summaryrefslogtreecommitdiffstats
path: root/src/postmulti/postmulti.c
blob: bffb8edfa0c852c8795562e263e49dda7022b978 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
/*++
/* NAME
/*	postmulti 1
/* SUMMARY
/*	Postfix multi-instance manager
/* SYNOPSIS
/* .fi
/* .ti -4
/*	\fBEnabling multi-instance management:\fR
/*
/*	\fBpostmulti\fR \fB-e init\fR [\fB-v\fR]
/*
/* .ti -4
/*	\fBIterator mode:\fR
/*
/*	\fBpostmulti\fR \fB-l\fR [\fB-aRv\fR] [\fB-g \fIgroup\fR]
/*	[\fB-i \fIname\fR]
/*
/*	\fBpostmulti\fR \fB-p\fR [\fB-av\fR] [\fB-g \fIgroup\fR]
/*	[\fB-i \fIname\fR] \fIpostfix-command...\fR
/*
/*	\fBpostmulti\fR \fB-x\fR [\fB-aRv\fR] [\fB-g \fIgroup\fR]
/*	[\fB-i \fIname\fR] \fIunix-command...\fR
/*
/* .ti -4
/*	\fBLife-cycle management:\fR
/*
/*	\fBpostmulti\fR \fB-e create\fR [\fB-av\fR]
/*	[\fB-g \fIgroup\fR] [\fB-i \fIname\fR] [\fB-G \fIgroup\fR]
/*	[\fB-I \fIname\fR] [\fIparam=value\fR ...]
/*
/*	\fBpostmulti\fR \fB-e import\fR [\fB-av\fR]
/*	[\fB-g \fIgroup\fR] [\fB-i \fIname\fR] [\fB-G \fIgroup\fR]
/*	[\fB-I \fIname\fR] [\fBconfig_directory=\fI/path\fR]
/*
/*	\fBpostmulti\fR \fB-e destroy\fR [\fB-v\fR] \fB-i \fIname\fR
/*
/*	\fBpostmulti\fR \fB-e deport\fR [\fB-v\fR] \fB-i \fIname\fR
/*
/*	\fBpostmulti\fR \fB-e enable\fR [\fB-v\fR] \fB-i \fIname\fR
/*
/*	\fBpostmulti\fR \fB-e disable\fR [\fB-v\fR] \fB-i \fIname\fR
/*
/*	\fBpostmulti\fR \fB-e assign\fR [\fB-v\fR] \fB-i \fIname\fR
/*	[\fB-I \fIname\fR] [-G \fIgroup\fR]
/* DESCRIPTION
/*	The \fBpostmulti\fR(1) command allows a Postfix administrator
/*	to manage multiple Postfix instances on a single host.
/*
/*	\fBpostmulti\fR(1) implements two fundamental modes of
/*	operation.  In \fBiterator\fR mode, it executes the same
/*	command for multiple Postfix instances.  In \fBlife-cycle
/*	management\fR mode, it adds or deletes one instance, or
/*	changes the multi-instance status of one instance.
/*
/*	Each mode of operation has its own command syntax. For this
/*	reason, each mode is documented in separate sections below.
/* BACKGROUND
/* .ad
/* .fi
/*	A multi-instance configuration consists of one primary
/*	Postfix instance, and one or more secondary instances whose
/*	configuration directory pathnames are recorded in the primary
/*	instance's main.cf file. Postfix instances share program
/*	files and documentation, but have their own configuration,
/*	queue and data directories.
/*
/*	Currently, only the default Postfix instance can be used
/*	as primary instance in a multi-instance configuration. The
/*	\fBpostmulti\fR(1) command does not currently support a \fB-c\fR
/*	option to select an alternative primary instance, and exits
/*	with a fatal error if the \fBMAIL_CONFIG\fR environment
/*	variable is set to a non-default configuration directory.
/*
/*	See the MULTI_INSTANCE_README tutorial for a more detailed
/*	discussion of multi-instance management with \fBpostmulti\fR(1).
/* ITERATOR MODE
/* .ad
/* .fi
/*	In iterator mode, \fBpostmulti\fR performs the same operation
/*	on all Postfix instances in turn.
/*
/*	If multi-instance support is not enabled, the requested
/*	command is performed just for the primary instance.
/* .PP
/*	Iterator mode implements the following command options:
/* .SH "Instance selection"
/* .IP \fB-a\fR
/*	Perform the operation on all instances. This is the default.
/* .IP "\fB-g \fIgroup\fR"
/*	Perform the operation only for members of the named \fIgroup\fR.
/* .IP "\fB-i \fIname\fR"
/*	Perform the operation only for the instance with the specified
/*	\fIname\fR.  You can specify either the instance name
/*	or the absolute pathname of the instance's configuration
/*	directory.  Specify "-" to select the primary Postfix instance.
/* .IP \fB-R\fR
/*	Reverse the iteration order. This may be appropriate when
/*	updating a multi-instance system, where "sink" instances
/*	are started before "source" instances.
/* .sp
/*	This option cannot be used with \fB-p\fR.
/* .SH "List mode"
/* .IP \fB-l\fR
/*	List Postfix instances with their instance name, instance
/*	group name, enable/disable status and configuration directory.
/* .SH "Postfix-wrapper mode"
/* .IP "\fB-p \fIpostfix-command\fR"
/*	Invoke \fBpostfix(1)\fR to execute \fIpostfix-command\fR.
/*	This option implements the \fBpostfix-wrapper\fR(5) interface.
/* .RS
/* .IP \(bu
/*	With "start"-like commands, "postfix check" is executed for
/*	instances that are not enabled. The full list of commands
/*	is specified with the postmulti_start_commands parameter.
/* .IP \(bu
/*	With "stop"-like commands, the iteration order is reversed,
/*	and disabled instances are skipped. The full list of commands
/*	is specified with the postmulti_stop_commands parameter.
/* .IP \(bu
/*	With "reload" and other commands that require a started
/*	instance, disabled instances are skipped. The full list of
/*	commands is specified with the postmulti_control_commands
/*	parameter.
/* .IP \(bu
/*	With "status" and other commands that don't require a started
/*	instance, the command is executed for all instances.
/* .RE
/* .IP
/*	The \fB-p\fR option can also be used interactively to
/*	start/stop/etc.  a named instance or instance group. For
/*	example, to start just the instances in the group "msa",
/*	invoke \fBpostmulti\fR(1) as follows:
/* .RS
/* .IP
/*	# postmulti -g msa -p start
/* .RE
/* .SH "Command mode"
/* .IP "\fB-x \fIunix-command\fR"
/*	Execute the specified \fIunix-command\fR for all Postfix instances.
/*	The command runs with appropriate environment settings for
/*	MAIL_CONFIG, command_directory, daemon_directory,
/*	config_directory, queue_directory, data_directory,
/*	multi_instance_name, multi_instance_group and
/*	multi_instance_enable.
/* .SH "Other options"
/* .IP \fB-v\fR
/*	Enable verbose logging for debugging purposes. Multiple
/*	\fB-v\fR options make the software increasingly verbose.
/* LIFE-CYCLE MANAGEMENT MODE
/* .ad
/* .fi
/*	With the \fB-e\fR option \fBpostmulti\fR(1) can be used to
/*	add or delete a Postfix instance, and to manage the
/*	multi-instance status of an existing instance.
/* .PP
/*	The following options are implemented:
/* .SH "Existing instance selection"
/* .IP \fB-a\fR
/*	When creating or importing an instance, place the new
/*	instance at the front of the secondary instance list.
/* .IP "\fB-g \fIgroup\fR"
/*	When creating or importing an instance, place the new
/*	instance before the first secondary instance that is a
/*	member of the specified group.
/* .IP "\fB-i \fIname\fR"
/*	When creating or importing an instance, place the new
/*	instance before the matching secondary instance.
/* .sp
/*	With other life-cycle operations, apply the operation to
/*	the named existing instance.  Specify "-" to select the
/*	primary Postfix instance.
/* .SH "New or existing instance name assignment"
/* .IP "\fB-I \fIname\fR"
/*	Assign the specified instance \fIname\fR to an existing
/*	instance, newly-created instance, or imported instance.
/*	Instance
/*	names other than "-" (which makes the instance "nameless")
/*	must start with "postfix-".  This restriction reduces the
/*	likelihood of name collisions with system files.
/* .IP "\fB-G \fIgroup\fR"
/*	Assign the specified \fIgroup\fR name to an existing instance
/*	or to a newly created or imported instance.
/* .SH "Instance creation/deletion/status change"
/* .IP "\fB-e \fIaction\fR"
/*	"Edit" managed instances. The following actions are supported:
/* .RS
/* .IP \fBinit\fR
/*	This command is required before \fBpostmulti\fR(1) can be
/*	used to manage Postfix instances.  The "postmulti -e init"
/*	command updates the primary instance's main.cf file by
/*	setting:
/* .RS
/* .IP
/* .nf
/*	multi_instance_wrapper =
/*		${command_directory}/postmulti -p --
/*	multi_instance_enable = yes
/* .fi
/* .RE
/* .IP
/*	You can set these by other means if you prefer.
/* .IP \fBcreate\fR
/*	Create a new Postfix instance and add it to the
/*	multi_instance_directories parameter of the primary instance.
/*	The "\fB-I \fIname\fR" option is recommended to give the
/*	instance a short name that is used to construct default
/*	values for the private directories of the new instance. The
/*	"\fB-G \fIgroup\fR" option may be specified to assign the
/*	instance to a group, otherwise, the new instance is not a
/*	member of any groups.
/* .sp
/*	The new instance main.cf is the stock main.cf with the
/*	parameters that specify the locations of shared files cloned
