xref: /netbsd-src/external/ibm-public/postfix/dist/src/qmgr/qmgr.c (revision 75f6d617e282811cb173c2ccfbf5df0dd71f7045)
1 /*	$NetBSD: qmgr.c,v 1.1.1.5 2014/07/06 19:27:55 tron Exp $	*/
2 
3 /*++
4 /* NAME
5 /*	qmgr 8
6 /* SUMMARY
7 /*	Postfix queue manager
8 /* SYNOPSIS
9 /*	\fBqmgr\fR [generic Postfix daemon options]
10 /* DESCRIPTION
11 /*	The \fBqmgr\fR(8) daemon awaits the arrival of incoming mail
12 /*	and arranges for its delivery via Postfix delivery processes.
13 /*	The actual mail routing strategy is delegated to the
14 /*	\fBtrivial-rewrite\fR(8) daemon.
15 /*	This program expects to be run from the \fBmaster\fR(8) process
16 /*	manager.
17 /*
18 /*	Mail addressed to the local \fBdouble-bounce\fR address is
19 /*	logged and discarded.  This stops potential loops caused by
20 /*	undeliverable bounce notifications.
21 /* MAIL QUEUES
22 /* .ad
23 /* .fi
24 /*	The \fBqmgr\fR(8) daemon maintains the following queues:
25 /* .IP \fBincoming\fR
26 /*	Inbound mail from the network, or mail picked up by the
27 /*	local \fBpickup\fR(8) daemon from the \fBmaildrop\fR directory.
28 /* .IP \fBactive\fR
29 /*	Messages that the queue manager has opened for delivery. Only
30 /*	a limited number of messages is allowed to enter the \fBactive\fR
31 /*	queue (leaky bucket strategy, for a fixed delivery rate).
32 /* .IP \fBdeferred\fR
33 /*	Mail that could not be delivered upon the first attempt. The queue
34 /*	manager implements exponential backoff by doubling the time between
35 /*	delivery attempts.
36 /* .IP \fBcorrupt\fR
37 /*	Unreadable or damaged queue files are moved here for inspection.
38 /* .IP \fBhold\fR
39 /*	Messages that are kept "on hold" are kept here until someone
40 /*	sets them free.
41 /* DELIVERY STATUS REPORTS
42 /* .ad
43 /* .fi
44 /*	The \fBqmgr\fR(8) daemon keeps an eye on per-message delivery status
45 /*	reports in the following directories. Each status report file has
46 /*	the same name as the corresponding message file:
47 /* .IP \fBbounce\fR
48 /*	Per-recipient status information about why mail is bounced.
49 /*	These files are maintained by the \fBbounce\fR(8) daemon.
50 /* .IP \fBdefer\fR
51 /*	Per-recipient status information about why mail is delayed.
52 /*	These files are maintained by the \fBdefer\fR(8) daemon.
53 /* .IP \fBtrace\fR
54 /*	Per-recipient status information as requested with the
55 /*	Postfix "\fBsendmail -v\fR" or "\fBsendmail -bv\fR" command.
56 /*	These files are maintained by the \fBtrace\fR(8) daemon.
57 /* .PP
58 /*	The \fBqmgr\fR(8) daemon is responsible for asking the
59 /*	\fBbounce\fR(8), \fBdefer\fR(8) or \fBtrace\fR(8) daemons to
60 /*	send delivery reports.
61 /* STRATEGIES
62 /* .ad
63 /* .fi
64 /*	The queue manager implements a variety of strategies for
65 /*	either opening queue files (input) or for message delivery (output).
66 /* .IP "\fBleaky bucket\fR"
67 /*	This strategy limits the number of messages in the \fBactive\fR queue
68 /*	and prevents the queue manager from running out of memory under
69 /*	heavy load.
70 /* .IP \fBfairness\fR
71 /*	When the \fBactive\fR queue has room, the queue manager takes one
72 /*	message from the \fBincoming\fR queue and one from the \fBdeferred\fR
73 /*	queue. This prevents a large mail backlog from blocking the delivery
74 /*	of new mail.
75 /* .IP "\fBslow start\fR"
76 /*	This strategy eliminates "thundering herd" problems by slowly
77 /*	adjusting the number of parallel deliveries to the same destination.
78 /* .IP "\fBround robin\fR
79 /*	The queue manager sorts delivery requests by destination.
80 /*	Round-robin selection prevents one destination from dominating
81 /*	deliveries to other destinations.
82 /* .IP "\fBexponential backoff\fR"
83 /*	Mail that cannot be delivered upon the first attempt is deferred.
84 /*	The time interval between delivery attempts is doubled after each
85 /*	attempt.
86 /* .IP "\fBdestination status cache\fR"
87 /*	The queue manager avoids unnecessary delivery attempts by
88 /*	maintaining a short-term, in-memory list of unreachable destinations.
89 /* .IP "\fBpreemptive message scheduling\fR"
90 /*	The queue manager attempts to minimize the average per-recipient delay
91 /*	while still preserving the correct per-message delays, using
92 /*	a sophisticated preemptive message scheduling.
