Add support for setclassresources() in the pipe transport on FreeBSD,
[exim.git] / src / src / transports / appendfile.c
CommitLineData
929ba01c 1/* $Cambridge: exim/src/src/transports/appendfile.c,v 1.13 2006/02/21 16:24:20 ph10 Exp $ */
0756eb3c
PH
2
3/*************************************************
4* Exim - an Internet mail transport agent *
5*************************************************/
6
d7d7b7b9 7/* Copyright (c) University of Cambridge 1995 - 2006 */
0756eb3c
PH
8/* See the file NOTICE for conditions of use and distribution. */
9
10
11#include "../exim.h"
12#include "appendfile.h"
13
14#ifdef SUPPORT_MAILDIR
15#include "tf_maildir.h"
16#endif
17
18
19/* Encodings for mailbox formats, and their names. MBX format is actually
20supported only if SUPPORT_MBX is set. */
21
22enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
23
24static char *mailbox_formats[] = {
25 "unix", "mbx", "smail", "maildir", "mailstore" };
26
27
28/* Check warn threshold only if quota size set or not a percentage threshold
29 percentage check should only be done if quota > 0 */
30
31#define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
32 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
33
34
35/* Options specific to the appendfile transport. They must be in alphabetic
36order (note that "_" comes before the lower case letters). Some of them are
37stored in the publicly visible instance block - these are flagged with the
38opt_public flag. */
39
40optionlist appendfile_transport_options[] = {
41 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
42 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
43 { "*set_use_flock_lock",opt_bool | opt_hidden,
44 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
45 { "*set_use_lockfile", opt_bool | opt_hidden,
46 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
47#ifdef SUPPORT_MBX
48 { "*set_use_mbx_lock", opt_bool | opt_hidden,
49 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
50#endif
51 { "allow_fifo", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
53 { "allow_symlink", opt_bool,
54 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
55 { "batch_id", opt_stringptr | opt_public,
56 (void *)offsetof(transport_instance, batch_id) },
57 { "batch_max", opt_int | opt_public,
58 (void *)offsetof(transport_instance, batch_max) },
59 { "check_group", opt_bool,
60 (void *)offsetof(appendfile_transport_options_block, check_group) },
61 { "check_owner", opt_bool,
62 (void *)offsetof(appendfile_transport_options_block, check_owner) },
63 { "check_string", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, check_string) },
65 { "create_directory", opt_bool,
66 (void *)offsetof(appendfile_transport_options_block, create_directory) },
67 { "create_file", opt_stringptr,
68 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
69 { "directory", opt_stringptr,
70 (void *)offsetof(appendfile_transport_options_block, dirname) },
71 { "directory_file", opt_stringptr,
72 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
73 { "directory_mode", opt_octint,
74 (void *)offsetof(appendfile_transport_options_block, dirmode) },
75 { "escape_string", opt_stringptr,
76 (void *)offsetof(appendfile_transport_options_block, escape_string) },
77 { "file", opt_stringptr,
78 (void *)offsetof(appendfile_transport_options_block, filename) },
79 { "file_format", opt_stringptr,
80 (void *)offsetof(appendfile_transport_options_block, file_format) },
81 { "file_must_exist", opt_bool,
82 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
83 { "lock_fcntl_timeout", opt_time,
84 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
85 { "lock_flock_timeout", opt_time,
86 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
87 { "lock_interval", opt_time,
88 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
89 { "lock_retries", opt_int,
90 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
91 { "lockfile_mode", opt_octint,
92 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
93 { "lockfile_timeout", opt_time,
94 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
95 { "mailbox_filecount", opt_stringptr,
96 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
97 { "mailbox_size", opt_stringptr,
98 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
99#ifdef SUPPORT_MAILDIR
100 { "maildir_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
102 { "maildir_quota_directory_regex", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
104 { "maildir_retries", opt_int,
105 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
106 { "maildir_tag", opt_stringptr,
107 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
108 { "maildir_use_size_file", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
110#endif /* SUPPORT_MAILDIR */
111#ifdef SUPPORT_MAILSTORE
112 { "mailstore_format", opt_bool,
113 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
114 { "mailstore_prefix", opt_stringptr,
115 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
116 { "mailstore_suffix", opt_stringptr,
117 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
118#endif /* SUPPORT_MAILSTORE */
119#ifdef SUPPORT_MBX
120 { "mbx_format", opt_bool,
121 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
122#endif /* SUPPORT_MBX */
123 { "message_prefix", opt_stringptr,
124 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
125 { "message_suffix", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
127 { "mode", opt_octint,
128 (void *)offsetof(appendfile_transport_options_block, mode) },
129 { "mode_fail_narrower",opt_bool,
130 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
131 { "notify_comsat", opt_bool,
132 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
133 { "quota", opt_stringptr,
134 (void *)offsetof(appendfile_transport_options_block, quota) },
135 { "quota_directory", opt_stringptr,
136 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
137 { "quota_filecount", opt_stringptr,
138 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
139 { "quota_is_inclusive", opt_bool,
140 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
141 { "quota_size_regex", opt_stringptr,
142 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
143 { "quota_warn_message", opt_stringptr | opt_public,
144 (void *)offsetof(transport_instance, warn_message) },
145 { "quota_warn_threshold", opt_stringptr,
146 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
147 { "use_bsmtp", opt_bool,
148 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
149 { "use_crlf", opt_bool,
150 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
151 { "use_fcntl_lock", opt_bool_set,
152 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
153 { "use_flock_lock", opt_bool_set,
154 (void *)offsetof(appendfile_transport_options_block, use_flock) },
155 { "use_lockfile", opt_bool_set,
156 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
157#ifdef SUPPORT_MBX
158 { "use_mbx_lock", opt_bool_set,
159 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
160#endif /* SUPPORT_MBX */
161};
162
163/* Size of the options list. An extern variable has to be used so that its
164address can appear in the tables drtables.c. */
165
166int appendfile_transport_options_count =
167 sizeof(appendfile_transport_options)/sizeof(optionlist);
168
169/* Default private options block for the appendfile transport. */
170
171appendfile_transport_options_block appendfile_transport_option_defaults = {
172 NULL, /* filename */
173 NULL, /* dirname */
174 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
175 NULL, /* message_prefix (default reset in init if not bsmtp) */
176 NULL, /* message_suffix (ditto) */
177 US"anywhere", /* create_file_string (string value for create_file) */
178 NULL, /* quota */
179 NULL, /* quota_directory */
180 NULL, /* quota_filecount */
181 NULL, /* quota_size_regex */
182 NULL, /* quota_warn_threshold */
183 NULL, /* mailbox_size_string */
184 NULL, /* mailbox_filecount_string */
185 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
186 NULL, /* maildir_tag */
187 NULL, /* mailstore_prefix */
188 NULL, /* mailstore_suffix */
189 NULL, /* check_string (default changed for non-bsmtp file)*/
190 NULL, /* escape_string (ditto) */
191 NULL, /* file_format */
0d7eb84a
PH
192 0, /* quota_value */
193 0, /* quota_warn_threshold_value */
0756eb3c
PH
194 -1, /* mailbox_size_value */
195 -1, /* mailbox_filecount_value */
0756eb3c 196 0, /* quota_filecount_value */
0756eb3c
PH
197 APPENDFILE_MODE, /* mode */
198 APPENDFILE_DIRECTORY_MODE, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere,/* create_file */
207 0, /* options */
208 FALSE, /* allow_fifo */
209 FALSE, /* allow_symlink */
210 FALSE, /* check_group */
211 TRUE, /* check_owner */
212 TRUE, /* create_directory */
213 FALSE, /* notify_comsat */
214 TRUE, /* use_lockfile */
215 FALSE, /* set_use_lockfile */
216 TRUE, /* use_fcntl */
217 FALSE, /* set_use_fcntl */
218 FALSE, /* use_flock */
219 FALSE, /* set_use_flock */
220 FALSE, /* use_mbx_lock */
221 FALSE, /* set_use_mbx_lock */
222 FALSE, /* use_bsmtp */
223 FALSE, /* use_crlf */
224 FALSE, /* file_must_exist */
225 TRUE, /* mode_fail_narrower */
226 FALSE, /* maildir_format */
227 FALSE, /* maildir_use_size_file */
228 FALSE, /* mailstore_format */
229 FALSE, /* mbx_format */
230 FALSE, /* quota_warn_threshold_is_percent */
231 TRUE /* quota_is_inclusive */
232};
233
234
235
236/*************************************************
237* Setup entry point *
238*************************************************/
239
240/* Called for each delivery in the privileged state, just before the uid/gid
241are changed and the main entry point is called. We use this function to
242expand any quota settings, so that it can access files that may not be readable
243by the user. It is also used to pick up external mailbox size information, if
244set.
245
246Arguments:
247 tblock points to the transport instance
248 addrlist addresses about to be delivered (not used)
249 dummy not used (doesn't pass back data)
929ba01c
PH
250 uid the uid that will be set (not used)
251 gid the gid that will be set (not used)
0756eb3c
PH
252 errmsg where to put an error message
253
254Returns: OK, FAIL, or DEFER
255*/
256
257static int
258appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
929ba01c 259 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
0756eb3c
PH
260{
261appendfile_transport_options_block *ob =
262 (appendfile_transport_options_block *)(tblock->options_block);
263uschar *q = ob->quota;
0d7eb84a 264double default_value = 0.0;
0756eb3c
PH
265int i;
266
267addrlist = addrlist; /* Keep picky compilers happy */
268dummy = dummy;
929ba01c
PH
269uid = uid;
270gid = gid;
0756eb3c
PH
271
272/* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
273mailbox_filecount */
274
275for (i = 0; i < 5; i++)
276 {
0d7eb84a 277 double d;
21c28500 278 uschar *which = NULL;
0d7eb84a
PH
279
280 if (q == NULL) d = default_value; else
0756eb3c 281 {
0756eb3c
PH
282 uschar *rest;
283 uschar *s = expand_string(q);
284
285 if (s == NULL)
286 {
287 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
288 "%s", q, tblock->name, expand_string_message);
289 return search_find_defer? DEFER : FAIL;
290 }
291
292 d = Ustrtod(s, &rest);
293
be22d70e 294 /* Handle following characters K, M, G, %, the latter being permitted
0756eb3c
PH
295 for quota_warn_threshold only. A threshold with no quota setting is
296 just ignored. */
297
298 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
299 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
be22d70e 300 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
0756eb3c
PH
301 else if (*rest == '%' && i == 2)
302 {
303 if (ob->quota_value <= 0 && !ob->maildir_use_size_file) d = 0;
304 else if ((int)d < 0 || (int)d > 100)
305 {
306 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
307 " for %s transport", (int)d, tblock->name);
308 return FAIL;
309 }
310 ob->quota_warn_threshold_is_percent = TRUE;
311 rest++;
312 }
313
314 while (isspace(*rest)) rest++;
315
316 if (*rest != 0)
317 {
318 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
319 "in %s transport", s, q, tblock->name);
320 return FAIL;
321 }
0756eb3c
PH
322 }
323
21c28500
PH
324 /* Set each value, checking for possible overflow. */
325
0756eb3c
PH
326 switch (i)
327 {
328 case 0:
21c28500 329 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4) which = US"quota";
0d7eb84a 330 ob->quota_value = (off_t)d;
0756eb3c 331 q = ob->quota_filecount;
0756eb3c
PH
332 break;
333
334 case 1:
21c28500 335 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"quota_filecount";
0d7eb84a 336 ob->quota_filecount_value = (int)d;
0756eb3c 337 q = ob->quota_warn_threshold;
0756eb3c
PH
338 break;
339
340 case 2:
21c28500
PH
341 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
342 which = US"quota_warn_threshold";
0d7eb84a 343 ob->quota_warn_threshold_value = (off_t)d;
0756eb3c 344 q = ob->mailbox_size_string;
0d7eb84a 345 default_value = -1.0;
0756eb3c
PH
346 break;
347
348 case 3:
21c28500
PH
349 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
350 which = US"mailbox_size";;
0d7eb84a 351 ob->mailbox_size_value = (off_t)d;
0756eb3c 352 q = ob->mailbox_filecount_string;
0d7eb84a
PH
353 break;
354
355 case 4:
21c28500 356 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"mailbox_filecount";
0d7eb84a 357 ob->mailbox_filecount_value = (int)d;
0756eb3c
PH
358 break;
359 }
21c28500
PH
360
361 if (which != NULL)
362 {
363 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
364 "%s transport", which, d, tblock->name);
365 return FAIL;
366 }
0756eb3c
PH
367 }
368
369return OK;
370}
371
372
373
374/*************************************************
375* Initialization entry point *
376*************************************************/
377
378/* Called for each instance, after its options have been read, to
379enable consistency checks to be done, or anything else that needs
380to be set up. */
381
382void
383appendfile_transport_init(transport_instance *tblock)
384{
385appendfile_transport_options_block *ob =
386 (appendfile_transport_options_block *)(tblock->options_block);
387
388/* Set up the setup entry point, to be called in the privileged state */
389
390tblock->setup = appendfile_transport_setup;
391
392/* Lock_retries must be greater than zero */
393
394if (ob->lock_retries == 0) ob->lock_retries = 1;
395
396/* Only one of a file name or directory name must be given. */
397
398if (ob->filename != NULL && ob->dirname != NULL)
399 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
400 "only one of \"file\" or \"directory\" can be specified", tblock->name);
401
402/* If a file name was specified, neither quota_filecount nor quota_directory
403must be given. */
404
405if (ob->filename != NULL)
406 {
407 if (ob->quota_filecount != NULL)
408 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
409 "quota_filecount must not be set without \"directory\"", tblock->name);
410 if (ob->quota_directory != NULL)
411 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
412 "quota_directory must not be set without \"directory\"", tblock->name);
