masqmail
view src/masqmail.c @ 411:9b93c0a3bd8c
Ensure lvals, rvals and components of address strucs are stripped.
| author | markus schnalke <meillo@marmaro.de> |
|---|---|
| date | Wed, 29 Feb 2012 12:06:33 +0100 |
| parents | cdd16614c1f5 |
| children | 0430194f7ef8 |
line source
1 /*
2 ** MasqMail
3 ** Copyright (C) 1999-2001 Oliver Kurth
4 ** Copyright (C) 2010 markus schnalke <meillo@marmaro.de>
5 **
6 ** This program is free software; you can redistribute it and/or modify
7 ** it under the terms of the GNU General Public License as published by
8 ** the Free Software Foundation; either version 2 of the License, or
9 ** (at your option) any later version.
10 **
11 ** This program is distributed in the hope that it will be useful,
12 ** but WITHOUT ANY WARRANTY; without even the implied warranty of
13 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 ** GNU General Public License for more details.
15 **
16 ** You should have received a copy of the GNU General Public License
17 ** along with this program; if not, write to the Free Software
18 ** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19 */
21 #include <stdio.h>
22 #include <errno.h>
23 #include <stdlib.h>
24 #include <string.h>
25 #include <unistd.h>
26 #include <sys/types.h>
27 #include <sys/socket.h>
28 #include <sys/time.h>
29 #include <netinet/in.h>
30 #include <netdb.h>
31 #include <syslog.h>
32 #include <signal.h>
34 #include <glib.h>
36 #include "masqmail.h"
38 /*
39 ** mutually exclusive modes. Note that there is no 'queue daemon' mode.
40 ** It, as well as the distinction beween the two (non exclusive) daemon
41 ** (queue and listen) modes, is handled by flags.
42 */
43 enum mta_mode {
44 MODE_NONE = 0, /* to check if a mode was set */
45 MODE_ACCEPT, /* accept message on stdin (fallback mode) */
46 MODE_DAEMON, /* run as daemon */
47 MODE_RUNQUEUE, /* single queue run, online or offline */
48 MODE_SMTP, /* accept SMTP on stdin */
49 MODE_LIST, /* list queue */
50 MODE_MCMD, /* do queue manipulation */
51 MODE_VERSION, /* show version */
52 MODE_BI, /* fake ;-) */
53 };
54 enum mta_mode mta_mode = MODE_NONE;
56 char *pidfile = NULL;
57 volatile int sigterm_in_progress = 0;
59 static void
60 sigterm_handler(int sig)
61 {
62 if (sigterm_in_progress)
63 raise(sig);
64 sigterm_in_progress = 1;
66 if (pidfile) {
67 uid_t uid = geteuid();
68 if (seteuid(0) != 0) {
69 logwrite(LOG_ALERT, "sigterm_handler: could not set "
70 "euid to %d: %s\n",
71 0, strerror(errno));
72 }
73 if (unlink(pidfile) != 0)
74 logwrite(LOG_WARNING,
75 "could not delete pid file %s: %s\n",
76 pidfile, strerror(errno));
77 seteuid(uid); /* we exit anyway after this, just to be sure */
78 }
80 signal(sig, SIG_DFL);
81 raise(sig);
82 }
84 /*
85 ** argv: the original argv
86 ** argp: number of arg (may get modified!)
