1 /*
2  * Copyright (c) 1983 Eric P. Allman
3  * Copyright (c) 1988, 1993
4  *	The Regents of the University of California.  All rights reserved.
5  *
6  * %sccs.include.redist.c%
7  */
8 
9 #ifndef lint
10 static char sccsid[] = "@(#)recipient.c	8.31 (Berkeley) 12/24/93";
11 #endif /* not lint */
12 
13 # include "sendmail.h"
14 # include <pwd.h>
15 
16 /*
17 **  SENDTOLIST -- Designate a send list.
18 **
19 **	The parameter is a comma-separated list of people to send to.
20 **	This routine arranges to send to all of them.
21 **
22 **	Parameters:
23 **		list -- the send list.
24 **		ctladdr -- the address template for the person to
25 **			send to -- effective uid/gid are important.
26 **			This is typically the alias that caused this
27 **			expansion.
28 **		sendq -- a pointer to the head of a queue to put
29 **			these people into.
30 **		e -- the envelope in which to add these recipients.
31 **
32 **	Returns:
33 **		The number of addresses actually on the list.
34 **
35 **	Side Effects:
36 **		none.
37 */
38 
39 # define MAXRCRSN	10
40 
41 sendtolist(list, ctladdr, sendq, e)
42 	char *list;
43 	ADDRESS *ctladdr;
44 	ADDRESS **sendq;
45 	register ENVELOPE *e;
46 {
47 	register char *p;
48 	register ADDRESS *al;	/* list of addresses to send to */
49 	bool firstone;		/* set on first address sent */
50 	char delimiter;		/* the address delimiter */
51 	int naddrs;
52 	char *oldto = e->e_to;
53 
54 	if (list == NULL)
55 	{
56 		syserr("sendtolist: null list");
57 		return 0;
58 	}
59 
60 	if (tTd(25, 1))
61 	{
62 		printf("sendto: %s\n   ctladdr=", list);
63 		printaddr(ctladdr, FALSE);
64 	}
65 
66 	/* heuristic to determine old versus new style addresses */
67 	if (ctladdr == NULL &&
68 	    (strchr(list, ',') != NULL || strchr(list, ';') != NULL ||
69 	     strchr(list, '<') != NULL || strchr(list, '(') != NULL))
70 		e->e_flags &= ~EF_OLDSTYLE;
71 	delimiter = ' ';
72 	if (!bitset(EF_OLDSTYLE, e->e_flags) || ctladdr != NULL)
73 		delimiter = ',';
74 
75 	firstone = TRUE;
76 	al = NULL;
77 	naddrs = 0;
78 
79 	for (p = list; *p != '\0'; )
80 	{
81 		auto char *delimptr;
82 		register ADDRESS *a;
83 
84 		/* parse the address */
85 		while ((isascii(*p) && isspace(*p)) || *p == ',')
86 			p++;
87 		a = parseaddr(p, NULLADDR, RF_COPYALL, delimiter, &delimptr, e);
88 		p = delimptr;
89 		if (a == NULL)
90 			continue;
91 		a->q_next = al;
92 		a->q_alias = ctladdr;
93 
94 		/* see if this should be marked as a primary address */
95 		if (ctladdr == NULL ||
96 		    (firstone && *p == '\0' && bitset(QPRIMARY, ctladdr->q_flags)))
97 			a->q_flags |= QPRIMARY;
98 
99 		if (ctladdr != NULL && sameaddr(ctladdr, a))
100 			ctladdr->q_flags |= QSELFREF;
101 		al = a;
102 		firstone = FALSE;
103 	}
104 
105 	/* arrange to send to everyone on the local send list */
106 	while (al != NULL)
107 	{
108 		register ADDRESS *a = al;
109 
110 		al = a->q_next;
111 		a = recipient(a, sendq, e);
112 
113 		/* arrange to inherit full name */
114 		if (a->q_fullname == NULL && ctladdr != NULL)
115 			a->q_fullname = ctladdr->q_fullname;
116 		naddrs++;
117 	}
118 
119 	e->e_to = oldto;
120 	return (naddrs);
121 }
122 /*
123 **  RECIPIENT -- Designate a message recipient
124 **
125 **	Saves the named person for future mailing.
126 **
127 **	Parameters:
128 **		a -- the (preparsed) address header for the recipient.