93 /* TRIGGERS
94 /* .ad
95 /* .fi
96 /*	On an idle system, the queue manager waits for the arrival of
97 /*	trigger events, or it waits for a timer to go off. A trigger
98 /*	is a one-byte message.
99 /*	Depending on the message received, the queue manager performs
100 /*	one of the following actions (the message is followed by the
101 /*	symbolic constant used internally by the software):
102 /* .IP "\fBD (QMGR_REQ_SCAN_DEFERRED)\fR"
103 /*	Start a deferred queue scan.  If a deferred queue scan is already
104 /*	in progress, that scan will be restarted as soon as it finishes.
105 /* .IP "\fBI (QMGR_REQ_SCAN_INCOMING)\fR"
106 /*	Start an incoming queue scan. If an incoming queue scan is already
107 /*	in progress, that scan will be restarted as soon as it finishes.
108 /* .IP "\fBA (QMGR_REQ_SCAN_ALL)\fR"
109 /*	Ignore deferred queue file time stamps. The request affects
110 /*	the next deferred queue scan.
111 /* .IP "\fBF (QMGR_REQ_FLUSH_DEAD)\fR"
112 /*	Purge all information about dead transports and destinations.
113 /* .IP "\fBW (TRIGGER_REQ_WAKEUP)\fR"
114 /*	Wakeup call, This is used by the master server to instantiate
115 /*	servers that should not go away forever. The action is to start
116 /*	an incoming queue scan.
117 /* .PP
118 /*	The \fBqmgr\fR(8) daemon reads an entire buffer worth of triggers.
119 /*	Multiple identical trigger requests are collapsed into one, and
120 /*	trigger requests are sorted so that \fBA\fR and \fBF\fR precede
121 /*	\fBD\fR and \fBI\fR. Thus, in order to force a deferred queue run,
122 /*	one would request \fBA F D\fR; in order to notify the queue manager
123 /*	of the arrival of new mail one would request \fBI\fR.
124 /* STANDARDS
125 /*	RFC 3463 (Enhanced status codes)
126 /*	RFC 3464 (Delivery status notifications)
127 /* SECURITY
128 /* .ad
129 /* .fi
130 /*	The \fBqmgr\fR(8) daemon is not security sensitive. It reads
131 /*	single-character messages from untrusted local users, and thus may
132 /*	be susceptible to denial of service attacks. The \fBqmgr\fR(8) daemon
133 /*	does not talk to the outside world, and it can be run at fixed low
134 /*	privilege in a chrooted environment.
135 /* DIAGNOSTICS
136 /*	Problems and transactions are logged to the syslog daemon.
137 /*	Corrupted message files are saved to the \fBcorrupt\fR queue
138 /*	for further inspection.
139 /*
140 /*	Depending on the setting of the \fBnotify_classes\fR parameter,
141 /*	the postmaster is notified of bounces and of other trouble.
142 /* BUGS
143 /*	A single queue manager process has to compete for disk access with
144 /*	multiple front-end processes such as \fBcleanup\fR(8). A sudden burst of
145 /*	inbound mail can negatively impact outbound delivery rates.
146 /* CONFIGURATION PARAMETERS
147 /* .ad
148 /* .fi
149 /*	Changes to \fBmain.cf\fR are not picked up automatically
150 /*	as \fBqmgr\fR(8)
151 /*	is a persistent process. Use the "\fBpostfix reload\fR" command after
152 /*	a configuration change.
153 /*
154 /*	The text below provides only a parameter summary. See
155 /*	\fBpostconf\fR(5) for more details including examples.
156 /*
157 /*	In the text below, \fItransport\fR is the first field in a
158 /*	\fBmaster.cf\fR entry.
159 /* COMPATIBILITY CONTROLS
160 /* .ad
161 /* .fi
162 /*	Available before Postfix version 2.5:
163 /* .IP "\fBallow_min_user (no)\fR"
164 /*	Allow a sender or recipient address to have `-' as the first
165 /*	character.
166 /* .PP
167 /*	Available with Postfix version 2.7 and later:
168 /* .IP "\fBdefault_filter_nexthop (empty)\fR"
169 /*	When a content_filter or FILTER request specifies no explicit
170 /*	next-hop destination, use $default_filter_nexthop instead; when
171 /*	that value is empty, use the domain in the recipient address.
172 /* ACTIVE QUEUE CONTROLS
173 /* .ad
174 /* .fi
175 /* .IP "\fBqmgr_clog_warn_time (300s)\fR"
176 /*	The minimal delay between warnings that a specific destination is
177 /*	clogging up the Postfix active queue.
178 /* .IP "\fBqmgr_message_active_limit (20000)\fR"
179 /*	The maximal number of messages in the active queue.
180 /* .IP "\fBqmgr_message_recipient_limit (20000)\fR"
181 /*	The maximal number of recipients held in memory by the Postfix
182 /*	queue manager, and the maximal size of the short-term,
183 /*	in-memory "dead" destination status cache.
184 /* .IP "\fBqmgr_message_recipient_minimum (10)\fR"
185 /*	The minimal number of in-memory recipients for any message.