/*	from the primary instance.  For "nameless" instances, you
/*	should manually adjust "syslog_name" to yield a unique
/*	"logtag" starting with "postfix-" that will uniquely identify
/*	the instance in the mail logs. It is simpler to assign the
/*	instance a short name with the "\fB-I \fIname\fR" option.
/* .sp
/*	Optional "name=value" arguments specify the instance
/*	config_directory, queue_directory and data_directory.
/*	For example:
/* .RS
/* .IP
/* .nf
/*	# postmulti -I postfix-mumble \e
/*		-G mygroup -e create \e
/*		config_directory=/my/config/dir \e
/*		queue_directory=/my/queue/dir \e
/*		data_directory=/my/data/dir
/* .fi
/* .RE
/* .IP
/*	If any of these pathnames is not supplied, the program
/*	attempts to generate the pathname by taking the corresponding
/*	primary instance pathname, and by replacing the last pathname
/*	component by the value of the \fB-I\fR option.
/* .sp
/*	If the instance configuration directory already exists, and
/*	contains both a main.cf and master.cf file, \fBcreate\fR
/*	will "import" the instance as-is. For existing instances,
/*	\fBcreate\fR and \fBimport\fR are identical.
/* .IP \fBimport\fR
/*	Import an existing instance into the list of instances
/*	managed by the \fBpostmulti\fR(1) multi-instance manager.
/*	This adds the instance to the multi_instance_directories
/*	list of the primary instance.  If the "\fB-I \fIname\fR"
/*	option is provided it specifies the new name for the instance
/*	and is used to define a default location for the instance
/*	configuration directory	(as with \fBcreate\fR above).  The
/*	"\fB-G \fIgroup\fR" option may be used to assign the instance
/*	to a group. Add a "\fBconfig_directory=\fI/path\fR" argument
/*	to override a default pathname based on "\fB-I \fIname\fR".
/* .IP \fBdestroy\fR
/*	Destroy a secondary Postfix instance. To be a candidate for
/*	destruction an instance must be disabled, stopped and its
/*	queue must not contain any messages. Attempts to destroy
/*	the primary Postfix instance trigger a fatal error, without
/*	destroying the instance.
/* .sp
/*	The instance is removed from the primary instance main.cf
/*	file's alternate_config_directories parameter and its data,
/*	queue and configuration directories are cleaned of files
/*	and directories created by the Postfix system. The main.cf
/*	and master.cf files are removed from the configuration
/*	directory even if they have been modified since initial
/*	creation. Finally, the instance is "deported" from the list
/*	of managed instances.
/* .sp
/*	If other files are present in instance private directories,
/*	the directories may not be fully removed, a warning is
/*	logged to alert the administrator. It is expected that an
/*	instance built using "fresh" directories via the \fBcreate\fR
/*	action will be fully removed by the \fBdestroy\fR action
/*	(if first disabled). If the instance configuration and queue
/*	directories are populated with additional files	(access and
/*	rewriting tables, chroot jail content, etc.) the instance
/*	directories will not be fully removed.
/* .sp
/*	The \fBdestroy\fR action triggers potentially dangerous
/*	file removal operations. Make sure the instance's data,
/*	queue and configuration directories are set correctly and
/*	do not contain any valuable files.
/* .IP \fBdeport\fR
/*	Deport a secondary instance from the list of managed
/*	instances. This deletes the instance configuration directory
/*	from the primary instance's multi_instance_directories list,
/*	but does not remove any files or directories.
/* .IP \fBassign\fR
/*	Assign a new instance name or a new group name to the
/*	selected instance.  Use "\fB-G -\fR" to specify "no group"
/*	and "\fB-I -\fR" to specify "no name".  If you choose to
/*	make an instance "nameless", set a suitable syslog_name in
/*	the corresponding main.cf file.
/* .IP \fBenable\fR
/*	Mark the selected instance as enabled. This just sets the
/*	multi_instance_enable parameter to "yes" in the instance's
/*	main.cf file.
/* .IP \fBdisable\fR
/*	Mark the selected instance as disabled. This means that
/*	the instance will not be started etc. with "postfix start",
/*	"postmulti -p start" and so on. The instance can still be
/*	started etc. with "postfix -c config-directory start".
/* .SH "Other options"
/* .IP \fB-v\fR
/*	Enable verbose logging for debugging purposes. Multiple
/*	\fB-v\fR options make the software increasingly verbose.
/* .RE
/* ENVIRONMENT
/* .ad
/* .fi
/*	The \fBpostmulti\fR(1) command exports the following environment
/*	variables before executing the requested \fIcommand\fR for a given
/*	instance:
/* .IP \fBMAIL_VERBOSE\fR
/*	This is set when the -v command-line option is present.
/* .IP \fBMAIL_CONFIG\fR
/*	The location of the configuration directory of the instance.
/* CONFIGURATION PARAMETERS
/* .ad
/* .fi
/* .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
/*	The default location of the Postfix main.cf and master.cf
/*	configuration files.
/* .IP "\fBdaemon_directory (see 'postconf -d' output)\fR"
/*	The directory with Postfix support programs and daemon programs.
/* .IP "\fBimport_environment (see 'postconf -d' output)\fR"
/*	The list of environment parameters that a privileged Postfix
/*	process will import from a non-Postfix parent process, or name=value
/*	environment overrides.
/* .IP "\fBmulti_instance_directories (empty)\fR"
/*	An optional list of non-default Postfix configuration directories;
/*	these directories belong to additional Postfix instances that share
/*	the Postfix executable files and documentation with the default
/*	Postfix instance, and that are started, stopped, etc., together
/*	with the default Postfix instance.
/* .IP "\fBmulti_instance_group (empty)\fR"
/*	The optional instance group name of this Postfix instance.
/* .IP "\fBmulti_instance_name (empty)\fR"
/*	The optional instance name of this Postfix instance.
/* .IP "\fBmulti_instance_enable (no)\fR"
/*	Allow this Postfix instance to be started, stopped, etc., by a
/*	multi-instance manager.
/* .IP "\fBpostmulti_start_commands (start)\fR"
/*	The \fBpostfix\fR(1) commands that the \fBpostmulti\fR(1) instance manager treats
/*	as "start" commands.
/* .IP "\fBpostmulti_stop_commands (see 'postconf -d' output)\fR"
/*	The \fBpostfix\fR(1) commands that the \fBpostmulti\fR(1) instance manager treats
/*	as "stop" commands.
/* .IP "\fBpostmulti_control_commands (reload flush)\fR"
/*	The \fBpostfix\fR(1) commands that the \fBpostmulti\fR(1) instance manager
/*	treats as "control" commands, that operate on running instances.
/* .IP "\fBsyslog_facility (mail)\fR"
/*	The syslog facility of Postfix logging.
/* .IP "\fBsyslog_name (see 'postconf -d' output)\fR"
/*	A prefix that is prepended to the process name in syslog
/*	records, so that, for example, "smtpd" becomes "prefix/smtpd".
/* .PP
/*	Available in Postfix 3.0 and later:
/* .IP "\fBmeta_directory (see 'postconf -d' output)\fR"
/*	The location of non-executable files that are shared among
/*	multiple Postfix instances, such as postfix-files, dynamicmaps.cf,
/*	and the multi-instance template files main.cf.proto and master.cf.proto.
/* .IP "\fBshlib_directory (see 'postconf -d' output)\fR"
/*	The location of Postfix dynamically-linked libraries
/*	(libpostfix-*.so), and the default location of Postfix database
/*	plugins (postfix-*.so) that have a relative pathname in the
/*	dynamicmaps.cf file.
/* FILES
/*	$meta_directory/main.cf.proto, stock configuration file
/*	$meta_directory/master.cf.proto, stock configuration file
/*	$daemon_directory/postmulti-script, life-cycle helper program
/* SEE ALSO
/*	postfix(1), Postfix control program
/*	postfix-wrapper(5), Postfix multi-instance API
/* README FILES
/* .ad
/* .fi
/*	Use "\fBpostconf readme_directory\fR" or "\fBpostconf
/*	html_directory\fR" to locate this information.
/* .nf
/* .na
/*	MULTI_INSTANCE_README, Postfix multi-instance management
/* HISTORY
/* .ad
/* .fi
/*	The \fBpostmulti\fR(1) command was introduced with Postfix
/*	version 2.6.
/* LICENSE
/* .ad
/* .fi
/*	The Secure Mailer license must be distributed with this software.
/* AUTHOR(S)
/*	Victor Duchovni
/*	Morgan Stanley
/*
/*	Wietse Venema
/*	IBM T.J. Watson Research
/*	P.O. Box 704
/*	Yorktown Heights, NY 10598, USA
/*
/*	Wietse Venema
/*	Google, Inc.
/*	111 8th Avenue
/*	New York, NY 10011, USA
/*--*/

