src/src/spool_in.c

   1 /* $Cambridge: exim/src/src/spool_in.c,v 1.5 2005/01/12 12:24:13 ph10 Exp $ */
   2
   3 /*************************************************
   4 *     Exim - an Internet mail transport agent    *
   5 *************************************************/
   6
   7 /* Copyright (c) University of Cambridge 1995 - 2005 */
   8 /* See the file NOTICE for conditions of use and distribution. */
   9
  10 /* Functions for reading spool files. When compiling for a utility (eximon),
  11 not all are needed, and some functionality can be cut out. */
  12
  13
  14 #include "exim.h"
  15
  16
  17
  18 #ifndef COMPILE_UTILITY
  19 /*************************************************
  20 *           Open and lock data file              *
  21 *************************************************/
  22
  23 /* The data file is the one that is used for locking, because the header file
  24 can get replaced during delivery because of header rewriting. The file has
  25 to opened with write access so that we can get an exclusive lock, but in
  26 fact it won't be written to. Just in case there's a major disaster (e.g.
  27 overwriting some other file descriptor with the value of this one), open it
  28 with append.
  29
  30 Argument: the id of the message
  31 Returns:  TRUE if file successfully opened and locked
  32
  33 Side effect: deliver_datafile is set to the fd of the open file.
  34 */
  35
  36 BOOL
  37 spool_open_datafile(uschar *id)
  38 {
  39 int i;
  40 struct stat statbuf;
  41 flock_t lock_data;
  42 uschar spoolname[256];
  43
  44 /* If split_spool_directory is set, first look for the file in the appropriate
  45 sub-directory of the input directory. If it is not found there, try the input
  46 directory itself, to pick up leftovers from before the splitting. If split_
  47 spool_directory is not set, first look in the main input directory. If it is
  48 not found there, try the split sub-directory, in case it is left over from a
  49 splitting state. */
  50
  51 for (i = 0; i < 2; i++)
  52   {
  53   int save_errno;
  54   message_subdir[0] = (split_spool_directory == (i == 0))? id[5] : 0;
  55   sprintf(CS spoolname, "%s/input/%s/%s-D", spool_directory, message_subdir, id);
  56   deliver_datafile = Uopen(spoolname, O_RDWR | O_APPEND, 0);
  57   if (deliver_datafile >= 0) break;
  58   save_errno = errno;
  59   if (errno == ENOENT)
  60     {
  61     if (i == 0) continue;
  62     if (!queue_running)
  63       log_write(0, LOG_MAIN, "Spool file %s-D not found", id);
  64     }
  65   else log_write(0, LOG_MAIN, "Spool error for %s: %s", spoolname,
  66     strerror(errno));
  67   errno = save_errno;
  68   return FALSE;
  69   }
  70
  71 /* File is open and message_subdir is set. Set the close-on-exec flag, and lock
  72 the file. We lock only the first line of the file (containing the message ID)
  73 because this apparently is needed for running Exim under Cygwin. If the entire
  74 file is locked in one process, a sub-process cannot access it, even when passed
  75 an open file descriptor (at least, I think that's the Cygwin story). On real
  76 Unix systems it doesn't make any difference as long as Exim is consistent in
  77 what it locks. */
  78
  79 fcntl(deliver_datafile, F_SETFD, fcntl(deliver_datafile, F_GETFD) |
  80   FD_CLOEXEC);
  81
  82 lock_data.l_type = F_WRLCK;
  83 lock_data.l_whence = SEEK_SET;
  84 lock_data.l_start = 0;
  85 lock_data.l_len = SPOOL_DATA_START_OFFSET;
  86
  87 if (fcntl(deliver_datafile, F_SETLK, &lock_data) < 0)
  88   {
  89   log_write(L_skip_delivery,
  90             LOG_MAIN,
  91             "Spool file is locked (another process is handling this message)");
  92   close(deliver_datafile);
  93   deliver_datafile = -1;
  94   errno = 0;
  95   return FALSE;
  96   }
  97
  98 /* Get the size of the data; don't include the leading filename line
  99 in the count, but add one for the newline before the data. */
 100
 101 if (fstat(deliver_datafile, &statbuf) == 0)
 102   {
 103   message_body_size = statbuf.st_size - SPOOL_DATA_START_OFFSET;
 104   message_size = message_body_size + 1;
 105   }
 106
 107 return TRUE;
 108 }
 109 #endif  /* COMPILE_UTILITY */
 110
 111
 112
 113 /*************************************************
 114 *    Read non-recipients tree from spool file    *
 115 *************************************************/
 116
 117 /* The tree of non-recipients is written to the spool file in a form that
 118 makes it easy to read back into a tree. The format is as follows:
 119
 120    . Each node is preceded by two letter(Y/N) indicating whether it has left
 121      or right children. There's one space after the two flags, before the name.
