Docs: more PCRE2

[exim.git] / src / src / transport.c

diff --git a/src/src/transport.c b/src/src/transport.c
index 75af68f9ba82dbf78caf89644b181b2d01128ecc..ef523657ea05b36f122ade55b8c838a22e9d2a50 100644 (file)
--- a/src/src/transport.c
+++ b/src/src/transport.c
@@ -2,7 +2,8 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 

-/* Copyright (c) University of Cambridge 1995 - 2016 */
+/* Copyright (c) University of Cambridge 1995 - 2018 */
+/* Copyright (c) The Exim Maintainers 2020 - 2021 */

 /* See the file NOTICE for conditions of use and distribution. */
 
 /* General functions concerned with transportation, and generic options for all
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* General functions concerned with transportation, and generic options for all


@@ -15,75 +16,76 @@ transports. */
 data blocks and which therefore have the opt_public flag set. Note that there
 are other options living inside this structure which can be set only from
 certain transports. */
 data blocks and which therefore have the opt_public flag set. Note that there
 are other options living inside this structure which can be set only from
 certain transports. */

+#define LOFF(field) OPT_OFF(transport_instance, field)

 
 optionlist optionlist_transports[] = {
   /*   name            type                                    value */
   { "*expand_group",    opt_stringptr|opt_hidden|opt_public,
 
 optionlist optionlist_transports[] = {
   /*   name            type                                    value */
   { "*expand_group",    opt_stringptr|opt_hidden|opt_public,

-                 (void *)offsetof(transport_instance, expand_gid) },
+                 LOFF(expand_gid) },

   { "*expand_user",     opt_stringptr|opt_hidden|opt_public,
   { "*expand_user",     opt_stringptr|opt_hidden|opt_public,

-                 (void *)offsetof(transport_instance, expand_uid) },
+                 LOFF(expand_uid) },

   { "*headers_rewrite_flags", opt_int|opt_public|opt_hidden,
   { "*headers_rewrite_flags", opt_int|opt_public|opt_hidden,

-                 (void *)offsetof(transport_instance, rewrite_existflags) },
+                 LOFF(rewrite_existflags) },

   { "*headers_rewrite_rules", opt_void|opt_public|opt_hidden,
   { "*headers_rewrite_rules", opt_void|opt_public|opt_hidden,

-                 (void *)offsetof(transport_instance, rewrite_rules) },
+                 LOFF(rewrite_rules) },

   { "*set_group",       opt_bool|opt_hidden|opt_public,
   { "*set_group",       opt_bool|opt_hidden|opt_public,

-                 (void *)offsetof(transport_instance, gid_set) },
+                 LOFF(gid_set) },

   { "*set_user",        opt_bool|opt_hidden|opt_public,
   { "*set_user",        opt_bool|opt_hidden|opt_public,

-                 (void *)offsetof(transport_instance, uid_set) },
+                 LOFF(uid_set) },

   { "body_only",        opt_bool|opt_public,
   { "body_only",        opt_bool|opt_public,

-                 (void *)offsetof(transport_instance, body_only) },
+                 LOFF(body_only) },

   { "current_directory", opt_stringptr|opt_public,
   { "current_directory", opt_stringptr|opt_public,

-                 (void *)offsetof(transport_instance, current_dir) },
+                 LOFF(current_dir) },

   { "debug_print",      opt_stringptr | opt_public,
   { "debug_print",      opt_stringptr | opt_public,

-                 (void *)offsetof(transport_instance, debug_string) },
+                 LOFF(debug_string) },

   { "delivery_date_add", opt_bool|opt_public,
   { "delivery_date_add", opt_bool|opt_public,

-                 (void *)(offsetof(transport_instance, delivery_date_add)) },
+                 LOFF(delivery_date_add) },

   { "disable_logging",  opt_bool|opt_public,
   { "disable_logging",  opt_bool|opt_public,

-                 (void *)(offsetof(transport_instance, disable_logging)) },
+                 LOFF(disable_logging) },

   { "driver",           opt_stringptr|opt_public,
   { "driver",           opt_stringptr|opt_public,

-                 (void *)offsetof(transport_instance, driver_name) },
+                 LOFF(driver_name) },

   { "envelope_to_add",   opt_bool|opt_public,
   { "envelope_to_add",   opt_bool|opt_public,

-                 (void *)(offsetof(transport_instance, envelope_to_add)) },
+                 LOFF(envelope_to_add) },

 #ifndef DISABLE_EVENT
   { "event_action",     opt_stringptr | opt_public,
 #ifndef DISABLE_EVENT
   { "event_action",     opt_stringptr | opt_public,

-                 (void *)offsetof(transport_instance, event_action) },
+                 LOFF(event_action) },

 #endif
   { "group",             opt_expand_gid|opt_public,
 #endif
   { "group",             opt_expand_gid|opt_public,

-                 (void *)offsetof(transport_instance, gid) },
+                 LOFF(gid) },

   { "headers_add",      opt_stringptr|opt_public|opt_rep_str,
   { "headers_add",      opt_stringptr|opt_public|opt_rep_str,

-                 (void *)offsetof(transport_instance, add_headers) },
+                 LOFF(add_headers) },

   { "headers_only",     opt_bool|opt_public,
   { "headers_only",     opt_bool|opt_public,

-                 (void *)offsetof(transport_instance, headers_only) },
+                 LOFF(headers_only) },

   { "headers_remove",   opt_stringptr|opt_public|opt_rep_str,
   { "headers_remove",   opt_stringptr|opt_public|opt_rep_str,

-                 (void *)offsetof(transport_instance, remove_headers) },
+                 LOFF(remove_headers) },

   { "headers_rewrite",  opt_rewrite|opt_public,
   { "headers_rewrite",  opt_rewrite|opt_public,

-                 (void *)offsetof(transport_instance, headers_rewrite) },
+                 LOFF(headers_rewrite) },

   { "home_directory",   opt_stringptr|opt_public,
   { "home_directory",   opt_stringptr|opt_public,

-                 (void *)offsetof(transport_instance, home_dir) },
+                 LOFF(home_dir) },

   { "initgroups",       opt_bool|opt_public,
   { "initgroups",       opt_bool|opt_public,

-                 (void *)offsetof(transport_instance, initgroups) },
+                 LOFF(initgroups) },

   { "max_parallel",     opt_stringptr|opt_public,
   { "max_parallel",     opt_stringptr|opt_public,

-                 (void *)offsetof(transport_instance, max_parallel) },
+                 LOFF(max_parallel) },

   { "message_size_limit", opt_stringptr|opt_public,
   { "message_size_limit", opt_stringptr|opt_public,

-                 (void *)offsetof(transport_instance, message_size_limit) },
+                 LOFF(message_size_limit) },

   { "rcpt_include_affixes", opt_bool|opt_public,
   { "rcpt_include_affixes", opt_bool|opt_public,

-                 (void *)offsetof(transport_instance, rcpt_include_affixes) },
+                 LOFF(rcpt_include_affixes) },

   { "retry_use_local_part", opt_bool|opt_public,
   { "retry_use_local_part", opt_bool|opt_public,

-                 (void *)offsetof(transport_instance, retry_use_local_part) },
+                 LOFF(retry_use_local_part) },

   { "return_path",      opt_stringptr|opt_public,
   { "return_path",      opt_stringptr|opt_public,

-                 (void *)(offsetof(transport_instance, return_path)) },
+                 LOFF(return_path) },

   { "return_path_add",   opt_bool|opt_public,
   { "return_path_add",   opt_bool|opt_public,

-                 (void *)(offsetof(transport_instance, return_path_add)) },
+                 LOFF(return_path_add) },

   { "shadow_condition", opt_stringptr|opt_public,
   { "shadow_condition", opt_stringptr|opt_public,

-                 (void *)offsetof(transport_instance, shadow_condition) },
+                 LOFF(shadow_condition) },

   { "shadow_transport", opt_stringptr|opt_public,
   { "shadow_transport", opt_stringptr|opt_public,

-                 (void *)offsetof(transport_instance, shadow) },
+                 LOFF(shadow) },

   { "transport_filter", opt_stringptr|opt_public,
   { "transport_filter", opt_stringptr|opt_public,

-                 (void *)offsetof(transport_instance, filter_command) },
+                 LOFF(filter_command) },

   { "transport_filter_timeout", opt_time|opt_public,
   { "transport_filter_timeout", opt_time|opt_public,

-                 (void *)offsetof(transport_instance, filter_timeout) },
+                 LOFF(filter_timeout) },

   { "user",             opt_expand_uid|opt_public,
   { "user",             opt_expand_uid|opt_public,

-                 (void *)offsetof(transport_instance, uid) }
+                 LOFF(uid) }

 };
 
 int optionlist_transports_size = nelem(optionlist_transports);
 };
 
 int optionlist_transports_size = nelem(optionlist_transports);


@@ -95,12 +97,11 @@ int optionlist_transports_size = nelem(optionlist_transports);
 void
 options_transports(void)
 {
 void
 options_transports(void)
 {

-struct transport_info * ti;

 uschar buf[64];
 
 options_from_list(optionlist_transports, nelem(optionlist_transports), US"TRANSPORTS", NULL);
 
 uschar buf[64];
 
 options_from_list(optionlist_transports, nelem(optionlist_transports), US"TRANSPORTS", NULL);
 

-for (ti = transports_available; ti->driver_name[0]; ti++)
+for (transport_info * ti = transports_available; ti->driver_name[0]; ti++)

   {
   spf(buf, sizeof(buf), US"_DRIVER_TRANSPORT_%T", ti->driver_name);
   builtin_macro_create(buf);
   {
   spf(buf, sizeof(buf), US"_DRIVER_TRANSPORT_%T", ti->driver_name);
   builtin_macro_create(buf);


@@ -142,8 +143,6 @@ the work. */
 void
 transport_init(void)
 {
 void
 transport_init(void)
 {