/* System library. */

#include <sys_defs.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <vstream.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <fcntl.h>
#include <errno.h>
#include <ctype.h>
#ifdef USE_PATHS_H
#include <paths.h>
#endif
#include <stddef.h>

/* Utility library. */

#include <msg.h>
#include <msg_vstream.h>
#include <vstream.h>
#include <vstring_vstream.h>
#include <stringops.h>
#include <clean_env.h>
#include <argv.h>
#include <safe.h>
#include <mymalloc.h>
#include <htable.h>
#include <name_code.h>
#include <ring.h>
#include <warn_stat.h>

/* Global library. */

#include <mail_version.h>
#include <mail_params.h>
#include <mail_conf.h>
#include <mail_parm_split.h>
#include <maillog_client.h>

/* Application-specific. */

 /*
  * Configuration parameters, specific to postmulti(1).
  */
char   *var_multi_start_cmds;
char   *var_multi_stop_cmds;
char   *var_multi_cntrl_cmds;

 /*
  * Shared directory pathnames.
  */
typedef struct {
    const char *param_name;
    char  **param_value;
} SHARED_PATH;

static SHARED_PATH shared_dir_table[] = {
    VAR_COMMAND_DIR, &var_command_dir,
    VAR_DAEMON_DIR, &var_daemon_dir,
    VAR_META_DIR, &var_meta_dir,
    VAR_SHLIB_DIR, &var_shlib_dir,
    0,
};

 /*
  * Actions.
  */
#define ITER_CMD_POSTFIX	(1<<0)	/* postfix(1) iterator mode */
#define ITER_CMD_LIST		(1<<1)	/* listing iterator mode */
#define ITER_CMD_GENERIC	(1<<2)	/* generic command iterator mode */

#define ITER_CMD_MASK_ALL \
    (ITER_CMD_POSTFIX | ITER_CMD_LIST | ITER_CMD_GENERIC)

#define EDIT_CMD_CREATE		(1<<4)	/* create new instance */
#define EDIT_CMD_IMPORT		(1<<5)	/* import existing instance */
#define EDIT_CMD_DESTROY	(1<<6)	/* destroy instance */
#define EDIT_CMD_DEPORT		(1<<7)	/* export instance */
#define EDIT_CMD_ENABLE		(1<<8)	/* enable start/stop */
#define EDIT_CMD_DISABLE	(1<<9)	/* disable start/stop */
#define EDIT_CMD_ASSIGN		(1<<10)	/* assign name/group */
#define EDIT_CMD_INIT		(1<<11)	/* hook into main.cf */

#define EDIT_CMD_MASK_ADD	(EDIT_CMD_CREATE | EDIT_CMD_IMPORT)
#define EDIT_CMD_MASK_DEL	(EDIT_CMD_DESTROY | EDIT_CMD_DEPORT)
#define EDIT_CMD_MASK_ASSIGN	(EDIT_CMD_MASK_ADD | EDIT_CMD_ASSIGN)
#define EDIT_CMD_MASK_ENB	(EDIT_CMD_ENABLE | EDIT_CMD_DISABLE)
#define EDIT_CMD_MASK_ALL \
    (EDIT_CMD_MASK_ASSIGN | EDIT_CMD_MASK_DEL | EDIT_CMD_MASK_ENB | \
	EDIT_CMD_INIT)

 /*
  * Edit command to number mapping, and vice versa.
  */
static NAME_CODE edit_command_table[] = {
    "create", EDIT_CMD_CREATE,
    "import", EDIT_CMD_IMPORT,
    "destroy", EDIT_CMD_DESTROY,
    "deport", EDIT_CMD_DEPORT,
    "enable", EDIT_CMD_ENABLE,
    "disable", EDIT_CMD_DISABLE,
    "assign", EDIT_CMD_ASSIGN,
    "init", EDIT_CMD_INIT,
    0, -1,
};

#define EDIT_CMD_CODE(str) \
	name_code(edit_command_table, NAME_CODE_FLAG_STRICT_CASE, (str))
#define EDIT_CMD_STR(code)	str_name_code(edit_command_table, (code))

 /*
  * Mandatory prefix for non-empty instance names.
  */
#ifndef NAME_PREFIX
#define NAME_PREFIX "postfix-"
#endif
#define HAS_NAME_PREFIX(name) \
     (strncmp((name), NAME_PREFIX, sizeof(NAME_PREFIX)-1) == 0)
#define NEED_NAME_PREFIX(name) \
    ((name) != 0 && strcmp((name), "-") != 0 && !HAS_NAME_PREFIX(name))
#define NAME_SUFFIX(name) ((name) + sizeof(NAME_PREFIX) - 1)

 /*
  * In-core instance structure. Only private information is kept here.
  */
typedef struct instance {
    RING    ring;			/* linkage. */
    char   *config_dir;			/* private */
    char   *queue_dir;			/* private */
    char   *data_dir;			/* private */
    char   *name;			/* null or name */
    char   *gname;			/* null or group */
    int     enabled;			/* start/stop enable */
    int     primary;			/* special */
} INSTANCE;

 /*
  * Managed instance list (edit mode and iterator mode).
  */
static RING instance_hd[1];		/* instance list head */

#define RING_TO_INSTANCE(ring_ptr)	RING_TO_APPL(ring_ptr, INSTANCE, ring)
#define RING_PTR_OF(x)			(&((x)->ring))

#define FOREACH_INSTANCE(entry) \
    for ((entry) = instance_hd; \
	 ((entry) = ring_succ(entry)) != instance_hd;)

#define FOREACH_SECONDARY_INSTANCE(entry) \
    for ((entry) = ring_succ(instance_hd); \
	 ((entry) = ring_succ(entry)) != instance_hd;)

#define NEXT_ITERATOR_INSTANCE(flags, entry) \
    (((flags) & ITER_FLAG_REVERSE) ? ring_pred(entry) : ring_succ(entry))

#define FOREACH_ITERATOR_INSTANCE(flags, entry) \
    for ((entry) = instance_hd; \
	((entry) = NEXT_ITERATOR_INSTANCE(flags, (entry))) != instance_hd;)

 /*
  * Instance selection. One can either select all instances, select by
  * instance name, or select by instance group.
  */
typedef struct {
    int     type;			/* see below */
    char   *name;			/* undefined or name */
} INST_SELECTION;

#define INST_SEL_NONE		0	/* default: no selection */
#define INST_SEL_ALL		1	/* select all instances */
#define INST_SEL_NAME		2	/* select instance name */
#define INST_SEL_GROUP		3	/* select instance group */

 /*
  * Instance name assignment. Each instance may be assigned an instance name
  * (this must be globally unique within a multi-instance cluster) or an
  * instance group name (this is intended to be shared). Externally, empty
  * names may be represented as "-". Internally, we use "" only, to simplify
  * the code.
  */
typedef struct {
    char   *name;			/* null or assigned instance name */
    char   *gname;			/* null or assigned group name */
} NAME_ASSIGNMENT;