186 /* .IP "\fBdefault_recipient_limit (20000)\fR"
187 /*	The default per-transport upper limit on the number of in-memory
188 /*	recipients.
189 /* .IP "\fItransport\fB_recipient_limit ($default_recipient_limit)\fR"
190 /*	Idem, for delivery via the named message \fItransport\fR.
191 /* .IP "\fBdefault_extra_recipient_limit (1000)\fR"
192 /*	The default value for the extra per-transport limit imposed on the
193 /*	number of in-memory recipients.
194 /* .IP "\fItransport\fB_extra_recipient_limit ($default_extra_recipient_limit)\fR"
195 /*	Idem, for delivery via the named message \fItransport\fR.
196 /* .PP
197 /*	Available in Postfix version 2.4 and later:
198 /* .IP "\fBdefault_recipient_refill_limit (100)\fR"
199 /*	The default per-transport limit on the number of recipients refilled at
200 /*	once.
201 /* .IP "\fItransport\fB_recipient_refill_limit ($default_recipient_refill_limit)\fR"
202 /*	Idem, for delivery via the named message \fItransport\fR.
203 /* .IP "\fBdefault_recipient_refill_delay (5s)\fR"
204 /*	The default per-transport maximum delay between recipients refills.
205 /* .IP "\fItransport\fB_recipient_refill_delay ($default_recipient_refill_delay)\fR"
206 /*	Idem, for delivery via the named message \fItransport\fR.
207 /* DELIVERY CONCURRENCY CONTROLS
208 /* .ad
209 /* .fi
210 /* .IP "\fBinitial_destination_concurrency (5)\fR"
211 /*	The initial per-destination concurrency level for parallel delivery
212 /*	to the same destination.
213 /* .IP "\fBdefault_destination_concurrency_limit (20)\fR"
214 /*	The default maximal number of parallel deliveries to the same
215 /*	destination.
216 /* .IP "\fItransport\fB_destination_concurrency_limit ($default_destination_concurrency_limit)\fR"
217 /*	Idem, for delivery via the named message \fItransport\fR.
218 /* .PP
219 /*	Available in Postfix version 2.5 and later:
220 /* .IP "\fItransport\fB_initial_destination_concurrency ($initial_destination_concurrency)\fR"
221 /*	Initial concurrency for delivery via the named message
222 /*	\fItransport\fR.
223 /* .IP "\fBdefault_destination_concurrency_failed_cohort_limit (1)\fR"
224 /*	How many pseudo-cohorts must suffer connection or handshake
225 /*	failure before a specific destination is considered unavailable
226 /*	(and further delivery is suspended).
227 /* .IP "\fItransport\fB_destination_concurrency_failed_cohort_limit ($default_destination_concurrency_failed_cohort_limit)\fR"
228 /*	Idem, for delivery via the named message \fItransport\fR.
229 /* .IP "\fBdefault_destination_concurrency_negative_feedback (1)\fR"
230 /*	The per-destination amount of delivery concurrency negative
231 /*	feedback, after a delivery completes with a connection or handshake
232 /*	failure.
233 /* .IP "\fItransport\fB_destination_concurrency_negative_feedback ($default_destination_concurrency_negative_feedback)\fR"
234 /*	Idem, for delivery via the named message \fItransport\fR.
235 /* .IP "\fBdefault_destination_concurrency_positive_feedback (1)\fR"
236 /*	The per-destination amount of delivery concurrency positive
237 /*	feedback, after a delivery completes without connection or handshake
238 /*	failure.
239 /* .IP "\fItransport\fB_destination_concurrency_positive_feedback ($default_destination_concurrency_positive_feedback)\fR"
240 /*	Idem, for delivery via the named message \fItransport\fR.
241 /* .IP "\fBdestination_concurrency_feedback_debug (no)\fR"
242 /*	Make the queue manager's feedback algorithm verbose for performance
243 /*	analysis purposes.
244 /* RECIPIENT SCHEDULING CONTROLS
245 /* .ad
246 /* .fi
247 /* .IP "\fBdefault_destination_recipient_limit (50)\fR"
248 /*	The default maximal number of recipients per message delivery.
249 /* .IP "\fItransport\fB_destination_recipient_limit ($default_destination_recipient_limit)\fR"
250 /*	Idem, for delivery via the named message \fItransport\fR.
251 /* MESSAGE SCHEDULING CONTROLS
252 /* .ad
253 /* .fi
254 /* .IP "\fBdefault_delivery_slot_cost (5)\fR"
255 /*	How often the Postfix queue manager's scheduler is allowed to
256 /*	preempt delivery of one message with another.
257 /* .IP "\fItransport\fB_delivery_slot_cost ($default_delivery_slot_cost)\fR"
258 /*	Idem, for delivery via the named message \fItransport\fR.
259 /* .IP "\fBdefault_minimum_delivery_slots (3)\fR"
260 /*	How many recipients a message must have in order to invoke the
261 /*	Postfix queue manager's scheduling algorithm at all.
