Build without WITH_CONTENT_SCAN.
[exim.git] / src / src / spool_out.c
CommitLineData
0a49a7a4 1/* $Cambridge: exim/src/src/spool_out.c,v 1.17 2009/11/16 19:50:37 nm4 Exp $ */
059ec3d9
PH
2
3/*************************************************
4* Exim - an Internet mail transport agent *
5*************************************************/
6
0a49a7a4 7/* Copyright (c) University of Cambridge 1995 - 2009 */
059ec3d9
PH
8/* See the file NOTICE for conditions of use and distribution. */
9
10/* Functions for writing spool files, and moving them about. */
11
12
13#include "exim.h"
14
15
16
17/*************************************************
18* Deal with header writing errors *
19*************************************************/
20
21/* This function is called immediately after errors in writing the spool, with
22errno still set. It creates and error message, depending on the circumstances.
23If errmsg is NULL, it logs the message and panic-dies. Otherwise errmsg is set
24to point to the message, and -1 is returned. This function makes the code of
25spool_write_header() a bit neater.
26
27Arguments:
28 where SW_RECEIVING, SW_DELIVERING, or SW_MODIFYING
29 errmsg where to put the message; NULL => panic-die
30 s text to add to log string
31 temp_name name of temp file to unlink
32 f FILE to close, if not NULL
33
34Returns: -1 if errmsg is not NULL; otherwise doesn't return
35*/
36
37static int
38spool_write_error(int where, uschar **errmsg, uschar *s, uschar *temp_name,
39 FILE *f)
40{
41uschar *msg = (where == SW_RECEIVING)?
42 string_sprintf("spool file %s error while receiving from %s: %s", s,
43 (sender_fullhost != NULL)? sender_fullhost : sender_ident,
44 strerror(errno))
45 :
46 string_sprintf("spool file %s error while %s: %s", s,
47 (where == SW_DELIVERING)? "delivering" : "modifying",
48 strerror(errno));
49
50if (temp_name != NULL) Uunlink(temp_name);
f1e894f3 51if (f != NULL) (void)fclose(f);
059ec3d9
PH
52
53if (errmsg == NULL)
54 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", msg);
55else
56 *errmsg = msg;
57
58return -1;
59}
60
61
62
63/*************************************************
64* Open file under temporary name *
65*************************************************/
66
67/* This is used for opening spool files under a temporary name,
68with a single attempt at deleting if they already exist.
69
70Argument: temporary name for spool header file
71Returns: file descriptor of open file, or < 0 on failure, with errno unchanged
72*/
73
74int
75spool_open_temp(uschar *temp_name)
76{
77int fd = Uopen(temp_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
78
79/* If the file already exists, something has gone wrong. This process may well
80have previously created the file if it is delivering more than one address, but
81it should have renamed it almost immediately. A file could, however, be left
82around as a result of a system crash, and by coincidence this process might
83have the same pid. We therefore have one go at unlinking it before giving up.
84*/
85
86if (fd < 0 && errno == EEXIST)
87 {
88 DEBUG(D_any) debug_printf("%s exists: unlinking\n", temp_name);
89 Uunlink(temp_name);
90 fd = Uopen(temp_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
91 }
92
93/* If the file has been opened, make sure the file's group is the Exim gid, and
94double-check the mode because the group setting doesn't always get set
95automatically. */
96
97if (fd >= 0)
98 {
ff790e47
PH
99 (void)fchown(fd, exim_uid, exim_gid);
100 (void)fchmod(fd, SPOOL_MODE);
059ec3d9
PH
101 }
102
103return fd;
104}
105
106
107
108/*************************************************
109* Write the header spool file *
110*************************************************/
111
112/* Returns the size of the file for success; zero for failure. The file is
113written under a temporary name, and then renamed. It's done this way so that it
114works with re-writing the file on message deferral as well as for the initial
115write. Whenever this function is called, the data file for the message should
116be open and locked, thus preventing any other exim process from working on this
117message.