87 ** cp: pointing to the char after the option
88 ** e.g. `-d 6' `-d6'
89 ** ^ ^
90 */
91 gchar*
92 get_optarg(char *argv[], gint *argp, char *cp)
93 {
94 if (*cp) {
95 /* this kind: -xval */
96 return cp;
97 }
98 cp = argv[*argp+1];
99 if (cp && (*cp != '-')) {
100 /* this kind: -x val */
101 (*argp)++;
102 return cp;
103 }
104 return NULL;
105 }
107 gboolean
108 write_pidfile(gchar *name)
109 {
110 FILE *fptr;
112 if ((fptr = fopen(name, "wt"))) {
113 fprintf(fptr, "%d\n", getpid());
114 fclose(fptr);
115 pidfile = strdup(name);
116 return TRUE;
117 }
118 logwrite(LOG_WARNING, "could not write pid file: %s\n",
119 strerror(errno));
120 return FALSE;
121 }
123 /* on -bd or if -q has an argument */
124 static void
125 mode_daemon(gboolean do_listen, gint queue_interval, char *argv[])
126 {
127 guint pid;
129 /* daemon */
130 if (!conf.run_as_user) {
131 if ((conf.orig_uid != 0) && (conf.orig_uid != conf.mail_uid)) {
132 fprintf(stderr, "must be root or %s for daemon.\n",
133 DEF_MAIL_USER);
134 exit(1);
135 }
136 }
138 /* reparent to init only if init is not already the parent */
139 if (getppid() != 1) {
140 if ((pid = fork()) > 0) {
141 exit(0);
142 } else if (pid < 0) {
143 logwrite(LOG_ALERT, "could not fork!\n");
144 exit(1);
145 }
146 }
148 signal(SIGTERM, sigterm_handler);
149 write_pidfile(PIDFILEDIR "/masqmail.pid");
151 conf.do_verbose = FALSE;
153 /*
154 ** closing and reopening the log ensures that it is open afterwards
155 ** because it is possible that the log is assigned to fd 1 and gets
156 ** thus closes by fclose(stdout). Similar for the debugfile.
157 */
158 logclose();
159 fclose(stdin);
160 fclose(stdout);
161 fclose(stderr);
162 logopen();
164 logwrite(LOG_NOTICE, "%s %s daemon starting\n", PACKAGE, VERSION);
165 listen_port(do_listen ? conf.listen_addresses : NULL,
166 queue_interval, argv);
167 }
169 /* -bs or called as smtpd or in.smtpd */
170 static void
171 mode_smtp()
172 {
173 /* accept smtp message on stdin */
174 /* write responses to stderr. */
176 struct sockaddr_in saddr;
177 gchar *peername = NULL;
178 int dummy = sizeof(saddr);
180 conf.do_verbose = FALSE;
182 if (!conf.run_as_user) {
183 set_euidgid(conf.orig_uid, conf.orig_gid, NULL, NULL);
184 }
186 DEBUG(5) debugf("accepting smtp message on stdin\n");
188 if (getpeername(0, (struct sockaddr *) (&saddr), &dummy) == 0) {
189 peername = g_strdup(inet_ntoa(saddr.sin_addr));
190 } else if (errno != ENOTSOCK)
191 exit(1);
193 smtp_in(stdin, stderr, peername, NULL);
194 }
196 /* default mode if address args or -t is specified, or called as rmail */
197 static void
198 mode_accept(address *return_path, gchar *full_sender_name, guint accept_flags,
199 char **addresses, int addr_cnt)
200 {
201 /* accept message on stdin */
202 accept_error err;
203 message *msg = create_message();
204 gint i;
205 pid_t pid;
207 if (return_path && !is_privileged_user(conf.orig_uid)) {
208 fprintf(stderr, "must be root, %s or in group %s for "
209 "setting return path.\n",
210 DEF_MAIL_USER, DEF_MAIL_GROUP);
211 exit(1);
212 }
214 if (!conf.run_as_user) {
215 set_euidgid(conf.orig_uid, conf.orig_gid, NULL, NULL);
216 }
218 DEBUG(5) debugf("accepting message on stdin\n");
220 msg->received_prot = PROT_LOCAL;
222 /* warn if -t option and cmdline addr args */
223 if (addr_cnt && (accept_flags & ACC_RCPT_FROM_HEAD)) {
224 logwrite(LOG_ALERT, "command line address arguments are "
225 "now *added* to the mail header\\\n");
226 logwrite(LOG_ALERT, " recipient addresses (instead of "
227 "substracted) when -t is given.\\\n");
228 logwrite(LOG_ALERT, " this changed with version 0.3.1\n");
229 }
231 for (i = 0; i < addr_cnt; i++) {
232 if (addresses[i][0] == '|') {
233 logwrite(LOG_ALERT, "no pipe allowed as recipient "
234 "address: %s\n", addresses[i]);