 122
 123    . The left subtree (if any) then follows, then the right subtree (if any).
 124
 125 This function is entered with the next input line in the buffer. Note we must
 126 save the right flag before recursing with the same buffer.
 127
 128 Once the tree is read, we re-construct the balance fields by scanning the tree.
 129 I forgot to write them out originally, and the compatible fix is to do it this
 130 way. This initial local recursing function does the necessary.
 131
 132 Arguments:
 133   node      tree node
 134
 135 Returns:    maximum depth below the node, including the node itself
 136 */
 137
 138 static int
 139 count_below(tree_node *node)
 140 {
 141 int nleft, nright;
 142 if (node == NULL) return 0;
 143 nleft = count_below(node->left);
 144 nright = count_below(node->right);
 145 node->balance = (nleft > nright)? 1 : ((nright > nleft)? 2 : 0);
 146 return 1 + ((nleft > nright)? nleft : nright);
 147 }
 148
 149 /* This is the real function...
 150
 151 Arguments:
 152   connect      pointer to the root of the tree
 153   f            FILE to read data from
 154   buffer       contains next input line; further lines read into it
 155   buffer_size  size of the buffer
 156
 157 Returns:       FALSE on format error
 158 */
 159
 160 static BOOL
 161 read_nonrecipients_tree(tree_node **connect, FILE *f, uschar *buffer,
 162   int buffer_size)
 163 {
 164 tree_node *node;
 165 int n = Ustrlen(buffer);
 166 BOOL right = buffer[1] == 'Y';
 167
 168 if (n < 5) return FALSE;    /* malformed line */
 169 buffer[n-1] = 0;            /* Remove \n */
 170 node = store_get(sizeof(tree_node) + n - 3);
 171 *connect = node;
 172 Ustrcpy(node->name, buffer + 3);
 173 node->data.ptr = NULL;
 174
 175 if (buffer[0] == 'Y')
 176   {
 177   if (Ufgets(buffer, buffer_size, f) == NULL ||
 178     !read_nonrecipients_tree(&node->left, f, buffer, buffer_size))
 179       return FALSE;
 180   }
 181 else node->left = NULL;
 182
 183 if (right)
 184   {
 185   if (Ufgets(buffer, buffer_size, f) == NULL ||
 186     !read_nonrecipients_tree(&node->right, f, buffer, buffer_size))
 187       return FALSE;
 188   }
 189 else node->right = NULL;
 190
 191 (void) count_below(*connect);
 192 return TRUE;
 193 }
 194
 195
 196
 197
 198 /*************************************************
 199 *             Read spool header file             *
 200 *************************************************/
 201
 202 /* This function reads a spool header file and places the data into the
 203 appropriate global variables. The header portion is always read, but header
 204 structures are built only if read_headers is set true. It isn't, for example,
 205 while generating -bp output.
 206
 207 It may be possible for blocks of nulls (binary zeroes) to get written on the
 208 end of a file if there is a system crash during writing. It was observed on an
 209 earlier version of Exim that omitted to fsync() the files - this is thought to
 210 have been the cause of that incident, but in any case, this code must be robust
 211 against such an event, and if such a file is encountered, it must be treated as
 212 malformed.