118
119Argument:
120 id the message id
121 where SW_RECEIVING, SW_DELIVERING, or SW_MODIFYING
122 errmsg where to put an error message; if NULL, panic-die on error
123
124Returns: the size of the header texts on success;
125 negative on writing failure, unless errmsg == NULL
126*/
127
128int
129spool_write_header(uschar *id, int where, uschar **errmsg)
130{
131int fd;
132int i;
133int size_correction;
134FILE *f;
135header_line *h;
136struct stat statbuf;
137uschar name[256];
138uschar temp_name[256];
139
140sprintf(CS temp_name, "%s/input/%s/hdr.%d", spool_directory, message_subdir,
141 (int)getpid());
142fd = spool_open_temp(temp_name);
143if (fd < 0) return spool_write_error(where, errmsg, US"open", NULL, NULL);
144f = fdopen(fd, "wb");
145DEBUG(D_receive|D_deliver) debug_printf("Writing spool header file\n");
146
147/* We now have an open file to which the header data is to be written. Start
148with the file's leaf name, to make the file self-identifying. Continue with the
149identity of the submitting user, followed by the sender's address. The sender's
150address is enclosed in <> because it might be the null address. Then write the
151received time and the number of warning messages that have been sent. */
152
153fprintf(f, "%s-H\n", message_id);
154fprintf(f, "%.63s %ld %ld\n", originator_login, (long int)originator_uid,
155 (long int)originator_gid);
156fprintf(f, "<%s>\n", sender_address);
157fprintf(f, "%d %d\n", received_time, warning_count);
158
159/* If there is information about a sending host, remember it. The HELO
160data can be set for local SMTP as well as remote. */
161
162if (sender_helo_name != NULL)
163 fprintf(f, "-helo_name %s\n", sender_helo_name);
164
165if (sender_host_address != NULL)
166 {
167 fprintf(f, "-host_address %s.%d\n", sender_host_address, sender_host_port);
168 if (sender_host_name != NULL)
169 fprintf(f, "-host_name %s\n", sender_host_name);
170 if (sender_host_authenticated != NULL)
171 fprintf(f, "-host_auth %s\n", sender_host_authenticated);
172 }
173
174/* Also about the interface a message came in on */
175
176if (interface_address != NULL)
177 fprintf(f, "-interface_address %s.%d\n", interface_address, interface_port);
8e669ac1 178
1f5b4c3d 179if (smtp_active_hostname != primary_hostname)
8e669ac1 180 fprintf(f, "-active_hostname %s\n", smtp_active_hostname);
059ec3d9
PH
181
182/* Likewise for any ident information; for local messages this is
183likely to be the same as originator_login, but will be different if
184the originator was root, forcing a different ident. */
185
186if (sender_ident != NULL) fprintf(f, "-ident %s\n", sender_ident);
187
188/* Ditto for the received protocol */
189
190if (received_protocol != NULL)
191 fprintf(f, "-received_protocol %s\n", received_protocol);
192
38a0a95f 193/* Preserve any ACL variables that are set. */
059ec3d9 194
38a0a95f
PH
195tree_walk(acl_var_c, &acl_var_write, f);
196tree_walk(acl_var_m, &acl_var_write, f);
059ec3d9
PH
197
198/* Now any other data that needs to be remembered. */
199
200fprintf(f, "-body_linecount %d\n", body_linecount);
d677b2f2 201fprintf(f, "-max_received_linelength %d\n", max_received_linelength);
059ec3d9
PH
202
203if (body_zerocount > 0) fprintf(f, "-body_zerocount %d\n", body_zerocount);
204
205if (authenticated_id != NULL)
206 fprintf(f, "-auth_id %s\n", authenticated_id);
207if (authenticated_sender != NULL)
208 fprintf(f, "-auth_sender %s\n", authenticated_sender);
209
210if (allow_unqualified_recipient) fprintf(f, "-allow_unqualified_recipient\n");
211if (allow_unqualified_sender) fprintf(f, "-allow_unqualified_sender\n");
212if (deliver_firsttime) fprintf(f, "-deliver_firsttime\n");
213if (deliver_freeze) fprintf(f, "-frozen %d\n", deliver_frozen_at);
214if (dont_deliver) fprintf(f, "-N\n");
b08b24c8 215if (host_lookup_deferred) fprintf(f, "-host_lookup_deferred\n");
059ec3d9
PH
216if (host_lookup_failed) fprintf(f, "-host_lookup_failed\n");
217if (sender_local) fprintf(f, "-local\n");
218if (local_error_message) fprintf(f, "-localerror\n");
219if (local_scan_data != NULL) fprintf(f, "-local_scan %s\n", local_scan_data);
8523533c
TK
220#ifdef WITH_CONTENT_SCAN
221if (spam_score_int != NULL) fprintf(f,"-spam_score_int %s\n", spam_score_int);
222#endif
059ec3d9
PH
223if (deliver_manual_thaw) fprintf(f, "-manual_thaw\n");
224if (sender_set_untrusted) fprintf(f, "-sender_set_untrusted\n");
225
8523533c
TK
226#ifdef EXPERIMENTAL_BRIGHTMAIL
227if (bmi_verdicts != NULL) fprintf(f, "-bmi_verdicts %s\n", bmi_verdicts);
228#endif
229
059ec3d9
PH
230#ifdef SUPPORT_TLS
231if (tls_certificate_verified) fprintf(f, "-tls_certificate_verified\n");
232if (tls_cipher != NULL) fprintf(f, "-tls_cipher %s\n", tls_cipher);
