masqmail

annotate src/masqmail.c @ 331:e507c854a63e

find changesets by author, revision, files, or words in the commit message
Security fix! Correct handling of seteuid() return value See Debian bug #638002, reported by John Lightsey. When possible the (already available) set_euidgid() function is used. Additionally, it is unnecessary to change the identity when writing into an already open file descriptor. This should fix the problem.
author markus schnalke <meillo@marmaro.de>
date Sat, 27 Aug 2011 16:19:07 +0200
parents f10a56dc7481
children b45dc53f2829
rev   line source
meillo@0 1 /* MasqMail
meillo@0 2 Copyright (C) 1999-2001 Oliver Kurth
meillo@76 3 Copyright (C) 2010 markus schnalke <meillo@marmaro.de>
meillo@0 4
meillo@0 5 This program is free software; you can redistribute it and/or modify
meillo@0 6 it under the terms of the GNU General Public License as published by
meillo@0 7 the Free Software Foundation; either version 2 of the License, or
meillo@0 8 (at your option) any later version.
meillo@0 9
meillo@0 10 This program is distributed in the hope that it will be useful,
meillo@0 11 but WITHOUT ANY WARRANTY; without even the implied warranty of
meillo@0 12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
meillo@0 13 GNU General Public License for more details.
meillo@0 14
meillo@0 15 You should have received a copy of the GNU General Public License
meillo@0 16 along with this program; if not, write to the Free Software
meillo@0 17 Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
meillo@0 18 */
meillo@0 19
meillo@0 20 #include <stdio.h>
meillo@0 21 #include <errno.h>
meillo@0 22 #include <stdlib.h>
meillo@0 23 #include <string.h>
meillo@0 24 #include <unistd.h>
meillo@0 25 #include <sys/types.h>
meillo@0 26 #include <sys/socket.h>
meillo@0 27 #include <sys/time.h>
meillo@0 28 #include <netinet/in.h>
meillo@0 29 #include <netdb.h>
meillo@0 30 #include <syslog.h>
meillo@0 31 #include <signal.h>
meillo@0 32
meillo@0 33 #include <glib.h>
meillo@0 34
meillo@0 35 #include "masqmail.h"
meillo@0 36
meillo@192 37 /* mutually exclusive modes. Note that there is no 'queue daemon' mode.
meillo@192 38 It, as well as the distinction beween the two (non exclusive) daemon
meillo@192 39 (queue and listen) modes, is handled by flags.*/
meillo@281 40 enum mta_mode {
meillo@281 41 MODE_NONE = 0, /* to check if a mode was set */
meillo@281 42 MODE_ACCEPT, /* accept message on stdin (fallback mode) */
meillo@10 43 MODE_DAEMON, /* run as daemon */
meillo@10 44 MODE_RUNQUEUE, /* single queue run, online or offline */
meillo@10 45 MODE_SMTP, /* accept SMTP on stdin */
meillo@10 46 MODE_LIST, /* list queue */
meillo@10 47 MODE_MCMD, /* do queue manipulation */
meillo@10 48 MODE_VERSION, /* show version */
meillo@10 49 MODE_BI, /* fake ;-) */
meillo@281 50 };
meillo@281 51 enum mta_mode mta_mode = MODE_NONE;
meillo@0 52
meillo@0 53 char *pidfile = NULL;
meillo@0 54 volatile int sigterm_in_progress = 0;
meillo@0 55
meillo@10 56 static void
meillo@10 57 sigterm_handler(int sig)
meillo@0 58 {
meillo@10 59 if (sigterm_in_progress)
meillo@10 60 raise(sig);
meillo@10 61 sigterm_in_progress = 1;
meillo@0 62
meillo@10 63 if (pidfile) {
meillo@331 64 uid_t uid = geteuid();
meillo@331 65 if (seteuid(0) != 0) {
meillo@331 66 logwrite(LOG_ALERT, "sigterm_handler: could not set euid to %d: %s\n", 0, strerror(errno));
meillo@331 67 }
meillo@10 68 if (unlink(pidfile) != 0)
meillo@10 69 logwrite(LOG_WARNING, "could not delete pid file %s: %s\n", pidfile, strerror(errno));
meillo@10 70 seteuid(uid); /* we exit anyway after this, just to be sure */
meillo@10 71 }
meillo@0 72
meillo@10 73 signal(sig, SIG_DFL);
meillo@10 74 raise(sig);
meillo@0 75 }
meillo@0 76
meillo@10 77 #ifdef ENABLE_IDENT /* so far used for that only */
meillo@10 78 static gboolean
meillo@10 79 is_in_netlist(gchar * host, GList * netlist)
meillo@0 80 {
meillo@10 81 guint hostip = inet_addr(host);
meillo@10 82 struct in_addr addr;
meillo@0 83
meillo@10 84 addr.s_addr = hostip;
meillo@10 85 if (addr.s_addr != INADDR_NONE) {
meillo@10 86 GList *node;
meillo@10 87 foreach(netlist, node) {
meillo@10 88 struct in_addr *net = (struct in_addr *) (node->data);
meillo@10 89 if ((addr.s_addr & net->s_addr) == net->s_addr)
meillo@10 90 return TRUE;
meillo@10 91 }
meillo@10 92 }
meillo@10 93 return FALSE;
meillo@0 94 }
meillo@0 95 #endif
meillo@0 96
meillo@249 97 /*
meillo@249 98 argv: the original argv
meillo@249 99 argp: number of arg (may get modified!)
