1 /* $NetBSD: postmulti.c,v 1.1.1.3 2010/06/17 18:06:59 tron Exp $ */ 2 3 /*++ 4 /* NAME 5 /* postmulti 1 6 /* SUMMARY 7 /* Postfix multi-instance manager 8 /* SYNOPSIS 9 /* .fi 10 /* \fBENABLING MULTI-INSTANCE MANAGEMENT:\fR 11 /* 12 /* \fBpostmulti\fR \fB-e init\fR [\fB-v\fR] 13 /* 14 /* \fBITERATOR MODE:\fR 15 /* 16 /* \fBpostmulti\fR \fB-l\fR [\fB-aRv\fR] [\fB-g \fIgroup\fR] 17 /* [\fB-i \fIname\fR] 18 /* 19 /* \fBpostmulti\fR \fB-p\fR [\fB-av\fR] [\fB-g \fIgroup\fR] 20 /* [\fB-i \fIname\fR] \fIcommand...\fR 21 /* 22 /* \fBpostmulti\fR \fB-x\fR [\fB-aRv\fR] [\fB-g \fIgroup\fR] 23 /* [\fB-i \fIname\fR] \fIcommand...\fR 24 /* 25 /* \fBLIFE-CYCLE MANAGEMENT:\fR 26 /* 27 /* \fBpostmulti\fR \fB-e create\fR [\fB-av\fR] 28 /* [\fB-g \fIgroup\fR] [\fB-i \fIname\fR] [\fB-G \fIgroup\fR] 29 /* [\fB-I \fIname\fR] [\fIparam=value\fR ...] 30 /* 31 /* \fBpostmulti\fR \fB-e import\fR [\fB-av\fR] 32 /* [\fB-g \fIgroup\fR] [\fB-i \fIname\fR] [\fB-G \fIgroup\fR] 33 /* [\fB-I \fIname\fR] [\fBconfig_directory=\fI/path\fR] 34 /* 35 /* \fBpostmulti\fR \fB-e destroy\fR [\fB-v\fR] \fB-i \fIname\fR 36 /* 37 /* \fBpostmulti\fR \fB-e deport\fR [\fB-v\fR] \fB-i \fIname\fR 38 /* 39 /* \fBpostmulti\fR \fB-e enable\fR [\fB-v\fR] \fB-i \fIname\fR 40 /* 41 /* \fBpostmulti\fR \fB-e disable\fR [\fB-v\fR] \fB-i \fIname\fR 42 /* 43 /* \fBpostmulti\fR \fB-e assign\fR [\fB-v\fR] \fB-i \fIname\fR 44 /* [\fB-I \fIname\fR] [-G \fIgroup\fR] 45 /* DESCRIPTION 46 /* The \fBpostmulti\fR(1) command allows a Postfix administrator 47 /* to manage multiple Postfix instances on a single host. 48 /* 49 /* \fBpostmulti\fR(1) implements two fundamental modes of 50 /* operation. In \fBiterator\fR mode, it executes the same 51 /* command for multiple Postfix instances. In \fBlife-cycle 52 /* management\fR mode, it adds or deletes one instance, or 53 /* changes the multi-instance status of one instance. 54 /* 55 /* Each mode of operation has its own command syntax. For this 56 /* reason, each mode is documented in separate sections below. 57 /* BACKGROUND 58 /* .ad 59 /* .fi 60 /* A multi-instance configuration consists of one primary 61 /* Postfix instance, and one or more secondary instances whose 62 /* configuration directory pathnames are recorded in the primary 63 /* instance's main.cf file. Postfix instances share program 64 /* files and documentation, but have their own configuration, 65 /* queue and data directories. 66 /* 67 /* Currently, only the default Postfix instance can be used 68 /* as primary instance in a multi-instance configuration. The 69 /* \fBpostmulti\fR(1) command does not currently support a \fB-c\fR 70 /* option to select an alternative primary instance, and exits 71 /* with a fatal error if the \fBMAIL_CONFIG\fR environment 72 /* variable is set to a non-default configuration directory. 73 /* 74 /* See the MULTI_INSTANCE_README tutorial for a more detailed 75 /* discussion of multi-instance management with \fBpostmulti\fR(1). 76 /* ITERATOR MODE 77 /* .ad 78 /* .fi 79 /* In iterator mode, \fBpostmulti\fR performs the same operation 80 /* on all Postfix instances in turn. 81 /* 82 /* If multi-instance support is not enabled, the requested 83 /* command is performed just for the primary instance. 84 /* .PP 85 /* Iterator mode implements the following command options: 86 /* .SH "Instance selection" 87 /* .IP \fB-a\fR 88 /* Perform the operation on all instances. This is the default. 89 /* .IP "\fB-g \fIgroup\fR" 90 /* Perform the operation only for members of the named \fIgroup\fR. 91 /* .IP "\fB-i \fIname\fR" 92 /* Perform the operation only for the instance with the specified 93 /* \fIname\fR. You can specify either the instance name 94 /* or the absolute pathname of the instance's configuration 95 /* directory. Specify "-" to select the primary Postfix instance. 96 /* .IP \fB-R\fR 97 /* Reverse the iteration order. This may be appropriate when 98 /* updating a multi-instance system, where "sink" instances 99 /* are started before "source" instances. 100 /* .sp 101 /* This option cannot be used with \fB-p\fR. 102 /* .SH "List mode" 103 /* .IP \fB-l\fR 104 /* List Postfix instances with their instance name, instance 105 /* group name, enable/disable status and configuration directory. 106 /* .SH "Postfix-wrapper mode" 107 /* .IP \fB-p\fR 108 /* Invoke \fBpostfix(1)\fR to execute the specified \fIcommand\fR. 109 /* This option implements the \fBpostfix-wrapper\fR(5) interface. 110 /* .RS 111 /* .IP \(bu 112 /* With "start"-like commands, "postfix check" is executed for 113 /* instances that are not enabled. The full list of commands 114 /* is specified with the postmulti_start_commands parameter. 115 /* .IP \(bu 116 /* With "stop"-like commands, the iteration order is reversed, 117 /* and disabled instances are skipped. The full list of commands 118 /* is specified with the postmulti_stop_commands parameter. 119 /* .IP \(bu 120 /* With "reload" and other commands that require a started 121 /* instance, disabled instances are skipped. The full list of 122 /* commands is specified with the postmulti_control_commands 123 /* parameter. 124 /* .IP \(bu 125 /* With "status" and other commands that don't require a started 126 /* instance, the command is executed for all instances. 127 /* .RE 128 /* .IP 129 /* The \fB-p\fR option can also be used interactively to 130 /* start/stop/etc. a named instance or instance group. For 131 /* example, to start just the instances in the group "msa", 132 /* invoke \fBpostmulti\fR(1) as follows: 133 /* .RS 134 /* .IP 135 /* # postmulti -g msa -p start 136 /* .RE 137 /* .SH "Command mode" 138 /* .IP \fB-x\fR 139 /* Execute the specified \fIcommand\fR for all Postfix instances. 140 /* The command runs with appropriate environment settings for 141 /* MAIL_CONFIG, command_directory, daemon_directory, 142 /* config_directory, queue_directory, data_directory, 143 /* multi_instance_name, multi_instance_group and 144 /* multi_instance_enable. 145 /* .SH "Other options" 146 /* .IP \fB-v\fR 147 /* Enable verbose logging for debugging purposes. Multiple 148 /* \fB-v\fR options make the software increasingly verbose. 149 /* LIFE-CYCLE MANAGEMENT MODE 150 /* .ad 151 /* .fi 152 /* With the \fB-e\fR option \fBpostmulti\fR(1) can be used to 153 /* add or delete a Postfix instance, and to manage the 154 /* multi-instance status of an existing instance. 155 /* .PP 156 /* The following options are implemented: 157 /* .SH "Existing instance selection" 158 /* .IP \fB-a\fR 159 /* When creating or importing an instance, place the new 160 /* instance at the front of the secondary instance list. 161 /* .IP "\fB-g \fIgroup\fR" 162 /* When creating or importing an instance, place the new 163 /* instance before the first secondary instance that is a 164 /* member of the specified group. 165 /* .IP "\fB-i \fIname\fR" 166 /* When creating or importing an instance, place the new 167 /* instance before the matching secondary instance. 168 /* .sp 169 /* With other life-cycle operations, apply the operation to 170 /* the named existing instance. Specify "-" to select the 171 /* primary Postfix instance. 172 /* .SH "New or existing instance name assignment" 173 /* .IP "\fB-I \fIname\fR" 174 /* Assign the specified instance \fIname\fR to an existing 175 /* instance, newly-created instance, or imported instance. 176 /* Instance 177 /* names other than "-" (which makes the instance "nameless") 178 /* must start with "postfix-". This restriction reduces the 179 /* likelihood of name collisions with system files. 180 /* .IP "\fB-G \fIgroup\fR" 181 /* Assign the specified \fIgroup\fR name to an existing instance 182 /* or to a newly created or imported instance. 