 /*
  * Iterator controls for non-edit commands. One can reverse the iteration
  * order, or give special treatment to disabled instances.
  */
#define ITER_FLAG_DEFAULT	0	/* default setting */
#define ITER_FLAG_REVERSE	(1<<0)	/* reverse iteration order */
#define ITER_FLAG_CHECK_DISABLED (1<<1)	/* check disabled instances */
#define ITER_FLAG_SKIP_DISABLED	(1<<2)	/* skip disabled instances */

 /*
  * Environment export controls for edit commands. postmulti(1) exports only
  * things that need to be updated.
  */
#define EXP_FLAG_MULTI_DIRS	(1<<0)	/* export multi_instance_directories */
#define EXP_FLAG_MULTI_NAME	(1<<1)	/* export multi_instance_name */
#define EXP_FLAG_MULTI_GROUP	(1<<2)	/* export multi_instance_group */

 /*
  * To detect conflicts, each instance name and each shared or private
  * pathname is registered in one place, with its owner. Everyone must
  * register their claims when they join, and will be rejected in case of
  * conlict.
  * 
  * Each claim value involves a parameter value (either a directory name or an
  * instance name). Each claim owner is the config_directory pathname plus
  * the parameter name.
  * 
  * XXX: No multi.cf lock file, so this is not race-free.
  */
static HTABLE *claim_table;

#define IS_CLAIMED_BY(name) \
    (claim_table ? htable_find(claim_table, (name)) : 0)

 /*
  * Forward references.
  */
static int iterate_command(int, int, char **, INST_SELECTION *);
static int match_instance_selection(INSTANCE *, INST_SELECTION *);

 /*
  * Convenience.
  */
#define INSTANCE_NAME(i) ((i)->name ? (i)->name : (i)->config_dir)
#define STR(buf)	vstring_str(buf)

/* register_claim - register claim or bust */

static void register_claim(const char *instance_path, const char *param_name,
			           const char *param_value)
{
    const char *myname = "register_claim";
    char   *requestor;
    const char *owner;

    /*
     * Sanity checks.
     */
    if (instance_path == 0 || *instance_path == 0)
	msg_panic("%s: no or empty instance pathname", myname);
    if (param_name == 0 || *param_name == 0)
	msg_panic("%s: no or empty parameter name", myname);
    if (param_value == 0)
	msg_panic("%s: no parameter value", myname);

    /*
     * Make a claim or report a conflict.
     */
    if (claim_table == 0)
	claim_table = htable_create(100);
    requestor = concatenate(instance_path, ", ", param_name, (char *) 0);
    if ((owner = htable_find(claim_table, param_value)) == 0) {
	(void) htable_enter(claim_table, param_value, requestor);
    } else if (strcmp(owner, requestor) == 0) {
	myfree(requestor);
    } else {
	msg_fatal("instance %s, %s=%s conflicts with instance %s=%s",
		instance_path, param_name, param_value, owner, param_value);
    }
}

/* claim_instance_attributes - claim multiple private instance attributes */

static void claim_instance_attributes(INSTANCE *ip)
{

    /*
     * Detect instance name or pathname conflicts between this instance and
     * other instances. XXX: No multi.cf lock file, so this is not race-free.
     */
    if (ip->name)
	register_claim(ip->config_dir, VAR_MULTI_NAME, ip->name);
    register_claim(ip->config_dir, VAR_CONFIG_DIR, ip->config_dir);
    register_claim(ip->config_dir, VAR_QUEUE_DIR, ip->queue_dir);
    register_claim(ip->config_dir, VAR_DATA_DIR, ip->data_dir);
}

/* alloc_instance - allocate a single instance object */

static INSTANCE *alloc_instance(const char *config_dir)
{
    INSTANCE *ip = (INSTANCE *) mymalloc(sizeof(INSTANCE));

    ring_init(RING_PTR_OF(ip));
    ip->config_dir = config_dir ? mystrdup(config_dir) : 0;
    ip->queue_dir = 0;
    ip->data_dir = 0;
    ip->name = 0;
    ip->gname = 0;
    ip->enabled = 0;
    ip->primary = 0;

    return (ip);
}

#if 0

/* free_instance - free a single instance object */

static void free_instance(INSTANCE *ip)
{

    /*
     * If we continue after secondary main.cf file read error, we must be
     * prepared for the case that some parameters may be missing.
     */
    if (ip->name)
	myfree(ip->name);
    if (ip->gname)
	myfree(ip->gname);
    if (ip->config_dir)
	myfree(ip->config_dir);
    if (ip->queue_dir)
	myfree(ip->queue_dir);
    if (ip->data_dir)
	myfree(ip->data_dir);
    myfree((void *) ip);
}

#endif

/* insert_instance - insert instance before selected location, claim names */

static void insert_instance(INSTANCE *ip, INST_SELECTION *selection)
{
    RING   *old;

#define append_instance(ip) insert_instance((ip), (INST_SELECTION *) 0)

    /*
     * Insert instance before the selected site.
     */
    claim_instance_attributes(ip);
    if (ring_succ(instance_hd) == 0)
	ring_init(instance_hd);
    if (selection && selection->type != INST_SEL_NONE) {
	FOREACH_SECONDARY_INSTANCE(old) {
	    if (match_instance_selection(RING_TO_INSTANCE(old), selection)) {
		ring_prepend(old, RING_PTR_OF(ip));
		return;
	    }
	}
	if (selection->type != INST_SEL_ALL)
	    msg_fatal("No matching secondary instances");
    }
    ring_prepend(instance_hd, RING_PTR_OF(ip));
}

/* create_primary_instance - synthetic entry for primary instance */

static INSTANCE *create_primary_instance(void)
{
    INSTANCE *ip = alloc_instance(var_config_dir);

    /*
     * There is no need to load primary instance parameter settings from
     * file. We already have the main.cf parameters of interest in memory.
     */
#define SAVE_INSTANCE_NAME(val) (*(val) ? mystrdup(val) : 0)

    ip->name = SAVE_INSTANCE_NAME(var_multi_name);
    ip->gname = SAVE_INSTANCE_NAME(var_multi_group);
    ip->enabled = var_multi_enable;
    ip->queue_dir = mystrdup(var_queue_dir);
    ip->data_dir = mystrdup(var_data_dir);
    ip->primary = 1;
    return (ip);
}

/* load_instance - read instance parameters from config_dir/main.cf */

static INSTANCE *load_instance(INSTANCE *ip)
{
    VSTREAM *pipe;
    VSTRING *buf;
    char   *name;
    char   *value;
    ARGV   *cmd;
    int     count = 0;
    static NAME_CODE bool_code[] = {
	CONFIG_BOOL_YES, 1,
	CONFIG_BOOL_NO, 0,
	0, -1,
    };

    /*
     * Expand parameter values in the context of the target main.cf file.
     */
#define REQUEST_PARAM_COUNT 5			/* # of requested parameters */

    cmd = argv_alloc(REQUEST_PARAM_COUNT + 3);
    name = concatenate(var_command_dir, "/", "postconf", (char *) 0);
    argv_add(cmd, name, "-xc", ip->config_dir,
	     VAR_QUEUE_DIR, VAR_DATA_DIR,
	     VAR_MULTI_NAME, VAR_MULTI_GROUP, VAR_MULTI_ENABLE,
	     (char *) 0);
    myfree(name);
    pipe = vstream_popen(O_RDONLY, CA_VSTREAM_POPEN_ARGV(cmd->argv),
			 CA_VSTREAM_POPEN_END);
    argv_free(cmd);
    if (pipe == 0)
	msg_fatal("Cannot parse %s/main.cf file: %m", ip->config_dir);

    /*
     * Read parameter settings from postconf. See also comments below on
     * whether we should continue or skip groups after error instead of
     * bailing out immediately.
     */
    buf = vstring_alloc(100);
    while (vstring_get_nonl(buf, pipe) != VSTREAM_EOF) {
	if (split_nameval(STR(buf), &name, &value))
	    msg_fatal("Invalid %s/main.cf parameter: %s",
		      ip->config_dir, STR(buf));
	if (strcmp(name, VAR_QUEUE_DIR) == 0 && ++count)
	    ip->queue_dir = mystrdup(value);
	else if (strcmp(name, VAR_DATA_DIR) == 0 && ++count)
	    ip->data_dir = mystrdup(value);
	else if (strcmp(name, VAR_MULTI_NAME) == 0 && ++count)
	    ip->name = SAVE_INSTANCE_NAME(value);
	else if (strcmp(name, VAR_MULTI_GROUP) == 0 && ++count)
	    ip->gname = SAVE_INSTANCE_NAME(value);
	else if (strcmp(name, VAR_MULTI_ENABLE) == 0 && ++count) {
	    /* mail_conf_bool(3) is case insensitive! */
	    ip->enabled = name_code(bool_code, NAME_CODE_FLAG_NONE, value);
	    if (ip->enabled < 0)
		msg_fatal("Unexpected %s/main.cf entry: %s = %s",
			  ip->config_dir, VAR_MULTI_ENABLE, value);
	}
    }
    vstring_free(buf);

