctladdr->q_flags |= QBOGUSSHELL;
}
else
{
char *sh;
ctladdr->q_ruser = sm_rpool_strdup_x(e->e_rpool,
pw->pw_name);
if (safechown)
sh = pw->pw_shell;
else
sh = "/SENDMAIL/ANY/SHELL/";
if (!usershellok(pw->pw_name, sh))
{
if (LogLevel > 11)
sm_syslog(LOG_INFO, e->e_id,
"%s: user %s has bad shell %s, marked %s",
shortenstring(fname,
MAXSHORTSTR),
pw->pw_name, sh,
safechown ? "bogus" : "unsafe");
if (safechown)
ctladdr->q_flags |= QBOGUSSHELL;
else
ctladdr->q_flags |= QUNSAFEADDR;
}
}
}
if (bitset(EF_VRFYONLY, e->e_flags))
{
/* don't do any more now */
ctladdr->q_state = QS_VERIFIED;
e->e_nrcpts++;
(void) sm_io_close(fp, SM_TIME_DEFAULT);
return rval;
}
/*
** Check to see if some bad guy can write this file
**
** Group write checking could be more clever, e.g.,
** guessing as to which groups are actually safe ("sys"
** may be; "user" probably is not).
*/
mode = S_IWOTH;
if (!bitnset((forwarding ?
DBS_GROUPWRITABLEFORWARDFILESAFE :
DBS_GROUPWRITABLEINCLUDEFILESAFE),
DontBlameSendmail))
mode |= S_IWGRP;
if (bitset(mode, st.st_mode))
{
if (tTd(27, 6))
sm_dprintf("include: %s is %s writable, marked unsafe\n",
shortenstring(fname, MAXSHORTSTR),
bitset(S_IWOTH, st.st_mode) ? "world"
: "group");
if (LogLevel > 11)
sm_syslog(LOG_INFO, e->e_id,
"%s: %s writable %s file, marked unsafe",
shortenstring(fname, MAXSHORTSTR),
bitset(S_IWOTH, st.st_mode) ? "world" : "group",
forwarding ? "forward" : ":include:");
ctladdr->q_flags |= QUNSAFEADDR;
}
/* read the file -- each line is a comma-separated list. */
FileName = fname;
LineNumber = 0;
ctladdr->q_flags &= ~QSELFREF;
nincludes = 0;
while (sm_io_fgets(fp, SM_TIME_DEFAULT, buf, sizeof(buf)) != NULL &&
!maxreached)
{
fixcrlf(buf, true);
LineNumber++;
if (buf[0] == '#' || buf[0] == '\0')
continue;
/* <sp>#@# introduces a comment anywhere */
/* for Japanese character sets */
for (p = buf; (p = strchr(++p, '#')) != NULL; )
{
if (p[1] == '@' && p[2] == '#' &&
isascii(p[-1]) && isspace(p[-1]) &&
(p[3] == '\0' || (isascii(p[3]) && isspace(p[3]))))
{
--p;
while (p > buf && isascii(p[-1]) &&
isspace(p[-1]))
--p;
p[0] = '\0';
break;
}
}
if (buf[0] == '\0')
continue;
e->e_to = NULL;
message("%s to %s",
forwarding ? "forwarding" : "sending", buf);
if (forwarding && LogLevel > 10)
sm_syslog(LOG_INFO, e->e_id,
"forward %.200s => %s",
oldto, shortenstring(buf, MAXSHORTSTR));
nincludes += sendtolist(buf, ctladdr, sendq, aliaslevel + 1, e);
if (forwarding &&
MaxForwardEntries > 0 &&
nincludes >= MaxForwardEntries)
{
/* just stop reading and processing further entries */
#if 0
/* additional: (?) */
ctladdr->q_state = QS_DONTSEND;
#endif /* 0 */
syserr("Attempt to forward to more than %d addresses (in %s)!",
MaxForwardEntries, fname);
maxreached = true;
}
}
if (sm_io_error(fp) && tTd(27, 3))
sm_dprintf("include: read error: %s\n", sm_errstring(errno));
if (nincludes > 0 && !bitset(QSELFREF, ctladdr->q_flags))
{
if (aliaslevel <= MaxAliasRecursion ||
ctladdr->q_state != QS_BADADDR)
{
ctladdr->q_state = QS_DONTSEND;
if (tTd(27, 5))
{
sm_dprintf("include: QS_DONTSEND ");
printaddr(sm_debug_file(), ctladdr, false);
}
}
}
(void) sm_io_close(fp, SM_TIME_DEFAULT);
FileName = oldfilename;
LineNumber = oldlinenumber;
e->e_to = oldto;
return rval;
}
static void
includetimeout(ignore)
int ignore;