-transport_instance *t;
-

 readconf_driver_init(US"transport",
   (driver_instance **)(&transports),     /* chain anchor */
   (driver_info *)transports_available,   /* available drivers */
 readconf_driver_init(US"transport",
   (driver_instance **)(&transports),     /* chain anchor */
   (driver_info *)transports_available,   /* available drivers */


@@ -156,7 +155,7 @@ readconf_driver_init(US"transport",
 /* Now scan the configured transports and check inconsistencies. A shadow
 transport is permitted only for local transports. */
 
 /* Now scan the configured transports and check inconsistencies. A shadow
 transport is permitted only for local transports. */
 

-for (t = transports; t; t = t->next)
+for (transport_instance * t = transports; t; t = t->next)

   {
   if (!t->info->local && t->shadow)
     log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
   {
   if (!t->info->local && t->shadow)
     log_write(0, LOG_PANIC_DIE|LOG_CONFIG,


@@ -175,6 +174,20 @@ for (t = transports; t; t = t->next)
 *             Write block of data                *
 *************************************************/
 
 *             Write block of data                *
 *************************************************/
 

+static int
+tpt_write(int fd, uschar * block, int len, BOOL more, int options)
+{
+return
+#ifndef DISABLE_TLS
+  tls_out.active.sock == fd
+    ? tls_write(tls_out.active.tls_ctx, block, len, more) :
+#endif
+#ifdef MSG_MORE
+  more && !(options & topt_not_socket) ? send(fd, block, len, MSG_MORE) :
+#endif
+  write(fd, block, len);
+}
+

 /* Subroutine called by write_chunk() and at the end of the message actually
 to write a data block. Also called directly by some transports to write
 additional data to the file descriptor (e.g. prefix, suffix).
 /* Subroutine called by write_chunk() and at the end of the message actually
 to write a data block. Also called directly by some transports to write
 additional data to the file descriptor (e.g. prefix, suffix).


@@ -218,61 +231,57 @@ Returns:    TRUE on success, FALSE on failure (with errno preserved);
 */
 
 static BOOL
 */
 
 static BOOL

-transport_write_block_fd(transport_ctx * tctx, uschar *block, int len, BOOL more)
+transport_write_block_fd(transport_ctx * tctx, uschar * block, int len, BOOL more)

 {
 {

-int i, rc, save_errno;
+int rc, save_errno;

 int local_timeout = transport_write_timeout;
 int local_timeout = transport_write_timeout;

+int connretry = 1;

 int fd = tctx->u.fd;
 
 /* This loop is for handling incomplete writes and other retries. In most
 normal cases, it is only ever executed once. */
 
 int fd = tctx->u.fd;
 
 /* This loop is for handling incomplete writes and other retries. In most
 normal cases, it is only ever executed once. */
 

-for (i = 0; i < 100; i++)
+for (int i = 0; i < 100; i++)

   {
   DEBUG(D_transport)
     debug_printf("writing data block fd=%d size=%d timeout=%d%s\n",
       fd, len, local_timeout, more ? " (more expected)" : "");
 
   {
   DEBUG(D_transport)
     debug_printf("writing data block fd=%d size=%d timeout=%d%s\n",
       fd, len, local_timeout, more ? " (more expected)" : "");
 

-  /* This code makes use of alarm() in order to implement the timeout. This
-  isn't a very tidy way of doing things. Using non-blocking I/O with select()
-  provides a neater approach. However, I don't know how to do this when TLS is
-  in use. */
+  /* When doing TCP Fast Open we may get this far before the 3-way handshake
+  is complete, and write returns ENOTCONN.  Detect that, wait for the socket
+  to become writable, and retry once only. */

 
 

-  if (transport_write_timeout <= 0)   /* No timeout wanted */
+  for(;;)

     {
     {

-    rc =
-#ifdef SUPPORT_TLS
-       tls_out.active == fd ? tls_write(FALSE, block, len, more) :
-#endif
-#ifdef MSG_MORE
-       more ? send(fd, block, len, MSG_MORE) :
-#endif
-       write(fd, block, len);
-    save_errno = errno;
-    }
+    /* This code makes use of alarm() in order to implement the timeout. This
+    isn't a very tidy way of doing things. Using non-blocking I/O with select()
+    provides a neater approach. However, I don't know how to do this when TLS is
+    in use. */

 
 

-  /* Timeout wanted. */
-
-  else
-    {
-    alarm(local_timeout);
-
-    rc =
-#ifdef SUPPORT_TLS
-       tls_out.active == fd ? tls_write(FALSE, block, len, more) :
-#endif
-#ifdef MSG_MORE
-       more ? send(fd, block, len, MSG_MORE) :
-#endif
-       write(fd, block, len);
-
-    save_errno = errno;
-    local_timeout = alarm(0);
-    if (sigalrm_seen)
+    if (transport_write_timeout <= 0)   /* No timeout wanted */

       {
       {

-      errno = ETIMEDOUT;
-      return FALSE;
+      rc = tpt_write(fd, block, len, more, tctx->options);
+      save_errno = errno;

       }
       }

+    else                               /* Timeout wanted. */
+      {
+      sigalrm_seen = FALSE;
+      ALARM(local_timeout);
+       rc = tpt_write(fd, block, len, more, tctx->options);
+       save_errno = errno;
+      local_timeout = ALARM_CLR(0);
+      if (sigalrm_seen)
+       {
+       errno = ETIMEDOUT;
+       return FALSE;
+       }
+      }
+
+    if (rc >= 0 || errno != ENOTCONN || connretry <= 0)
+      break;
+
+    poll_one_fd(fd, POLLOUT, -1);              /* could set timeout? retval check? */
+    connretry--;

     }
 
   /* Hopefully, the most common case is success, so test that first. */
     }
 
   /* Hopefully, the most common case is success, so test that first. */


@@ -373,13 +382,18 @@ BOOL
 transport_write_string(int fd, const char *format, ...)
 {
 transport_ctx tctx = {{0}};
 transport_write_string(int fd, const char *format, ...)
 {
 transport_ctx tctx = {{0}};

+gstring gs = { .size = big_buffer_size, .ptr = 0, .s = big_buffer };

 va_list ap;
 va_list ap;

+
+/* Use taint-unchecked routines for writing into big_buffer, trusting
+that the result will never be expanded. */
+

 va_start(ap, format);
 va_start(ap, format);

-if (!string_vformat(big_buffer, big_buffer_size, format, ap))
+if (!string_vformat(&gs, SVFMT_TAINT_NOCHK, format, ap))

   log_write(0, LOG_MAIN|LOG_PANIC_DIE, "overlong formatted string in transport");
 va_end(ap);
 tctx.u.fd = fd;
   log_write(0, LOG_MAIN|LOG_PANIC_DIE, "overlong formatted string in transport");
 va_end(ap);
 tctx.u.fd = fd;

-return transport_write_block(&tctx, big_buffer, Ustrlen(big_buffer), FALSE);
+return transport_write_block(&tctx, gs.s, gs.ptr, FALSE);

 }
 
 
 }
 
 


@@ -423,7 +437,6 @@ write_chunk(transport_ctx * tctx, uschar *chunk, int len)
 {
 uschar *start = chunk;
 uschar *end = chunk + len;
 {
 uschar *start = chunk;
 uschar *end = chunk + len;

-uschar *ptr;

 int mlen = DELIVER_OUT_BUFFER_SIZE - nl_escape_length - 2;
 
 /* The assumption is made that the check string will never stretch over move
 int mlen = DELIVER_OUT_BUFFER_SIZE - nl_escape_length - 2;
 
 /* The assumption is made that the check string will never stretch over move


@@ -460,7 +473,7 @@ if (nl_partial_match >= 0)
 for possible escaping. The code for the non-NL route should be as fast as
 possible. */
 
 for possible escaping. The code for the non-NL route should be as fast as
 possible. */
 

-for (ptr = start; ptr < end; ptr++)
+for (uschar * ptr = start; ptr < end; ptr++)

   {
   int ch, len;
 
   {
   int ch, len;
 


@@ -493,7 +506,7 @@ for (ptr = start; ptr < end; ptr++)
 
   if (  *ptr == '\r' && ptr[1] == '\n'
      && !(tctx->options & topt_use_crlf)
 
   if (  *ptr == '\r' && ptr[1] == '\n'
      && !(tctx->options & topt_use_crlf)

-     && spool_file_wireformat
+     && f.spool_file_wireformat

      )
     ptr++;
 
      )
     ptr++;
 


@@ -503,7 +516,7 @@ for (ptr = start; ptr < end; ptr++)
 
     /* Insert CR before NL if required */
 
 
     /* Insert CR before NL if required */
 

-    if (tctx->options & topt_use_crlf && !spool_file_wireformat)
+    if (tctx->options & topt_use_crlf && !f.spool_file_wireformat)

       *chunk_ptr++ = '\r';
     *chunk_ptr++ = '\n';
     transport_newlines++;
       *chunk_ptr++ = '\r';
     *chunk_ptr++ = '\n';
     transport_newlines++;


@@ -578,17 +591,17 @@ if (include_affixes)
   return addr->address;
   }
 
   return addr->address;
   }
 

-if (addr->suffix == NULL)
+if (!addr->suffix)

   {
   {

-  if (addr->prefix == NULL) return addr->address;
+  if (!addr->prefix) return addr->address;

   return addr->address + Ustrlen(addr->prefix);
   }
 
 at = Ustrrchr(addr->address, '@');
   return addr->address + Ustrlen(addr->prefix);
   }
 
 at = Ustrrchr(addr->address, '@');

-plen = (addr->prefix == NULL)? 0 : Ustrlen(addr->prefix);
+plen = addr->prefix ? Ustrlen(addr->prefix) : 0;

 slen = Ustrlen(addr->suffix);
 
 slen = Ustrlen(addr->suffix);
 

-return string_sprintf("%.*s@%s", (at - addr->address - plen - slen),
+return string_sprintf("%.*s@%s", (int)(at - addr->address - plen - slen),

    addr->address + plen, at + 1);
 }
 
    addr->address + plen, at + 1);
 }
 


@@ -638,7 +651,7 @@ so that we don't handle it again. */
 
 for (ppp = *pdlist; ppp; ppp = ppp->next) if (p == ppp->ptr) return TRUE;
 
 
 for (ppp = *pdlist; ppp; ppp = ppp->next) if (p == ppp->ptr) return TRUE;
 