183 /* .SH "Instance creation/deletion/status change" 184 /* .IP "\fB-e \fIaction\fR" 185 /* "Edit" managed instances. The following actions are supported: 186 /* .RS 187 /* .IP \fBinit\fR 188 /* This command is required before \fBpostmulti\fR(1) can be 189 /* used to manage Postfix instances. The "postmulti -e init" 190 /* command updates the primary instance's main.cf file by 191 /* setting: 192 /* .RS 193 /* .IP 194 /* .nf 195 /* multi_instance_wrapper = 196 /* ${command_directory}/postmulti -p -- 197 /* multi_instance_enable = yes 198 /* .fi 199 /* .RE 200 /* .IP 201 /* You can set these by other means if you prefer. 202 /* .IP \fBcreate\fR 203 /* Create a new Postfix instance and add it to the 204 /* multi_instance_directories parameter of the primary instance. 205 /* The "\fB-I \fIname\fR" option is recommended to give the 206 /* instance a short name that is used to construct default 207 /* values for the private directories of the new instance. The 208 /* "\fB-G \fIgroup\fR" option may be specified to assign the 209 /* instance to a group, otherwise, the new instance is not a 210 /* member of any groups. 211 /* .sp 212 /* The new instance main.cf is the stock main.cf with the 213 /* parameters that specify the locations of shared files cloned 214 /* from the primary instance. For "nameless" instances, you 215 /* should manually adjust "syslog_name" to yield a unique 216 /* "logtag" starting with "postfix-" that will uniquely identify 217 /* the instance in the mail logs. It is simpler to assign the 218 /* instance a short name with the "\fB-I \fIname\fR" option. 219 /* .sp 220 /* Optional "name=value" arguments specify the instance 221 /* config_directory, queue_directory and data_directory. 222 /* For example: 223 /* .RS 224 /* .IP 225 /* .nf 226 /* # postmulti -I postfix-mumble \e 227 /* -G mygroup -e create \e 228 /* config_directory=/my/config/dir \e 229 /* queue_directory=/my/queue/dir \e 230 /* data_directory=/my/data/dir 231 /* .fi 232 /* .RE 233 /* .IP 234 /* If any of these pathnames is not supplied, the program 235 /* attempts to generate the pathname by taking the corresponding 236 /* primary instance pathname, and by replacing the last pathname 237 /* component by the value of the \fB-I\fR option. 238 /* .sp 239 /* If the instance configuration directory already exists, and 240 /* contains both a main.cf and master.cf file, \fBcreate\fR 241 /* will "import" the instance as-is. For existing instances, 242 /* \fBcreate\fR and \fBimport\fR are identical. 243 /* .IP \fBimport\fR 244 /* Import an existing instance into the list of instances 245 /* managed by the \fBpostmulti\fR(1) multi-instance manager. 246 /* This adds the instance to the multi_instance_directories 247 /* list of the primary instance. If the "\fB-I \fIname\fR" 248 /* option is provided it specifies the new name for the instance 249 /* and is used to define a default location for the instance 250 /* configuration directory (as with \fBcreate\fR above). The 251 /* "\fB-G \fIgroup\fR" option may be used to assign the instance 252 /* to a group. Add a "\fBconfig_directory=\fI/path\fR" argument 253 /* to override a default pathname based on "\fB-I \fIname\fR". 254 /* .IP \fBdestroy\fR 255 /* Destroy a secondary Postfix instance. To be a candidate for 256 /* destruction an instance must be disabled, stopped and its 257 /* queue must not contain any messages. Attempts to destroy 258 /* the primary Postfix instance trigger a fatal error, without 259 /* destroying the instance. 260 /* .sp 261 /* The instance is removed from the primary instance main.cf 262 /* file's alternate_config_directories parameter and its data, 263 /* queue and configuration directories are cleaned of files 264 /* and directories created by the Postfix system. The main.cf 265 /* and master.cf files are removed from the configuration 266 /* directory even if they have been modified since initial 267 /* creation. Finally, the instance is "deported" from the list 268 /* of managed instances. 269 /* .sp 270 /* If other files are present in instance private directories, 271 /* the directories may not be fully removed, a warning is 272 /* logged to alert the administrator. It is expected that an 273 /* instance built using "fresh" directories via the \fBcreate\fR 274 /* action will be fully removed by the \fBdestroy\fR action 275 /* (if first disabled). If the instance configuration and queue 276 /* directories are populated with additional files (access and 277 /* rewriting tables, chroot jail content, etc.) the instance 278 /* directories will not be fully removed. 279 /* .sp 280 /* The \fBdestroy\fR action triggers potentially dangerous 281 /* file removal operations. Make sure the instance's data, 282 /* queue and configuration directories are set correctly and 283 /* do not contain any valuable files. 284 /* .IP \fBdeport\fR 285 /* Deport a secondary instance from the list of managed 286 /* instances. This deletes the instance configuration directory 287 /* from the primary instance's multi_instance_directories list, 288 /* but does not remove any files or directories. 289 /* .IP \fBassign\fR 290 /* Assign a new instance name or a new group name to the 291 /* selected instance. Use "\fB-G -\fR" to specify "no group" 292 /* and "\fB-I -\fR" to specify "no name". If you choose to 293 /* make an instance "nameless", set a suitable syslog_name in 294 /* the corresponding main.cf file. 295 /* .IP \fBenable\fR 296 /* Mark the selected instance as enabled. This just sets the 297 /* multi_instance_enable parameter to "yes" in the instance's 298 /* main.cf file. 299 /* .IP \fBdisable\fR 300 /* Mark the selected instance as disabled. This means that 301 /* the instance will not be started etc. with "postfix start", 302 /* "postmulti -p start" and so on. The instance can still be 303 /* started etc. with "postfix -c config-directory start". 304 /* .SH "Other options" 305 /* .IP \fB-v\fR 306 /* Enable verbose logging for debugging purposes. Multiple 307 /* \fB-v\fR options make the software increasingly verbose. 308 /* .RE 309 /* ENVIRONMENT 310 /* .ad 311 /* .fi 312 /* The \fBpostmulti\fR(1) command exports the following environment 313 /* variables before executing the requested \fIcommand\fR for a given 314 /* instance: 315 /* .IP \fBMAIL_VERBOSE\fR 316 /* This is set when the -v command-line option is present. 317 /* .IP \fBMAIL_CONFIG\fR 318 /* The location of the configuration directory of the instance. 319 /* CONFIGURATION PARAMETERS 320 /* .ad 321 /* .fi 322 /* .IP "\fBconfig_directory (see 'postconf -d' output)\fR" 323 /* The default location of the Postfix main.cf and master.cf 324 /* configuration files. 325 /* .IP "\fBdaemon_directory (see 'postconf -d' output)\fR" 326 /* The directory with Postfix support programs and daemon programs. 327 /* .IP "\fBimport_environment (see 'postconf -d' output)\fR" 328 /* The list of environment parameters that a Postfix process will 329 /* import from a non-Postfix parent process. 330 /* .IP "\fBmulti_instance_directories (empty)\fR" 331 /* An optional list of non-default Postfix configuration directories; 332 /* these directories belong to additional Postfix instances that share 333 /* the Postfix executable files and documentation with the default 334 /* Postfix instance, and that are started, stopped, etc., together 335 /* with the default Postfix instance. 336 /* .IP "\fBmulti_instance_group (empty)\fR" 337 /* The optional instance group name of this Postfix instance. 338 /* .IP "\fBmulti_instance_name (empty)\fR" 339 /* The optional instance name of this Postfix instance. 340 /* .IP "\fBmulti_instance_enable (no)\fR" 341 /* Allow this Postfix instance to be started, stopped, etc., by a 342 /* multi-instance manager. 