Dual-tls - split management of TLS into in- and out-bound connection-handling.

[exim.git] / src / src / exim.c

diff --git a/src/src/exim.c b/src/src/exim.c
index 8eb6022457176d2b603117e7d1a975b2f0650f05..a59cfea9a9b44becd0d87008914dec3b8d1edadc 100644 (file)
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -526,7 +526,7 @@ close_unwanted(void)
 if (smtp_input)
   {
   #ifdef SUPPORT_TLS
-  tls_close(FALSE);      /* Shut down the TLS library */
+  tls_close(FALSE, FALSE);      /* Shut down the TLS library */
   #endif
   (void)close(fileno(smtp_in));
   (void)close(fileno(smtp_out));
@@ -1434,6 +1434,7 @@ BOOL checking = FALSE;
 BOOL count_queue = FALSE;
 BOOL expansion_test = FALSE;
 BOOL extract_recipients = FALSE;
+BOOL flag_G = FALSE;
 BOOL flag_n = FALSE;
 BOOL forced_delivery = FALSE;
 BOOL f_end_dot = FALSE;
@@ -2507,11 +2508,12 @@ for (i = 1; i < argc; i++)
     break;
 
     /* -G: sendmail invocation to specify that it's a gateway submission and
-    sendmail may complain about problems instead of fixing them.  We might use
-    it to disable submission mode fixups for command-line?  Currently we just
-    ignore it. */
+    sendmail may complain about problems instead of fixing them.
+    We make it equivalent to an ACL "control = suppress_local_fixups" and do
+    not at this time complain about problems. */
 
     case 'G':
+    flag_G = TRUE;
     break;
 
     /* -h: Set the hop count for an incoming message. Exim does not currently
@@ -3274,7 +3276,7 @@ for (i = 1; i < argc; i++)
     /* -tls-on-connect: don't wait for STARTTLS (for old clients) */
 
     #ifdef SUPPORT_TLS
-    else if (Ustrcmp(argrest, "ls-on-connect") == 0) tls_on_connect = TRUE;
+    else if (Ustrcmp(argrest, "ls-on-connect") == 0) tls_in.on_connect = TRUE;
     #endif
 
     else badarg = TRUE;
@@ -4055,6 +4057,21 @@ else
     interface_port = check_port(interface_address);
   }
 
+/* If the caller is trusted, then they can use -G to suppress_local_fixups. */
+if (flag_G)
+  {
+  if (trusted_caller)
+    {
+    suppress_local_fixups = suppress_local_fixups_default = TRUE;
+    DEBUG(D_acl) debug_printf("suppress_local_fixups forced on by -G\n");
+    }
+  else
+    {
+    fprintf(stderr, "exim: permission denied (-G requires a trusted user)\n");
+    return EXIT_FAILURE;
+    }
+  }
+
 /* If an SMTP message is being received check to see if the standard input is a
 TCP/IP socket. If it is, we assume that Exim was called from inetd if the
 caller is root or the Exim user, or if the port is a privileged one. Otherwise,
@@ -4076,7 +4093,7 @@ if (smtp_input)
         interface_address = host_ntoa(-1, &interface_sock, NULL,
           &interface_port);
 
-      if (host_is_tls_on_connect_port(interface_port)) tls_on_connect = TRUE;
+      if (host_is_tls_on_connect_port(interface_port)) tls_in.on_connect = TRUE;
 
       if (real_uid == root_uid || real_uid == exim_uid || interface_port < 1024)
         {