413 }
414
415/* The default locking depends on whether MBX is set or not. Change the
416built-in default if none of the lock options has been explicitly set. At least
417one form of locking is required in all cases, but mbx locking changes the
418meaning of fcntl and flock locking. */
419
420/* Not all operating systems provide flock(). For those that do, if flock is
421requested, the default for fcntl is FALSE. */
422
423if (ob->use_flock)
424 {
425 #ifdef NO_FLOCK
426 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
427 "flock() support was not available in the operating system when this "
428 "binary was built", tblock->name);
429 #endif /* NO_FLOCK */
430 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
431 }
432
433#ifdef SUPPORT_MBX
434if (ob->mbx_format)
435 {
436 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
437 !ob->set_use_mbx_lock)
438 {
439 ob->use_lockfile = ob->use_flock = FALSE;
440 ob->use_mbx_lock = ob->use_fcntl = TRUE;
441 }
442 else if (ob->use_mbx_lock)
443 {
444 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
445 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
446 if (!ob->set_use_flock) ob->use_flock = FALSE;
447 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
448 }
449 }
450#endif /* SUPPORT_MBX */
451
452if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
453 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
454 "no locking configured", tblock->name);
455
456/* Unset timeouts for non-used locking types */
457
458if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
459if (!ob->use_flock) ob->lock_flock_timeout = 0;
460
461/* If a directory name was specified, only one of maildir or mailstore may be
462specified, and if quota_filecount or quota_directory is given, quota must
463be set. */
464
465if (ob->dirname != NULL)
466 {
467 if (ob->maildir_format && ob->mailstore_format)
468 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
469 "only one of maildir and mailstore may be specified", tblock->name);
470 if (ob->quota_filecount != NULL && ob->quota == NULL)
471 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
472 "quota must be set if quota_filecount is set", tblock->name);
473 if (ob->quota_directory != NULL && ob->quota == NULL)
474 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
475 "quota must be set if quota_directory is set", tblock->name);
476 }
477
478/* If a fixed uid field is set, then a gid field must also be set. */
479
480if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
481 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
482 "user set without group for the %s transport", tblock->name);
483
484/* If "create_file" is set, check that a valid option is given, and set the
485integer variable. */
486
487if (ob->create_file_string != NULL)
488 {
489 int value = 0;
490 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
491 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
492 create_belowhome;
493 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
494 value = create_inhome;
495 else
496 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
497 "invalid value given for \"file_create\" for the %s transport: %s",
498 tblock->name, ob->create_file_string);
499 ob->create_file = value;
500 }
501
502/* If quota_warn_threshold is set, set up default for warn_message. It may
503not be used if the actual threshold for a given delivery ends up as zero,
504of if it's given as a percentage and there's no quota setting. */
505
506if (ob->quota_warn_threshold != NULL)
507 {
508 if (tblock->warn_message == NULL) tblock->warn_message = US
509 "To: $local_part@$domain\n"
510 "Subject: Your mailbox\n\n"
511 "This message is automatically created by mail delivery software (Exim).\n\n"
512 "The size of your mailbox has exceeded a warning threshold that is\n"
513 "set by the system administrator.\n";
514 }
515
516/* If batch SMTP is set, force the check and escape strings, and arrange that
517headers are also escaped. */
518
519if (ob->use_bsmtp)
520 {
521 ob->check_string = US".";
522 ob->escape_string = US"..";
523 ob->options |= topt_escape_headers;
524 }
525
526/* If not batch SMTP, not maildir, not mailstore, and directory is not set,
527insert default values for for the affixes and the check/escape strings. */
528
529else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
530 {
531 if (ob->message_prefix == NULL) ob->message_prefix =
532 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
533 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
534 if (ob->check_string == NULL) ob->check_string = US"From ";
535 if (ob->escape_string == NULL) ob->escape_string = US">From ";
536
537 }
538
539/* Set up the bitwise options for transport_write_message from the various
540driver options. Only one of body_only and headers_only can be set. */
541
542ob->options |=
543 (tblock->body_only? topt_no_headers : 0) |
544 (tblock->headers_only? topt_no_body : 0) |
545 (tblock->return_path_add? topt_add_return_path : 0) |
546 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
547 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
548 ((ob->use_crlf || ob->mbx_format)? topt_use_crlf : 0);
549}
550
551
552
553/*************************************************
554* Notify comsat *
555*************************************************/
556
557/* The comsat daemon is the thing that provides asynchronous notification of
558the arrival of local messages, if requested by the user by "biff y". It is a
559BSD thing that uses a TCP/IP protocol for communication. A message consisting
560of the text "user@offset" must be sent, where offset is the place in the
561mailbox where new mail starts. There is no scope for telling it which file to
562look at, which makes it a less than useful if mail is being delivered into a
563non-standard place such as the user's home directory. In fact, it doesn't seem
564to pay much attention to the offset.
565
566Arguments:
567 user user name
568 offset offset in mailbox
569
570Returns: nothing
571*/
572
573static void
0d7eb84a 574notify_comsat(uschar *user, off_t offset)
0756eb3c
PH
575{
576struct servent *sp;
577host_item host;
578host_item *h;
579uschar buffer[256];
580
581DEBUG(D_transport) debug_printf("notify_comsat called\n");
582
b1c749bb 583sprintf(CS buffer, "%.200s@" OFF_T_FMT "\n", user, offset);
0756eb3c
PH
584
585if ((sp = getservbyname("biff", "udp")) == NULL)
586 {
587 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
588 return;
589 }
590
591host.name = US"localhost";
592host.next = NULL;
593
594
595/* This code is all set up to look up "localhost" and use all its addresses
596until one succeeds. However, it appears that at least on some systems, comsat
597doesn't listen on the ::1 address. So for the moment, just force the address to
598be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
599can be changed. */
600
601/******
602if (host_find_byname(&host, NULL, NULL, FALSE) == HOST_FIND_FAILED)
603 {
604 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
605 return;
606 }
607******/
608
609host.address = US"127.0.0.1";
610
611
612for (h = &host; h != NULL; h = h->next)
613 {
614 int sock, rc;
615 int host_af = (Ustrchr(h->address, ':') != NULL)? AF_INET6 : AF_INET;
616
617 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
618
619 sock = ip_socket(SOCK_DGRAM, host_af);
620 if (sock < 0) continue;
621
622 /* Connect never fails for a UDP socket, so don't set a timeout. */
623
624 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0);
625 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
f1e894f3 626 (void)close(sock);
0756eb3c
PH
627
628 if (rc >= 0) break;
629 DEBUG(D_transport)
630 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
631 h->address);
632 }
633}
634
635
636
637/*************************************************
638* Check the format of a file *
639*************************************************/
640
641/* This function is called when file_format is set, to check that an existing
642file has the right format. The format string contains text/transport pairs. The
643string matching is literal. we just read big_buffer_size bytes, because this is
644all about the first few bytes of a file.
645
646Arguments:
647 cfd the open file
648 tblock the transport block
649 addr the address block - for inserting error data
650
651Returns: pointer to the required transport, or NULL
652*/
653
654transport_instance *
655check_file_format(int cfd, transport_instance *tblock, address_item *addr)
656{
657uschar *format =
658 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
659uschar data[256];
660int len = read(cfd, data, sizeof(data));
661int sep = 0;
662uschar *s;
663
664DEBUG(D_transport) debug_printf("checking file format\n");
665
666/* An empty file matches the current transport */
667
668if (len == 0) return tblock;
669
670/* Search the formats for a match */
671
672while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size))!= NULL)
673 {
674 int slen = Ustrlen(s);
675 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
676 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
677 if (match)
678 {
679 transport_instance *tt;
680 for (tt = transports; tt != NULL; tt = tt->next)
681 if (Ustrcmp(tp, tt->name) == 0)
682 {
683 DEBUG(D_transport)
684 debug_printf("file format -> %s transport\n", tt->name);
685 return tt;
686 }
687 addr->basic_errno = ERRNO_BADTRANSPORT;
688 addr->message = string_sprintf("%s transport (for %.*s format) not found",
689 tp, slen, data);
690 return NULL;
691 }
692 }
693
694/* Failed to find a match */
695
696addr->basic_errno = ERRNO_FORMATUNKNOWN;
697addr->message = US"mailbox file format unrecognized";
698return NULL;
699}
700
701
702
703
704/*************************************************
705* Check directory's files for quota *
706*************************************************/
707
708/* This function is called if quota is set for one of the delivery modes that
709delivers into a specific directory. It scans the directory and stats all the
710files in order to get a total size and count. This is an expensive thing to do,
711but some people are prepared to bear the cost. Alternatively, if size_regex is
712set, it is used as a regex to try to extract the size from the file name, a
713strategy that some people use on maildir files on systems where the users have
714no shell access.
715
716The function is global, because it is also called from tf_maildir.c for maildir
717folders (which should contain only regular files).
718
719Note: Any problems can be written to debugging output, but cannot be written to
720the log, because we are running as an unprivileged user here.
721
722Arguments:
723 dirname the name of the directory
724 countptr where to add the file count (because this function recurses)
725 regex a compiled regex to get the size from a name
726
727Returns: the sum of the sizes of the stattable files
728 zero if the directory cannot be opened
729*/
730
0d7eb84a 731off_t
0756eb3c
PH
732check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
733{
734DIR *dir;
0d7eb84a 735off_t sum = 0;
0756eb3c
PH
736int count = *countptr;
737struct dirent *ent;
738struct stat statbuf;
739
740dir = opendir(CS dirname);
741if (dir == NULL) return 0;
742
743while ((ent = readdir(dir)) != NULL)
744 {
745 uschar *name = US ent->d_name;
746 uschar buffer[1024];
747
748 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
749
750 count++;
751
752 /* If there's a regex, try to find the size using it */
753
754 if (regex != NULL)
755 {
756 int ovector[6];
757 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
758 {
759 uschar *endptr;
0d7eb84a 760 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
0756eb3c
PH
761 if (endptr == name + ovector[3])
762 {
763 sum += size;
764 DEBUG(D_transport)
b1c749bb
PH
765 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
766 size);
0756eb3c
PH
767 continue;
768 }
769 }
770 DEBUG(D_transport)
771 debug_printf("check_dir_size: regex did not match %s\n", name);
772 }
773
774 /* No regex or no match for the regex, or captured non-digits */
775
776 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
777 {
778 DEBUG(D_transport)
779 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
780 name);
781 continue;
782 }
783
784 if (Ustat(buffer, &statbuf) < 0)
785 {
786 DEBUG(D_transport)
787 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
788 strerror(errno));
789 continue;
790 }
791
792 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
793 sum += statbuf.st_size;
794 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
795 sum += check_dir_size(buffer, &count, regex);
796 }
797
798closedir(dir);
799DEBUG(D_transport)
b1c749bb
PH
800 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
801 sum, count);
0d7eb84a 802
0756eb3c
PH
803*countptr = count;
804return sum;
805}
806
807
808
809
810/*************************************************
811* Apply a lock to a file descriptor *
812*************************************************/
813
814/* This function applies a lock to a file descriptor, using a blocking or
815non-blocking lock, depending on the timeout value. It can apply either or
816both of a fcntl() and a flock() lock. However, not all OS support flock();
817for those that don't, the use_flock option cannot be set.
818
819Arguments:
820 fd the file descriptor
821 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
822 fcntl() format); the flock() type is deduced if needed
823 dofcntl do fcntl() locking
824 fcntltime non-zero to use blocking fcntl()
825 doflock do flock() locking
826 flocktime non-zero to use blocking flock()
827
828Returns: yield of the fcntl() or flock() call, with errno preserved;
829 sigalrm_seen set if there has been a timeout
830*/
831
832static int
833apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
834 int flocktime)
835{
836int yield = 0;
837int save_errno;
838struct flock lock_data;
839lock_data.l_type = fcntltype;
840lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
841
842sigalrm_seen = FALSE;
843
844if (dofcntl)
845 {
846 if (fcntltime > 0)
847 {
848 alarm(fcntltime);
849 yield = fcntl(fd, F_SETLKW, &lock_data);
850 save_errno = errno;
851 alarm(0);
852 errno = save_errno;
853 }
854 else yield = fcntl(fd, F_SETLK, &lock_data);
855 }
856
857#ifndef NO_FLOCK
858if (doflock && (yield >= 0))
859 {
860 int flocktype = (fcntltype == F_WRLCK)? LOCK_EX : LOCK_SH;
861 if (flocktime > 0)
862 {
863 alarm(flocktime);
864 yield = flock(fd, flocktype);
865 save_errno = errno;
866 alarm(0);
867 errno = save_errno;
868 }
869 else yield = flock(fd, flocktype | LOCK_NB);
870 }
871#endif /* NO_FLOCK */
872
873return yield;
874}
875
876
877
878
879#ifdef SUPPORT_MBX
880/*************************************************
881* Copy message into MBX mailbox *
882*************************************************/
883
884/* This function is called when a message intended for a MBX mailbox has been
885written to a temporary file. We can now get the size of the message and then
886copy it in MBX format to the mailbox.