343 /* .IP "\fBpostmulti_start_commands (start)\fR" 344 /* The \fBpostfix\fR(1) commands that the \fBpostmulti\fR(1) instance manager treats 345 /* as "start" commands. 346 /* .IP "\fBpostmulti_stop_commands (see 'postconf -d' output)\fR" 347 /* The \fBpostfix\fR(1) commands that the \fBpostmulti\fR(1) instance manager treats 348 /* as "stop" commands. 349 /* .IP "\fBpostmulti_control_commands (reload flush)\fR" 350 /* The \fBpostfix\fR(1) commands that the \fBpostmulti\fR(1) instance manager 351 /* treats as "control" commands, that operate on running instances. 352 /* .IP "\fBsyslog_facility (mail)\fR" 353 /* The syslog facility of Postfix logging. 354 /* .IP "\fBsyslog_name (see 'postconf -d' output)\fR" 355 /* The mail system name that is prepended to the process name in syslog 356 /* records, so that "smtpd" becomes, for example, "postfix/smtpd". 357 /* FILES 358 /* $daemon_directory/main.cf, stock configuration file 359 /* $daemon_directory/master.cf, stock configuration file 360 /* $daemon_directory/postmulti-script, life-cycle helper program 361 /* SEE ALSO 362 /* postfix(1), Postfix control program 363 /* postfix-wrapper(5), Postfix multi-instance API 364 /* README FILES 365 /* Use "\fBpostconf readme_directory\fR" or "\fBpostconf 366 /* html_directory\fR" to locate this information. 367 /* MULTI_INSTANCE_README, Postfix multi-instance management 368 /* HISTORY 369 /* .ad 370 /* .fi 371 /* The \fBpostmulti\fR(1) command was introduced with Postfix 372 /* version 2.6. 373 /* LICENSE 374 /* .ad 375 /* .fi 376 /* The Secure Mailer license must be distributed with this software. 377 /* AUTHOR(S) 378 /* Victor Duchovni 379 /* Morgan Stanley 380 /* 381 /* Wietse Venema 382 /* IBM T.J. Watson Research 383 /* P.O. Box 704 384 /* Yorktown Heights, NY 10598, USA 385 /*--*/ 386 387 /* System library. */ 388 389 #include <sys_defs.h> 390 #include <sys/stat.h> 391 #include <sys/wait.h> 392 #include <vstream.h> 393 #include <stdlib.h> 394 #include <unistd.h> 395 #include <string.h> 396 #include <fcntl.h> 397 #include <syslog.h> 398 #include <errno.h> 399 #include <ctype.h> 400 #ifdef USE_PATHS_H 401 #include <paths.h> 402 #endif 403 #include <stddef.h> 404 405 /* Utility library. */ 406 407 #include <msg.h> 408 #include <msg_vstream.h> 409 #include <msg_syslog.h> 410 #include <vstream.h> 411 #include <vstring_vstream.h> 412 #include <stringops.h> 413 #include <clean_env.h> 414 #include <argv.h> 415 #include <safe.h> 416 #include <mymalloc.h> 417 #include <htable.h> 418 #include <name_code.h> 419 #include <ring.h> 420 421 /* Global library. */ 422 423 #include <mail_version.h> 424 #include <mail_params.h> 425 #include <mail_conf.h> 426 427 /* Application-specific. */ 428 429 /* 430 * Configuration parameters, specific to postmulti(1). 431 */ 432 char *var_multi_start_cmds; 433 char *var_multi_stop_cmds; 434 char *var_multi_cntrl_cmds; 435 436 /* 437 * Shared directory pathnames. 438 */ 439 typedef struct { 440 const char *param_name; 441 char **param_value; 442 } SHARED_PATH; 443 444 static SHARED_PATH shared_dir_table[] = { 445 VAR_COMMAND_DIR, &var_command_dir, 446 VAR_DAEMON_DIR, &var_daemon_dir, 447 0, 448 }; 449 450 /* 451 * Actions. 452 */ 453 #define ITER_CMD_POSTFIX (1<<0) /* postfix(1) iterator mode */ 454 #define ITER_CMD_LIST (1<<1) /* listing iterator mode */ 455 #define ITER_CMD_GENERIC (1<<2) /* generic command iterator mode */ 456 457 #define ITER_CMD_MASK_ALL \ 458 (ITER_CMD_POSTFIX | ITER_CMD_LIST | ITER_CMD_GENERIC) 459 460 #define EDIT_CMD_CREATE (1<<4) /* create new instance */ 461 #define EDIT_CMD_IMPORT (1<<5) /* import existing instance */ 462 #define EDIT_CMD_DESTROY (1<<6) /* destroy instance */ 463 #define EDIT_CMD_DEPORT (1<<7) /* export instance */ 464 #define EDIT_CMD_ENABLE (1<<8) /* enable start/stop */ 465 #define EDIT_CMD_DISABLE (1<<9) /* disable start/stop */ 466 #define EDIT_CMD_ASSIGN (1<<10) /* assign name/group */ 467 #define EDIT_CMD_INIT (1<<11) /* hook into main.cf */ 468 469 #define EDIT_CMD_MASK_ADD (EDIT_CMD_CREATE | EDIT_CMD_IMPORT) 470 #define EDIT_CMD_MASK_DEL (EDIT_CMD_DESTROY | EDIT_CMD_DEPORT) 471 #define EDIT_CMD_MASK_ASSIGN (EDIT_CMD_MASK_ADD | EDIT_CMD_ASSIGN) 472 #define EDIT_CMD_MASK_ENB (EDIT_CMD_ENABLE | EDIT_CMD_DISABLE) 473 #define EDIT_CMD_MASK_ALL \ 474 (EDIT_CMD_MASK_ASSIGN | EDIT_CMD_MASK_DEL | EDIT_CMD_MASK_ENB | \ 475 EDIT_CMD_INIT) 476 477 /* 478 * Edit command to number mapping, and vice versa. 479 */ 480 static NAME_CODE edit_command_table[] = { 481 "create", EDIT_CMD_CREATE, 482 "import", EDIT_CMD_IMPORT, 483 "destroy", EDIT_CMD_DESTROY, 484 "deport", EDIT_CMD_DEPORT, 485 "enable", EDIT_CMD_ENABLE, 486 "disable", EDIT_CMD_DISABLE, 487 "assign", EDIT_CMD_ASSIGN, 488 "init", EDIT_CMD_INIT, 489 0, -1, 490 }; 491 492 #define EDIT_CMD_CODE(str) \ 493 name_code(edit_command_table, NAME_CODE_FLAG_STRICT_CASE, (str)) 494 #define EDIT_CMD_STR(code) str_name_code(edit_command_table, (code)) 495 496 /* 497 * Mandatory prefix for non-empty instance names. 498 */ 499 #ifndef NAME_PREFIX 500 #define NAME_PREFIX "postfix-" 501 #endif 502 #define HAS_NAME_PREFIX(name) \ 503 (strncmp((name), NAME_PREFIX, sizeof(NAME_PREFIX)-1) == 0) 504 #define NEED_NAME_PREFIX(name) \ 505 ((name) != 0 && strcmp((name), "-") != 0 && !HAS_NAME_PREFIX(name)) 506 #define NAME_SUFFIX(name) ((name) + sizeof(NAME_PREFIX) - 1) 507 508 /* 509 * In-core instance structure. Only private information is kept here. 510 */ 511 typedef struct instance { 512 RING ring; /* linkage. */ 513 char *config_dir; /* private */ 514 char *queue_dir; /* private */ 515 char *data_dir; /* private */ 516 char *name; /* null or name */ 517 char *gname; /* null or group */ 518 int enabled; /* start/stop enable */ 519 int primary; /* special */ 520 } INSTANCE; 521 522 /* 523 * Managed instance list (edit mode and iterator mode). 524 */ 525 static RING instance_hd[1]; /* instance list head */ 526 527 #define RING_TO_INSTANCE(ring_ptr) RING_TO_APPL(ring_ptr, INSTANCE, ring) 528 #define RING_PTR_OF(x) (&((x)->ring)) 529 530 #define FOREACH_INSTANCE(entry) \ 531 for ((entry) = instance_hd; \ 532 ((entry) = ring_succ(entry)) != instance_hd;) 533 534 #define FOREACH_SECONDARY_INSTANCE(entry) \ 535 for ((entry) = ring_succ(instance_hd); \ 536 ((entry) = ring_succ(entry)) != instance_hd;) 537 538 #define NEXT_ITERATOR_INSTANCE(flags, entry) \ 539 (((flags) & ITER_FLAG_REVERSE) ? ring_pred(entry) : ring_succ(entry)) 540 541 #define FOREACH_ITERATOR_INSTANCE(flags, entry) \ 542 for ((entry) = instance_hd; \ 543 ((entry) = NEXT_ITERATOR_INSTANCE(flags, (entry))) != instance_hd;) 544 545 /* 546 * Instance selection. One can either select all instances, select by 547 * instance name, or select by instance group. 548 */ 549 typedef struct { 550 int type; /* see below */ 551 char *name; /* undefined or name */ 552 } INST_SELECTION; 553 554 #define INST_SEL_NONE 0 /* default: no selection */ 555 #define INST_SEL_ALL 1 /* select all instances */ 556 #define INST_SEL_NAME 2 /* select instance name */ 557 #define INST_SEL_GROUP 3 /* select instance group */ 558 559 /* 560 * Instance name assignment. Each instance may be assigned an instance name 561 * (this must be globally unique within a multi-instance cluster) or an 562 * instance group name (this is intended to be shared). Externally, empty 563 * names may be represented as "-". Internally, we use "" only, to simplify 564 * the code. 565 */ 566 typedef struct { 567 char *name; /* null or assigned instance name */ 568 char *gname; /* null or assigned group name */ 569 } NAME_ASSIGNMENT; 570 571 /* 572 * Iterator controls for non-edit commands. One can reverse the iteration 573 * order, or give special treatment to disabled instances. 