1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2024 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
10 /* Functions concerned with running Exim as a daemon */
16 /* Structure for holding data for each SMTP connection */
18 typedef struct smtp_slot {
19 pid_t pid; /* pid of the spawned reception process */
20 uschar * host_address; /* address of the client host */
23 typedef struct runner_slot {
24 pid_t pid; /* pid of spawned queue-runner process */
25 const uschar *queue_name; /* pointer to the name in the qrunner struct */
28 /* An empty slot for initializing (Standard C does not allow constructor
29 expressions in assignments except as initializers in declarations). */
31 static smtp_slot empty_smtp_slot = { .pid = 0, .host_address = NULL };
33 /*************************************************
34 * Local static variables *
35 *************************************************/
37 static SIGNAL_BOOL sigchld_seen;
38 static SIGNAL_BOOL sighup_seen;
39 static SIGNAL_BOOL sigterm_seen;
41 static int accept_retry_count = 0;
42 static int accept_retry_errno;
43 static BOOL accept_retry_select_failed;
45 static int queue_run_count = 0; /* current runners */
47 static unsigned queue_runner_slot_count = 0;
48 static runner_slot * queue_runner_slots = NULL;
49 static smtp_slot * smtp_slots = NULL;
51 static BOOL write_pid = TRUE;
53 #ifndef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
54 static uschar * notifier_socket_name;
58 /*************************************************
60 *************************************************/
62 /* All this handler does is to set a flag and re-enable the signal.
64 Argument: the signal number
69 sighup_handler(int sig)
72 signal(SIGHUP, sighup_handler);
77 /*************************************************
78 * SIGCHLD handler for main daemon process *
79 *************************************************/
81 /* Don't re-enable the handler here, since we aren't doing the
82 waiting here. If the signal is re-enabled, there will just be an
83 infinite sequence of calls to this handler. The SIGCHLD signal is
84 used just as a means of waking up the daemon so that it notices
85 terminated subprocesses as soon as possible.
87 Argument: the signal number
92 main_sigchld_handler(int sig)
94 os_non_restarting_signal(SIGCHLD, SIG_DFL);
99 /* SIGTERM handler. Try to get the daemon pid file removed
103 main_sigterm_handler(int sig)
111 /*************************************************
112 * Unexpected errors in SMTP calls *
113 *************************************************/
115 /* This function just saves a bit of repetitious coding.
118 log_msg Text of message to be logged
119 smtp_msg Text of SMTP error message
120 was_errno The failing errno
126 never_error(uschar *log_msg, uschar *smtp_msg, int was_errno)
128 uschar *emsg = was_errno <= 0
129 ? US"" : string_sprintf(": %s", strerror(was_errno));
130 log_write(0, LOG_MAIN|LOG_PANIC, "%s%s", log_msg, emsg);
131 if (smtp_out) smtp_printf("421 %s\r\n", SP_NO_MORE, smtp_msg);
137 /*************************************************
138 *************************************************/
141 unlink_notifier_socket(void)
143 #ifndef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
144 DEBUG(D_any) debug_printf("unlinking notifier socket %s\n", notifier_socket_name);
145 Uunlink(notifier_socket_name);
151 close_daemon_sockets(int daemon_notifier_fd,
152 struct pollfd * fd_polls, int listen_socket_count)
154 if (daemon_notifier_fd >= 0)
156 (void) close(daemon_notifier_fd);
157 daemon_notifier_fd = -1;
160 for (int i = 0; i < listen_socket_count; i++) (void) close(fd_polls[i].fd);
164 /*************************************************
165 * Handle a connected SMTP call *
166 *************************************************/
168 /* This function is called when an SMTP connection has been accepted.
169 If there are too many, give an error message and close down. Otherwise
170 spin off a sub-process to handle the call. The list of listening sockets
171 is required so that they can be closed in the sub-process. Take care not to
172 leak store in this process - reset the stacking pool at the end.
175 fd_polls sockets which are listening for incoming calls
176 listen_socket_count count of listening sockets
177 accept_socket socket of the current accepted call
178 accepted socket information about the current call
184 handle_smtp_call(struct pollfd * fd_polls, int listen_socket_count,
185 int accept_socket, struct sockaddr *accepted)
188 union sockaddr_46 interface_sockaddr;
189 EXIM_SOCKLEN_T ifsize = sizeof(interface_sockaddr);
190 int dup_accept_socket = -1;
191 int max_for_this_host = 0;
192 int save_log_selector = *log_selector;
195 rmark reset_point = store_mark();
197 /* Make the address available in ASCII representation, and also fish out
200 sender_host_address = host_ntoa(-1, accepted, NULL, &sender_host_port);
201 DEBUG(D_any) debug_printf("Connection request from %s port %d\n",
202 sender_host_address, sender_host_port);
204 /* Set up the output stream, check the socket has duplicated, and set up the
205 input stream. These operations fail only the exceptional circumstances. Note
206 that never_error() won't use smtp_out if it is NULL. */
208 if (!(smtp_out = fdopen(accept_socket, "wb")))
210 never_error(US"daemon: fdopen() for smtp_out failed", US"", errno);
214 if ((dup_accept_socket = dup(accept_socket)) < 0)
216 never_error(US"daemon: couldn't dup socket descriptor",
217 US"Connection setup failed", errno);
221 if (!(smtp_in = fdopen(dup_accept_socket, "rb")))
223 never_error(US"daemon: fdopen() for smtp_in failed",
224 US"Connection setup failed", errno);
228 /* Get the data for the local interface address. Panic for most errors, but
229 "connection reset by peer" just means the connection went away. */
231 if (getsockname(accept_socket, (struct sockaddr *)(&interface_sockaddr),
234 log_write(0, LOG_MAIN | ((errno == ECONNRESET)? 0 : LOG_PANIC),
235 "getsockname() failed: %s", strerror(errno));
236 smtp_printf("421 Local problem: getsockname() failed; please try again later\r\n", SP_NO_MORE);
240 interface_address = host_ntoa(-1, &interface_sockaddr, NULL, &interface_port);
241 DEBUG(D_interface) debug_printf("interface address=%s port=%d\n",
242 interface_address, interface_port);
244 /* Build a string identifying the remote host and, if requested, the port and
245 the local interface data. This is for logging; at the end of this function the
246 memory is reclaimed. */
248 whofrom = string_append(NULL, 3, "[", sender_host_address, "]");
250 if (LOGGING(incoming_port))
251 whofrom = string_fmt_append(whofrom, ":%d", sender_host_port);
253 if (LOGGING(incoming_interface))
254 whofrom = string_fmt_append(whofrom, " I=[%s]:%d",
255 interface_address, interface_port);
257 /* Check maximum number of connections. We do not check for reserved
258 connections or unacceptable hosts here. That is done in the subprocess because
259 it might take some time. */
261 if (smtp_accept_max > 0 && smtp_accept_count >= smtp_accept_max)
263 DEBUG(D_any) debug_printf("rejecting SMTP connection: count=%d max=%d\n",
264 smtp_accept_count, smtp_accept_max);
265 smtp_printf("421 Too many concurrent SMTP connections; "
266 "please try again later.\r\n", SP_NO_MORE);
267 log_write(L_connection_reject,
268 LOG_MAIN, "Connection from %Y refused: too many connections",
273 /* If a load limit above which only reserved hosts are acceptable is defined,
274 get the load average here, and if there are in fact no reserved hosts, do
275 the test right away (saves a fork). If there are hosts, do the check in the
276 subprocess because it might take time. */
278 if (smtp_load_reserve >= 0)
280 load_average = OS_GETLOADAVG();
281 if (!smtp_reserve_hosts && load_average > smtp_load_reserve)
283 DEBUG(D_any) debug_printf("rejecting SMTP connection: load average = %.2f\n",
284 (double)load_average/1000.0);
285 smtp_printf("421 Too much load; please try again later.\r\n", SP_NO_MORE);
286 log_write(L_connection_reject,
287 LOG_MAIN, "Connection from %Y refused: load average = %.2f",
288 whofrom, (double)load_average/1000.0);
293 /* Check that one specific host (strictly, IP address) is not hogging
294 resources. This is done here to prevent a denial of service attack by someone
295 forcing you to fork lots of times before denying service. The value of
296 smtp_accept_max_per_host is a string which is expanded. This makes it possible
297 to provide host-specific limits according to $sender_host address, but because
298 this is in the daemon mainline, only fast expansions (such as inline address
299 checks) should be used. The documentation is full of warnings. */
301 GET_OPTION("smtp_accept_max_per_host");
302 if (smtp_accept_max_per_host)
304 uschar * expanded = expand_string(smtp_accept_max_per_host);
307 if (!f.expand_string_forcedfail)
308 log_write(0, LOG_MAIN|LOG_PANIC, "expansion of smtp_accept_max_per_host "
309 "failed for %Y: %s", whofrom, expand_string_message);
311 /* For speed, interpret a decimal number inline here */
314 uschar * s = expanded;
316 max_for_this_host = max_for_this_host * 10 + *s++ - '0';
318 log_write(0, LOG_MAIN|LOG_PANIC, "expansion of smtp_accept_max_per_host "
319 "for %Y contains non-digit: %s", whofrom, expanded);
323 /* If we have fewer total connections than max_for_this_host, we can skip the
324 tedious per host_address checks. Note that at this stage smtp_accept_count
325 contains the count of *other* connections, not including this one. */
328 && max_for_this_host > 0 && smtp_accept_count >= max_for_this_host)
330 int host_accept_count = 0;
331 int other_host_count = 0; /* keep a count of non matches to optimise */
333 for (int i = 0; i < smtp_accept_max; ++i)
334 if (smtp_slots[i].host_address)
336 if (Ustrcmp(sender_host_address, smtp_slots[i].host_address) == 0)
341 /* Testing all these strings is expensive - see if we can drop out
342 early, either by hitting the target, or finding there are not enough
343 connections left to make the target. */
345 if ( host_accept_count >= max_for_this_host
346 || smtp_accept_count - other_host_count < max_for_this_host)
350 if (host_accept_count >= max_for_this_host)
352 DEBUG(D_any) debug_printf("rejecting SMTP connection: too many from this "
353 "IP address: count=%d max=%d\n",
354 host_accept_count, max_for_this_host);
355 smtp_printf("421 Too many concurrent SMTP connections "
356 "from this IP address; please try again later.\r\n", SP_NO_MORE);
357 log_write(L_connection_reject,
358 LOG_MAIN, "Connection from %Y refused: too many connections "
359 "from that IP address", whofrom);
365 /* OK, the connection count checks have been passed.
366 Now we can fork the accepting process; do a lookup tidy, just in case any
367 expansion above did a lookup. */
370 pid = exim_fork(US"daemon-accept");
372 /* Handle the child process */
376 int queue_only_reason = 0;
377 int old_pool = store_pool;
378 int save_debug_selector = debug_selector;
379 BOOL local_queue_only;
380 BOOL session_local_queue_only;
382 struct sigaction act;
385 smtp_accept_count++; /* So that it includes this process */
388 /* Log the connection if requested.
389 In order to minimize the cost (because this is going to happen for every
390 connection), do a preliminary selector test here. This saves ploughing through
391 the generalized logging code each time when the selector is false. If the
392 selector is set, check whether the host is on the list for logging. If not,
393 arrange to unset the selector in the subprocess.