233if (tls_peerdn != NULL) fprintf(f, "-tls_peerdn %s\n", tls_peerdn);
234#endif
235
236/* To complete the envelope, write out the tree of non-recipients, followed by
237the list of recipients. These won't be disjoint the first time, when no
238checking has been done. If a recipient is a "one-time" alias, it is followed by
239a space and its parent address number (pno). */
240
241tree_write(tree_nonrecipients, f);
242fprintf(f, "%d\n", recipients_count);
243for (i = 0; i < recipients_count; i++)
244 {
245 recipient_item *r = recipients_list + i;
246 if (r->pno < 0 && r->errors_to == NULL)
247 fprintf(f, "%s\n", r->address);
248 else
249 {
250 uschar *errors_to = (r->errors_to == NULL)? US"" : r->errors_to;
251 fprintf(f, "%s %s %d,%d#1\n", r->address, errors_to,
252 Ustrlen(errors_to), r->pno);
253 }
254 }
255
256/* Put a blank line before the headers */
257
258fprintf(f, "\n");
259
260/* Save the size of the file so far so we can subtract it from the final length
261to get the actual size of the headers. */
262
263fflush(f);
264fstat(fd, &statbuf);
265size_correction = statbuf.st_size;
266
267/* Finally, write out the message's headers. To make it easier to read them
268in again, precede each one with the count of its length. Make the count fixed
269length to aid human eyes when debugging and arrange for it not be included in
270the size. It is followed by a space for normal headers, a flagging letter for
271various other headers, or an asterisk for old headers that have been rewritten.
272These are saved as a record for debugging. Don't included them in the message's
273size. */
274
275for (h = header_list; h != NULL; h = h->next)
276 {
277 fprintf(f, "%03d%c %s", h->slen, h->type, h->text);
278 size_correction += 5;
279 if (h->type == '*') size_correction += h->slen;
280 }
281
282/* Flush and check for any errors while writing */
283
284if (fflush(f) != 0 || ferror(f))
285 return spool_write_error(where, errmsg, US"write", temp_name, f);
286
287/* Force the file's contents to be written to disk. Note that fflush()
288just pushes it out of C, and fclose() doesn't guarantee to do the write
289either. That's just the way Unix works... */
290
54fc8428 291if (EXIMfsync(fileno(f)) < 0)
059ec3d9
PH
292 return spool_write_error(where, errmsg, US"sync", temp_name, f);
293
294/* Get the size of the file, and close it. */
295
296fstat(fd, &statbuf);
297if (fclose(f) != 0)
298 return spool_write_error(where, errmsg, US"close", temp_name, NULL);
299
300/* Rename the file to its correct name, thereby replacing any previous
301incarnation. */
302
303sprintf(CS name, "%s/input/%s/%s-H", spool_directory, message_subdir, id);
304
305if (Urename(temp_name, name) < 0)
306 return spool_write_error(where, errmsg, US"rename", temp_name, NULL);
307
308/* Linux (and maybe other OS?) does not automatically sync a directory after
309an operation like rename. We therefore have to do it forcibly ourselves in
310these cases, to make sure the file is actually accessible on disk, as opposed
311to just the data being accessible from a file in lost+found. Linux also has
312O_DIRECTORY, for opening a directory.
313
314However, it turns out that some file systems (some versions of NFS?) do not
315support directory syncing. It seems safe enough to ignore EINVAL to cope with
316these cases. One hack on top of another... but that's life. */
317
318#ifdef NEED_SYNC_DIRECTORY
319
320sprintf(CS temp_name, "%s/input/%s/.", spool_directory, message_subdir);
321
322#ifndef O_DIRECTORY
323#define O_DIRECTORY 0
324#endif
325
326if ((fd = Uopen(temp_name, O_RDONLY|O_DIRECTORY, 0)) < 0)
327 return spool_write_error(where, errmsg, US"directory open", name, NULL);
328
54fc8428 329if (EXIMfsync(fd) < 0 && errno != EINVAL)
059ec3d9
PH
330 return spool_write_error(where, errmsg, US"directory sync", name, NULL);
331
332if (close(fd) < 0)
333 return spool_write_error(where, errmsg, US"directory close", name, NULL);
334
335#endif /* NEED_SYNC_DIRECTORY */
336
337/* Return the number of characters in the headers, which is the file size, less
338the prelimary stuff, less the additional count fields on the headers. */
339
340DEBUG(D_receive) debug_printf("Size of headers = %d\n",
341 (int)(statbuf.st_size - size_correction));
342
343return statbuf.st_size - size_correction;
344}
345
346
347#ifdef SUPPORT_MOVE_FROZEN_MESSAGES
348
349/************************************************
350* Make a hard link *
351************************************************/
352
353/* Used by spool_move_message() below. Note re the use of sprintf(): the value
354of spool_directory is checked to ensure that it is less than 200 characters at
355start-up time.