235 /* should we better ignore this one addr? */
236 exit(1);
237 }
238 msg->rcpt_list = g_list_append(msg->rcpt_list,
239 create_address_qualified(addresses[i],
240 TRUE, conf.host_name));
241 }
243 /* -f option */
244 msg->return_path = return_path;
246 /* -F option */
247 msg->full_sender_name = full_sender_name;
249 err = accept_message(stdin, msg, accept_flags);
251 switch (err) {
252 case AERR_OK:
253 /* to continue; all other cases exit */
254 break;
255 case AERR_EOF:
256 fprintf(stderr, "unexpected EOF.\n");
257 exit(1);
258 case AERR_NORCPT:
259 fprintf(stderr, "no recipients.\n");
260 exit(1);
261 case AERR_SIZE:
262 fprintf(stderr, "max message size exceeded.\n");
263 exit(1);
264 default:
265 /* should never happen: */
266 fprintf(stderr, "Unknown error (%d)\r\n", err);
267 exit(1);
268 }
270 if (!spool_write(msg, TRUE)) {
271 fprintf(stderr, "Could not write spool file\n");
272 exit(1);
273 }
275 /* here the mail is queued and thus in our responsibility */
276 logwrite(LOG_NOTICE, "%s <= %s with %s\n", msg->uid,
277 addr_string(msg->return_path), prot_names[PROT_LOCAL]);
279 if (conf.do_queue) {
280 /* we're finished as we only need to queue it */
281 return;
282 }
284 /* deliver at once */
285 if ((pid = fork()) < 0) {
286 logwrite(LOG_ALERT, "could not fork for delivery, id = %s\n",
287 msg->uid);
288 } else if (pid == 0) {
289 conf.do_verbose = FALSE;
290 fclose(stdin);
291 fclose(stdout);
292 fclose(stderr);
293 if (deliver(msg)) {
294 exit(0);
295 } else {
296 /*
297 ** TODO: Should we really fail here? Because the
298 ** mail is queued already. If we fail the client
299 ** might submit it again. If at-once-delivery
300 ** is seen as an additional best-effort service,
301 ** then we should still exit successful here.
302 */
303 exit(1);
304 }
305 }
306 }
308 /*
309 ** if -Mrm is given
310 **
311 ** currently only the `rm' command is supported
312 ** until this changes, we don't need any facility for further commands
313 ** return success if at least one message had been deleted
314 */
315 static int
316 manipulate_queue(char *cmd, char *id[])
317 {
318 gboolean ok = FALSE;
320 if (strcmp(cmd, "rm") != 0) {
321 fprintf(stderr, "unknown command %s\n", cmd);
322 return FALSE;
323 }
325 set_euidgid(conf.mail_uid, conf.mail_gid, NULL, NULL);
327 /* privileged users may delete any mail */
328 if (is_privileged_user(conf.orig_uid)) {
329 for (; *id; id++) {
330 fprintf(stderr, "id: %s\n", *id);
331 if (queue_delete(*id)) {
332 ok = TRUE;
333 }
334 }
335 return ok;
336 }
338 struct passwd *pw = getpwuid(conf.orig_uid);
339 if (!pw) {
340 fprintf(stderr, "could not find a passwd entry for "
341 "uid %d: %s\n",
342 conf.orig_uid, strerror(errno));
343 return FALSE;
344 }
346 /* non-privileged users may only delete their own messages */
347 for (; *id; id++) {
348 message *msg = msg_spool_read(*id);
350 fprintf(stderr, "id: %s\n", *id);
352 if (!msg->ident) {
353 fprintf(stderr, "message %s does not have an ident\n",
354 *id);
355 continue;
356 }
357 if (strcmp(pw->pw_name, msg->ident) != 0) {
358 fprintf(stderr, "you do not own message id %s\n", *id);
359 continue;
360 }
362 if (msg->received_host || (msg->received_prot != PROT_LOCAL)) {
363 fprintf(stderr, "message %s was not received "
364 "locally\n", *id);
365 continue;
366 }
368 ok = queue_delete(*id);
369 }
370 return ok;
371 }
373 /* -qo, -q (without argument), or called as runq */
374 static int
375 run_queue(gboolean do_runq, gboolean do_runq_online, char *route_name)
376 {
377 int ret;
379 /* queue runs */
380 set_identity(conf.orig_uid, "queue run");
382 if (do_runq) {
383 ret = queue_run();
384 }
386 if (do_runq_online) {
387 if (route_name) {
388 conf.online_query = g_strdup_printf("/bin/echo %s",
389 route_name);
390 }
391 /*
392 ** TODO: change behavior of `-qo without argument'?