887
888Arguments:
889 to_fd fd to write to (the real mailbox)
890 from_fd fd to read from (the temporary file)
891 saved_size current size of mailbox
892
893Returns: OK if all went well, DEFER otherwise, with errno preserved
894 the number of bytes written are added to transport_count
895 by virtue of calling transport_write_block()
896*/
897
898/* Values taken from c-client */
899
900#define MBX_HDRSIZE 2048
901#define MBX_NUSERFLAGS 30
902
903static int
0d7eb84a 904copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
0756eb3c 905{
0d7eb84a
PH
906int used;
907off_t size;
0756eb3c
PH
908struct stat statbuf;
909
910/* If the current mailbox size is zero, write a header block */
911
912if (saved_size == 0)
913 {
914 int i;
915 uschar *s;
916 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
917 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
918 (long int)time(NULL));
919 for (i = 0; i < MBX_NUSERFLAGS; i++)
920 sprintf (CS(s += Ustrlen(s)), "\015\012");
921 if (!transport_write_block (to_fd, deliver_out_buffer, MBX_HDRSIZE))
922 return DEFER;
923 }
924
925DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
926
927/* Now construct the message's header from the time and the RFC822 file
928size, including CRLFs, which is the size of the input (temporary) file. */
929
930if (fstat(from_fd, &statbuf) < 0) return DEFER;
931size = statbuf.st_size;
932
b1c749bb
PH
933sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
934 tod_stamp(tod_mbx), size, 0L, 0, 0);
0756eb3c
PH
935used = Ustrlen(deliver_out_buffer);
936
937/* Rewind the temporary file, and copy it over in chunks. */
938
939lseek(from_fd, 0 , SEEK_SET);
940
941while (size > 0)
942 {
943 int len = read(from_fd, deliver_out_buffer + used,
944 DELIVER_OUT_BUFFER_SIZE - used);
945 if (len <= 0)
946 {
947 if (len == 0) errno = ERRNO_MBXLENGTH;
948 return DEFER;
949 }
950 if (!transport_write_block(to_fd, deliver_out_buffer, used + len))
951 return DEFER;
952 size -= len;
953 used = 0;
954 }
955
956return OK;
957}
958#endif /* SUPPORT_MBX */
959
960
961
962/*************************************************
963* Check creation is permitted *
964*************************************************/
965
966/* This function checks whether a given file name is permitted to be created,
967as controlled by the create_file option. If no home directory is set, however,
968we can't do any tests.
969
970Arguments:
971 filename the file name
972 create_file the ob->create_file option
973
974Returns: TRUE if creation is permitted
975*/
976
977static BOOL
978check_creation(uschar *filename, int create_file)
979{
980BOOL yield = TRUE;
981
982if (deliver_home != NULL && create_file != create_anywhere)
983 {
984 int len = Ustrlen(deliver_home);
985 uschar *file = filename;
986
987 while (file[0] == '/' && file[1] == '/') file++;
988 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
989 ( Ustrchr(file+len+2, '/') != NULL &&
990 (
991 create_file != create_belowhome ||
992 Ustrstr(file+len, "/../") != NULL
993 )
994 )
995 ) yield = FALSE;
996
997 /* If yield is TRUE, the file name starts with the home directory, and does
998 not contain any instances of "/../" in the "belowhome" case. However, it may
999 still contain symbolic links. We can check for this by making use of
1000 realpath(), which most Unixes seem to have (but make it possible to cut this
1001 out). We can't just use realpath() on the whole file name, because we know
1002 the file itself doesn't exist, and intermediate directories may also not
1003 exist. What we want to know is the real path of the longest existing part of
1004 the path. That must match the home directory's beginning, whichever is the
1005 shorter. */
1006
1007 #ifndef NO_REALPATH
1008 if (yield && create_file == create_belowhome)
1009 {
1010 uschar *slash, *next;
1011 uschar *rp = NULL;
1012 for (slash = Ustrrchr(file, '/'); /* There is known to be one */
1013 rp == NULL && slash > file; /* Stop if reached beginning */
1014 slash = next)
1015 {
1016 *slash = 0;
1017 rp = US realpath(CS file, CS big_buffer);
1018 next = Ustrrchr(file, '/');
1019 *slash = '/';
1020 }
1021
1022 /* If rp == NULL it means that none of the relevant directories exist.
1023 This is not a problem here - it means that no symbolic links can exist,
1024 which is all we are worried about. Otherwise, we must compare it
1025 against the start of the home directory. However, that may itself
1026 contain symbolic links, so we have to "realpath" it as well, if
1027 possible. */
1028
1029 if (rp != NULL)
1030 {
1031 uschar hdbuffer[PATH_MAX+1];
1032 uschar *rph = deliver_home;
1033 int rlen = Ustrlen(big_buffer);
1034
1035 rp = US realpath(CS deliver_home, CS hdbuffer);
1036 if (rp != NULL)
1037 {
1038 rph = hdbuffer;
1039 len = Ustrlen(rph);
1040 }
1041
1042 if (rlen > len) rlen = len;
1043 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1044 {
1045 yield = FALSE;
1046 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1047 big_buffer, deliver_home);
1048 }
1049 }
1050 }
1051 #endif /* NO_REALPATH */
1052 }
1053
1054return yield;
1055}
1056
1057
1058
1059/*************************************************
1060* Main entry point *
1061*************************************************/
1062
1063/* See local README for general interface details. This transport always
1064returns FALSE, indicating that the status which has been placed in the first
1065address should be copied to any other addresses in a batch.
1066
1067Appendfile delivery is tricky and has led to various security problems in other
1068mailers. The logic used here is therefore laid out in some detail. When this
1069function is called, we are running in a subprocess which has had its gid and
1070uid set to the appropriate values. Therefore, we cannot write directly to the
1071exim logs. Any errors must be handled by setting appropriate return codes.
1072Note that the default setting for addr->transport_return is DEFER, so it need
1073not be set unless some other value is required.
1074
1075The code below calls geteuid() rather than getuid() to get the current uid
1076because in weird configurations not running setuid root there may be a
1077difference. In the standard configuration, where setuid() has been used in the
1078delivery process, there will be no difference between the uid and the euid.
1079
1080(1) If the af_file flag is set, this is a delivery to a file after .forward or
1081 alias expansion. Otherwise, there must be a configured file name or
1082 directory name.
1083
1084The following items apply in the case when a file name (as opposed to a
1085directory name) is given, that is, when appending to a single file:
1086
1087(2f) Expand the file name.
1088
1089(3f) If the file name is /dev/null, return success (optimization).
1090
1091(4f) If the file_format options is set, open the file for reading, and check
1092 that the bytes at the start of the file match one of the given strings.
1093 If the check indicates a transport other than the current one should be
1094 used, pass control to that other transport. Otherwise continue. An empty
1095 or non-existent file matches the current transport. The file is closed
1096 after the check.
1097
1098(5f) If a lock file is required, create it (see extensive separate comments
1099 below about the algorithm for doing this). It is important to do this
1100 before opening the mailbox if NFS is in use.
1101
1102(6f) Stat the file, using lstat() rather than stat(), in order to pick up
1103 details of any symbolic link.
1104
1105(7f) If the file already exists:
1106
1107 Check the owner and group if necessary, and defer if they are wrong.
1108
1109 If it is a symbolic link AND the allow_symlink option is set (NOT the
1110 default), go back to (6f) but this time use stat() instead of lstat().
1111
1112 If it's not a regular file (or FIFO when permitted), defer delivery.
1113
1114 Check permissions. If the required permissions are *less* than the
1115 existing ones, or supplied by the address (often by the user via filter),
1116 chmod() the file. Otherwise, defer.
1117
1118 Save the inode number.
1119
1120 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1121
1122 If open fails because the file does not exist, go to (6f); on any other
1123 failure, defer.
1124
1125 Check the inode number hasn't changed - I realize this isn't perfect (an
1126 inode can be reused) but it's cheap and will catch some of the races.
1127
1128 Check it's still a regular file (or FIFO if permitted).
1129
1130 Check that the owner and permissions haven't changed.
1131
1132 If file_format is set, check that the file still matches the format for
1133 the current transport. If not, defer delivery.
1134
1135(8f) If file does not exist initially:
1136
1137 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1138 this is via a symbolic link (only possible if allow_symlinks is set), in
1139 which case don't use O_EXCL, as it dosn't work.
1140
1141 If open fails because the file already exists, go to (6f). To avoid
1142 looping for ever in a situation where the file is continuously being
1143 created and deleted, all of this happens inside a loop that operates
1144 lock_retries times and includes the fcntl and flock locking. If the
1145 loop completes without the file getting opened, defer and request
1146 freezing, because something really weird is happening.
1147
1148 If open fails for any other reason, defer for subsequent delivery except
1149 when this is a file delivery resulting from an alias or forward expansion
1150 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1151 most likely a user rather than a configuration error.
1152
1153(9f) We now have the file checked and open for writing. If so configured, lock
1154 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1155 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1156 still fails, give up and defer delivery.
1157
1158(10f)Save the access time (for subsequent restoration) and the size of the
1159 file, for comsat and for re-setting if delivery fails in the middle -
1160 e.g. for quota exceeded.
1161
1162The following items apply in the case when a directory name is given:
1163
1164(2d) Create a new file in the directory using a temporary name, by opening for
1165 writing and with O_CREAT. If maildir format is being used, the file
1166 is created in a temporary subdirectory with a prescribed name. If
1167 mailstore format is being used, the envelope file is first created with a
1168 temporary name, then the data file.
1169
1170The following items apply in all cases:
1171
1172(11) We now have the file open for writing, and locked if it was given as a
1173 file name. Write the message and flush the file, unless there is a setting
1174 of the local quota option, in which case we can check for its excession
1175 without doing any writing.
1176
1177 In the case of MBX format mailboxes, the message is first written to a
1178 temporary file, in order to get its correct length. This is then copied to
1179 the real file, preceded by an MBX header.
1180
1181 If there is a quota error on writing, defer the address. Timeout logic
1182 will determine for how long retries are attempted. We restore the mailbox
1183 to its original length if it's a single file. There doesn't seem to be a
1184 uniform error code for quota excession (it even differs between SunOS4
1185 and some versions of SunOS5) so a system-dependent macro called
1186 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1187 compile time.
1188
1189 For any other error (most commonly disk full), do the same.
1190
1191The following applies after appending to a file:
1192
1193(12f)Restore the atime; notify_comsat if required; close the file (which
1194 unlocks it if it was locked). Delete the lock file if it exists.
1195
1196The following applies after writing a unique file in a directory:
1197
1198(12d)For maildir format, rename the file into the new directory. For mailstore
1199 format, rename the envelope file to its correct name. Otherwise, generate
1200 a unique name from the directory_file option, and rename to that, possibly
1201 trying a few times if the file exists and re-expanding the name gives a
1202 different string.
1203
1204This transport yields FAIL only when a file name is generated by an alias or
1205forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1206All other failures return DEFER (in addr->transport_return). */
1207
1208
1209BOOL
1210appendfile_transport_entry(
1211 transport_instance *tblock, /* data for this instantiation */
1212 address_item *addr) /* address we are working on */
1213{
1214appendfile_transport_options_block *ob =
1215 (appendfile_transport_options_block *)(tblock->options_block);
1216struct stat statbuf;
1217uschar *fdname = NULL;
1218uschar *filename = NULL;
1219uschar *hitchname = NULL;
1220uschar *dataname = NULL;
1221uschar *lockname = NULL;
1222uschar *newname = NULL;
1223uschar *nametag = NULL;
1224uschar *cr = US"";
1225uschar *filecount_msg = US"";
1226uschar *path;
1227struct utimbuf times;
1228struct timeval msg_tv;
1229BOOL isdirectory = FALSE;
1230BOOL isfifo = FALSE;
1231BOOL wait_for_tick = FALSE;
1232uid_t uid = geteuid(); /* See note above */
1233gid_t gid = getegid();
1234int mbformat;
1235int mode = (addr->mode > 0)? addr->mode : ob->mode;
0d7eb84a
PH
1236off_t saved_size = -1;
1237off_t mailbox_size = ob->mailbox_size_value;
0756eb3c
PH
1238int mailbox_filecount = ob->mailbox_filecount_value;
1239int hd = -1;
1240int fd = -1;
1241int yield = FAIL;
1242int i;
1243
1244#ifdef SUPPORT_MBX
1245int save_fd = 0;
1246int mbx_lockfd = -1;
1247uschar mbx_lockname[40];
1248FILE *temp_file = NULL;
1249#endif /* SUPPORT_MBX */
1250
1251#ifdef SUPPORT_MAILDIR
1252int maildirsize_fd = -1; /* fd for maildirsize file */
1253int maildir_save_errno;
1254#endif
1255
1256
1257DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1258
1259/* An "address_file" or "address_directory" transport is used to deliver to
1260files specified via .forward or an alias file. Prior to release 4.20, the
1261"file" and "directory" options were ignored in this case. This has been changed
1262to allow the redirection data to specify what is in effect a folder, whose
1263location is determined by the options on the transport.