meillo@249 100 cp: pointing to the char after the option
meillo@249 101 e.g. `-d 6' `-d6'
meillo@249 102 ^ ^
meillo@249 103 */
meillo@10 104 gchar*
meillo@249 105 get_optarg(char* argv[], gint* argp, char* cp)
meillo@0 106 {
meillo@249 107 if (*cp) {
meillo@249 108 /* this kind: -xval */
meillo@249 109 return cp;
meillo@249 110 }
meillo@249 111 cp = argv[*argp+1];
meillo@249 112 if (cp && (*cp != '-')) {
meillo@249 113 /* this kind: -x val */
meillo@249 114 (*argp)++;
meillo@249 115 return cp;
meillo@10 116 }
meillo@10 117 return NULL;
meillo@0 118 }
meillo@0 119
meillo@10 120 gboolean
meillo@10 121 write_pidfile(gchar * name)
meillo@0 122 {
meillo@10 123 FILE *fptr;
meillo@0 124
meillo@10 125 if ((fptr = fopen(name, "wt"))) {
meillo@10 126 fprintf(fptr, "%d\n", getpid());
meillo@10 127 fclose(fptr);
meillo@10 128 pidfile = strdup(name);
meillo@10 129 return TRUE;
meillo@10 130 }
meillo@10 131 logwrite(LOG_WARNING, "could not write pid file: %s\n", strerror(errno));
meillo@10 132 return FALSE;
meillo@10 133 }
meillo@0 134
meillo@264 135 /* on -bd or if -q has an argument */
meillo@10 136 static void
meillo@10 137 mode_daemon(gboolean do_listen, gint queue_interval, char *argv[])
meillo@10 138 {
meillo@10 139 guint pid;
meillo@0 140
meillo@10 141 /* daemon */
meillo@10 142 if (!conf.run_as_user) {
meillo@10 143 if ((conf.orig_uid != 0) && (conf.orig_uid != conf.mail_uid)) {
meillo@10 144 fprintf(stderr, "must be root or %s for daemon.\n", DEF_MAIL_USER);
meillo@262 145 exit(1);
meillo@10 146 }
meillo@10 147 }
meillo@0 148
meillo@74 149 /* reparent to init only if init is not already the parent */
meillo@74 150 if (getppid() != 1) {
meillo@74 151 if ((pid = fork()) > 0) {
meillo@262 152 exit(0);
meillo@74 153 } else if (pid < 0) {
meillo@208 154 logwrite(LOG_ALERT, "could not fork!\n");
meillo@262 155 exit(1);
meillo@74 156 }
meillo@10 157 }
meillo@0 158
meillo@10 159 signal(SIGTERM, sigterm_handler);
meillo@10 160 write_pidfile(PIDFILEDIR "/masqmail.pid");
meillo@0 161
meillo@10 162 conf.do_verbose = FALSE;
meillo@10 163
meillo@72 164 /* closing and reopening the log ensures that it is open afterwards
meillo@72 165 because it is possible that the log is assigned to fd 1 and gets
meillo@72 166 thus closes by fclose(stdout). Similar for the debugfile.