395 jgh 2023/08/08 :- moved this logging in from the parent process, just
396 pre-fork. There was a claim back from 4.21 (when it was moved from
397 smtp_start_session()) that smtp_accept_count could have become out-of-date by
398 the time the child could log it, and I can't see how that could happen. */
400 if (LOGGING(smtp_connection))
402 uschar * list = hosts_connection_nolog;
403 memset(sender_host_cache, 0, sizeof(sender_host_cache));
404 if (list && verify_check_host(&list) == OK)
405 save_log_selector &= ~L_smtp_connection;
406 else if (LOGGING(connection_id))
407 log_write(L_smtp_connection, LOG_MAIN, "SMTP connection from %Y "
408 "Ci=%s (TCP/IP connection count = %d)",
409 whofrom, connection_id, smtp_accept_count);
411 log_write(L_smtp_connection, LOG_MAIN, "SMTP connection from %Y "
412 "(TCP/IP connection count = %d)", whofrom, smtp_accept_count);
415 /* If the listen backlog was over the monitoring level, log it. */
417 if (smtp_listen_backlog > smtp_backlog_monitor)
418 log_write(0, LOG_MAIN, "listen backlog %d I=[%s]:%d",
419 smtp_listen_backlog, interface_address, interface_port);
421 /* May have been modified for the subprocess */
423 *log_selector = save_log_selector;
425 /* Get the local interface address into permanent store */
427 store_pool = POOL_PERM;
428 interface_address = string_copy(interface_address);
429 store_pool = old_pool;
431 /* Check for a tls-on-connect port */
433 if (host_is_tls_on_connect_port(interface_port)) tls_in.on_connect = TRUE;
435 /* Expand smtp_active_hostname if required. We do not do this any earlier,
436 because it may depend on the local interface address (indeed, that is most
437 likely what it depends on.) */
439 smtp_active_hostname = primary_hostname;
440 GET_OPTION("smtp_active_hostname");
441 if (raw_active_hostname)
443 uschar * nah = expand_string(raw_active_hostname);
446 if (!f.expand_string_forcedfail)
448 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand \"%s\" "
449 "(smtp_active_hostname): %s", raw_active_hostname,
450 expand_string_message);
451 smtp_printf("421 Local configuration error; "
452 "please try again later.\r\n", SP_NO_MORE);
455 exim_underbar_exit(EXIT_FAILURE);
458 else if (*nah) smtp_active_hostname = nah;
461 /* Initialize the queueing flags */
464 session_local_queue_only = queue_only;
466 /* Close the listening sockets, and set the SIGCHLD handler to SIG_IGN.
467 We also attempt to set things up so that children are automatically reaped,
468 but just in case this isn't available, there's a paranoid waitpid() in the
469 loop too (except for systems where we are sure it isn't needed). See the more
470 extensive comment before the reception loop in exim.c for a fuller
471 explanation of this logic. */
473 close_daemon_sockets(daemon_notifier_fd, fd_polls, listen_socket_count);
475 /* Set FD_CLOEXEC on the SMTP socket. We don't want any rogue child processes
476 to be able to communicate with them, under any circumstances. */
477 (void)fcntl(accept_socket, F_SETFD,
478 fcntl(accept_socket, F_GETFD) | FD_CLOEXEC);
479 (void)fcntl(dup_accept_socket, F_SETFD,
480 fcntl(dup_accept_socket, F_GETFD) | FD_CLOEXEC);
483 act.sa_handler = SIG_IGN;
484 sigemptyset(&(act.sa_mask));
485 act.sa_flags = SA_NOCLDWAIT;
486 sigaction(SIGCHLD, &act, NULL);
488 signal(SIGCHLD, SIG_IGN);
490 signal(SIGTERM, SIG_DFL);
491 signal(SIGINT, SIG_DFL);
493 /* Attempt to get an id from the sending machine via the RFC 1413
494 protocol. We do this in the sub-process in order not to hold up the
495 main process if there is any delay. Then set up the fullhost information
496 in case there is no HELO/EHLO.
498 If debugging is enabled only for the daemon, we must turn if off while
499 finding the id, but turn it on again afterwards so that information about the
500 incoming connection is output. */
502 if (f.debug_daemon) debug_selector = 0;
503 verify_get_ident(IDENT_PORT);
504 host_build_sender_fullhost();
505 debug_selector = save_debug_selector;
508 debug_printf("Process %d is handling incoming connection from %s\n",
509 (int)getpid(), sender_fullhost);
511 /* Now disable debugging permanently if it's required only for the daemon
514 if (f.debug_daemon) debug_selector = 0;
516 /* If there are too many child processes for immediate delivery,
517 set the session_local_queue_only flag, which is initialized from the
518 configured value and may therefore already be TRUE. Leave logging
519 till later so it will have a message id attached. Note that there is no
520 possibility of re-calculating this per-message, because the value of
521 smtp_accept_count does not change in this subprocess. */
523 if (smtp_accept_queue > 0 && smtp_accept_count > smtp_accept_queue)
525 session_local_queue_only = TRUE;
526 queue_only_reason = 1;
529 /* Handle the start of the SMTP session, then loop, accepting incoming
530 messages from the SMTP connection. The end will come at the QUIT command,
531 when smtp_setup_msg() returns 0. A break in the connection causes the
532 process to die (see accept.c).
534 NOTE: We do *not* call smtp_log_no_mail() if smtp_start_session() fails,
535 because a log line has already been written for all its failure exists
536 (usually "connection refused: <reason>") and writing another one is
537 unnecessary clutter. */
539 if (!smtp_start_session())
543 exim_underbar_exit(EXIT_SUCCESS);
549 message_id[0] = 0; /* Clear out any previous message_id */
550 reset_point = store_mark(); /* Save current store high water point */
553 debug_printf("Process %d is ready for new message\n", (int)getpid());
555 /* Smtp_setup_msg() returns 0 on QUIT or if the call is from an
556 unacceptable host or if an ACL "drop" command was triggered, -1 on
557 connection lost, and +1 on validly reaching DATA. Receive_msg() almost
558 always returns TRUE when smtp_input is true; just retry if no message was
559 accepted (can happen for invalid message parameters). However, it can yield
560 FALSE if the connection was forcibly dropped by the DATA ACL. */
562 if ((rc = smtp_setup_msg()) > 0)
564 BOOL ok = receive_msg(FALSE);
565 search_tidyup(); /* Close cached databases */
566 if (!ok) /* Connection was dropped */
568 cancel_cutthrough_connection(TRUE, US"receive dropped");
570 smtp_log_no_mail(); /* Log no mail if configured */
571 exim_underbar_exit(EXIT_SUCCESS);
573 if (!message_id[0]) continue; /* No message was accepted */
575 else /* bad smtp_setup_msg() */
579 int fd = fileno(smtp_in);
583 /* drain socket, for clean TCP FINs */
584 if (fcntl(fd, F_SETFL, O_NONBLOCK) == 0)
585 for(int i = 16; read(fd, buf, sizeof(buf)) > 0 && i > 0; ) i--;
587 cancel_cutthrough_connection(TRUE, US"message setup dropped");
589 smtp_log_no_mail(); /* Log no mail if configured */
591 /*XXX should we pause briefly, hoping that the client will be the
592 active TCP closer hence get the TCP_WAIT endpoint? */
593 DEBUG(D_receive) debug_printf("SMTP>>(close on process exit)\n");
594 exim_underbar_exit(rc ? EXIT_FAILURE : EXIT_SUCCESS);
597 /* Show the recipients when debugging */
602 debug_printf("Sender: %s\n", sender_address);
605 debug_printf("Recipients:\n");
606 for (int i = 0; i < recipients_count; i++)
607 debug_printf(" %s\n", recipients_list[i].address);
611 /* A message has been accepted. Clean up any previous delivery processes
612 that have completed and are defunct, on systems where they don't go away
613 by themselves (see comments when setting SIG_IGN above). On such systems
614 (if any) these delivery processes hang around after termination until
615 the next message is received. */
617 #ifndef SIG_IGN_WORKS
618 while (waitpid(-1, NULL, WNOHANG) > 0);
621 /* Reclaim up the store used in accepting this message */
624 int r = receive_messagecount;
625 BOOL q = f.queue_only_policy;
626 smtp_reset(reset_point);
628 f.queue_only_policy = q;
629 receive_messagecount = r;
632 /* If queue_only is set or if there are too many incoming connections in
633 existence, session_local_queue_only will be TRUE. If it is not, check
634 whether we have received too many messages in this session for immediate
637 if (!session_local_queue_only &&
638 smtp_accept_queue_per_connection > 0 &&
639 receive_messagecount > smtp_accept_queue_per_connection)
641 session_local_queue_only = TRUE;
642 queue_only_reason = 2;
645 /* Initialize local_queue_only from session_local_queue_only. If it is not
646 true, and queue_only_load is set, check that the load average is below it.
647 If local_queue_only is set by this means, we also set if for the session if
648 queue_only_load_latch is true (the default). This means that, once set,
649 local_queue_only remains set for any subsequent messages on the same SMTP
650 connection. This is a deliberate choice; even though the load average may
651 fall, it doesn't seem right to deliver later messages on the same call when
652 not delivering earlier ones. However, the are special circumstances such as
653 very long-lived connections from scanning appliances where this is not the
654 best strategy. In such cases, queue_only_load_latch should be set false. */
656 if ( !(local_queue_only = session_local_queue_only)
657 && queue_only_load >= 0
658 && (local_queue_only = (load_average = OS_GETLOADAVG()) > queue_only_load)
661 queue_only_reason = 3;
662 if (queue_only_load_latch) session_local_queue_only = TRUE;
665 /* Log the queueing here, when it will get a message id attached, but
666 not if queue_only is set (case 0). */
668 if (local_queue_only) switch(queue_only_reason)
670 case 1: log_write(L_delay_delivery,
671 LOG_MAIN, "no immediate delivery: too many connections "
672 "(%d, max %d)", smtp_accept_count, smtp_accept_queue);
675 case 2: log_write(L_delay_delivery,
676 LOG_MAIN, "no immediate delivery: more than %d messages "
677 "received in one connection", smtp_accept_queue_per_connection);
680 case 3: log_write(L_delay_delivery,
681 LOG_MAIN, "no immediate delivery: load average %.2f",
682 (double)load_average/1000.0);
686 /* If a delivery attempt is required, spin off a new process to handle it.
687 If we are not root, we have to re-exec exim unless deliveries are being
688 done unprivileged. */
690 else if ( (!f.queue_only_policy || f.queue_smtp)
691 && !f.deliver_freeze)
695 /* We used to flush smtp_out before forking so that buffered data was not
696 duplicated, but now we want to pipeline the responses for data and quit.