1264
1265Compatibility with the case when neither option is set is retained by forcing a
1266value for the file or directory name. A directory delivery is assumed if the
1267last character of the path from the router is '/'.
1268
1269The file path is in the local part of the address, but not in the $local_part
1270variable (that holds the parent local part). It is, however, in the
1271$address_file variable. Below, we update the local part in the address if it
1272changes by expansion, so that the final path ends up in the log. */
1273
1274if (testflag(addr, af_file) &&
1275 ob->filename == NULL &&
1276 ob->dirname == NULL)
1277 {
1278 fdname = US"$address_file";
1279 if (address_file[Ustrlen(address_file)-1] == '/' ||
1280 ob->maildir_format ||
1281 ob->mailstore_format)
1282 isdirectory = TRUE;
1283 }
1284
1285/* Handle (a) an "address file" delivery where "file" or "directory" is
1286explicitly set and (b) a non-address_file delivery, where one of "file" or
1287"directory" must be set; initialization ensures that they are not both set. */
1288
1289if (fdname == NULL)
1290 {
1291 fdname = ob->filename;
1292 if (fdname == NULL)
1293 {
1294 fdname = ob->dirname;
1295 isdirectory = TRUE;
1296 }
1297 if (fdname == NULL)
1298 {
1299 addr->transport_return = PANIC;
1300 addr->message = string_sprintf("Mandatory file or directory option "
1301 "missing from %s transport", tblock->name);
1302 return FALSE;
1303 }
1304 }
1305
1306/* Maildir and mailstore require a directory */
1307
1308if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1309 {
1310 addr->transport_return = PANIC;
1311 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1312 "to be specified for the %s transport",
1313 ob->maildir_format? "dir" : "store", tblock->name);
1314 return FALSE;
1315 }
1316
1317path = expand_string(fdname);
1318
1319if (path == NULL)
1320 {
1321 addr->transport_return = PANIC;
1322 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1323 "name for %s transport) failed: %s", fdname, tblock->name,
1324 expand_string_message);
1325 return FALSE;
1326 }
1327
1328if (path[0] != '/')
1329 {
1330 addr->message = string_sprintf("appendfile: file or directory name "
1331 "\"%s\" is not absolute", path);
1332 addr->basic_errno = ERRNO_NOTABSOLUTE;
1333 return FALSE;
1334 }
1335
1336/* For a file delivery, make sure the local part in the address is updated to
1337the true local part. */
1338
1339if (testflag(addr, af_file)) addr->local_part = string_copy(path);
1340
1341/* The available mailbox formats depend on whether it is a directory or a file
1342delivery. */
1343
1344if (isdirectory)
1345 {
1346 mbformat =
1347 #ifdef SUPPORT_MAILDIR
1348 (ob->maildir_format)? mbf_maildir :
1349 #endif
1350 #ifdef SUPPORT_MAILSTORE
1351 (ob->mailstore_format)? mbf_mailstore :
1352 #endif
1353 mbf_smail;
1354 }
1355else
1356 {
1357 mbformat =
1358 #ifdef SUPPORT_MBX
1359 (ob->mbx_format)? mbf_mbx :
1360 #endif
1361 mbf_unix;
1362 }
1363
1364DEBUG(D_transport)
1365 {
b1c749bb
PH
1366 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1367 " warning=" OFF_T_FMT "%s\n"
0756eb3c
PH
1368 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1369 "maildir_use_size_file=%s\n",
b1c749bb
PH
1370 mode, ob->notify_comsat, ob->quota_value,
1371 ob->quota_warn_threshold_value,
0756eb3c
PH
1372 ob->quota_warn_threshold_is_percent? "%" : "",
1373 isdirectory? "directory" : "file",
1374 path, mailbox_formats[mbformat],
1375 (ob->message_prefix == NULL)? US"null" : string_printing(ob->message_prefix),
1376 (ob->message_suffix == NULL)? US"null" : string_printing(ob->message_suffix),
1377 (ob->maildir_use_size_file)? "yes" : "no");
1378
1379 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1380 ob->use_lockfile? "lockfile " : "",
1381 ob->use_mbx_lock? "mbx locking (" : "",
1382 ob->use_fcntl? "fcntl " : "",
1383 ob->use_flock? "flock" : "",
1384 ob->use_mbx_lock? ")" : "");
1385 }
1386
1387/* If the -N option is set, can't do any more. */
1388
1389if (dont_deliver)
1390 {
1391 DEBUG(D_transport)
1392 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1393 tblock->name);
1394 addr->transport_return = OK;
1395 return FALSE;
1396 }
1397
1398/* Handle the case of a file name. If the file name is /dev/null, we can save
1399ourselves some effort and just give a success return right away. */
1400
1401if (!isdirectory)
1402 {
1403 BOOL use_lstat = TRUE;
1404 BOOL file_opened = FALSE;
1405 BOOL allow_creation_here = TRUE;
1406
1407 if (Ustrcmp(path, "/dev/null") == 0)
1408 {
1409 addr->transport_return = OK;
1410 return FALSE;
1411 }
1412
1413 /* Set the name of the file to be opened, and the file to which the data
1414 is written, and find out if we are permitted to create a non-existent file. */
1415
1416 dataname = filename = path;
1417 allow_creation_here = check_creation(filename, ob->create_file);
1418
1419 /* If ob->create_directory is set, attempt to create the directories in
1420 which this mailbox lives, but only if we are permitted to create the file
1421 itself. We know we are dealing with an absolute path, because this was
1422 checked above. */
1423
1424 if (ob->create_directory && allow_creation_here)
1425 {
1426 uschar *p = Ustrrchr(path, '/');
1427 *p = '\0';
1428 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1429 {
1430 addr->basic_errno = errno;
1431 addr->message =
1432 string_sprintf("failed to create directories for %s: %s", path,
1433 strerror(errno));
1434 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1435 return FALSE;
1436 }
1437 *p = '/';
1438 }
1439
1440 /* If file_format is set we must check that any existing file matches one of
1441 the configured formats by checking the bytes it starts with. A match then
1442 indicates a specific transport - if it is not this one, pass control to it.
1443 Otherwise carry on here. An empty or non-existent file matches the current
1444 transport. We don't need to distinguish between non-existence and other open
1445 failures because if an existing file fails to open here, it will also fail
1446 again later when O_RDWR is used. */
1447
1448 if (ob->file_format != NULL)
1449 {
1450 int cfd = Uopen(path, O_RDONLY, 0);
1451 if (cfd >= 0)
1452 {
1453 transport_instance *tt = check_file_format(cfd, tblock, addr);
f1e894f3 1454 (void)close(cfd);
0756eb3c
PH
1455
1456 /* If another transport is indicated, call it and return; if no transport
1457 was found, just return - the error data will have been set up.*/
1458
1459 if (tt != tblock)
1460 {
1461 if (tt != NULL)
1462 {
1463 set_process_info("delivering %s to %s using %s", message_id,
1464 addr->local_part, tt->name);
1465 debug_print_string(tt->debug_string);
1466 addr->transport = tt;
1467 (tt->info->code)(tt, addr);
1468 }
1469 return FALSE;
1470 }
1471 }
1472 }
1473
1474 /* The locking of mailbox files is worse than the naming of cats, which is
1475 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1476 three different names, so several different styles of locking are used.
1477
1478 Research in other programs that lock mailboxes shows that there is no
1479 universally standard method. Having mailboxes NFS-mounted on the system that
1480 is delivering mail is not the best thing, but people do run like this,
1481 and so the code must do its best to cope.
1482
1483 Three different locking mechanisms are supported. The initialization function
1484 checks that at least one is configured.
1485
1486 LOCK FILES
1487
1488 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1489 will work over NFS. Only after that is done do we actually open the mailbox
1490 and apply locks to it (if configured).
1491
1492 Originally, Exim got the file opened before doing anything about locking.
1493 However, a very occasional problem was observed on Solaris 2 when delivering
1494 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1495 gets remembered at open time. If another process on another host (that's
1496 important) has the file open and locked and writes to it and then releases
1497 the lock while the first process is waiting to get the lock, the first
1498 process may fail to write at the new end point of the file - despite the very
1499 definite statement about O_APPEND in the man page for write(). Experiments
1500 have reproduced this problem, but I do not know any way of forcing a host to
1501 update its attribute cache for an open NFS file. It would be nice if it did
1502 so when a lock was taken out, but this does not seem to happen. Anyway, to
1503 reduce the risk of this problem happening, we now create the lock file
1504 (if configured) *before* opening the mailbox. That will prevent two different
1505 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1506 however, but Pine at least seems to operate in the same way.
1507
1508 Lockfiles should normally be used when NFS is involved, because of the above
1509 problem.
1510
1511 The logic for creating the lock file is:
1512
1513 . The name of the lock file is <mailbox-name>.lock
1514
1515 . First, create a "hitching post" name by adding the primary host name,
1516 current time and pid to the lock file name. This should be unique.
1517
1518 . Create the hitching post file using WRONLY + CREAT + EXCL.
1519
1520 . If that fails EACCES, we assume it means that the user is unable to create
1521 files in the mail spool directory. Some installations might operate in this
1522 manner, so there is a configuration option to allow this state not to be an
1523 error - we proceed to lock using fcntl only, after the file is open.
1524
1525 . Otherwise, an error causes a deferment of the address.
1526
1527 . Hard link the hitching post to the lock file name.
1528
1529 . If the link succeeds, we have successfully created the lock file. Simply
1530 close and unlink the hitching post file.
1531
1532 . If the link does not succeed, proceed as follows:
1533
1534 o Fstat the hitching post file, and then close and unlink it.
1535
1536 o Now examine the stat data. If the number of links to the file is exactly
1537 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1538 the return never made it back, so the link() function gave a failure
1539 return.
1540
1541 . This method allows for the lock file to be created by some other process
1542 right up to the moment of the attempt to hard link it, and is also robust
1543 against NFS server crash-reboots, which would probably result in timeouts
1544 in the middle of link().
1545
1546 . System crashes may cause lock files to get left lying around, and some means
1547 of flushing them is required. The approach of writing a pid (used by smail
1548 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1549 timeout, which seems a better approach. Since any program that writes to a
1550 mailbox using a lock file should complete its task very quickly, Pine
1551 removes lock files that are older than 5 minutes. We allow the value to be
1552 configurable on the transport.
1553
1554 FCNTL LOCKING
1555
1556 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1557 mailbox once it is open. This is done by default with a non-blocking lock.
1558 Failures to lock cause retries after a sleep, but only for a certain number
1559 of tries. A blocking lock is deliberately not used so that we don't hold the
1560 mailbox open. This minimizes the possibility of the NFS problem described
1561 under LOCK FILES above, if for some reason NFS deliveries are happening
1562 without lock files. However, the use of a non-blocking lock and sleep, though
1563 the safest approach, does not give the best performance on very busy systems.
1564 A blocking lock plus timeout does better. Therefore Exim has an option to
1565 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1566 enables the use of blocking fcntl() calls.
1567
1568 FLOCK LOCKING
1569
1570 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1571 same manner as for fcntl locking above. No-blocking/timeout is also set as
1572 above in lock_flock_timeout. Not all operating systems provide or support
1573 flock(). For those that don't (as determined by the definition of LOCK_SH in
1574 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1575 is implemented (not precisely) on top of fcntl(), which means there's no
1576 point in actually using it.
1577
1578 MBX LOCKING
1579
1580 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1581 then the rules used for locking in c-client are used. Exim takes out a shared
1582 lock on the mailbox file, and an exclusive lock on the file whose name is
1583 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1584 any other MBX client from getting an exclusive lock on it and expunging it.
1585 It also stops any other MBX client from unlinking the /tmp lock when it has
1586 finished with it.
1587
1588 The exclusive lock on the /tmp file prevents any other MBX client from
1589 updating the mailbox in any way. When writing is finished, if an exclusive
1590 lock on the mailbox can be obtained, indicating there are no current sharers,
1591 the /tmp file is unlinked.