-ppp = store_get(sizeof(struct aci));
+ppp = store_get(sizeof(struct aci), FALSE);

 ppp->next = *pdlist;
 *pdlist = ppp;
 ppp->ptr = p;
 ppp->next = *pdlist;
 *pdlist = ppp;
 ppp->ptr = p;


@@ -662,7 +675,7 @@ if (ppp) return TRUE;
 
 /* Remember what we have output, and output it. */
 
 
 /* Remember what we have output, and output it. */
 

-ppp = store_get(sizeof(struct aci));
+ppp = store_get(sizeof(struct aci), FALSE);

 ppp->next = *pplist;
 *pplist = ppp;
 ppp->ptr = pp;
 ppp->next = *pplist;
 *pplist = ppp;
 ppp->ptr = pp;


@@ -692,7 +705,6 @@ BOOL
 transport_headers_send(transport_ctx * tctx,
   BOOL (*sendfn)(transport_ctx * tctx, uschar * s, int len))
 {
 transport_headers_send(transport_ctx * tctx,
   BOOL (*sendfn)(transport_ctx * tctx, uschar * s, int len))
 {

-header_line *h;

 const uschar *list;
 transport_instance * tblock = tctx ? tctx->tblock : NULL;
 address_item * addr = tctx ? tctx->addr : NULL;
 const uschar *list;
 transport_instance * tblock = tctx ? tctx->tblock : NULL;
 address_item * addr = tctx ? tctx->addr : NULL;


@@ -704,13 +716,12 @@ match any entries therein.  It is a colon-sep list; expand the items
 separately and squash any empty ones.
 Then check addr->prop.remove_headers too, provided that addr is not NULL. */
 
 separately and squash any empty ones.
 Then check addr->prop.remove_headers too, provided that addr is not NULL. */
 

-for (h = header_list; h; h = h->next) if (h->type != htype_old)
+for (header_line * h = header_list; h; h = h->next) if (h->type != htype_old)

   {
   {

-  int i;

   BOOL include_header = TRUE;
 
   list = tblock ? tblock->remove_headers : NULL;
   BOOL include_header = TRUE;
 
   list = tblock ? tblock->remove_headers : NULL;

-  for (i = 0; i < 2; i++)    /* For remove_headers && addr->prop.remove_headers */
+  for (int i = 0; i < 2; i++)    /* For remove_headers && addr->prop.remove_headers */

     {
     if (list)
       {
     {
     if (list)
       {


@@ -721,16 +732,23 @@ for (h = header_list; h; h = h->next) if (h->type != htype_old)
        int len;
 
        if (i == 0)
        int len;
 
        if (i == 0)

-         if (!(s = expand_string(s)) && !expand_string_forcedfail)
+         if (!(s = expand_string(s)) && !f.expand_string_forcedfail)

            {
            errno = ERRNO_CHHEADER_FAIL;
            return FALSE;
            }
        len = s ? Ustrlen(s) : 0;
            {
            errno = ERRNO_CHHEADER_FAIL;
            return FALSE;
            }
        len = s ? Ustrlen(s) : 0;

-       if (strncmpic(h->text, s, len) != 0) continue;
-       ss = h->text + len;
-       while (*ss == ' ' || *ss == '\t') ss++;
-       if (*ss == ':') break;
+       if (len && s[len-1] == '*')     /* trailing glob */
+         {
+         if (strncmpic(h->text, s, len-1) == 0) break;
+         }
+       else
+         {
+         if (strncmpic(h->text, s, len) != 0) continue;
+         ss = h->text + len;
+         while (*ss == ' ' || *ss == '\t') ss++;
+         if (*ss == ':') break;
+         }

        }
       if (s) { include_header = FALSE; break; }
       }
        }
       if (s) { include_header = FALSE; break; }
       }


@@ -744,7 +762,7 @@ for (h = header_list; h; h = h->next) if (h->type != htype_old)
     {
     if (tblock && tblock->rewrite_rules)
       {
     {
     if (tblock && tblock->rewrite_rules)
       {

-      void *reset_point = store_get(0);
+      rmark reset_point = store_mark();

       header_line *hh;
 
       if ((hh = rewrite_header(h, NULL, NULL, tblock->rewrite_rules,
       header_line *hh;
 
       if ((hh = rewrite_header(h, NULL, NULL, tblock->rewrite_rules,


@@ -780,10 +798,9 @@ Headers added to an address by a router are guaranteed to end with a newline.
 
 if (addr)
   {
 
 if (addr)
   {

-  int i;

   header_line *hprev = addr->prop.extra_headers;
   header_line *hprev = addr->prop.extra_headers;

-  header_line *hnext;
-  for (i = 0; i < 2; i++)
+  header_line *hnext, * h;
+  for (int i = 0; i < 2; i++)

     for (h = hprev, hprev = NULL; h; h = hnext)
       {
       hnext = h->next;
     for (h = hprev, hprev = NULL; h; h = hnext)
       {
       hnext = h->next;


@@ -827,7 +844,7 @@ if (tblock && (list = CUS tblock->add_headers))
          }
        }
       }
          }
        }
       }

-    else if (!expand_string_forcedfail)
+    else if (!f.expand_string_forcedfail)

       { errno = ERRNO_CHHEADER_FAIL; return FALSE; }
   }
 
       { errno = ERRNO_CHHEADER_FAIL; return FALSE; }
   }
 


@@ -867,7 +884,7 @@ transport_write_timeout non-zero.
 
 Arguments:
   tctx
 
 Arguments:
   tctx

-    (fd, msg)          Either and fd, to write the message to,
+    (fd, msg)          Either an fd, to write the message to,

                        or a string: if null write message to allocated space
                        otherwire take content as headers.
     addr                (chain of) addresses (for extra headers), or NULL;
                        or a string: if null write message to allocated space
                        otherwire take content as headers.
     addr                (chain of) addresses (for extra headers), or NULL;


@@ -886,6 +903,7 @@ Arguments:
       add_delivery_date     if TRUE, add a "delivery-date" header
       use_crlf              if TRUE, turn NL into CR LF
       end_dot               if TRUE, send a terminating "." line at the end
       add_delivery_date     if TRUE, add a "delivery-date" header
       use_crlf              if TRUE, turn NL into CR LF
       end_dot               if TRUE, send a terminating "." line at the end

+      no_flush             if TRUE, do not flush at end

       no_headers            if TRUE, omit the headers
       no_body               if TRUE, omit the body
     check_string          a string to check for at the start of lines, or NULL
       no_headers            if TRUE, omit the headers
       no_body               if TRUE, omit the body
     check_string          a string to check for at the start of lines, or NULL


@@ -932,17 +950,17 @@ so temporarily hide the global that adjusts for its format. */
 
 if (!(tctx->options & topt_no_headers))
   {
 
 if (!(tctx->options & topt_no_headers))
   {

-  BOOL save_wireformat = spool_file_wireformat;
-  spool_file_wireformat = FALSE;
+  BOOL save_wireformat = f.spool_file_wireformat;
+  f.spool_file_wireformat = FALSE;

 
   /* Add return-path: if requested. */
 
   if (tctx->options & topt_add_return_path)
     {
 
   /* Add return-path: if requested. */
 
   if (tctx->options & topt_add_return_path)
     {

-    uschar buffer[ADDRESS_MAXLENGTH + 20];
-    int n = sprintf(CS buffer, "Return-path: <%.*s>\n", ADDRESS_MAXLENGTH,
-      return_path);
-    if (!write_chunk(tctx, buffer, n)) goto bad;
+    int n;
+    uschar * s = string_sprintf("Return-path: <%.*s>\n%n",
+                          EXIM_EMAILADDR_MAX, return_path, &n);
+    if (!write_chunk(tctx, s, n)) goto bad;

     }
 
   /* Add envelope-to: if requested */
     }
 
   /* Add envelope-to: if requested */


@@ -950,10 +968,9 @@ if (!(tctx->options & topt_no_headers))
   if (tctx->options & topt_add_envelope_to)
     {
     BOOL first = TRUE;
   if (tctx->options & topt_add_envelope_to)
     {
     BOOL first = TRUE;

-    address_item *p;

     struct aci *plist = NULL;
     struct aci *dlist = NULL;
     struct aci *plist = NULL;
     struct aci *dlist = NULL;

-    void *reset_point = store_get(0);
+    rmark reset_point = store_mark();

 
     if (!write_chunk(tctx, US"Envelope-to: ", 13)) goto bad;
 
 
     if (!write_chunk(tctx, US"Envelope-to: ", 13)) goto bad;
 


@@ -961,8 +978,9 @@ if (!(tctx->options & topt_no_headers))
     anchors for lists of addresses already handled; they have to be defined at
     this level because write_env_to() calls itself recursively. */
 
     anchors for lists of addresses already handled; they have to be defined at
     this level because write_env_to() calls itself recursively. */
 

-    for (p = tctx->addr; p; p = p->next)
-      if (!write_env_to(p, &plist, &dlist, &first, tctx)) goto bad;
+    for (address_item * p = tctx->addr; p; p = p->next)
+      if (!write_env_to(p, &plist, &dlist, &first, tctx))
+       goto bad;

 
     /* Add a final newline and reset the store used for tracking duplicates */
 
 
     /* Add a final newline and reset the store used for tracking duplicates */
 


@@ -990,11 +1008,11 @@ if (!(tctx->options & topt_no_headers))
   if (!transport_headers_send(tctx, &write_chunk))
     {
 bad:
   if (!transport_headers_send(tctx, &write_chunk))
     {
 bad:

-    spool_file_wireformat = save_wireformat;
+    f.spool_file_wireformat = save_wireformat;

     return FALSE;
     }
 
     return FALSE;
     }
 

-  spool_file_wireformat = save_wireformat;
+  f.spool_file_wireformat = save_wireformat;