574 */ 575 #define ITER_FLAG_DEFAULT 0 /* default setting */ 576 #define ITER_FLAG_REVERSE (1<<0) /* reverse iteration order */ 577 #define ITER_FLAG_CHECK_DISABLED (1<<1) /* check disabled instances */ 578 #define ITER_FLAG_SKIP_DISABLED (1<<2) /* skip disabled instances */ 579 580 /* 581 * Environment export controls for edit commands. postmulti(1) exports only 582 * things that need to be updated. 583 */ 584 #define EXP_FLAG_MULTI_DIRS (1<<0) /* export multi_instance_directories */ 585 #define EXP_FLAG_MULTI_NAME (1<<1) /* export multi_instance_name */ 586 #define EXP_FLAG_MULTI_GROUP (1<<2) /* export multi_instance_group */ 587 588 /* 589 * To detect conflicts, each instance name and each shared or private 590 * pathname is registered in one place, with its owner. Everyone must 591 * register their claims when they join, and will be rejected in case of 592 * conlict. 593 * 594 * Each claim value involves a parameter value (either a directory name or an 595 * instance name). Each claim owner is the config_directory pathname plus 596 * the parameter name. 597 * 598 * XXX: No multi.cf lock file, so this is not race-free. 599 */ 600 static HTABLE *claim_table; 601 602 #define IS_CLAIMED_BY(name) \ 603 (claim_table ? htable_find(claim_table, (name)) : 0) 604 605 /* 606 * Forward references. 607 */ 608 static int iterate_command(int, int, char **, INST_SELECTION *); 609 static int match_instance_selection(INSTANCE *, INST_SELECTION *); 610 611 /* 612 * Convenience. 613 */ 614 #define INSTANCE_NAME(i) ((i)->name ? (i)->name : (i)->config_dir) 615 #define STR(buf) vstring_str(buf) 616 617 /* register_claim - register claim or bust */ 618 619 static void register_claim(const char *instance_path, const char *param_name, 620 const char *param_value) 621 { 622 const char *myname = "register_claim"; 623 char *requestor; 624 const char *owner; 625 626 /* 627 * Sanity checks. 628 */ 629 if (instance_path == 0 || *instance_path == 0) 630 msg_panic("%s: no or empty instance pathname", myname); 631 if (param_name == 0 || *param_name == 0) 632 msg_panic("%s: no or empty parameter name", myname); 633 if (param_value == 0) 634 msg_panic("%s: no parameter value", myname); 635 636 /* 637 * Make a claim or report a conflict. 638 */ 639 if (claim_table == 0) 640 claim_table = htable_create(100); 641 requestor = concatenate(instance_path, ", ", param_name, (char *) 0); 642 if ((owner = htable_find(claim_table, param_value)) == 0) { 643 (void) htable_enter(claim_table, param_value, requestor); 644 } else if (strcmp(owner, requestor) == 0) { 645 myfree(requestor); 646 } else { 647 msg_fatal("instance %s, %s=%s conflicts with instance %s=%s", 648 instance_path, param_name, param_value, owner, param_value); 649 } 650 } 651 652 /* claim_instance_attributes - claim multiple private instance attributes */ 653 654 static void claim_instance_attributes(INSTANCE *ip) 655 { 656 657 /* 658 * Detect instance name or pathname conflicts between this instance and 659 * other instances. XXX: No multi.cf lock file, so this is not race-free. 660 */ 661 if (ip->name) 662 register_claim(ip->config_dir, VAR_MULTI_NAME, ip->name); 663 register_claim(ip->config_dir, VAR_CONFIG_DIR, ip->config_dir); 664 register_claim(ip->config_dir, VAR_QUEUE_DIR, ip->queue_dir); 665 register_claim(ip->config_dir, VAR_DATA_DIR, ip->data_dir); 666 } 667 668 /* alloc_instance - allocate a single instance object */ 669 670 static INSTANCE *alloc_instance(const char *config_dir) 671 { 672 INSTANCE *ip = (INSTANCE *) mymalloc(sizeof(INSTANCE)); 673 674 ring_init(RING_PTR_OF(ip)); 675 ip->config_dir = config_dir ? mystrdup(config_dir) : 0; 676 ip->queue_dir = 0; 677 ip->data_dir = 0; 678 ip->name = 0; 679 ip->gname = 0; 680 ip->enabled = 0; 681 ip->primary = 0; 682 683 return (ip); 684 } 685 686 #if 0 687 688 /* free_instance - free a single instance object */ 689 690 static void free_instance(INSTANCE *ip) 691 { 692 693 /* 694 * If we continue after secondary main.cf file read error, we must be 695 * prepared for the case that some parameters may be missing. 696 */ 697 if (ip->name) 698 myfree(ip->name); 699 if (ip->gname) 700 myfree(ip->gname); 701 if (ip->config_dir) 702 myfree(ip->config_dir); 703 if (ip->queue_dir) 704 myfree(ip->queue_dir); 705 if (ip->data_dir) 706 myfree(ip->data_dir); 707 myfree((char *) ip); 708 } 709 710 #endif 711 712 /* insert_instance - insert instance before selected location, claim names */ 713 714 static void insert_instance(INSTANCE *ip, INST_SELECTION *selection) 715 { 716 RING *old; 717 718 #define append_instance(ip) insert_instance((ip), (INST_SELECTION *) 0) 719 720 /* 721 * Insert instance before the selected site. 722 */ 723 claim_instance_attributes(ip); 724 if (ring_succ(instance_hd) == 0) 725 ring_init(instance_hd); 726 if (selection && selection->type != INST_SEL_NONE) { 727 FOREACH_SECONDARY_INSTANCE(old) { 728 if (match_instance_selection(RING_TO_INSTANCE(old), selection)) { 729 ring_prepend(old, RING_PTR_OF(ip)); 730 return; 731 } 732 } 733 if (selection->type != INST_SEL_ALL) 734 msg_fatal("No matching secondary instances"); 735 } 736 ring_prepend(instance_hd, RING_PTR_OF(ip)); 737 } 738 739 /* create_primary_instance - synthetic entry for primary instance */ 740 741 static INSTANCE *create_primary_instance(void) 742 { 743 INSTANCE *ip = alloc_instance(var_config_dir); 744 745 /* 746 * There is no need to load primary instance paramater settings from 747 * file. We already have the main.cf parameters of interest in memory. 748 */ 749 #define SAVE_INSTANCE_NAME(val) (*(val) ? mystrdup(val) : 0) 750 751 ip->name = SAVE_INSTANCE_NAME(var_multi_name); 752 ip->gname = SAVE_INSTANCE_NAME(var_multi_group); 753 ip->enabled = var_multi_enable; 754 ip->queue_dir = mystrdup(var_queue_dir); 755 ip->data_dir = mystrdup(var_data_dir); 756 ip->primary = 1; 757 return (ip); 758 } 759 760 /* load_instance - read instance parameters from config_dir/main.cf */ 761 762 static INSTANCE *load_instance(INSTANCE *ip) 763 { 764 VSTREAM *pipe; 765 VSTRING *buf; 766 char *name; 767 char *value; 768 ARGV *cmd; 769 int count = 0; 770 static NAME_CODE bool_code[] = { 771 CONFIG_BOOL_YES, 1, 772 CONFIG_BOOL_NO, 0, 773 0, -1, 774 }; 775 776 /* 777 * XXX: We could really use a "postconf -E" to expand values in the 778 * context of the target main.cf! 779 */ 780 #define REQUEST_PARAM_COUNT 5 /* # of requested parameters */ 781 782 cmd = argv_alloc(REQUEST_PARAM_COUNT + 3); 783 name = concatenate(var_command_dir, "/", "postconf", (char *) 0); 784 argv_add(cmd, name, "-c", ip->config_dir, 785 VAR_QUEUE_DIR, VAR_DATA_DIR, 786 VAR_MULTI_NAME, VAR_MULTI_GROUP, VAR_MULTI_ENABLE, 787 (char *) 0); 788 myfree(name); 789 pipe = vstream_popen(O_RDONLY, VSTREAM_POPEN_ARGV, cmd->argv, 790 VSTREAM_POPEN_END); 791 argv_free(cmd); 792 if (pipe == 0) 793 msg_fatal("Cannot parse %s/main.cf file: %m", ip->config_dir); 794 795 /* 796 * Read parameter settings from postconf. See also comments below on 797 * whether we should continue or skip groups after error instead of 798 * bailing out immediately. 799 */ 800 buf = vstring_alloc(100); 801 while (vstring_get_nonl(buf, pipe) != VSTREAM_EOF) { 802 if (split_nameval(STR(buf), &name, &value)) 803 msg_fatal("Invalid %s/main.cf parameter: %s", 804 ip->config_dir, STR(buf)); 805 if (strcmp(name, VAR_QUEUE_DIR) == 0 && ++count) 806 ip->queue_dir = mystrdup(value); 807 else if (strcmp(name, VAR_DATA_DIR) == 0 && ++count) 808 ip->data_dir = mystrdup(value); 809 else if (strcmp(name, VAR_MULTI_NAME) == 0 && ++count) 810 ip->name = SAVE_INSTANCE_NAME(value); 811 else if (strcmp(name, VAR_MULTI_GROUP) == 0 && ++count) 812 ip->gname = SAVE_INSTANCE_NAME(value); 813 else if (strcmp(name, VAR_MULTI_ENABLE) == 0 && ++count) { 814 /* mail_conf_bool(3) is case insensitive! */ 815 ip->enabled = name_code(bool_code, NAME_CODE_FLAG_NONE, value); 816 if (ip->enabled < 0) 817 msg_fatal("Unexpected %s/main.cf entry: %s = %s", 818 ip->config_dir, VAR_MULTI_ENABLE, value); 819 } 820 } 821 vstring_free(buf); 822 823 /* 824 * XXX We should not bail out while reading a bad secondary main.cf file. 825 * When we manage dozens or more instances, the likelihood increases that 826 * some file will be damaged or missing after a system crash. That is not 827 * a good reason to prevent undamaged Postfix instances from starting. 