{
/*
** NOTE: THIS CAN BE CALLED FROM A SIGNAL HANDLER. DO NOT ADD
** ANYTHING TO THIS ROUTINE UNLESS YOU KNOW WHAT YOU ARE
** DOING.
*/
errno = ETIMEDOUT;
longjmp(CtxIncludeTimeout, 1);
}
/*
** SENDTOARGV -- send to an argument vector.
**
** Parameters:
** argv -- argument vector to send to.
** e -- the current envelope.
**
** Returns:
** none.
**
** Side Effects:
** puts all addresses on the argument vector onto the
** send queue.
*/
void
sendtoargv(argv, e)
register char **argv;
register ENVELOPE *e;
{
register char *p;
while ((p = *argv++) != NULL)
(void) sendtolist(p, NULLADDR, &e->e_sendqueue, 0, e);
}
/*
** GETCTLADDR -- get controlling address from an address header.
**
** If none, get one corresponding to the effective userid.
**
** Parameters:
** a -- the address to find the controller of.
**
** Returns:
** the controlling address.
*/
ADDRESS *
getctladdr(a)
register ADDRESS *a;
{
while (a != NULL && !bitset(QGOODUID, a->q_flags))
a = a->q_alias;
return a;
}
/*
** SELF_REFERENCE -- check to see if an address references itself
**
** The check is done through a chain of aliases. If it is part of
** a loop, break the loop at the "best" address, that is, the one
** that exists as a real user.
**
** This is to handle the case of:
** awc: Andrew.Chang
** Andrew.Chang: awc@mail.server
** which is a problem only on mail.server.
**
** Parameters:
** a -- the address to check.
**
** Returns:
** The address that should be retained.
*/
static ADDRESS *
self_reference(a)
ADDRESS *a;
{
ADDRESS *b; /* top entry in self ref loop */
ADDRESS *c; /* entry that point to a real mail box */
if (tTd(27, 1))
sm_dprintf("self_reference(%s)\n", a->q_paddr);
for (b = a->q_alias; b != NULL; b = b->q_alias)
{
if (sameaddr(a, b))
break;
}
if (b == NULL)
{
if (tTd(27, 1))
sm_dprintf("\t... no self ref\n");
return NULL;
}
/*
** Pick the first address that resolved to a real mail box
** i.e has a mbdb entry. The returned value will be marked
** QSELFREF in recipient(), which in turn will disable alias()
** from marking it as QS_IS_DEAD(), which mean it will be used
** as a deliverable address.
**
** The 2 key thing to note here are:
** 1) we are in a recursive call sequence:
** alias->sendtolist->recipient->alias
** 2) normally, when we return back to alias(), the address
** will be marked QS_EXPANDED, since alias() assumes the
** expanded form will be used instead of the current address.
** This behaviour is turned off if the address is marked
** QSELFREF. We set QSELFREF when we return to recipient().
*/
c = a;
while (c != NULL)
{
if (tTd(27, 10))
sm_dprintf(" %s", c->q_user);
if (bitnset(M_HASPWENT, c->q_mailer->m_flags))
{
SM_MBDB_T user;
if (tTd(27, 2))
sm_dprintf("\t... getpwnam(%s)... ", c->q_user);
if (sm_mbdb_lookup(c->q_user, &user) == EX_OK)
{
if (tTd(27, 2))
sm_dprintf("found\n");
/* ought to cache results here */
if (sameaddr(b, c))
return b;
else
return c;
}
if (tTd(27, 2))
sm_dprintf("failed\n");
}
else
{
/* if local delivery, compare usernames */
if (bitnset(M_LOCALMAILER, c->q_mailer->m_flags) &&
b->q_mailer == c->q_mailer)
{
if (tTd(27, 2))
sm_dprintf("\t... local match (%s)\n",
c->q_user);
if (sameaddr(b, c))
return b;
else
return c;
}
}
if (tTd(27, 10))
sm_dprintf("\n");
c = c->q_alias;
}
if (tTd(27, 1))
sm_dprintf("\t... cannot break loop for \"%s\"\n", a->q_paddr);
return NULL;
}