697 Instead, hard-close the fd underlying smtp_out right after fork to discard
700 if ((dpid = exim_fork(US"daemon-accept-delivery")) == 0)
702 (void)fclose(smtp_in);
703 (void)close(fileno(smtp_out));
704 (void)fclose(smtp_out);
705 smtp_in = smtp_out = NULL;
707 /* Don't ever molest the parent's SSL connection, but do clean up
708 the data structures if necessary. */
711 tls_close(NULL, TLS_NO_SHUTDOWN);
714 /* Reset SIGHUP and SIGCHLD in the child in both cases. */
716 signal(SIGHUP, SIG_DFL);
717 signal(SIGCHLD, SIG_DFL);
718 signal(SIGTERM, SIG_DFL);
719 signal(SIGINT, SIG_DFL);
721 if (geteuid() != root_uid && !deliver_drop_privilege)
723 signal(SIGALRM, SIG_DFL);
724 delivery_re_exec(CEE_EXEC_PANIC);
725 /* Control does not return here. */
728 /* No need to re-exec; SIGALRM remains set to the default handler */
730 (void) deliver_message(message_id, FALSE, FALSE);
732 exim_underbar_exit(EXIT_SUCCESS);
737 release_cutthrough_connection(US"passed for delivery");
738 DEBUG(D_any) debug_printf("forked delivery process %d\n", (int)dpid);
742 cancel_cutthrough_connection(TRUE, US"delivery fork failed");
743 log_write(0, LOG_MAIN|LOG_PANIC, "daemon: delivery process fork "
744 "failed: %s", strerror(errno));
751 /* Carrying on in the parent daemon process... Can't do much if the fork
752 failed. Otherwise, keep count of the number of accepting processes and
753 remember the pid for ticking off when the child completes. */
756 never_error(US"daemon: accept process fork failed", US"Fork failed", errno);
759 for (int i = 0; i < smtp_accept_max; ++i)
760 if (smtp_slots[i].pid <= 0)
762 smtp_slots[i].pid = pid;
763 /* Connection closes come asyncronously, so we cannot stack this store */
764 if (smtp_accept_max_per_host)
765 smtp_slots[i].host_address = string_copy_malloc(sender_host_address);
769 DEBUG(D_any) debug_printf("%d SMTP accept process%s running\n",
770 smtp_accept_count, smtp_accept_count == 1 ? "" : "es");
773 /* Get here via goto in error cases */
777 /* Close the streams associated with the socket which will also close the
778 socket fds in this process. We can't do anything if fclose() fails, but
779 logging brings it to someone's attention. However, "connection reset by peer"
780 isn't really a problem, so skip that one. On Solaris, a dropped connection can
781 manifest itself as a broken pipe, so drop that one too. If the streams don't
782 exist, something went wrong while setting things up. Make sure the socket
783 descriptors are closed, in order to drop the connection. */
787 if (fclose(smtp_out) != 0 && errno != ECONNRESET && errno != EPIPE)
788 log_write(0, LOG_MAIN|LOG_PANIC, "daemon: fclose(smtp_out) failed: %s",
792 else (void)close(accept_socket);
796 if (fclose(smtp_in) != 0 && errno != ECONNRESET && errno != EPIPE)
797 log_write(0, LOG_MAIN|LOG_PANIC, "daemon: fclose(smtp_in) failed: %s",
801 else (void)close(dup_accept_socket);
803 /* Release any store used in this process, including the store used for holding
804 the incoming host address and an expanded active_hostname. */
807 interface_address = sender_host_name = sender_host_address = NULL;
808 store_reset(reset_point);
814 /*************************************************
815 * Check wildcard listen special cases *
816 *************************************************/
818 /* This function is used when binding and listening on lists of addresses and
819 ports. It tests for special cases of wildcard listening, when IPv4 and IPv6
820 sockets may interact in different ways in different operating systems. It is
821 passed an error number, the list of listening addresses, and the current
822 address. Two checks are available: for a previous wildcard IPv6 address, or for
823 a following wildcard IPv4 address, in both cases on the same port.
825 In practice, pairs of wildcard addresses should be adjacent in the address list
826 because they are sorted that way below.
830 addresses the list of addresses
831 ipa the current IP address
832 back if TRUE, check for previous wildcard IPv6 address
833 if FALSE, check for a following wildcard IPv4 address
835 Returns: TRUE or FALSE
839 check_special_case(int eno, ip_address_item *addresses, ip_address_item *ipa,
842 ip_address_item *ipa2;
844 /* For the "back" case, if the failure was "address in use" for a wildcard IPv4
845 address, seek a previous IPv6 wildcard address on the same port. As it is
846 previous, it must have been successfully bound and be listening. Flag it as a
847 "6 including 4" listener. */
851 if (eno != EADDRINUSE || ipa->address[0] != 0) return FALSE;
852 for (ipa2 = addresses; ipa2 != ipa; ipa2 = ipa2->next)
854 if (ipa2->address[1] == 0 && ipa2->port == ipa->port)
856 ipa2->v6_include_v4 = TRUE;
862 /* For the "forward" case, if the current address is a wildcard IPv6 address,
863 we seek a following wildcard IPv4 address on the same port. */
867 if (ipa->address[0] != ':' || ipa->address[1] != 0) return FALSE;
868 for (ipa2 = ipa->next; ipa2 != NULL; ipa2 = ipa2->next)
869 if (ipa2->address[0] == 0 && ipa->port == ipa2->port) return TRUE;
878 /*************************************************
879 * Handle terminating subprocesses *
880 *************************************************/
882 /* Handle the termination of child processes. Theoretically, this need be done
883 only when sigchld_seen is TRUE, but rumour has it that some systems lose
884 SIGCHLD signals at busy times, so to be on the safe side, this function is
885 called each time round. It shouldn't be too expensive.
892 handle_ending_processes(void)
897 while ((pid = waitpid(-1, &status, WNOHANG)) > 0)
901 debug_printf("child %ld ended: status=0x%x\n", (long)pid, status);
903 if (WIFEXITED(status))
904 debug_printf(" normal exit, %d\n", WEXITSTATUS(status));
905 else if (WIFSIGNALED(status))
906 debug_printf(" signal exit, signal %d%s\n", WTERMSIG(status),
907 WCOREDUMP(status) ? " (core dumped)" : "");
911 /* If it's a listening daemon for which we are keeping track of individual
912 subprocesses, deal with an accepting process that has terminated. */
918 for (i = 0, sp = smtp_slots; i < smtp_accept_max; i++, sp++)
921 if (sp->host_address)
922 store_free(sp->host_address);
923 *sp = empty_smtp_slot;
924 if (--smtp_accept_count < 0) smtp_accept_count = 0;
925 DEBUG(D_any) debug_printf("%d SMTP accept process%s now running\n",
926 smtp_accept_count, smtp_accept_count == 1 ? "" : "es");
929 if (i < smtp_accept_max) continue; /* Found an accepting process */
932 /* If it wasn't an accepting process, see if it was a queue-runner
933 process that we are tracking. */
935 if (queue_runner_slots)
936 for (unsigned i = 0; i < queue_runner_slot_count; i++)
938 runner_slot * r = queue_runner_slots + i;
941 r->pid = 0; /* free up the slot */
943 if (--queue_run_count < 0) queue_run_count = 0;
944 DEBUG(D_any) debug_printf("%d queue-runner process%s now running\n",
945 queue_run_count, queue_run_count == 1 ? "" : "es");
947 for (qrunner ** p = &qrunners, * q = qrunners; q; p = &q->next, q = *p)
948 if (q->name == r->queue_name)
950 if (q->interval) /* a periodic queue run */
952 else /* a one-time run */
953 *p = q->next; /* drop this qrunner */
964 set_pid_file_path(void)
966 if (override_pid_file_path)
967 pid_file_path = override_pid_file_path;
970 pid_file_path = string_sprintf("%s/exim-daemon.pid", spool_directory);
972 if (pid_file_path[0] != '/')
973 log_write(0, LOG_PANIC_DIE, "pid file path %s must be absolute\n", pid_file_path);
977 enum pid_op { PID_WRITE, PID_CHECK, PID_DELETE };
979 /* Do various pid file operations as safe as possible. Ideally we'd just
980 drop the privileges for creation of the pid file and not care at all about removal of
982 Returns: true on success, false + errno==EACCES otherwise
986 operate_on_pid_file(const enum pid_op operation, const pid_t pid)
988 char pid_line[sizeof(int) * 3 + 2];
989 const int pid_len = snprintf(pid_line, sizeof(pid_line), "%ld\n", (long)pid);
990 BOOL lines_match = FALSE;
991 uschar * path, * base, * dir;
993 const int dir_flags = O_RDONLY | O_NONBLOCK;
994 const int base_flags = O_NOFOLLOW | O_NONBLOCK;
995 const mode_t base_mode = 0644;
997 int cwd_fd = -1, dir_fd = -1, base_fd = -1;
998 BOOL success = FALSE;
1001 set_pid_file_path();
1002 if (!f.running_in_test_harness && real_uid != root_uid && real_uid != exim_uid) goto cleanup;
1003 if (pid_len < 2 || pid_len >= (int)sizeof(pid_line)) goto cleanup;
1005 path = string_copy(pid_file_path);
1006 if ((base = Ustrrchr(path, '/')) == NULL) /* should not happen, but who knows */
1007 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "pid file path \"%s\" does not contain a '/'", pid_file_path);
1009 dir = base != path ? path : US"/";
1012 if (!dir || !*dir || *dir != '/') goto cleanup;
1013 if (!base || !*base || Ustrchr(base, '/') != NULL) goto cleanup;
1015 cwd_fd = open(".", dir_flags);
1016 if (cwd_fd < 0 || fstat(cwd_fd, &sb) != 0 || !S_ISDIR(sb.st_mode)) goto cleanup;
1017 dir_fd = open(CS dir, dir_flags);
1018 if (dir_fd < 0 || fstat(dir_fd, &sb) != 0 || !S_ISDIR(sb.st_mode)) goto cleanup;
1020 /* emulate openat */
1021 if (fchdir(dir_fd) != 0) goto cleanup;
1022 base_fd = open(CS base, O_RDONLY | base_flags);
1023 if (fchdir(cwd_fd) != 0)
1024 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "can't return to previous working dir: %s", strerror(errno));
1028 char line[sizeof(pid_line)];
1031 if (fstat(base_fd, &sb) != 0 || !S_ISREG(sb.st_mode)) goto cleanup;
1032 if ((sb.st_mode & 07777) != base_mode || sb.st_nlink != 1) goto cleanup;
1033 if (sb.st_size < 2 || sb.st_size >= (off_t)sizeof(line)) goto cleanup;
1035 len = read(base_fd, line, sizeof(line));
1036 if (len != (ssize_t)sb.st_size) goto cleanup;
1039 if (strspn(line, "0123456789") != (size_t)len-1) goto cleanup;
1040 if (line[len-1] != '\n') goto cleanup;
1041 lines_match = len == pid_len && strcmp(line, pid_line) == 0;
1044 if (operation == PID_WRITE)
1051 /* emulate unlinkat */
1052 if (fchdir(dir_fd) != 0) goto cleanup;
1053 error = unlink(CS base);
1054 if (fchdir(cwd_fd) != 0)
1055 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "can't return to previous working dir: %s", strerror(errno));
