Merge 8.8.4 -> 8.8.5 changes onto mainline

17 files changed, 407 insertions, 171 deletions

diff --git a/usr.sbin/sendmail/cf/cf/Makefile b/usr.sbin/sendmail/cf/cf/Makefile
index d88673e..6aece5b 100644
--- a/usr.sbin/sendmail/cf/cf/Makefile
+++ b/usr.sbin/sendmail/cf/cf/Makefile
@@ -1,10 +1,10 @@
-#	@(#)Makefile	8.17 (Berkeley) 9/12/95
+#	@(#)Makefile	8.19 (Berkeley) 1/14/97
 
 #
 #  This Makefile uses the new Berkeley "make" program.  See Makefile.dist
 #  for a more vanilla version.
 #
-#  Configuration files are created using "m4 file.mc > file.cf";
+#  Create configuration files using "m4 ../m4/cf.m4 file.mc > file.cf";
 #  this may be easier than tweaking the Makefile.  You do need to
 #  have a fairly modern M4 available (GNU m4 works).  On SunOS, use
 #  /usr/5bin/m4.
@@ -44,7 +44,7 @@ CLEANFILES+=$(ALL)
 #		cs-sunos4.1.cf cs-ultrix4.cf \
 #	s2k-osf1.cf s2k-ultrix4.cf \
 #	chez.cs.cf huginn.cs.cf mail.cs.cf mail.eecs.cf mailspool.cs.cf \
-#		python.cs.cf ucbarpa.cf ucbvax.cf vangogh.cs.cf
+#		python.cs.cf ucbarpa.cf ucbvax.cf vangogh.cs.cf knecht.cf
 
 all: $(ALL)
 
diff --git a/usr.sbin/sendmail/src/collect.c b/usr.sbin/sendmail/src/collect.c
index c5e1ceb..660521c 100644
--- a/usr.sbin/sendmail/src/collect.c
+++ b/usr.sbin/sendmail/src/collect.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)collect.c	8.61 (Berkeley) 11/24/96";
+static char sccsid[] = "@(#)collect.c	8.62 (Berkeley) 12/11/96";
 #endif /* not lint */
 
 # include <errno.h>
@@ -501,6 +501,21 @@ readerr:
 		markstats(e, (ADDRESS *) NULL);
 	}
 
+#ifdef _FFR_DSN_RRT
+	/*
+	**  If we have a Return-Receipt-To:, turn it into a DSN.
+	*/
+
+	if (RrtImpliesDsn && hvalue("return-receipt-to", e->e_header) != NULL)
+	{
+		ADDRESS *q;
+
+		for (q = e->e_sendqueue; q != NULL; q = q->q_next)
+			if (!bitset(QHASNOTIFY, q->q_flags))
+				q->q_flags |= QHASNOTIFY|QPINGONSUCCESS;
+	}
+#endif
+
 	/*
 	**  Add an Apparently-To: line if we have no recipient lines.
 	*/
diff --git a/usr.sbin/sendmail/src/conf.c b/usr.sbin/sendmail/src/conf.c
index eba8181..a768d18 100644
--- a/usr.sbin/sendmail/src/conf.c
+++ b/usr.sbin/sendmail/src/conf.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)conf.c	8.325 (Berkeley) 12/1/96";
+static char sccsid[] = "@(#)conf.c	8.333 (Berkeley) 1/21/97";
 #endif /* not lint */
 
 # include "sendmail.h"
@@ -127,14 +127,6 @@ struct hdrinfo	HdrInfo[] =
 
 
 /*
-**  Location of system files/databases/etc.
-*/
-
-char	*PidFile =	_PATH_SENDMAILPID;	/* stores daemon proc id */
-
-
-
-/*
 **  Privacy values
 */
 
@@ -230,6 +222,7 @@ setdefaults(e)
 	ServiceSwitchFile = "/etc/service.switch";
 	ServiceCacheMaxAge = (time_t) 10;
 	HostsFile = _PATH_HOSTS;
+	PidFile = newstr(_PATH_SENDMAILPID);
 	MustQuoteChars = "@,;:\\()[].'";
 	MciInfoTimeout = 30 MINUTES;
 	MaxRuleRecursion = MAXRULERECURSION;
@@ -1849,12 +1842,13 @@ int getla(void)
 int
 getla()
 {
-	kstat_ctl_t *kc;
-	kstat_t *ksp;
+	static kstat_ctl_t *kc = NULL;
+	static kstat_t *ksp = NULL;
 	kstat_named_t *ksn;
 	int la;
 
-	kc = kstat_open();
+	if (kc == NULL)		/* if not initialized before */
+		kc = kstat_open();
 	if (kc == NULL)
 	{
 		if (tTd(3, 1))
@@ -1862,24 +1856,25 @@ getla()
 				errstring(errno));
 		return -1;
 	}
-	ksp = kstat_lookup(kc, "unix", 0, "system_misc"); /* NULL on error */
+	if (ksp == NULL)
+		ksp = kstat_lookup(kc, "unix", 0, "system_misc");
 	if (ksp == NULL)
 	{
 		if (tTd(3, 1))
 			printf("getla: kstat_lookup(): %s\n",
-				errstring(errno);
+				errstring(errno));
 		return -1;
 	}
 	if (kstat_read(kc, ksp, NULL) < 0)
 	{
 		if (tTd(3, 1))
 			printf("getla: kstat_read(): %s\n",
-				errstring(errno);
+				errstring(errno));
 		return -1;
 	}
 	ksn = (kstat_named_t *) kstat_data_lookup(ksp, "avenrun_1min");
-	la = (ksn->value.ul + FSCALE/2) >> FSHIFT;
-	kstat_close(kc);
+	la = ((double)ksn->value.ul + FSCALE/2) / FSCALE;
+	/* kstat_close(kc); /o do not close for fast access */
 	return la;
 }
 
@@ -2372,7 +2367,7 @@ setproctitle(fmt, va_alist)
 **		Picks up extant zombies.
 */
 
-void
+SIGFUNC_DECL
 reapchild(sig)
 	int sig;
 {
@@ -2414,6 +2409,7 @@ reapchild(sig)
 	(void) setsignal(SIGCHLD, reapchild);
 # endif
 	errno = olderrno;
+	return SIGFUNC_RETURN;
 }
 /*
 **  PUTENV -- emulation of putenv() in terms of setenv()
@@ -2800,12 +2796,12 @@ getopt(nargc,nargv,ostr)
 	if(!*place) {			/* update scanning pointer */
 		if (optind >= nargc || *(place = nargv[optind]) != '-' || !*++place) {
 			atend++;
-			return(EOF);
+			return -1;
 		}
 		if (*place == '-') {	/* found "--" */
 			++optind;
 			atend++;
-			return(EOF);
+			return -1;
 		}
 	}				/* option letter okay? */
 	if ((optopt = (int)*place++) == (int)':' || !(oli = strchr(ostr,optopt))) {
@@ -3686,6 +3682,7 @@ lockfile(fd, filename, ext, type)
 #  endif
 		syserr("cannot lockf(%s%s, fd=%d, type=%o, omode=%o, euid=%d)",
 			filename, ext, fd, type, omode, geteuid());
+		dumpfd(fd, TRUE, TRUE);
 	}
 # else
 	if (ext == NULL)
@@ -3715,6 +3712,7 @@ lockfile(fd, filename, ext, type)
 #  endif
 		syserr("cannot flock(%s%s, fd=%d, type=%o, omode=%o, euid=%d)",
 			filename, ext, fd, type, omode, geteuid());
+		dumpfd(fd, TRUE, TRUE);
 	}
 # endif
 	if (tTd(55, 60))
@@ -4005,8 +4003,10 @@ vendor_set_uid(uid)
 