828 */ 829 if (count != REQUEST_PARAM_COUNT) 830 msg_fatal("Failed to obtain all required %s/main.cf parameters", 831 ip->config_dir); 832 833 if (vstream_pclose(pipe)) 834 msg_fatal("Cannot parse %s/main.cf file", ip->config_dir); 835 return (ip); 836 } 837 838 /* load_all_instances - compute list of Postfix instances */ 839 840 static void load_all_instances(void) 841 { 842 INSTANCE *primary_instance; 843 char **cpp; 844 ARGV *secondary_names; 845 846 /* 847 * Avoid unexpected behavior when $multi_instance_directories contains 848 * only comma characters. Count the actual number of elements, before we 849 * decide that the list is empty. 850 */ 851 secondary_names = argv_split(var_multi_conf_dirs, "\t\n\r, "); 852 853 /* 854 * First, the primary instance. This is synthesized out of thin air. 855 */ 856 primary_instance = create_primary_instance(); 857 if (secondary_names->argc == 0) 858 primary_instance->enabled = 1; /* Single-instance mode */ 859 append_instance(primary_instance); 860 861 /* 862 * Next, instances defined in $multi_instance_directories. Note: 863 * load_instance() has side effects on the global config dictionary, but 864 * this does not affect the values that have already been extracted into 865 * C variables. 866 */ 867 for (cpp = secondary_names->argv; *cpp != 0; cpp++) 868 append_instance(load_instance(alloc_instance(*cpp))); 869 870 argv_free(secondary_names); 871 } 872 873 /* match_instance_selection - match all/name/group constraints */ 874 875 static int match_instance_selection(INSTANCE *ip, INST_SELECTION *selection) 876 { 877 char *iname; 878 char *name; 879 880 /* 881 * When selecting (rather than assigning names) an instance, we match by 882 * the instance name, config_directory path, or the instance name suffix 883 * (name without mandatory prefix). Selecting "-" selects the primary 884 * instance. 885 */ 886 switch (selection->type) { 887 case INST_SEL_NONE: 888 return (0); 889 case INST_SEL_ALL: 890 return (1); 891 case INST_SEL_GROUP: 892 return (ip->gname != 0 && strcmp(selection->name, ip->gname) == 0); 893 case INST_SEL_NAME: 894 name = selection->name; 895 if (*name == '/' || ip->name == 0) 896 iname = ip->config_dir; 897 else if (!HAS_NAME_PREFIX(name) && HAS_NAME_PREFIX(ip->name)) 898 iname = NAME_SUFFIX(ip->name); 899 else 900 iname = ip->name; 901 return (strcmp(name, iname) == 0 902 || (ip->primary && strcmp(name, "-") == 0)); 903 default: 904 msg_panic("match_instance_selection: unknown selection type: %d", 905 selection->type); 906 } 907 } 908 909 /* check_setenv - setenv() with extreme prejudice */ 910 911 static void check_setenv(const char *name, const char *value) 912 { 913 #define CLOBBER 1 914 if (setenv(name, value, CLOBBER) < 0) 915 msg_fatal("setenv: %m"); 916 } 917 918 /* prepend_command_path - prepend command_directory to PATH */ 919 920 static void prepend_command_path(void) 921 { 922 char *cmd_path; 923 924 /* 925 * Carefully prepend "$command_directory:" to PATH. We can free the 926 * buffer after check_setenv(), since the value is copied there. 927 */ 928 cmd_path = safe_getenv("PATH"); 929 cmd_path = concatenate(var_command_dir, ":", (cmd_path && *cmd_path) ? 930 cmd_path : ROOT_PATH, (char *) 0); 931 check_setenv("PATH", cmd_path); 932 myfree(cmd_path); 933 } 934 935 /* check_shared_dir_status - check and claim shared directories */ 936 937 static void check_shared_dir_status(void) 938 { 939 struct stat st; 940 const SHARED_PATH *sp; 941 942 for (sp = shared_dir_table; sp->param_name; ++sp) { 943 if (stat(sp->param_value[0], &st) < 0) 944 msg_fatal("%s = '%s': directory not found: %m", 945 sp->param_name, sp->param_value[0]); 946 if (!S_ISDIR(st.st_mode)) 947 msg_fatal("%s = '%s' is not a directory", 948 sp->param_name, sp->param_value[0]); 949 register_claim(var_config_dir, sp->param_name, sp->param_value[0]); 950 } 951 } 952 953 /* check_safe_name - allow instance or group name with only "safe" characters */ 954 955 static int check_safe_name(const char *s) 956 { 957 #define SAFE_PUNCT "!@%-_=+:./" 958 if (*s == 0) 959 return (0); 960 for (; *s; ++s) { 961 if (!ISALNUM(*s) && !strchr(SAFE_PUNCT, *s)) 962 return (0); 963 } 964 return (1); 965 } 966 967 /* check_name_assignments - Check validity of assigned instance or group name */ 968 969 static void check_name_assignments(NAME_ASSIGNMENT *assignment) 970 { 971 972 /* 973 * Syntax check the assigned instance name. This name is also used to 974 * generate directory pathnames, so we must not allow "/" characters. 975 * 976 * The value "" will clear the name and is always valid. The command-line 977 * parser has already converted "-" into "", to simplify implementation. 978 */ 979 if (assignment->name && *assignment->name) { 980 if (!check_safe_name(assignment->name)) 981 msg_fatal("Unsafe characters in new instance name: '%s'", 982 assignment->name); 983 if (strchr(assignment->name, '/')) 984 msg_fatal("Illegal '/' character in new instance name: '%s'", 985 assignment->name); 986 if (NEED_NAME_PREFIX(assignment->name)) 987 msg_fatal("New instance name must start with '%s'", 988 NAME_PREFIX); 989 } 990 991 /* 992 * Syntax check the assigned group name. 993 */ 994 if (assignment->gname && *assignment->gname) { 995 if (!check_safe_name(assignment->gname)) 996 msg_fatal("Unsafe characters in '-G %s'", assignment->gname); 997 } 998 } 999 1000 /* do_name_assignments - assign instance/group names */ 1001 1002 static int do_name_assignments(INSTANCE *target, NAME_ASSIGNMENT *assignment) 1003 { 1004 int export_flags = 0; 1005 1006 /* 1007 * The command-line parser has already converted "-" into "", to simplify 1008 * implementation. 1009 */ 1010 if (assignment->name 1011 && strcmp(assignment->name, target->name ? target->name : "")) { 1012 register_claim(target->config_dir, VAR_MULTI_NAME, assignment->name); 1013 if (target->name) 1014 myfree(target->name); 1015 target->name = SAVE_INSTANCE_NAME(assignment->name); 1016 export_flags |= EXP_FLAG_MULTI_NAME; 1017 } 1018 if (assignment->gname 1019 && strcmp(assignment->gname, target->gname ? target->gname : "")) { 1020 if (target->gname) 1021 myfree(target->gname); 1022 target->gname = SAVE_INSTANCE_NAME(assignment->gname); 1023 export_flags |= EXP_FLAG_MULTI_GROUP; 1024 } 1025 return (export_flags); 1026 } 1027 1028 /* make_private_path - generate secondary pathname using primary as template */ 1029 1030 static char *make_private_path(const char *param_name, 1031 const char *primary_value, 1032 NAME_ASSIGNMENT *assignment) 1033 { 1034 char *path; 1035 char *base; 1036 char *end; 1037 1038 /* 1039 * The command-line parser has already converted "-" into "", to simplify 1040 * implementation. 