1056 if (error) goto cleanup;
1057 (void)close(base_fd);
1060 /* emulate openat */
1061 if (fchdir(dir_fd) != 0) goto cleanup;
1062 base_fd = open(CS base, O_WRONLY | O_CREAT | O_EXCL | base_flags, base_mode);
1063 if (fchdir(cwd_fd) != 0)
1064 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "can't return to previous working dir: %s", strerror(errno));
1065 if (base_fd < 0) goto cleanup;
1066 if (fchmod(base_fd, base_mode) != 0) goto cleanup;
1067 if (write(base_fd, pid_line, pid_len) != pid_len) goto cleanup;
1068 DEBUG(D_any) debug_printf("pid written to %s\n", pid_file_path);
1073 if (!lines_match) goto cleanup;
1074 if (operation == PID_DELETE)
1077 /* emulate unlinkat */
1078 if (fchdir(dir_fd) != 0) goto cleanup;
1079 error = unlink(CS base);
1080 if (fchdir(cwd_fd) != 0)
1081 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "can't return to previous working dir: %s", strerror(errno));
1082 if (error) goto cleanup;
1090 if (cwd_fd >= 0) (void)close(cwd_fd);
1091 if (dir_fd >= 0) (void)close(dir_fd);
1092 if (base_fd >= 0) (void)close(base_fd);
1097 /* Remove the daemon's pidfile. Note: runs with root privilege,
1098 as a direct child of the daemon. Does not return. */
1101 delete_pid_file(void)
1103 const BOOL success = operate_on_pid_file(PID_DELETE, getppid());
1106 debug_printf("delete pid file %s %s: %s\n", pid_file_path,
1107 success ? "success" : "failure", strerror(errno));
1109 exim_exit(EXIT_SUCCESS);
1113 /* Called by the daemon; exec a child to get the pid file deleted
1114 since we may require privs for the containing directory */
1121 DEBUG(D_any) debug_printf("SIGTERM/SIGINT seen\n");
1122 #if !defined(DISABLE_TLS) && (defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT))
1123 tls_watch_invalidate();
1126 if (daemon_notifier_fd >= 0)
1128 close(daemon_notifier_fd);
1129 daemon_notifier_fd = -1;
1130 unlink_notifier_socket();
1133 if (f.running_in_test_harness || write_pid)
1135 if ((pid = exim_fork(US"daemon-del-pidfile")) == 0)
1137 if (override_pid_file_path)
1138 (void)child_exec_exim(CEE_EXEC_PANIC, FALSE, NULL, FALSE, 3,
1139 "-oP", override_pid_file_path, "-oPX");
1141 (void)child_exec_exim(CEE_EXEC_PANIC, FALSE, NULL, FALSE, 1, "-oPX");
1143 /* Control never returns here. */
1146 child_close(pid, 1);
1148 exim_exit(EXIT_SUCCESS);
1152 /*************************************************
1153 * Listener socket for local work prompts *
1154 *************************************************/
1157 daemon_client_sockname(struct sockaddr_un * sup, uschar ** sname)
1159 #ifdef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1160 sup->sun_path[0] = 0; /* Abstract local socket addr - Linux-specific? */
1161 return offsetof(struct sockaddr_un, sun_path) + 1
1162 + snprintf(sup->sun_path+1, sizeof(sup->sun_path)-1, "exim_%d", getpid());
1164 *sname = string_sprintf("%s/p_%d", spool_directory, getpid());
1165 return offsetof(struct sockaddr_un, sun_path)
1166 + snprintf(sup->sun_path, sizeof(sup->sun_path), "%s", CS *sname);
1171 daemon_notifier_sockname(struct sockaddr_un * sup)
1173 GET_OPTION("notifier_socket");
1174 #ifdef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1175 sup->sun_path[0] = 0; /* Abstract local socket addr - Linux-specific? */
1176 return offsetof(struct sockaddr_un, sun_path) + 1
1177 + snprintf(sup->sun_path+1, sizeof(sup->sun_path)-1, "%s",
1178 CS expand_string(notifier_socket));
1180 notifier_socket_name = expand_string(notifier_socket);
1181 return offsetof(struct sockaddr_un, sun_path)
1182 + snprintf(sup->sun_path, sizeof(sup->sun_path), "%s",
1183 CS notifier_socket_name);
1189 daemon_notifier_socket(void)
1192 const uschar * where;
1193 struct sockaddr_un sa_un = {.sun_family = AF_UNIX};
1196 if (!f.notifier_socket_en)
1198 DEBUG(D_any) debug_printf("-oY used so not creating notifier socket\n");
1201 if (override_local_interfaces && !override_pid_file_path)
1204 debug_printf("-oX used without -oP so not creating notifier socket\n");
1207 if (!notifier_socket || !*notifier_socket)
1209 DEBUG(D_any) debug_printf("no name for notifier socket\n");
1213 DEBUG(D_any) debug_printf("creating notifier socket\n");
1216 if ((fd = socket(PF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0)) < 0)
1217 { where = US"socket"; goto bad; }
1219 if ((fd = socket(PF_UNIX, SOCK_DGRAM, 0)) < 0)
1220 { where = US"socket"; goto bad; }
1221 (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
1224 len = daemon_notifier_sockname(&sa_un);
1226 #ifdef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1227 DEBUG(D_any) debug_printf(" @%s\n", sa_un.sun_path+1);
1228 #else /* filesystem-visible and persistent; will neeed removal */
1229 DEBUG(D_any) debug_printf(" %s\n", sa_un.sun_path);
1232 if (bind(fd, (const struct sockaddr *)&sa_un, (socklen_t)len) < 0)
1233 { where = US"bind"; goto bad; }
1235 #ifdef SO_PASSCRED /* Linux */
1236 if (setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &on, sizeof(on)) < 0)
1237 { where = US"SO_PASSCRED"; goto bad2; }
1238 #elif defined(LOCAL_CREDS) /* FreeBSD-ish */
1239 if (setsockopt(fd, 0, LOCAL_CREDS, &on, sizeof(on)) < 0)
1240 { where = US"LOCAL_CREDS"; goto bad2; }
1243 /* debug_printf("%s: fd %d\n", __FUNCTION__, fd); */
1244 daemon_notifier_fd = fd;
1248 #ifndef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1249 Uunlink(sa_un.sun_path);
1252 log_write(0, LOG_MAIN|LOG_PANIC, "%s %s: %s",
1253 __FUNCTION__, where, strerror(errno));
1259 /* Data for notifier-triggered queue runs */
1261 static uschar queuerun_msgid[MESSAGE_ID_LENGTH+1];
1262 static const uschar * queuerun_msg_qname;
1265 /* The notifier socket has something to read. Pull the message from it, decode
1270 daemon_notification(void)
1272 uschar buf[256], cbuf[256];
1273 struct sockaddr_un sa_un;
1274 struct iovec iov = {.iov_base = buf, .iov_len = sizeof(buf)-1};
1275 struct msghdr msg = { .msg_name = &sa_un,
1276 .msg_namelen = sizeof(sa_un),
1279 .msg_control = cbuf,
1280 .msg_controllen = sizeof(cbuf)
1284 buf[sizeof(buf)-1] = 0;
1285 if ((sz = recvmsg(daemon_notifier_fd, &msg, 0)) <= 0) return;
1286 if (sz >= sizeof(buf)) return;
1289 debug_printf("addrlen %d\n", msg.msg_namelen);
1292 if (msg.msg_namelen > 0)
1294 BOOL abstract = !*sa_un.sun_path;
1295 char * name = sa_un.sun_path + (abstract ? 1 : 0);
1296 int namelen = (int)msg.msg_namelen - abstract ? 1 : 0;
1298 debug_printf("%s from addr '%s%.*s'\n", __FUNCTION__,
1299 abstract ? "@" : "",
1302 debug_printf("%s (from unknown addr)\n", __FUNCTION__);
1305 debug_printf("%s (from unknown addr)\n", __FUNCTION__);
1307 /* Refuse to handle the item unless the peer has good credentials */
1308 #ifdef SCM_CREDENTIALS
1309 # define EXIM_SCM_CR_TYPE SCM_CREDENTIALS
1310 #elif defined(LOCAL_CREDS) && defined(SCM_CREDS)
1311 # define EXIM_SCM_CR_TYPE SCM_CREDS
1313 /* The OS has no way to get the creds of the caller (for a unix/datagram socket.
1314 Punt; don't try to check. */
1317 #ifdef EXIM_SCM_CR_TYPE
1318 for (struct cmsghdr * cp = CMSG_FIRSTHDR(&msg);
1320 cp = CMSG_NXTHDR(&msg, cp))
1321 if (cp->cmsg_level == SOL_SOCKET && cp->cmsg_type == EXIM_SCM_CR_TYPE)
1323 # ifdef SCM_CREDENTIALS /* Linux */
1324 struct ucred * cr = (struct ucred *) CMSG_DATA(cp);
1325 if (cr->uid && cr->uid != exim_uid)
1327 DEBUG(D_queue_run) debug_printf("%s: sender creds pid %ld uid %d gid %d\n",
1328 __FUNCTION__, (long)cr->pid, (int)cr->uid, (int)cr->gid);
1330 # elif defined(LOCAL_CREDS) /* BSD-ish */
1331 struct sockcred * cr = (struct sockcred *) CMSG_DATA(cp);
1332 if (cr->sc_uid && cr->sc_uid != exim_uid)
1334 DEBUG(D_queue_run) debug_printf("%s: sender creds pid ??? uid %d gid %d\n",
1335 __FUNCTION__, (int)cr->sc_uid, (int)cr->sc_gid);
1345 #ifndef DISABLE_QUEUE_RAMP
1346 case NOTIFY_MSG_QRUN:
1347 /* this should be a message_id */
1349 debug_printf("%s: qrunner trigger: %s\n", __FUNCTION__, buf+1);
1351 memcpy(queuerun_msgid, buf+1, MESSAGE_ID_LENGTH+1);
1353 for (qrunner * q = qrunners; q; q = q->next)
1355 ? Ustrcmp(q->name, buf+1+MESSAGE_ID_LENGTH+1) == 0
1356 : !buf[1+MESSAGE_ID_LENGTH+1]
1358 { queuerun_msg_qname = q->name; break; }
1362 case NOTIFY_QUEUE_SIZE_REQ:
1365 int len = snprintf(CS buf, sizeof(buf), "%u", queue_count_cached());
1368 debug_printf("%s: queue size request: %s\n", __FUNCTION__, buf);
1370 if (sendto(daemon_notifier_fd, buf, len, 0,
1371 (const struct sockaddr *)&sa_un, msg.msg_namelen) < 0)
1372 log_write(0, LOG_MAIN|LOG_PANIC,
1373 "%s: sendto: %s\n", __FUNCTION__, strerror(errno));
1378 regex_at_daemon(buf);
1387 daemon_inetd_wtimeout(time_t last_connection_time)
1389 time_t resignal_interval = inetd_wait_timeout;
1391 if (last_connection_time == (time_t)0)
1394 debug_printf("inetd wait timeout expired, but still not seen first message, ignoring\n");
1398 time_t now = time(NULL);
1399 if (now == (time_t)-1)
1401 DEBUG(D_any) debug_printf("failed to get time: %s\n", strerror(errno));
1403 else if ((now - last_connection_time) >= inetd_wait_timeout)
1406 debug_printf("inetd wait timeout %d expired, ending daemon\n",
1407 inetd_wait_timeout);
1408 log_write(0, LOG_MAIN, "exim %s daemon terminating, inetd wait timeout reached.\n",
1410 daemon_die(); /* Does not return */
1413 resignal_interval -= (now - last_connection_time);
1416 sigalrm_seen = FALSE;
1417 ALARM(resignal_interval);
1421 /* Re-sort the qrunners list, and return the shortest interval.
1422 That could be negatime.
1423 The next-tick times should have been updated by any runs initiated,
1424 though will not be when the global limit on runners was reached.
1426 Unlikely to have many queues, so insertion-sort.
1430 next_qrunner_interval(void)
1432 qrunner * sorted = NULL;
1433 for (qrunner * q = qrunners, * next; q; q = next)
1439 qrunner ** p = &sorted;
1440 for (qrunner * qq; qq = *p; p = &qq->next)
1441 if ( q->next_tick < qq->next_tick
1442 || q->next_tick == qq->next_tick && q->interval < qq->interval
1456 return qrunners ? qrunners->next_tick - time(NULL) : 0;
1459 /* See if we can do a queue run. If policy limit permit, kick one off.
1460 If both notification and timer events are present, handle the former
1461 and leave the timer outstanding.