129 **		sendq -- a pointer to the head of a queue to put the
130 **			recipient in.  Duplicate supression is done
131 **			in this queue.
132 **		e -- the current envelope.
133 **
134 **	Returns:
135 **		The actual address in the queue.  This will be "a" if
136 **		the address is not a duplicate, else the original address.
137 **
138 **	Side Effects:
139 **		none.
140 */
141 
142 ADDRESS *
143 recipient(a, sendq, e)
144 	register ADDRESS *a;
145 	register ADDRESS **sendq;
146 	register ENVELOPE *e;
147 {
148 	register ADDRESS *q;
149 	ADDRESS **pq;
150 	register struct mailer *m;
151 	register char *p;
152 	bool quoted = FALSE;		/* set if the addr has a quote bit */
153 	int findusercount = 0;
154 	char buf[MAXNAME];		/* unquoted image of the user name */
155 	extern int safefile();
156 
157 	e->e_to = a->q_paddr;
158 	m = a->q_mailer;
159 	errno = 0;
160 	if (tTd(26, 1))
161 	{
162 		printf("\nrecipient: ");
163 		printaddr(a, FALSE);
164 	}
165 
166 	/* if this is primary, add it to the original recipient list */
167 	if (a->q_alias == NULL)
168 	{
169 		if (e->e_origrcpt == NULL)
170 			e->e_origrcpt = a->q_paddr;
171 		else if (e->e_origrcpt != a->q_paddr)
172 			e->e_origrcpt = "";
173 	}
174 
175 	/* break aliasing loops */
176 	if (AliasLevel > MAXRCRSN)
177 	{
178 		usrerr("554 aliasing/forwarding loop broken");
179 		return (a);
180 	}
181 
182 	/*
183 	**  Finish setting up address structure.
184 	*/
185 
186 	/* set the queue timeout */
187 	a->q_timeout = TimeOuts.to_q_return;
188 
189 	/* get unquoted user for file, program or user.name check */
190 	(void) strcpy(buf, a->q_user);
191 	for (p = buf; *p != '\0' && !quoted; p++)
192 	{
193 		if (*p == '\\')
194 			quoted = TRUE;
195 	}
196 	stripquotes(buf);
197 
198 	/* check for direct mailing to restricted mailers */
199 	if (a->q_alias == NULL && m == ProgMailer)
200 	{
201 		a->q_flags |= QBADADDR;
202 		usrerr("550 Cannot mail directly to programs");
203 	}
204 
205 	/*
206 	**  Look up this person in the recipient list.
207 	**	If they are there already, return, otherwise continue.
208 	**	If the list is empty, just add it.  Notice the cute
209 	**	hack to make from addresses suppress things correctly:
210 	**	the QDONTSEND bit will be set in the send list.
211 	**	[Please note: the emphasis is on "hack."]
212 	*/
213 
214 	for (pq = sendq; (q = *pq) != NULL; pq = &q->q_next)
215 	{
216 		if (sameaddr(q, a))
217 		{
218 			if (tTd(26, 1))
219 			{
220 				printf("%s in sendq: ", a->q_paddr);
221 				printaddr(q, FALSE);
222 			}
223 			if (!bitset(QPRIMARY, q->q_flags))
224 			{
225 				if (!bitset(QDONTSEND, a->q_flags))
226 					message("duplicate suppressed");
227 				q->q_flags |= a->q_flags;
228 			}
229 			a = q;
230 			goto testselfdestruct;
231 		}
232 	}
233 
234 	/* add address on list */
235 	*pq = a;
236 	a->q_next = NULL;
237 
238 	/*
239 	**  Alias the name and handle special mailer types.