meillo@72 167 */
meillo@72 168 logclose();
meillo@10 169 fclose(stdin);
meillo@10 170 fclose(stdout);
meillo@10 171 fclose(stderr);
meillo@72 172 logopen();
meillo@10 173
meillo@208 174 logwrite(LOG_NOTICE, "%s %s daemon starting\n", PACKAGE, VERSION);
meillo@10 175 listen_port(do_listen ? conf.listen_addresses : NULL, queue_interval, argv);
meillo@0 176 }
meillo@0 177
meillo@264 178 /* -bs or called as smtpd or in.smtpd */
meillo@10 179 static void
meillo@10 180 mode_smtp()
meillo@0 181 {
meillo@10 182 /* accept smtp message on stdin */
meillo@10 183 /* write responses to stderr. */
meillo@0 184
meillo@10 185 struct sockaddr_in saddr;
meillo@10 186 gchar *peername = NULL;
meillo@10 187 int dummy = sizeof(saddr);
meillo@0 188
meillo@10 189 conf.do_verbose = FALSE;
meillo@0 190
meillo@10 191 if (!conf.run_as_user) {
meillo@331 192 set_euidgid(conf.orig_uid, conf.orig_gid, NULL, NULL);
meillo@10 193 }
meillo@0 194
meillo@10 195 DEBUG(5) debugf("accepting smtp message on stdin\n");
meillo@0 196
meillo@10 197 if (getpeername(0, (struct sockaddr *) (&saddr), &dummy) == 0) {
meillo@10 198 peername = g_strdup(inet_ntoa(saddr.sin_addr));
meillo@10 199 } else if (errno != ENOTSOCK)
meillo@262 200 exit(1);
meillo@0 201
meillo@10 202 smtp_in(stdin, stderr, peername, NULL);
meillo@0 203 }
meillo@0 204
meillo@264 205 /* default mode if address args or -t is specified, or called as rmail */
meillo@10 206 static void
meillo@10 207 mode_accept(address * return_path, gchar * full_sender_name, guint accept_flags, char **addresses, int addr_cnt)
meillo@0 208 {
meillo@10 209 /* accept message on stdin */
meillo@10 210 accept_error err;
meillo@10 211 message *msg = create_message();
meillo@10 212 gint i;
meillo@266 213 pid_t pid;
meillo@0 214
meillo@83 215 if (return_path && !is_privileged_user(conf.orig_uid)) {
meillo@96 216 fprintf(stderr, "must be root, %s or in group %s for setting return path.\n", DEF_MAIL_USER, DEF_MAIL_GROUP);
meillo@262 217 exit(1);
meillo@10 218 }
meillo@0 219
meillo@10 220 if (!conf.run_as_user) {
meillo@331 221 set_euidgid(conf.orig_uid, conf.orig_gid, NULL, NULL);
meillo@10 222 }
meillo@0 223
meillo@10 224 DEBUG(5) debugf("accepting message on stdin\n");
meillo@0 225
meillo@10 226 msg->received_prot = PROT_LOCAL;
meillo@276 227
meillo@276 228 /* warn if -t option and cmdline addr args */
meillo@276 229 if (addr_cnt && (accept_flags & ACC_RCPT_FROM_HEAD)) {
meillo@276 230 logwrite(LOG_ALERT, "command line address arguments are now *added* to the mail header\\\n");
meillo@276 231 logwrite(LOG_ALERT, " recipient addresses (instead of substracted) when -t is given.\\\n");
meillo@276 232 logwrite(LOG_ALERT, " this changed with version 0.3.1\n");
meillo@276 233 }
meillo@276 234
meillo@10 235 for (i = 0; i < addr_cnt; i++) {
meillo@266 236 if (addresses[i][0] == '|') {
meillo@10 237 logwrite(LOG_ALERT, "no pipe allowed as recipient address: %s\n", addresses[i]);
meillo@276 238 /* should we better ignore this one addr? */
meillo@262 239 exit(1);
meillo@10 240 }
meillo@264 241 msg->rcpt_list = g_list_append(msg->rcpt_list, create_address_qualified(addresses[i], TRUE, conf.host_name));
meillo@10 242 }
meillo@0 243
meillo@10 244 /* -f option */
meillo@10 245 msg->return_path = return_path;
meillo@0 246
meillo@10 247 /* -F option */
meillo@10 248 msg->full_sender_name = full_sender_name;
meillo@0 249
meillo@266 250 err = accept_message(stdin, msg, accept_flags);
meillo@0 251
meillo@266 252 switch (err) {
meillo@266 253 case AERR_OK:
meillo@266 254 /* to continue; all other cases exit */
meillo@266 255 break;
meillo@266 256 case AERR_EOF:
meillo@266 257 fprintf(stderr, "unexpected EOF.\n");
meillo@266 258 exit(1);
meillo@266 259 case AERR_NORCPT:
meillo@266 260 fprintf(stderr, "no recipients.\n");
meillo@266 261 exit(1);
meillo@266 262 case AERR_SIZE:
meillo@266 263 fprintf(stderr, "max message size exceeded.\n");
meillo@266 264 exit(1);
meillo@266 265 default:
meillo@266 266 /* should never happen: */
meillo@266 267 fprintf(stderr, "Unknown error (%d)\r\n", err);
meillo@266 268 exit(1);
meillo@266 269 }
meillo@266 270
meillo@266 271 if (!spool_write(msg, TRUE)) {
meillo@266 272 fprintf(stderr, "Could not write spool file\n");
meillo@266 273 exit(1);
meillo@266 274 }
meillo@266 275
meillo@267 276 /* here the mail is queued and thus in our responsibility */
meillo@266 277 logwrite(LOG_NOTICE, "%s <= %s with %s\n", msg->uid, addr_string(msg->return_path), prot_names[PROT_LOCAL]);
meillo@266 278
meillo@266 279 if (conf.do_queue) {
meillo@266 280 /* we're finished as we only need to queue it */
meillo@266 281 return;
meillo@266 282 }
meillo@266 283
meillo@266 284 /* deliver at once */
meillo@266 285 if ((pid = fork()) < 0) {
meillo@266 286 logwrite(LOG_ALERT, "could not fork for delivery, id = %s\n", msg->uid);
meillo@266 287 } else if (pid == 0) {
meillo@266 288 conf.do_verbose = FALSE;
meillo@266 289 fclose(stdin);
meillo@266 290 fclose(stdout);
meillo@266 291 fclose(stderr);
meillo@266 292 if (deliver(msg)) {
meillo@266 293 exit(0);
meillo@10 294 } else {
meillo@267 295 /*
meillo@267 296 TODO:
meillo@267 297 Should we really fail here? Because the mail is queued
meillo@267 298 already. If we fail the client might submit it again.