393 ** Because that behavior is included in -q.
394 */
395 ret = queue_run_online();
396 }
397 return ret;
398 }
400 /* -bV or default mode if neither addr arg nor -t */
401 static void
402 mode_version(void)
403 {
404 gchar *with_resolver = "";
405 gchar *with_auth = "";
407 #ifdef ENABLE_RESOLVER
408 with_resolver = " +resolver";
409 #endif
410 #ifdef ENABLE_AUTH
411 with_auth = " +auth";
412 #endif
414 printf("%s %s%s%s\n", PACKAGE, VERSION, with_resolver, with_auth);
415 }
417 void
418 set_mode(enum mta_mode mode)
419 {
420 if (mta_mode && mta_mode!=mode) {
421 fprintf(stderr, "operation mode was already specified "
422 "(%d vs. %d)\n", mta_mode, mode);
423 exit(1);
424 }
426 mta_mode = mode;
427 return;
428 }
430 int
431 main(int argc, char *argv[])
432 {
433 gchar *progname;
434 char *opt;
435 gint arg;
437 gboolean do_listen = FALSE;
438 gboolean do_runq = FALSE;
439 gboolean do_runq_online = FALSE;
440 gboolean do_queue = FALSE;
441 gint queue_interval = 0;
442 gchar *M_cmd = NULL;
443 gboolean opt_t = FALSE;
444 gboolean opt_i = FALSE;
445 gchar *conf_file = CONF_FILE;
446 gchar *route_name = NULL;
447 gchar *f_address = NULL;
448 address *return_path = NULL; /* may be changed by -f option */
449 gchar *full_sender_name = NULL;
450 gboolean do_verbose = FALSE;
451 gint debug_level = -1;
453 /* strip the path part */
454 progname = strrchr(argv[0], '/');
455 progname = (progname) ? progname+1 : argv[0];
457 if (strcmp(progname, "mailq") == 0) {
458 mta_mode = MODE_LIST;
459 } else if (strcmp(progname, "mailrm") == 0) {
460 mta_mode = MODE_MCMD;
461 M_cmd = "rm";
462 } else if (strcmp(progname, "newaliases") == 0) {
463 mta_mode = MODE_BI;
464 } else if (strcmp(progname, "rmail") == 0) {
465 /*
466 ** the `rmail' alias should probably be removed now
467 ** that we have the rmail script. But let's keep it
468 ** for some while for compatibility. 2010-06-19
469 */
470 mta_mode = MODE_ACCEPT;
471 opt_i = TRUE;
472 } else if (strcmp(progname, "runq") == 0) {
473 mta_mode = MODE_RUNQUEUE;
474 do_runq = TRUE;
475 } else if (strcmp(progname, "smtpd") == 0
476 || strcmp(progname, "in.smtpd") == 0) {
477 mta_mode = MODE_SMTP;
478 }
480 /* parse cmd line */
481 for (arg=1; arg<argc && argv[arg][0]=='-'; arg++) {
482 opt = argv[arg] + 1; /* points to the char after the dash */
484 if (strcmp(opt, "-") == 0) {
485 /* everything after `--' are address arguments */
486 arg++;
487 break;
489 } else if (strcmp(opt, "bm") == 0) {
490 set_mode(MODE_ACCEPT);
492 } else if (strcmp(opt, "bd") == 0) {
493 set_mode(MODE_DAEMON);
494 do_listen = TRUE;
496 } else if (strcmp(opt, "bi") == 0) {
497 set_mode(MODE_BI);
499 } else if (strcmp(opt, "bs") == 0) {
500 set_mode(MODE_SMTP);
502 } else if (strcmp(opt, "bp") == 0) {
503 set_mode(MODE_LIST);
505 } else if (strcmp(opt, "bV") == 0) {
506 set_mode(MODE_VERSION);
508 } else if (strncmp(opt, "B", 1) == 0) {
509 /* we ignore this and throw the argument away */
510 get_optarg(argv, &arg, opt+1);
512 } else if (strncmp(opt, "C", 1) == 0) {
513 conf_file = get_optarg(argv, &arg, opt+1);
514 if (!conf_file) {
515 fprintf(stderr, "-C requires filename arg.\n");
516 exit(1);
517 }
519 } else if (strncmp(opt, "d", 1) == 0) {
520 if (getuid() != 0) {