 213
 214 Arguments:
 215   name          name of the header file, including the -H
 216   read_headers  TRUE if in-store header structures are to be built
 217   subdir_set    TRUE is message_subdir is already set
 218
 219 Returns:        spool_read_OK        success
 220                 spool_read_notopen   open failed
 221                 spool_read_enverror  error in the envelope portion
 222                 spool_read_hdrdrror  error in the header portion
 223 */
 224
 225 int
 226 spool_read_header(uschar *name, BOOL read_headers, BOOL subdir_set)
 227 {
 228 FILE *f = NULL;
 229 int n;
 230 int rcount = 0;
 231 long int uid, gid;
 232 BOOL inheader = FALSE;
 233 uschar originator[64];
 234
 235 /* Reset all the global variables to their default values. However, there is
 236 one exception. DO NOT change the default value of dont_deliver, because it may
 237 be forced by an external setting. */
 238
 239 for (n = 0; n < ACL_C_MAX + ACL_M_MAX; n++) acl_var[n] = NULL;
 240
 241 authenticated_id = NULL;
 242 authenticated_sender = NULL;
 243 allow_unqualified_recipient = FALSE;
 244 allow_unqualified_sender = FALSE;
 245 body_linecount = 0;
 246 body_zerocount = 0;
 247 deliver_firsttime = FALSE;
 248 deliver_freeze = FALSE;
 249 deliver_frozen_at = 0;
 250 deliver_manual_thaw = FALSE;
 251 /* dont_deliver must NOT be reset */
 252 header_list = header_last = NULL;
 253 host_lookup_failed = FALSE;
 254 interface_address = NULL;
 255 interface_port = 0;
 256 local_error_message = FALSE;
 257 local_scan_data = NULL;
 258 message_linecount = 0;
 259 received_protocol = NULL;
 260 received_count = 0;
 261 recipients_list = NULL;
 262 sender_address = NULL;
 263 sender_fullhost = NULL;
 264 sender_helo_name = NULL;
 265 sender_host_address = NULL;
 266 sender_host_name = NULL;
 267 sender_host_port = 0;
 268 sender_host_authenticated = NULL;
 269 sender_ident = NULL;
 270 sender_local = FALSE;
 271 sender_set_untrusted = FALSE;
 272 smtp_active_hostname = primary_hostname;
 273 tree_nonrecipients = NULL;
 274
 275 #ifdef EXPERIMENTAL_BRIGHTMAIL
 276 bmi_run = 0;
 277 bmi_verdicts = NULL;
 278 #endif
 279
 280 #ifdef SUPPORT_TLS
 281 tls_certificate_verified = FALSE;
 282 tls_cipher = NULL;
 283 tls_peerdn = NULL;
 284 #endif
 285
 286 #ifdef WITH_CONTENT_SCAN
 287 spam_score_int = NULL;
 288 #endif
 289
 290 /* Generate the full name and open the file. If message_subdir is already
 291 set, just look in the given directory. Otherwise, look in both the split
 292 and unsplit directories, as for the data file above. */
 293
 294 for (n = 0; n < 2; n++)
 295   {
 296   if (!subdir_set)
 297     message_subdir[0] = (split_spool_directory == (n == 0))? name[5] : 0;
 298   sprintf(CS big_buffer, "%s/input/%s/%s", spool_directory, message_subdir,
 299     name);
 300   f = Ufopen(big_buffer, "rb");
 301   if (f != NULL) break;
 302   if (n != 0 || subdir_set || errno != ENOENT) return spool_read_notopen;
 303   }
 304
 305 errno = 0;
 306
 307 #ifndef COMPILE_UTILITY
 308 DEBUG(D_deliver) debug_printf("reading spool file %s\n", name);
 309 #endif  /* COMPILE_UTILITY */
 310
 311 /* The first line of a spool file contains the message id followed by -H (i.e.
 312 the file name), in order to make the file self-identifying. */
 313
 314 if (Ufgets(big_buffer, big_buffer_size, f) == NULL) goto SPOOL_READ_ERROR;
 315 if (Ustrlen(big_buffer) != MESSAGE_ID_LENGTH + 3 ||
 316     Ustrncmp(big_buffer, name, MESSAGE_ID_LENGTH + 2) != 0)
 317   goto SPOOL_FORMAT_ERROR;
 318
 319 /* The next three lines in the header file are in a fixed format. The first
 320 contains the login, uid, and gid of the user who caused the file to be written.