meillo@267 299 If at-once-delivery is seen as an additional best-effort
meillo@267 300 service, then we should still exit successful here.
meillo@267 301 */
meillo@262 302 exit(1);
meillo@10 303 }
meillo@0 304 }
meillo@0 305 }
meillo@0 306
meillo@250 307 /*
meillo@264 308 if -Mrm is given
meillo@264 309
meillo@250 310 currently only the `rm' command is supported
meillo@250 311 until this changes, we don't need any facility for further commands
meillo@250 312 return success if at least one message had been deleted
meillo@250 313 */
meillo@250 314 static int
meillo@250 315 manipulate_queue(char* cmd, char* id[])
meillo@250 316 {
meillo@250 317 gboolean ok = FALSE;
meillo@250 318
meillo@250 319 if (strcmp(cmd, "rm") != 0) {
meillo@250 320 fprintf(stderr, "unknown command %s\n", cmd);
meillo@250 321 return FALSE;
meillo@250 322 }
meillo@250 323
meillo@250 324 set_euidgid(conf.mail_uid, conf.mail_gid, NULL, NULL);
meillo@250 325
meillo@250 326 /* privileged users may delete any mail */
meillo@250 327 if (is_privileged_user(conf.orig_uid)) {
meillo@250 328 for (; *id; id++) {
meillo@250 329 fprintf(stderr, "id: %s\n", *id);
meillo@250 330 if (queue_delete(*id)) {
meillo@250 331 ok = TRUE;
meillo@250 332 }
meillo@250 333 }
meillo@250 334 return ok;
meillo@250 335 }
meillo@250 336
meillo@250 337 struct passwd *pw = getpwuid(conf.orig_uid);
meillo@250 338 if (!pw) {
meillo@250 339 fprintf(stderr, "could not find a passwd entry for uid %d: %s\n",
meillo@250 340 conf.orig_uid, strerror(errno));
meillo@250 341 return FALSE;
meillo@250 342 }
meillo@250 343
meillo@250 344 /* non-privileged users may only delete their own messages */
meillo@250 345 for (; *id; id++) {
meillo@250 346 message *msg = msg_spool_read(*id, FALSE);
meillo@250 347
meillo@250 348 fprintf(stderr, "id: %s\n", *id);
meillo@250 349
meillo@250 350 if (!msg->ident) {
meillo@250 351 fprintf(stderr, "message %s does not have an ident\n", *id);
meillo@250 352 continue;
meillo@250 353 }
meillo@250 354 if (strcmp(pw->pw_name, msg->ident) != 0) {
meillo@250 355 fprintf(stderr, "you do not own message id %s\n", *id);
meillo@250 356 continue;
meillo@250 357 }
meillo@250 358
meillo@250 359 if ( (msg->received_host || (msg->received_prot != PROT_LOCAL))
meillo@250 360 #ifdef ENABLE_IDENT
meillo@250 361 && !is_in_netlist(msg->received_host, conf.ident_trusted_nets)
meillo@250 362 #endif
meillo@250 363 ) {
meillo@250 364 fprintf(stderr, "message %s was not received locally or from a trusted network\n", *id);
meillo@250 365 continue;
meillo@250 366 }
meillo@250 367
meillo@250 368 ok = queue_delete(*id);
meillo@250 369 }
meillo@250 370 return ok;
meillo@250 371 }
meillo@250 372
meillo@264 373 /* -qo, -q (without argument), or called as runq */
meillo@251 374 static int
meillo@251 375 run_queue(gboolean do_runq, gboolean do_runq_online, char* route_name)
meillo@251 376 {
meillo@251 377 int ret;
meillo@251 378
meillo@251 379 /* queue runs */
meillo@251 380 set_identity(conf.orig_uid, "queue run");
meillo@251 381
meillo@251 382 if (do_runq) {
meillo@251 383 ret = queue_run();
meillo@251 384 }
meillo@251 385
meillo@251 386 if (do_runq_online) {
meillo@251 387 if (route_name) {
meillo@310 388 conf.online_query = g_strdup_printf("/bin/echo %s", route_name);
meillo@251 389 }
meillo@290 390 /* TODO: change behavior of `-qo without argument'?