521 fprintf(stderr, "only root may set the "
522 "debug level.\n");
523 exit(1);
524 }
525 char *lvl = get_optarg(argv, &arg, opt+1);
526 if (!lvl) {
527 fprintf(stderr, "-d requires number arg.\n");
528 exit(1);
529 }
530 debug_level = atoi(lvl);
532 } else if (strncmp(opt, "f", 1) == 0) {
533 /* set return path */
534 gchar *address = get_optarg(argv, &arg, opt+1);
535 if (!address) {
536 fprintf(stderr, "-f requires address arg.\n");
537 exit(1);
538 }
539 f_address = g_strdup(address);
541 } else if (strncmp(opt, "F", 1) == 0) {
542 full_sender_name = get_optarg(argv, &arg, opt+1);
543 if (!full_sender_name) {
544 fprintf(stderr, "-F requires name arg.\n");
545 exit(1);
546 }
548 } else if (strcmp(opt, "i") == 0) {
549 opt_i = TRUE;
551 } else if (strcmp(opt, "m") == 0) {
552 /* ignore -m (me too) switch (see man page) */
554 } else if (strcmp(opt, "Mrm") == 0) {
555 set_mode(MODE_MCMD);
556 M_cmd = "rm";
558 } else if (strcmp(opt, "odq") == 0) {
559 do_queue = TRUE;
561 } else if (strcmp(opt, "oi") == 0) {
562 opt_i = TRUE;
564 } else if (strncmp(opt, "o", 1) == 0) {
565 /* ignore all other -oXXX options */
567 } else if (strncmp(opt, "qo", 2) == 0) {
568 /* must be before the `q' check */
569 set_mode(MODE_RUNQUEUE);
570 do_runq_online = TRUE;
571 /* can be NULL, then we use online detection method */
572 /* TODO: behavior might change if it is NULL */
573 route_name = get_optarg(argv, &arg, opt+2);
574 if (!route_name) {
575 fprintf(stderr, "Please do not use -qo "
576 "without argument anymore; "
577 "use -q instead.\n");
578 fprintf(stderr, "The behavior for -qo without "
579 "argument is likely to "
580 "change.\n");
581 }
583 } else if (strncmp(opt, "q", 1) == 0) {
584 /* must be after the `qo' check */
585 gchar *optarg;
587 optarg = get_optarg(argv, &arg, opt+1);
588 if (optarg) {
589 /* do regular queue runs */
590 set_mode(MODE_DAEMON);
591 queue_interval = time_interval(optarg);
592 } else {
593 /* do a single queue run */
594 set_mode(MODE_RUNQUEUE);
595 do_runq = TRUE;
596 }
598 } else if (strcmp(opt, "t") == 0) {
599 opt_t = TRUE;
601 } else if (strcmp(opt, "v") == 0) {
602 do_verbose = TRUE;
604 } else {
605 fprintf(stderr, "unrecognized option `-%s'\n", opt);
606 exit(1);
607 }
608 }
610 if (!mta_mode && arg==argc && !opt_t) {
611 /*
612 ** In this case no rcpts can be found, thus no mail
613 ** can be sent, thus masqmail will always fail. We
614 ** rather do something better instead. This covers
615 ** also the case of calling masqmail without args.
616 */
617 mode_version();
618 exit(0);
619 }
621 if (mta_mode == MODE_VERSION) {
622 mode_version();
623 exit(0);
624 }
626 if (!mta_mode) {
627 mta_mode = MODE_ACCEPT;
628 }
630 /* initialize random generator */
631 srand(time(NULL));
632 /* ignore SIGPIPE signal */
633 signal(SIGPIPE, SIG_IGN);
635 /* close all possibly open file descriptors, except std{in,out,err} */
636 {
637 int i, max_fd = sysconf(_SC_OPEN_MAX);
639 if (max_fd <= 0) {
640 max_fd = 64;
641 }
642 for (i=3; i<max_fd; i++) {
643 close(i);
644 }
645 }
647 init_conf();
649 /*
650 ** if we are not privileged, and the config file was changed we
651 ** implicetely set the the run_as_user flag and give up all
652 ** privileges.