1592
1593 MBX locking can use either fcntl() or flock() locking. If neither
1594 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1595 The calls for getting these locks are by default non-blocking, as for non-mbx
1596 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1597 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1598 probably makes sense to set timeouts for any MBX deliveries. */
1599
1600
1601 /* Build a lock file if configured to do so - the existence of a lock
1602 file is subsequently checked by looking for a non-negative value of the
1603 file descriptor hd - even though the file is no longer open. */
1604
1605 if (ob->use_lockfile)
1606 {
1607 lockname = string_sprintf("%s.lock", filename);
1608 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1609 (unsigned int)(time(NULL)), (unsigned int)getpid());
1610
1611 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1612 hitchname);
1613
1614 /* Lock file creation retry loop */
1615
1616 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1617 {
1618 int rc;
1619 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1620
1621 if (hd < 0)
1622 {
1623 addr->basic_errno = errno;
1624 addr->message =
1625 string_sprintf("creating lock file hitching post %s "
1626 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1627 (long int)getegid());
1628 return FALSE;
1629 }
1630
1631 /* Attempt to hitch the hitching post to the lock file. If link()
1632 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1633 file, and get rid of the hitching post. If the number of links was 2,
1634 the link was created, despite the failure of link(). If the hitch was
1635 not successful, try again, having unlinked the lock file if it is too
1636 old.
1637
1638 There's a version of Linux (2.0.27) which doesn't update its local cache
1639 of the inode after link() by default - which many think is a bug - but
1640 if the link succeeds, this code will be OK. It just won't work in the
1641 case when link() fails after having actually created the link. The Linux
1642 NFS person is fixing this; a temporary patch is available if anyone is
1643 sufficiently worried. */
1644
1645 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
f1e894f3 1646 (void)close(hd);
0756eb3c
PH
1647 Uunlink(hitchname);
1648 if (rc != 0 && statbuf.st_nlink != 2)
1649 {
1650 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1651 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1652 {
1653 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1654 Uunlink(lockname);
1655 }
1656 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1657 continue;
1658 }
1659
1660 DEBUG(D_transport) debug_printf("lock file created\n");
1661 break;
1662 }
1663
1664 /* Check for too many tries at creating the lock file */
1665
1666 if (i >= ob->lock_retries)
1667 {
1668 addr->basic_errno = ERRNO_LOCKFAILED;
1669 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1670 filename);
1671 return FALSE;
1672 }
1673 }
1674
1675
1676 /* We now have to get the file open. First, stat() it and act on existence or
1677 non-existence. This is in a loop to handle the case of a file's being created
1678 or deleted as we watch, and also to handle retries when the locking fails.
1679 Rather than holding the file open while waiting for the fcntl() and/or
1680 flock() lock, we close and do the whole thing again. This should be safer,
1681 especially for NFS files, which might get altered from other hosts, making
1682 their cached sizes incorrect.
1683
1684 With the default settings, no symlinks are permitted, but there is an option
1685 to permit symlinks for those sysadmins that know what they are doing.
1686 Shudder. However, insist that the initial symlink is owned by the right user.
1687 Thus lstat() is used initially; if a symlink is discovered, the loop is
1688 repeated such that stat() is used, to look at the end file. */
1689
1690 for (i = 0; i < ob->lock_retries; i++)
1691 {
1692 int sleep_before_retry = TRUE;
1693 file_opened = FALSE;
1694
1695 if((use_lstat? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1696 {
1697 /* Let's hope that failure to stat (other than non-existence) is a
1698 rare event. */
1699
1700 if (errno != ENOENT)
1701 {
1702 addr->basic_errno = errno;
1703 addr->message = string_sprintf("attempting to stat mailbox %s",
1704 filename);
1705 goto RETURN;
1706 }
1707
1708 /* File does not exist. If it is required to pre-exist this state is an
1709 error. */
1710
1711 if (ob->file_must_exist)
1712 {
1713 addr->basic_errno = errno;
1714 addr->message = string_sprintf("mailbox %s does not exist, "
1715 "but file_must_exist is set", filename);
1716 goto RETURN;
1717 }
1718
1719 /* If not permitted to create this file because it isn't in or below
1720 the home directory, generate an error. */
1721
1722 if (!allow_creation_here)
1723 {
1724 addr->basic_errno = ERRNO_BADCREATE;
1725 addr->message = string_sprintf("mailbox %s does not exist, "
1726 "but creation outside the home directory is not permitted",
1727 filename);
1728 goto RETURN;
1729 }
1730
1731 /* Attempt to create and open the file. If open fails because of
1732 pre-existence, go round the loop again. For any other error, defer the
1733 address, except for an alias or forward generated file name with EPERM,
1734 ENOENT, or EACCES, as those are most likely to be user errors rather
1735 than Exim config errors. When a symbolic link is permitted and points
1736 to a non-existent file, we get here with use_lstat = FALSE. In this case
1737 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1738 consistency and because MBX locking requires it in order to be able to
1739 get a shared lock. */
1740
1741 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1742 (use_lstat? O_EXCL : 0), mode);
1743 if (fd < 0)
1744 {
1745 if (errno == EEXIST) continue;
1746 addr->basic_errno = errno;
1747 addr->message = string_sprintf("while creating mailbox %s",
1748 filename);
1749 if (testflag(addr, af_file) &&
1750 (errno == EPERM || errno == ENOENT || errno == EACCES))
1751 addr->transport_return = FAIL;
1752 goto RETURN;
1753 }
1754
1755 /* We have successfully created and opened the file. Ensure that the group
1756 and the mode are correct. */
1757
ff790e47
PH
1758 (void)Uchown(filename, uid, gid);
1759 (void)Uchmod(filename, mode);
0756eb3c
PH
1760 }
1761
1762
1763 /* The file already exists. Test its type, ownership, and permissions, and
1764 save the inode for checking later. If symlinks are permitted (not the
1765 default or recommended state) it may be a symlink that already exists.
1766 Check its ownership and then look for the file at the end of the link(s).
1767 This at least prevents one user creating a symlink for another user in
1768 a sticky directory. */
1769
1770 else
1771 {
1772 int oldmode = (int)statbuf.st_mode;
1773 ino_t inode = statbuf.st_ino;
1774 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1775
1776 isfifo = FALSE; /* In case things are changing */
1777
1778 /* Check owner if required - the default. */
1779
1780 if (ob->check_owner && statbuf.st_uid != uid)
1781 {
1782 addr->basic_errno = ERRNO_BADUGID;
1783 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1784 "(%ld != %ld)", filename,
1785 islink? " (symlink)" : "",
1786 (long int)(statbuf.st_uid), (long int)uid);
1787 goto RETURN;
1788 }
1789
1790 /* Group is checked only if check_group is set. */
1791
1792 if (ob->check_group && statbuf.st_gid != gid)
1793 {
1794 addr->basic_errno = ERRNO_BADUGID;
1795 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1796 filename, islink? " (symlink)" : "", statbuf.st_gid, gid);
1797 goto RETURN;
1798 }
1799
1800 /* If symlinks are permitted (not recommended), the lstat() above will
1801 have found the symlink. Its ownership has just been checked; go round
1802 the loop again, using stat() instead of lstat(). That will never yield a
1803 mode of S_IFLNK. */
1804
1805 if (islink && ob->allow_symlink)
1806 {
1807 use_lstat = FALSE;
1808 i--; /* Don't count this time round */
1809 continue;
1810 }
1811
1812 /* An actual file exists. Check that it is a regular file, or FIFO
1813 if permitted. */
1814
1815 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1816
1817 else if ((oldmode & S_IFMT) != S_IFREG)
1818 {
1819 addr->basic_errno = ERRNO_NOTREGULAR;
1820 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1821 filename, ob->allow_fifo? " or named pipe" : "");
1822 goto RETURN;
1823 }
1824
1825 /* If the mode is not what it would be for a newly created file, change
1826 the permissions if the mode is supplied for the address. Otherwise,
1827 reduce but do not extend the permissions. If the newly created
1828 permissions are greater than the existing permissions, don't change
1829 things when the mode is not from the address. */
1830
1831 if ((oldmode = (oldmode & 07777)) != mode)
1832 {
1833 int diffs = oldmode ^ mode;
1834 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1835 {
1836 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1837 if (Uchmod(filename, mode) < 0)
1838 {
1839 addr->basic_errno = errno;
1840 addr->message = string_sprintf("attempting to chmod mailbox %s",
1841 filename);
1842 goto RETURN;
1843 }
1844 oldmode = mode;
1845 }
1846
1847 /* Mode not from address, and newly-created permissions are greater
1848 than existing permissions. Default is to complain, but it can be
1849 configured to go ahead and try to deliver anyway if that's what
1850 the administration wants. */
1851
1852 else if (ob->mode_fail_narrower)
1853 {
1854 addr->basic_errno = ERRNO_BADMODE;
1855 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1856 "(%o expected)", filename, oldmode, mode);
1857 goto RETURN;
1858 }
1859 }
1860
1861 /* We are happy with the existing file. Open it, and then do further
1862 tests to ensure that it is the same file that we were just looking at.
1863 If the file does not now exist, restart this loop, going back to using
1864 lstat again. For an NFS error, just defer; other opening errors are
1865 more serious. The file is opened RDWR so that its format can be checked,
1866 and also MBX locking requires the use of a shared (read) lock. However,
1867 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1868 reading the pipe. */
1869
1870 fd = Uopen(filename, isfifo? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1871 mode);
1872 if (fd < 0)
1873 {
1874 if (errno == ENOENT)
1875 {
1876 use_lstat = TRUE;
1877 continue;
1878 }
1879 addr->basic_errno = errno;
1880 if (isfifo)
1881 {
1882 addr->message = string_sprintf("while opening named pipe %s "
1883 "(could mean no process is reading it)", filename);
1884 }
1885 else if (errno != EWOULDBLOCK)
1886 {
1887 addr->message = string_sprintf("while opening mailbox %s", filename);
1888 }
1889 goto RETURN;
1890 }
1891
1892 /* This fstat really shouldn't fail, as we have an open file! There's a
1893 dilemma here. We use fstat in order to be sure we are peering at the file
1894 we have got open. However, that won't tell us if the file was reached
1895 via a symbolic link. We checked this above, but there is a race exposure
1896 if the link was created between the previous lstat and the open. However,
1897 it would have to be created with the same inode in order to pass the
1898 check below. If ob->allow_symlink is set, causing the use of stat rather
1899 than lstat above, symbolic links may be there anyway, and the checking is
1900 weaker. */
1901
1902 if (fstat(fd, &statbuf) < 0)
1903 {
1904 addr->basic_errno = errno;
1905 addr->message = string_sprintf("attempting to stat open mailbox %s",
1906 filename);
1907 goto RETURN;
1908 }
1909
1910 /* Check the inode; this is isn't a perfect check, but gives some
1911 confidence. */
1912
1913 if (inode != statbuf.st_ino)
1914 {
1915 addr->basic_errno = ERRNO_INODECHANGED;
1916 addr->message = string_sprintf("opened mailbox %s inode number changed "
1917 "from %d to %ld", filename, inode, statbuf.st_ino);
1918 addr->special_action = SPECIAL_FREEZE;
1919 goto RETURN;
1920 }
1921
1922 /* Check it's still a regular file or FIFO, and the uid, gid, and
1923 permissions have not changed. */
1924
1925 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1926 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1927 {
1928 addr->basic_errno = ERRNO_NOTREGULAR;
1929 addr->message =
1930 string_sprintf("opened mailbox %s is no longer a %s", filename,
1931 isfifo? "named pipe" : "regular file");
1932 addr->special_action = SPECIAL_FREEZE;
1933 goto RETURN;
1934 }
1935
1936 if ((ob->check_owner && statbuf.st_uid != uid) ||
1937 (ob->check_group && statbuf.st_gid != gid))
1938 {
1939 addr->basic_errno = ERRNO_BADUGID;
1940 addr->message =
1941 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1942 addr->special_action = SPECIAL_FREEZE;
1943 goto RETURN;
1944 }
1945
1946 if ((statbuf.st_mode & 07777) != oldmode)
1947 {
1948 addr->basic_errno = ERRNO_BADMODE;
1949 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
1950 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
1951 addr->special_action = SPECIAL_FREEZE;
1952 goto RETURN;
1953 }
1954
1955 /* If file_format is set, check that the format of the file has not
1956 changed. Error data is set by the testing function. */
1957
1958 if (ob->file_format != NULL &&
1959 check_file_format(fd, tblock, addr) != tblock)
1960 {
1961 addr->message = US"open mailbox has changed format";
1962 goto RETURN;
1963 }
1964
1965 /* The file is OK. Carry on to do the locking. */
1966 }
1967
1968 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
1969 locking rules if configured to do so. If a lock file is also required, it
1970 was created above and hd was left >= 0. At least one form of locking is
1971 required by the initialization function. If locking fails here, close the
1972 file and go round the loop all over again, after waiting for a bit, unless
1973 blocking locking was used. */
1974
1975 file_opened = TRUE;
1976 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
1977 sleep_before_retry = FALSE;
1978
1979 /* Simple fcntl() and/or flock() locking */
1980
1981 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
1982 {
1983 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1984 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
1985 }
1986
1987 /* MBX locking rules */
1988
1989 #ifdef SUPPORT_MBX
1990 else if (ob->use_mbx_lock)
1991 {
1992 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
1993 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
1994 fstat(fd, &statbuf) >= 0)
1995 {
1996 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
1997 (long)statbuf.st_ino);
1998
1999 if (Ulstat(mbx_lockname, &statbuf) >= 0)
2000 {
2001 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
2002 {
2003 addr->basic_errno = ERRNO_LOCKFAILED;
2004 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2005 mbx_lockname);
2006 goto RETURN;
2007 }
2008 if (statbuf.st_nlink > 1)
2009 {
2010 addr->basic_errno = ERRNO_LOCKFAILED;
2011 addr->message = string_sprintf("hard link to MBX lock file %s",
2012 mbx_lockname);
2013 goto RETURN;
2014 }
2015 }
2016
2017 mbx_lockfd = Uopen(mbx_lockname, O_RDWR | O_CREAT, 0600);
2018 if (mbx_lockfd < 0)
2019 {
2020 addr->basic_errno = ERRNO_LOCKFAILED;
2021 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2022 mbx_lockname, strerror(errno));
2023 goto RETURN;
2024 }
2025
ff790e47 2026 (void)Uchmod(mbx_lockname, 0600);
0756eb3c
PH
2027
2028 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2029 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2030 {
2031 struct stat ostatbuf;
2032
2033 /* This tests for a specific race condition. Ensure that we still
2034 have the same file. */
2035
2036 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2037 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2038 statbuf.st_dev == ostatbuf.st_dev &&
2039 statbuf.st_ino == ostatbuf.st_ino)
2040 break;
2041 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2042 "between creation and locking\n", mbx_lockname);
2043 }
2044
2045 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2046 strerror(errno));
f1e894f3 2047 (void)close(mbx_lockfd);
0756eb3c
PH
2048 mbx_lockfd = -1;
2049 }
2050 else
2051 {
2052 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2053 filename, strerror(errno));
2054 }
2055 }
2056 #endif /* SUPPORT_MBX */
2057
2058 else break; /* No on-file locking required; break the open/lock loop */
2059
2060 DEBUG(D_transport)
2061 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2062
f1e894f3 2063 (void)close(fd);
0756eb3c
PH
2064 fd = -1;
2065 use_lstat = TRUE; /* Reset to use lstat first */
2066
2067
2068 /* If a blocking call timed out, break the retry loop if the total time
2069 so far is not less than than retries * interval. Use the larger of the
2070 flock() and fcntl() timeouts. */
2071
2072 if (sigalrm_seen &&
2073 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2074 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2075 ob->lock_retries * ob->lock_interval)
2076 i = ob->lock_retries;
2077
2078 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2079 flock() that caused the problem. */
2080
2081 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2082 }
2083
2084 /* Test for exceeding the maximum number of tries. Either the file remains
2085 locked, or, if we haven't got it open, something is terribly wrong... */
2086
2087 if (i >= ob->lock_retries)
2088 {
2089 if (!file_opened)
2090 {
2091 addr->basic_errno = ERRNO_EXISTRACE;
2092 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2093 addr->special_action = SPECIAL_FREEZE;
2094 }
2095 else
2096 {
2097 addr->basic_errno = ERRNO_LOCKFAILED;
2098 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2099 filename);
2100 }
2101 goto RETURN;
2102 }
2103
2104 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2105
2106 /* Save access time (for subsequent restoration), modification time (for
2107 restoration if updating fails), size of file (for comsat and for re-setting if
2108 delivery fails in the middle - e.g. for quota exceeded). */
2109
2110 if (fstat(fd, &statbuf) < 0)
2111 {
2112 addr->basic_errno = errno;
2113 addr->message = string_sprintf("while fstatting opened mailbox %s",
2114 filename);
2115 goto RETURN;
2116 }
2117
2118 times.actime = statbuf.st_atime;
2119 times.modtime = statbuf.st_mtime;
2120 saved_size = statbuf.st_size;
2121 if (mailbox_size < 0) mailbox_size = saved_size;
2122 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2123 }
2124
2125/* Prepare for writing to a new file (as opposed to appending to an old one).