meillo@290 391 Because that behavior is included in -q. */
meillo@251 392 ret = queue_run_online();
meillo@251 393 }
meillo@251 394 return ret;
meillo@251 395 }
meillo@251 396
meillo@264 397 /* -bV or default mode if neither addr arg nor -t */
meillo@261 398 static void
meillo@261 399 mode_version(void)
meillo@261 400 {
meillo@261 401 gchar *with_resolver = "";
meillo@261 402 gchar *with_auth = "";
meillo@261 403 gchar *with_ident = "";
meillo@261 404
meillo@261 405 #ifdef ENABLE_RESOLVER
meillo@261 406 with_resolver = " +resolver";
meillo@261 407 #endif
meillo@261 408 #ifdef ENABLE_AUTH
meillo@261 409 with_auth = " +auth";
meillo@261 410 #endif
meillo@261 411 #ifdef ENABLE_IDENT
meillo@261 412 with_ident = " +ident";
meillo@261 413 #endif
meillo@261 414
meillo@261 415 printf("%s %s%s%s%s\n", PACKAGE, VERSION, with_resolver, with_auth, with_ident);
meillo@261 416 }
meillo@261 417
meillo@281 418 void
meillo@281 419 set_mode(enum mta_mode mode)
meillo@281 420 {
meillo@281 421 if (mta_mode && mta_mode!=mode) {
meillo@281 422 fprintf(stderr, "operation mode was already specified (%d vs. %d)\n", mta_mode, mode);
meillo@281 423 exit(1);
meillo@281 424 }
meillo@281 425
meillo@281 426 mta_mode = mode;
meillo@281 427 return;
meillo@281 428 }
meillo@281 429
meillo@0 430 int
meillo@0 431 main(int argc, char *argv[])
meillo@0 432 {
meillo@251 433 gchar *progname;
meillo@249 434 char* opt;
meillo@249 435 gint arg;
meillo@0 436
meillo@10 437 gboolean do_listen = FALSE;
meillo@10 438 gboolean do_runq = FALSE;
meillo@10 439 gboolean do_runq_online = FALSE;
meillo@10 440 gboolean do_queue = FALSE;
meillo@10 441 gint queue_interval = 0;
meillo@251 442 gchar *M_cmd = NULL;
meillo@10 443 gboolean opt_t = FALSE;
meillo@10 444 gboolean opt_i = FALSE;
meillo@251 445 gchar *conf_file = CONF_FILE;
meillo@10 446 gchar *route_name = NULL;
meillo@10 447 gchar *f_address = NULL;
meillo@251 448 address *return_path = NULL; /* may be changed by -f option */
meillo@10 449 gchar *full_sender_name = NULL;
meillo@251 450 gboolean do_verbose = FALSE;
meillo@251 451 gint debug_level = -1;
meillo@0 452
meillo@260 453 /* strip the path part */
meillo@261 454 progname = strrchr(argv[0], '/');
meillo@261 455 progname = (progname) ? progname+1 : argv[0];
meillo@0 456
meillo@10 457 if (strcmp(progname, "mailq") == 0) {
meillo@10 458 mta_mode = MODE_LIST;
meillo@10 459 } else if (strcmp(progname, "mailrm") == 0) {
meillo@10 460 mta_mode = MODE_MCMD;
meillo@10 461 M_cmd = "rm";
meillo@284 462 } else if (strcmp(progname, "newaliases") == 0) {
meillo@284 463 mta_mode = MODE_BI;
meillo@10 464 } else if (strcmp(progname, "rmail") == 0) {
meillo@89 465 /* the `rmail' alias should probably be removed now
meillo@89 466 that we have the rmail script. But let's keep it
meillo@89 467 for some while for compatibility. 2010-06-19 */
meillo@10 468 mta_mode = MODE_ACCEPT;
meillo@10 469 opt_i = TRUE;
meillo@284 470 } else if (strcmp(progname, "runq") == 0) {
meillo@284 471 mta_mode = MODE_RUNQUEUE;
meillo@284 472 do_runq = TRUE;
meillo@284 473 } else if (strcmp(progname, "smtpd") == 0
meillo@284 474 || strcmp(progname, "in.smtpd") == 0) {
meillo@10 475 mta_mode = MODE_SMTP;
meillo@10 476 }
meillo@0 477
meillo@10 478 /* parse cmd line */
meillo@249 479 for (arg=1; arg<argc && argv[arg][0]=='-'; arg++) {
meillo@251 480 opt = argv[arg] + 1; /* points to the char after the dash */
meillo@10 481
meillo@249 482 if (strcmp(opt, "-") == 0) {
meillo@249 483 /* everything after `--' are address arguments */
meillo@249 484 arg++;
meillo@249 485 break;
meillo@10 486
meillo@278 487 } else if (strcmp(opt, "bm") == 0) {
meillo@281 488 set_mode(MODE_ACCEPT);