240 	*/
241 
242   trylocaluser:
243 	if (tTd(29, 7))
244 		printf("at trylocaluser %s\n", a->q_user);
245 
246 	if (bitset(QDONTSEND|QBADADDR|QVERIFIED, a->q_flags))
247 		goto testselfdestruct;
248 
249 	if (m == InclMailer)
250 	{
251 		a->q_flags |= QDONTSEND;
252 		if (a->q_alias == NULL)
253 		{
254 			a->q_flags |= QBADADDR;
255 			usrerr("550 Cannot mail directly to :include:s");
256 		}
257 		else
258 		{
259 			int ret;
260 
261 			message("including file %s", a->q_user);
262 			ret = include(a->q_user, FALSE, a, sendq, e);
263 			if (transienterror(ret))
264 			{
265 #ifdef LOG
266 				if (LogLevel > 2)
267 					syslog(LOG_ERR, "%s: include %s: transient error: %e",
268 						e->e_id, a->q_user, errstring(ret));
269 #endif
270 				a->q_flags |= QQUEUEUP;
271 				usrerr("451 Cannot open %s: %s",
272 					a->q_user, errstring(ret));
273 			}
274 			else if (ret != 0)
275 			{
276 				a->q_flags |= QBADADDR;
277 				usrerr("550 Cannot open %s: %s",
278 					a->q_user, errstring(ret));
279 			}
280 		}
281 	}
282 	else if (m == FileMailer)
283 	{
284 		extern bool writable();
285 
286 		/* check if writable or creatable */
287 		if (a->q_alias == NULL)
288 		{
289 			a->q_flags |= QBADADDR;
290 			usrerr("550 Cannot mail directly to files");
291 		}
292 		else if (!writable(buf, getctladdr(a), SFF_ANYFILE))
293 		{
294 			a->q_flags |= QBADADDR;
295 			giveresponse(EX_CANTCREAT, m, NULL, a->q_alias, e);
296 		}
297 	}
298 
299 	if (m != LocalMailer)
300 	{
301 		if (!bitset(QDONTSEND, a->q_flags))
302 			e->e_nrcpts++;
303 		goto testselfdestruct;
304 	}
305 
306 	/* try aliasing */
307 	alias(a, sendq, e);
308 
309 # ifdef USERDB
310 	/* if not aliased, look it up in the user database */
311 	if (!bitset(QDONTSEND|QNOTREMOTE|QVERIFIED, a->q_flags))
312 	{
313 		extern int udbexpand();
314 
315 		if (udbexpand(a, sendq, e) == EX_TEMPFAIL)
316 		{
317 			a->q_flags |= QQUEUEUP;
318 			if (e->e_message == NULL)
319 				e->e_message = newstr("Deferred: user database error");
320 # ifdef LOG
321 			if (LogLevel > 8)
322 				syslog(LOG_INFO, "%s: deferred: udbexpand: %s",
323 					e->e_id, errstring(errno));
324 # endif
325 			message("queued (user database error): %s",
326 				errstring(errno));
327 			e->e_nrcpts++;
328 			goto testselfdestruct;
329 		}
330 	}
331 # endif
332 
333 	/* if it was an alias or a UDB expansion, just return now */
334 	if (bitset(QDONTSEND|QQUEUEUP|QVERIFIED, a->q_flags))
335 		goto testselfdestruct;
336 
337 	/*
338 	**  If we have a level two config file, then pass the name through
339 	**  Ruleset 5 before sending it off.  Ruleset 5 has the right
340 	**  to send rewrite it to another mailer.  This gives us a hook
341 	**  after local aliasing has been done.
342 	*/
343 
344 	if (tTd(29, 5))
345 	{
346 		printf("recipient: testing local?  cl=%d, rr5=%x\n\t",
347 			ConfigLevel, RewriteRules[5]);
348 		printaddr(a, FALSE);
349 	}
350 	if (!bitset(QNOTREMOTE, a->q_flags) && ConfigLevel >= 2 &&
351 	    RewriteRules[5] != NULL)
352 	{
353 		maplocaluser(a, sendq, e);
354 	}
355 
356 	/*
357 	**  If it didn't get rewritten to another mailer, go ahead
358 	**  and deliver it.