    /*
     * XXX We should not bail out while reading a bad secondary main.cf file.
     * When we manage dozens or more instances, the likelihood increases that
     * some file will be damaged or missing after a system crash. That is not
     * a good reason to prevent undamaged Postfix instances from starting.
     */
    if (count != REQUEST_PARAM_COUNT)
	msg_fatal("Failed to obtain all required %s/main.cf parameters",
		  ip->config_dir);

    if (vstream_pclose(pipe))
	msg_fatal("Cannot parse %s/main.cf file", ip->config_dir);
    return (ip);
}

/* load_all_instances - compute list of Postfix instances */

static void load_all_instances(void)
{
    INSTANCE *primary_instance;
    char  **cpp;
    ARGV   *secondary_names;

    /*
     * Avoid unexpected behavior when $multi_instance_directories contains
     * only comma characters. Count the actual number of elements, before we
     * decide that the list is empty.
     */
    secondary_names = argv_split(var_multi_conf_dirs, CHARS_COMMA_SP);

    /*
     * First, the primary instance.  This is synthesized out of thin air.
     */
    primary_instance = create_primary_instance();
    if (secondary_names->argc == 0)
	primary_instance->enabled = 1;		/* Single-instance mode */
    append_instance(primary_instance);

    /*
     * Next, instances defined in $multi_instance_directories. Note:
     * load_instance() has side effects on the global config dictionary, but
     * this does not affect the values that have already been extracted into
     * C variables.
     */
    for (cpp = secondary_names->argv; *cpp != 0; cpp++)
	append_instance(load_instance(alloc_instance(*cpp)));

    argv_free(secondary_names);
}

/* match_instance_selection - match all/name/group constraints */

static int match_instance_selection(INSTANCE *ip, INST_SELECTION *selection)
{
    char   *iname;
    char   *name;

    /*
     * When selecting (rather than assigning names) an instance, we match by
     * the instance name, config_directory path, or the instance name suffix
     * (name without mandatory prefix). Selecting "-" selects the primary
     * instance.
     */
    switch (selection->type) {
    case INST_SEL_NONE:
	return (0);
    case INST_SEL_ALL:
	return (1);
    case INST_SEL_GROUP:
	return (ip->gname != 0 && strcmp(selection->name, ip->gname) == 0);
    case INST_SEL_NAME:
	name = selection->name;
	if (*name == '/' || ip->name == 0)
	    iname = ip->config_dir;
	else if (!HAS_NAME_PREFIX(name) && HAS_NAME_PREFIX(ip->name))
	    iname = NAME_SUFFIX(ip->name);
	else
	    iname = ip->name;
	return (strcmp(name, iname) == 0
		|| (ip->primary && strcmp(name, "-") == 0));
    default:
	msg_panic("match_instance_selection: unknown selection type: %d",
		  selection->type);
    }
}

/* check_setenv - setenv() with extreme prejudice */

static void check_setenv(const char *name, const char *value)
{
#define CLOBBER 1
    if (setenv(name, value, CLOBBER) < 0)
	msg_fatal("setenv: %m");
}

/* prepend_command_path - prepend command_directory to PATH */

static void prepend_command_path(void)
{
    char   *cmd_path;

    /*
     * Carefully prepend "$command_directory:" to PATH. We can free the
     * buffer after check_setenv(), since the value is copied there.
     */
    cmd_path = safe_getenv("PATH");
    cmd_path = concatenate(var_command_dir, ":", (cmd_path && *cmd_path) ?
			   cmd_path : ROOT_PATH, (char *) 0);
    check_setenv("PATH", cmd_path);
    myfree(cmd_path);
}

/* check_shared_dir_status - check and claim shared directories */

static void check_shared_dir_status(void)
{
    struct stat st;
    const SHARED_PATH *sp;

    /*
     * XXX Avoid false conflicts with meta_directory. This usually overlaps
     * with other directories, typcally config_directory, shlib_directory or
     * daemon_directory.
     */
    for (sp = shared_dir_table; sp->param_name; ++sp) {
	if (sp->param_value[0][0] != '/')	/* "no" or other special */
	    continue;
	if (stat(sp->param_value[0], &st) < 0)
	    msg_fatal("%s = '%s': directory not found: %m",
		      sp->param_name, sp->param_value[0]);
	if (!S_ISDIR(st.st_mode))
	    msg_fatal("%s = '%s' is not a directory",
		      sp->param_name, sp->param_value[0]);
	if (strcmp(sp->param_name, VAR_META_DIR) == 0)
	    continue;
	register_claim(var_config_dir, sp->param_name, sp->param_value[0]);
    }
}

/* check_safe_name - allow instance or group name with only "safe" characters */

static int check_safe_name(const char *s)
{
#define SAFE_PUNCT	"!@%-_=+:./"
    if (*s == 0)
	return (0);
    for (; *s; ++s) {
	if (!ISALNUM(*s) && !strchr(SAFE_PUNCT, *s))
	    return (0);
    }
    return (1);
}

/* check_name_assignments - Check validity of assigned instance or group name */

static void check_name_assignments(NAME_ASSIGNMENT *assignment)
{

    /*
     * Syntax check the assigned instance name. This name is also used to
     * generate directory pathnames, so we must not allow "/" characters.
     * 
     * The value "" will clear the name and is always valid. The command-line
     * parser has already converted "-" into "", to simplify implementation.
     */
    if (assignment->name && *assignment->name) {
	if (!check_safe_name(assignment->name))
	    msg_fatal("Unsafe characters in new instance name: '%s'",
		      assignment->name);
	if (strchr(assignment->name, '/'))
	    msg_fatal("Illegal '/' character in new instance name: '%s'",
		      assignment->name);
	if (NEED_NAME_PREFIX(assignment->name))
	    msg_fatal("New instance name must start with '%s'",
		      NAME_PREFIX);
    }

    /*
     * Syntax check the assigned group name.
     */
    if (assignment->gname && *assignment->gname) {
	if (!check_safe_name(assignment->gname))
	    msg_fatal("Unsafe characters in '-G %s'", assignment->gname);
    }
}

/* do_name_assignments - assign instance/group names */

static int do_name_assignments(INSTANCE *target, NAME_ASSIGNMENT *assignment)
{
    int     export_flags = 0;

    /*
     * The command-line parser has already converted "-" into "", to simplify
     * implementation.
     */
    if (assignment->name
	&& strcmp(assignment->name, target->name ? target->name : "")) {
	register_claim(target->config_dir, VAR_MULTI_NAME, assignment->name);
	if (target->name)
	    myfree(target->name);
	target->name = SAVE_INSTANCE_NAME(assignment->name);
	export_flags |= EXP_FLAG_MULTI_NAME;
    }
    if (assignment->gname
	&& strcmp(assignment->gname, target->gname ? target->gname : "")) {
	if (target->gname)
	    myfree(target->gname);
	target->gname = SAVE_INSTANCE_NAME(assignment->gname);
	export_flags |= EXP_FLAG_MULTI_GROUP;
    }
    return (export_flags);
}

/* make_private_path - generate secondary pathname using primary as template */

static char *make_private_path(const char *param_name,
			               const char *primary_value,
			               NAME_ASSIGNMENT *assignment)
{
    char   *path;
    char   *base;
    char   *end;

    /*
     * The command-line parser has already converted "-" into "", to simplify
     * implementation.
     */
    if (assignment->name == 0 || *assignment->name == 0)
	msg_fatal("Missing %s parameter value", param_name);

    if (*primary_value != '/')
	msg_fatal("Invalid default %s parameter value: '%s': "
		  "specify an absolute pathname",
		  param_name, primary_value);

    base = mystrdup(primary_value);
    if ((end = strrchr(base, '/')) != 0) {
	/* Drop trailing slashes */
	if (end[1] == '\0') {
	    while (--end > base && *end == '/')
		*end = '\0';
	    end = strrchr(base, '/');
	}
	/* Drop last path component */
	while (end > base && *end == '/')
	    *end-- = '\0';
    }
    path = concatenate(base[1] ? base : "", "/",
		       assignment->name, (char *) 0);
    myfree(base);
    return (path);
}