1463 Return the number of seconds until the next due runner.
1467 daemon_qrun(int local_queue_run_max, struct pollfd * fd_polls, int listen_socket_count)
1469 DEBUG(D_any) debug_printf("%s received\n",
1470 #ifndef DISABLE_QUEUE_RAMP
1471 *queuerun_msgid ? "qrun notification" :
1475 /* Do a full queue run in a child process, if required, unless we already have
1476 enough queue runners on the go. If we are not running as root, a re-exec is
1477 required. In the calling process, restart the alamr timer for the next run. */
1479 if (is_multiple_qrun()) /* we are managing periodic runs */
1480 if (local_queue_run_max <= 0 || queue_run_count < local_queue_run_max)
1484 #ifndef DISABLE_QUEUE_RAMP
1485 /* If this is a triggered run for a specific message, see if we can start
1486 another runner for this queue. */
1488 if (*queuerun_msgid)
1490 for (qrunner * qq = qrunners; qq; qq = qq->next)
1491 if (qq->name == queuerun_msg_qname)
1493 q = qq->run_count < qq->run_max ? qq : NULL;
1499 /* Normal periodic run: in order of run priority, find the first queue
1500 for which we can start a runner */
1502 for (q = qrunners; q; q = q->next)
1503 if (q->run_count < q->run_max) break;
1505 if (q) /* found a queue to run */
1509 /* Bump this queue's next-tick by it's interval */
1513 time_t now = time(NULL);
1514 do ; while ((q->next_tick += q->interval) <= now);
1517 if ((pid = exim_fork(US"queue-runner")) == 0)
1519 /* Disable debugging if it's required only for the daemon process. We
1520 leave the above message, because it ties up with the "child ended"
1521 debugging messages. */
1523 if (f.debug_daemon) debug_selector = 0;
1525 /* Close any open listening sockets in the child */
1527 close_daemon_sockets(daemon_notifier_fd,
1528 fd_polls, listen_socket_count);
1530 /* Reset SIGHUP and SIGCHLD in the child in both cases. */
1532 signal(SIGHUP, SIG_DFL);
1533 signal(SIGCHLD, SIG_DFL);
1534 signal(SIGTERM, SIG_DFL);
1535 signal(SIGINT, SIG_DFL);
1537 /* Re-exec if privilege has been given up, unless deliver_drop_
1538 privilege is set. Reset SIGALRM before exec(). */
1540 if (geteuid() != root_uid && !deliver_drop_privilege)
1547 signal(SIGALRM, SIG_DFL);
1552 if ( q->queue_2stage
1553 #ifndef DISABLE_QUEUE_RAMP
1557 if (q->queue_run_first_delivery) *p++ = 'i';
1558 if (q->queue_run_force) *p++ = 'f';
1559 if (q->deliver_force_thaw) *p++ = 'f';
1560 if (q->queue_run_local) *p++ = 'l';
1564 ? string_sprintf("%sG%s", opt, q->name) : opt;
1566 #ifndef DISABLE_QUEUE_RAMP
1567 if (*queuerun_msgid)
1569 log_write(0, LOG_MAIN, "notify triggered queue run");
1570 extra[extracount++] = queuerun_msgid; /* Trigger only the */
1571 extra[extracount++] = queuerun_msgid; /* one message */
1575 /* If -R or -S were on the original command line, ensure they get
1578 if (deliver_selectstring)
1580 extra[extracount++] = f.deliver_selectstring_regex ? US"-Rr" : US"-R";
1581 extra[extracount++] = deliver_selectstring;
1584 if (deliver_selectstring_sender)
1586 extra[extracount++] = f.deliver_selectstring_sender_regex
1588 extra[extracount++] = deliver_selectstring_sender;
1591 /* Overlay this process with a new execution. */
1593 (void)child_exec_exim(CEE_EXEC_PANIC, FALSE, NULL, FALSE, extracount,
1594 extra[0], extra[1], extra[2], extra[3], extra[4], extra[5], extra[6]);
1596 /* Control never returns here. */
1599 /* No need to re-exec; SIGALRM remains set to the default handler */
1601 #ifndef DISABLE_QUEUE_RAMP
1602 if (*queuerun_msgid)
1604 log_write(0, LOG_MAIN, "notify triggered queue run");
1605 f.queue_2stage = FALSE;
1606 queue_run(q, queuerun_msgid, queuerun_msgid, FALSE);
1610 queue_run(q, NULL, NULL, FALSE);
1611 exim_underbar_exit(EXIT_SUCCESS);
1616 log_write(0, LOG_MAIN|LOG_PANIC, "daemon: fork of queue-runner "
1617 "process failed: %s", strerror(errno));
1622 for (int i = 0; i < local_queue_run_max; ++i)
1623 if (queue_runner_slots[i].pid <= 0)
1625 queue_runner_slots[i].pid = pid;
1626 queue_runner_slots[i].queue_name = q->name;
1631 DEBUG(D_any) debug_printf("%d queue-runner process%s running\n",
1632 queue_run_count, queue_run_count == 1 ? "" : "es");
1637 /* The queue run has been initiated (unless we were already running enough) */
1639 #ifndef DISABLE_QUEUE_RAMP
1640 if (*queuerun_msgid) /* it was a fast-ramp kick; dealt with */
1641 *queuerun_msgid = 0;
1642 else /* periodic or one-time queue run */
1644 /* Set up next timer callback. Impose a minimum 1s tick,
1645 even when a run was outstanding */
1647 int interval = next_qrunner_interval();
1648 if (interval <= 0) interval = 1;
1650 sigalrm_seen = FALSE;
1651 if (qrunners) /* there are still periodic qrunners */
1653 ALARM(interval); /* set up next qrun tick */
1663 static const uschar *
1664 describe_queue_runners(void)
1668 if (!is_multiple_qrun()) return US"no queue runs";
1670 for (qrunner * q = qrunners; q; q = q->next)
1672 g = string_catn(g, US"-q", 2);
1673 if (q->queue_2stage) g = string_catn(g, US"q", 1);
1674 if (q->name) g = string_append(g, 3, US"G", q->name, US"/");
1675 g = string_cat(g, readconf_printtime(q->interval));
1676 g = string_catn(g, US" ", 1);
1679 gstring_release_unused(g);
1680 return string_from_gstring(g);
1684 /*************************************************
1685 * Exim Daemon Mainline *
1686 *************************************************/
1688 /* The daemon can do two jobs, either of which is optional:
1690 (1) Listens for incoming SMTP calls and spawns off a sub-process to handle
1691 each one. This is requested by the -bd option, with -oX specifying the SMTP
1692 port on which to listen (for testing).
1694 (2) Spawns a queue-running process every so often. This is controlled by the
1695 -q option with a an interval time. (If no time is given, a single queue run
1696 is done from the main function, and control doesn't get here.)
1698 Root privilege is required in order to attach to port 25. Some systems require
1699 it when calling socket() rather than bind(). To cope with all cases, we run as
1700 root for both socket() and bind(). Some systems also require root in order to
1701 write to the pid file directory. This function must therefore be called as root
1702 if it is to work properly in all circumstances. Once the socket is bound and
1703 the pid file written, root privilege is given up if there is an exim uid.
1705 There are no arguments to this function, and it never returns. */
1711 struct pollfd * fd_polls, * tls_watch_poll = NULL, * dnotify_poll = NULL;
1712 int listen_socket_count = 0, poll_fd_count;
1713 ip_address_item * addresses = NULL;
1714 time_t last_connection_time = (time_t)0;
1715 int local_queue_run_max = 0;
1717 if (is_multiple_qrun())
1719 /* Nuber of runner-tracking structs needed: If the option queue_run_max has
1720 no expandable elements then it is the overall maximum; else we assume it
1721 depends on the queue name, and add them up to get the maximum.
1722 Evaluate both that and the individual limits. */
1724 GET_OPTION("queue_run_max");
1725 if (Ustrchr(queue_run_max, '$') != NULL)
1727 for (qrunner * q = qrunners; q; q = q->next)
1729 queue_name = q->name;
1730 local_queue_run_max +=
1731 (q->run_max = atoi(CS expand_string(queue_run_max)));
1737 local_queue_run_max = atoi(CS expand_string(queue_run_max));
1738 for (qrunner * q = qrunners; q; q = q->next)
1739 q->run_max = local_queue_run_max;
1743 process_purpose = US"daemon";
1745 /* If any debugging options are set, turn on the D_pid bit so that all
1746 debugging lines get the pid added. */
1748 DEBUG(D_any|D_v) debug_selector |= D_pid;
1750 /* Allocate enough pollstructs for inetd mode plus the ancillary sockets;
1751 also used when there are no listen sockets. */
1753 fd_polls = store_get(sizeof(struct pollfd) * 3, GET_UNTAINTED);
1755 if (f.inetd_wait_mode)
1757 listen_socket_count = 1;
1759 if (dup2(0, 3) == -1)
1760 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1761 "failed to dup inetd socket safely away: %s", strerror(errno));
1764 fd_polls[0].events = POLLIN;
1770 if (debug_file == stderr)
1772 /* need a call to log_write before call to open debug_file, so that
1773 log.c:file_path has been initialised. This is unfortunate. */
1774 log_write(0, LOG_MAIN, "debugging Exim in inetd wait mode starting");
1778 exim_nullstd(); /* re-open fd2 after we just closed it again */
1779 debug_logging_activate(US"-wait", NULL);
1782 DEBUG(D_any) debug_printf("running in inetd wait mode\n");
1784 /* As per below, when creating sockets ourselves, we handle tcp_nodelay for
1785 our own buffering; we assume though that inetd set the socket REUSEADDR. */
1788 if (setsockopt(3, IPPROTO_TCP, TCP_NODELAY, US &on, sizeof(on)))
1789 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to set socket NODELAY: %s",
1794 if (f.inetd_wait_mode || f.daemon_listen)
1796 /* If any option requiring a load average to be available during the
1797 reception of a message is set, call os_getloadavg() while we are root
1798 for those OS for which this is necessary the first time it is called (in
1799 order to perform an "open" on the kernel memory file). */
1801 #ifdef LOAD_AVG_NEEDS_ROOT
1802 if (queue_only_load >= 0 || smtp_load_reserve >= 0 ||
1803 (deliver_queue_load_max >= 0 && deliver_drop_privilege))
1804 (void)os_getloadavg();
1809 /* Do the preparation for setting up a listener on one or more interfaces, and
1810 possible on various ports. This is controlled by the combination of
1811 local_interfaces (which can set IP addresses and ports) and daemon_smtp_port
1812 (which is a list of default ports to use for those items in local_interfaces
1813 that do not specify a port). The -oX command line option can be used to
1814 override one or both of these options.
1816 If local_interfaces is not set, the default is to listen on all interfaces.
1817 When it is set, it can include "all IPvx interfaces" as an item. This is useful
1818 when different ports are in use.
1820 It turns out that listening on all interfaces is messy in an IPv6 world,
1821 because several different implementation approaches have been taken. This code
1822 is now supposed to work with all of them. The point of difference is whether an
1823 IPv6 socket that is listening on all interfaces will receive incoming IPv4
1824 calls or not. We also have to cope with the case when IPv6 libraries exist, but
1825 there is no IPv6 support in the kernel.
1827 . On Solaris, an IPv6 socket will accept IPv4 calls, and give them as mapped
1828 addresses. However, if an IPv4 socket is also listening on all interfaces,
1829 calls are directed to the appropriate socket.
1831 . On (some versions of) Linux, an IPv6 socket will accept IPv4 calls, and
1832 give them as mapped addresses, but an attempt also to listen on an IPv4
1833 socket on all interfaces causes an error.
1835 . On OpenBSD, an IPv6 socket will not accept IPv4 calls. You have to set up
1836 two sockets if you want to accept both kinds of call.
1838 . FreeBSD is like OpenBSD, but it has the IPV6_V6ONLY socket option, which
1839 can be turned off, to make it behave like the versions of Linux described
1842 . I heard a report that the USAGI IPv6 stack for Linux has implemented
1845 So, what we do when IPv6 is supported is as follows:
1847 (1) After it is set up, the list of interfaces is scanned for wildcard
1848 addresses. If an IPv6 and an IPv4 wildcard are both found for the same
1849 port, the list is re-arranged so that they are together, with the IPv6
1852 (2) If the creation of a wildcard IPv6 socket fails, we just log the error and
1853 carry on if an IPv4 wildcard socket for the same port follows later in the
1854 list. This allows Exim to carry on in the case when the kernel has no IPv6
1857 (3) Having created an IPv6 wildcard socket, we try to set IPV6_V6ONLY if that
1858 option is defined. However, if setting fails, carry on regardless (but log
1861 (4) If binding or listening on an IPv6 wildcard socket fails, it is a serious
1864 (5) If binding or listening on an IPv4 wildcard socket fails with the error
1865 EADDRINUSE, and a previous interface was an IPv6 wildcard for the same
1866 port (which must have succeeded or we wouldn't have got this far), we
1867 assume we are in the situation where just a single socket is permitted,
1868 and ignore the error.