 #if TCPWRAPPERS
 # include <tcpd.h>
+
+/* tcpwrappers does no logging, but you still have to declare these -- ugh */
 int	allow_severity	= LOG_INFO;
-int	deny_severity	= LOG_WARNING;
+int	deny_severity	= LOG_NOTICE;
 #endif
 
 #if DAEMON
@@ -4021,7 +4021,14 @@ validate_connection(sap, hostname, e)
 
 #if TCPWRAPPERS
 	if (!hosts_ctl("sendmail", hostname, anynet_ntoa(sap), STRING_UNKNOWN))
+	{
+# ifdef LOG
+		if (LogLevel >= 4)
+			syslog(LOG_NOTICE, "tcpwrappers (%s, %s) rejection",
+				hostname, anynet_ntoa(sap));
+# endif
 		return FALSE;
+	}
 #endif
 	return TRUE;
 }
@@ -4389,7 +4396,7 @@ load_if_names()
 	int s;
 	int i;
         struct ifconf ifc;
-	char interfacebuf[1024];
+	char interfacebuf[10240];
 
 	s = socket(AF_INET, SOCK_DGRAM, 0);
 	if (s == -1)
@@ -4760,6 +4767,9 @@ char	*OsCompileOptions[] =
 #if USE_SA_SIGACTION
 	"USE_SA_SIGACTION",
 #endif
+#if USE_SIGLONGJMP
+	"USE_SIGLONGJMP",
+#endif
 #if USESETEUID
 	"USESETEUID",
 #endif
diff --git a/usr.sbin/sendmail/src/conf.h b/usr.sbin/sendmail/src/conf.h
index 5ec2b36..9c3904d 100644
--- a/usr.sbin/sendmail/src/conf.h
+++ b/usr.sbin/sendmail/src/conf.h
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)conf.h	8.279 (Berkeley) 12/1/96
+ *	@(#)conf.h	8.288 (Berkeley) 1/17/97
  */
 
 /*
@@ -367,14 +367,12 @@ typedef int		pid_t;
 
 #if defined(sun) && !defined(BSD)
 
+# include <sys/time.h>
 # define HASINITGROUPS	1	/* has initgroups(3) call */
 # define HASUNAME	1	/* use System V uname(2) system call */
 # define HASGETUSERSHELL 1	/* DOES have getusershell(3) call in libc */
 # define HASFCHMOD	1	/* has fchmod(2) syscall */
 # define IP_SRCROUTE	1	/* can check IP source routing */
-# ifndef LA_TYPE
-#  define LA_TYPE	LA_INT
-# endif
 
 # ifdef SOLARIS_2_3
 #  define SOLARIS	20300	/* for back compat only -- use -DSOLARIS=20300 */
@@ -389,7 +387,6 @@ typedef int		pid_t;
 #  ifndef __svr4__
 #   define __svr4__		/* use all System V Releae 4 defines below */
 #  endif
-#  include <sys/time.h>
 #  define GIDSET_T	gid_t
 #  define USE_SA_SIGACTION	1	/* use sa_sigaction field */
 #  ifndef _PATH_UNIX
@@ -409,16 +406,14 @@ typedef int		pid_t;
 #   define USESETEUID	1		/* seteuid works as of 2.3 */
 #  endif
 #  if SOLARIS >= 20500 || (SOLARIS < 10000 && SOLARIS >= 205)
-#   define HASSNPRINTF	1		/* has snprintf starting in 2.5 */
 #   define HASSETREUID	1		/* setreuid works as of 2.5 */
-#   if SOLARIS == 20500 || SOLARIS == 205
-#    define snprintf	__snprintf	/* but names it oddly in 2.5 */
-#    define vsnprintf	__vsnprintf
-#   endif
 #   ifndef LA_TYPE
 #    define LA_TYPE	LA_KSTAT	/* use kstat(3k) -- may work in < 2.5 */
 #   endif
 #  endif
+#  if SOLARIS >= 20600 || (SOLARIS < 10000 && SOLARIS >= 206)
+#   define HASSNPRINTF	1		/* has snprintf starting in 2.6 */
+#  endif
 #  ifndef HASGETUSERSHELL
 #   define HASGETUSERSHELL 0	/* getusershell(3) causes core dumps */
 #  endif
@@ -454,7 +449,12 @@ extern char		*getenv();
 
 #  endif
 # endif
-#endif
+
+# ifndef LA_TYPE
+#  define LA_TYPE	LA_INT
+# endif
+
+#endif /* sun && !BSD */
 
 /*
 **  DG/UX
@@ -680,7 +680,7 @@ typedef int		pid_t;
 
 
 /*
-**  FreeBSD / NetBSD (all architectures, all versions)
+**  FreeBSD / NetBSD / OpenBSD (all architectures, all versions)
 **
 **  4.3BSD clone, closer to 4.4BSD	for FreeBSD 1.x and NetBSD 0.9x
 **  4.4BSD-Lite based			for FreeBSD 2.x and NetBSD 1.x
@@ -688,7 +688,7 @@ typedef int		pid_t;
 **	See also BSD defines.
 */
 
-#if defined(__FreeBSD__) || defined(__NetBSD__)
+#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__)
 # include <paths.h>
 # define HASUNSETENV	1	/* has unsetenv(3) call */
 # define HASSETSID	1	/* has the setsid(2) POSIX syscall */
@@ -722,6 +722,10 @@ typedef int		pid_t;
 #   define SPT_PADCHAR	'\0'		/* pad process title with nulls */
 #  endif
 # endif
+# if defined(__OpenBSD__)
+#  undef SPT_TYPE
+#  define SPT_TYPE	SPT_BUILTIN	/* setproctitle is in libc */
+# endif
 #endif
 
 
@@ -831,6 +835,7 @@ extern int		errno;
 # define SYSTEM5	1	/* include all the System V defines */
 # define HASGETUSERSHELL 0	/* does not have getusershell(3) call */
 # define NOFTRUNCATE	0	/* has (simulated) ftruncate call */
+# define USE_SIGLONGJMP	1	/* sigsetjmp needed for signal handling */
 # define MAXPATHLEN	PATHSIZE
 # define SFS_TYPE	SFS_4ARGS	/* use <sys/statfs.h> 4-arg impl */
 # define SFS_BAVAIL	f_bfree		/* alternate field name */
@@ -903,6 +908,7 @@ extern int		errno;
 # define WAITUNION	1	/* use "union wait" as wait argument type */
 # define NEEDFSYNC	1	/* no fsync(2) in system library */
 # define NEEDSTRSTR	1	/* need emulation of the strstr(3) call */
+# define NOFTRUNCATE	1	/* do not have ftruncate(2) */
 # define MAXPATHLEN	PATH_MAX
 # define LA_TYPE	LA_SHORT
 # define SFS_TYPE	SFS_STATFS	/* use <sys/statfs.h> statfs() impl */
@@ -916,6 +922,7 @@ extern int		errno;
 typedef unsigned short	uid_t;
 typedef unsigned short	gid_t;
 typedef short		pid_t;
+typedef unsigned long	mode_t;
 