2126There are several different formats, but there is preliminary stuff concerned
2127with quotas that applies to all of them. Finding the current size by directory
2128scanning is expensive; for maildirs some fudges have been invented:
2129
2130 (1) A regex can be used to extract a file size from its name;
2131 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2132 mailbox size.
2133*/
2134
2135else
2136 {
2137 uschar *check_path = path; /* Default quota check path */
2138 const pcre *regex = NULL; /* Regex for file size from file name */
2139
2140 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2141 {
2142 addr->basic_errno = ERRNO_BADCREATE;
2143 addr->message = string_sprintf("tried to create file in %s, but "
2144 "file creation outside the home directory is not permitted", path);
2145 goto RETURN;
2146 }
2147
2148 #ifdef SUPPORT_MAILDIR
2149 /* For a maildir delivery, ensure that all the relevant directories exist */
2150
2151 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2152 ob->create_directory, ob->dirmode))
2153 return FALSE;
2154 #endif /* SUPPORT_MAILDIR */
2155
2156 /* If we are going to do a quota check, of if maildir_use_size_file is set
2157 for a maildir delivery, compile the regular expression if there is one. We
2158 may also need to adjust the path that is used. We need to do this for
2159 maildir_use_size_file even if the quota is unset, because we still want to
2160 create the file. When maildir support is not compiled,
2161 ob->maildir_use_size_file is always FALSE. */
2162
2163 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2164 {
2165 const uschar *error;
2166 int offset;
2167
2168 /* Compile the regex if there is one */
2169
2170 if (ob->quota_size_regex != NULL)
2171 {
2172 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2173 (const char **)&error, &offset, NULL);
2174 if (regex == NULL)
2175 {
2176 addr->message = string_sprintf("appendfile: regular expression "
2177 "error: %s at offset %d while compiling %s", error, offset,
2178 ob->quota_size_regex);
2179 return FALSE;
2180 }
2181 else
2182 {
2183 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2184 ob->quota_size_regex);
2185 }
2186 }
2187
2188 /* Use an explicitly configured directory if set */
2189
2190 if (ob->quota_directory != NULL)
2191 {
2192 check_path = expand_string(ob->quota_directory);
2193 if (check_path == NULL)
2194 {
2195 addr->transport_return = PANIC;
2196 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2197 "name for %s transport) failed: %s", ob->quota_directory,
2198 tblock->name, expand_string_message);
2199 return FALSE;
2200 }
2201
2202 if (check_path[0] != '/')
2203 {
2204 addr->message = string_sprintf("appendfile: quota_directory name "
2205 "\"%s\" is not absolute", check_path);
2206 addr->basic_errno = ERRNO_NOTABSOLUTE;
2207 return FALSE;
2208 }
2209 }
2210
2211 #ifdef SUPPORT_MAILDIR
2212 /* Otherwise, if we are handling a maildir delivery, and the directory
2213 contains a file called maildirfolder, this is a maildir++ feature telling
2214 us that this is a sub-directory of the real inbox. We should therefore do
2215 the quota check on the parent directory. Beware of the special case when
2216 the directory name itself ends in a slash. */
2217
2218 else if (mbformat == mbf_maildir)
2219 {
2220 struct stat statbuf;
2221 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2222 {
2223 uschar *new_check_path = string_copy(check_path);
2224 uschar *slash = Ustrrchr(new_check_path, '/');
2225 if (slash != NULL)
2226 {
2227 if (slash[1] == 0)
2228 {
2229 *slash = 0;
2230 slash = Ustrrchr(new_check_path, '/');
2231 }
2232 if (slash != NULL)
2233 {
2234 *slash = 0;
2235 check_path = new_check_path;
2236 }
2237 }
2238 }
2239 }
2240 #endif /* SUPPORT_MAILDIR */
2241 }
2242
2243 /* If we are using maildirsize files, we need to ensure that such a file
2244 exists and, if necessary, recalculate its contents. As a byproduct of this,
2245 we obtain the current size of the maildir. If no quota is to be enforced
2246 (ob->quota_value == 0), we still need the size if a threshold check will
2247 happen later.
2248
2249 Another regular expression is used to determine which directories inside the
2250 maildir are going to be counted. */
2251
2252 #ifdef SUPPORT_MAILDIR
2253 if (ob->maildir_use_size_file)
2254 {
2255 const pcre *dir_regex = NULL;
2256 const uschar *error;
2257 int offset;
2258
2259 if (ob->maildir_dir_regex != NULL)
2260 {
2261 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2262 (const char **)&error, &offset, NULL);
2263 if (dir_regex == NULL)
2264 {
2265 addr->message = string_sprintf("appendfile: regular expression "
2266 "error: %s at offset %d while compiling %s", error, offset,
2267 ob->maildir_dir_regex);
2268 return FALSE;
2269 }
2270 else
2271 {
2272 DEBUG(D_transport)
2273 debug_printf("using regex for maildir directory selection: %s\n",
2274 ob->maildir_dir_regex);
2275 }
2276 }
2277
2278 /* Quota enforcement; create and check the file. There is some discussion
2279 about whether this should happen if the quota is unset. At present, Exim
2280 always creates the file. If we ever want to change this, uncomment
2281 appropriate lines below, possibly doing a check on some option. */
2282
2283/* if (???? || ob->quota_value > 0) */
2284
2285 {
0d7eb84a
PH
2286 off_t size;
2287 int filecount;
0756eb3c
PH
2288
2289 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2290 &size, &filecount);
2291
2292 if (maildirsize_fd == -1)
2293 {
2294 addr->basic_errno = errno;
2295 addr->message = string_sprintf("while opening or reading "
2296 "%s/maildirsize", check_path);
2297 return FALSE;
2298 }
2299
2300 if (mailbox_size < 0) mailbox_size = size;
2301 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2302 }
2303
2304 /* No quota enforcement; ensure file does *not* exist; calculate size if
2305 needed. */
2306
2307/* else
2308 * {
2309 * time_t old_latest;
2310 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2311 * if (THRESHOLD_CHECK)
2312 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2313 * regex, dir_regex, FALSE);
2314 * }
2315*/
2316
2317 }
2318 #endif /* SUPPORT_MAILDIR */
2319
2320 /* Otherwise (mailbox_size is not yet set), if we are going to do a quota
2321 check later on, find the current size of the mailbox. (We don't need to check
2322 ob->quota_filecount_value, because it can only be set if ob->quota_value is
2323 set.) */
2324
2325 if ((mailbox_size < 0 || mailbox_filecount < 0) &&
2326 (ob->quota_value > 0 || THRESHOLD_CHECK))
2327 {
0d7eb84a 2328 off_t size;
5fe762f6 2329 int filecount = 0;
0756eb3c
PH
2330 DEBUG(D_transport)
2331 debug_printf("quota checks on directory %s\n", check_path);
2332 size = check_dir_size(check_path, &filecount, regex);
2333 if (mailbox_size < 0) mailbox_size = size;
2334 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2335 }
2336
2337 /* Handle the case of creating a unique file in a given directory (not in
2338 maildir or mailstore format - this is how smail did it). A temporary name is
2339 used to create the file. Later, when it is written, the name is changed to a
2340 unique one. There is no need to lock the file. An attempt is made to create
2341 the directory if it does not exist. */
2342
2343 if (mbformat == mbf_smail)
2344 {
2345 DEBUG(D_transport)
2346 debug_printf("delivering to new file in %s\n", path);
2347 filename = dataname =
2348 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2349 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2350 if (fd < 0 && /* failed to open, and */
2351 (errno != ENOENT || /* either not non-exist */
2352 !ob->create_directory || /* or not allowed to make */
2353 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2354 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2355 {
2356 addr->basic_errno = errno;
2357 addr->message = string_sprintf("while creating file %s", filename);
2358 return FALSE;
2359 }
2360 }
2361
2362 #ifdef SUPPORT_MAILDIR
2363
2364 /* Handle the case of a unique file in maildir format. The file is written to
2365 the tmp subdirectory, with a prescribed form of name. */
2366
2367 else if (mbformat == mbf_maildir)
2368 {
2369 DEBUG(D_transport)
2370 debug_printf("delivering in maildir format in %s\n", path);
2371
2372 nametag = ob->maildir_tag;
2373
2374 /* Check that nametag expands successfully; a hard failure causes a panic
2375 return. The actual expansion for use happens again later, when
2376 $message_size is accurately known. */
2377
2378 if (nametag != NULL && expand_string(nametag) == NULL &&
2379 !expand_string_forcedfail)
2380 {
2381 addr->transport_return = PANIC;
2382 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2383 "for %s transport) failed: %s", nametag, tblock->name,
2384 expand_string_message);
2385 return FALSE;
2386 }
2387
2388 /* We ensured the existence of all the relevant directories above. Attempt
2389 to open the temporary file a limited number of times. I think this rather
2390 scary-looking for statement is actually OK. If open succeeds, the loop is
2391 broken; if not, there is a test on the value of i. Get the time again
2392 afresh each time round the loop. Its value goes into a variable that is
2393 checked at the end, to make sure we don't release this process until the
2394 clock has ticked. */
2395
2396 for (i = 1;; i++)
2397 {
2398 uschar *basename;
2399
2400 (void)gettimeofday(&msg_tv, NULL);
2401 basename = string_sprintf("%lu.H%luP%lu.%s", msg_tv.tv_sec,
2402 msg_tv.tv_usec, getpid(), primary_hostname);
2403
2404 filename = dataname = string_sprintf("tmp/%s", basename);
2405 newname = string_sprintf("new/%s", basename);
2406
2407 if (Ustat(filename, &statbuf) == 0)
2408 errno = EEXIST;
2409 else if (errno == ENOENT)
2410 {
2411 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2412 if (fd >= 0) break;
2413 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2414 filename, strerror(errno));
2415 }
2416
2417 /* Too many retries - give up */
2418
2419 if (i >= ob->maildir_retries)
2420 {
2421 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2422 filename, i, (i == 1)? "y" : "ies");
2423 addr->basic_errno = errno;
2424 return FALSE;
2425 }
2426
2427 /* Open or stat failed but we haven't tried too many times yet. */
2428
2429 sleep(2);
2430 }
2431
2432 /* Note that we have to ensure the clock has ticked before leaving */
2433
2434 wait_for_tick = TRUE;
2435
2436 /* Why are these here? Put in because they are present in the non-maildir
2437 directory case above. */
2438
ff790e47
PH
2439 (void)Uchown(filename, uid, gid);
2440 (void)Uchmod(filename, mode);
0756eb3c
PH
2441 }
2442
2443 #endif /* SUPPORT_MAILDIR */
2444
2445 #ifdef SUPPORT_MAILSTORE
2446
2447 /* Handle the case of a unique file in mailstore format. First write the
2448 envelope to a temporary file, then open the main file. The unique base name
2449 for the files consists of the message id plus the pid of this delivery
2450 process. */
2451
2452 else
2453 {
2454 FILE *env_file;
2455 address_item *taddr;
2456 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2457 string_base62((long int)getpid()));
2458
2459 DEBUG(D_transport)
2460 debug_printf("delivering in mailstore format in %s\n", path);
2461
2462 filename = string_sprintf("%s.tmp", mailstore_basename);
2463 newname = string_sprintf("%s.env", mailstore_basename);
2464 dataname = string_sprintf("%s.msg", mailstore_basename);
2465