   }
 
 /* When doing RFC3030 CHUNKING output, work out how much data would be in a
   }
 
 /* When doing RFC3030 CHUNKING output, work out how much data would be in a


@@ -1023,7 +1041,7 @@ if (tctx->options & topt_use_bdat)
     if (size_limit > 0  &&  fsize > size_limit)
       fsize = size_limit;
     size = hsize + fsize;
     if (size_limit > 0  &&  fsize > size_limit)
       fsize = size_limit;
     size = hsize + fsize;

-    if (tctx->options & topt_use_crlf  &&  !spool_file_wireformat)
+    if (tctx->options & topt_use_crlf  &&  !f.spool_file_wireformat)

       size += body_linecount;  /* account for CRLF-expansion */
 
     /* With topt_use_bdat we never do dot-stuffing; no need to
       size += body_linecount;  /* account for CRLF-expansion */
 
     /* With topt_use_bdat we never do dot-stuffing; no need to


@@ -1070,10 +1088,10 @@ This should get used for CHUNKING output and also for writing the -K file for
 dkim signing,  when we had CHUNKING input.  */
 
 #ifdef OS_SENDFILE
 dkim signing,  when we had CHUNKING input.  */
 
 #ifdef OS_SENDFILE

-if (  spool_file_wireformat
+if (  f.spool_file_wireformat

    && !(tctx->options & (topt_no_body | topt_end_dot))
    && !nl_check_length
    && !(tctx->options & (topt_no_body | topt_end_dot))
    && !nl_check_length

-   && tls_out.active != tctx->u.fd
+   && tls_out.active.sock != tctx->u.fd

    )
   {
   ssize_t copied = 0;
    )
   {
   ssize_t copied = 0;


@@ -1104,20 +1122,20 @@ DEBUG(D_transport) debug_printf("cannot use sendfile for body: no support\n");
 DEBUG(D_transport)
   if (!(tctx->options & topt_no_body))
     debug_printf("cannot use sendfile for body: %s\n",
 DEBUG(D_transport)
   if (!(tctx->options & topt_no_body))
     debug_printf("cannot use sendfile for body: %s\n",

-      !spool_file_wireformat ? "spoolfile not wireformat"
+      !f.spool_file_wireformat ? "spoolfile not wireformat"

       : tctx->options & topt_end_dot ? "terminating dot wanted"
       : nl_check_length ? "dot- or From-stuffing wanted"
       : "TLS output wanted");
 
 if (!(tctx->options & topt_no_body))
   {
       : tctx->options & topt_end_dot ? "terminating dot wanted"
       : nl_check_length ? "dot- or From-stuffing wanted"
       : "TLS output wanted");
 
 if (!(tctx->options & topt_no_body))
   {

-  int size = size_limit;
+  unsigned long size = size_limit > 0 ? size_limit : ULONG_MAX;

 
   nl_check_length = abs(nl_check_length);
   nl_partial_match = 0;
   if (lseek(deliver_datafile, SPOOL_DATA_START_OFFSET, SEEK_SET) < 0)
     return FALSE;
 
   nl_check_length = abs(nl_check_length);
   nl_partial_match = 0;
   if (lseek(deliver_datafile, SPOOL_DATA_START_OFFSET, SEEK_SET) < 0)
     return FALSE;

-  while (  (len = MAX(DELIVER_IN_BUFFER_SIZE, size)) > 0
+  while (  (len = MIN(DELIVER_IN_BUFFER_SIZE, size)) > 0

        && (len = read(deliver_datafile, deliver_in_buffer, len)) > 0)
     {
     if (!write_chunk(tctx, deliver_in_buffer, len))
        && (len = read(deliver_datafile, deliver_in_buffer, len)) > 0)
     {
     if (!write_chunk(tctx, deliver_in_buffer, len))


@@ -1130,9 +1148,10 @@ if (!(tctx->options & topt_no_body))
   if (len != 0) return FALSE;
   }
 
   if (len != 0) return FALSE;
   }
 

-/* Finished with the check string */
+/* Finished with the check string, and spool-format consideration */

 
 nl_check_length = nl_escape_length = 0;
 
 nl_check_length = nl_escape_length = 0;

+f.spool_file_wireformat = FALSE;

 
 /* If requested, add a terminating "." line (SMTP output). */
 
 
 /* If requested, add a terminating "." line (SMTP output). */
 


@@ -1141,8 +1160,9 @@ if (tctx->options & topt_end_dot && !write_chunk(tctx, US".\n", 2))
 
 /* Write out any remaining data in the buffer before returning. */
 
 
 /* Write out any remaining data in the buffer before returning. */
 

-return (len = chunk_ptr - deliver_out_buffer) <= 0 ||
-  transport_write_block(tctx, deliver_out_buffer, len, FALSE);
+return (len = chunk_ptr - deliver_out_buffer) <= 0
+  || transport_write_block(tctx, deliver_out_buffer, len,
+                           !!(tctx->options & topt_no_flush));

 }
 
 
 }
 
 


@@ -1169,12 +1189,13 @@ BOOL
 transport_write_message(transport_ctx * tctx, int size_limit)
 {
 BOOL last_filter_was_NL = TRUE;
 transport_write_message(transport_ctx * tctx, int size_limit)
 {
 BOOL last_filter_was_NL = TRUE;

-BOOL save_spool_file_wireformat = spool_file_wireformat;
-int rc, len, yield, fd_read, fd_write, save_errno;
+BOOL save_spool_file_wireformat = f.spool_file_wireformat;
+BOOL yield;
+int rc, len, fd_read, fd_write, save_errno;

 int pfd[2] = {-1, -1};
 pid_t filter_pid, write_pid;
 
 int pfd[2] = {-1, -1};
 pid_t filter_pid, write_pid;
 

-transport_filter_timed_out = FALSE;
+f.transport_filter_timed_out = FALSE;

 
 /* If there is no filter command set up, call the internal function that does
 the actual work, passing it the incoming fd, and return its result. */
 
 /* If there is no filter command set up, call the internal function that does
 the actual work, passing it the incoming fd, and return its result. */


@@ -1214,10 +1235,10 @@ write_pid = (pid_t)(-1);
 
   {
   int bits = fcntl(tctx->u.fd, F_GETFD);
 
   {
   int bits = fcntl(tctx->u.fd, F_GETFD);

-  (void)fcntl(tctx->u.fd, F_SETFD, bits | FD_CLOEXEC);
+  (void) fcntl(tctx->u.fd, F_SETFD, bits | FD_CLOEXEC);

   filter_pid = child_open(USS transport_filter_argv, NULL, 077,
   filter_pid = child_open(USS transport_filter_argv, NULL, 077,

-   &fd_write, &fd_read, FALSE);
-  (void)fcntl(tctx->u.fd, F_SETFD, bits & ~FD_CLOEXEC);
+                         &fd_write, &fd_read, FALSE, US"transport-filter");
+  (void) fcntl(tctx->u.fd, F_SETFD, bits & ~FD_CLOEXEC);

   }
 if (filter_pid < 0) goto TIDY_UP;      /* errno set */
 
   }
 if (filter_pid < 0) goto TIDY_UP;      /* errno set */
 


@@ -1230,7 +1251,7 @@ via a(nother) pipe. While writing to the filter, we do not do the CRLF,
 smtp dots, or check string processing. */
 
 if (pipe(pfd) != 0) goto TIDY_UP;      /* errno set */
 smtp dots, or check string processing. */
 
 if (pipe(pfd) != 0) goto TIDY_UP;      /* errno set */

-if ((write_pid = fork()) == 0)
+if ((write_pid = exim_fork(US"tpt-filter-writer")) == 0)

   {
   BOOL rc;
   (void)close(fd_read);
   {
   BOOL rc;
   (void)close(fd_read);


@@ -1239,7 +1260,7 @@ if ((write_pid = fork()) == 0)
 
   tctx->u.fd = fd_write;
   tctx->check_string = tctx->escape_string = NULL;
 
   tctx->u.fd = fd_write;
   tctx->check_string = tctx->escape_string = NULL;

-  tctx->options &= ~(topt_use_crlf | topt_end_dot | topt_use_bdat);
+  tctx->options &= ~(topt_use_crlf | topt_end_dot | topt_use_bdat | topt_no_flush);

 
   rc = internal_transport_write_message(tctx, size_limit);
 
 
   rc = internal_transport_write_message(tctx, size_limit);
 


@@ -1250,11 +1271,11 @@ if ((write_pid = fork()) == 0)
         != sizeof(int)
      || write(pfd[pipe_write], (void *)&tctx->addr->more_errno, sizeof(int))
         != sizeof(int)
         != sizeof(int)
      || write(pfd[pipe_write], (void *)&tctx->addr->more_errno, sizeof(int))
         != sizeof(int)

-     || write(pfd[pipe_write], (void *)&tctx->addr->delivery_usec, sizeof(int))
-        != sizeof(int)
+     || write(pfd[pipe_write], (void *)&tctx->addr->delivery_time, sizeof(struct timeval))
+        != sizeof(struct timeval)

      )
     rc = FALSE;        /* compiler quietening */
      )
     rc = FALSE;        /* compiler quietening */

-  _exit(0);
+  exim_underbar_exit(EXIT_SUCCESS);

   }
 save_errno = errno;
 
   }
 save_errno = errno;
 


@@ -1274,7 +1295,7 @@ if (write_pid < 0)
 
 /* When testing, let the subprocess get going */
 
 
 /* When testing, let the subprocess get going */
 

-if (running_in_test_harness) millisleep(250);
+testharness_pause_ms(250);

 
 DEBUG(D_transport)
   debug_printf("process %d writing to transport filter\n", (int)write_pid);
 
 DEBUG(D_transport)
   debug_printf("process %d writing to transport filter\n", (int)write_pid);


@@ -1291,19 +1312,20 @@ no data is returned, that counts as "ended with NL" (default setting of the
 variable is TRUE).  The output should always be unix-format as we converted
 any wireformat source on writing input to the filter. */
 
 variable is TRUE).  The output should always be unix-format as we converted
 any wireformat source on writing input to the filter. */
 