 /* some stuff that should have been in the include files */
 # include <grp.h>
@@ -1014,7 +1021,9 @@ extern struct group	*getgrnam();
 
 extern int		errno;
 typedef int		pid_t;
-#define			SIGFUNC_DEFINED
+#define SIGFUNC_DEFINED
+#define SIGFUNC_RETURN	(0)
+#define SIGFUNC_DECL	int
 typedef int		(*sigfunc_t)();
 extern char		*getenv();
 extern void		*malloc();
@@ -1109,6 +1118,8 @@ extern void		*malloc();
 # define HASINITGROUPS	1	/* has initgroups(3) call */
 # define HASSETVBUF	1	/* we have setvbuf(3) in libc */
 # define SIGFUNC_DEFINED	/* sigfunc_t already defined */
+# define SIGFUNC_RETURN	(0)	/* XXX this is a guess */
+# define SIGFUNC_DECL	int	/* XXX this is a guess */
 # ifndef IDENTPROTO
 #  define IDENTPROTO	0	/* TCP/IP implementation is broken */
 # endif
@@ -1283,6 +1294,9 @@ typedef int		pid_t;
 #  define IDENTPROTO	0	/* TCP/IP implementation is broken */
 # endif
 # define RLIMIT_NEEDS_SYS_TIME_H	1
+# if defined(NGROUPS_MAX) && !NGROUPS_MAX
+#  undef NGROUPS_MAX
+# endif
 #endif
 
 
@@ -1493,6 +1507,8 @@ extern struct group	*getgrent(), *getgrnam(), *getgrgid();
 typedef int		pid_t;
 typedef int		(*sigfunc_t)();
 #  define SIGFUNC_DEFINED
+#  define SIGFUNC_RETURN	(0)
+#  define SIGFUNC_DECL		int
 
 # else
 			/* NEWS-OS 6.0.3 with /bin/cc */
@@ -1557,6 +1573,8 @@ typedef int		(*sigfunc_t)();
 typedef int		pid_t;
 typedef int		(*sigfunc_t)();
 # define SIGFUNC_DEFINED
+# define SIGFUNC_RETURN	(0)
+# define SIGFUNC_DECL	int
 extern char	*getenv();
 extern int	errno;
 # define _PATH_VENDOR_CF	"/usr/lib/sendmail.cf"
@@ -1661,6 +1679,28 @@ extern int	errno;
 
 #endif
 
+/*
+**  Harris Nighthawk PowerUX (nh6000 box)
+**
+**  Contributed by Bob Miorelli, Pratt & Whitney <miorelli@pweh.com>
+*/
+
+#ifdef _PowerUX
+# ifndef __svr4__
+#  define __svr4__
+# endif
+# define _PATH_VENDOR_CF	"/etc/mail/sendmail.cf"
+# ifndef _PATH_SENDMAILPID
+#  define _PATH_SENDMAILPID	"/etc/mail/sendmail.pid"
+# endif
+# define SYSLOG_BUFSIZE		1024
+# define HASSNPRINTF		1	/* has snprintf(3) and vsnprintf(3) */
+# define LA_TYPE		LA_ZERO
+typedef struct msgb		mblk_t;
+# undef offsetof	/* avoid stddefs.h and sys/sysmacros.h conflict */
+#endif
+
+
 /**********************************************************************
 **  End of Per-Operating System defines
 **********************************************************************/
@@ -1719,10 +1759,7 @@ extern int	errno;
 #  define SFS_TYPE		SFS_STATVFS
 # endif
 
-/* SVr4 uses different routines for setjmp/longjmp with signal support */
-# define jmp_buf		sigjmp_buf
-# define setjmp(env)		sigsetjmp(env, 1)
-# define longjmp(env, val)	siglongjmp(env, val)
+# define USE_SIGLONGJMP	1	/* sigsetjmp needed for signal handling */
 #endif
 
 /* general System V defines */
@@ -1843,6 +1880,10 @@ extern int	errno;
 # define SECUREWARE	0	/* assume no SecureWare C2 auditing hooks */
 #endif
 
+#ifndef USE_SIGLONGJMP
+# define USE_SIGLONGJMP	0	/* assume setjmp handles signals properly */
+#endif
+
 /*
 **  If no type for argument two of getgroups call is defined, assume
 **  it's an integer -- unfortunately, there seem to be several choices
@@ -2069,6 +2110,12 @@ struct utsname
 #ifndef SIGFUNC_DEFINED
 typedef void		(*sigfunc_t) __P((int));
 #endif
+#ifndef SIGFUNC_RETURN
+# define SIGFUNC_RETURN
+#endif
+#ifndef SIGFUNC_DECL
+# define SIGFUNC_DECL	void
+#endif
 
 /* size of syslog buffer */
 #ifndef SYSLOG_BUFSIZE
@@ -2115,3 +2162,22 @@ typedef void		(*sigfunc_t) __P((int));
 #ifndef SCANF
 # define SCANF		1
 #endif
+
+/*
+**  SVr4 and similar systems use different routines for setjmp/longjmp
+**  with signal support
+*/
+
+#if USE_SIGLONGJMP
+/* Silly SCO /usr/include/setjmp.h file has #define setjmp(env) setjmp(env) */
+# ifdef setjmp
+#  undef setjmp
+# endif
+# define jmp_buf		sigjmp_buf
+# define setjmp(env)		sigsetjmp(env, 1)
+# define longjmp(env, val)	siglongjmp(env, val)
+#endif
+
+#if !defined(NGROUPS_MAX) && defined(NGROUPS)
+# define NGROUPS_MAX	NGROUPS		/* POSIX naming convention */
+#endif
diff --git a/usr.sbin/sendmail/src/daemon.c b/usr.sbin/sendmail/src/daemon.c
index c8516fc..bd8a914 100644
--- a/usr.sbin/sendmail/src/daemon.c
+++ b/usr.sbin/sendmail/src/daemon.c
@@ -37,9 +37,9 @@
 
 #ifndef lint
 #ifdef DAEMON
-static char sccsid[] = "@(#)daemon.c	8.156 (Berkeley) 12/1/96 (with daemon mode)";
+static char sccsid[] = "@(#)daemon.c	8.159 (Berkeley) 1/14/97 (with daemon mode)";
 #else
-static char sccsid[] = "@(#)daemon.c	8.156 (Berkeley) 12/1/96 (without daemon mode)";
+static char sccsid[] = "@(#)daemon.c	8.159 (Berkeley) 1/14/97 (without daemon mode)";
 #endif
 #endif /* not lint */
 
@@ -165,7 +165,8 @@ getrequests(e)
 	(void) setsignal(SIGCHLD, reapchild);
 
 	/* write the pid to the log file for posterity */
-	pidf = fopen(PidFile, "w");
+	pidf = safefopen(PidFile, O_WRONLY|O_CREAT|O_TRUNC, 0644,
+			 SFF_NOSLINK|SFF_ROOTOK|SFF_REGONLY|SFF_CREAT);
 	if (pidf != NULL)
 	{
 		extern char *CommandLineArgs;
@@ -316,7 +317,7 @@ getrequests(e)
 		if (pid == 0)
 		{
 			char *p;
-			extern void intsig();
+			extern SIGFUNC_DECL intsig __P((int));
 			FILE *inchannel, *outchannel;
 			bool nullconn;
 
diff --git a/usr.sbin/sendmail/src/deliver.c b/usr.sbin/sendmail/src/deliver.c
index 576c166..97a1050 100644
--- a/usr.sbin/sendmail/src/deliver.c
+++ b/usr.sbin/sendmail/src/deliver.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)deliver.c	8.260 (Berkeley) 12/1/96";
+static char sccsid[] = "@(#)deliver.c	8.266 (Berkeley) 1/17/97";
 #endif /* not lint */
 
