~/.forward files handling was fixed recently so that it is the privileged

process that does the opening, this commit does some cleanup, and fixes a
bug I experienced today which was caused by a use-after-free.

I did some testing to make sure a user cannot cause smtpd to deadlock, or
loop, with broken setups (self-referencing forwards/aliases, empty files,
broken files...), but if you are playing with aliases/forwards PLEASE let
me know of any bug you run into.

1 files changed, 22 insertions, 23 deletions

diff --git a/usr.sbin/smtpd/smtpd.h b/usr.sbin/smtpd/smtpd.h
index 5390f76aa43..23ad369074f 100644
--- a/usr.sbin/smtpd/smtpd.h
+++ b/usr.sbin/smtpd/smtpd.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: smtpd.h,v 1.83 2009/03/06 23:45:00 gilles Exp $	*/
+/*	$OpenBSD: smtpd.h,v 1.84 2009/03/08 17:54:20 gilles Exp $	*/
 
 /*
  * Copyright (c) 2008 Gilles Chehade <gilles@openbsd.org>
@@ -620,28 +620,6 @@ struct session {
 
 };
 
-struct forward_req {
-	u_int64_t			 id;
-	char				 pw_name[MAXLOGNAME];
-};
-
-enum lkasession_flags {
-	F_ERROR		= 0x1
-};
-
-struct lkasession {
-	SPLAY_ENTRY(lkasession)		 nodes;
-	u_int64_t			 id;
-
-	struct path			 path;
-	struct aliaseslist		 aliaseslist;
-	u_int8_t			 iterations;
-	u_int32_t			 pending;
-	enum lkasession_flags		 flags;
-	struct message			 message;
-	struct submit_status		 *ss;
-};
-
 struct smtpd {
 #define SMTPD_OPT_VERBOSE			 0x00000001
 #define SMTPD_OPT_NOACTION			 0x00000002
@@ -737,6 +715,27 @@ struct message_recipient {
 	struct message			 msg;
 };
 
+struct forward_req {
+	u_int64_t			 id;
+	char				 pw_name[MAXLOGNAME];
+};
+
+enum lkasession_flags {
+	F_ERROR		= 0x1
+};
+
+struct lkasession {
+	SPLAY_ENTRY(lkasession)		 nodes;
+	u_int64_t			 id;
+
+	struct path			 path;
+	struct aliaseslist		 aliaseslist;
+	u_int8_t			 iterations;
+	u_int32_t			 pending;
+	enum lkasession_flags		 flags;
+	struct message			 message;
+	struct submit_status		 ss;
+};
 
 /* aliases.c */
 int aliases_exist(struct smtpd *, char *);