-spool_file_wireformat = FALSE;
+f.spool_file_wireformat = FALSE;

 chunk_ptr = deliver_out_buffer;
 
 for (;;)
   {
   sigalrm_seen = FALSE;
 chunk_ptr = deliver_out_buffer;
 
 for (;;)
   {
   sigalrm_seen = FALSE;

-  alarm(transport_filter_timeout);
+  ALARM(transport_filter_timeout);

   len = read(fd_read, deliver_in_buffer, DELIVER_IN_BUFFER_SIZE);
   len = read(fd_read, deliver_in_buffer, DELIVER_IN_BUFFER_SIZE);

-  alarm(0);
+  ALARM_CLR(0);

   if (sigalrm_seen)
     {
   if (sigalrm_seen)
     {

+    DEBUG(D_transport) debug_printf("timed out reading from filter\n");

     errno = ETIMEDOUT;
     errno = ETIMEDOUT;

-    transport_filter_timed_out = TRUE;
+    f.transport_filter_timed_out = TRUE;

     goto TIDY_UP;
     }
 
     goto TIDY_UP;
     }
 


@@ -1331,7 +1353,7 @@ there has been an error, kill the processes before waiting for them, just to be
 sure. Also apply a paranoia timeout. */
 
 TIDY_UP:
 sure. Also apply a paranoia timeout. */
 
 TIDY_UP:

-spool_file_wireformat = save_spool_file_wireformat;
+f.spool_file_wireformat = save_spool_file_wireformat;

 save_errno = errno;
 
 (void)close(fd_read);
 save_errno = errno;
 
 (void)close(fd_read);


@@ -1374,11 +1396,10 @@ if (write_pid > 0)
         yield = FALSE;
        }
       else if (!ok)
         yield = FALSE;
        }
       else if (!ok)

-        {
+        {              /* Try to drain the pipe; read fails are don't care */

        int dummy = read(pfd[pipe_read], (void *)&save_errno, sizeof(int));
         dummy = read(pfd[pipe_read], (void *)&tctx->addr->more_errno, sizeof(int));
        int dummy = read(pfd[pipe_read], (void *)&save_errno, sizeof(int));
         dummy = read(pfd[pipe_read], (void *)&tctx->addr->more_errno, sizeof(int));

-        dummy = read(pfd[pipe_read], (void *)&tctx->addr->delivery_usec, sizeof(int));
-       dummy = dummy;          /* compiler quietening */
+        dummy = read(pfd[pipe_read], (void *)&tctx->addr->delivery_time, sizeof(struct timeval));

         yield = FALSE;
         }
       }
         yield = FALSE;
         }
       }


@@ -1399,6 +1420,7 @@ filter was not NL, insert a NL to make the SMTP protocol work. */
 if (yield)
   {
   nl_check_length = nl_escape_length = 0;
 if (yield)
   {
   nl_check_length = nl_escape_length = 0;

+  f.spool_file_wireformat = FALSE;

   if (  tctx->options & topt_end_dot
      && ( last_filter_was_NL
         ? !write_chunk(tctx, US".\n", 2)
   if (  tctx->options & topt_end_dot
      && ( last_filter_was_NL
         ? !write_chunk(tctx, US".\n", 2)


@@ -1419,7 +1441,7 @@ DEBUG(D_transport)
   {
   debug_printf("end of filtering transport writing: yield=%d\n", yield);
   if (!yield)
   {
   debug_printf("end of filtering transport writing: yield=%d\n", yield);
   if (!yield)

-    debug_printf("errno=%d more_errno=%d\n", errno, tctx->addr->more_errno);
+    debug_printf(" errno=%d more_errno=%d\n", errno, tctx->addr->more_errno);

   }
 
 return yield;
   }
 
 return yield;


@@ -1468,7 +1490,6 @@ void
 transport_update_waiting(host_item *hostlist, uschar *tpname)
 {
 const uschar *prevname = US"";
 transport_update_waiting(host_item *hostlist, uschar *tpname)
 {
 const uschar *prevname = US"";

-host_item *host;

 open_db dbblock;
 open_db *dbm_file;
 
 open_db dbblock;
 open_db *dbm_file;
 


@@ -1477,18 +1498,17 @@ DEBUG(D_transport) debug_printf("updating wait-%s database\n", tpname);
 /* Open the database for this transport */
 
 if (!(dbm_file = dbfn_open(string_sprintf("wait-%.200s", tpname),
 /* Open the database for this transport */
 
 if (!(dbm_file = dbfn_open(string_sprintf("wait-%.200s", tpname),

-                     O_RDWR, &dbblock, TRUE)))
+                     O_RDWR, &dbblock, TRUE, TRUE)))

   return;
 
 /* Scan the list of hosts for which this message is waiting, and ensure
 that the message id is in each host record. */
 
   return;
 
 /* Scan the list of hosts for which this message is waiting, and ensure
 that the message id is in each host record. */
 

-for (host = hostlist; host; host = host->next)
+for (host_item * host = hostlist; host; host = host->next)

   {
   BOOL already = FALSE;
   dbdata_wait *host_record;
   {
   BOOL already = FALSE;
   dbdata_wait *host_record;

-  uschar *s;
-  int i, host_length;
+  int host_length;

   uschar buffer[256];
 
   /* Skip if this is the same host as we just processed; otherwise remember
   uschar buffer[256];
 
   /* Skip if this is the same host as we just processed; otherwise remember


@@ -1501,7 +1521,7 @@ for (host = hostlist; host; host = host->next)
 
   if (!(host_record = dbfn_read(dbm_file, host->name)))
     {
 
   if (!(host_record = dbfn_read(dbm_file, host->name)))
     {

-    host_record = store_get(sizeof(dbdata_wait) + MESSAGE_ID_LENGTH);
+    host_record = store_get(sizeof(dbdata_wait) + MESSAGE_ID_LENGTH, FALSE);

     host_record->count = host_record->sequence = 0;
     }
 
     host_record->count = host_record->sequence = 0;
     }
 


@@ -1511,7 +1531,7 @@ for (host = hostlist; host; host = host->next)
 
   /* Search the record to see if the current message is already in it. */
 
 
   /* Search the record to see if the current message is already in it. */
 

-  for (s = host_record->text; s < host_record->text + host_length;
+  for (uschar * s = host_record->text; s < host_record->text + host_length;

        s += MESSAGE_ID_LENGTH)
     if (Ustrncmp(s, message_id, MESSAGE_ID_LENGTH) == 0)
       { already = TRUE; break; }
        s += MESSAGE_ID_LENGTH)
     if (Ustrncmp(s, message_id, MESSAGE_ID_LENGTH) == 0)
       { already = TRUE; break; }


@@ -1519,14 +1539,14 @@ for (host = hostlist; host; host = host->next)
   /* If we haven't found this message in the main record, search any
   continuation records that exist. */
 
   /* If we haven't found this message in the main record, search any
   continuation records that exist. */
 

-  for (i = host_record->sequence - 1; i >= 0 && !already; i--)
+  for (int i = host_record->sequence - 1; i >= 0 && !already; i--)

     {
     dbdata_wait *cont;
     sprintf(CS buffer, "%.200s:%d", host->name, i);
     if ((cont = dbfn_read(dbm_file, buffer)))
       {
       int clen = cont->count * MESSAGE_ID_LENGTH;
     {
     dbdata_wait *cont;
     sprintf(CS buffer, "%.200s:%d", host->name, i);
     if ((cont = dbfn_read(dbm_file, buffer)))
       {
       int clen = cont->count * MESSAGE_ID_LENGTH;

-      for (s = cont->text; s < cont->text + clen; s += MESSAGE_ID_LENGTH)
+      for (uschar * s = cont->text; s < cont->text + clen; s += MESSAGE_ID_LENGTH)

         if (Ustrncmp(s, message_id, MESSAGE_ID_LENGTH) == 0)
           { already = TRUE; break; }
       }
         if (Ustrncmp(s, message_id, MESSAGE_ID_LENGTH) == 0)
           { already = TRUE; break; }
       }


@@ -1543,12 +1563,17 @@ for (host = hostlist; host; host = host->next)
 
   /* If this record is full, write it out with a new name constructed
   from the sequence number, increase the sequence number, and empty
 
   /* If this record is full, write it out with a new name constructed
   from the sequence number, increase the sequence number, and empty

-  the record. */
+  the record.  If we're doing a two-phase queue run initial phase, ping the
+  daemon to consider running a delivery on this host. */

 
   if (host_record->count >= WAIT_NAME_MAX)
     {
     sprintf(CS buffer, "%.200s:%d", host->name, host_record->sequence);
     dbfn_write(dbm_file, buffer, host_record, sizeof(dbdata_wait) + host_length);
 
   if (host_record->count >= WAIT_NAME_MAX)
     {
     sprintf(CS buffer, "%.200s:%d", host->name, host_record->sequence);
     dbfn_write(dbm_file, buffer, host_record, sizeof(dbdata_wait) + host_length);

+#ifndef DISABLE_QUEUE_RAMP
+    if (f.queue_2stage && queue_fast_ramp && !queue_run_in_order)
+      queue_notify_daemon(message_id);
+#endif

     host_record->sequence++;
     host_record->count = 0;
     host_length = 0;
     host_record->sequence++;
     host_record->count = 0;
     host_length = 0;


@@ -1560,7 +1585,7 @@ for (host = hostlist; host; host = host->next)
   else
     {
     dbdata_wait *newr =
   else
     {
     dbdata_wait *newr =

-      store_get(sizeof(dbdata_wait) + host_length + MESSAGE_ID_LENGTH);
+      store_get(sizeof(dbdata_wait) + host_length + MESSAGE_ID_LENGTH, FALSE);

     memcpy(newr, host_record, sizeof(dbdata_wait) + host_length);
     host_record = newr;
     }
     memcpy(newr, host_record, sizeof(dbdata_wait) + host_length);
     host_record = newr;
     }