359 	*/
360 
361 	if (!bitset(QDONTSEND|QQUEUEUP, a->q_flags))
362 	{
363 		auto bool fuzzy;
364 		register struct passwd *pw;
365 		extern struct passwd *finduser();
366 
367 		/* warning -- finduser may trash buf */
368 		pw = finduser(buf, &fuzzy);
369 		if (pw == NULL)
370 		{
371 			a->q_flags |= QBADADDR;
372 			giveresponse(EX_NOUSER, m, NULL, a->q_alias, e);
373 		}
374 		else
375 		{
376 			char nbuf[MAXNAME];
377 
378 			if (fuzzy)
379 			{
380 				/* name was a fuzzy match */
381 				a->q_user = newstr(pw->pw_name);
382 				if (findusercount++ > 3)
383 				{
384 					a->q_flags |= QBADADDR;
385 					usrerr("554 aliasing/forwarding loop for %s broken",
386 						pw->pw_name);
387 					return (a);
388 				}
389 
390 				/* see if it aliases */
391 				(void) strcpy(buf, pw->pw_name);
392 				goto trylocaluser;
393 			}
394 			a->q_home = newstr(pw->pw_dir);
395 			a->q_uid = pw->pw_uid;
396 			a->q_gid = pw->pw_gid;
397 			a->q_ruser = newstr(pw->pw_name);
398 			a->q_flags |= QGOODUID;
399 			buildfname(pw->pw_gecos, pw->pw_name, nbuf);
400 			if (nbuf[0] != '\0')
401 				a->q_fullname = newstr(nbuf);
402 #ifndef NEEDGETUSERSHELL
403 			if (pw->pw_shell != NULL && pw->pw_shell[0] != '\0')
404 			{
405 				extern char *getusershell();
406 
407 				setusershell();
408 				while ((p = getusershell()) != NULL)
409 					if (strcmp(p, pw->pw_shell) == 0)
410 						break;
411 				endusershell();
412 				if (p == NULL)
413 					a->q_flags |= QBOGUSSHELL;
414 			}
415 #endif
416 			if (!quoted)
417 				forward(a, sendq, e);
418 		}
419 	}
420 	if (!bitset(QDONTSEND, a->q_flags))
421 		e->e_nrcpts++;
422 
423   testselfdestruct:
424 	if (tTd(26, 8))
425 	{
426 		printf("testselfdestruct: ");
427 		printaddr(a, TRUE);
428 	}
429 	if (a->q_alias == NULL && a != &e->e_from &&
430 	    bitset(QDONTSEND, a->q_flags))
431 	{
432 		q = *sendq;
433 		while (q != NULL && bitset(QDONTSEND, q->q_flags))
434 			q = q->q_next;
435 		if (q == NULL)
436 		{
437 			a->q_flags |= QBADADDR;
438 			usrerr("554 aliasing/forwarding loop broken");
439 		}
440 	}
441 	return (a);
442 }
443 /*
444 **  FINDUSER -- find the password entry for a user.
445 **
446 **	This looks a lot like getpwnam, except that it may want to
447 **	do some fancier pattern matching in /etc/passwd.
448 **
449 **	This routine contains most of the time of many sendmail runs.
450 **	It deserves to be optimized.
451 **
452 **	Parameters:
453 **		name -- the name to match against.
454 **		fuzzyp -- an outarg that is set to TRUE if this entry
455 **			was found using the fuzzy matching algorithm;
456 **			set to FALSE otherwise.
457 **
458 **	Returns:
459 **		A pointer to a pw struct.
460 **		NULL if name is unknown or ambiguous.
461 **
462 **	Side Effects:
463 **		may modify name.
464 */
465 
466 struct passwd *
467 finduser(name, fuzzyp)
468 	char *name;
469 	bool *fuzzyp;
470 {
471 	register struct passwd *pw;
472 	register char *p;
473 	extern struct passwd *getpwent();
474 	extern struct passwd *getpwnam();
475 
476 	if (tTd(29, 4))
477 		printf("finduser(%s): ", name);
478 
479 	*fuzzyp = FALSE;
480 
481 	/* DEC Hesiod getpwnam accepts numeric strings -- short circuit it */
482 	for (p = name; *p != '\0'; p++)
483 		if (!isascii(*p) || !isdigit(*p))
484 			break;
485 	if (*p == '\0')
486 	{
487 		if (tTd(29, 4))
488 			printf("failed (numeric input)\n");
489 		return NULL;
490 	}
491 
492 	/* look up this login name using fast path */
493 	if ((pw = getpwnam(name)) != NULL)
494 	{
495 		if (tTd(29, 4))
496 			printf("found (non-fuzzy)\n");
497 		return (pw);
498 	}
499 
500 #ifdef MATCHGECOS
501 	/* see if fuzzy matching allowed */
502 	if (!MatchGecos)
503 	{
504 		if (tTd(29, 4))
505 			printf("not found (fuzzy disabled)\n");
506 		return NULL;
507 	}
508 
509 	/* search for a matching full name instead */
510 	for (p = name; *p != '\0'; p++)
511 	{
512 		if (*p == (SpaceSub & 0177) || *p == '_')
513 			*p = ' ';
514 	}
515 	(void) setpwent();
516 	while ((pw = getpwent()) != NULL)
517 	{
518 		char buf[MAXNAME];
519 
520 		buildfname(pw->pw_gecos, pw->pw_name, buf);
521 		if (strchr(buf, ' ') != NULL && !strcasecmp(buf, name))
522 		{
523 			if (tTd(29, 4))
524 				printf("fuzzy matches %s\n", pw->pw_name);
525 			message("sending to login name %s", pw->pw_name);
526 			*fuzzyp = TRUE;
527 			return (pw);
528 		}
529 	}
530 	if (tTd(29, 4))
531 		printf("no fuzzy match found\n");
532 #else
533 	if (tTd(29, 4))
534 		printf("not found (fuzzy disabled)\n");
535 #endif
536 	return (NULL);
537 }
538 /*
539 **  WRITABLE -- predicate returning if the file is writable.