meillo@278 489
meillo@249 490 } else if (strcmp(opt, "bd") == 0) {
meillo@281 491 set_mode(MODE_DAEMON);
meillo@249 492 do_listen = TRUE;
meillo@249 493
meillo@249 494 } else if (strcmp(opt, "bi") == 0) {
meillo@281 495 set_mode(MODE_BI);
meillo@249 496
meillo@249 497 } else if (strcmp(opt, "bs") == 0) {
meillo@281 498 set_mode(MODE_SMTP);
meillo@249 499
meillo@249 500 } else if (strcmp(opt, "bp") == 0) {
meillo@281 501 set_mode(MODE_LIST);
meillo@249 502
meillo@249 503 } else if (strcmp(opt, "bV") == 0) {
meillo@281 504 set_mode(MODE_VERSION);
meillo@249 505
meillo@249 506 } else if (strncmp(opt, "B", 1) == 0) {
meillo@249 507 /* we ignore this and throw the argument away */
meillo@249 508 get_optarg(argv, &arg, opt+1);
meillo@249 509
meillo@249 510 } else if (strncmp(opt, "C", 1) == 0) {
meillo@251 511 conf_file = get_optarg(argv, &arg, opt+1);
meillo@251 512 if (!conf_file) {
meillo@249 513 fprintf(stderr, "-C requires a filename as argument.\n");
meillo@262 514 exit(1);
meillo@10 515 }
meillo@249 516
meillo@249 517 } else if (strncmp(opt, "d", 1) == 0) {
meillo@249 518 if (getuid() != 0) {
meillo@249 519 fprintf(stderr, "only root may set the debug level.\n");
meillo@262 520 exit(1);
meillo@249 521 }
meillo@249 522 char *lvl = get_optarg(argv, &arg, opt+1);
meillo@249 523 if (!lvl) {
meillo@249 524 fprintf(stderr, "-d requires a number argument.\n");
meillo@262 525 exit(1);
meillo@249 526 }
meillo@249 527 debug_level = atoi(lvl);
meillo@249 528
meillo@249 529 } else if (strncmp(opt, "f", 1) == 0) {
meillo@249 530 /* set return path */
meillo@249 531 gchar *address = get_optarg(argv, &arg, opt+1);
meillo@249 532 if (!address) {
meillo@249 533 fprintf(stderr, "-f requires an address argument\n");
meillo@262 534 exit(1);
meillo@249 535 }
meillo@249 536 f_address = g_strdup(address);
meillo@249 537
meillo@249 538 } else if (strncmp(opt, "F", 1) == 0) {
meillo@249 539 full_sender_name = get_optarg(argv, &arg, opt+1);
meillo@249 540 if (!full_sender_name) {
meillo@249 541 fprintf(stderr, "-F requires a name argument\n");
meillo@262 542 exit(1);
meillo@249 543 }
meillo@249 544
meillo@249 545 } else if (strcmp(opt, "i") == 0) {
meillo@249 546 opt_i = TRUE;
meillo@249 547
meillo@249 548 } else if (strcmp(opt, "m") == 0) {
meillo@249 549 /* ignore -m (me too) switch (see man page) */
meillo@249 550
meillo@249 551 } else if (strcmp(opt, "Mrm") == 0) {
meillo@281 552 set_mode(MODE_MCMD);
meillo@249 553 M_cmd = "rm";
meillo@249 554
meillo@249 555 } else if (strcmp(opt, "odq") == 0) {
meillo@249 556 do_queue = TRUE;
meillo@249 557
meillo@249 558 } else if (strcmp(opt, "oi") == 0) {
meillo@257 559 opt_i = TRUE;
meillo@249 560
meillo@249 561 } else if (strncmp(opt, "o", 1) == 0) {
meillo@249 562 /* ignore all other -oXXX options */
meillo@249 563
meillo@249 564 } else if (strncmp(opt, "qo", 2) == 0) {
meillo@278 565 /* must be before the `q' check */
meillo@281 566 set_mode(MODE_RUNQUEUE);
meillo@249 567 do_runq_online = TRUE;
meillo@249 568 /* can be NULL, then we use online detection method */
meillo@290 569 /* TODO: behavior might change if it is NULL */
meillo@249 570 route_name = get_optarg(argv, &arg, opt+2);
meillo@290 571 if (!route_name) {
meillo@290 572 fprintf(stderr, "Please do not use -qo without argument anymore; use -q instead.\n");
meillo@290 573 fprintf(stderr, "The behavior for -qo without argument is likely to change.\n");
meillo@290 574 }
meillo@249 575
meillo@249 576 } else if (strncmp(opt, "q", 1) == 0) {
meillo@249 577 /* must be after the `qo' check */
meillo@249 578 gchar *optarg;
meillo@249 579
meillo@251 580 optarg = get_optarg(argv, &arg, opt+1);
meillo@251 581 if (optarg) {