@@ -1574,7 +1599,8 @@ for (host = hostlist; host; host = host->next)
   /* Update the database */
 
   dbfn_write(dbm_file, host->name, host_record, sizeof(dbdata_wait) + host_length);
   /* Update the database */
 
   dbfn_write(dbm_file, host->name, host_record, sizeof(dbdata_wait) + host_length);

-  DEBUG(D_transport) debug_printf("added to list for %s\n", host->name);
+  DEBUG(D_transport) debug_printf("added %.*s to queue for %s\n",
+                                 MESSAGE_ID_LENGTH, message_id, host->name);

   }
 
 /* All now done */
   }
 
 /* All now done */


@@ -1602,7 +1628,6 @@ Arguments:
   local_message_max  maximum number of messages down one connection
                        as set by the caller transport
   new_message_id     set to the message id of a waiting message
   local_message_max  maximum number of messages down one connection
                        as set by the caller transport
   new_message_id     set to the message id of a waiting message

-  more               set TRUE if there are yet more messages waiting

   oicf_func          function to call to validate if it is ok to send
                      to this message_id from the current instance.
   oicf_data          opaque data for oicf_func
   oicf_func          function to call to validate if it is ok to send
                      to this message_id from the current instance.
   oicf_data          opaque data for oicf_func


@@ -1618,7 +1643,7 @@ typedef struct msgq_s
 
 BOOL
 transport_check_waiting(const uschar *transport_name, const uschar *hostname,
 
 BOOL
 transport_check_waiting(const uschar *transport_name, const uschar *hostname,

-  int local_message_max, uschar *new_message_id, BOOL *more, oicf oicf_func, void *oicf_data)
+  int local_message_max, uschar *new_message_id, oicf oicf_func, void *oicf_data)

 {
 dbdata_wait *host_record;
 int host_length;
 {
 dbdata_wait *host_record;
 int host_length;


@@ -1628,13 +1653,12 @@ open_db *dbm_file;
 int         i;
 struct stat statbuf;
 
 int         i;
 struct stat statbuf;
 

-*more = FALSE;
-

 DEBUG(D_transport)
   {
   debug_printf("transport_check_waiting entered\n");
   debug_printf("  sequence=%d local_max=%d global_max=%d\n",
     continue_sequence, local_message_max, connection_max_messages);
 DEBUG(D_transport)
   {
   debug_printf("transport_check_waiting entered\n");
   debug_printf("  sequence=%d local_max=%d global_max=%d\n",
     continue_sequence, local_message_max, connection_max_messages);

+  acl_level++;

   }
 
 /* Do nothing if we have hit the maximum number that can be send down one
   }
 
 /* Do nothing if we have hit the maximum number that can be send down one


@@ -1644,23 +1668,23 @@ if (connection_max_messages >= 0) local_message_max = connection_max_messages;
 if (local_message_max > 0 && continue_sequence >= local_message_max)
   {
   DEBUG(D_transport)
 if (local_message_max > 0 && continue_sequence >= local_message_max)
   {
   DEBUG(D_transport)

-    debug_printf("max messages for one connection reached: returning\n");
-  return FALSE;
+    debug_printf_indent("max messages for one connection reached: returning\n");
+  goto retfalse;

   }
 
 /* Open the waiting information database. */
 
 if (!(dbm_file = dbfn_open(string_sprintf("wait-%.200s", transport_name),
   }
 
 /* Open the waiting information database. */
 
 if (!(dbm_file = dbfn_open(string_sprintf("wait-%.200s", transport_name),

-                         O_RDWR, &dbblock, TRUE)))
-  return FALSE;
+                         O_RDWR, &dbblock, TRUE, TRUE)))
+  goto retfalse;

 
 /* See if there is a record for this host; if not, there's nothing to do. */
 
 if (!(host_record = dbfn_read(dbm_file, hostname)))
   {
   dbfn_close(dbm_file);
 
 /* See if there is a record for this host; if not, there's nothing to do. */
 
 if (!(host_record = dbfn_read(dbm_file, hostname)))
   {
   dbfn_close(dbm_file);

-  DEBUG(D_transport) debug_printf("no messages waiting for %s\n", hostname);
-  return FALSE;
+  DEBUG(D_transport) debug_printf_indent("no messages waiting for %s\n", hostname);
+  goto retfalse;

   }
 
 /* If the data in the record looks corrupt, just log something and
   }
 
 /* If the data in the record looks corrupt, just log something and


@@ -1671,7 +1695,7 @@ if (host_record->count > WAIT_NAME_MAX)
   dbfn_close(dbm_file);
   log_write(0, LOG_MAIN|LOG_PANIC, "smtp-wait database entry for %s has bad "
     "count=%d (max=%d)", hostname, host_record->count, WAIT_NAME_MAX);
   dbfn_close(dbm_file);
   log_write(0, LOG_MAIN|LOG_PANIC, "smtp-wait database entry for %s has bad "
     "count=%d (max=%d)", hostname, host_record->count, WAIT_NAME_MAX);

-  return FALSE;
+  goto retfalse;

   }
 
 /* Scan the message ids in the record from the end towards the beginning,
   }
 
 /* Scan the message ids in the record from the end towards the beginning,


@@ -1695,7 +1719,7 @@ while (1)
 
   /* create an array to read entire message queue into memory for processing  */
 
 
   /* create an array to read entire message queue into memory for processing  */
 

-  msgq = store_malloc(sizeof(msgq_t) * host_record->count);
+  msgq = store_get(sizeof(msgq_t) * host_record->count, FALSE);

   msgq_count = host_record->count;
   msgq_actual = msgq_count;
 
   msgq_count = host_record->count;
   msgq_actual = msgq_count;
 


@@ -1703,12 +1727,13 @@ while (1)
     {
     msgq[i].bKeep = TRUE;
 
     {
     msgq[i].bKeep = TRUE;
 

-    Ustrncpy(msgq[i].message_id, host_record->text + (i * MESSAGE_ID_LENGTH),
+    Ustrncpy_nt(msgq[i].message_id, host_record->text + (i * MESSAGE_ID_LENGTH),

       MESSAGE_ID_LENGTH);
     msgq[i].message_id[MESSAGE_ID_LENGTH] = 0;
     }
 
   /* first thing remove current message id if it exists */
       MESSAGE_ID_LENGTH);
     msgq[i].message_id[MESSAGE_ID_LENGTH] = 0;
     }
 
   /* first thing remove current message id if it exists */

+  /*XXX but what if it has un-sent addrs? */

 
   for (i = 0; i < msgq_count; ++i)
     if (Ustrcmp(msgq[i].message_id, message_id) == 0)
 
   for (i = 0; i < msgq_count; ++i)
     if (Ustrcmp(msgq[i].message_id, message_id) == 0)


@@ -1722,16 +1747,14 @@ while (1)
   for (i = msgq_count - 1; i >= 0; --i) if (msgq[i].bKeep)
     {
     uschar subdir[2];
   for (i = msgq_count - 1; i >= 0; --i) if (msgq[i].bKeep)
     {
     uschar subdir[2];

+    uschar * mid = msgq[i].message_id;

 
 

-    subdir[0] = split_spool_directory ? msgq[i].message_id[5] : 0;
-    subdir[1] = 0;
-
-    if (Ustat(spool_fname(US"input", subdir, msgq[i].message_id, US"-D"),
-             &statbuf) != 0)
+    set_subdir_str(subdir, mid, 0);
+    if (Ustat(spool_fname(US"input", subdir, mid, US"-D"), &statbuf) != 0)

       msgq[i].bKeep = FALSE;
       msgq[i].bKeep = FALSE;

-    else if (!oicf_func || oicf_func(msgq[i].message_id, oicf_data))
+    else if (!oicf_func || oicf_func(mid, oicf_data))

       {
       {

-      Ustrcpy(new_message_id, msgq[i].message_id);
+      Ustrcpy_nt(new_message_id, mid);

       msgq[i].bKeep = FALSE;
       bFound = TRUE;
       break;
       msgq[i].bKeep = FALSE;
       bFound = TRUE;
       break;


@@ -1772,13 +1795,12 @@ while (1)
 
   while (host_length <= 0)
     {
 
   while (host_length <= 0)
     {

-    int i;

     dbdata_wait * newr = NULL;
     uschar buffer[256];
 
     /* Search for a continuation */
 
     dbdata_wait * newr = NULL;
     uschar buffer[256];
 
     /* Search for a continuation */
 

-    for (i = host_record->sequence - 1; i >= 0 && !newr; i--)
+    for (int i = host_record->sequence - 1; i >= 0 && !newr; i--)

       {
       sprintf(CS buffer, "%.200s:%d", hostname, i);
       newr = dbfn_read(dbm_file, buffer);
       {
       sprintf(CS buffer, "%.200s:%d", hostname, i);
       newr = dbfn_read(dbm_file, buffer);


@@ -1802,10 +1824,7 @@ while (1)
     }
 
   if (bFound)          /* Usual exit from main loop */
     }
 
   if (bFound)          /* Usual exit from main loop */

-    {
-    store_free (msgq);

     break;
     break;

-    }

 
   /* If host_length <= 0 we have emptied a record and not found a good message,
   and there are no continuation records. Otherwise there is a continuation
 
   /* If host_length <= 0 we have emptied a record and not found a good message,
   and there are no continuation records. Otherwise there is a continuation


@@ -1814,8 +1833,8 @@ while (1)
   if (host_length <= 0)
     {
     dbfn_close(dbm_file);
   if (host_length <= 0)
     {
     dbfn_close(dbm_file);

-    DEBUG(D_transport) debug_printf("waiting messages already delivered\n");
-    return FALSE;
+    DEBUG(D_transport) debug_printf_indent("waiting messages already delivered\n");
+    goto retfalse;

     }
 
   /* we were not able to find an acceptable message, nor was there a
     }
 
   /* we were not able to find an acceptable message, nor was there a


@@ -1826,10 +1845,8 @@ while (1)
     {
     Ustrcpy(new_message_id, message_id);
     dbfn_close(dbm_file);
     {
     Ustrcpy(new_message_id, message_id);
     dbfn_close(dbm_file);

-    return FALSE;
+    goto retfalse;