 321 The second contains the mail address of the message's sender, enclosed in <>.
 322 The third contains the time the message was received, and the number of warning
 323 messages for delivery delays that have been sent. */
 324
 325 if (Ufgets(big_buffer, big_buffer_size, f) == NULL) goto SPOOL_READ_ERROR;
 326
 327 if (sscanf(CS big_buffer, "%s %ld %ld", originator, &uid, &gid) != 3)
 328   goto SPOOL_FORMAT_ERROR;
 329 originator_login = string_copy(originator);
 330 originator_uid = (uid_t)uid;
 331 originator_gid = (gid_t)gid;
 332
 333 if (Ufgets(big_buffer, big_buffer_size, f) == NULL) goto SPOOL_READ_ERROR;
 334 n = Ustrlen(big_buffer);
 335 if (n < 3 || big_buffer[0] != '<' || big_buffer[n-2] != '>')
 336   goto SPOOL_FORMAT_ERROR;
 337
 338 sender_address = store_get(n-2);
 339 Ustrncpy(sender_address, big_buffer+1, n-3);
 340 sender_address[n-3] = 0;
 341
 342 if (Ufgets(big_buffer, big_buffer_size, f) == NULL) goto SPOOL_READ_ERROR;
 343 if (sscanf(CS big_buffer, "%d %d", &received_time, &warning_count) != 2)
 344   goto SPOOL_FORMAT_ERROR;
 345
 346 message_age = time(NULL) - received_time;
 347
 348 #ifndef COMPILE_UTILITY
 349 DEBUG(D_deliver) debug_printf("user=%s uid=%ld gid=%ld sender=%s\n",
 350   originator_login, (long int)originator_uid, (long int)originator_gid,
 351   sender_address);
 352 #endif  /* COMPILE_UTILITY */
 353
 354 /* Now there may be a number of optional lines, each starting with "-".
 355 If you add a new setting here, make sure you set the default above. */
 356
 357 for (;;)
 358   {
 359   if (Ufgets(big_buffer, big_buffer_size, f) == NULL) goto SPOOL_READ_ERROR;
 360   if (big_buffer[0] != '-') break;
 361
 362   big_buffer[Ustrlen(big_buffer) - 1] = 0;
 363   if (Ustrncmp(big_buffer, "-acl ", 5) == 0)
 364     {
 365     int index, count;
 366     if (sscanf(CS big_buffer + 5, "%d %d", &index, &count) != 2)
 367       goto SPOOL_FORMAT_ERROR;
 368     /* Ignore if index too big - might be if a later release with more
 369     variables built this spool file. */
 370     if (index < ACL_C_MAX + ACL_M_MAX)
 371       {
 372       acl_var[index] = store_get(count + 1);
 373       if (fread(acl_var[index], 1, count+1, f) < count) goto SPOOL_READ_ERROR;
 374       acl_var[index][count] = 0;
 375       }
 376     }
 377   else if (Ustrcmp(big_buffer, "-local") == 0) sender_local = TRUE;
 378   else if (Ustrcmp(big_buffer, "-localerror") == 0)
 379     local_error_message = TRUE;
 380   else if (Ustrncmp(big_buffer, "-local_scan ", 12) == 0)
 381     local_scan_data = string_copy(big_buffer + 12);
 382 #ifdef WITH_CONTENT_SCAN
 383   else if (Ustrncmp(big_buffer, "-spam_score_int ", 16) == 0)
 384     spam_score_int = string_copy(big_buffer + 16);
 385 #endif
 386 #ifdef EXPERIMENTAL_BRIGHTMAIL
 387   else if (Ustrncmp(big_buffer, "-bmi_verdicts ", 14) == 0)
 388     bmi_verdicts = string_copy(big_buffer + 14);
 389 #endif
 390   else if (Ustrcmp(big_buffer, "-host_lookup_failed") == 0)
 391     host_lookup_failed = TRUE;
 392   else if (Ustrncmp(big_buffer, "-body_linecount", 15) == 0)
 393     body_linecount = Uatoi(big_buffer + 15);
 394   else if (Ustrncmp(big_buffer, "-body_zerocount", 15) == 0)
 395     body_zerocount = Uatoi(big_buffer + 15);
 396   else if (Ustrncmp(big_buffer, "-frozen", 7) == 0)
 397     {