1872 The preparation code decodes options and sets up the relevant data. We do this
1873 first, so that we can return non-zero if there are any syntax errors, and also
1876 if (f.daemon_listen && !f.inetd_wait_mode)
1878 int *default_smtp_port;
1882 const uschar * list;
1883 uschar *local_iface_source = US"local_interfaces";
1884 ip_address_item *ipa;
1885 ip_address_item **pipa;
1887 /* If -oX was used, disable the writing of a pid file unless -oP was
1888 explicitly used to force it. Then scan the string given to -oX. Any items
1889 that contain neither a dot nor a colon are used to override daemon_smtp_port.
1890 Any other items are used to override local_interfaces. */
1892 if (override_local_interfaces)
1894 gstring * new_smtp_port = NULL;
1895 gstring * new_local_interfaces = NULL;
1897 if (!override_pid_file_path) write_pid = FALSE;
1899 list = override_local_interfaces;
1901 while ((s = string_nextinlist(&list, &sep, NULL, 0)))
1904 gstring ** gp = Ustrpbrk(s, ".:") ? &new_local_interfaces : &new_smtp_port;
1910 *gp = string_catn(*gp, US"<", 1);
1913 *gp = string_catn(*gp, joinstr, 2);
1914 *gp = string_cat (*gp, s);
1919 daemon_smtp_port = string_from_gstring(new_smtp_port);
1920 DEBUG(D_any) debug_printf("daemon_smtp_port overridden by -oX:\n %s\n",
1924 if (new_local_interfaces)
1926 local_interfaces = string_from_gstring(new_local_interfaces);
1927 local_iface_source = US"-oX data";
1928 DEBUG(D_any) debug_printf("local_interfaces overridden by -oX:\n %s\n",
1933 /* Create a list of default SMTP ports, to be used if local_interfaces
1934 contains entries without explicit ports. First count the number of ports, then
1935 build a translated list in a vector. */
1937 list = daemon_smtp_port;
1939 while ((s = string_nextinlist(&list, &sep, NULL, 0)))
1941 default_smtp_port = store_get((pct+1) * sizeof(int), GET_UNTAINTED);
1942 list = daemon_smtp_port;
1945 (s = string_nextinlist(&list, &sep, NULL, 0));
1951 default_smtp_port[pct] = Ustrtol(s, &end, 0);
1952 if (end != s + Ustrlen(s))
1953 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "invalid SMTP port: %s", s);
1957 struct servent *smtp_service = getservbyname(CS s, "tcp");
1959 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "TCP port \"%s\" not found", s);
1960 default_smtp_port[pct] = ntohs(smtp_service->s_port);
1963 default_smtp_port[pct] = 0;
1965 /* Check the list of TLS-on-connect ports and do name lookups if needed */
1967 list = tls_in.on_connect_ports;
1969 /* the list isn't expanded so cannot be tainted. If it ever is we will trap here */
1970 while ((s = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1975 list = tls_in.on_connect_ports;
1976 tls_in.on_connect_ports = NULL;
1978 while ((s = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1982 struct servent * smtp_service = getservbyname(CS s, "tcp");
1984 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "TCP port \"%s\" not found", s);
1985 s = string_sprintf("%d", (int)ntohs(smtp_service->s_port));
1987 g = string_append_listele(g, ':', s);
1990 tls_in.on_connect_ports = g->s;
1994 /* Create the list of local interfaces, possibly with ports included. This
1995 list may contain references to 0.0.0.0 and ::0 as wildcards. These special
1996 values are converted below. */
1998 addresses = host_build_ifacelist(local_interfaces, local_iface_source);
2000 /* In the list of IP addresses, convert 0.0.0.0 into an empty string, and ::0
2001 into the string ":". We use these to recognize wildcards in IPv4 and IPv6. In
2002 fact, many IP stacks recognize 0.0.0.0 and ::0 and handle them as wildcards
2003 anyway, but we need to know which are the wildcard addresses, and the shorter
2006 In the same scan, fill in missing port numbers from the default list. When
2007 there is more than one item in the list, extra items are created. */
2009 for (ipa = addresses; ipa; ipa = ipa->next)
2011 if (Ustrcmp(ipa->address, "0.0.0.0") == 0)
2012 ipa->address[0] = 0;
2013 else if (Ustrcmp(ipa->address, "::0") == 0)
2015 ipa->address[0] = ':';
2016 ipa->address[1] = 0;
2019 if (ipa->port > 0) continue;
2021 if (daemon_smtp_port[0] <= 0)
2022 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "no port specified for interface "
2023 "%s and daemon_smtp_port is unset; cannot start daemon",
2024 ipa->address[0] == 0 ? US"\"all IPv4\"" :
2025 ipa->address[1] == 0 ? US"\"all IPv6\"" : ipa->address);
2027 ipa->port = default_smtp_port[0];
2028 for (int i = 1; default_smtp_port[i] > 0; i++)
2030 ip_address_item * new = store_get(sizeof(ip_address_item), GET_UNTAINTED);
2032 memcpy(new->address, ipa->address, Ustrlen(ipa->address) + 1);
2033 new->port = default_smtp_port[i];
2034 new->next = ipa->next;
2040 /* Scan the list of addresses for wildcards. If we find an IPv4 and an IPv6
2041 wildcard for the same port, ensure that (a) they are together and (b) the
2042 IPv6 address comes first. This makes handling the messy features easier, and
2043 also simplifies the construction of the "daemon started" log line. */
2046 for (ipa = addresses; ipa; pipa = &ipa->next, ipa = ipa->next)
2048 ip_address_item *ipa2;
2050 /* Handle an IPv4 wildcard */
2052 if (ipa->address[0] == 0)
2053 for (ipa2 = ipa; ipa2->next; ipa2 = ipa2->next)
2055 ip_address_item *ipa3 = ipa2->next;
2056 if (ipa3->address[0] == ':' &&
2057 ipa3->address[1] == 0 &&
2058 ipa3->port == ipa->port)
2060 ipa2->next = ipa3->next;
2067 /* Handle an IPv6 wildcard. */
2069 else if (ipa->address[0] == ':' && ipa->address[1] == 0)
2070 for (ipa2 = ipa; ipa2->next; ipa2 = ipa2->next)
2072 ip_address_item *ipa3 = ipa2->next;
2073 if (ipa3->address[0] == 0 && ipa3->port == ipa->port)
2075 ipa2->next = ipa3->next;
2076 ipa3->next = ipa->next;
2084 /* Get a vector to remember all the sockets in.
2085 Two extra elements for the ancillary sockets */
2087 for (ipa = addresses; ipa; ipa = ipa->next)
2088 listen_socket_count++;
2089 fd_polls = store_get(sizeof(struct pollfd) * (listen_socket_count + 2),
2091 for (struct pollfd * p = fd_polls; p < fd_polls + listen_socket_count + 2;
2093 { p->fd = -1; p->events = POLLIN; }
2095 } /* daemon_listen but not inetd_wait_mode */
2097 if (f.daemon_listen)
2100 /* Do a sanity check on the max connects value just to save us from getting
2101 a huge amount of store. */
2103 if (smtp_accept_max > 4095) smtp_accept_max = 4096;
2105 /* There's no point setting smtp_accept_queue unless it is less than the max
2106 connects limit. The configuration reader ensures that the max is set if the
2107 queue-only option is set. */
2109 if (smtp_accept_queue > smtp_accept_max) smtp_accept_queue = 0;
2111 /* Get somewhere to keep the list of SMTP accepting pids if we are keeping
2112 track of them for total number and queue/host limits. */
2114 if (smtp_accept_max > 0)
2116 smtp_slots = store_get(smtp_accept_max * sizeof(smtp_slot), GET_UNTAINTED);
2117 for (int i = 0; i < smtp_accept_max; i++) smtp_slots[i] = empty_smtp_slot;
2121 /* The variable background_daemon is always false when debugging, but
2122 can also be forced false in order to keep a non-debugging daemon in the
2123 foreground. If background_daemon is true, close all open file descriptors that
2124 we know about, but then re-open stdin, stdout, and stderr to /dev/null. Also
2125 do this for inetd_wait mode.
2127 This is protection against any called functions (in libraries, or in
2128 Perl, or whatever) that think they can write to stderr (or stdout). Before this
2129 was added, it was quite likely that an SMTP connection would use one of these
2130 file descriptors, in which case writing random stuff to it caused chaos.
2132 Then disconnect from the controlling terminal, Most modern Unixes seem to have
2133 setsid() for getting rid of the controlling terminal. For any OS that doesn't,
2134 setsid() can be #defined as a no-op, or as something else. */
2136 if (f.background_daemon || f.inetd_wait_mode)
2138 log_close_all(); /* Just in case anything was logged earlier */
2139 search_tidyup(); /* Just in case any were used in reading the config. */
2140 (void)close(0); /* Get rid of stdin/stdout/stderr */
2143 exim_nullstd(); /* Connect stdin/stdout/stderr to /dev/null */
2144 log_stderr = NULL; /* So no attempt to copy paniclog output */
2147 if (f.background_daemon)
2149 /* If the parent process of this one has pid == 1, we are re-initializing the
2150 daemon as the result of a SIGHUP. In this case, there is no need to do
2151 anything, because the controlling terminal has long gone. Otherwise, fork, in
2152 case current process is a process group leader (see 'man setsid' for an
2153 explanation) before calling setsid().
2154 All other forks want daemon_listen cleared. Rather than blow a register, jsut
2159 BOOL daemon_listen = f.daemon_listen;
2160 pid_t pid = exim_fork(US"daemon");
2161 if (pid < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2162 "fork() failed when starting daemon: %s", strerror(errno));
2163 if (pid > 0) exim_exit(EXIT_SUCCESS); /* in parent process, just exit */
2164 (void)setsid(); /* release controlling terminal */
2165 f.daemon_listen = daemon_listen;
2169 /* We are now in the disconnected, daemon process (unless debugging). Set up
2170 the listening sockets if required. */
2172 daemon_notifier_socket();
2174 if (f.daemon_listen && !f.inetd_wait_mode)
2177 ip_address_item *ipa;
2179 /* For each IP address, create a socket, bind it to the appropriate port, and
2180 start listening. See comments above about IPv6 sockets that may or may not
2181 accept IPv4 calls when listening on all interfaces. We also have to cope with
2182 the case of a system with IPv6 libraries, but no IPv6 support in the kernel.