2466 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2467 if (fd < 0 && /* failed to open, and */
2468 (errno != ENOENT || /* either not non-exist */
2469 !ob->create_directory || /* or not allowed to make */
2470 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2471 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2472 {
2473 addr->basic_errno = errno;
2474 addr->message = string_sprintf("while creating file %s", filename);
2475 return FALSE;
2476 }
2477
2478 /* Why are these here? Put in because they are present in the non-maildir
2479 directory case above. */
2480
ff790e47
PH
2481 (void)Uchown(filename, uid, gid);
2482 (void)Uchmod(filename, mode);
0756eb3c
PH
2483
2484 /* Built a C stream from the open file descriptor. */
2485
2486 if ((env_file = fdopen(fd, "wb")) == NULL)
2487 {
2488 addr->basic_errno = errno;
2489 addr->transport_return = PANIC;
2490 addr->message = string_sprintf("fdopen of %s ("
2491 "for %s transport) failed", filename, tblock->name);
f1e894f3 2492 (void)close(fd);
0756eb3c
PH
2493 Uunlink(filename);
2494 return FALSE;
2495 }
2496
2497 /* Write the envelope file, then close it. */
2498
2499 if (ob->mailstore_prefix != NULL)
2500 {
2501 uschar *s = expand_string(ob->mailstore_prefix);
2502 if (s == NULL)
2503 {
2504 if (!expand_string_forcedfail)
2505 {
2506 addr->transport_return = PANIC;
2507 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2508 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2509 tblock->name, expand_string_message);
f1e894f3 2510 (void)fclose(env_file);
0756eb3c
PH
2511 Uunlink(filename);
2512 return FALSE;
2513 }
2514 }
2515 else
2516 {
2517 int n = Ustrlen(s);
2518 fprintf(env_file, "%s", CS s);
2519 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2520 }
2521 }
2522
2523 fprintf(env_file, "%s\n", sender_address);
2524
2525 for (taddr = addr; taddr!= NULL; taddr = taddr->next)
2526 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2527
2528 if (ob->mailstore_suffix != NULL)
2529 {
2530 uschar *s = expand_string(ob->mailstore_suffix);
2531 if (s == NULL)
2532 {
2533 if (!expand_string_forcedfail)
2534 {
2535 addr->transport_return = PANIC;
2536 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2537 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2538 tblock->name, expand_string_message);
f1e894f3 2539 (void)fclose(env_file);
0756eb3c
PH
2540 Uunlink(filename);
2541 return FALSE;
2542 }
2543 }
2544 else
2545 {
2546 int n = Ustrlen(s);
2547 fprintf(env_file, "%s", CS s);
2548 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2549 }
2550 }
2551
2552 if (fclose(env_file) != 0)
2553 {
2554 addr->basic_errno = errno;
2555 addr->message = string_sprintf("while closing %s", filename);
2556 Uunlink(filename);
2557 return FALSE;
2558 }
2559
2560 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2561
2562 /* Now open the data file, and ensure that it has the correct ownership and
2563 mode. */
2564
2565 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2566 if (fd < 0)
2567 {
2568 addr->basic_errno = errno;
2569 addr->message = string_sprintf("while creating file %s", dataname);
2570 Uunlink(filename);
2571 return FALSE;
2572 }
ff790e47
PH
2573 (void)Uchown(dataname, uid, gid);
2574 (void)Uchmod(dataname, mode);
0756eb3c
PH
2575 }
2576
2577 #endif /* SUPPORT_MAILSTORE */
2578
2579
2580 /* In all cases of writing to a new file, ensure that the file which is
2581 going to be renamed has the correct ownership and mode. */
2582
ff790e47
PH
2583 (void)Uchown(filename, uid, gid);
2584 (void)Uchmod(filename, mode);
0756eb3c
PH
2585 }
2586
2587
2588/* At last we can write the message to the file, preceded by any configured
2589prefix line, and followed by any configured suffix line. If there are any
2590writing errors, we must defer. */
2591
2592DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2593
2594yield = OK;
2595errno = 0;
2596
2597/* If there is a local quota setting, check that we are not going to exceed it
2598with this message if quota_is_inclusive is set; if it is not set, the check
2599is for the mailbox already being over quota (i.e. the current message is not
2600included in the check). */
2601
2602if (ob->quota_value > 0)
2603 {
2604 DEBUG(D_transport)
2605 {
b1c749bb
PH
2606 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2607 " this message = %d (%sincluded)\n",
2608 ob->quota_value, mailbox_size, message_size,
2609 ob->quota_is_inclusive? "" : "not ");
0756eb3c
PH
2610 debug_printf(" file count quota = %d count = %d\n",
2611 ob->quota_filecount_value, mailbox_filecount);
2612 }
2613 if (mailbox_size + (ob->quota_is_inclusive? message_size:0) > ob->quota_value)
2614 {
2615 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2616 yield = DEFER;
2617 errno = ERRNO_EXIMQUOTA;
2618 }
2619 else if (ob->quota_filecount_value > 0 &&
2620 mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2621 ob->quota_filecount_value)
2622 {
2623 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2624 yield = DEFER;
2625 errno = ERRNO_EXIMQUOTA;
2626 filecount_msg = US" filecount";
2627 }
2628 }
2629
2630/* If we are writing in MBX format, what we actually do is to write the message
2631to a temporary file, and then copy it to the real file once we know its size.
2632This is the most straightforward way of getting the correct length in the
2633separator line. So, what we do here is to save the real file descriptor, and
2634replace it with one for a temporary file. The temporary file gets unlinked once
2635opened, so that it goes away on closure. */
2636
2637#ifdef SUPPORT_MBX
2638if (yield == OK && ob->mbx_format)
2639 {
2640 temp_file = tmpfile();
2641 if (temp_file == NULL)
2642 {
2643 addr->basic_errno = errno;
2644 addr->message = US"while setting up temporary file";
2645 yield = DEFER;
2646 goto RETURN;
2647 }
2648 save_fd = fd;
2649 fd = fileno(temp_file);
2650 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2651 }
2652#endif /* SUPPORT_MBX */
2653
2654/* Zero the count of bytes written. It is incremented by the transport_xxx()
2655functions. */
2656
2657transport_count = 0;
2658
2659/* Write any configured prefix text first */
2660
2661if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2662 {
2663 uschar *prefix = expand_string(ob->message_prefix);
2664 if (prefix == NULL)
2665 {
2666 errno = ERRNO_EXPANDFAIL;
2667 addr->transport_return = PANIC;
2668 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2669 "transport) failed", ob->message_prefix, tblock->name);
2670 yield = DEFER;
2671 }
2672 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2673 }
2674
2675/* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2676various different values for batching are handled outside; if there is more
2677than one address available here, all must be included. If any address is a
2678file, use its parent in the RCPT TO. */
2679
2680if (yield == OK && ob->use_bsmtp)
2681 {
2682 transport_count = 0;
2683 if (ob->use_crlf) cr = US"\r";
2684 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2685 yield = DEFER;
2686 else
2687 {
2688 address_item *a;
2689 for (a = addr; a != NULL; a = a->next)
2690 {
2691 address_item *b = testflag(a, af_pfr)? a->parent: a;
2692 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2693 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2694 { yield = DEFER; break; }
2695 }
2696 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2697 yield = DEFER;
2698 }
2699 }
2700
2701/* Now the message itself. The options for transport_write_message were set up
2702at initialization time. */
2703
2704if (yield == OK)
2705 {
2706 if (!transport_write_message(addr, fd, ob->options, 0, tblock->add_headers,
2707 tblock->remove_headers, ob->check_string, ob->escape_string,
2708 tblock->rewrite_rules, tblock->rewrite_existflags))
2709 yield = DEFER;
2710 }
2711
2712/* Now a configured suffix. */
2713
2714if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2715 {
2716 uschar *suffix = expand_string(ob->message_suffix);
2717 if (suffix == NULL)
2718 {
2719 errno = ERRNO_EXPANDFAIL;
2720 addr->transport_return = PANIC;
2721 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2722 "transport) failed", ob->message_suffix, tblock->name);
2723 yield = DEFER;
2724 }
2725 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2726 }
2727
2728/* If batch smtp, write the terminating dot. */
2729
2730if (yield == OK && ob->use_bsmtp &&
2731 !transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2732
2733/* If MBX format is being used, all that writing was to the temporary file.
2734However, if there was an earlier failure (Exim quota exceeded, for example),
2735the temporary file won't have got opened - and no writing will have been done.
2736If writing was OK, we restore the fd, and call a function that copies the
2737message in MBX format into the real file. Otherwise use the temporary name in
2738any messages. */
2739
2740#ifdef SUPPORT_MBX
2741if (temp_file != NULL && ob->mbx_format)
2742 {
2743 int mbx_save_errno;
2744 fd = save_fd;
2745
2746 if (yield == OK)
2747 {
2748 transport_count = 0; /* Reset transport count for actual write */
2749 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2750 }
2751 else if (errno >= 0) dataname = US"temporary file";
2752
2753 /* Preserve errno while closing the temporary file. */
2754
2755 mbx_save_errno = errno;
f1e894f3 2756 (void)fclose(temp_file);
0756eb3c
PH
2757 errno = mbx_save_errno;
2758 }
2759#endif /* SUPPORT_MBX */
2760
2761/* Force out the remaining data to check for any errors; some OS don't allow
2762fsync() to be called for a FIFO. */
2763
2764if (yield == OK && !isfifo && fsync(fd) < 0) yield = DEFER;
2765
2766/* Update message_size to the accurate count of bytes written, including
2767added headers. */
2768
2769message_size = transport_count;
2770
2771/* If using a maildir++ quota file, add this message's size to it, and
2772close the file descriptor. */
2773
2774#ifdef SUPPORT_MAILDIR
2775if (yield == OK && maildirsize_fd >= 0)
2776 maildir_record_length(maildirsize_fd, message_size);
2777
2778maildir_save_errno = errno; /* Preserve errno while closing the file */
f1e894f3 2779(void)close(maildirsize_fd);
0756eb3c
PH
2780errno = maildir_save_errno;
2781#endif /* SUPPORT_MAILDIR */
2782
2783/* If there is a quota warning threshold and we are have crossed it with this
2784message, set the SPECIAL_WARN flag in the address, to cause a warning message
2785to be sent. */
2786
2787if (THRESHOLD_CHECK)
2788 {
0d7eb84a 2789 off_t threshold = ob->quota_warn_threshold_value;
0756eb3c 2790 if (ob->quota_warn_threshold_is_percent)
0d7eb84a 2791 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
0756eb3c 2792 DEBUG(D_transport)
b1c749bb
PH
2793 debug_printf("quota = " OFF_T_FMT
2794 " threshold = " OFF_T_FMT
2795 " old size = " OFF_T_FMT
2796 " message size = %d\n",
2797 ob->quota_value, threshold, mailbox_size,
0d7eb84a 2798 message_size);
0756eb3c
PH
2799 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
2800 addr->special_action = SPECIAL_WARN;
2801
2802 /******* You might think that the test ought to be this:
2803 *
2804 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
2805 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
2806 *
2807 * (indeed, I was sent a patch with that in). However, it is possible to
2808 * have a warning threshold without actually imposing a quota, and I have
2809 * therefore kept Exim backwards compatible.
