1 /* $NetBSD: pickup.c,v 1.4 2022/10/08 16:12:46 christos Exp $ */
2
3 /*++
4 /* NAME
5 /* pickup 8
6 /* SUMMARY
7 /* Postfix local mail pickup
8 /* SYNOPSIS
9 /* \fBpickup\fR [generic Postfix daemon options]
10 /* DESCRIPTION
11 /* The \fBpickup\fR(8) daemon waits for hints that new mail has been
12 /* dropped into the \fBmaildrop\fR directory, and feeds it into the
13 /* \fBcleanup\fR(8) daemon.
14 /* Ill-formatted files are deleted without notifying the originator.
15 /* This program expects to be run from the \fBmaster\fR(8) process
16 /* manager.
17 /* STANDARDS
18 /* .ad
19 /* .fi
20 /* None. The \fBpickup\fR(8) daemon does not interact with
21 /* the outside world.
22 /* SECURITY
23 /* .ad
24 /* .fi
25 /* The \fBpickup\fR(8) daemon is moderately security sensitive. It runs
26 /* with fixed low privilege and can run in a chrooted environment.
27 /* However, the program reads files from potentially hostile users.
28 /* The \fBpickup\fR(8) daemon opens no files for writing, is careful about
29 /* what files it opens for reading, and does not actually touch any data
30 /* that is sent to its public service endpoint.
31 /* DIAGNOSTICS
32 /* Problems and transactions are logged to \fBsyslogd\fR(8)
33 /* or \fBpostlogd\fR(8).
34 /* BUGS
35 /* The \fBpickup\fR(8) daemon copies mail from file to the \fBcleanup\fR(8)
36 /* daemon. It could avoid message copying overhead by sending a file
37 /* descriptor instead of file data, but then the already complex
38 /* \fBcleanup\fR(8) daemon would have to deal with unfiltered user data.
39 /* CONFIGURATION PARAMETERS
40 /* .ad
41 /* .fi
42 /* As the \fBpickup\fR(8) daemon is a relatively long-running process, up
43 /* to an hour may pass before a \fBmain.cf\fR change takes effect.
44 /* Use the command "\fBpostfix reload\fR" command to speed up a change.
45 /*
46 /* The text below provides only a parameter summary. See
47 /* \fBpostconf\fR(5) for more details including examples.
48 /* CONTENT INSPECTION CONTROLS
49 /* .ad
50 /* .fi
51 /* .IP "\fBcontent_filter (empty)\fR"
52 /* After the message is queued, send the entire message to the
53 /* specified \fItransport:destination\fR.
54 /* .IP "\fBreceive_override_options (empty)\fR"
55 /* Enable or disable recipient validation, built-in content
56 /* filtering, or address mapping.
57 /* MISCELLANEOUS CONTROLS
58 /* .ad
59 /* .fi
60 /* .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
61 /* The default location of the Postfix main.cf and master.cf
62 /* configuration files.
63 /* .IP "\fBipc_timeout (3600s)\fR"
64 /* The time limit for sending or receiving information over an internal
65 /* communication channel.
66 /* .IP "\fBline_length_limit (2048)\fR"
67 /* Upon input, long lines are chopped up into pieces of at most
68 /* this length; upon delivery, long lines are reconstructed.
69 /* .IP "\fBmax_idle (100s)\fR"
70 /* The maximum amount of time that an idle Postfix daemon process waits
71 /* for an incoming connection before terminating voluntarily.
72 /* .IP "\fBmax_use (100)\fR"
73 /* The maximal number of incoming connections that a Postfix daemon
74 /* process will service before terminating voluntarily.
75 /* .IP "\fBprocess_id (read-only)\fR"
76 /* The process ID of a Postfix command or daemon process.
77 /* .IP "\fBprocess_name (read-only)\fR"
78 /* The process name of a Postfix command or daemon process.
79 /* .IP "\fBqueue_directory (see 'postconf -d' output)\fR"
80 /* The location of the Postfix top-level queue directory.
81 /* .IP "\fBsyslog_facility (mail)\fR"
82 /* The syslog facility of Postfix logging.
83 /* .IP "\fBsyslog_name (see 'postconf -d' output)\fR"
84 /* A prefix that is prepended to the process name in syslog
85 /* records, so that, for example, "smtpd" becomes "prefix/smtpd".