     }
     }

-
-  store_free(msgq);

   }            /* we need to process a continuation record */
 
 /* Control gets here when an existing message has been encountered; its
   }            /* we need to process a continuation record */
 
 /* Control gets here when an existing message has been encountered; its


@@ -1840,13 +1857,16 @@ record if required, close the database, and return TRUE. */
 if (host_length > 0)
   {
   host_record->count = host_length/MESSAGE_ID_LENGTH;
 if (host_length > 0)
   {
   host_record->count = host_length/MESSAGE_ID_LENGTH;

-

   dbfn_write(dbm_file, hostname, host_record, (int)sizeof(dbdata_wait) + host_length);
   dbfn_write(dbm_file, hostname, host_record, (int)sizeof(dbdata_wait) + host_length);

-  *more = TRUE;

   }
 
 dbfn_close(dbm_file);
   }
 
 dbfn_close(dbm_file);

+DEBUG(D_transport) {acl_level--; debug_printf("transport_check_waiting: TRUE\n"); }

 return TRUE;
 return TRUE;

+
+retfalse:
+DEBUG(D_transport) {acl_level--; debug_printf("transport_check_waiting: FALSE\n"); }
+return FALSE;

 }
 
 /*************************************************
 }
 
 /*************************************************


@@ -1858,32 +1878,64 @@ void
 transport_do_pass_socket(const uschar *transport_name, const uschar *hostname,
   const uschar *hostaddress, uschar *id, int socket_fd)
 {
 transport_do_pass_socket(const uschar *transport_name, const uschar *hostname,
   const uschar *hostaddress, uschar *id, int socket_fd)
 {

-int i = 20;
+int i = 13;

 const uschar **argv;
 
 const uschar **argv;
 

+#ifndef DISABLE_TLS
+if (smtp_peer_options & OPTION_TLS) i += 6;
+#endif
+#ifdef EXPERIMENTAL_ESMTP_LIMITS
+if (continue_limit_mail || continue_limit_rcpt || continue_limit_rcptdom)
+                                   i += 4;
+#endif
+if (queue_run_pid != (pid_t)0)     i += 3;
+#ifdef SUPPORT_SOCKS
+if (proxy_session)                 i += 5;
+#endif
+

 /* Set up the calling arguments; use the standard function for the basics,
 but we have a number of extras that may be added. */
 
 argv = CUSS child_exec_exim(CEE_RETURN_ARGV, TRUE, &i, FALSE, 0);
 
 /* Set up the calling arguments; use the standard function for the basics,
 but we have a number of extras that may be added. */
 
 argv = CUSS child_exec_exim(CEE_RETURN_ARGV, TRUE, &i, FALSE, 0);
 

-if (smtp_authenticated)                                argv[i++] = US"-MCA";
+if (f.smtp_authenticated)                      argv[i++] = US"-MCA";

 if (smtp_peer_options & OPTION_CHUNKING)       argv[i++] = US"-MCK";
 if (smtp_peer_options & OPTION_DSN)            argv[i++] = US"-MCD";
 if (smtp_peer_options & OPTION_PIPE)           argv[i++] = US"-MCP";
 if (smtp_peer_options & OPTION_SIZE)           argv[i++] = US"-MCS";
 if (smtp_peer_options & OPTION_CHUNKING)       argv[i++] = US"-MCK";
 if (smtp_peer_options & OPTION_DSN)            argv[i++] = US"-MCD";
 if (smtp_peer_options & OPTION_PIPE)           argv[i++] = US"-MCP";
 if (smtp_peer_options & OPTION_SIZE)           argv[i++] = US"-MCS";

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 if (smtp_peer_options & OPTION_TLS)
 if (smtp_peer_options & OPTION_TLS)

-  if (tls_out.active >= 0 || continue_proxy_cipher)
+  if (tls_out.active.sock >= 0 || continue_proxy_cipher)

     {
     argv[i++] = US"-MCt";
     argv[i++] = sending_ip_address;
     argv[i++] = string_sprintf("%d", sending_port);
     {
     argv[i++] = US"-MCt";
     argv[i++] = sending_ip_address;
     argv[i++] = string_sprintf("%d", sending_port);

-    argv[i++] = tls_out.active >= 0 ? tls_out.cipher : continue_proxy_cipher;
+    argv[i++] = tls_out.active.sock >= 0 ? tls_out.cipher : continue_proxy_cipher;
+
+    if (tls_out.sni)
+      {
+      argv[i++] =
+#ifdef SUPPORT_DANE
+        tls_out.dane_verified ? US"-MCr" :
+#endif
+        US"-MCs";
+      argv[i++] = tls_out.sni;
+      }

     }
   else
     argv[i++] = US"-MCT";
 #endif
 
     }
   else
     argv[i++] = US"-MCT";
 #endif
 

+#ifdef EXPERIMENTAL_ESMTP_LIMITS
+if (continue_limit_rcpt || continue_limit_rcptdom)
+  {
+  argv[i++] = US"-MCL";
+  argv[i++] = string_sprintf("%u", continue_limit_mail);
+  argv[i++] = string_sprintf("%u", continue_limit_rcpt);
+  argv[i++] = string_sprintf("%u", continue_limit_rcptdom);
+  }
+#endif
+

 if (queue_run_pid != (pid_t)0)
   {
   argv[i++] = US"-MCQ";
 if (queue_run_pid != (pid_t)0)
   {
   argv[i++] = US"-MCQ";


@@ -1891,6 +1943,17 @@ if (queue_run_pid != (pid_t)0)
   argv[i++] = string_sprintf("%d", queue_run_pipe);
   }
 
   argv[i++] = string_sprintf("%d", queue_run_pipe);
   }
 

+#ifdef SUPPORT_SOCKS
+if (proxy_session)
+  {
+  argv[i++] = US"-MCp";
+  argv[i++] = proxy_local_address;
+  argv[i++] = string_sprintf("%d", proxy_local_port);
+  argv[i++] = proxy_external_address;
+  argv[i++] = string_sprintf("%d", proxy_external_port);
+  }
+#endif
+

 argv[i++] = US"-MC";
 argv[i++] = US transport_name;
 argv[i++] = US hostname;
 argv[i++] = US"-MC";
 argv[i++] = US transport_name;
 argv[i++] = US hostname;


@@ -1933,26 +1996,33 @@ Returns:          FALSE if fork fails; TRUE otherwise
 
 BOOL
 transport_pass_socket(const uschar *transport_name, const uschar *hostname,
 
 BOOL
 transport_pass_socket(const uschar *transport_name, const uschar *hostname,

-  const uschar *hostaddress, uschar *id, int socket_fd)
+  const uschar *hostaddress, uschar *id, int socket_fd
+#ifdef EXPERIMENTAL_ESMTP_LIMITS
+  , unsigned peer_limit_mail, unsigned peer_limit_rcpt, unsigned peer_limit_rcptdom
+#endif
+  )

 {
 pid_t pid;
 int status;
 
 DEBUG(D_transport) debug_printf("transport_pass_socket entered\n");
 
 {
 pid_t pid;
 int status;
 
 DEBUG(D_transport) debug_printf("transport_pass_socket entered\n");
 

-if ((pid = fork()) == 0)
+#ifdef EXPERIMENTAL_ESMTP_LIMITS
+continue_limit_mail = peer_limit_mail;
+continue_limit_rcpt = peer_limit_rcpt;
+continue_limit_rcptdom = peer_limit_rcptdom;
+#endif
+
+if ((pid = exim_fork(US"continued-transport-interproc")) == 0)

   {
   /* Disconnect entirely from the parent process. If we are running in the
   test harness, wait for a bit to allow the previous process time to finish,
   write the log, etc., so that the output is always in the same order for
   automatic comparison. */
 
   {
   /* Disconnect entirely from the parent process. If we are running in the
   test harness, wait for a bit to allow the previous process time to finish,
   write the log, etc., so that the output is always in the same order for
   automatic comparison. */
 

-  if ((pid = fork()) != 0)
-    {
-    DEBUG(D_transport) debug_printf("transport_pass_socket succeeded (final-pid %d)\n", pid);
+  if ((pid = exim_fork(US"continued-transport")) != 0)

     _exit(EXIT_SUCCESS);
     _exit(EXIT_SUCCESS);

-    }
-  if (running_in_test_harness) sleep(1);
+  testharness_pause_ms(1000);

 
   transport_do_pass_socket(transport_name, hostname, hostaddress,
     id, socket_fd);
 
   transport_do_pass_socket(transport_name, hostname, hostaddress,
     id, socket_fd);


@@ -1966,7 +2036,6 @@ if (pid > 0)
   {
   int rc;
   while ((rc = wait(&status)) != pid && (rc >= 0 || errno != ECHILD));
   {
   int rc;
   while ((rc = wait(&status)) != pid && (rc >= 0 || errno != ECHILD));

-  DEBUG(D_transport) debug_printf("transport_pass_socket succeeded (inter-pid %d)\n", pid);

   return TRUE;
   }
 else
   return TRUE;
   }
 else


@@ -2009,21 +2078,20 @@ transport_set_up_command(const uschar ***argvptr, uschar *cmd,
   BOOL expand_arguments, int expand_failed, address_item *addr,
   uschar *etext, uschar **errptr)
 {
   BOOL expand_arguments, int expand_failed, address_item *addr,
   uschar *etext, uschar **errptr)
 {

-address_item *ad;

 const uschar **argv;
 uschar *s, *ss;
 int address_count = 0;
 int argcount = 0;
 const uschar **argv;
 uschar *s, *ss;
 int address_count = 0;
 int argcount = 0;

-int i, max_args;
+int max_args;

 
 /* Get store in which to build an argument list. Count the number of addresses
 supplied, and allow for that many arguments, plus an additional 60, which
 should be enough for anybody. Multiple addresses happen only when the local
 delivery batch option is set. */
 
 
 /* Get store in which to build an argument list. Count the number of addresses
 supplied, and allow for that many arguments, plus an additional 60, which
 should be enough for anybody. Multiple addresses happen only when the local
 delivery batch option is set. */
 