 398     deliver_freeze = TRUE;
 399     deliver_frozen_at = Uatoi(big_buffer + 7);
 400     }
 401   else if (Ustrcmp(big_buffer, "-allow_unqualified_recipient") == 0)
 402     allow_unqualified_recipient = TRUE;
 403   else if (Ustrcmp(big_buffer, "-allow_unqualified_sender") == 0)
 404     allow_unqualified_sender = TRUE;
 405   else if (Ustrcmp(big_buffer, "-deliver_firsttime") == 0)
 406     deliver_firsttime = TRUE;
 407   else if (Ustrcmp(big_buffer, "-manual_thaw") == 0)
 408     deliver_manual_thaw = TRUE;
 409   else if (Ustrncmp(big_buffer, "-auth_id", 8) == 0)
 410     authenticated_id = string_copy(big_buffer + 9);
 411   else if (Ustrncmp(big_buffer, "-auth_sender", 12) == 0)
 412     authenticated_sender = string_copy(big_buffer + 13);
 413   else if (Ustrncmp(big_buffer, "-sender_set_untrusted", 21) == 0)
 414     sender_set_untrusted = TRUE;
 415
 416   #ifdef SUPPORT_TLS
 417   else if (Ustrncmp(big_buffer, "-tls_certificate_verified", 25) == 0)
 418     tls_certificate_verified = TRUE;
 419   else if (Ustrncmp(big_buffer, "-tls_cipher", 11) == 0)
 420     tls_cipher = string_copy(big_buffer + 12);
 421   else if (Ustrncmp(big_buffer, "-tls_peerdn", 11) == 0)
 422     tls_peerdn = string_copy(big_buffer + 12);
 423   #endif
 424
 425   /* We now record the port number after the address, separated by a
 426   dot. For compatibility during upgrading, do nothing if there
 427   isn't a value (it gets left at zero). */
 428
 429   else if (Ustrncmp(big_buffer, "-host_address", 13) == 0)
 430     {
 431     sender_host_port = host_extract_port(big_buffer + 14);
 432     sender_host_address = string_copy(big_buffer + 14);
 433     }
 434
 435   else if (Ustrncmp(big_buffer, "-interface_address", 18) == 0)
 436     {
 437     interface_port = host_extract_port(big_buffer + 19);
 438     interface_address = string_copy(big_buffer + 19);
 439     }
 440
 441   else if (Ustrncmp(big_buffer, "-active_hostname", 16) == 0)
 442     smtp_active_hostname = string_copy(big_buffer + 17);
 443   else if (Ustrncmp(big_buffer, "-host_auth", 10) == 0)
 444     sender_host_authenticated = string_copy(big_buffer + 11);
 445   else if (Ustrncmp(big_buffer, "-host_name", 10) == 0)
 446     sender_host_name = string_copy(big_buffer + 11);
 447   else if (Ustrncmp(big_buffer, "-helo_name", 10) == 0)
 448     sender_helo_name = string_copy(big_buffer + 11);
 449   else if (Ustrncmp(big_buffer, "-ident", 6) == 0)
 450     sender_ident = string_copy(big_buffer + 7);
 451   else if (Ustrncmp(big_buffer, "-received_protocol", 18) == 0)
 452     received_protocol = string_copy(big_buffer + 19);
 453   else if (Ustrncmp(big_buffer, "-N", 2) == 0)
 454     dont_deliver = TRUE;
 455
 456   /* To allow new versions of Exim that add additional flags to interwork
 457   with older versions that do not understand them, just ignore any flagged
 458   lines that we don't recognize. Otherwise it wouldn't be possible to back
 459   off a new version that left new-style flags written on the spool. That's
 460   why the following line is commented out. */
 461
 462     /* else goto SPOOL_FORMAT_ERROR; */
 463   }
 464
 465 /* Build sender_fullhost if required */
 466
 467 #ifndef COMPILE_UTILITY
 468 host_build_sender_fullhost();
 469 #endif  /* COMPILE_UTILITY */
 470