262 /* .IP "\fItransport\fB_minimum_delivery_slots ($default_minimum_delivery_slots)\fR"
263 /*	Idem, for delivery via the named message \fItransport\fR.
264 /* .IP "\fBdefault_delivery_slot_discount (50)\fR"
265 /*	The default value for transport-specific _delivery_slot_discount
266 /*	settings.
267 /* .IP "\fItransport\fB_delivery_slot_discount ($default_delivery_slot_discount)\fR"
268 /*	Idem, for delivery via the named message \fItransport\fR.
269 /* .IP "\fBdefault_delivery_slot_loan (3)\fR"
270 /*	The default value for transport-specific _delivery_slot_loan
271 /*	settings.
272 /* .IP "\fItransport\fB_delivery_slot_loan ($default_delivery_slot_loan)\fR"
273 /*	Idem, for delivery via the named message \fItransport\fR.
274 /* OTHER RESOURCE AND RATE CONTROLS
275 /* .ad
276 /* .fi
277 /* .IP "\fBminimal_backoff_time (300s)\fR"
278 /*	The minimal time between attempts to deliver a deferred message;
279 /*	prior to Postfix 2.4 the default value was 1000s.
280 /* .IP "\fBmaximal_backoff_time (4000s)\fR"
281 /*	The maximal time between attempts to deliver a deferred message.
282 /* .IP "\fBmaximal_queue_lifetime (5d)\fR"
283 /*	Consider a message as undeliverable, when delivery fails with a
284 /*	temporary error, and the time in the queue has reached the
285 /*	maximal_queue_lifetime limit.
286 /* .IP "\fBqueue_run_delay (300s)\fR"
287 /*	The time between deferred queue scans by the queue manager;
288 /*	prior to Postfix 2.4 the default value was 1000s.
289 /* .IP "\fBtransport_retry_time (60s)\fR"
290 /*	The time between attempts by the Postfix queue manager to contact
291 /*	a malfunctioning message delivery transport.
292 /* .PP
293 /*	Available in Postfix version 2.1 and later:
294 /* .IP "\fBbounce_queue_lifetime (5d)\fR"
295 /*	Consider a bounce message as undeliverable, when delivery fails
296 /*	with a temporary error, and the time in the queue has reached the
297 /*	bounce_queue_lifetime limit.
298 /* .PP
299 /*	Available in Postfix version 2.5 and later:
300 /* .IP "\fBdefault_destination_rate_delay (0s)\fR"
301 /*	The default amount of delay that is inserted between individual
302 /*	deliveries to the same destination; the resulting behavior depends
303 /*	on the value of the corresponding per-destination recipient limit.
304 /* .IP "\fItransport\fB_destination_rate_delay $default_destination_rate_delay
305 /*	Idem, for delivery via the named message \fItransport\fR.
306 /* SAFETY CONTROLS
307 /* .ad
308 /* .fi
309 /* .IP "\fBqmgr_daemon_timeout (1000s)\fR"
310 /*	How much time a Postfix queue manager process may take to handle
311 /*	a request before it is terminated by a built-in watchdog timer.
312 /* .IP "\fBqmgr_ipc_timeout (60s)\fR"
313 /*	The time limit for the queue manager to send or receive information
314 /*	over an internal communication channel.
315 /* MISCELLANEOUS CONTROLS
316 /* .ad
317 /* .fi
318 /* .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
319 /*	The default location of the Postfix main.cf and master.cf
320 /*	configuration files.
321 /* .IP "\fBdefer_transports (empty)\fR"
322 /*	The names of message delivery transports that should not deliver mail
323 /*	unless someone issues "\fBsendmail -q\fR" or equivalent.
324 /* .IP "\fBdelay_logging_resolution_limit (2)\fR"
325 /*	The maximal number of digits after the decimal point when logging
326 /*	sub-second delay values.
327 /* .IP "\fBhelpful_warnings (yes)\fR"
328 /*	Log warnings about problematic configuration settings, and provide
329 /*	helpful suggestions.
330 /* .IP "\fBprocess_id (read-only)\fR"
331 /*	The process ID of a Postfix command or daemon process.
332 /* .IP "\fBprocess_name (read-only)\fR"
333 /*	The process name of a Postfix command or daemon process.
334 /* .IP "\fBqueue_directory (see 'postconf -d' output)\fR"
335 /*	The location of the Postfix top-level queue directory.
336 /* .IP "\fBsyslog_facility (mail)\fR"
337 /*	The syslog facility of Postfix logging.
338 /* .IP "\fBsyslog_name (see 'postconf -d' output)\fR"
339 /*	The mail system name that is prepended to the process name in syslog
340 /*	records, so that "smtpd" becomes, for example, "postfix/smtpd".
341 /* FILES
342 /*	/var/spool/postfix/incoming, incoming queue
343 /*	/var/spool/postfix/active, active queue
344 /*	/var/spool/postfix/deferred, deferred queue
345 /*	/var/spool/postfix/bounce, non-delivery status
346 /*	/var/spool/postfix/defer, non-delivery status
347 /*	/var/spool/postfix/trace, delivery status
348 /* SEE ALSO
349 /*	trivial-rewrite(8), address routing
350 /*	bounce(8), delivery status reports
351 /*	postconf(5), configuration parameters
352 /*	master(5), generic daemon options
353 /*	master(8), process manager
354 /*	syslogd(8), system logging
355 /* README FILES
356 /* .ad
357 /* .fi
358 /*	Use "\fBpostconf readme_directory\fR" or
359 /*	"\fBpostconf html_directory\fR" to locate this information.