86 /* .PP
87 /* Available in Postfix 3.3 and later:
88 /* .IP "\fBservice_name (read-only)\fR"
89 /* The master.cf service name of a Postfix daemon process.
90 /* .PP
91 /* Available in Postfix 3.5 and later:
92 /* .IP "\fBinfo_log_address_format (external)\fR"
93 /* The email address form that will be used in non-debug logging
94 /* (info, warning, etc.).
95 /* SEE ALSO
96 /* cleanup(8), message canonicalization
97 /* sendmail(1), Sendmail-compatible interface
98 /* postdrop(1), mail posting agent
99 /* postconf(5), configuration parameters
100 /* master(5), generic daemon options
101 /* master(8), process manager
102 /* postlogd(8), Postfix logging
103 /* syslogd(8), system logging
104 /* LICENSE
105 /* .ad
106 /* .fi
107 /* The Secure Mailer license must be distributed with this software.
108 /* AUTHOR(S)
109 /* Wietse Venema
110 /* IBM T.J. Watson Research
111 /* P.O. Box 704
112 /* Yorktown Heights, NY 10598, USA
113 /*
114 /* Wietse Venema
115 /* Google, Inc.
116 /* 111 8th Avenue
117 /* New York, NY 10011, USA
118 /*--*/
119
120 /* System library. */
121
122 #include <sys_defs.h>
123 #include <sys/stat.h>
124 #include <dirent.h>
125 #include <unistd.h>
126 #include <stdlib.h>
127 #include <time.h>
128 #include <string.h>
129 #include <fcntl.h>
130 #include <errno.h>
131 #include <ctype.h>
132
133 /* Utility library. */
134
135 #include <msg.h>
136 #include <scan_dir.h>
137 #include <vstring.h>
138 #include <vstream.h>
139 #include <set_ugid.h>
140 #include <safe_open.h>
141 #include <watchdog.h>
142 #include <stringops.h>
143
144 /* Global library. */
145
146 #include <mail_queue.h>
147 #include <mail_open_ok.h>
148 #include <mymalloc.h>
149 #include <mail_proto.h>
150 #include <cleanup_user.h>
151 #include <mail_date.h>
152 #include <mail_params.h>
153 #include <mail_conf.h>
154 #include <record.h>
155 #include <rec_type.h>
156 #include <lex_822.h>
157 #include <input_transp.h>
158 #include <rec_attr_map.h>
159 #include <mail_version.h>
160 #include <smtputf8.h>
161 #include <info_log_addr_form.h>
162
163 /* Single-threaded server skeleton. */
164
165 #include <mail_server.h>
166
167 /* Application-specific. */
168
169 char *var_filter_xport;
170 char *var_input_transp;
171
172 /*
173 * Structure to bundle a bunch of information about a queue file.
174 */
175 typedef struct {
176 char *id; /* queue file basename */
177 struct stat st; /* queue file status */
178 char *path; /* name for open/remove */
179 char *sender; /* sender address */
180 } PICKUP_INFO;
181
182 /*
183 * What action should be taken after attempting to deliver a message: remove
184 * the file from the maildrop, or leave it alone. The latter is also used
185 * for files that are still being written to.
186 */
187 #define REMOVE_MESSAGE_FILE 1
188 #define KEEP_MESSAGE_FILE 2
189
190 /*
191 * Transparency: before mail is queued, do we allow address mapping,
192 * automatic bcc, header/body checks?
193 */
194 int pickup_input_transp_mask;
195
196 /* file_read_error - handle error while reading queue file */
197
file_read_error(PICKUP_INFO * info,int type)198 static int file_read_error(PICKUP_INFO *info, int type)
199 {
200 msg_warn("uid=%ld: unexpected or malformed record type %d",
201 (long) info->st.st_uid, type);
202 return (REMOVE_MESSAGE_FILE);
203 }
204
205 /* cleanup_service_error_reason - handle error writing to cleanup service. */
206
cleanup_service_error_reason(PICKUP_INFO * info,int status,const char * reason)207 static int cleanup_service_error_reason(PICKUP_INFO *info, int status,
208 const char *reason)
209 {
210
211 /*
212 * XXX If the cleanup server gave a reason, then it was already logged.
213 * Don't bother logging it another time.
214 *
215 * XXX Discard a message without recipient. This can happen with "postsuper
216 * -r" when a message is already delivered (or bounced). The Postfix
217 * sendmail command rejects submissions without recipients.