 #include "sendmail.h"
@@ -314,7 +314,7 @@ sendall(e, mode)
 			ee->e_errorqueue = copyqueue(e->e_errorqueue);
 			ee->e_flags = e->e_flags & ~(EF_INQUEUE|EF_CLRQUEUE|EF_FATALERRS|EF_SENDRECEIPT|EF_RET_PARAM);
 			ee->e_flags |= EF_NORECEIPT;
-			setsender(owner, ee, NULL, TRUE);
+			setsender(owner, ee, NULL, '\0', TRUE);
 			if (tTd(13, 5))
 			{
 				printf("sendall(split): QDONTSEND ");
@@ -401,7 +401,7 @@ sendall(e, mode)
 
 	if (owner != NULL)
 	{
-		setsender(owner, e, NULL, TRUE);
+		setsender(owner, e, NULL, '\0', TRUE);
 		if (tTd(13, 5))
 		{
 			printf("sendall(owner): QDONTSEND ");
@@ -470,6 +470,13 @@ sendall(e, mode)
   queueonly:
 		if (e->e_nrcpts > 0)
 			e->e_flags |= EF_INQUEUE;
+		dropenvelope(e, FALSE);
+		for (ee = splitenv; ee != NULL; ee = ee->e_sibling)
+		{
+			if (ee->e_nrcpts > 0)
+				ee->e_flags |= EF_INQUEUE;
+			dropenvelope(ee, FALSE);
+		}
 		return;
 
 	  case SM_FORK:
@@ -547,7 +554,7 @@ sendall(e, mode)
 			exit(EX_OK);
 
 		/* be sure we are immune from the terminal */
-		disconnect(1, e);
+		disconnect(2, e);
 
 		/* prevent parent from waiting if there was an error */
 		if (pid < 0)
@@ -788,10 +795,10 @@ dofork()
 */
 
 #ifndef NO_UID
-# define NO_UID		((uid_t) -1)
+# define NO_UID		-1
 #endif
 #ifndef NO_GID
-# define NO_GID		((gid_t) -1)
+# define NO_GID		-1
 #endif
 
 int
@@ -1500,9 +1507,9 @@ tryhost:
 		{
 			int i;
 			int saveerrno;
-			uid_t new_euid = NO_UID;
-			uid_t new_ruid = NO_UID;
-			gid_t new_gid = NO_GID;
+			int new_euid = NO_UID;
+			int new_ruid = NO_UID;
+			int new_gid = NO_GID;
 			struct stat stb;
 			extern int DtableSize;
 
@@ -1765,12 +1772,13 @@ tryhost:
 	}
 #endif
 
+	/* clear out per-message flags from connection structure */
+	mci->mci_flags &= ~(MCIF_CVT7TO8|MCIF_CVT8TO7);
+
 	if (bitset(EF_HAS8BIT, e->e_flags) &&
 	    !bitset(EF_DONT_MIME, e->e_flags) &&
 	    bitnset(M_7BITS, m->m_flags))
 		mci->mci_flags |= MCIF_CVT8TO7;
-	else
-		mci->mci_flags &= ~MCIF_CVT8TO7;
 
 #if MIME7TO8
 	if (bitnset(M_MAKE8BIT, m->m_flags) &&
@@ -2000,7 +2008,7 @@ tryhost:
 		e->e_statmsg = NULL;
 
 		/* reset the mci state for the next transaction */
-		if (mci->mci_state == MCIS_ACTIVE)
+		if (mci != NULL && mci->mci_state == MCIS_ACTIVE)
 			mci->mci_state = MCIS_OPEN;
 	}
 # endif
@@ -2014,7 +2022,7 @@ tryhost:
 
 #if SMTP
 	/* now close the connection */
-	if (clever && mci->mci_state != MCIS_CLOSED &&
+	if (clever && mci != NULL && mci->mci_state != MCIS_CLOSED &&
 	    !bitset(MCIF_CACHED, mci->mci_flags))
 		smtpquit(m, mci, e);
 #endif
diff --git a/usr.sbin/sendmail/src/headers.c b/usr.sbin/sendmail/src/headers.c
index 7ae2acf..310f45f 100644
--- a/usr.sbin/sendmail/src/headers.c
+++ b/usr.sbin/sendmail/src/headers.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)headers.c	8.101 (Berkeley) 11/23/96";
+static char sccsid[] = "@(#)headers.c	8.103 (Berkeley) 12/11/96";
 #endif /* not lint */
 
 # include <errno.h>
@@ -569,7 +569,7 @@ eatheader(e, full)
 			if (tTd(32, 2))
 				printf("eatheader: setsender(*%s == %s)\n",
 					hi->hi_field, p);
-			setsender(p, e, NULL, TRUE);
+			setsender(p, e, NULL, '\0', TRUE);
 		}
 	}
 
@@ -1165,7 +1165,11 @@ putheader(mci, hdr, e)
 
 		/* suppress return receipts if requested */
 		if (bitset(H_RECEIPTTO, h->h_flags) &&
+#if _FFR_DSN_RRT
+		    (RrtImpliesDsn || bitset(EF_NORECEIPT, e->e_flags)))
+#else
 		    bitset(EF_NORECEIPT, e->e_flags))
+#endif
 		{
 			if (tTd(34, 11))
 				printf(" (skipped (receipt))\n");
diff --git a/usr.sbin/sendmail/src/main.c b/usr.sbin/sendmail/src/main.c
index 1b68be1..193ba54 100644
--- a/usr.sbin/sendmail/src/main.c
+++ b/usr.sbin/sendmail/src/main.c
@@ -39,7 +39,7 @@ static char copyright[] =
 #endif /* not lint */
 
 #ifndef lint
-static char sccsid[] = "@(#)main.c	8.223 (Berkeley) 12/1/96";
+static char sccsid[] = "@(#)main.c	8.230 (Berkeley) 1/17/97";
 #endif /* not lint */
 
 #define	_DEFINE
@@ -145,12 +145,12 @@ main(argc, argv, envp)
 	extern char *optarg;
 	extern char **environ;
 	extern time_t convtime();
-	extern void intsig();
+	extern SIGFUNC_DECL intsig __P((int));
 	extern struct hostent *myhostname();
 	extern char *getauthinfo();
 	extern char *getcfname();
-	extern void sigusr1();
-	extern void sighup();
+	extern SIGFUNC_DECL sigusr1 __P((int));
+	extern SIGFUNC_DECL sighup __P((int));
 	extern void initmacros __P((ENVELOPE *));
 	extern void init_md __P((int, char **));
 	extern int getdtsize __P((void));
@@ -165,6 +165,7 @@ main(argc, argv, envp)
 	extern void printqueue __P((void));
 	extern void sendtoargv __P((char **, ENVELOPE *));
 	extern void resetlimits __P((void));
+	extern void drop_privileges __P((void));
 
 	/*
 	**  Check to see if we reentered.
@@ -228,6 +229,9 @@ main(argc, argv, envp)
 
 	tTsetup(tTdvect, sizeof tTdvect, "0-99.1");
 
+	/* drop group id privileges (RunAsUser not yet set) */
+	drop_privileges();
+
 	/* Handle any non-getoptable constructions. */
 	obsolete(argv);
 
@@ -245,7 +249,7 @@ main(argc, argv, envp)
 # define OPTIONS	"B:b:C:cd:e:F:f:h:IiM:mN:nO:o:p:q:R:r:sTtUV:vX:"
 #endif
 	opterr = 0;
-	while ((j = getopt(argc, argv, OPTIONS)) != EOF)
+	while ((j = getopt(argc, argv, OPTIONS)) != -1)
 	{
 		switch (j)
 		{
@@ -511,7 +515,7 @@ main(argc, argv, envp)
 		OpMode = MD_PURGESTAT;
 
 	optind = 1;
-	while ((j = getopt(argc, argv, OPTIONS)) != EOF)
+	while ((j = getopt(argc, argv, OPTIONS)) != -1)
 	{
 		switch (j)
 		{
@@ -806,10 +810,7 @@ main(argc, argv, envp)
 	if (OpMode != MD_DAEMON && OpMode != MD_FGDAEMON)
 	{
 		/* drop privileges -- daemon mode done after socket/bind */
-		if (RunAsGid != 0)
-			(void) setgid(RunAsGid);
-		if (RunAsUid != 0)
-			(void) setuid(RunAsUid);
+		drop_privileges();
 	}
 