360 /* .na
361 /* .nf
362 /*	SCHEDULER_README, scheduling algorithm
363 /*	QSHAPE_README, Postfix queue analysis
364 /* LICENSE
365 /* .ad
366 /* .fi
367 /*	The Secure Mailer license must be distributed with this software.
368 /* AUTHOR(S)
369 /*	Wietse Venema
370 /*	IBM T.J. Watson Research
371 /*	P.O. Box 704
372 /*	Yorktown Heights, NY 10598, USA
373 /*
374 /*	Preemptive scheduler enhancements:
375 /*	Patrik Rak
376 /*	Modra 6
377 /*	155 00, Prague, Czech Republic
378 /*--*/
379 
380 /* System library. */
381 
382 #include <sys_defs.h>
383 #include <stdlib.h>
384 #include <unistd.h>
385 #include <ctype.h>
386 
387 /* Utility library. */
388 
389 #include <msg.h>
390 #include <events.h>
391 #include <vstream.h>
392 #include <dict.h>
393 
394 /* Global library. */
395 
396 #include <mail_queue.h>
397 #include <recipient_list.h>
398 #include <mail_conf.h>
399 #include <mail_params.h>
400 #include <mail_version.h>
401 #include <mail_proto.h>			/* QMGR_SCAN constants */
402 #include <mail_flow.h>
403 #include <flush_clnt.h>
404 
405 /* Master process interface */
406 
407 #include <master_proto.h>
408 #include <mail_server.h>
409 
410 /* Application-specific. */
411 
412 #include "qmgr.h"
413 
414  /*
415   * Tunables.
416   */
417 int     var_queue_run_delay;
418 int     var_min_backoff_time;
419 int     var_max_backoff_time;
420 int     var_max_queue_time;
421 int     var_dsn_queue_time;
422 int     var_qmgr_active_limit;
423 int     var_qmgr_rcpt_limit;
424 int     var_qmgr_msg_rcpt_limit;
425 int     var_xport_rcpt_limit;
426 int     var_stack_rcpt_limit;
427 int     var_xport_refill_limit;
428 int     var_xport_refill_delay;
429 int     var_delivery_slot_cost;
430 int     var_delivery_slot_loan;
431 int     var_delivery_slot_discount;
432 int     var_min_delivery_slots;
433 int     var_init_dest_concurrency;
434 int     var_transport_retry_time;
435 int     var_dest_con_limit;
436 int     var_dest_rcpt_limit;
437 char   *var_defer_xports;
438 int     var_local_con_lim;
439 int     var_local_rcpt_lim;
440 bool    var_verp_bounce_off;
441 int     var_qmgr_clog_warn_time;
442 char   *var_conc_pos_feedback;
443 char   *var_conc_neg_feedback;
444 int     var_conc_cohort_limit;
445 int     var_conc_feedback_debug;
446 int     var_dest_rate_delay;
447 char   *var_def_filter_nexthop;
448 int     var_qmgr_daemon_timeout;
449 int     var_qmgr_ipc_timeout;
450 
451 static QMGR_SCAN *qmgr_scans[2];
452 
453 #define QMGR_SCAN_IDX_INCOMING 0
454 #define QMGR_SCAN_IDX_DEFERRED 1
455 #define QMGR_SCAN_IDX_COUNT (sizeof(qmgr_scans) / sizeof(qmgr_scans[0]))
456 
457 /* qmgr_deferred_run_event - queue manager heartbeat */
458 
459 static void qmgr_deferred_run_event(int unused_event, char *dummy)
460 {
461 
462     /*
463      * This routine runs when it is time for another deferred queue scan.
464      * Make sure this routine gets called again in the future.
465      */
466     qmgr_scan_request(qmgr_scans[QMGR_SCAN_IDX_DEFERRED], QMGR_SCAN_START);
467     event_request_timer(qmgr_deferred_run_event, dummy, var_queue_run_delay);
468 }
469 
470 /* qmgr_trigger_event - respond to external trigger(s) */
471 
472 static void qmgr_trigger_event(char *buf, int len,
473 			               char *unused_service, char **argv)
474 {
475     int     incoming_flag = 0;
476     int     deferred_flag = 0;
477     int     i;
478 
479     /*
480      * Sanity check. This service takes no command-line arguments.
481      */
482     if (argv[0])
483 	msg_fatal("unexpected command-line argument: %s", argv[0]);
484 
485     /*
486      * Collapse identical requests that have arrived since we looked last
487      * time. There is no client feedback so there is no need to process each
488      * request in order. And as long as we don't have conflicting requests we
489      * are free to sort them into the most suitable order.