2183 listening, provided a wildcard IPv4 socket for the same port follows. */
2185 for (ipa = addresses, sk = 0; sk < listen_socket_count; ipa = ipa->next, sk++)
2188 ip_address_item * ipa2;
2191 if (Ustrchr(ipa->address, ':') != NULL)
2194 wildcard = ipa->address[1] == 0;
2199 wildcard = ipa->address[0] == 0;
2202 if ((fd_polls[sk].fd = fd = ip_socket(SOCK_STREAM, af)) < 0)
2204 if (check_special_case(0, addresses, ipa, FALSE))
2206 log_write(0, LOG_MAIN, "Failed to create IPv6 socket for wildcard "
2207 "listening (%s): will use IPv4", strerror(errno));
2210 log_write(0, LOG_PANIC_DIE, "IPv%c socket creation failed: %s",
2211 af == AF_INET6 ? '6' : '4', strerror(errno));
2214 /* If this is an IPv6 wildcard socket, set IPV6_V6ONLY if that option is
2215 available. Just log failure (can get protocol not available, just like
2216 socket creation can). */
2219 if (af == AF_INET6 && wildcard &&
2220 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) < 0)
2221 log_write(0, LOG_MAIN, "Setting IPV6_V6ONLY on daemon's IPv6 wildcard "
2222 "socket failed (%s): carrying on without it", strerror(errno));
2223 #endif /* IPV6_V6ONLY */
2225 /* Set SO_REUSEADDR so that the daemon can be restarted while a connection
2226 is being handled. Without this, a connection will prevent reuse of the
2227 smtp port for listening. */
2229 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) < 0)
2230 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "setting SO_REUSEADDR on socket "
2231 "failed when starting daemon: %s", strerror(errno));
2233 /* Set TCP_NODELAY; Exim does its own buffering. There is a switch to
2234 disable this because it breaks some broken clients. */
2236 if (tcp_nodelay) setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on));
2238 /* Now bind the socket to the required port; if Exim is being restarted
2239 it may not always be possible to bind immediately, even with SO_REUSEADDR
2240 set, so try 10 times, waiting between each try. After 10 failures, we give
2241 up. In an IPv6 environment, if bind () fails with the error EADDRINUSE and
2242 we are doing wildcard IPv4 listening and there was a previous IPv6 wildcard
2243 address for the same port, ignore the error on the grounds that we must be
2244 in a system where the IPv6 socket accepts both kinds of call. This is
2245 necessary for (some release of) USAGI Linux; other IP stacks fail at the
2246 listen() stage instead. */
2249 f.tcp_fastopen_ok = TRUE;
2254 if (ip_bind(fd, af, ipa->address, ipa->port) >= 0) break;
2255 if (check_special_case(errno, addresses, ipa, TRUE))
2257 DEBUG(D_any) debug_printf("wildcard IPv4 bind() failed after IPv6 "
2258 "listen() success; EADDRINUSE ignored\n");
2262 msg = US strerror(errno);
2268 if (daemon_startup_retries <= 0)
2269 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2270 "socket bind() to port %d for address %s failed: %s: "
2271 "daemon abandoned", ipa->port, addr, msg);
2272 log_write(0, LOG_MAIN, "socket bind() to port %d for address %s "
2273 "failed: %s: waiting %s before trying again (%d more %s)",
2274 ipa->port, addr, msg, readconf_printtime(daemon_startup_sleep),
2275 daemon_startup_retries, (daemon_startup_retries > 1)? "tries" : "try");
2276 daemon_startup_retries--;
2277 sleep(daemon_startup_sleep);
2282 debug_printf("listening on all interfaces (IPv%c) port %d\n",
2283 af == AF_INET6 ? '6' : '4', ipa->port);
2285 debug_printf("listening on %s port %d\n", ipa->address, ipa->port);
2287 /* Start listening on the bound socket, establishing the maximum backlog of
2288 connections that is allowed. On success, add to the set of sockets for select
2289 and continue to the next address. */
2291 #if defined(TCP_FASTOPEN) && !defined(__APPLE__)
2292 if ( f.tcp_fastopen_ok
2293 && setsockopt(fd, IPPROTO_TCP, TCP_FASTOPEN,
2294 &smtp_connect_backlog, sizeof(smtp_connect_backlog)))
2296 DEBUG(D_any) debug_printf("setsockopt FASTOPEN: %s\n", strerror(errno));
2297 f.tcp_fastopen_ok = FALSE;
2300 if (listen(fd, smtp_connect_backlog) >= 0)
2302 #if defined(TCP_FASTOPEN) && defined(__APPLE__)
2303 if ( f.tcp_fastopen_ok
2304 && setsockopt(fd, IPPROTO_TCP, TCP_FASTOPEN, &on, sizeof(on)))
2306 DEBUG(D_any) debug_printf("setsockopt FASTOPEN: %s\n", strerror(errno));
2307 f.tcp_fastopen_ok = FALSE;
2310 fd_polls[sk].fd = fd;
2314 /* Listening has failed. In an IPv6 environment, as for bind(), if listen()
2315 fails with the error EADDRINUSE and we are doing IPv4 wildcard listening
2316 and there was a previous successful IPv6 wildcard listen on the same port,
2317 we want to ignore the error on the grounds that we must be in a system
2318 where the IPv6 socket accepts both kinds of call. */
2320 if (!check_special_case(errno, addresses, ipa, TRUE))
2321 log_write(0, LOG_PANIC_DIE, "listen() failed on interface %s: %s",
2323 ? af == AF_INET6 ? US"(any IPv6)" : US"(any IPv4)" : ipa->address,
2326 DEBUG(D_any) debug_printf("wildcard IPv4 listen() failed after IPv6 "
2327 "listen() success; EADDRINUSE ignored\n");
2330 /* Come here if there has been a problem with the socket which we
2331 are going to ignore. We remove the address from the chain, and back up the
2335 sk--; /* Back up the count */
2336 listen_socket_count--; /* Reduce the total */
2337 if (ipa == addresses) addresses = ipa->next; else
2339 for (ipa2 = addresses; ipa2->next != ipa; ipa2 = ipa2->next);
2340 ipa2->next = ipa->next;
2343 } /* End of bind/listen loop for each address */
2344 } /* End of setup for listening */
2347 /* If we are not listening, we want to write a pid file only if -oP was
2348 explicitly given. */
2350 else if (!override_pid_file_path)
2353 /* Write the pid to a known file for assistance in identification, if required.
2354 We do this before giving up root privilege, because on some systems it is
2355 necessary to be root in order to write into the pid file directory. There's
2356 nothing to stop multiple daemons running, as long as no more than one listens
2357 on a given TCP/IP port on the same interface(s). However, in these
2358 circumstances it gets far too complicated to mess with pid file names
2359 automatically. Consequently, Exim 4 writes a pid file only
2361 (a) When running in the test harness, or
2362 (b) When -bd is used and -oX is not used, or
2363 (c) When -oP is used to supply a path.
2365 The variable daemon_write_pid is used to control this. */
2367 if (f.running_in_test_harness || write_pid)
2369 const enum pid_op operation = (f.running_in_test_harness
2370 || real_uid == root_uid
2371 || (real_uid == exim_uid && !override_pid_file_path)) ? PID_WRITE : PID_CHECK;
2372 if (!operate_on_pid_file(operation, getpid()))
2373 DEBUG(D_any) debug_printf("%s pid file %s: %s\n", (operation == PID_WRITE) ? "write" : "check", pid_file_path, strerror(errno));
2376 /* Set up the handler for SIGHUP, which causes a restart of the daemon. */
2378 sighup_seen = FALSE;
2379 signal(SIGHUP, sighup_handler);
2381 /* Give up root privilege at this point (assuming that exim_uid and exim_gid
2382 are not root). The third argument controls the running of initgroups().
2383 Normally we do this, in order to set up the groups for the Exim user. However,
2384 if we are not root at this time - some odd installations run that way - we
2387 exim_setugid(exim_uid, exim_gid, geteuid()==root_uid, US"running as a daemon");
2389 /* Update the originator_xxx fields so that received messages as listed as
2390 coming from Exim, not whoever started the daemon. */
2392 originator_uid = exim_uid;
2393 originator_gid = exim_gid;
2394 originator_login = (pw = getpwuid(exim_uid))
2395 ? string_copy_perm(US pw->pw_name, FALSE) : US"exim";
2397 /* Get somewhere to keep the list of queue-runner pids if we are keeping track
2398 of them (and also if we are doing queue runs). */
2400 if (is_multiple_qrun() && local_queue_run_max > 0)
2402 queue_runner_slot_count = local_queue_run_max;
2403 queue_runner_slots = store_get(local_queue_run_max * sizeof(runner_slot), GET_UNTAINTED);
2404 memset(queue_runner_slots, 0, local_queue_run_max * sizeof(runner_slot));
2407 /* Set up the handler for termination of child processes, and the one
2408 telling us to die. */
2410 sigchld_seen = FALSE;
2411 os_non_restarting_signal(SIGCHLD, main_sigchld_handler);
2413 sigterm_seen = FALSE;
2414 os_non_restarting_signal(SIGTERM, main_sigterm_handler);
2415 os_non_restarting_signal(SIGINT, main_sigterm_handler);
2417 /* If we are to run the queue periodically, pretend the alarm has just gone
2418 off. This will cause the first queue-runner to get kicked off straight away.
2419 Get an initial sort of the list of queues, to prioritize the initial q-runs */
2422 if ((sigalrm_seen = is_multiple_qrun()))
2423 (void) next_qrunner_interval();
2425 /* Log the start up of a daemon - at least one of listening or queue running
2428 if (f.inetd_wait_mode)
2430 uschar *p = big_buffer;
2432 if (inetd_wait_timeout >= 0)
2433 sprintf(CS p, "terminating after %d seconds", inetd_wait_timeout);
2435 sprintf(CS p, "with no wait timeout");
2437 log_write(0, LOG_MAIN,
2438 "exim %s daemon started: pid=%ld, launched with listening socket, %s",
2439 version_string, getpid(), big_buffer);
2440 set_process_info("daemon(%s): pre-listening socket", version_string);
2442 /* set up the timeout logic */
2443 sigalrm_seen = TRUE;
2446 else if (f.daemon_listen)
2449 int smtps_ports = 0;
2450 ip_address_item * ipa;
2452 const uschar * qinfo = describe_queue_runners();
2454 /* Build a list of listening addresses in big_buffer, but limit it to 10
2455 items. The style is for backwards compatibility.
2457 It is possible to have some ports listening for SMTPS (as opposed to TLS
2458 startted by STARTTLS), and others listening for standard SMTP. Keep their
2459 listings separate. */
2461 for (int j = 0, i; j < 2; j++)
2462 for (i = 0, ipa = addresses; i < 10 && ipa; i++, ipa = ipa->next)
2464 /* First time round, look for SMTP ports; second time round, look for
2465 SMTPS ports. Build IP+port strings. */
2467 if (host_is_tls_on_connect_port(ipa->port) == (j > 0))
2474 /* Now the information about the port (and sometimes interface) */
2476 if (ipa->address[0] == ':' && ipa->address[1] == 0)
2478 if (ipa->next && ipa->next->address[0] == 0 &&
2479 ipa->next->port == ipa->port)
2481 ipa->log = string_sprintf(" port %d (IPv6 and IPv4)", ipa->port);
2482 (ipa = ipa->next)->log = NULL;
2484 else if (ipa->v6_include_v4)
2485 ipa->log = string_sprintf(" port %d (IPv6 with IPv4)", ipa->port);
2487 ipa->log = string_sprintf(" port %d (IPv6)", ipa->port);
2489 else if (ipa->address[0] == 0) /* v4 wildcard */
2490 ipa->log = string_sprintf(" port %d (IPv4)", ipa->port);
2491 else /* check for previously-seen IP */
2493 ip_address_item * i2;
2494 for (i2 = addresses; i2 != ipa; i2 = i2->next)
2495 if ( host_is_tls_on_connect_port(i2->port) == (j > 0)
2496 && Ustrcmp(ipa->address, i2->address) == 0
2498 { /* found; append port to list */
2499 for (p = i2->log; *p; ) p++; /* end of existing string { */
2500 if (*--p == '}') *p = '\0'; /* drop EOL */
2501 while (isdigit(*--p)) ; /* char before port */
2503 i2->log = *p == ':' /* no list yet? { */
2504 ? string_sprintf("%.*s{%s,%d}",
2505 (int)(p - i2->log + 1), i2->log, p+1, ipa->port)
2506 : string_sprintf("%s,%d}", i2->log, ipa->port);
2510 if (i2 == ipa) /* first-time IP */
2511 ipa->log = string_sprintf(" [%s]:%d", ipa->address, ipa->port);
2517 for (int j = 0, i; j < 2; j++)
2519 /* First time round, look for SMTP ports; second time round, look for
2520 SMTPS ports. For the first one of each, insert leading text. */
2525 p += sprintf(CS p, "SMTP on");
2528 if (smtps_ports > 0)
2529 p += sprintf(CS p, "%sSMTPS on",
2530 smtp_ports == 0 ? "" : " and for ");
2532 /* Now the information about the port (and sometimes interface) */
2534 for (i = 0, ipa = addresses; i < 10 && ipa; i++, ipa = ipa->next)
2535 if (host_is_tls_on_connect_port(ipa->port) == (j > 0))
2537 p += sprintf(CS p, "%s", ipa->log);
2540 p += sprintf(CS p, " ...");
2543 log_write(0, LOG_MAIN,
2544 "exim %s daemon started: pid=%ld, %s, listening for %s",
2545 version_string, getpid(), qinfo, big_buffer);
2546 set_process_info("daemon(%s): %s, listening for %s",
2547 version_string, qinfo, big_buffer);
2550 else /* no listening sockets, only queue-runs */
2552 const uschar * s = describe_queue_runners();
2553 log_write(0, LOG_MAIN,
2554 "exim %s daemon started: pid=%ld, %s, not listening for SMTP",
2555 version_string, getpid(), s);
2556 set_process_info("daemon(%s): %s, not listening", version_string, s);
2559 /* Do any work it might be useful to amortize over our children
2560 (eg: compile regex) */
2563 smtp_deliver_init(); /* Used for callouts */
2565 #ifndef DISABLE_DKIM
2567 # ifdef MEASURE_TIMING
2569 gettimeofday(&t0, NULL);
2572 # ifdef MEASURE_TIMING
2573 report_time_since(&t0, US"dkim_exim_init (delta)");
2578 #ifdef WITH_CONTENT_SCAN
2585 /* Add ancillary sockets to the set for select */
2587 poll_fd_count = listen_socket_count;
2589 if (tls_watch_fd >= 0)
2591 tls_watch_poll = &fd_polls[poll_fd_count++];
2592 tls_watch_poll->fd = tls_watch_fd;
2593 tls_watch_poll->events = POLLIN;
2596 if (daemon_notifier_fd >= 0)
2598 dnotify_poll = &fd_polls[poll_fd_count++];
2599 dnotify_poll->fd = daemon_notifier_fd;
2600 dnotify_poll->events = POLLIN;
2603 /* Close the log so it can be renamed and moved. In the few cases below where
2604 this long-running process writes to the log (always exceptional conditions), it
2605 closes the log afterwards, for the same reason. */
2609 DEBUG(D_any) debug_print_ids(US"daemon running with");
2611 /* Any messages accepted via this route are going to be SMTP. */
2615 #ifdef MEASURE_TIMING
2616 report_time_since(×tamp_startup, US"daemon loop start"); /* testcase 0022 */
2619 /* Enter the never-ending loop... */
2623 int nolisten_sleep = 60;
2626 daemon_die(); /* Does not return */
2628 /* This code is placed first in the loop, so that it gets obeyed at the
2629 start, before the first wait, for the queue-runner case, so that the first
2630 one can be started immediately.