meillo@251 582 /* not just one single queue run but regular runs */
meillo@281 583 set_mode(MODE_DAEMON);
meillo@254 584 queue_interval = time_interval(optarg);
meillo@281 585 } else {
meillo@281 586 set_mode(MODE_RUNQUEUE);
meillo@281 587 do_runq = TRUE;
meillo@249 588 }
meillo@249 589
meillo@249 590 } else if (strcmp(opt, "t") == 0) {
meillo@249 591 opt_t = TRUE;
meillo@249 592
meillo@249 593 } else if (strcmp(opt, "v") == 0) {
meillo@249 594 do_verbose = TRUE;
meillo@249 595
meillo@10 596 } else {
meillo@249 597 fprintf(stderr, "unrecognized option `-%s'\n", opt);
meillo@262 598 exit(1);
meillo@10 599 }
meillo@0 600 }
meillo@0 601
meillo@281 602 if (!mta_mode && arg==argc && !opt_t) {
meillo@278 603 /*
meillo@278 604 In this case no rcpts can be found, thus no mail
meillo@278 605 can be sent, thus masqmail will always fail. We
meillo@278 606 rather do something better instead. This covers
meillo@278 607 also the case of calling masqmail without args.
meillo@278 608 */
meillo@281 609 mode_version();
meillo@281 610 exit(0);
meillo@259 611 }
meillo@259 612
meillo@10 613 if (mta_mode == MODE_VERSION) {
meillo@261 614 mode_version();
meillo@262 615 exit(0);
meillo@10 616 }
meillo@0 617
meillo@281 618 if (!mta_mode) {
meillo@281 619 mta_mode = MODE_ACCEPT;
meillo@281 620 }
meillo@281 621
meillo@10 622 /* initialize random generator */
meillo@10 623 srand(time(NULL));
meillo@10 624 /* ignore SIGPIPE signal */
meillo@10 625 signal(SIGPIPE, SIG_IGN);
meillo@0 626
meillo@73 627 /* close all possibly open file descriptors, except std{in,out,err} */
meillo@10 628 {
meillo@10 629 int i, max_fd = sysconf(_SC_OPEN_MAX);
meillo@0 630
meillo@251 631 if (max_fd <= 0) {
meillo@10 632 max_fd = 64;
meillo@251 633 }
meillo@251 634 for (i=3; i<max_fd; i++) {
meillo@10 635 close(i);
meillo@251 636 }
meillo@10 637 }
meillo@0 638
meillo@10 639 init_conf();
meillo@0 640
meillo@10 641 /* if we are not privileged, and the config file was changed we
meillo@10 642 implicetely set the the run_as_user flag and give up all
meillo@10 643 privileges.
meillo@0 644
meillo@10 645 So it is possible for a user to run his own daemon without
meillo@10 646 breaking security.
meillo@10 647 */
meillo@251 648 if ((strcmp(conf_file, CONF_FILE) != 0) && (conf.orig_uid != 0)) {
meillo@251 649 conf.run_as_user = TRUE;
meillo@331 650 set_euidgid(conf.orig_uid, conf.orig_gid, NULL, NULL);
meillo@331 651 if (setgid(conf.orig_gid)) {
meillo@331 652 logwrite(LOG_ALERT, "could not set gid to %d: %s\n", conf.orig_gid, strerror(errno));
meillo@331 653 exit(1);
meillo@331 654 }
meillo@331 655 if (setuid(conf.orig_uid)) {
meillo@331 656 logwrite(LOG_ALERT, "could not set uid to %d: %s\n", conf.orig_uid, strerror(errno));
meillo@331 657 exit(1);
meillo@331 658 }
meillo@10 659 }
meillo@0 660
meillo@155 661 conf.log_dir = LOG_DIR;
meillo@288 662 /* FIXME: fails if we run as user */
meillo@155 663 logopen();
meillo@155 664 if (!read_conf(conf_file)) {
meillo@155 665 logwrite(LOG_ALERT, "SHUTTING DOWN due to problems reading config\n");
meillo@155 666 exit(5);
meillo@155 667 }
meillo@155 668 logclose();
meillo@0 669
meillo@251 670 if (do_queue) {
meillo@10 671 conf.do_queue = TRUE;
meillo@251 672 }
meillo@251 673 if (do_verbose) {
meillo@10 674 conf.do_verbose = TRUE;
meillo@251 675 }
meillo@251 676 if (debug_level >= 0) { /* if >= 0, it was given by argument */
meillo@10 677 conf.debug_level = debug_level;
meillo@251 678 }
meillo@0 679
meillo@46 680 /* It appears that changing to / ensures that we are never in
meillo@46 681 a directory which we cannot access. This situation could be
meillo@46 682 possible after changing identity.