490      */
491 #define QMGR_FLUSH_BEFORE	(QMGR_FLUSH_ONCE | QMGR_FLUSH_DFXP)
492 
493     for (i = 0; i < len; i++) {
494 	if (msg_verbose)
495 	    msg_info("request: %d (%c)",
496 		     buf[i], ISALNUM(buf[i]) ? buf[i] : '?');
497 	switch (buf[i]) {
498 	case TRIGGER_REQ_WAKEUP:
499 	case QMGR_REQ_SCAN_INCOMING:
500 	    incoming_flag |= QMGR_SCAN_START;
501 	    break;
502 	case QMGR_REQ_SCAN_DEFERRED:
503 	    deferred_flag |= QMGR_SCAN_START;
504 	    break;
505 	case QMGR_REQ_FLUSH_DEAD:
506 	    deferred_flag |= QMGR_FLUSH_BEFORE;
507 	    incoming_flag |= QMGR_FLUSH_BEFORE;
508 	    break;
509 	case QMGR_REQ_SCAN_ALL:
510 	    deferred_flag |= QMGR_SCAN_ALL;
511 	    incoming_flag |= QMGR_SCAN_ALL;
512 	    break;
513 	default:
514 	    if (msg_verbose)
515 		msg_info("request ignored");
516 	    break;
517 	}
518     }
519 
520     /*
521      * Process each request type at most once. Modifiers take effect upon the
522      * next queue run. If no queue run is in progress, and a queue scan is
523      * requested, the request takes effect immediately.
524      */
525     if (incoming_flag != 0)
526 	qmgr_scan_request(qmgr_scans[QMGR_SCAN_IDX_INCOMING], incoming_flag);
527     if (deferred_flag != 0)
528 	qmgr_scan_request(qmgr_scans[QMGR_SCAN_IDX_DEFERRED], deferred_flag);
529 }
530 
531 /* qmgr_loop - queue manager main loop */
532 
533 static int qmgr_loop(char *unused_name, char **unused_argv)
534 {
535     char   *path;
536     int     token_count;
537     int     feed = 0;
538     int     scan_idx;			/* Priority order scan index */
539     static int first_scan_idx = QMGR_SCAN_IDX_INCOMING;
540     int     last_scan_idx = QMGR_SCAN_IDX_COUNT - 1;
541     int     delay;
542 
543     /*
544      * This routine runs as part of the event handling loop, after the event
545      * manager has delivered a timer or I/O event (including the completion
546      * of a connection to a delivery process), or after it has waited for a
547      * specified amount of time. The result value of qmgr_loop() specifies
548      * how long the event manager should wait for the next event.
549      */
550 #define DONT_WAIT	0
551 #define WAIT_FOR_EVENT	(-1)
552 
553     /*
554      * Attempt to drain the active queue by allocating a suitable delivery
555      * process and by delivering mail via it. Delivery process allocation and
556      * mail delivery are asynchronous.
557      */
558     qmgr_active_drain();
559 
560     /*
561      * Let some new blood into the active queue when the queue size is
562      * smaller than some configurable limit.
563      *
564      * We import one message per interrupt, to optimally tune the input count
565      * for the number of delivery agent protocol wait states, as explained in
566      * qmgr_transport.c.
567      */
568     delay = WAIT_FOR_EVENT;
569     for (scan_idx = 0; qmgr_message_count < var_qmgr_active_limit
570 	 && scan_idx < QMGR_SCAN_IDX_COUNT; ++scan_idx) {
571 	last_scan_idx = (scan_idx + first_scan_idx) % QMGR_SCAN_IDX_COUNT;
572 	if ((path = qmgr_scan_next(qmgr_scans[last_scan_idx])) != 0) {
573 	    delay = DONT_WAIT;
574 	    if ((feed = qmgr_active_feed(qmgr_scans[last_scan_idx], path)) != 0)
575 		break;
576 	}
577     }
578 
579     /*
580      * Round-robin the queue scans. When the active queue becomes full,
581      * prefer new mail over deferred mail.
582      */
583     if (qmgr_message_count < var_qmgr_active_limit) {
584 	first_scan_idx = (last_scan_idx + 1) % QMGR_SCAN_IDX_COUNT;
585     } else if (first_scan_idx != QMGR_SCAN_IDX_INCOMING) {
586 	first_scan_idx = QMGR_SCAN_IDX_INCOMING;
587     }
588 
589     /*
590      * Global flow control. If enabled, slow down receiving processes that
591      * get ahead of the queue manager, but don't block them completely.