/* assign_new_parameter - assign new instance private name=value */

static void assign_new_parameter(INSTANCE *new, int edit_cmd,
				         const char *arg)
{
    char   *saved_arg;
    char   *name;
    char   *value;
    char   *end;
    char  **target = 0;

    /*
     * With "import", only config_directory is specified on the command line
     * (either explicitly as config_directory=/path/name, or implicitly as
     * instance name). The other private directory pathnames are taken from
     * the existing instance's main.cf file.
     * 
     * With "create", all private pathname parameters are specified on the
     * command line, or generated from an instance name.
     */
    saved_arg = mystrdup(arg);
    if (split_nameval(saved_arg, &name, &value))
	msg_fatal("Malformed parameter setting '%s'", arg);

    if (strcmp(VAR_CONFIG_DIR, name) == 0) {
	target = &new->config_dir;
    } else if (edit_cmd != EDIT_CMD_IMPORT) {
	if (strcmp(VAR_QUEUE_DIR, name) == 0) {
	    target = &new->queue_dir;
	} else if (strcmp(VAR_DATA_DIR, name) == 0) {
	    target = &new->data_dir;
	}
    }
    if (target == 0)
	msg_fatal("Parameter '%s' not valid with action %s",
		  name, EDIT_CMD_STR(edit_cmd));

    /*
     * Extract and assign the parameter value. We do a limited number of
     * checks here. Conflicts between instances are checked by the caller.
     * More checks may be implemented in the helper script if inspired.
     */
    if (*value != '/')
	msg_fatal("Parameter setting '%s' is not an absolute path", name);

    /* Tolerate+trim trailing "/" from readline completion */
    for (end = value + strlen(value) - 1; end > value && *end == '/'; --end)
	*end = 0;

    /* No checks here for "/." or other shoot-foot silliness. */
    if (end == value)
	msg_fatal("Parameter setting '%s' is the root directory", name);

    if (*target)
	myfree(*target);
    *target = mystrdup(value);

    /*
     * Cleanup.
     */
    myfree(saved_arg);
}

/* assign_new_parameters - initialize new instance private parameters */

static void assign_new_parameters(INSTANCE *new, int edit_cmd,
			           char **argv, NAME_ASSIGNMENT *assignment)
{
    const char *owner;

    /*
     * Sanity check the explicit parameter settings. More stringent checks
     * may take place in the helper script.
     */
    while (*argv)
	assign_new_parameter(new, edit_cmd, *argv++);

    /*
     * Initialize any missing private directory pathnames, using the primary
     * configuration directory parameter values as a template, and using the
     * assigned instance name to fill in the blanks.
     * 
     * When importing an existing instance, load private directory pathnames
     * from its main.cf file.
     */
    if (new->config_dir == 0)
	new->config_dir =
	    make_private_path(VAR_CONFIG_DIR, var_config_dir, assignment);
    /* Needed for better-quality error message. */
    if ((owner = IS_CLAIMED_BY(new->config_dir)) != 0)
	msg_fatal("new %s=%s is already in use by instance %s=%s",
		  VAR_CONFIG_DIR, new->config_dir, owner, new->config_dir);
    if (edit_cmd != EDIT_CMD_IMPORT) {
	if (new->queue_dir == 0)
	    new->queue_dir =
		make_private_path(VAR_QUEUE_DIR, var_queue_dir, assignment);
	if (new->data_dir == 0)
	    new->data_dir =
		make_private_path(VAR_DATA_DIR, var_data_dir, assignment);
    } else {
	load_instance(new);
    }
}

/* export_helper_environment - update environment settings for helper command */

static void export_helper_environment(INSTANCE *target, int export_flags)
{
    ARGV   *import_env;
    VSTRING *multi_dirs;
    const SHARED_PATH *sp;
    RING   *entry;

    /*
     * Environment import filter, to enforce consistent behavior whether this
     * command is started by hand, or at system boot time. This is necessary
     * because some shell scripts use environment settings to override
     * main.cf settings.
     */
    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
    clean_env(import_env->argv);
    argv_free(import_env);

    /*
     * Prepend $command_directory: to PATH. This supposedly ensures that
     * naive programs will execute commands from the right Postfix version.
     */
    prepend_command_path();

    /*
     * The following ensures that Postfix's own programs will target the
     * primary instance.
     */
    check_setenv(CONF_ENV_PATH, var_config_dir);

    /*
     * Export the parameter settings that are shared between instances.
     */
    for (sp = shared_dir_table; sp->param_name; ++sp)
	check_setenv(sp->param_name, sp->param_value[0]);

    /*
     * Export the target instance's private directory locations.
     */
    check_setenv(VAR_CONFIG_DIR, target->config_dir);
    check_setenv(VAR_QUEUE_DIR, target->queue_dir);
    check_setenv(VAR_DATA_DIR, target->data_dir);

    /*
     * With operations that add or delete a secondary instance, we export the
     * modified multi_instance_directories parameter value for the primary
     * Postfix instance.
     */
    if (export_flags & EXP_FLAG_MULTI_DIRS) {
	multi_dirs = vstring_alloc(100);
	FOREACH_SECONDARY_INSTANCE(entry) {
	    if (VSTRING_LEN(multi_dirs) > 0)
		VSTRING_ADDCH(multi_dirs, ' ');
	    vstring_strcat(multi_dirs, RING_TO_INSTANCE(entry)->config_dir);
	}
	check_setenv(VAR_MULTI_CONF_DIRS, STR(multi_dirs));
	vstring_free(multi_dirs);
    }

    /*
     * Export updates for the instance name and group. Empty value (or no
     * export) means don't update, "-" means clear.
     */
    if (export_flags & EXP_FLAG_MULTI_NAME)
	check_setenv(VAR_MULTI_NAME, target->name && *target->name ?
		     target->name : "-");

    if (export_flags & EXP_FLAG_MULTI_GROUP)
	check_setenv(VAR_MULTI_GROUP, target->gname && *target->gname ?
		     target->gname : "-");

    /*
     * If we would implement enable/disable commands by exporting the updated
     * parameter value, then we could skip commands that have no effect, just
     * like we can skip "assign" commands that make no change.
     */
}

/* install_new_instance - install and return newly created instance */

static INSTANCE *install_new_instance(int edit_cmd, char **argv,
				              INST_SELECTION *selection,
				              NAME_ASSIGNMENT *assignment,
				              int *export_flags)
{
    INSTANCE *new;

    new = alloc_instance((char *) 0);
    check_name_assignments(assignment);
    assign_new_parameters(new, edit_cmd, argv, assignment);
    *export_flags |=
	(do_name_assignments(new, assignment) | EXP_FLAG_MULTI_DIRS);
    insert_instance(new, selection);
    return (new);
}

/* update_instance - update existing instance, return export flags */

static int update_instance(INSTANCE *target, NAME_ASSIGNMENT *assignment)
{
    int     export_flags;

    check_name_assignments(assignment);
    export_flags = do_name_assignments(target, assignment);
    return (export_flags);
}

/* select_existing_instance - return instance selected for management */

static INSTANCE *select_existing_instance(INST_SELECTION *selection,
					          int unlink_flag,
					          int *export_flags)
{
    INSTANCE *selected = 0;
    RING   *entry;
    INSTANCE *ip;

#define DONT_UNLINK	0
#define DO_UNLINK	1

    if (selection->type != INST_SEL_NAME)
	msg_fatal("Select an instance via '-i name'");

    /* Find the selected instance and its predecessor */
    FOREACH_INSTANCE(entry) {
	if (match_instance_selection(ip = RING_TO_INSTANCE(entry), selection)) {
	    selected = ip;
	    break;
	}
    }

    if (selected == 0)
	msg_fatal("No instance named %s", selection->name);

    if (unlink_flag) {
	/* Splice the target instance out of the list */
	if (ring_pred(entry) == instance_hd)
	    msg_fatal("Cannot remove the primary instance");
	if (selected->enabled)
	    msg_fatal("Cannot remove enabled instances");
	ring_detach(entry);
	if (export_flags == 0)
	    msg_panic("select_existing_instance: no export flags");
	*export_flags |= EXP_FLAG_MULTI_DIRS;
    }
    return (selected);
}

/* manage - create/destroy/... manage instances */

static NORETURN manage(int edit_cmd, int argc, char **argv,
		               INST_SELECTION *selection,
		               NAME_ASSIGNMENT *assignment)
{
    char   *cmd;
    INSTANCE *target;
    int     export_flags;