meillo@46 683 Maybe we should only change to / if we not run as user, to
meillo@46 684 allow relative paths for log files in test setups for
meillo@46 685 instance.
meillo@46 686 */
meillo@10 687 chdir("/");
meillo@0 688
meillo@10 689 if (!conf.run_as_user) {
meillo@10 690 if (setgid(0) != 0) {
meillo@10 691 fprintf(stderr, "could not set gid to 0. Is the setuid bit set? : %s\n", strerror(errno));
meillo@262 692 exit(1);
meillo@10 693 }
meillo@10 694 if (setuid(0) != 0) {
meillo@10 695 fprintf(stderr, "could not gain root privileges. Is the setuid bit set? : %s\n", strerror(errno));
meillo@262 696 exit(1);
meillo@10 697 }
meillo@10 698 }
meillo@0 699
meillo@10 700 if (!logopen()) {
meillo@10 701 fprintf(stderr, "could not open log file\n");
meillo@262 702 exit(1);
meillo@10 703 }
meillo@0 704
meillo@10 705 DEBUG(1) debugf("masqmail %s starting\n", VERSION);
meillo@0 706
meillo@10 707 DEBUG(5) {
meillo@10 708 gchar **str = argv;
meillo@10 709 debugf("args: \n");
meillo@10 710 while (*str) {
meillo@10 711 debugf("%s \n", *str);
meillo@10 712 str++;
meillo@10 713 }
meillo@10 714 }
meillo@10 715 DEBUG(5) debugf("queue_interval = %d\n", queue_interval);
meillo@0 716
meillo@10 717 if (f_address) {
meillo@10 718 return_path = create_address_qualified(f_address, TRUE, conf.host_name);
meillo@10 719 g_free(f_address);
meillo@10 720 if (!return_path) {
meillo@10 721 fprintf(stderr, "invalid RFC821 address: %s\n", f_address);
meillo@262 722 exit(1);
meillo@10 723 }
meillo@10 724 }
meillo@10 725
meillo@10 726 switch (mta_mode) {
meillo@10 727 case MODE_DAEMON:
meillo@10 728 mode_daemon(do_listen, queue_interval, argv);
meillo@10 729 break;
meillo@251 730
meillo@10 731 case MODE_RUNQUEUE:
meillo@251 732 exit(run_queue(do_runq, do_runq_online, route_name) ? 0 : 1);
meillo@10 733 break;
meillo@10 734
meillo@10 735 case MODE_SMTP:
meillo@10 736 mode_smtp();
meillo@10 737 break;
meillo@10 738
meillo@10 739 case MODE_LIST:
meillo@10 740 queue_list();
meillo@10 741 break;
meillo@10 742
meillo@10 743 case MODE_BI:
meillo@262 744 exit(0);
meillo@10 745 break; /* well... */
meillo@10 746
meillo@10 747 case MODE_MCMD:
meillo@250 748 exit(manipulate_queue(M_cmd, &argv[arg]) ? 0 : 1);
meillo@10 749 break;
meillo@10 750
meillo@10 751 case MODE_ACCEPT:
meillo@10 752 {
meillo@268 753 guint accept_flags = (opt_t ? ACC_RCPT_FROM_HEAD : 0)
meillo@110 754 | (opt_i ? ACC_DOT_IGNORE : ACC_NODOT_RELAX);
meillo@10 755 mode_accept(return_path, full_sender_name, accept_flags, &(argv[arg]), argc - arg);
meillo@258 756 exit(0);
meillo@10 757 }
meillo@10 758 break;
meillo@251 759
meillo@10 760 default:
meillo@10 761 fprintf(stderr, "unknown mode: %d\n", mta_mode);
meillo@10 762 break;
meillo@0 763 }
meillo@0 764
meillo@10 765 logclose();
meillo@0 766
meillo@263 767 exit(0);
meillo@0 768 }