218 */
219 if (reason == 0 || *reason == 0)
220 msg_warn("%s: error writing %s: %s",
221 info->path, info->id, cleanup_strerror(status));
222 return ((status & (CLEANUP_STAT_BAD | CLEANUP_STAT_RCPT)) ?
223 REMOVE_MESSAGE_FILE : KEEP_MESSAGE_FILE);
224 }
225
226 #define cleanup_service_error(info, status) \
227 cleanup_service_error_reason((info), (status), (char *) 0)
228
229 /* copy_segment - copy a record group */
230
copy_segment(VSTREAM * qfile,VSTREAM * cleanup,PICKUP_INFO * info,VSTRING * buf,char * expected)231 static int copy_segment(VSTREAM *qfile, VSTREAM *cleanup, PICKUP_INFO *info,
232 VSTRING *buf, char *expected)
233 {
234 int type;
235 int check_first = (*expected == REC_TYPE_CONTENT[0]);
236 int time_seen = 0;
237 char *attr_name;
238 char *attr_value;
239 char *saved_attr;
240 int skip_attr;
241
242 /*
243 * Limit the input record size. All front-end programs should protect the
244 * mail system against unreasonable inputs. This also requires that we
245 * limit the size of envelope records written by the local posting agent.
246 *
247 * Records with named attributes are filtered by postdrop(1).
248 *
249 * We must allow PTR records here because of "postsuper -r".
250 */
251 for (;;) {
252 if ((type = rec_get(qfile, buf, var_line_limit)) < 0
253 || strchr(expected, type) == 0)
254 return (file_read_error(info, type));
255 if (msg_verbose)
256 msg_info("%s: read %c %s", info->id, type, vstring_str(buf));
257 if (type == *expected)
258 break;
259 if (type == REC_TYPE_FROM) {
260 if (info->sender == 0)
261 info->sender = mystrdup(vstring_str(buf));
262 /* Compatibility with Postfix < 2.3. */
263 if (time_seen == 0)
264 rec_fprintf(cleanup, REC_TYPE_TIME, "%ld",
265 (long) info->st.st_mtime);
266 }
267 if (type == REC_TYPE_TIME)
268 time_seen = 1;
269
270 /*
271 * XXX Workaround: REC_TYPE_FILT (used in envelopes) == REC_TYPE_CONT
272 * (used in message content).
273 *
274 * As documented in postsuper(1), ignore content filter record.
275 */
276 if (*expected != REC_TYPE_CONTENT[0]) {
277 if (type == REC_TYPE_FILT)
278 /* Discard FILTER record after "postsuper -r". */
279 continue;
280 if (type == REC_TYPE_RDR)
281 /* Discard REDIRECT record after "postsuper -r". */
282 continue;
283 }
284 if (*expected == REC_TYPE_EXTRACT[0]) {
285 if (type == REC_TYPE_RRTO)
286 /* Discard return-receipt record after "postsuper -r". */
287 continue;
288 if (type == REC_TYPE_ERTO)
289 /* Discard errors-to record after "postsuper -r". */
290 continue;
291 if (type == REC_TYPE_ATTR) {
292 saved_attr = mystrdup(vstring_str(buf));
293 skip_attr = (split_nameval(saved_attr,
294 &attr_name, &attr_value) == 0
295 && rec_attr_map(attr_name) == 0);
296 myfree(saved_attr);
297 /* Discard other/header/body action after "postsuper -r". */
298 if (skip_attr)
299 continue;
300 }
301 }
302
303 /*
304 * XXX Force an empty record when the queue file content begins with
305 * whitespace, so that it won't be considered as being part of our
306 * own Received: header. What an ugly Kluge.
307 */
308 if (check_first
309 && (type == REC_TYPE_NORM || type == REC_TYPE_CONT)) {
310 check_first = 0;
311 if (VSTRING_LEN(buf) > 0 && IS_SPACE_TAB(vstring_str(buf)[0]))
312 rec_put(cleanup, REC_TYPE_NORM, "", 0);
313 }
314 if ((REC_PUT_BUF(cleanup, type, buf)) < 0)
315 return (cleanup_service_error(info, CLEANUP_STAT_WRITE));
316 }
317 return (0);
318 }
319
320 /* pickup_copy - copy message to cleanup service */
321
pickup_copy(VSTREAM * qfile,VSTREAM * cleanup,PICKUP_INFO * info,VSTRING * buf)322 static int pickup_copy(VSTREAM *qfile, VSTREAM *cleanup,
323 PICKUP_INFO *info, VSTRING *buf)
324 {
325 time_t now = time((time_t *) 0);
326 int status;
327 char *name;
328
329 /*
330 * Protect against time-warped time stamps. Warn about mail that has been
331 * queued for an excessive amount of time. Allow for some time drift with
332 * network clients that mount the maildrop remotely - especially clients
333 * that can't get their daylight savings offsets right.