2632 The other option is that we have an inetd wait timeout specified to -bw. */
2634 if (sigalrm_seen || *queuerun_msgid)
2635 if (inetd_wait_timeout > 0)
2636 daemon_inetd_wtimeout(last_connection_time); /* Might not return */
2639 daemon_qrun(local_queue_run_max, fd_polls, listen_socket_count);
2642 /* Sleep till a connection happens if listening, and handle the connection if
2643 that is why we woke up. The FreeBSD operating system requires the use of
2644 select() before accept() because the latter function is not interrupted by
2645 a signal, and we want to wake up for SIGCHLD and SIGALRM signals. Some other
2646 OS do notice signals in accept() but it does no harm to have the select()
2647 in for all of them - and it won't then be a lurking problem for ports to
2648 new OS. In fact, the later addition of listening on specific interfaces only
2649 requires this way of working anyway. */
2651 if (f.daemon_listen)
2654 BOOL select_failed = FALSE;
2656 DEBUG(D_any) debug_printf("Listening...\n");
2658 /* In rare cases we may have had a SIGCHLD signal in the time between
2659 setting the handler (below) and getting back here. If so, pretend that the
2660 select() was interrupted so that we reap the child. This might still leave
2661 a small window when a SIGCHLD could get lost. However, since we use SIGCHLD
2662 only to do the reaping more quickly, it shouldn't result in anything other
2663 than a delay until something else causes a wake-up.
2664 For the normal case, wait for either a pollable fd (eg. new connection) or
2665 or a SIGALRM (for a periodic queue run) */
2673 lcount = poll(fd_polls, poll_fd_count, -1);
2677 select_failed = TRUE;
2681 /* Clean up any subprocesses that may have terminated. We need to do this
2682 here so that smtp_accept_max_per_host works when a connection to that host
2683 has completed, and we are about to accept a new one. When this code was
2684 later in the sequence, a new connection could be rejected, even though an
2685 old one had just finished. Preserve the errno from any select() failure for
2686 the use of the common select/accept error processing below. */
2689 int select_errno = errno;
2690 handle_ending_processes();
2695 /* Create or rotate any required keys; handle (delayed) filewatch event */
2697 if ((old_tfd = tls_daemon_tick()) >= 0)
2698 for (struct pollfd * p = &fd_polls[listen_socket_count];
2699 p < fd_polls + poll_fd_count; p++)
2700 if (p->fd == old_tfd) { p->fd = tls_watch_fd ; break; }
2703 errno = select_errno;
2706 /* Loop for all the sockets that are currently ready to go. If select
2707 actually failed, we have set the count to 1 and select_failed=TRUE, so as
2708 to use the common error code for select/accept below. */
2710 while (lcount-- > 0)
2712 int accept_socket = -1;
2714 struct sockaddr_in6 accepted;
2716 struct sockaddr_in accepted;
2721 #if !defined(DISABLE_TLS) && (defined(EXIM_HAVE_INOTIFY) || defined(EXIM_HAVE_KEVENT))
2722 if (tls_watch_poll && tls_watch_poll->revents & POLLIN)
2724 tls_watch_poll->revents = 0;
2725 tls_watch_trigger_time = time(NULL); /* Set up delayed event */
2726 tls_watch_discard_event(tls_watch_fd);
2727 break; /* to top of daemon loop */
2730 /* Handle the daemon-notifier socket. If it was a fast-ramp
2731 notification then queuerun_msgid will have a nonzerolength string. */
2733 if (dnotify_poll && dnotify_poll->revents & POLLIN)
2735 dnotify_poll->revents = 0;
2736 daemon_notification();
2737 break; /* to top of daemon loop */
2739 for (struct pollfd * p = fd_polls; p < fd_polls + listen_socket_count;
2741 if (p->revents & POLLIN)
2743 EXIM_SOCKLEN_T alen = sizeof(accepted);
2744 #if defined(__FreeBSD__) && defined(SO_LISTENQLEN)
2746 socklen_t blen = sizeof(backlog);
2748 if ( smtp_backlog_monitor > 0
2749 && getsockopt(p->fd, SOL_SOCKET, SO_LISTENQLEN, &backlog, &blen) == 0)
2752 debug_printf("listen fd %d queue curr %d\n", p->fd, backlog);
2753 smtp_listen_backlog = backlog;
2756 #elif defined(TCP_INFO) && defined(EXIM_HAVE_TCPI_UNACKED)
2758 socklen_t tlen = sizeof(ti);
2760 /* If monitoring the backlog is wanted, grab for later logging */
2762 smtp_listen_backlog = 0;
2763 if ( smtp_backlog_monitor > 0
2764 && getsockopt(p->fd, IPPROTO_TCP, TCP_INFO, &ti, &tlen) == 0)
2766 DEBUG(D_interface) debug_printf("listen fd %d queue max %u curr %u\n",
2767 p->fd, ti.tcpi_sacked, ti.tcpi_unacked);
2768 smtp_listen_backlog = ti.tcpi_unacked;
2772 accept_socket = accept(p->fd, (struct sockaddr *)&accepted, &alen);
2777 /* If select or accept has failed and this was not caused by an
2778 interruption, log the incident and try again. With asymmetric TCP/IP
2779 routing errors such as "No route to network" have been seen here. Also
2780 "connection reset by peer" has been seen. These cannot be classed as
2781 disastrous errors, but they could fill up a lot of log. The code in smail
2782 crashes the daemon after 10 successive failures of accept, on the grounds
2783 that some OS fail continuously. Exim originally followed suit, but this
2784 appears to have caused problems. Now it just keeps going, but instead of
2785 logging each error, it batches them up when they are continuous. */
2787 if (accept_socket < 0 && errno != EINTR)
2789 if (accept_retry_count == 0)
2791 accept_retry_errno = errno;
2792 accept_retry_select_failed = select_failed;
2794 else if ( errno != accept_retry_errno
2795 || select_failed != accept_retry_select_failed
2796 || accept_retry_count >= 50)
2798 log_write(0, LOG_MAIN | (accept_retry_count >= 50 ? LOG_PANIC : 0),
2799 "%d %s() failure%s: %s",
2801 accept_retry_select_failed ? "select" : "accept",
2802 accept_retry_count == 1 ? "" : "s",
2803 strerror(accept_retry_errno));
2805 accept_retry_count = 0;
2806 accept_retry_errno = errno;
2807 accept_retry_select_failed = select_failed;
2809 accept_retry_count++;
2811 else if (accept_retry_count > 0)
2813 log_write(0, LOG_MAIN, "%d %s() failure%s: %s",
2815 accept_retry_select_failed ? "select" : "accept",
2816 accept_retry_count == 1 ? "" : "s",
2817 strerror(accept_retry_errno));
2819 accept_retry_count = 0;
2822 /* If select/accept succeeded, deal with the connection. */
2824 if (accept_socket >= 0)
2826 #ifdef TCP_QUICKACK /* Avoid pure-ACKs while in tls protocol pingpong phase */
2827 /* Unfortunately we cannot be certain to do this before a TLS-on-connect
2828 Client Hello arrives and is acked. We do it as early as possible. */
2829 (void) setsockopt(accept_socket, IPPROTO_TCP, TCP_QUICKACK, US &off, sizeof(off));
2831 if (inetd_wait_timeout)
2832 last_connection_time = time(NULL);
2833 handle_smtp_call(fd_polls, listen_socket_count, accept_socket,
2834 (struct sockaddr *)&accepted);
2839 /* If not listening, then just sleep for the queue interval. If we woke
2840 up early the last time for some other signal, it won't matter because
2841 the alarm signal will wake at the right time. This code originally used
2842 sleep() but it turns out that on the FreeBSD system, sleep() is not inter-
2843 rupted by signals, so it wasn't waking up for SIGALRM or SIGCHLD. Luckily
2844 select() can be used as an interruptible sleep() on all versions of Unix. */
2849 poll(&p, 0, nolisten_sleep * 1000);
2850 handle_ending_processes();
2853 /* Re-enable the SIGCHLD handler if it has been run. It can't do it
2854 for itself, because it isn't doing the waiting itself. */
2858 sigchld_seen = FALSE;
2859 os_non_restarting_signal(SIGCHLD, main_sigchld_handler);
2862 /* Handle being woken by SIGHUP. We know at this point that the result
2863 of accept() has been dealt with, so we can re-exec exim safely, first
2864 closing the listening sockets so that they can be reused. Cancel any pending
2865 alarm in case it is just about to go off, and set SIGHUP to be ignored so
2866 that another HUP in quick succession doesn't clobber the new daemon before it
2867 gets going. All log files get closed by the close-on-exec flag; however, if
2868 the exec fails, we need to close the logs. */
2872 log_write(0, LOG_MAIN, "pid %ld: SIGHUP received: re-exec daemon",
2874 close_daemon_sockets(daemon_notifier_fd, fd_polls, listen_socket_count);
2875 unlink_notifier_socket();
2877 signal(SIGHUP, SIG_IGN);
2878 sighup_argv[0] = exim_path;
2880 execv(CS exim_path, (char *const *)sighup_argv);
2881 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "pid %ld: exec of %s failed: %s",
2882 getpid(), exim_path, strerror(errno));
2886 } /* End of main loop */
2888 /* Control never reaches here */
2893 /* End of exim_daemon.c */