 	/*
@@ -900,6 +901,20 @@ main(argc, argv, envp)
 		printf("Warning: HostStatusDirectory required for SingleThreadDelivery\n");
 	}
 
+	/* check for permissions */
+	if ((OpMode == MD_DAEMON || OpMode == MD_PURGESTAT) && RealUid != 0)
+	{
+#ifdef LOG
+		if (LogLevel > 1)
+			syslog(LOG_ALERT, "user %d attempted to %s",
+				RealUid,
+				OpMode == MD_DAEMON ? "run daemon"
+						    : "purge host status");
+#endif
+		usrerr("Permission denied");
+		exit(EX_USAGE);
+	}
+
 	if (MeToo)
 		BlankEnvelope.e_flags |= EF_METOO;
 
@@ -916,17 +931,6 @@ main(argc, argv, envp)
 		/* fall through ... */
 
 	  case MD_DAEMON:
-		/* check for permissions */
-		if (RealUid != 0)
-		{
-#ifdef LOG
-			if (LogLevel > 1)
-				syslog(LOG_ALERT, "user %d attempted to run daemon",
-					RealUid);
-#endif
-			usrerr("Permission denied");
-			exit(EX_USAGE);
-		}
 		vendor_daemon_setup(CurEnv);
 
 		/* remove things that don't make sense in daemon mode */
@@ -948,6 +952,11 @@ main(argc, argv, envp)
 		Verbose = TRUE;
 		/* fall through... */
 
+	  case MD_PRINT:
+		/* to handle sendmail -bp -qSfoobar properly */
+		queuemode = FALSE;
+		/* fall through... */
+
 	  default:
 		/* arrange to exit cleanly on hangup signal */
 		if (setsignal(SIGHUP, SIG_IGN) == (sigfunc_t) SIG_DFL)
@@ -1214,7 +1223,7 @@ main(argc, argv, envp)
 	if (OpMode == MD_TEST)
 	{
 		char buf[MAXLINE];
-		void intindebug();
+		SIGFUNC_DECL intindebug __P((int));
 
 		if (isatty(fileno(stdin)))
 			Verbose = TRUE;
@@ -1318,10 +1327,7 @@ main(argc, argv, envp)
 		nullserver = getrequests(CurEnv);
 
 		/* drop privileges */
-		if (RunAsGid != 0)
-			(void) setgid(RunAsGid);
-		if (RunAsUid != 0)
-			(void) setuid(RunAsUid);
+		drop_privileges();
 
 		/* at this point we are in a child: reset state */
 		(void) newenvelope(CurEnv, CurEnv);
@@ -1385,7 +1391,7 @@ main(argc, argv, envp)
 	if (warn_f_flag != '\0' && !wordinclass(RealUserName, 't'))
 		auth_warning(CurEnv, "%s set sender to %s using -%c",
 			RealUserName, from, warn_f_flag);
-	setsender(from, CurEnv, NULL, FALSE);
+	setsender(from, CurEnv, NULL, '\0', FALSE);
 	if (macvalue('s', CurEnv) == NULL)
 		define('s', RealHostName, CurEnv);
 
@@ -1450,10 +1456,12 @@ main(argc, argv, envp)
 }
 
 
-void
-intindebug()
+SIGFUNC_DECL
+intindebug(sig)
+	int sig;
 {
 	longjmp(TopFrame, 1);
+	return SIGFUNC_RETURN;
 }
 
 
@@ -1528,8 +1536,9 @@ finis()
 **		Unlocks the current job.
 */
 
-void
-intsig()
+SIGFUNC_DECL
+intsig(sig)
+	int sig;
 {
 #ifdef LOG
 	if (LogLevel > 79)
@@ -1944,15 +1953,18 @@ dumpstate(when)
 }
 
 
-void
-sigusr1()
+SIGFUNC_DECL
+sigusr1(sig)
+	int sig;
 {
 	dumpstate("user signal");
+	return SIGFUNC_RETURN;
 }
 
 
-void
-sighup()
+SIGFUNC_DECL
+sighup(sig)
+	int sig;
 {
 	if (SaveArgv[0][0] != '/')
 	{
@@ -1984,6 +1996,31 @@ sighup()
 	exit(EX_OSFILE);
 }
 /*
+**  DROP_PRIVILEGES -- reduce privileges to those of the RunAsUser option
+**
+**	Parameters:
+**		none.
+**
+**	Returns:
+**		none.
+*/
+
+void
+drop_privileges()
+{
+#ifdef NGROUPS_MAX
+	/* reset group permissions; these can be set later */
+	GIDSET_T emptygidset[NGROUPS_MAX];
+
+	emptygidset[0] = RunAsGid == 0 ? getegid() : RunAsGid;
+	(void) setgroups(1, emptygidset);
+#endif
+	if (RunAsGid != 0)
+		(void) setgid(RunAsGid);
+	if (RunAsUid != 0)
+		(void) setuid(RunAsUid);
+}
+/*
 **  TESTMODELINE -- process a test mode input line
 **
 **	Parameters:
diff --git a/usr.sbin/sendmail/src/mime.c b/usr.sbin/sendmail/src/mime.c
index bdb91a2..999c5ab 100644
--- a/usr.sbin/sendmail/src/mime.c
+++ b/usr.sbin/sendmail/src/mime.c
@@ -36,7 +36,7 @@
 # include <string.h>
 
 #ifndef lint
-static char sccsid[] = "@(#)mime.c	8.51 (Berkeley) 11/24/96";
+static char sccsid[] = "@(#)mime.c	8.54 (Berkeley) 1/14/97";
 #endif /* not lint */
 
 /*
@@ -958,10 +958,8 @@ mime7to8(mci, header, e)
 	register char *p;
 	char *cte;
 	char **pvp;
-	u_char *obp;
 	u_char *fbufp;
 	char buf[MAXLINE];
-	u_char obuf[MAXLINE + 1];
 	u_char fbuf[MAXLINE + 1];
 	char pvpbuf[MAXLINE];
 	extern u_char MimeTokenTab[256];
@@ -1045,9 +1043,10 @@ mime7to8(mci, header, e)
 			c2 = CHAR64(c2);
 