334 */
335 #define DAY_SECONDS 86400
336 #define HOUR_SECONDS 3600
337
338 if (info->st.st_mtime > now + 2 * HOUR_SECONDS) {
339 msg_warn("%s: message dated %ld seconds into the future",
340 info->id, (long) (info->st.st_mtime - now));
341 info->st.st_mtime = now;
342 } else if (info->st.st_mtime < now - DAY_SECONDS) {
343 msg_warn("%s: message has been queued for %d days",
344 info->id, (int) ((now - info->st.st_mtime) / DAY_SECONDS));
345 }
346
347 /*
348 * Add content inspection transport. See also postsuper(1).
349 */
350 if (*var_filter_xport)
351 rec_fprintf(cleanup, REC_TYPE_FILT, "%s", var_filter_xport);
352
353 /*
354 * Copy the message envelope segment. Allow only those records that we
355 * expect to see in the envelope section. The envelope segment must
356 * contain an envelope sender address.
357 */
358 if ((status = copy_segment(qfile, cleanup, info, buf, REC_TYPE_ENVELOPE)) != 0)
359 return (status);
360 if (info->sender == 0) {
361 msg_warn("%s: uid=%ld: no envelope sender",
362 info->id, (long) info->st.st_uid);
363 return (REMOVE_MESSAGE_FILE);
364 }
365
366 /*
367 * For messages belonging to $mail_owner also log the maildrop queue id.
368 * This supports message tracking for mail requeued via "postsuper -r".
369 */
370 #define MAIL_IS_REQUEUED(info) \
371 ((info)->st.st_uid == var_owner_uid && ((info)->st.st_mode & S_IROTH) == 0)
372
373 if (MAIL_IS_REQUEUED(info)) {
374 msg_info("%s: uid=%d from=<%s> orig_id=%s", info->id,
375 (int) info->st.st_uid, info_log_addr_form_sender(info->sender),
376 ((name = strrchr(info->path, '/')) != 0 ?
377 name + 1 : info->path));
378 } else {
379 msg_info("%s: uid=%d from=<%s>", info->id,
380 (int) info->st.st_uid, info_log_addr_form_sender(info->sender));
381 }
382
383 /*
384 * Message content segment. Send a dummy message length. Prepend a
385 * Received: header to the message contents. For tracing purposes,
386 * include the message file ownership, without revealing the login name.
387 */
388 rec_fputs(cleanup, REC_TYPE_MESG, "");
389 rec_fprintf(cleanup, REC_TYPE_NORM, "Received: by %s (%s, from userid %ld)",
390 var_myhostname, var_mail_name, (long) info->st.st_uid);
391 rec_fprintf(cleanup, REC_TYPE_NORM, "\tid %s; %s", info->id,
392 mail_date(info->st.st_mtime));
393
394 /*
395 * Copy the message content segment. Allow only those records that we
396 * expect to see in the message content section.
397 */
398 if ((status = copy_segment(qfile, cleanup, info, buf, REC_TYPE_CONTENT)) != 0)
399 return (status);
400
401 /*
402 * Send the segment with information extracted from message headers.
403 * Permit a non-empty extracted segment, so that list manager software
404 * can to output recipients after the message, and so that sysadmins can
405 * re-inject messages after a change of configuration.
406 */
407 rec_fputs(cleanup, REC_TYPE_XTRA, "");
408 if ((status = copy_segment(qfile, cleanup, info, buf, REC_TYPE_EXTRACT)) != 0)
409 return (status);
410
411 /*
412 * There are no errors. Send the end-of-data marker, and get the cleanup
413 * service completion status. XXX Since the pickup service is unable to
414 * bounce, the cleanup service can report only soft errors here.