540 **
541 **	This routine must duplicate the algorithm in sys/fio.c.
542 **	Unfortunately, we cannot use the access call since we
543 **	won't necessarily be the real uid when we try to
544 **	actually open the file.
545 **
546 **	Notice that ANY file with ANY execute bit is automatically
547 **	not writable.  This is also enforced by mailfile.
548 **
549 **	Parameters:
550 **		filename -- the file name to check.
551 **		ctladdr -- the controlling address for this file.
552 **		flags -- SFF_* flags to control the function.
553 **
554 **	Returns:
555 **		TRUE -- if we will be able to write this file.
556 **		FALSE -- if we cannot write this file.
557 **
558 **	Side Effects:
559 **		none.
560 */
561 
562 bool
563 writable(filename, ctladdr, flags)
564 	char *filename;
565 	ADDRESS *ctladdr;
566 	int flags;
567 {
568 	uid_t euid;
569 	gid_t egid;
570 	int bits;
571 	register char *p;
572 	char *uname;
573 	struct stat stb;
574 	extern char RealUserName[];
575 
576 	if (tTd(29, 5))
577 		printf("writable(%s, %x)\n", filename, flags);
578 
579 #ifdef HASLSTAT
580 	if ((bitset(SFF_NOSLINK, flags) ? lstat(filename, &stb)
581 					: stat(filename, &stb)) < 0)
582 #else
583 	if (stat(filename, &stb) < 0)
584 #endif
585 	{
586 		/* file does not exist -- see if directory is safe */
587 		p = strrchr(filename, '/');
588 		if (p == NULL)
589 		{
590 			errno = ENOTDIR;
591 			return FALSE;
592 		}
593 		*p = '\0';
594 		errno = safefile(filename, RealUid, RealGid, RealUserName,
595 				 SFF_MUSTOWN, S_IWRITE|S_IEXEC);
596 		*p = '/';
597 		return errno == 0;
598 	}
599 
600 	/*
601 	**  File does exist -- check that it is writable.
602 	*/
603 
604 	if (bitset(0111, stb.st_mode))
605 	{
606 		if (tTd(29, 5))
607 			printf("failed (mode %o: x bits)\n", stb.st_mode);
608 		errno = EPERM;
609 		return (FALSE);
610 	}
611 
612 	if (ctladdr != NULL && geteuid() == 0)
613 	{
614 		euid = ctladdr->q_uid;
615 		egid = ctladdr->q_gid;
616 		uname = ctladdr->q_user;
617 	}
618 	else
619 	{
620 		euid = RealUid;
621 		egid = RealGid;
622 		uname = RealUserName;
623 	}
624 	if (euid == 0)
625 	{
626 		euid = DefUid;
627 		uname = DefUser;
628 	}
629 	if (egid == 0)
630 		egid = DefGid;
631 	if (geteuid() == 0)
632 	{
633 #ifdef SUID_ROOT_FILES_OK
634 		if (bitset(S_ISUID, stb.st_mode))
635 #else
636 		if (bitset(S_ISUID, stb.st_mode) && stb.st_uid != 0)
637 #endif
638 		{
639 			flags |= SFF_ROOTOK;
640 			euid = stb.st_uid;
641 			uname = NULL;
642 		}
643 		if (bitset(S_ISGID, stb.st_mode) && stb.st_gid != 0)
644 			egid = stb.st_gid;
645 	}
646 
647 	if (tTd(29, 5))
648 		printf("\teu/gid=%d/%d, st_u/gid=%d/%d\n",
649 			euid, egid, stb.st_uid, stb.st_gid);
650 
651 	errno = safefile(filename, euid, egid, uname, flags, S_IWRITE);
652 	return errno == 0;
653 }
654 /*
655 **  INCLUDE -- handle :include: specification.