1041 */ 1042 if (assignment->name == 0 || *assignment->name == 0) 1043 msg_fatal("Missing %s parameter value", param_name); 1044 1045 if (*primary_value != '/') 1046 msg_fatal("Invalid default %s parameter value: '%s': " 1047 "specify an absolute pathname", 1048 param_name, primary_value); 1049 1050 base = mystrdup(primary_value); 1051 if ((end = strrchr(base, '/')) != 0) { 1052 /* Drop trailing slashes */ 1053 if (end[1] == '\0') { 1054 while (--end > base && *end == '/') 1055 *end = '\0'; 1056 end = strrchr(base, '/'); 1057 } 1058 /* Drop last path component */ 1059 while (end > base && *end == '/') 1060 *end-- = '\0'; 1061 } 1062 path = concatenate(base[1] ? base : "", "/", 1063 assignment->name, (char *) 0); 1064 myfree(base); 1065 return (path); 1066 } 1067 1068 /* assign_new_parameter - assign new instance private name=value */ 1069 1070 static void assign_new_parameter(INSTANCE *new, int edit_cmd, 1071 const char *arg) 1072 { 1073 char *saved_arg; 1074 char *name; 1075 char *value; 1076 char *end; 1077 char **target = 0; 1078 1079 /* 1080 * With "import", only config_directory is specified on the command line 1081 * (either explicitly as config_directory=/path/name, or implicitly as 1082 * instance name). The other private directory pathnames are taken from 1083 * the existing instance's main.cf file. 1084 * 1085 * With "create", all private pathname parameters are specified on the 1086 * command line, or generated from an instance name. 1087 */ 1088 saved_arg = mystrdup(arg); 1089 if (split_nameval(saved_arg, &name, &value)) 1090 msg_fatal("Malformed parameter setting '%s'", arg); 1091 1092 if (strcmp(VAR_CONFIG_DIR, name) == 0) { 1093 target = &new->config_dir; 1094 } else if (edit_cmd != EDIT_CMD_IMPORT) { 1095 if (strcmp(VAR_QUEUE_DIR, name) == 0) { 1096 target = &new->queue_dir; 1097 } else if (strcmp(VAR_DATA_DIR, name) == 0) { 1098 target = &new->data_dir; 1099 } 1100 } 1101 if (target == 0) 1102 msg_fatal("Parameter '%s' not valid with action %s", 1103 name, EDIT_CMD_STR(edit_cmd)); 1104 1105 /* 1106 * Extract and assign the parameter value. We do a limited number of 1107 * checks here. Conflicts between instances are checked by the caller. 1108 * More checks may be implemented in the helper script if inspired. 1109 */ 1110 if (*value != '/') 1111 msg_fatal("Parameter setting '%s' is not an absolute path", name); 1112 1113 /* Tolerate+trim trailing "/" from readline completion */ 1114 for (end = value + strlen(value) - 1; end > value && *end == '/'; --end) 1115 *end = 0; 1116 1117 /* No checks here for "/." or other shoot-foot silliness. */ 1118 if (end == value) 1119 msg_fatal("Parameter setting '%s' is the root directory", name); 1120 1121 if (*target) 1122 myfree(*target); 1123 *target = mystrdup(value); 1124 1125 /* 1126 * Cleanup. 1127 */ 1128 myfree(saved_arg); 1129 } 1130 1131 /* assign_new_parameters - initialize new instance private parameters */ 1132 1133 static void assign_new_parameters(INSTANCE *new, int edit_cmd, 1134 char **argv, NAME_ASSIGNMENT *assignment) 1135 { 1136 const char *owner; 1137 1138 /* 1139 * Sanity check the explicit parameter settings. More stringent checks 1140 * may take place in the helper script. 1141 */ 1142 while (*argv) 1143 assign_new_parameter(new, edit_cmd, *argv++); 1144 1145 /* 1146 * Initialize any missing private directory pathnames, using the primary 1147 * configuration directory parameter values as a template, and using the 1148 * assigned instance name to fill in the blanks. 1149 * 1150 * When importing an existing instance, load private directory pathnames 1151 * from its main.cf file. 1152 */ 1153 if (new->config_dir == 0) 1154 new->config_dir = 1155 make_private_path(VAR_CONFIG_DIR, var_config_dir, assignment); 1156 /* Needed for better-quality error message. */ 1157 if ((owner = IS_CLAIMED_BY(new->config_dir)) != 0) 1158 msg_fatal("new %s=%s is already in use by instance %s=%s", 1159 VAR_CONFIG_DIR, new->config_dir, owner, new->config_dir); 1160 if (edit_cmd != EDIT_CMD_IMPORT) { 1161 if (new->queue_dir == 0) 1162 new->queue_dir = 1163 make_private_path(VAR_QUEUE_DIR, var_queue_dir, assignment); 1164 if (new->data_dir == 0) 1165 new->data_dir = 1166 make_private_path(VAR_DATA_DIR, var_data_dir, assignment); 1167 } else { 1168 load_instance(new); 1169 } 1170 } 1171 1172 /* export_helper_environment - update environment settings for helper command */ 1173 1174 static void export_helper_environment(INSTANCE *target, int export_flags) 1175 { 1176 ARGV *import_env; 1177 VSTRING *multi_dirs; 1178 const SHARED_PATH *sp; 1179 RING *entry; 1180 1181 /* 1182 * Environment import filter, to enforce consistent behavior whether this 1183 * command is started by hand, or at system boot time. This is necessary 1184 * because some shell scripts use environment settings to override 1185 * main.cf settings. 1186 */ 1187 import_env = argv_split(var_import_environ, ", \t\r\n"); 1188 clean_env(import_env->argv); 1189 argv_free(import_env); 1190 1191 /* 1192 * Prepend $command_directory: to PATH. This supposedly ensures that 1193 * naive programs will execute commands from the right Postfix version. 1194 */ 1195 prepend_command_path(); 1196 1197 /* 1198 * The following ensures that Postfix's own programs will target the 1199 * primary instance. 1200 */ 1201 check_setenv(CONF_ENV_PATH, var_config_dir); 1202 1203 /* 1204 * Export the parameter settings that are shared between instances. 1205 */ 1206 for (sp = shared_dir_table; sp->param_name; ++sp) 1207 check_setenv(sp->param_name, sp->param_value[0]); 1208 1209 /* 1210 * Export the target instance's private directory locations. 1211 */ 1212 check_setenv(VAR_CONFIG_DIR, target->config_dir); 1213 check_setenv(VAR_QUEUE_DIR, target->queue_dir); 1214 check_setenv(VAR_DATA_DIR, target->data_dir); 1215 1216 /* 1217 * With operations that add or delete a secondary instance, we export the 1218 * modified multi_instance_directories parameter value for the primary 1219 * Postfix instance. 1220 */ 1221 if (export_flags & EXP_FLAG_MULTI_DIRS) { 1222 multi_dirs = vstring_alloc(100); 1223 FOREACH_SECONDARY_INSTANCE(entry) { 1224 if (VSTRING_LEN(multi_dirs) > 0) 1225 VSTRING_ADDCH(multi_dirs, ' '); 1226 vstring_strcat(multi_dirs, RING_TO_INSTANCE(entry)->config_dir); 1227 } 1228 check_setenv(VAR_MULTI_CONF_DIRS, STR(multi_dirs)); 1229 vstring_free(multi_dirs); 1230 } 1231 1232 /* 1233 * Export updates for the instance name and group. Empty value (or no 1234 * export) means don't update, "-" means clear. 1235 */ 1236 if (export_flags & EXP_FLAG_MULTI_NAME) 1237 check_setenv(VAR_MULTI_NAME, target->name && *target->name ? 1238 target->name : "-"); 1239 1240 if (export_flags & EXP_FLAG_MULTI_GROUP) 1241 check_setenv(VAR_MULTI_GROUP, target->gname && *target->gname ? 1242 target->gname : "-"); 1243 1244 /* 1245 * If we would implement enable/disable commands by exporting the updated 1246 * parameter value, then we could skip commands that have no effect, just 1247 * like we can skip "assign" commands that make no change. 1248 */ 1249 } 1250 1251 /* install_new_instance - install and return newly created instance */ 1252 1253 static INSTANCE *install_new_instance(int edit_cmd, char **argv, 1254 INST_SELECTION *selection, 1255 NAME_ASSIGNMENT *assignment, 1256 int *export_flags) 1257 { 1258 INSTANCE *new; 1259 1260 new = alloc_instance((char *) 0); 1261 check_name_assignments(assignment); 1262 assign_new_parameters(new, edit_cmd, argv, assignment); 1263 *export_flags |= 1264 (do_name_assignments(new, assignment) | EXP_FLAG_MULTI_DIRS); 1265 insert_instance(new, selection); 1266 return (new); 1267 } 1268 1269 /* update_instance - update existing instance, return export flags */ 1270 1271 static int update_instance(INSTANCE *target, NAME_ASSIGNMENT *assignment) 1272 { 1273 int export_flags; 1274 1275 check_name_assignments(assignment); 1276 export_flags = do_name_assignments(target, assignment); 1277 return (export_flags); 1278 } 1279 1280 /* select_existing_instance - return instance selected for management */ 1281 1282 static INSTANCE *select_existing_instance(INST_SELECTION *selection, 1283 int unlink_flag, 1284 int *export_flags) 1285 { 1286 INSTANCE *selected = 0; 1287 RING *entry; 1288 INSTANCE *ip; 1289 1290 #define DONT_UNLINK 0 1291 #define DO_UNLINK 1 1292 1293 if (selection->type != INST_SEL_NAME) 1294 msg_fatal("Select an instance via '-i name'"); 1295 1296 /* Find the selected instance and its predecessor */ 1297 FOREACH_INSTANCE(entry) { 1298 if (match_instance_selection(ip = RING_TO_INSTANCE(entry), selection)) { 1299 selected = ip; 1300 break; 1301 } 1302 } 1303 1304 if (selected == 0) 1305 msg_fatal("No instance named %s", selection->name); 1306 1307 if (unlink_flag) { 1308 /* Splice the target instance out of the list */ 1309 if (ring_pred(entry) == instance_hd) 1310 msg_fatal("Cannot remove the primary instance"); 1311 if (selected->enabled) 1312 msg_fatal("Cannot remove enabled instances"); 1313 ring_detach(entry); 1314 if (export_flags == 0) 1315 msg_panic("select_existing_instance: no export flags"); 1316 *export_flags |= EXP_FLAG_MULTI_DIRS; 1317 } 1318 return (selected); 1319 } 1320 1321 /* manage - create/destroy/... manage instances */ 1322 1323 static NORETURN manage(int edit_cmd, int argc, char **argv, 1324 INST_SELECTION *selection, 1325 NAME_ASSIGNMENT *assignment) 1326 { 1327 char *cmd; 1328 INSTANCE *target; 1329 int export_flags; 1330 1331 /* 1332 * Edit mode is not subject to iterator controls. 1333 */ 1334 #define NO_EXPORT_FLAGS ((int *) 0) 1335 export_flags = 0; 1336 1337 switch (edit_cmd) { 1338 case EDIT_CMD_INIT: 1339 target = create_primary_instance(); 1340 break; 1341 1342 case EDIT_CMD_CREATE: 1343 case EDIT_CMD_IMPORT: 1344 load_all_instances(); 1345 target = install_new_instance(edit_cmd, argv, selection, 1346 assignment, &export_flags); 1347 break; 1348 1349 case EDIT_CMD_ASSIGN: 1350 load_all_instances(); 1351 target = 1352 select_existing_instance(selection, DONT_UNLINK, NO_EXPORT_FLAGS); 1353 export_flags |= update_instance(target, assignment); 1354 if (export_flags == 0) 1355 exit(0); 1356 break; 1357 1358 case EDIT_CMD_DESTROY: 1359 case EDIT_CMD_DEPORT: 1360 load_all_instances(); 1361 target = select_existing_instance(selection, DO_UNLINK, &export_flags); 1362 break; 1363 1364 default: 1365 load_all_instances(); 1366 target = 1367 select_existing_instance(selection, DONT_UNLINK, NO_EXPORT_FLAGS); 1368 break; 1369 } 1370 1371 /* 1372 * Set up the helper script's process environment, and execute the helper 1373 * script. 1374 */ 1375 #define HELPER "postmulti-script" 1376 1377 export_helper_environment(target, export_flags); 1378 cmd = concatenate(var_daemon_dir, "/" HELPER, (char *) 0); 1379 execl(cmd, cmd, "-e", EDIT_CMD_STR(edit_cmd), (char *) 0); 1380 msg_fatal("%s: %m", cmd); 1381 } 1382 1383 /* run_user_command - execute external command with requested MAIL_CONFIG env */ 1384 1385 static int run_user_command(INSTANCE *ip, int iter_cmd, int iter_flags, 1386 char **argv) 1387 { 1388 WAIT_STATUS_T status; 1389 int pid; 1390 int wpid; 1391 1392 /* 1393 * Set up a process environment. The postfix(1) command needs MAIL_CONFIG 1394 * (or the equivalent command-line option); it overrides everything else. 1395 * 1396 * postmulti(1) typically runs various Postfix utilities (postsuper, ...) in 1397 * the context of one or more instances. It can also run various scripts 1398 * on the users PATH. So we can't clobber the user's PATH, but do want to 1399 * make sure that the utilities in $command_directory are always found in 1400 * the right place (or at all). 1401 */ 1402 switch (pid = fork()) { 1403 case -1: 1404 msg_warn("fork %s: %m", argv[0]); 1405 return -1; 1406 case 0: 1407 check_setenv(CONF_ENV_PATH, ip->config_dir); 1408 if (iter_cmd != ITER_CMD_POSTFIX) { 1409 check_setenv(VAR_DAEMON_DIR, var_daemon_dir); 1410 check_setenv(VAR_COMMAND_DIR, var_command_dir); 1411 check_setenv(VAR_CONFIG_DIR, ip->config_dir); 1412 check_setenv(VAR_QUEUE_DIR, ip->queue_dir); 1413 check_setenv(VAR_DATA_DIR, ip->data_dir); 1414 check_setenv(VAR_MULTI_NAME, ip->name ? ip->name : ""); 1415 check_setenv(VAR_MULTI_GROUP, ip->gname ? ip->gname : ""); 1416 check_setenv(VAR_MULTI_ENABLE, ip->enabled ? 1417 CONFIG_BOOL_YES : CONFIG_BOOL_NO); 1418 prepend_command_path(); 1419 } 1420 1421 /* 1422 * Replace: postfix -- start ... With: postfix -- check ... 1423 */ 1424 if (iter_cmd == ITER_CMD_POSTFIX 1425 && (iter_flags & ITER_FLAG_CHECK_DISABLED) && !ip->enabled) 1426 argv[2] = "check"; 1427 1428 execvp(argv[0], argv); 1429 msg_fatal("execvp %s: %m", argv[0]); 1430 default: 1431 do { 1432 wpid = waitpid(pid, &status, 0); 1433 } while (wpid == -1 && errno == EINTR); 1434 return (wpid == -1 ? -1 : 1435 WIFEXITED(status) ? WEXITSTATUS(status) : 1); 1436 } 1437 } 1438 1439 /* word_in_list - look up command in start, stop, or control list */ 1440 1441 static int word_in_list(char *cmdlist, const char *cmd) 1442 { 1443 char *saved; 1444 char *cp; 1445 char *elem; 1446 1447 cp = saved = mystrdup(cmdlist); 1448 while ((elem = mystrtok(&cp, "\t\n\r, ")) != 0 && strcmp(elem, cmd) != 0) 1449 /* void */ ; 1450 myfree(saved); 1451 return (elem != 0); 1452 } 1453 1454 /* iterate_postfix_command - execute postfix(1) command */ 1455 1456 static int iterate_postfix_command(int iter_cmd, int argc, char **argv, 1457 INST_SELECTION *selection) 1458 { 1459 int exit_status; 1460 char *cmd; 1461 ARGV *my_argv; 1462 int iter_flags; 1463 1464 /* 1465 * Override the iterator controls. 1466 */ 1467 if (word_in_list(var_multi_start_cmds, argv[0])) { 1468 iter_flags = ITER_FLAG_CHECK_DISABLED; 1469 } else if (word_in_list(var_multi_stop_cmds, argv[0])) { 1470 iter_flags = ITER_FLAG_SKIP_DISABLED | ITER_FLAG_REVERSE; 1471 } else if (word_in_list(var_multi_cntrl_cmds, argv[0])) { 1472 iter_flags = ITER_FLAG_SKIP_DISABLED; 1473 } else { 1474 iter_flags = 0; 1475 } 1476 1477 /* 1478 * Override the command line in a straightforward manner: prepend 1479 * "postfix --" to the command arguments. Other overrides (environment, 1480 * start -> check) are implemented below the iterator. 1481 */ 1482 #define POSTFIX_CMD "postfix" 1483 1484 my_argv = argv_alloc(argc + 2); 1485 cmd = concatenate(var_command_dir, "/" POSTFIX_CMD, (char *) 0); 1486 argv_add(my_argv, cmd, "--", (char *) 0); 1487 myfree(cmd); 1488 while (*argv) 1489 argv_add(my_argv, *argv++, (char *) 0); 1490 1491 /* 1492 * Execute the command for all applicable Postfix instances. 1493 */ 1494 exit_status = 1495 iterate_command(iter_cmd, iter_flags, my_argv->argv, selection); 1496 1497 argv_free(my_argv); 1498 return (exit_status); 1499 } 1500 1501 /* list_instances - list all selected instances */ 1502 1503 static void list_instances(int iter_flags, INST_SELECTION *selection) 1504 { 1505 RING *entry; 1506 INSTANCE *ip; 1507 1508 /* 1509 * Iterate over the selected instances. 1510 */ 1511 FOREACH_ITERATOR_INSTANCE(iter_flags, entry) { 1512 ip = RING_TO_INSTANCE(entry); 1513 if (match_instance_selection(ip, selection)) 1514 vstream_printf("%-15s %-15s %-9s %s\n", 1515 ip->name ? ip->name : "-", 1516 ip->gname ? ip->gname : "-", 1517 ip->enabled ? "y" : "n", 1518 ip->config_dir); 1519 } 1520 if (vstream_fflush(VSTREAM_OUT)) 1521 msg_fatal("error writing output: %m"); 1522 } 1523 1524 /* iterate_command - execute command for selected instances */ 1525 1526 static int iterate_command(int iter_cmd, int iter_flags, char **argv, 1527 INST_SELECTION *selection) 1528 { 1529 int exit_status = 0; 1530 int matched = 0; 1531 RING *entry; 1532 INSTANCE *ip; 1533 1534 /* 1535 * Iterate over the selected instances. 