 471 #ifndef COMPILE_UTILITY
 472 DEBUG(D_deliver)
 473   debug_printf("sender_local=%d ident=%s\n", sender_local,
 474     (sender_ident == NULL)? US"unset" : sender_ident);
 475 #endif  /* COMPILE_UTILITY */
 476
 477 /* We now have the tree of addresses NOT to deliver to, or a line
 478 containing "XX", indicating no tree. */
 479
 480 if (Ustrncmp(big_buffer, "XX\n", 3) != 0 &&
 481   !read_nonrecipients_tree(&tree_nonrecipients, f, big_buffer, big_buffer_size))
 482     goto SPOOL_FORMAT_ERROR;
 483
 484 #ifndef COMPILE_UTILITY
 485 DEBUG(D_deliver)
 486   {
 487   debug_printf("Non-recipients:\n");
 488   debug_print_tree(tree_nonrecipients);
 489   }
 490 #endif  /* COMPILE_UTILITY */
 491
 492 /* After reading the tree, the next line has not yet been read into the
 493 buffer. It contains the count of recipients which follow on separate lines. */
 494
 495 if (Ufgets(big_buffer, big_buffer_size, f) == NULL) goto SPOOL_READ_ERROR;
 496 if (sscanf(CS big_buffer, "%d", &rcount) != 1) goto SPOOL_FORMAT_ERROR;
 497
 498 #ifndef COMPILE_UTILITY
 499 DEBUG(D_deliver) debug_printf("recipients_count=%d\n", rcount);
 500 #endif  /* COMPILE_UTILITY */
 501
 502 recipients_list_max = rcount;
 503 recipients_list = store_get(rcount * sizeof(recipient_item));
 504
 505 for (recipients_count = 0; recipients_count < rcount; recipients_count++)
 506   {
 507   int nn;
 508   int pno = -1;
 509   uschar *errors_to = NULL;
 510   uschar *p;
 511
 512   if (Ufgets(big_buffer, big_buffer_size, f) == NULL) goto SPOOL_READ_ERROR;
 513   nn = Ustrlen(big_buffer);
 514   if (nn < 2) goto SPOOL_FORMAT_ERROR;
 515
 516   /* Remove the newline; this terminates the address if there is no additional
 517   data on the line. */
 518
 519   p = big_buffer + nn - 1;
 520   *p-- = 0;
 521
 522   /* Look back from the end of the line for digits and special terminators.
 523   Since an address must end with a domain, we can tell that extra data is
 524   present by the presence of the terminator, which is always some character
 525   that cannot exist in a domain. (If I'd thought of the need for additional
 526   data early on, I'd have put it at the start, with the address at the end. As
 527   it is, we have to operate backwards. Addresses are permitted to contain
 528   spaces, you see.)
 529
 530   This code has to cope with various versions of this data that have evolved
 531   over time. In all cases, the line might just contain an address, with no
 532   additional data. Otherwise, the possibilities are as follows:
 533
 534   Exim 3 type:       <address><space><digits>,<digits>,<digits>
 535
 536     The second set of digits is the parent number for one_time addresses. The
 537     other values were remnants of earlier experiments that were abandoned.
 538
 539   Exim 4 first type: <address><space><digits>
 540
 541     The digits are the parent number for one_time addresses.
 542
 543   Exim 4 new type:   <address><space><data>#<type bits>
 544
 545     The type bits indicate what the contents of the data are.
 546
 547     Bit 01 indicates that, reading from right to left, the data
 548       ends with <errors_to address><space><len>,<pno> where pno is
 549       the parent number for one_time addresses, and len is the length
 550       of the errors_to address (zero meaning none).