 			*fbufp = (c1 << 2) | ((c2 & 0x30) >> 4);
-			if (*fbufp++ == '\n' || fbuf >= &fbuf[MAXLINE])
+			if (*fbufp++ == '\n' || fbufp >= &fbuf[MAXLINE])
 			{
-				if (*--fbufp != '\n' || *--fbufp != '\r')
+				if (*--fbufp != '\n' ||
+				    (fbufp > fbuf && *--fbufp != '\r'))
 					fbufp++;
 				*fbufp = '\0';
 				putline((char *) fbuf, mci);
@@ -1057,9 +1056,10 @@ mime7to8(mci, header, e)
 				continue;
 			c3 = CHAR64(c3);
 			*fbufp = ((c2 & 0x0f) << 4) | ((c3 & 0x3c) >> 2);
-			if (*fbufp++ == '\n' || fbuf >= &fbuf[MAXLINE])
+			if (*fbufp++ == '\n' || fbufp >= &fbuf[MAXLINE])
 			{
-				if (*--fbufp != '\n' || *--fbufp != '\r')
+				if (*--fbufp != '\n' ||
+				    (fbufp > fbuf && *--fbufp != '\r'))
 					fbufp++;
 				*fbufp = '\0';
 				putline((char *) fbuf, mci);
@@ -1069,36 +1069,38 @@ mime7to8(mci, header, e)
 				continue;
 			c4 = CHAR64(c4);
 			*fbufp = ((c3 & 0x03) << 6) | c4;
-			if (*fbufp++ == '\n' || fbuf >= &fbuf[MAXLINE])
+			if (*fbufp++ == '\n' || fbufp >= &fbuf[MAXLINE])
 			{
-				if (*--fbufp != '\n' || *--fbufp != '\r')
+				if (*--fbufp != '\n' ||
+				    (fbufp > fbuf && *--fbufp != '\r'))
 					fbufp++;
 				*fbufp = '\0';
 				putline((char *) fbuf, mci);
 				fbufp = fbuf;
 			}
 		}
-
-		/* force out partial last line */
-		if (fbufp > fbuf)
-		{
-			*fbufp = '\0';
-			putline((char *) fbuf, mci);
-		}
 	}
 	else
 	{
 		/* quoted-printable */
-		obp = obuf;
+		fbufp = fbuf;
 		while (fgets(buf, sizeof buf, e->e_dfp) != NULL)
 		{
-			if (mime_fromqp((u_char *) buf, &obp, 0, &obuf[MAXLINE] - obp) == 0)
+			if (mime_fromqp((u_char *) buf, &fbufp, 0,
+					&fbuf[MAXLINE] - fbufp) == 0)
 				continue;
 
-			putline((char *) obuf, mci);
-			obp = obuf;
+			putline((char *) fbuf, mci);
+			fbufp = fbuf;
 		}
 	}
+
+	/* force out partial last line */
+	if (fbufp > fbuf)
+	{
+		*fbufp = '\0';
+		putline((char *) fbuf, mci);
+	}
 	if (tTd(43, 3))
 		printf("\t\t\tmime7to8 => %s to 8bit done\n", cte);
 }
diff --git a/usr.sbin/sendmail/src/readcf.c b/usr.sbin/sendmail/src/readcf.c
index 9e2c156..c868136 100644
--- a/usr.sbin/sendmail/src/readcf.c
+++ b/usr.sbin/sendmail/src/readcf.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)readcf.c	8.181 (Berkeley) 12/1/96";
+static char sccsid[] = "@(#)readcf.c	8.184 (Berkeley) 1/14/97";
 #endif /* not lint */
 
 # include "sendmail.h"
@@ -1482,6 +1482,14 @@ struct optioninfo
 	{ "SingleThreadDelivery",	O_SINGTHREAD,	FALSE	},
 #define O_RUNASUSER	0x9d
 	{ "RunAsUser",			O_RUNASUSER,	FALSE	},
+#ifdef _FFR_DSN_RRT
+#define O_DSN_RRT	0x9e
+	{ "RrtImpliesDsn",		O_DSN_RRT,	FALSE	},
+#endif
+#ifdef _FFR_PIDFILE_OPT
+#define O_PIDFILE	0x9f
+	{ "PidFile",			O_PIDFILE,	FALSE	},
+#endif
 
 	{ NULL,				'\0',		FALSE	}
 };
@@ -2264,6 +2272,19 @@ setoption(opt, val, safe, sticky, e)
 		}
 		break;
 
+#ifdef _FFR_DSN_RRT
+	  case O_DSN_RRT:
+		RrtImpliesDsn = atobool(p);
+		break;
+#endif
+
+#ifdef _FFR_PIDFILE_OPT
+	  case O_PIDFILE:
+		free(PidFile);
+		PidFile = newstr(p);
+		break;
+#endif
+
 	  default:
 		if (tTd(37, 1))
 		{
diff --git a/usr.sbin/sendmail/src/savemail.c b/usr.sbin/sendmail/src/savemail.c
index 9fb1c24..e3cbfa3 100644
--- a/usr.sbin/sendmail/src/savemail.c
+++ b/usr.sbin/sendmail/src/savemail.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)savemail.c	8.101 (Berkeley) 11/24/96";
+static char sccsid[] = "@(#)savemail.c	8.103 (Berkeley) 1/18/97";
 #endif /* not lint */
 
 # include "sendmail.h"
@@ -643,7 +643,7 @@ returntosender(msg, returnq, flags, e)
 	markstats(ee, NULLADDR);
 
 	/* actually deliver the error message */
-	sendall(ee, SM_DEFAULT);
+	sendall(ee, SM_DELIVER);
 
 	/* restore state */
 	dropenvelope(ee, TRUE);
@@ -1388,7 +1388,8 @@ xuntextify(t)
 **  XTEXTOK -- check if a string is legal xtext
 **
 **	Xtext is used in Delivery Status Notifications.  The spec was
-**	taken from draft-ietf-notary-mime-delivery-04.txt.
+**	taken from RFC 1891, ``SMTP Service Extension for Delivery
+**	Status Notifications''.
 **
 **	Parameters:
 **		s -- the string to check.
diff --git a/usr.sbin/sendmail/src/sendmail.8 b/usr.sbin/sendmail/src/sendmail.8
index 34c3f44..601ccd5 100644
--- a/usr.sbin/sendmail/src/sendmail.8
+++ b/usr.sbin/sendmail/src/sendmail.8
@@ -29,9 +29,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     @(#)sendmail.8	8.10 (Berkeley) 9/20/96
+.\"     @(#)sendmail.8	8.11 (Berkeley) 1/16/97
 .\"
-.Dd September 20, 1996
+.Dd January 16, 1997
 .Dt SENDMAIL 8
 .Os BSD 4
 .Sh NAME
@@ -293,7 +293,7 @@ be set when called by a network delivery agent such as
 .Nm rmail .
 .It Fl V Ar envid
 Set the original envelope id.
-This is propogated across SMTP to servers that support DSNs
+This is propagated across SMTP to servers that support DSNs
 and is returned in DSN-compliant error messages.
 .It Fl v
 Go into verbose mode.
diff --git a/usr.sbin/sendmail/src/sendmail.h b/usr.sbin/sendmail/src/sendmail.h
index 6aba9ab..9c0e3e2 100644
--- a/usr.sbin/sendmail/src/sendmail.h
+++ b/usr.sbin/sendmail/src/sendmail.h
@@ -31,7 +31,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)sendmail.h	8.216 (Berkeley) 12/1/96
+ *	@(#)sendmail.h	8.219 (Berkeley) 1/14/97
  */
 