    /*
     * Edit mode is not subject to iterator controls.
     */
#define NO_EXPORT_FLAGS		((int *) 0)
    export_flags = 0;

    switch (edit_cmd) {
    case EDIT_CMD_INIT:
	target = create_primary_instance();
	break;

    case EDIT_CMD_CREATE:
    case EDIT_CMD_IMPORT:
	load_all_instances();
	target = install_new_instance(edit_cmd, argv, selection,
				      assignment, &export_flags);
	break;

    case EDIT_CMD_ASSIGN:
	load_all_instances();
	target =
	    select_existing_instance(selection, DONT_UNLINK, NO_EXPORT_FLAGS);
	export_flags |= update_instance(target, assignment);
	if (export_flags == 0)
	    exit(0);
	break;

    case EDIT_CMD_DESTROY:
    case EDIT_CMD_DEPORT:
	load_all_instances();
	target = select_existing_instance(selection, DO_UNLINK, &export_flags);
	break;

    default:
	load_all_instances();
	target =
	    select_existing_instance(selection, DONT_UNLINK, NO_EXPORT_FLAGS);
	break;
    }

    /*
     * Set up the helper script's process environment, and execute the helper
     * script.
     */
#define HELPER "postmulti-script"

    export_helper_environment(target, export_flags);
    cmd = concatenate(var_daemon_dir, "/" HELPER, (char *) 0);
    execl(cmd, cmd, "-e", EDIT_CMD_STR(edit_cmd), (char *) 0);
    msg_fatal("%s: %m", cmd);
}

/* run_user_command - execute external command with requested MAIL_CONFIG env */

static int run_user_command(INSTANCE *ip, int iter_cmd, int iter_flags,
			            char **argv)
{
    WAIT_STATUS_T status;
    int     pid;
    int     wpid;

    /*
     * Set up a process environment. The postfix(1) command needs MAIL_CONFIG
     * (or the equivalent command-line option); it overrides everything else.
     * 
     * postmulti(1) typically runs various Postfix utilities (postsuper, ...) in
     * the context of one or more instances. It can also run various scripts
     * on the users PATH. So we can't clobber the user's PATH, but do want to
     * make sure that the utilities in $command_directory are always found in
     * the right place (or at all).
     */
    switch (pid = fork()) {
    case -1:
	msg_warn("fork %s: %m", argv[0]);
	return -1;
    case 0:
	check_setenv(CONF_ENV_PATH, ip->config_dir);
	if (iter_cmd != ITER_CMD_POSTFIX) {
	    check_setenv(VAR_DAEMON_DIR, var_daemon_dir);
	    check_setenv(VAR_COMMAND_DIR, var_command_dir);
	    check_setenv(VAR_CONFIG_DIR, ip->config_dir);
	    check_setenv(VAR_QUEUE_DIR, ip->queue_dir);
	    check_setenv(VAR_DATA_DIR, ip->data_dir);
	    check_setenv(VAR_MULTI_NAME, ip->name ? ip->name : "");
	    check_setenv(VAR_MULTI_GROUP, ip->gname ? ip->gname : "");
	    check_setenv(VAR_MULTI_ENABLE, ip->enabled ?
			 CONFIG_BOOL_YES : CONFIG_BOOL_NO);
	    prepend_command_path();
	}

	/*
	 * Replace: postfix -- start ... With: postfix -- check ...
	 */
	if (iter_cmd == ITER_CMD_POSTFIX
	    && (iter_flags & ITER_FLAG_CHECK_DISABLED) && !ip->enabled)
	    argv[2] = "check";

	execvp(argv[0], argv);
	msg_fatal("execvp %s: %m", argv[0]);
    default:
	do {
	    wpid = waitpid(pid, &status, 0);
	} while (wpid == -1 && errno == EINTR);
	return (wpid == -1 ? -1 :
		WIFEXITED(status) ? WEXITSTATUS(status) : 1);
    }
}

/* word_in_list - look up command in start, stop, or control list */

static int word_in_list(char *cmdlist, const char *cmd)
{
    char   *saved;
    char   *cp;
    char   *elem;

    cp = saved = mystrdup(cmdlist);
    while ((elem = mystrtok(&cp, CHARS_COMMA_SP)) != 0 && strcmp(elem, cmd) != 0)
	 /* void */ ;
    myfree(saved);
    return (elem != 0);
}

/* iterate_postfix_command - execute postfix(1) command */

static int iterate_postfix_command(int iter_cmd, int argc, char **argv,
				           INST_SELECTION *selection)
{
    int     exit_status;
    char   *cmd;
    ARGV   *my_argv;
    int     iter_flags;

    /*
     * Override the iterator controls.
     */
    if (word_in_list(var_multi_start_cmds, argv[0])) {
	iter_flags = ITER_FLAG_CHECK_DISABLED;
    } else if (word_in_list(var_multi_stop_cmds, argv[0])) {
	iter_flags = ITER_FLAG_SKIP_DISABLED | ITER_FLAG_REVERSE;
    } else if (word_in_list(var_multi_cntrl_cmds, argv[0])) {
	iter_flags = ITER_FLAG_SKIP_DISABLED;
    } else {
	iter_flags = 0;
    }

    /*
     * Override the command line in a straightforward manner: prepend
     * "postfix --" to the command arguments. Other overrides (environment,
     * start -> check) are implemented below the iterator.
     */
#define POSTFIX_CMD	"postfix"

    my_argv = argv_alloc(argc + 2);
    cmd = concatenate(var_command_dir, "/" POSTFIX_CMD, (char *) 0);
    argv_add(my_argv, cmd, "--", (char *) 0);
    myfree(cmd);
    while (*argv)
	argv_add(my_argv, *argv++, (char *) 0);

    /*
     * Execute the command for all applicable Postfix instances.
     */
    exit_status =
	iterate_command(iter_cmd, iter_flags, my_argv->argv, selection);

    argv_free(my_argv);
    return (exit_status);
}

/* list_instances - list all selected instances */

static void list_instances(int iter_flags, INST_SELECTION *selection)
{
    RING   *entry;
    INSTANCE *ip;

    /*
     * Iterate over the selected instances.
     */
    FOREACH_ITERATOR_INSTANCE(iter_flags, entry) {
	ip = RING_TO_INSTANCE(entry);
	if (match_instance_selection(ip, selection))
	    vstream_printf("%-15s %-15s %-9s %s\n",
			   ip->name ? ip->name : "-",
			   ip->gname ? ip->gname : "-",
			   ip->enabled ? "y" : "n",
			   ip->config_dir);
    }
    if (vstream_fflush(VSTREAM_OUT))
	msg_fatal("error writing output: %m");
}

/* iterate_command - execute command for selected instances */

static int iterate_command(int iter_cmd, int iter_flags, char **argv,
			           INST_SELECTION *selection)
{
    int     exit_status = 0;
    int     matched = 0;
    RING   *entry;
    INSTANCE *ip;

    /*
     * Iterate over the selected instances.
     */
    FOREACH_ITERATOR_INSTANCE(iter_flags, entry) {
	ip = RING_TO_INSTANCE(entry);
	if ((iter_flags & ITER_FLAG_SKIP_DISABLED) && !ip->enabled)
	    continue;
	if (!match_instance_selection(ip, selection))
	    continue;
	matched = 1;

	/* Run the requested command */
	if (run_user_command(ip, iter_cmd, iter_flags, argv) != 0)
	    exit_status = 1;
    }
    if (matched == 0)
	msg_fatal("No matching instances");

    return (exit_status);
}

/* iterate - Iterate over all or selected instances */

static NORETURN iterate(int iter_cmd, int iter_flags, int argc, char **argv,
			        INST_SELECTION *selection)
{
    int     exit_status;

    /*
     * In iterator mode, no selection means wild-card selection.
     */
    if (selection->type == INST_SEL_NONE)
	selection->type = INST_SEL_ALL;

    /*
     * Load the in-memory instance table from main.cf files.
     */
    load_all_instances();

    /*
     * Iterate over the selected instances.
     */
    switch (iter_cmd) {
    case ITER_CMD_POSTFIX:
	exit_status = iterate_postfix_command(iter_cmd, argc, argv, selection);
	break;
    case ITER_CMD_LIST:
	list_instances(iter_flags, selection);
	exit_status = 0;
	break;
    case ITER_CMD_GENERIC:
	exit_status = iterate_command(iter_cmd, iter_flags, argv, selection);
	break;
    default:
	msg_panic("iterate: unknown mode: %d", iter_cmd);
    }
    exit(exit_status);
}

static NORETURN usage(const char *progname)
{
    msg_fatal("Usage:"
	      "%s -l [-v] [-a] [-g group] [-i instance] | "
	      "%s -p [-v] [-a] [-g group] [-i instance] command... | "
	      "%s -x [-v] [-a] [-i name] [-g group] command... | "
	      "%s -e action [-v] [-a] [-i name] [-g group] [-I name] "
	      "[-G group] [param=value ...]",
	      progname, progname, progname, progname);
}