653 **
654 ** So it is possible for a user to run his own daemon without
655 ** breaking security.
656 */
657 if ((strcmp(conf_file, CONF_FILE) != 0) && (conf.orig_uid != 0)) {
658 conf.run_as_user = TRUE;
659 set_euidgid(conf.orig_uid, conf.orig_gid, NULL, NULL);
660 if (setgid(conf.orig_gid)) {
661 logwrite(LOG_ALERT, "could not set gid to %d: %s\n",
662 conf.orig_gid, strerror(errno));
663 exit(1);
664 }
665 if (setuid(conf.orig_uid)) {
666 logwrite(LOG_ALERT, "could not set uid to %d: %s\n",
667 conf.orig_uid, strerror(errno));
668 exit(1);
669 }
670 }
672 conf.log_dir = LOG_DIR;
673 conf.debug_level = debug_level; /* for debuggin during read_conf() */
674 /* FIXME: fails if we run as user */
675 logopen();
676 if (!read_conf(conf_file)) {
677 logwrite(LOG_ALERT, "SHUTTING DOWN due to problems reading "
678 "config\n");
679 exit(5);
680 }
681 logclose();
683 if (do_queue) {
684 conf.do_queue = TRUE;
685 }
686 if (do_verbose) {
687 conf.do_verbose = TRUE;
688 }
689 if (debug_level >= 0) { /* if >= 0, it was given by argument */
690 conf.debug_level = debug_level;
691 }
693 /*
694 ** It appears that changing to / ensures that we are never in
695 ** a directory which we cannot access. This situation could be
696 ** possible after changing identity.
697 ** Maybe we should only change to / if we not run as user, to
698 ** allow relative paths for log files in test setups for
699 ** instance.
700 */
701 chdir("/");
703 if (!conf.run_as_user) {
704 if (setgid(0) != 0) {
705 fprintf(stderr, "could not set gid to 0. "
706 "Is the setuid bit set? : %s\n",
707 strerror(errno));
708 exit(1);
709 }
710 if (setuid(0) != 0) {
711 fprintf(stderr, "could not gain root privileges. "
712 "Is the setuid bit set? : %s\n",
713 strerror(errno));
714 exit(1);
715 }
716 }
718 if (!logopen()) {
719 fprintf(stderr, "could not open log file\n");
720 exit(1);
721 }
723 DEBUG(1) debugf("masqmail %s starting\n", VERSION);
725 DEBUG(5) {
726 gchar **str = argv;
727 debugf("args: \n");
728 while (*str) {
729 debugf("%s \n", *str);
730 str++;
731 }
732 }
733 DEBUG(5) debugf("queue_interval = %d\n", queue_interval);
735 if (f_address) {
736 return_path = create_address_qualified(f_address, TRUE,
737 conf.host_name);
738 g_free(f_address);
739 if (!return_path) {
740 fprintf(stderr, "invalid RFC821 address: %s\n",
741 f_address);
742 exit(1);
743 }
744 }
746 switch (mta_mode) {
747 case MODE_DAEMON:
748 mode_daemon(do_listen, queue_interval, argv);
749 break;
751 case MODE_RUNQUEUE:
752 exit(run_queue(do_runq, do_runq_online, route_name) ? 0 : 1);
753 break;
755 case MODE_SMTP:
756 mode_smtp();
757 break;
759 case MODE_LIST:
760 queue_list();
761 break;
763 case MODE_BI:
764 exit(0);
765 break; /* well... */
767 case MODE_MCMD:
768 exit(manipulate_queue(M_cmd, &argv[arg]) ? 0 : 1);
769 break;
771 case MODE_ACCEPT:
772 {
773 guint accept_flags = 0;
774 accept_flags |= (opt_t ? ACC_RCPT_FROM_HEAD : 0);
775 accept_flags |= (opt_i ?
776 ACC_DOT_IGNORE : ACC_NODOT_RELAX);
777 mode_accept(return_path, full_sender_name,
778 accept_flags, argv + arg, argc - arg);
779 exit(0);
780 }
781 break;
783 default:
784 fprintf(stderr, "unknown mode: %d\n", mta_mode);
785 break;
786 }
788 logclose();
790 exit(0);
791 }