592      */
593     if (var_in_flow_delay > 0) {
594 	token_count = mail_flow_count();
595 	if (token_count < var_proc_limit) {
596 	    if (feed != 0 && last_scan_idx == QMGR_SCAN_IDX_INCOMING)
597 		mail_flow_put(1);
598 	    else if (qmgr_scans[QMGR_SCAN_IDX_INCOMING]->handle == 0)
599 		mail_flow_put(var_proc_limit - token_count);
600 	} else if (token_count > var_proc_limit) {
601 	    mail_flow_get(token_count - var_proc_limit);
602 	}
603     }
604     return (delay);
605 }
606 
607 /* pre_accept - see if tables have changed */
608 
609 static void pre_accept(char *unused_name, char **unused_argv)
610 {
611     const char *table;
612 
613     if ((table = dict_changed_name()) != 0) {
614 	msg_info("table %s has changed -- restarting", table);
615 	exit(0);
616     }
617 }
618 
619 /* qmgr_pre_init - pre-jail initialization */
620 
621 static void qmgr_pre_init(char *unused_name, char **unused_argv)
622 {
623     flush_init();
624 }
625 
626 /* qmgr_post_init - post-jail initialization */
627 
628 static void qmgr_post_init(char *name, char **unused_argv)
629 {
630 
631     /*
632      * Backwards compatibility.
633      */
634     if (strcmp(var_procname, "nqmgr") == 0) {
635 	msg_warn("please update the %s/%s file; the new queue manager",
636 		 var_config_dir, MASTER_CONF_FILE);
637 	msg_warn("(old name: nqmgr) has become the standard queue manager (new name: qmgr)");
638 	msg_warn("support for the name old name (nqmgr) will be removed from Postfix");
639     }
640 
641     /*
642      * Sanity check.
643      */
644     if (var_qmgr_rcpt_limit < var_qmgr_active_limit) {
645 	msg_warn("%s is smaller than %s - adjusting %s",
646 	      VAR_QMGR_RCPT_LIMIT, VAR_QMGR_ACT_LIMIT, VAR_QMGR_RCPT_LIMIT);
647 	var_qmgr_rcpt_limit = var_qmgr_active_limit;
648     }
649     if (var_dsn_queue_time > var_max_queue_time) {
650 	msg_warn("%s is larger than %s - adjusting %s",
651 		 VAR_DSN_QUEUE_TIME, VAR_MAX_QUEUE_TIME, VAR_DSN_QUEUE_TIME);
652 	var_dsn_queue_time = var_max_queue_time;
653     }
654 
655     /*
656      * This routine runs after the skeleton code has entered the chroot jail.
657      * Prevent automatic process suicide after a limited number of client
658      * requests or after a limited amount of idle time. Move any left-over
659      * entries from the active queue to the incoming queue, and give them a
660      * time stamp into the future, in order to allow ongoing deliveries to
661      * finish first. Start scanning the incoming and deferred queues.
662      * Left-over active queue entries are moved to the incoming queue because
663      * the incoming queue has priority; moving left-overs to the deferred
664      * queue could cause anomalous delays when "postfix reload/start" are
665      * issued often. Override the IPC timeout (default 3600s) so that the
666      * queue manager can reset a broken IPC channel before the watchdog timer
667      * goes off.
668      */
669     var_ipc_timeout = var_qmgr_ipc_timeout;
670     var_use_limit = 0;
671     var_idle_limit = 0;
672     qmgr_move(MAIL_QUEUE_ACTIVE, MAIL_QUEUE_INCOMING, event_time());
673     qmgr_scans[QMGR_SCAN_IDX_INCOMING] = qmgr_scan_create(MAIL_QUEUE_INCOMING);
674     qmgr_scans[QMGR_SCAN_IDX_DEFERRED] = qmgr_scan_create(MAIL_QUEUE_DEFERRED);
675     qmgr_scan_request(qmgr_scans[QMGR_SCAN_IDX_INCOMING], QMGR_SCAN_START);
676     qmgr_deferred_run_event(0, (char *) 0);
677 }
678 
679 MAIL_VERSION_STAMP_DECLARE;
680 
681 /* main - the main program */
682 
683 int     main(int argc, char **argv)
684 {
685     static const CONFIG_STR_TABLE str_table[] = {
686 	VAR_DEFER_XPORTS, DEF_DEFER_XPORTS, &var_defer_xports, 0, 0,