 551    */
 552
 553   while (isdigit(*p)) p--;
 554
 555   /* Handle Exim 3 spool files */
 556
 557   if (*p == ',')
 558     {
 559     int dummy;
 560     while (isdigit(*(--p)) || *p == ',');
 561     if (*p == ' ')
 562       {
 563       *p++ = 0;
 564       sscanf(CS p, "%d,%d", &dummy, &pno);
 565       }
 566     }
 567
 568   /* Handle early Exim 4 spool files */
 569
 570   else if (*p == ' ')
 571     {
 572     *p++ = 0;
 573     sscanf(CS p, "%d", &pno);
 574     }
 575
 576   /* Handle current format Exim 4 spool files */
 577
 578   else if (*p == '#')
 579     {
 580     int flags;
 581     sscanf(CS p+1, "%d", &flags);
 582
 583     if ((flags & 0x01) != 0)      /* one_time data exists */
 584       {
 585       int len;
 586       while (isdigit(*(--p)) || *p == ',' || *p == '-');
 587       sscanf(CS p+1, "%d,%d", &len, &pno);
 588       *p = 0;
 589       if (len > 0)
 590         {
 591         p -= len;
 592         errors_to = string_copy(p);
 593         }
 594       }
 595
 596     *(--p) = 0;   /* Terminate address */
 597     }
 598
 599   recipients_list[recipients_count].address = string_copy(big_buffer);
 600   recipients_list[recipients_count].pno = pno;
 601   recipients_list[recipients_count].errors_to = errors_to;
 602   }
 603
 604 /* The remainder of the spool header file contains the headers for the message,
 605 separated off from the previous data by a blank line. Each header is preceded
 606 by a count of its length and either a certain letter (for various identified
 607 headers), space (for a miscellaneous live header) or an asterisk (for a header
 608 that has been rewritten). Count the Received: headers. We read the headers
 609 always, in order to check on the format of the file, but only create a header
 610 list if requested to do so. */
 611
 612 inheader = TRUE;
 613 if (Ufgets(big_buffer, big_buffer_size, f) == NULL) goto SPOOL_READ_ERROR;
 614 if (big_buffer[0] != '\n') goto SPOOL_FORMAT_ERROR;
 615
 616 while ((n = fgetc(f)) != EOF)
 617   {
 618   header_line *h;
 619   uschar flag[4];
 620   int i;
 621
 622   if (!isdigit(n)) goto SPOOL_FORMAT_ERROR;
 623   ungetc(n, f);
 624   fscanf(f, "%d%c ", &n, flag);
 625   if (flag[0] != '*') message_size += n;  /* Omit non-transmitted headers */
 626
 627   if (read_headers)
 628     {
 629     h = store_get(sizeof(header_line));
 630     h->next = NULL;
 631     h->type = flag[0];
 632     h->slen = n;
 633     h->text = store_get(n+1);
 634
 635     if (h->type == htype_received) received_count++;
 636
 637     if (header_list == NULL) header_list = h;
 638       else header_last->next = h;
 639     header_last = h;
 640
 641     for (i = 0; i < n; i++)
 642       {
 643       int c = fgetc(f);
 644       if (c == 0 || c == EOF) goto SPOOL_FORMAT_ERROR;
 645       if (c == '\n' && h->type != htype_old) message_linecount++;
 646       h->text[i] = c;
 647       }
 648     h->text[i] = 0;
 649     }
 650
 651   /* Not requiring header data, just skip through the bytes */
 652
 653   else for (i = 0; i < n; i++)
 654     {
 655     int c = fgetc(f);
 656     if (c == 0 || c == EOF) goto SPOOL_FORMAT_ERROR;
 657     }
 658   }
 659
 660 /* We have successfully read the data in the header file. Update the message
 661 line count by adding the body linecount to the header linecount. Close the file
 662 and give a positive response. */
 663
 664 #ifndef COMPILE_UTILITY
 665 DEBUG(D_deliver) debug_printf("body_linecount=%d message_linecount=%d\n",
 666   body_linecount, message_linecount);
 667 #endif  /* COMPILE_UTILITY */
 668
 669 message_linecount += body_linecount;
 670
 671 fclose(f);
 672 return spool_read_OK;
 673
 674
 675 /* There was an error reading the spool or there was missing data,
 676 or there was a format error. A "read error" with no errno means an
 677 unexpected EOF, which we treat as a format error. */
 678
 679 SPOOL_READ_ERROR:
 680 if (errno != 0)
 681   {
 682   n = errno;
 683
 684   #ifndef COMPILE_UTILITY
 685   DEBUG(D_any) debug_printf("Error while reading spool file %s\n", name);
 686   #endif  /* COMPILE_UTILITY */
 687
 688   fclose(f);
 689   errno = n;
 690   return inheader? spool_read_hdrerror : spool_read_enverror;
 691   }
 692
 693 SPOOL_FORMAT_ERROR:
 694
 695 #ifndef COMPILE_UTILITY
 696 DEBUG(D_any) debug_printf("Format error in spool file %s\n", name);
 697 #endif  /* COMPILE_UTILITY */
 698
 699 fclose(f);
 700 errno = ERRNO_SPOOLFORMAT;
 701 return inheader? spool_read_hdrerror : spool_read_enverror;
 702 }
 703
 704 /* End of spool_in.c */