656 **
657 **	Parameters:
658 **		fname -- filename to include.
659 **		forwarding -- if TRUE, we are reading a .forward file.
660 **			if FALSE, it's a :include: file.
661 **		ctladdr -- address template to use to fill in these
662 **			addresses -- effective user/group id are
663 **			the important things.
664 **		sendq -- a pointer to the head of the send queue
665 **			to put these addresses in.
666 **
667 **	Returns:
668 **		open error status
669 **
670 **	Side Effects:
671 **		reads the :include: file and sends to everyone
672 **		listed in that file.
673 */
674 
675 static jmp_buf	CtxIncludeTimeout;
676 static int	includetimeout();
677 
678 int
679 include(fname, forwarding, ctladdr, sendq, e)
680 	char *fname;
681 	bool forwarding;
682 	ADDRESS *ctladdr;
683 	ADDRESS **sendq;
684 	ENVELOPE *e;
685 {
686 	register FILE *fp = NULL;
687 	char *oldto = e->e_to;
688 	char *oldfilename = FileName;
689 	int oldlinenumber = LineNumber;
690 	register EVENT *ev = NULL;
691 	int nincludes;
692 	register ADDRESS *ca;
693 	uid_t saveduid, uid;
694 	gid_t savedgid, gid;
695 	char *uname;
696 	int rval = 0;
697 	int sfflags = forwarding ? SFF_MUSTOWN : SFF_ANYFILE;
698 	char buf[MAXLINE];
699 
700 	if (tTd(27, 2))
701 		printf("include(%s)\n", fname);
702 	if (tTd(27, 4))
703 		printf("   ruid=%d euid=%d\n", getuid(), geteuid());
704 	if (tTd(27, 14))
705 	{
706 		printf("ctladdr ");
707 		printaddr(ctladdr, FALSE);
708 	}
709 
710 	if (tTd(27, 9))
711 		printf("include: old uid = %d/%d\n", getuid(), geteuid());
712 
713 	ca = getctladdr(ctladdr);
714 	if (ca == NULL)
715 	{
716 		uid = DefUid;
717 		gid = DefGid;
718 		uname = DefUser;
719 		saveduid = -1;
720 	}
721 	else
722 	{
723 		uid = ca->q_uid;
724 		gid = ca->q_gid;
725 		uname = ca->q_user;
726 #ifdef HASSETREUID
727 		saveduid = geteuid();
728 		savedgid = getegid();
729 		if (saveduid == 0)
730 		{
731 			initgroups(uname, gid);
732 			if (uid != 0)
733 				(void) setreuid(0, uid);
734 		}
735 #endif
736 	}
737 
738 	if (tTd(27, 9))
739 		printf("include: new uid = %d/%d\n", getuid(), geteuid());
740 
741 	/*
742 	**  If home directory is remote mounted but server is down,
743 	**  this can hang or give errors; use a timeout to avoid this
744 	*/
745 
746 	if (setjmp(CtxIncludeTimeout) != 0)
747 	{
748 		ctladdr->q_flags |= QQUEUEUP;
749 		errno = 0;
750 		usrerr("451 open timeout on %s", fname);
751 
752 		/* return pseudo-error code */
753 		rval = EOPENTIMEOUT;
754 		goto resetuid;
755 	}
756 	ev = setevent((time_t) 60, includetimeout, 0);
757 
758 	/* the input file must be marked safe */
759 	rval = safefile(fname, uid, gid, uname, sfflags, S_IREAD);
760 	if (rval != 0)
761 	{
762 		/* don't use this :include: file */
763 		clrevent(ev);
764 		if (tTd(27, 4))
765 			printf("include: not safe (uid=%d): %s\n",
766 				uid, errstring(rval));
767 		goto resetuid;
768 	}
769 
770 	fp = fopen(fname, "r");
771 	if (fp == NULL)
772 	{
773 		rval = errno;
774 		if (tTd(27, 4))
775 			printf("include: open: %s\n", errstring(rval));
776 	}
777 	else if (ca == NULL)
778 	{
779 		struct stat st;
780 
781 		if (fstat(fileno(fp), &st) < 0)
782 		{
783 			rval = errno;
784 			syserr("Cannot fstat %s!", fname);