356
357Arguments:
358 dir base directory name
359 subdir subdirectory name
360 id message id
361 suffix suffix to add to id
362 from source directory prefix
363 to destination directory prefix
364 noentok if TRUE, absence of file is not an error
365
366Returns: TRUE if all went well
367 FALSE, having panic logged if not
368*/
369
370static BOOL
371make_link(uschar *dir, uschar *subdir, uschar *id, uschar *suffix, uschar *from,
372 uschar *to, BOOL noentok)
373{
374uschar f[256], t[256];
375sprintf(CS f, "%s/%s%s/%s/%s%s", spool_directory, from, dir, subdir, id, suffix);
376sprintf(CS t, "%s/%s%s/%s/%s%s", spool_directory, to, dir, subdir, id, suffix);
377if (Ulink(f, t) < 0 && (!noentok || errno != ENOENT))
378 {
379 log_write(0, LOG_MAIN|LOG_PANIC, "link(\"%s\", \"%s\") failed while moving "
380 "message: %s", f, t, strerror(errno));
381 return FALSE;
382 }
383return TRUE;
384}
385
386
387
388/************************************************
389* Break a link *
390************************************************/
391
392/* Used by spool_move_message() below. Note re the use of sprintf(): the value
393of spool_directory is checked to ensure that it is less than 200 characters at
394start-up time.
395
396Arguments:
397 dir base directory name
398 subdir subdirectory name
399 id message id
400 suffix suffix to add to id
401 from source directory prefix
402 noentok if TRUE, absence of file is not an error
403
404Returns: TRUE if all went well
405 FALSE, having panic logged if not
406*/
407
408static BOOL
409break_link(uschar *dir, uschar *subdir, uschar *id, uschar *suffix, uschar *from,
410 BOOL noentok)
411{
412uschar f[256];
413sprintf(CS f, "%s/%s%s/%s/%s%s", spool_directory, from, dir, subdir, id, suffix);
414if (Uunlink(f) < 0 && (!noentok || errno != ENOENT))
415 {
416 log_write(0, LOG_MAIN|LOG_PANIC, "unlink(\"%s\") failed while moving "
417 "message: %s", f, strerror(errno));
418 return FALSE;
419 }
420return TRUE;
421}
422
423
424
425/************************************************
426* Move message files *
427************************************************/
428
429/* Move the files for a message (-H, -D, and msglog) from one directory (or
430hierarchy) to another. It is assume that there is no -J file in existence when
431this is done. At present, this is used only when move_frozen_messages is set,
432so compile it only when that support is configured.
433
434Arguments:
435 id the id of the message to be delivered
436 subdir the subdirectory name, or an empty string
437 from a prefix for "input" or "msglog" for where the message is now
438 to a prefix for "input" or "msglog" for where the message is to go
439
440Returns: TRUE if all is well
441 FALSE if not, with error logged in panic and main logs
442*/
443
444BOOL
445spool_move_message(uschar *id, uschar *subdir, uschar *from, uschar *to)
446{
447/* Create any output directories that do not exist. */
448
449sprintf(CS big_buffer, "%sinput/%s", to, subdir);
450(void)directory_make(spool_directory, big_buffer, INPUT_DIRECTORY_MODE, TRUE);
451sprintf(CS big_buffer, "%smsglog/%s", to, subdir);
452(void)directory_make(spool_directory, big_buffer, INPUT_DIRECTORY_MODE, TRUE);
453
454/* Move the message by first creating new hard links for all the files, and
455then removing the old links. When moving messages onto the main spool, the -H
456file should be set up last, because that's the one that tells Exim there is a
457message to be delivered, so we create its new link last and remove its old link
458first. Programs that look at the alternate directories should follow the same
459rule of waiting for a -H file before doing anything. When moving messsages off
460the mail spool, the -D file should be open and locked at the time, thus keeping
461Exim's hands off. */
462
463if (!make_link(US"msglog", subdir, id, US"", from, to, TRUE) ||
464 !make_link(US"input", subdir, id, US"-D", from, to, FALSE) ||
465 !make_link(US"input", subdir, id, US"-H", from, to, FALSE))
466 return FALSE;
467
468if (!break_link(US"input", subdir, id, US"-H", from, FALSE) ||
469 !break_link(US"input", subdir, id, US"-D", from, FALSE) ||
470 !break_link(US"msglog", subdir, id, US"", from, TRUE))
471 return FALSE;
472
473log_write(0, LOG_MAIN, "moved from %sinput, %smsglog to %sinput, %smsglog",
474 from, from, to, to);
475
476return TRUE;
477}
478
479#endif
480
481/* End of spool_out.c */