1536 */ 1537 FOREACH_ITERATOR_INSTANCE(iter_flags, entry) { 1538 ip = RING_TO_INSTANCE(entry); 1539 if ((iter_flags & ITER_FLAG_SKIP_DISABLED) && !ip->enabled) 1540 continue; 1541 if (!match_instance_selection(ip, selection)) 1542 continue; 1543 matched = 1; 1544 1545 /* Run the requested command */ 1546 if (run_user_command(ip, iter_cmd, iter_flags, argv) != 0) 1547 exit_status = 1; 1548 } 1549 if (matched == 0) 1550 msg_fatal("No matching instances"); 1551 1552 return (exit_status); 1553 } 1554 1555 /* iterate - Iterate over all or selected instances */ 1556 1557 static NORETURN iterate(int iter_cmd, int iter_flags, int argc, char **argv, 1558 INST_SELECTION *selection) 1559 { 1560 int exit_status; 1561 1562 /* 1563 * In iterator mode, no selection means wild-card selection. 1564 */ 1565 if (selection->type == INST_SEL_NONE) 1566 selection->type = INST_SEL_ALL; 1567 1568 /* 1569 * Load the in-memory instance table from main.cf files. 1570 */ 1571 load_all_instances(); 1572 1573 /* 1574 * Iterate over the selected instances. 1575 */ 1576 switch (iter_cmd) { 1577 case ITER_CMD_POSTFIX: 1578 exit_status = iterate_postfix_command(iter_cmd, argc, argv, selection); 1579 break; 1580 case ITER_CMD_LIST: 1581 list_instances(iter_flags, selection); 1582 exit_status = 0; 1583 break; 1584 case ITER_CMD_GENERIC: 1585 exit_status = iterate_command(iter_cmd, iter_flags, argv, selection); 1586 break; 1587 default: 1588 msg_panic("iterate: unknown mode: %d", iter_cmd); 1589 } 1590 exit(exit_status); 1591 } 1592 1593 static NORETURN usage(const char *progname) 1594 { 1595 msg_fatal("Usage:" 1596 "%s -l [-v] [-a] [-g group] [-i instance] | " 1597 "%s -p [-v] [-a] [-g group] [-i instance] command... | " 1598 "%s -x [-v] [-a] [-i name] [-g group] command... | " 1599 "%s -e action [-v] [-a] [-i name] [-g group] [-I name] " 1600 "[-G group] [param=value ...]", 1601 progname, progname, progname, progname); 1602 } 1603 1604 MAIL_VERSION_STAMP_DECLARE; 1605 1606 /* main - iterate commands over multiple instance or manage instances */ 1607 1608 int main(int argc, char **argv) 1609 { 1610 int fd; 1611 struct stat st; 1612 char *slash; 1613 char *config_dir; 1614 int ch; 1615 static const CONFIG_STR_TABLE str_table[] = { 1616 VAR_MULTI_START_CMDS, DEF_MULTI_START_CMDS, &var_multi_start_cmds, 0, 0, 1617 VAR_MULTI_STOP_CMDS, DEF_MULTI_STOP_CMDS, &var_multi_stop_cmds, 0, 0, 1618 VAR_MULTI_CNTRL_CMDS, DEF_MULTI_CNTRL_CMDS, &var_multi_cntrl_cmds, 0, 0, 1619 0, 1620 }; 1621 int instance_select_count = 0; 1622 int command_mode_count = 0; 1623 INST_SELECTION selection; 1624 NAME_ASSIGNMENT assignment; 1625 int iter_flags = ITER_FLAG_DEFAULT; 1626 int cmd_mode = 0; 1627 int code; 1628 1629 selection.type = INST_SEL_NONE; 1630 assignment.name = assignment.gname = 0; 1631 1632 /* 1633 * Fingerprint executables and core dumps. 1634 */ 1635 MAIL_VERSION_STAMP_ALLOCATE; 1636 1637 /* 1638 * Be consistent with file permissions. 1639 */ 1640 umask(022); 1641 1642 /* 1643 * To minimize confusion, make sure that the standard file descriptors 1644 * are open before opening anything else. XXX Work around for 44BSD where 1645 * fstat can return EBADF on an open file descriptor. 1646 */ 1647 for (fd = 0; fd < 3; fd++) 1648 if (fstat(fd, &st) == -1 1649 && (close(fd), open("/dev/null", O_RDWR, 0)) != fd) 1650 msg_fatal("open /dev/null: %m"); 1651 1652 /* 1653 * Set up diagnostics. XXX What if stdin is the system console during 1654 * boot time? It seems a bad idea to log startup errors to the console. 1655 * This is UNIX, a system that can run without hand holding. 1656 */ 1657 if ((slash = strrchr(argv[0], '/')) != 0 && slash[1]) 1658 argv[0] = slash + 1; 1659 if (isatty(STDERR_FILENO)) 1660 msg_vstream_init(argv[0], VSTREAM_ERR); 1661 msg_syslog_init(argv[0], LOG_PID, LOG_FACILITY); 1662 1663 if ((config_dir = getenv(CONF_ENV_PATH)) != 0 1664 && strcmp(config_dir, DEF_CONFIG_DIR) != 0) 1665 msg_fatal("Non-default configuration directory: %s=%s", 1666 CONF_ENV_PATH, config_dir); 1667 1668 /* 1669 * Parse switches. 1670 */ 1671 while ((ch = GETOPT(argc, argv, "ae:g:i:G:I:lpRvx")) > 0) { 1672 switch (ch) { 1673 default: 1674 usage(argv[0]); 1675 /* NOTREACHED */ 1676 case 'a': 1677 if (selection.type != INST_SEL_ALL) 1678 instance_select_count++; 1679 selection.type = INST_SEL_ALL; 1680 break; 1681 case 'e': 1682 if ((code = EDIT_CMD_CODE(optarg)) < 0) 1683 msg_fatal("Invalid '-e' edit action '%s'. Specify '%s', " 1684 "'%s', '%s', '%s', '%s', '%s', '%s', '%s' or '%s'", 1685 optarg, 1686 EDIT_CMD_STR(EDIT_CMD_CREATE), 1687 EDIT_CMD_STR(EDIT_CMD_DESTROY), 1688 EDIT_CMD_STR(EDIT_CMD_IMPORT), 1689 EDIT_CMD_STR(EDIT_CMD_DEPORT), 1690 EDIT_CMD_STR(EDIT_CMD_ENABLE), 1691 EDIT_CMD_STR(EDIT_CMD_DISABLE), 1692 EDIT_CMD_STR(EDIT_CMD_ASSIGN), 1693 EDIT_CMD_STR(EDIT_CMD_INIT), 1694 optarg); 1695 if (cmd_mode != code) 1696 command_mode_count++; 1697 cmd_mode = code; 1698 break; 1699 case 'g': 1700 instance_select_count++; 1701 selection.type = INST_SEL_GROUP; 1702 selection.name = optarg; 1703 break; 1704 case 'i': 1705 instance_select_count++; 1706 selection.type = INST_SEL_NAME; 1707 selection.name = optarg; 1708 break; 1709 case 'G': 1710 if (assignment.gname != 0) 1711 msg_fatal("Specify at most one '-G' option"); 1712 assignment.gname = strcmp(optarg, "-") == 0 ? "" : optarg; 1713 break; 1714 case 'I': 1715 if (assignment.name != 0) 1716 msg_fatal("Specify at most one '-I' option"); 1717 assignment.name = strcmp(optarg, "-") == 0 ? "" : optarg; 1718 break; 1719 case 'l': 1720 if (cmd_mode != ITER_CMD_LIST) 1721 command_mode_count++; 1722 cmd_mode = ITER_CMD_LIST; 1723 break; 1724 case 'p': 1725 if (cmd_mode != ITER_CMD_POSTFIX) 1726 command_mode_count++; 1727 cmd_mode = ITER_CMD_POSTFIX; 1728 break; 1729 case 'R': 1730 iter_flags ^= ITER_FLAG_REVERSE; 1731 break; 1732 case 'v': 1733 msg_verbose++; 1734 check_setenv(CONF_ENV_VERB, ""); 1735 break; 1736 case 'x': 1737 if (cmd_mode != ITER_CMD_GENERIC) 1738 command_mode_count++; 1739 cmd_mode = ITER_CMD_GENERIC; 1740 break; 1741 } 1742 } 1743 1744 /* 1745 * Report missing arguments, or wrong arguments in the wrong context. 1746 */ 1747 if (instance_select_count > 1) 1748 msg_fatal("Specity no more than one of '-a', '-g', '-i'"); 1749 1750 if (command_mode_count != 1) 1751 msg_fatal("Specify exactly one of '-e', '-l', '-p', '-x'"); 1752 1753 if (cmd_mode == ITER_CMD_LIST && argc > optind) 1754 msg_fatal("Command not allowed with '-l'"); 1755 1756 if (cmd_mode == ITER_CMD_POSTFIX || cmd_mode == ITER_CMD_GENERIC) 1757 if (argc == optind) 1758 msg_fatal("Command required with '-p' or '-x' option"); 1759 1760 if (cmd_mode == ITER_CMD_POSTFIX || (cmd_mode & EDIT_CMD_MASK_ALL)) 1761 if (iter_flags != ITER_FLAG_DEFAULT) 1762 msg_fatal("The '-p' and '-e' options preclude the use of '-R'"); 1763 1764 if ((cmd_mode & EDIT_CMD_MASK_ASSIGN) == 0 1765 && (assignment.name || assignment.gname)) { 1766 if ((cmd_mode & EDIT_CMD_MASK_ALL) == 0) 1767 msg_fatal("Cannot assign instance name or group without '-e %s'", 1768 EDIT_CMD_STR(EDIT_CMD_ASSIGN)); 1769 else 1770 msg_fatal("Cannot assign instance name or group with '-e %s'", 1771 EDIT_CMD_STR(cmd_mode)); 1772 } 1773 if (cmd_mode & EDIT_CMD_MASK_ALL) { 1774 if (cmd_mode == EDIT_CMD_ASSIGN 1775 && (assignment.name == 0 && assignment.gname == 0)) 1776 msg_fatal("Specify new instance name or group with '-e %s'", 1777 EDIT_CMD_STR(cmd_mode)); 1778 1779 if ((cmd_mode & ~EDIT_CMD_MASK_ADD) != 0 && argc > optind) 1780 msg_fatal("Parameter overrides not valid with '-e %s'", 1781 EDIT_CMD_STR(cmd_mode)); 1782 } 1783 1784 /* 1785 * Proces main.cf parameters. 1786 */ 1787 mail_conf_read(); 1788 get_mail_conf_str_table(str_table); 1789 1790 /* 1791 * Sanity checks. 1792 */ 1793 check_shared_dir_status(); 1794 1795 /* 1796 * Iterate over selected instances, or manipulate one instance. 1797 */ 1798 if (cmd_mode & ITER_CMD_MASK_ALL) 1799 iterate(cmd_mode, iter_flags, argc - optind, argv + optind, &selection); 1800 else 1801 manage(cmd_mode, argc - optind, argv + optind, &selection, &assignment); 1802 } 1803