785 		}
786 		else
787 		{
788 			ctladdr->q_uid = st.st_uid;
789 			ctladdr->q_gid = st.st_gid;
790 			ctladdr->q_flags |= QGOODUID;
791 		}
792 	}
793 
794 	clrevent(ev);
795 
796 resetuid:
797 
798 #ifdef HASSETREUID
799 	if (saveduid == 0)
800 	{
801 		if (uid != 0)
802 			if (setreuid(-1, 0) < 0 || setreuid(RealUid, 0) < 0)
803 				syserr("setreuid(%d, 0) failure (real=%d, eff=%d)",
804 					RealUid, getuid(), geteuid());
805 		setgid(savedgid);
806 	}
807 #endif
808 
809 	if (tTd(27, 9))
810 		printf("include: reset uid = %d/%d\n", getuid(), geteuid());
811 
812 	if (fp == NULL)
813 		return rval;
814 
815 	if (bitset(EF_VRFYONLY, e->e_flags))
816 	{
817 		/* don't do any more now */
818 		ctladdr->q_flags |= QVERIFIED;
819 		e->e_nrcpts++;
820 		xfclose(fp, "include", fname);
821 		return rval;
822 	}
823 
824 	/* read the file -- each line is a comma-separated list. */
825 	FileName = fname;
826 	LineNumber = 0;
827 	ctladdr->q_flags &= ~QSELFREF;
828 	nincludes = 0;
829 	while (fgets(buf, sizeof buf, fp) != NULL)
830 	{
831 		register char *p = strchr(buf, '\n');
832 
833 		LineNumber++;
834 		if (p != NULL)
835 			*p = '\0';
836 		if (buf[0] == '#' || buf[0] == '\0')
837 			continue;
838 		e->e_to = NULL;
839 		message("%s to %s",
840 			forwarding ? "forwarding" : "sending", buf);
841 #ifdef LOG
842 		if (forwarding && LogLevel > 9)
843 			syslog(LOG_INFO, "%s: forward %s => %s",
844 				e->e_id, oldto, buf);
845 #endif
846 
847 		AliasLevel++;
848 		nincludes += sendtolist(buf, ctladdr, sendq, e);
849 		AliasLevel--;
850 	}
851 
852 	if (ferror(fp) && tTd(27, 3))
853 		printf("include: read error: %s\n", errstring(errno));
854 	if (nincludes > 0 && !bitset(QSELFREF, ctladdr->q_flags))
855 	{
856 		if (tTd(27, 5))
857 		{
858 			printf("include: QDONTSEND ");
859 			printaddr(ctladdr, FALSE);
860 		}
861 		ctladdr->q_flags |= QDONTSEND;
862 	}
863 
864 	(void) xfclose(fp, "include", fname);
865 	FileName = oldfilename;
866 	LineNumber = oldlinenumber;
867 	e->e_to = oldto;
868 	return rval;
869 }
870 
871 static
872 includetimeout()
873 {
874 	longjmp(CtxIncludeTimeout, 1);
875 }
876 /*
877 **  SENDTOARGV -- send to an argument vector.
878 **
879 **	Parameters:
880 **		argv -- argument vector to send to.
881 **		e -- the current envelope.
882 **
883 **	Returns:
884 **		none.
885 **
886 **	Side Effects:
887 **		puts all addresses on the argument vector onto the
888 **			send queue.
889 */
890 
891 sendtoargv(argv, e)
892 	register char **argv;
893 	register ENVELOPE *e;
894 {
895 	register char *p;
896 
897 	while ((p = *argv++) != NULL)
898 	{
899 		(void) sendtolist(p, NULLADDR, &e->e_sendqueue, e);
900 	}
901 }
902 /*
903 **  GETCTLADDR -- get controlling address from an address header.
904 **
905 **	If none, get one corresponding to the effective userid.
906 **
907 **	Parameters:
908 **		a -- the address to find the controller of.
909 **
910 **	Returns:
911 **		the controlling address.
912 **
913 **	Side Effects:
914 **		none.
915 */
916 
917 ADDRESS *
918 getctladdr(a)
919 	register ADDRESS *a;
920 {
921 	while (a != NULL && !bitset(QGOODUID, a->q_flags))
922 		a = a->q_alias;
923 	return (a);
924 }
925