415 */
416 rec_fputs(cleanup, REC_TYPE_END, "");
417 if (attr_scan(cleanup, ATTR_FLAG_MISSING,
418 RECV_ATTR_INT(MAIL_ATTR_STATUS, &status),
419 RECV_ATTR_STR(MAIL_ATTR_WHY, buf),
420 ATTR_TYPE_END) != 2)
421 return (cleanup_service_error(info, CLEANUP_STAT_WRITE));
422
423 /*
424 * Depending on the cleanup service completion status, delete the message
425 * file, or try again later. Bounces are dealt with by the cleanup
426 * service itself. The master process wakes up the cleanup service every
427 * now and then.
428 */
429 if (status) {
430 return (cleanup_service_error_reason(info, status, vstring_str(buf)));
431 } else {
432 return (REMOVE_MESSAGE_FILE);
433 }
434 }
435
436 /* pickup_file - initialize for file copy and cleanup */
437
pickup_file(PICKUP_INFO * info)438 static int pickup_file(PICKUP_INFO *info)
439 {
440 VSTRING *buf = vstring_alloc(100);
441 int status;
442 VSTREAM *qfile;
443 VSTREAM *cleanup;
444 int cleanup_flags;
445
446 /*
447 * Open the submitted file. If we cannot open it, and we're not having a
448 * file descriptor leak problem, delete the submitted file, so that we
449 * won't keep complaining about the same file again and again. XXX
450 * Perhaps we should save "bad" files elsewhere for further inspection.
451 * XXX How can we delete a file when open() fails with ENOENT?
452 */
453 qfile = safe_open(info->path, O_RDONLY | O_NONBLOCK, 0,
454 (struct stat *) 0, -1, -1, buf);
455 if (qfile == 0) {
456 if (errno != ENOENT)
457 msg_warn("open input file %s: %s", info->path, vstring_str(buf));
458 vstring_free(buf);
459 if (errno == EACCES)
460 msg_warn("if this file was created by Postfix < 1.1, then you may have to chmod a+r %s/%s",
461 var_queue_dir, info->path);
462 return (errno == EACCES ? KEEP_MESSAGE_FILE : REMOVE_MESSAGE_FILE);
463 }
464
465 /*
466 * Contact the cleanup service and read the queue ID that it has
467 * allocated. In case of trouble, request that the cleanup service
468 * bounces its copy of the message. because the original input file is
469 * not readable by the bounce service.
470 *
471 * If mail is re-injected with "postsuper -r", disable Milter applications.
472 * If they were run before the mail was queued then there is no need to
473 * run them again. Moreover, the queue file does not contain enough
474 * information to reproduce the exact same SMTP events and Sendmail
475 * macros that Milters received when the mail originally arrived in
476 * Postfix.
477 *
478 * The actual message copying code is in a separate routine, so that it is
479 * easier to implement the many possible error exits without forgetting
480 * to close files, or to release memory.
481 */
482 cleanup_flags =
483 input_transp_cleanup(CLEANUP_FLAG_BOUNCE | CLEANUP_FLAG_MASK_EXTERNAL,
484 pickup_input_transp_mask);
485 /* As documented in postsuper(1). */
486 if (MAIL_IS_REQUEUED(info))
487 cleanup_flags &= ~CLEANUP_FLAG_MILTER;
488 else
489 cleanup_flags |= smtputf8_autodetect(MAIL_SRC_MASK_SENDMAIL);
490
491 cleanup = mail_connect_wait(MAIL_CLASS_PUBLIC, var_cleanup_service);
492 if (attr_scan(cleanup, ATTR_FLAG_STRICT,
493 RECV_ATTR_STREQ(MAIL_ATTR_PROTO, MAIL_ATTR_PROTO_CLEANUP),
494 RECV_ATTR_STR(MAIL_ATTR_QUEUEID, buf),
495 ATTR_TYPE_END) != 1
496 || attr_print(cleanup, ATTR_FLAG_NONE,
497 SEND_ATTR_INT(MAIL_ATTR_FLAGS, cleanup_flags),
498 ATTR_TYPE_END) != 0) {
499 status = KEEP_MESSAGE_FILE;
500 } else {
501 info->id = mystrdup(vstring_str(buf));
502 status = pickup_copy(qfile, cleanup, info, buf);
503 }
504 vstream_fclose(qfile);
505 vstream_fclose(cleanup);
506 vstring_free(buf);
507 return (status);
508 }
509
510 /* pickup_init - init info structure */
511
pickup_init(PICKUP_INFO * info)512 static void pickup_init(PICKUP_INFO *info)
513 {
514 info->id = 0;
515 info->path = 0;
516 info->sender = 0;
517 }
518
519 /* pickup_free - wipe info structure */
520
pickup_free(PICKUP_INFO * info)521 static void pickup_free(PICKUP_INFO *info)
522 {
523 #define SAFE_FREE(x) { if (x) myfree(x); }
524
525 SAFE_FREE(info->id);
526 SAFE_FREE(info->path);
527 SAFE_FREE(info->sender);
528 }
529
530 /* pickup_service - service client */
531
pickup_service(char * unused_buf,ssize_t unused_len,char * unused_service,char ** argv)532 static void pickup_service(char *unused_buf, ssize_t unused_len,
533 char *unused_service, char **argv)
534 {
535 SCAN_DIR *scan;
536 char *queue_name;
537 PICKUP_INFO info;
538 const char *path;
539 char *id;
540 int file_count;
541
542 /*
543 * Sanity check. This service takes no command-line arguments.