 /*
@@ -41,7 +41,7 @@
 # ifdef _DEFINE
 # define EXTERN
 # ifndef lint
-static char SmailSccsId[] =	"@(#)sendmail.h	8.216		12/1/96";
+static char SmailSccsId[] =	"@(#)sendmail.h	8.219		1/14/97";
 # endif
 # else /*  _DEFINE */
 # define EXTERN extern
@@ -1135,7 +1135,7 @@ EXTERN bool	HasWildcardMX;	/* don't use MX records when canonifying */
 EXTERN char	SpaceSub;	/* substitution for <lwsp> */
 EXTERN int	PrivacyFlags;	/* privacy flags */
 EXTERN char	*ConfFile;	/* location of configuration file [conf.c] */
-extern char	*PidFile;	/* location of proc id file [conf.c] */
+EXTERN char	*PidFile;	/* location of proc id file [conf.c] */
 extern ADDRESS	NullAddress;	/* a null (template) address [main.c] */
 EXTERN long	WkClassFact;	/* multiplier for message class -> priority */
 EXTERN long	WkRecipFact;	/* multiplier for # of recipients -> priority */
@@ -1165,6 +1165,9 @@ EXTERN bool	AllowBogusHELO;	/* allow syntax errors on HELO command */
 EXTERN bool	UserSubmission;	/* initial (user) mail submission */
 EXTERN uid_t	RunAsUid;	/* UID to become for bulk of run */
 EXTERN gid_t	RunAsGid;	/* GID to become for bulk of run */
+#ifdef _FFR_DSN_RRT
+EXTERN bool	RrtImpliesDsn;	/* turn Return-Receipt-To: into DSN */
+#endif
 EXTERN bool	IgnoreHostStatus;	/* ignore long term host status files */
 EXTERN bool	SingleThreadDelivery;	/* single thread hosts on delivery */
 EXTERN bool	UnsafeGroupWrites;	/* group-writable files are unsafe */
@@ -1291,7 +1294,7 @@ extern void	makelower __P((char *));
 extern void	rebuildaliases __P((MAP *, bool));
 extern void	readaliases __P((MAP *, FILE *, bool, bool));
 extern void	finis __P(());
-extern void	setsender __P((char *, ENVELOPE *, char **, bool));
+extern void	setsender __P((char *, ENVELOPE *, char **, int, bool));
 extern FILE	*safefopen __P((char *, int, int, int));
 extern void	xputs __P((const char *));
 extern void	logsender __P((ENVELOPE *, char *));
diff --git a/usr.sbin/sendmail/src/srvrsmtp.c b/usr.sbin/sendmail/src/srvrsmtp.c
index fcc1e94..1195d8a 100644
--- a/usr.sbin/sendmail/src/srvrsmtp.c
+++ b/usr.sbin/sendmail/src/srvrsmtp.c
@@ -36,9 +36,9 @@
 
 #ifndef lint
 #if SMTP
-static char sccsid[] = "@(#)srvrsmtp.c	8.131 (Berkeley) 12/1/96 (with SMTP)";
+static char sccsid[] = "@(#)srvrsmtp.c	8.136 (Berkeley) 1/17/97 (with SMTP)";
 #else
-static char sccsid[] = "@(#)srvrsmtp.c	8.131 (Berkeley) 12/1/96 (without SMTP)";
+static char sccsid[] = "@(#)srvrsmtp.c	8.136 (Berkeley) 1/17/97 (without SMTP)";
 #endif
 #endif /* not lint */
 
@@ -121,7 +121,11 @@ char	*CurSmtpClient;			/* who's at the other end of channel */
 static char	*skipword();
 
 
-#define MAXBADCOMMANDS	25		/* maximum number of bad commands */
+#define MAXBADCOMMANDS	25	/* maximum number of bad commands */
+#define MAXNOOPCOMMANDS	20	/* max "noise" commands before slowdown */
+#define MAXHELOCOMMANDS	3	/* max HELO/EHLO commands before slowdown */
+#define MAXVRFYCOMMANDS	6	/* max VRFY/EXPN commands before slowdown */
+#define MAXETRNCOMMANDS	8	/* max ETRN commands before slowdown */
 
 void
 smtp(nullserver, e)
@@ -146,6 +150,8 @@ smtp(nullserver, e)
 	volatile int badcommands = 0;	/* count of bad commands */
 	volatile int nverifies = 0;	/* count of VRFY/EXPN commands */
 	volatile int n_etrn = 0;	/* count of ETRN commands */
+	volatile int n_noop = 0;	/* count of NOOP/VERB/ONEX etc cmds */
+	volatile int n_helo = 0;	/* count of HELO/EHLO commands */
 	bool ok;
 	char inp[MAXLINE];
 	char cmdbuf[MAXLINE];
@@ -154,6 +160,7 @@ smtp(nullserver, e)
 	extern void settime __P((ENVELOPE *));
 	extern bool enoughdiskspace __P((long));
 	extern int runinchild __P((char *, ENVELOPE *));
+	extern void checksmtpattack __P((volatile int *, int, char *));
 
 	if (fileno(OutChannel) != fileno(stdout))
 	{
@@ -303,10 +310,23 @@ smtp(nullserver, e)
 		**	to everything.
 		*/
 
-		if (nullserver && c->cmdcode != CMDQUIT)
+		if (nullserver)
 		{
-			message("550 Access denied");
-			continue;
+			switch (c->cmdcode)
+			{
+			  case CMDQUIT:
+			  case CMDHELO:
+			  case CMDEHLO:
+			  case CMDNOOP:
+				/* process normally */
+				break;
+
+			  default:
+				if (++badcommands > MAXBADCOMMANDS)
+					sleep(1);
+				message("550 Access denied");
+				continue;
+			}
 		}
 
 		/* non-null server */
@@ -325,6 +345,17 @@ smtp(nullserver, e)
 				SmtpPhase = "server HELO";
 			}
 
+			/* avoid denial-of-service */
+			checksmtpattack(&n_helo, MAXHELOCOMMANDS, "HELO/EHLO");
+
+			/* check for duplicate HELO/EHLO per RFC 1651 4.2 */
+			if (gothello)
+			{
+				message("503 %s Duplicate HELO/EHLO",
+					MyHostName);
+				break;
+			}
+
 			/* check for valid domain name (re 1123 5.2.5) */
 			if (*p == '\0' && !AllowBogusHELO)
 			{
@@ -355,20 +386,15 @@ smtp(nullserver, e)
 					if (!AllowBogusHELO)
 						message("501 Invalid domain name");
 					else
+					{
 						message("250 %s Invalid domain name, accepting anyway",
 							MyHostName);
+						gothello = TRUE;
+					}
 					break;
 				}
 			}
 
-			/* check for duplicate HELO/EHLO per RFC 1651 4.2 */
-			if (gothello)
-			{
-				message("503 %s Duplicate HELO/EHLO",
-					MyHostName);
-				break;
-			}
-
 			sendinghost = newstr(p);
 			gothello = TRUE;
 			if (c->cmdcode != CMDEHLO)
@@ -484,7 +510,7 @@ smtp(nullserver, e)
 
 			/* must parse sender first */
 			delimptr = NULL;
-			setsender(p, e, &delimptr, FALSE);
+			setsender(p, e, &delimptr, ' ', FALSE);
 			if (delimptr != NULL && *delimptr != '\0')
 				*delimptr++ = '\0';
 
@@ -775,18 +801,8 @@ smtp(nullserver, e)
 
 		  case CMDVRFY:		/* vrfy -- verify address */
 		  case CMDEXPN:		/* expn -- expand address */
-			if (++nverifies >= MAXBADCOMMANDS)
-			{
-#ifdef LOG
-				if (nverifies == MAXBADCOMMANDS &&
-				    LogLevel > 5)
-				{
-					syslog(LOG_INFO, "%.100s: VRFY attack?",
-					       CurSmtpClient);
-				}
-#endif
-				sleep(1);
-			}
+			checksmtpattack(&nverifies, MAXVRFYCOMMANDS,
+				c->cmdcode == CMDVRFY ? "VRFY" : "EXPN");
 			vrfy = c->cmdcode == CMDVRFY;
 			if (bitset(vrfy ? PRIV_NOVRFY : PRIV_NOEXPN,
 						PrivacyFlags))
@@ -867,8 +883,8 @@ smtp(nullserver, e)
 			}
 
 			/* crude way to avoid denial-of-service attacks */
-			if (n_etrn++ >= 3)
-				sleep(3);
+			checksmtpattack(&n_etrn, MAXETRNCOMMANDS, "ETRN");
+
 			id = p;
 			if (*id == '@')
 				id++;
@@ -892,6 +908,7 @@ smtp(nullserver, e)
 			break;
 
 		  case CMDNOOP:		/* noop -- do nothing */
+			checksmtpattack(&n_noop, MAXNOOPCOMMANDS, "NOOP");
 			message("250 OK");
 			break;
 