687 	VAR_CONC_POS_FDBACK, DEF_CONC_POS_FDBACK, &var_conc_pos_feedback, 1, 0,
688 	VAR_CONC_NEG_FDBACK, DEF_CONC_NEG_FDBACK, &var_conc_neg_feedback, 1, 0,
689 	VAR_DEF_FILTER_NEXTHOP, DEF_DEF_FILTER_NEXTHOP, &var_def_filter_nexthop, 0, 0,
690 	0,
691     };
692     static const CONFIG_TIME_TABLE time_table[] = {
693 	VAR_QUEUE_RUN_DELAY, DEF_QUEUE_RUN_DELAY, &var_queue_run_delay, 1, 0,
694 	VAR_MIN_BACKOFF_TIME, DEF_MIN_BACKOFF_TIME, &var_min_backoff_time, 1, 0,
695 	VAR_MAX_BACKOFF_TIME, DEF_MAX_BACKOFF_TIME, &var_max_backoff_time, 1, 0,
696 	VAR_MAX_QUEUE_TIME, DEF_MAX_QUEUE_TIME, &var_max_queue_time, 0, 8640000,
697 	VAR_DSN_QUEUE_TIME, DEF_DSN_QUEUE_TIME, &var_dsn_queue_time, 0, 8640000,
698 	VAR_XPORT_RETRY_TIME, DEF_XPORT_RETRY_TIME, &var_transport_retry_time, 1, 0,
699 	VAR_QMGR_CLOG_WARN_TIME, DEF_QMGR_CLOG_WARN_TIME, &var_qmgr_clog_warn_time, 0, 0,
700 	VAR_XPORT_REFILL_DELAY, DEF_XPORT_REFILL_DELAY, &var_xport_refill_delay, 1, 0,
701 	VAR_DEST_RATE_DELAY, DEF_DEST_RATE_DELAY, &var_dest_rate_delay, 0, 0,
702 	VAR_QMGR_DAEMON_TIMEOUT, DEF_QMGR_DAEMON_TIMEOUT, &var_qmgr_daemon_timeout, 1, 0,
703 	VAR_QMGR_IPC_TIMEOUT, DEF_QMGR_IPC_TIMEOUT, &var_qmgr_ipc_timeout, 1, 0,
704 	0,
705     };
706     static const CONFIG_INT_TABLE int_table[] = {
707 	VAR_QMGR_ACT_LIMIT, DEF_QMGR_ACT_LIMIT, &var_qmgr_active_limit, 1, 0,
708 	VAR_QMGR_RCPT_LIMIT, DEF_QMGR_RCPT_LIMIT, &var_qmgr_rcpt_limit, 1, 0,
709 	VAR_QMGR_MSG_RCPT_LIMIT, DEF_QMGR_MSG_RCPT_LIMIT, &var_qmgr_msg_rcpt_limit, 1, 0,
710 	VAR_XPORT_RCPT_LIMIT, DEF_XPORT_RCPT_LIMIT, &var_xport_rcpt_limit, 0, 0,
711 	VAR_STACK_RCPT_LIMIT, DEF_STACK_RCPT_LIMIT, &var_stack_rcpt_limit, 0, 0,
712 	VAR_XPORT_REFILL_LIMIT, DEF_XPORT_REFILL_LIMIT, &var_xport_refill_limit, 1, 0,
713 	VAR_DELIVERY_SLOT_COST, DEF_DELIVERY_SLOT_COST, &var_delivery_slot_cost, 0, 0,
714 	VAR_DELIVERY_SLOT_LOAN, DEF_DELIVERY_SLOT_LOAN, &var_delivery_slot_loan, 0, 0,
715 	VAR_DELIVERY_SLOT_DISCOUNT, DEF_DELIVERY_SLOT_DISCOUNT, &var_delivery_slot_discount, 0, 100,
716 	VAR_MIN_DELIVERY_SLOTS, DEF_MIN_DELIVERY_SLOTS, &var_min_delivery_slots, 0, 0,
717 	VAR_INIT_DEST_CON, DEF_INIT_DEST_CON, &var_init_dest_concurrency, 1, 0,
718 	VAR_DEST_CON_LIMIT, DEF_DEST_CON_LIMIT, &var_dest_con_limit, 0, 0,
719 	VAR_DEST_RCPT_LIMIT, DEF_DEST_RCPT_LIMIT, &var_dest_rcpt_limit, 0, 0,
720 	VAR_LOCAL_RCPT_LIMIT, DEF_LOCAL_RCPT_LIMIT, &var_local_rcpt_lim, 0, 0,
721 	VAR_LOCAL_CON_LIMIT, DEF_LOCAL_CON_LIMIT, &var_local_con_lim, 0, 0,
722 	VAR_CONC_COHORT_LIM, DEF_CONC_COHORT_LIM, &var_conc_cohort_limit, 0, 0,
723 	0,
724     };
725     static const CONFIG_BOOL_TABLE bool_table[] = {
726 	VAR_VERP_BOUNCE_OFF, DEF_VERP_BOUNCE_OFF, &var_verp_bounce_off,
727 	VAR_CONC_FDBACK_DEBUG, DEF_CONC_FDBACK_DEBUG, &var_conc_feedback_debug,
728 	0,
729     };
730 
731     /*
732      * Fingerprint executables and core dumps.
733      */
734     MAIL_VERSION_STAMP_ALLOCATE;
735 
736     /*
737      * Use the trigger service skeleton, because no-one else should be
738      * monitoring our service port while this process runs, and because we do
739      * not talk back to the client.
740      */
741     trigger_server_main(argc, argv, qmgr_trigger_event,
742 			MAIL_SERVER_INT_TABLE, int_table,
743 			MAIL_SERVER_STR_TABLE, str_table,
744 			MAIL_SERVER_BOOL_TABLE, bool_table,
745 			MAIL_SERVER_TIME_TABLE, time_table,
746 			MAIL_SERVER_PRE_INIT, qmgr_pre_init,
747 			MAIL_SERVER_POST_INIT, qmgr_post_init,
748 			MAIL_SERVER_LOOP, qmgr_loop,
749 			MAIL_SERVER_PRE_ACCEPT, pre_accept,
750 			MAIL_SERVER_SOLITARY,
751 			MAIL_SERVER_WATCHDOG, &var_qmgr_daemon_timeout,
752 			0);
753 }
754