544 */
545 if (argv[0])
546 msg_fatal("unexpected command-line argument: %s", argv[0]);
547
548 /*
549 * Skip over things that we don't want to open, such as files that are
550 * still being written, or garbage. Leave it up to the sysadmin to remove
551 * garbage. Keep scanning the queue directory until we stop removing
552 * files from it.
553 *
554 * When we find a file, stroke the watchdog so that it will not bark while
555 * some application is keeping us busy by injecting lots of mail into the
556 * maildrop directory.
557 */
558 queue_name = MAIL_QUEUE_MAILDROP; /* XXX should be a list */
559 do {
560 file_count = 0;
561 scan = scan_dir_open(queue_name);
562 while ((id = scan_dir_next(scan)) != 0) {
563 if (mail_open_ok(queue_name, id, &info.st, &path) == MAIL_OPEN_YES) {
564 pickup_init(&info);
565 info.path = mystrdup(path);
566 watchdog_pat();
567 if (pickup_file(&info) == REMOVE_MESSAGE_FILE) {
568 if (REMOVE(info.path))
569 msg_warn("remove %s: %m", info.path);
570 else
571 file_count++;
572 }
573 pickup_free(&info);
574 }
575 }
576 scan_dir_close(scan);
577 } while (file_count);
578 }
579
580 /* post_jail_init - drop privileges */
581
post_jail_init(char * unused_name,char ** unused_argv)582 static void post_jail_init(char *unused_name, char **unused_argv)
583 {
584
585 /*
586 * In case master.cf was not updated for unprivileged service.
587 */
588 if (getuid() != var_owner_uid)
589 set_ugid(var_owner_uid, var_owner_gid);
590
591 /*
592 * Initialize the receive transparency options: do we want unknown
593 * recipient checks, do we want address mapping.
594 */
595 pickup_input_transp_mask =
596 input_transp_mask(VAR_INPUT_TRANSP, var_input_transp);
597 }
598
599 MAIL_VERSION_STAMP_DECLARE;
600
601 /* main - pass control to the multi-threaded server skeleton */
602
main(int argc,char ** argv)603 int main(int argc, char **argv)
604 {
605 static const CONFIG_STR_TABLE str_table[] = {
606 VAR_FILTER_XPORT, DEF_FILTER_XPORT, &var_filter_xport, 0, 0,
607 VAR_INPUT_TRANSP, DEF_INPUT_TRANSP, &var_input_transp, 0, 0,
608 0,
609 };
610
611 /*
612 * Fingerprint executables and core dumps.
613 */
614 MAIL_VERSION_STAMP_ALLOCATE;
615
616 /*
617 * Use the multi-threaded skeleton, because no-one else should be
618 * monitoring our service socket while this process runs.
619 *
620 * XXX The default watchdog timeout for trigger servers is 1000s, while the
621 * cleanup server watchdog timeout is $daemon_timeout (i.e. several
622 * hours). We override the default 1000s timeout to avoid problems with
623 * slow mail submission. The real problem is of course that the
624 * single-threaded pickup server is not a good solution for mail
625 * submissions.
626 */
627 trigger_server_main(argc, argv, pickup_service,
628 CA_MAIL_SERVER_STR_TABLE(str_table),
629 CA_MAIL_SERVER_POST_INIT(post_jail_init),
630 CA_MAIL_SERVER_SOLITARY,
631 CA_MAIL_SERVER_WATCHDOG(&var_daemon_timeout),
632 0);
633 }
634