2810 ********/
2811
2812 }
2813
2814/* Handle error while writing the file. Control should come here directly after
2815the error, with the reason in errno. In the case of expansion failure in prefix
2816or suffix, it will be ERRNO_EXPANDFAIL. */
2817
2818if (yield != OK)
2819 {
2820 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
2821
2822 /* Save the error number. If positive, it will ultimately cause a strerror()
2823 call to generate some text. */
2824
2825 addr->basic_errno = errno;
2826
2827 /* For system or Exim quota excession, or disk full, set more_errno to the
2828 time since the file was last read. If delivery was into a directory, the
2829 time since last read logic is not relevant, in general. However, for maildir
2830 deliveries we can approximate it by looking at the last modified time of the
2831 "new" subdirectory. Since Exim won't be adding new messages, a change to the
2832 "new" subdirectory implies that an MUA has moved a message from there to the
2833 "cur" directory. */
2834
2835 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
2836 {
2837 addr->more_errno = 0;
2838 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
2839
2840 #ifdef SUPPORT_MAILDIR
2841 else if (mbformat == mbf_maildir)
2842 {
2843 struct stat statbuf;
2844 if (Ustat("new", &statbuf) < 0)
2845 {
2846 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
2847 "stat error %d for \"new\": %s\n", errno, strerror(errno));
2848 }
2849 else /* Want a repeatable time when in test harness */
2850 {
2851 addr->more_errno = running_in_test_harness? 10 :
2852 (int)time(NULL) - statbuf.st_mtime;
2853 }
2854 DEBUG(D_transport)
2855 debug_printf("maildir: time since \"new\" directory modified = %s\n",
2856 readconf_printtime(addr->more_errno));
2857 }
2858 #endif /* SUPPORT_MAILDIR */
2859 }
2860
2861 /* Handle system quota excession. Add an explanatory phrase for the error
2862 message, since some systems don't have special quota-excession errors,
2863 and on those that do, "quota" doesn't always mean anything to the user. */
2864
2865 if (errno == errno_quota)
2866 {
2867 #ifndef EDQUOT
2868 addr->message = string_sprintf("mailbox is full "
2869 "(quota exceeded while writing to file %s)", filename);
2870 #else
2871 addr->message = string_sprintf("mailbox is full");
2872 #endif /* EDQUOT */
2873 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
2874 dataname,
2875 isdirectory? US"" : US": time since file read = ",
2876 isdirectory? US"" : readconf_printtime(addr->more_errno));
2877 }
2878
2879 /* Handle Exim's own quota-imposition */
2880
2881 else if (errno == ERRNO_EXIMQUOTA)
2882 {
2883 addr->message = string_sprintf("mailbox is full "
2884 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
2885 dataname);
2886 addr->user_message = US"mailbox is full";
2887 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
2888 filecount_msg, dataname,
2889 isdirectory? US"" : US": time since file read = ",
2890 isdirectory? US"" : readconf_printtime(addr->more_errno));
2891 }
2892
2893 /* Handle a process failure while writing via a filter; the return
2894 from child_close() is in more_errno. */
2895
2896 else if (errno == ERRNO_FILTER_FAIL)
8e669ac1 2897 {
35af9f61
PH
2898 yield = PANIC;
2899 addr->message = string_sprintf("transport filter process failed (%d) "
2900 "while writing to %s%s", addr->more_errno, dataname,
2901 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
8e669ac1 2902 }
0756eb3c
PH
2903
2904 /* Handle failure to expand header changes */
2905
2906 else if (errno == ERRNO_CHHEADER_FAIL)
2907 {
2908 yield = PANIC;
2909 addr->message =
2910 string_sprintf("failed to expand headers_add or headers_remove while "
2911 "writing to %s: %s", dataname, expand_string_message);
2912 }
2913
2914 /* Handle failure to complete writing of a data block */
2915
2916 else if (errno == ERRNO_WRITEINCOMPLETE)
2917 {
2918 addr->message = string_sprintf("failed to write data block while "
2919 "writing to %s", dataname);
2920 }
2921
2922 /* Handle length mismatch on MBX copying */
2923
2924 #ifdef SUPPORT_MBX
2925 else if (errno == ERRNO_MBXLENGTH)
2926 {
2927 addr->message = string_sprintf("length mismatch while copying MBX "
2928 "temporary file to %s", dataname);
2929 }
2930 #endif /* SUPPORT_MBX */
2931
2932 /* For other errors, a general-purpose explanation, if the message is
2933 not already set. */
2934
2935 else if (addr->message == NULL)
2936 addr->message = string_sprintf("error while writing to %s", dataname);
2937
2938 /* For a file, reset the file size to what it was before we started, leaving
2939 the last modification time unchanged, so it will get reset also. All systems
2940 investigated so far have ftruncate(), whereas not all have the F_FREESP
2941 fcntl() call (BSDI & FreeBSD do not). */
2942
ff790e47 2943 if (!isdirectory) (void)ftruncate(fd, saved_size);
0756eb3c
PH
2944 }
2945
2946/* Handle successful writing - we want the modification time to be now for
2947appended files. Remove the default backstop error number. For a directory, now
2948is the time to rename the file with a unique name. As soon as such a name
2949appears it may get used by another process, so we close the file first and
2950check that all is well. */
2951
2952else
2953 {
2954 times.modtime = time(NULL);
2955 addr->basic_errno = 0;
2956
2957 /* Handle the case of writing to a new file in a directory. This applies
2958 to all single-file formats - maildir, mailstore, and "smail format". */
2959
2960 if (isdirectory)
2961 {
2962 if (fstat(fd, &statbuf) < 0)
2963 {
2964 addr->basic_errno = errno;
2965 addr->message = string_sprintf("while fstatting opened message file %s",
2966 filename);
2967 yield = DEFER;
2968 }
2969
2970 else if (close(fd) < 0)
2971 {
2972 addr->basic_errno = errno;
2973 addr->message = string_sprintf("close() error for %s",
2974 (ob->mailstore_format)? dataname : filename);
2975 yield = DEFER;
2976 }
2977
2978 /* File is successfully written and closed. Arrange to rename it. For the
2979 different kinds of single-file delivery, some games can be played with the
2980 name. The message size is by this time set to the accurate value so that
2981 its value can be used in expansions. */
2982
2983 else
2984 {
2985 uschar *renamename = newname;
2986 fd = -1;
2987
2988 DEBUG(D_transport) debug_printf("renaming temporary file\n");
2989
2990 /* If there is no rename name set, we are in a non-maildir, non-mailstore
2991 situation. The name is built by expanding the directory_file option, and
2992 we make the inode number available for use in this. The expansion was
2993 checked for syntactic validity above, before we wrote the file.
2994
2995 We have to be careful here, in case the file name exists. (In the other
2996 cases, the names used are constructed to be unique.) The rename()
2997 function just replaces an existing file - we don't want that! So instead
2998 of calling rename(), we must use link() and unlink().
2999
3000 In this case, if the link fails because of an existing file, we wait
3001 for one second and try the expansion again, to see if it produces a
3002 different value. Do this up to 5 times unless the name stops changing.
3003 This makes it possible to build values that are based on the time, and
3004 still cope with races from multiple simultaneous deliveries. */
3005
3006 if (newname == NULL)
3007 {
3008 int i;
3009 uschar *renameleaf;
3010 uschar *old_renameleaf = US"";
3011
3012 for (i = 0; ; sleep(1), i++)
3013 {
3014 deliver_inode = statbuf.st_ino;
3015 renameleaf = expand_string(ob->dirfilename);
3016 deliver_inode = 0;
3017
3018 if (renameleaf == NULL)
3019 {
3020 addr->transport_return = PANIC;
3021 addr->message = string_sprintf("Expansion of \"%s\" "
3022 "(directory_file for %s transport) failed: %s",
3023 ob->dirfilename, tblock->name, expand_string_message);
3024 goto RETURN;
3025 }
3026
3027 renamename = string_sprintf("%s/%s", path, renameleaf);
3028 if (Ulink(filename, renamename) < 0)
3029 {
3030 DEBUG(D_transport) debug_printf("link failed: %s\n",
3031 strerror(errno));
3032 if (errno != EEXIST || i >= 4 ||
3033 Ustrcmp(renameleaf, old_renameleaf) == 0)
3034 {
3035 addr->basic_errno = errno;
3036 addr->message = string_sprintf("while renaming %s as %s",
3037 filename, renamename);
3038 yield = DEFER;
3039 break;
3040 }
3041 old_renameleaf = renameleaf;
3042 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3043 renamename);
3044 }
3045 else
3046 {
3047 Uunlink(filename);
3048 filename = NULL;
3049 break;
3050 }
3051 } /* re-expand loop */
3052 } /* not mailstore or maildir */
3053
3054 /* For maildir and mailstore formats, the new name was created earlier,
3055 except that for maildir, there is the possibility of adding a "tag" on
3056 the end of the name by expanding the value of nametag. This usually
3057 includes a reference to the message size. The expansion of nametag was
3058 checked above, before the file was opened. It either succeeded, or
3059 provoked a soft failure. So any failure here can be treated as soft.
3060 Ignore non-printing characters and / and put a colon at the start if the
3061 first character is alphanumeric. */
3062
3063 else
3064 {
3065 if (nametag != NULL)
3066 {
3067 uschar *iptr = expand_string(nametag);
3068 if (iptr != NULL)
3069 {
3070 uschar *etag = store_get(Ustrlen(iptr) + 2);
3071 uschar *optr = etag;
3072 while (*iptr != 0)
3073 {
3074 if (mac_isgraph(*iptr) && *iptr != '/')
3075 {
3076 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3077 *optr++ = *iptr;
3078 }
3079 iptr++;
3080 }
3081 *optr = 0;
3082 renamename = string_sprintf("%s%s", newname, etag);
3083 }
3084 }
3085
3086 /* Do the rename. If the name is too long and a tag exists, try again
3087 without the tag. */
3088
3089 if (Urename(filename, renamename) < 0 &&
3090 (nametag == NULL || errno != ENAMETOOLONG ||
3091 (renamename = newname, Urename(filename, renamename) < 0)))
3092 {
3093 addr->basic_errno = errno;
3094 addr->message = string_sprintf("while renaming %s as %s",
3095 filename, renamename);
3096 yield = DEFER;
3097 }
3098
3099 /* Rename succeeded */
3100
3101 else
3102 {
3103 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3104 renamename);
3105 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3106 }
3107 } /* maildir or mailstore */
3108 } /* successful write + close */
3109 } /* isdirectory */
3110 } /* write success */
3111
3112
3113/* For a file, restore the last access time (atime), and set the modification
3114time as required - changed if write succeeded, unchanged if not. */
3115
3116if (!isdirectory) utime(CS filename, &times);
3117
3118/* Notify comsat if configured to do so. It only makes sense if the configured
3119file is the one that the comsat daemon knows about. */
3120
3121if (ob->notify_comsat && yield == OK && deliver_localpart != NULL)
3122 notify_comsat(deliver_localpart, saved_size);
3123
3124/* Pass back the final return code in the address structure */
3125
3126DEBUG(D_transport)
3127 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3128 yield, addr->basic_errno, addr->more_errno);
3129
3130addr->transport_return = yield;
3131
3132/* Close the file, which will release the fcntl lock. For a directory write it
3133is closed above, except in cases of error which goto RETURN, when we also need
3134to remove the original file(s). For MBX locking, if all has gone well, before
3135closing the file, see if we can get an exclusive lock on it, in which case we
3136can unlink the /tmp lock file before closing it. This is always a non-blocking
3137lock; there's no need to wait if we can't get it. If everything has gone right
3138but close fails, defer the message. Then unlink the lock file, if present. This
3139point in the code is jumped to from a number of places when errors are
3140detected, in order to get the file closed and the lock file tidied away. */
3141
3142RETURN:
3143
3144#ifdef SUPPORT_MBX
3145if (mbx_lockfd >= 0)
3146 {
3147 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3148 ob->use_flock, 0) >= 0)
3149 {
3150 DEBUG(D_transport)
3151 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3152 Uunlink(mbx_lockname);
3153 }
f1e894f3 3154 (void)close(mbx_lockfd);
0756eb3c
PH
3155 }
3156#endif /* SUPPORT_MBX */
3157
3158if (fd >= 0 && close(fd) < 0 && yield == OK)
3159 {
3160 addr->basic_errno = errno;
3161 addr->message = string_sprintf("while closing %s", filename);
3162 addr->transport_return = DEFER;
3163 }
3164
3165if (hd >= 0) Uunlink(lockname);
3166
3167/* We get here with isdirectory and filename set only in error situations. */
3168
3169if (isdirectory && filename != NULL)
3170 {
3171 Uunlink(filename);
3172 if (dataname != filename) Uunlink(dataname);
3173 }
3174
3175/* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3176file name relies on time + pid. We must not allow the process to finish until
3177the clock has move on by at least one microsecond. Usually we expect this
3178already to be the case, but machines keep getting faster... */
3179
3180if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3181
3182/* A return of FALSE means that if there was an error, a common error was
3183put in the first address of a batch. */
3184
3185return FALSE;
3186}
3187
3188/* End of transport/appendfile.c */