@@ -916,17 +933,20 @@ doquit:
 				message("502 Verbose unavailable");
 				break;
 			}
+			checksmtpattack(&n_noop, MAXNOOPCOMMANDS, "VERB");
 			Verbose = TRUE;
 			e->e_sendmode = SM_DELIVER;
 			message("250 Verbose mode");
 			break;
 
 		  case CMDONEX:		/* doing one transaction only */
+			checksmtpattack(&n_noop, MAXNOOPCOMMANDS, "ONEX");
 			OneXact = TRUE;
 			message("250 Only one transaction");
 			break;
 
 		  case CMDXUSR:		/* initial (user) submission */
+			checksmtpattack(&n_noop, MAXNOOPCOMMANDS, "XUSR");
 			UserSubmission = TRUE;
 			message("250 Initial submission");
 			break;
@@ -976,6 +996,40 @@ doquit:
 	}
 }
 /*
+**  CHECKSMTPATTACK -- check for denial-of-service attack by repetition
+**
+**	Parameters:
+**		pcounter -- pointer to a counter for this command.
+**		maxcount -- maximum value for this counter before we
+**			slow down.
+**		cname -- command name for logging.
+**
+**	Returns:
+**		none.
+**
+**	Side Effects:
+**		Slows down if we seem to be under attack.
+*/
+
+void
+checksmtpattack(pcounter, maxcount, cname)
+	volatile int *pcounter;
+	int maxcount;
+	char *cname;
+{
+	if (++(*pcounter) >= maxcount)
+	{
+#ifdef LOG
+		if (*pcounter == maxcount && LogLevel > 5)
+		{
+			syslog(LOG_INFO, "%.100s: %.40s attack?",
+			       CurSmtpClient, cname);
+		}
+#endif
+		sleep(*pcounter / maxcount);
+	}
+}
+/*
 **  SKIPWORD -- skip a fixed word.
 **
 **	Parameters:
diff --git a/usr.sbin/sendmail/src/udb.c b/usr.sbin/sendmail/src/udb.c
index 8e52303..af4c298 100644
--- a/usr.sbin/sendmail/src/udb.c
+++ b/usr.sbin/sendmail/src/udb.c
@@ -36,9 +36,9 @@
 
 #ifndef lint
 #if USERDB
-static char sccsid [] = "@(#)udb.c	8.46 (Berkeley) 12/1/96 (with USERDB)";
+static char sccsid [] = "@(#)udb.c	8.47 (Berkeley) 12/6/96 (with USERDB)";
 #else
-static char sccsid [] = "@(#)udb.c	8.46 (Berkeley) 12/1/96 (without USERDB)";
+static char sccsid [] = "@(#)udb.c	8.47 (Berkeley) 12/6/96 (without USERDB)";
 #endif
 #endif
 
@@ -275,7 +275,7 @@ udbexpand(a, sendq, aliaslevel, e)
 					userleft--;
 				}
 				bcopy(info.data, p, info.size);
-				user[info.size] = '\0';
+				p[info.size] = '\0';
 				userleft -= info.size;
 
 				/* get the next record */
diff --git a/usr.sbin/sendmail/src/usersmtp.c b/usr.sbin/sendmail/src/usersmtp.c
index af6adc2..23d1348 100644
--- a/usr.sbin/sendmail/src/usersmtp.c
+++ b/usr.sbin/sendmail/src/usersmtp.c
@@ -36,9 +36,9 @@
 
 #ifndef lint
 #if SMTP
-static char sccsid[] = "@(#)usersmtp.c	8.79 (Berkeley) 12/1/96 (with SMTP)";
+static char sccsid[] = "@(#)usersmtp.c	8.80 (Berkeley) 1/18/97 (with SMTP)";
 #else
-static char sccsid[] = "@(#)usersmtp.c	8.79 (Berkeley) 12/1/96 (without SMTP)";
+static char sccsid[] = "@(#)usersmtp.c	8.80 (Berkeley) 1/18/97 (without SMTP)";
 #endif
 #endif /* not lint */
 
@@ -493,6 +493,12 @@ smtpmailfrom(m, mci, e)
 		smtpquit(m, mci, e);
 		return EX_TEMPFAIL;
 	}
+	else if (r == 452 && bitset(MCIF_SIZE, mci->mci_flags) &&
+		 e->e_msgsize > 0)
+	{
+		mci_setstat(mci, EX_NOTSTICKY, smtptodsn(r), SmtpReplyBuffer);
+		return EX_TEMPFAIL;
+	}
 	else if (REPLYTYPE(r) == 4)
 	{
 		mci_setstat(mci, EX_TEMPFAIL, smtptodsn(r), SmtpReplyBuffer);
@@ -684,6 +690,7 @@ smtpdata(m, mci, e)
 	register int r;
 	register EVENT *ev;
 	int rstat;
+	int xstat;
 	time_t timeout;
 
 	/*
@@ -790,17 +797,22 @@ smtpdata(m, mci, e)
 		return EX_TEMPFAIL;
 	}
 	mci->mci_state = MCIS_OPEN;
-	if (REPLYTYPE(r) == 4)
+	xstat = EX_NOTSTICKY;
+	if (r == 452)
 		rstat = EX_TEMPFAIL;
+	else if (r == 552)
+		rstat = EX_UNAVAILABLE;
+	else if (REPLYTYPE(r) == 4)
+		rstat = xstat = EX_TEMPFAIL;
 	else if (REPLYCLASS(r) != 5)
-		rstat = EX_PROTOCOL;
+		rstat = xstat = EX_PROTOCOL;
 	else if (REPLYTYPE(r) == 2)
-		rstat = EX_OK;
+		rstat = xstat = EX_OK;
 	else if (REPLYTYPE(r) == 5)
-		rstat = EX_UNAVAILABLE;
+		rstat = xstat = EX_UNAVAILABLE;
 	else
 		rstat = EX_PROTOCOL;
-	mci_setstat(mci, rstat, smtptodsn(r), SmtpReplyBuffer);
+	mci_setstat(mci, xstat, smtptodsn(r), SmtpReplyBuffer);
 	if (e->e_statmsg != NULL)
 		free(e->e_statmsg);
 	e->e_statmsg = newstr(&SmtpReplyBuffer[4]);
diff --git a/usr.sbin/sendmail/src/util.c b/usr.sbin/sendmail/src/util.c
index 0eee2f2..242b615 100644
--- a/usr.sbin/sendmail/src/util.c
+++ b/usr.sbin/sendmail/src/util.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)util.c	8.113 (Berkeley) 11/24/96";
+static char sccsid[] = "@(#)util.c	8.115 (Berkeley) 1/5/97";
 #endif /* not lint */
 
 # include "sendmail.h"
@@ -313,7 +313,7 @@ xputs(s)
 			{
 				if (bitset(0200, *s))
 					printf("{%s}", macname(*s++ & 0377));
-				else
+				else if (*s != '\0')
 					printf("%c", *s++);
 			}
 			if (mp->metaname != '\0')
@@ -670,7 +670,9 @@ safefile(fn, uid, gid, uname, flags, mode, st)
 		return EPERM;
 	}
 
-	if (uid == 0 && !bitset(SFF_ROOTOK, flags))
+	if (uid == 0 && bitset(SFF_OPENASROOT, flags))
+		;
+	else if (uid == 0 && !bitset(SFF_ROOTOK, flags))
 		mode >>= 6;
 	else if (st->st_uid != uid)
 	{