-for (ad = addr; ad != NULL; ad = ad->next) address_count++;
+for (address_item * ad = addr; ad; ad = ad->next) address_count++;

 max_args = address_count + 60;
 max_args = address_count + 60;

-*argvptr = argv = store_get((max_args+1)*sizeof(uschar *));
+*argvptr = argv = store_get((max_args+1)*sizeof(uschar *), FALSE);

 
 /* Split the command up into arguments terminated by white space. Lose
 trailing space at the start and end. Double-quoted arguments can contain \\ and
 
 /* Split the command up into arguments terminated by white space. Lose
 trailing space at the start and end. Double-quoted arguments can contain \\ and


@@ -2033,18 +2101,19 @@ arguments are verbatim. Copy each argument into a new string. */
 s = cmd;
 while (isspace(*s)) s++;
 
 s = cmd;
 while (isspace(*s)) s++;
 

-while (*s != 0 && argcount < max_args)
+for (; *s != 0 && argcount < max_args; argcount++)

   {
   if (*s == '\'')
     {
     ss = s + 1;
     while (*ss != 0 && *ss != '\'') ss++;
   {
   if (*s == '\'')
     {
     ss = s + 1;
     while (*ss != 0 && *ss != '\'') ss++;

-    argv[argcount++] = ss = store_get(ss - s++);
+    argv[argcount] = ss = store_get(ss - s++, is_tainted(cmd));

     while (*s != 0 && *s != '\'') *ss++ = *s++;
     if (*s != 0) s++;
     *ss++ = 0;
     }
     while (*s != 0 && *s != '\'') *ss++ = *s++;
     if (*s != 0) s++;
     *ss++ = 0;
     }

-  else argv[argcount++] = string_copy(string_dequote(CUSS &s));
+  else
+    argv[argcount] = string_dequote(CUSS &s);

   while (isspace(*s)) s++;
   }
 
   while (isspace(*s)) s++;
   }
 


@@ -2084,8 +2153,8 @@ $recipients. */
 DEBUG(D_transport)
   {
   debug_printf("direct command:\n");
 DEBUG(D_transport)
   {
   debug_printf("direct command:\n");

-  for (i = 0; argv[i] != US 0; i++)
-    debug_printf("  argv[%d] = %s\n", i, string_printing(argv[i]));
+  for (int i = 0; argv[i]; i++)
+    debug_printf("  argv[%d] = '%s'\n", i, string_printing(argv[i]));

   }
 
 if (expand_arguments)
   }
 
 if (expand_arguments)


@@ -2094,7 +2163,7 @@ if (expand_arguments)
     addr->parent != NULL &&
     Ustrcmp(addr->parent->address, "system-filter") == 0;
 
     addr->parent != NULL &&
     Ustrcmp(addr->parent->address, "system-filter") == 0;
 

-  for (i = 0; argv[i] != US 0; i++)
+  for (int i = 0; argv[i] != US 0; i++)

     {
 
     /* Handle special fudge for passing an address list */
     {
 
     /* Handle special fudge for passing an address list */


@@ -2118,10 +2187,11 @@ if (expand_arguments)
         memmove(argv + i + 1 + additional, argv + i + 1,
           (argcount - i)*sizeof(uschar *));
 
         memmove(argv + i + 1 + additional, argv + i + 1,
           (argcount - i)*sizeof(uschar *));
 

-      for (ad = addr; ad != NULL; ad = ad->next) {
-          argv[i++] = ad->address;
-          argcount++;
-      }
+      for (address_item * ad = addr; ad; ad = ad->next)
+        {
+       argv[i++] = ad->address;
+       argcount++;
+       }

 
       /* Subtract one since we replace $pipe_addresses */
       argcount--;
 
       /* Subtract one since we replace $pipe_addresses */
       argcount--;


@@ -2134,10 +2204,10 @@ if (expand_arguments)
         (Ustrcmp(argv[i], "$address_pipe") == 0 ||
          Ustrcmp(argv[i], "${address_pipe}") == 0))
       {
         (Ustrcmp(argv[i], "$address_pipe") == 0 ||
          Ustrcmp(argv[i], "${address_pipe}") == 0))
       {

-      int address_pipe_i;

       int address_pipe_argcount = 0;
       int address_pipe_max_args;
       uschar **address_pipe_argv;
       int address_pipe_argcount = 0;
       int address_pipe_max_args;
       uschar **address_pipe_argv;

+      BOOL tainted;

 
       /* We can never have more then the argv we will be loading into */
       address_pipe_max_args = max_args - argcount + 1;
 
       /* We can never have more then the argv we will be loading into */
       address_pipe_max_args = max_args - argcount + 1;


@@ -2146,10 +2216,11 @@ if (expand_arguments)
         debug_printf("address_pipe_max_args=%d\n", address_pipe_max_args);
 
       /* We allocate an additional for (uschar *)0 */
         debug_printf("address_pipe_max_args=%d\n", address_pipe_max_args);
 
       /* We allocate an additional for (uschar *)0 */

-      address_pipe_argv = store_get((address_pipe_max_args+1)*sizeof(uschar *));
+      address_pipe_argv = store_get((address_pipe_max_args+1)*sizeof(uschar *), FALSE);

 
       /* +1 because addr->local_part[0] == '|' since af_force_command is set */
       s = expand_string(addr->local_part + 1);
 
       /* +1 because addr->local_part[0] == '|' since af_force_command is set */
       s = expand_string(addr->local_part + 1);

+      tainted = is_tainted(s);

 
       if (s == NULL || *s == '\0')
         {
 
       if (s == NULL || *s == '\0')
         {


@@ -2168,7 +2239,7 @@ if (expand_arguments)
           {
           ss = s + 1;
           while (*ss != 0 && *ss != '\'') ss++;
           {
           ss = s + 1;
           while (*ss != 0 && *ss != '\'') ss++;

-          address_pipe_argv[address_pipe_argcount++] = ss = store_get(ss - s++);
+          address_pipe_argv[address_pipe_argcount++] = ss = store_get(ss - s++, tainted);

           while (*s != 0 && *s != '\'') *ss++ = *s++;
           if (*s != 0) s++;
           *ss++ = 0;
           while (*s != 0 && *s != '\'') *ss++ = *s++;
           if (*s != 0) s++;
           *ss++ = 0;


@@ -2206,12 +2277,12 @@ if (expand_arguments)
         }
 
       /* If we are not just able to replace the slot that contained
         }
 
       /* If we are not just able to replace the slot that contained

-       * $address_pipe (address_pipe_argcount == 1)
-       * We have to move the existing argv by address_pipe_argcount - 1
-       * Visually if address_pipe_argcount == 2:
-       * [argv 0][argv 1][argv 2($address_pipe)][argv 3][0]
-       * [argv 0][argv 1][ap_arg0][ap_arg1][old argv 3][0]
-       */
+      $address_pipe (address_pipe_argcount == 1)
+      We have to move the existing argv by address_pipe_argcount - 1
+      Visually if address_pipe_argcount == 2:
+      [argv 0][argv 1][argv 2($address_pipe)][argv 3][0]
+      [argv 0][argv 1][ap_arg0][ap_arg1][old argv 3][0] */
+

       if (address_pipe_argcount > 1)
         memmove(
           /* current position + additional args */
       if (address_pipe_argcount > 1)
         memmove(
           /* current position + additional args */


@@ -2223,15 +2294,12 @@ if (expand_arguments)
         );
 
       /* Now we fill in the slots we just moved argv out of
         );
 
       /* Now we fill in the slots we just moved argv out of

-       * [argv 0][argv 1][argv 2=pipeargv[0]][argv 3=pipeargv[1]][old argv 3][0]
-       */
-      for (address_pipe_i = 0;
+      [argv 0][argv 1][argv 2=pipeargv[0]][argv 3=pipeargv[1]][old argv 3][0] */
+
+      for (int address_pipe_i = 0;

            address_pipe_argv[address_pipe_i] != US 0;
            address_pipe_argv[address_pipe_i] != US 0;

-           address_pipe_i++)
-        {
+           address_pipe_i++, argcount++)

         argv[i++] = address_pipe_argv[address_pipe_i];
         argv[i++] = address_pipe_argv[address_pipe_i];

-        argcount++;
-        }

 
       /* Subtract one since we replace $address_pipe */
       argcount--;
 
       /* Subtract one since we replace $address_pipe */
       argcount--;


@@ -2243,16 +2311,16 @@ if (expand_arguments)
     else
       {
       const uschar *expanded_arg;
     else
       {
       const uschar *expanded_arg;

-      enable_dollar_recipients = allow_dollar_recipients;
+      f.enable_dollar_recipients = allow_dollar_recipients;

       expanded_arg = expand_cstring(argv[i]);
       expanded_arg = expand_cstring(argv[i]);

-      enable_dollar_recipients = FALSE;
+      f.enable_dollar_recipients = FALSE;

 
 

-      if (expanded_arg == NULL)
+      if (!expanded_arg)

         {
         uschar *msg = string_sprintf("Expansion of \"%s\" "
           "from command \"%s\" in %s failed: %s",
           argv[i], cmd, etext, expand_string_message);
         {
         uschar *msg = string_sprintf("Expansion of \"%s\" "
           "from command \"%s\" in %s failed: %s",
           argv[i], cmd, etext, expand_string_message);

-        if (addr != NULL)
+        if (addr)

           {
           addr->transport_return = expand_failed;
           addr->message = msg;
           {
           addr->transport_return = expand_failed;
           addr->message = msg;


@@ -2267,7 +2335,7 @@ if (expand_arguments)
   DEBUG(D_transport)
     {
     debug_printf("direct command after expansion:\n");
   DEBUG(D_transport)
     {
     debug_printf("direct command after expansion:\n");

-    for (i = 0; argv[i] != US 0; i++)
+    for (int i = 0; argv[i] != US 0; i++)

       debug_printf("  argv[%d] = %s\n", i, string_printing(argv[i]));
     }
   }
       debug_printf("  argv[%d] = %s\n", i, string_printing(argv[i]));
     }
   }