MAIL_VERSION_STAMP_DECLARE;

/* main - iterate commands over multiple instance or manage instances */

int     main(int argc, char **argv)
{
    int     fd;
    struct stat st;
    char   *slash;
    char   *config_dir;
    int     ch;
    static const CONFIG_STR_TABLE str_table[] = {
	VAR_MULTI_START_CMDS, DEF_MULTI_START_CMDS, &var_multi_start_cmds, 0, 0,
	VAR_MULTI_STOP_CMDS, DEF_MULTI_STOP_CMDS, &var_multi_stop_cmds, 0, 0,
	VAR_MULTI_CNTRL_CMDS, DEF_MULTI_CNTRL_CMDS, &var_multi_cntrl_cmds, 0, 0,
	0,
    };
    int     instance_select_count = 0;
    int     command_mode_count = 0;
    INST_SELECTION selection;
    NAME_ASSIGNMENT assignment;
    int     iter_flags = ITER_FLAG_DEFAULT;
    int     cmd_mode = 0;
    int     code;

    selection.type = INST_SEL_NONE;
    assignment.name = assignment.gname = 0;

    /*
     * Fingerprint executables and core dumps.
     */
    MAIL_VERSION_STAMP_ALLOCATE;

    /*
     * Be consistent with file permissions.
     */
    umask(022);

    /*
     * To minimize confusion, make sure that the standard file descriptors
     * are open before opening anything else. XXX Work around for 44BSD where
     * fstat can return EBADF on an open file descriptor.
     */
    for (fd = 0; fd < 3; fd++)
	if (fstat(fd, &st) == -1
	    && (close(fd), open("/dev/null", O_RDWR, 0)) != fd)
	    msg_fatal("open /dev/null: %m");

    /*
     * Set up diagnostics. XXX What if stdin is the system console during
     * boot time? It seems a bad idea to log startup errors to the console.
     * This is UNIX, a system that can run without hand holding.
     */
    if ((slash = strrchr(argv[0], '/')) != 0 && slash[1])
	argv[0] = slash + 1;
    if (isatty(STDERR_FILENO))
	msg_vstream_init(argv[0], VSTREAM_ERR);
    maillog_client_init(argv[0], MAILLOG_CLIENT_FLAG_LOGWRITER_FALLBACK);

    /*
     * Check the Postfix library version as soon as we enable logging.
     */
    MAIL_VERSION_CHECK;

    /*
     * Process main.cf parameters. This is done before the GETOPT() loop to
     * improve logging. This assumes that no command-line option can affect
     * parameter processing.
     */
    mail_conf_read();
    get_mail_conf_str_table(str_table);
    maillog_client_init(argv[0], MAILLOG_CLIENT_FLAG_LOGWRITER_FALLBACK);

    if ((config_dir = getenv(CONF_ENV_PATH)) != 0
	&& strcmp(config_dir, DEF_CONFIG_DIR) != 0)
	msg_fatal("Non-default configuration directory: %s=%s",
		  CONF_ENV_PATH, config_dir);

    /*
     * Parse switches. Move the above mail_conf_read() block after this loop,
     * if any command-line option can affect parameter processing.
     */
    while ((ch = GETOPT(argc, argv, "ae:g:i:G:I:lpRvx")) > 0) {
	switch (ch) {
	default:
	    usage(argv[0]);
	    /* NOTREACHED */
	case 'a':
	    if (selection.type != INST_SEL_ALL)
		instance_select_count++;
	    selection.type = INST_SEL_ALL;
	    break;
	case 'e':
	    if ((code = EDIT_CMD_CODE(optarg)) < 0)
		msg_fatal("Invalid '-e' edit action '%s'. Specify '%s', "
			  "'%s', '%s', '%s', '%s', '%s', '%s' or '%s'",
			  optarg,
			  EDIT_CMD_STR(EDIT_CMD_CREATE),
			  EDIT_CMD_STR(EDIT_CMD_DESTROY),
			  EDIT_CMD_STR(EDIT_CMD_IMPORT),
			  EDIT_CMD_STR(EDIT_CMD_DEPORT),
			  EDIT_CMD_STR(EDIT_CMD_ENABLE),
			  EDIT_CMD_STR(EDIT_CMD_DISABLE),
			  EDIT_CMD_STR(EDIT_CMD_ASSIGN),
			  EDIT_CMD_STR(EDIT_CMD_INIT));
	    if (cmd_mode != code)
		command_mode_count++;
	    cmd_mode = code;
	    break;
	case 'g':
	    instance_select_count++;
	    selection.type = INST_SEL_GROUP;
	    selection.name = optarg;
	    break;
	case 'i':
	    instance_select_count++;
	    selection.type = INST_SEL_NAME;
	    selection.name = optarg;
	    break;
	case 'G':
	    if (assignment.gname != 0)
		msg_fatal("Specify at most one '-G' option");
	    assignment.gname = strcmp(optarg, "-") == 0 ? "" : optarg;
	    break;
	case 'I':
	    if (assignment.name != 0)
		msg_fatal("Specify at most one '-I' option");
	    assignment.name = strcmp(optarg, "-") == 0 ? "" : optarg;
	    break;
	case 'l':
	    if (cmd_mode != ITER_CMD_LIST)
		command_mode_count++;
	    cmd_mode = ITER_CMD_LIST;
	    break;
	case 'p':
	    if (cmd_mode != ITER_CMD_POSTFIX)
		command_mode_count++;
	    cmd_mode = ITER_CMD_POSTFIX;
	    break;
	case 'R':
	    iter_flags ^= ITER_FLAG_REVERSE;
	    break;
	case 'v':
	    msg_verbose++;
	    check_setenv(CONF_ENV_VERB, "");
	    break;
	case 'x':
	    if (cmd_mode != ITER_CMD_GENERIC)
		command_mode_count++;
	    cmd_mode = ITER_CMD_GENERIC;
	    break;
	}
    }

    /*
     * Report missing arguments, or wrong arguments in the wrong context.
     */
    if (instance_select_count > 1)
	msg_fatal("Specity no more than one of '-a', '-g', '-i'");

    if (command_mode_count != 1)
	msg_fatal("Specify exactly one of '-e', '-l', '-p', '-x'");

    if (cmd_mode == ITER_CMD_LIST && argc > optind)
	msg_fatal("Command not allowed with '-l'");

    if (cmd_mode == ITER_CMD_POSTFIX || cmd_mode == ITER_CMD_GENERIC)
	if (argc == optind)
	    msg_fatal("Command required with '-p' or '-x' option");

    if (cmd_mode == ITER_CMD_POSTFIX || (cmd_mode & EDIT_CMD_MASK_ALL))
	if (iter_flags != ITER_FLAG_DEFAULT)
	    msg_fatal("The '-p' and '-e' options preclude the use of '-R'");

    if ((cmd_mode & EDIT_CMD_MASK_ASSIGN) == 0
	&& (assignment.name || assignment.gname)) {
	if ((cmd_mode & EDIT_CMD_MASK_ALL) == 0)
	    msg_fatal("Cannot assign instance name or group without '-e %s'",
		      EDIT_CMD_STR(EDIT_CMD_ASSIGN));
	else
	    msg_fatal("Cannot assign instance name or group with '-e %s'",
		      EDIT_CMD_STR(cmd_mode));
    }
    if (cmd_mode & EDIT_CMD_MASK_ALL) {
	if (cmd_mode == EDIT_CMD_ASSIGN
	    && (assignment.name == 0 && assignment.gname == 0))
	    msg_fatal("Specify new instance name or group with '-e %s'",
		      EDIT_CMD_STR(cmd_mode));

	if ((cmd_mode & ~EDIT_CMD_MASK_ADD) != 0 && argc > optind)
	    msg_fatal("Parameter overrides not valid with '-e %s'",
		      EDIT_CMD_STR(cmd_mode));
    }

    /*
     * Sanity checks.
     */
    check_shared_dir_status();

    /*
     * Iterate over selected instances, or manipulate one instance.
     */
    if (cmd_mode & ITER_CMD_MASK_ALL)
	iterate(cmd_mode, iter_flags, argc - optind, argv + optind, &selection);
    else
	manage(cmd_mode, argc - optind, argv + optind, &selection, &assignment);
}