1e92add35ddf1610a5be3ee19ddfd119a0b25b8a
[exim.git] / src / src / transports / appendfile.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8
9 #include "../exim.h"
10 #include "appendfile.h"
11
12 #ifdef SUPPORT_MAILDIR
13 #include "tf_maildir.h"
14 #endif
15
16
17 /* Options specific to the appendfile transport. They must be in alphabetic
18 order (note that "_" comes before the lower case letters). Some of them are
19 stored in the publicly visible instance block - these are flagged with the
20 opt_public flag. */
21
22 optionlist appendfile_transport_options[] = {
23 #ifdef SUPPORT_MAILDIR
24 { "*expand_maildir_use_size_file", opt_stringptr,
25 (void *)offsetof(appendfile_transport_options_block, expand_maildir_use_size_file) },
26 #endif
27 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
28 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
29 { "*set_use_flock_lock",opt_bool | opt_hidden,
30 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
31 { "*set_use_lockfile", opt_bool | opt_hidden,
32 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
33 #ifdef SUPPORT_MBX
34 { "*set_use_mbx_lock", opt_bool | opt_hidden,
35 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
36 #endif
37 { "allow_fifo", opt_bool,
38 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
39 { "allow_symlink", opt_bool,
40 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
41 { "batch_id", opt_stringptr | opt_public,
42 (void *)offsetof(transport_instance, batch_id) },
43 { "batch_max", opt_int | opt_public,
44 (void *)offsetof(transport_instance, batch_max) },
45 { "check_group", opt_bool,
46 (void *)offsetof(appendfile_transport_options_block, check_group) },
47 { "check_owner", opt_bool,
48 (void *)offsetof(appendfile_transport_options_block, check_owner) },
49 { "check_string", opt_stringptr,
50 (void *)offsetof(appendfile_transport_options_block, check_string) },
51 { "create_directory", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, create_directory) },
53 { "create_file", opt_stringptr,
54 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
55 { "directory", opt_stringptr,
56 (void *)offsetof(appendfile_transport_options_block, dirname) },
57 { "directory_file", opt_stringptr,
58 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
59 { "directory_mode", opt_octint,
60 (void *)offsetof(appendfile_transport_options_block, dirmode) },
61 { "escape_string", opt_stringptr,
62 (void *)offsetof(appendfile_transport_options_block, escape_string) },
63 { "file", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, filename) },
65 { "file_format", opt_stringptr,
66 (void *)offsetof(appendfile_transport_options_block, file_format) },
67 { "file_must_exist", opt_bool,
68 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
69 { "lock_fcntl_timeout", opt_time,
70 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
71 { "lock_flock_timeout", opt_time,
72 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
73 { "lock_interval", opt_time,
74 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
75 { "lock_retries", opt_int,
76 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
77 { "lockfile_mode", opt_octint,
78 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
79 { "lockfile_timeout", opt_time,
80 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
81 { "mailbox_filecount", opt_stringptr,
82 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
83 { "mailbox_size", opt_stringptr,
84 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
85 #ifdef SUPPORT_MAILDIR
86 { "maildir_format", opt_bool,
87 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
88 { "maildir_quota_directory_regex", opt_stringptr,
89 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
90 { "maildir_retries", opt_int,
91 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
92 { "maildir_tag", opt_stringptr,
93 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
94 { "maildir_use_size_file", opt_expand_bool,
95 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
96 { "maildirfolder_create_regex", opt_stringptr,
97 (void *)offsetof(appendfile_transport_options_block, maildirfolder_create_regex ) },
98 #endif /* SUPPORT_MAILDIR */
99 #ifdef SUPPORT_MAILSTORE
100 { "mailstore_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
102 { "mailstore_prefix", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
104 { "mailstore_suffix", opt_stringptr,
105 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
106 #endif /* SUPPORT_MAILSTORE */
107 #ifdef SUPPORT_MBX
108 { "mbx_format", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
110 #endif /* SUPPORT_MBX */
111 { "message_prefix", opt_stringptr,
112 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
113 { "message_suffix", opt_stringptr,
114 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
115 { "mode", opt_octint,
116 (void *)offsetof(appendfile_transport_options_block, mode) },
117 { "mode_fail_narrower",opt_bool,
118 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
119 { "notify_comsat", opt_bool,
120 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
121 { "quota", opt_stringptr,
122 (void *)offsetof(appendfile_transport_options_block, quota) },
123 { "quota_directory", opt_stringptr,
124 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
125 { "quota_filecount", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
127 { "quota_is_inclusive", opt_bool,
128 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
129 { "quota_size_regex", opt_stringptr,
130 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
131 { "quota_warn_message", opt_stringptr | opt_public,
132 (void *)offsetof(transport_instance, warn_message) },
133 { "quota_warn_threshold", opt_stringptr,
134 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
135 { "use_bsmtp", opt_bool,
136 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
137 { "use_crlf", opt_bool,
138 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
139 { "use_fcntl_lock", opt_bool_set,
140 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
141 { "use_flock_lock", opt_bool_set,
142 (void *)offsetof(appendfile_transport_options_block, use_flock) },
143 { "use_lockfile", opt_bool_set,
144 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
145 #ifdef SUPPORT_MBX
146 { "use_mbx_lock", opt_bool_set,
147 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
148 #endif /* SUPPORT_MBX */
149 };
150
151 /* Size of the options list. An extern variable has to be used so that its
152 address can appear in the tables drtables.c. */
153
154 int appendfile_transport_options_count =
155 sizeof(appendfile_transport_options)/sizeof(optionlist);
156
157
158 #ifdef MACRO_PREDEF
159
160 /* Dummy values */
161 appendfile_transport_options_block appendfile_transport_option_defaults = {0};
162 void appendfile_transport_init(transport_instance *tblock) {}
163 BOOL appendfile_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
164
165 #else /*!MACRO_PREDEF*/
166
167 /* Default private options block for the appendfile transport. */
168
169 appendfile_transport_options_block appendfile_transport_option_defaults = {
170 NULL, /* filename */
171 NULL, /* dirname */
172 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
173 NULL, /* message_prefix (default reset in init if not bsmtp) */
174 NULL, /* message_suffix (ditto) */
175 US"anywhere", /* create_file_string (string value for create_file) */
176 NULL, /* quota */
177 NULL, /* quota_directory */
178 NULL, /* quota_filecount */
179 NULL, /* quota_size_regex */
180 NULL, /* quota_warn_threshold */
181 NULL, /* mailbox_size_string */
182 NULL, /* mailbox_filecount_string */
183 NULL, /* expand_maildir_use_size_file */
184 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
185 NULL, /* maildir_tag */
186 NULL, /* maildirfolder_create_regex */
187 NULL, /* mailstore_prefix */
188 NULL, /* mailstore_suffix */
189 NULL, /* check_string (default changed for non-bsmtp file)*/
190 NULL, /* escape_string (ditto) */
191 NULL, /* file_format */
192 0, /* quota_value */
193 0, /* quota_warn_threshold_value */
194 -1, /* mailbox_size_value */
195 -1, /* mailbox_filecount_value */
196 0, /* quota_filecount_value */
197 APPENDFILE_MODE, /* mode */
198 APPENDFILE_DIRECTORY_MODE, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere,/* create_file */
207 0, /* options */
208 FALSE, /* allow_fifo */
209 FALSE, /* allow_symlink */
210 FALSE, /* check_group */
211 TRUE, /* check_owner */
212 TRUE, /* create_directory */
213 FALSE, /* notify_comsat */
214 TRUE, /* use_lockfile */
215 FALSE, /* set_use_lockfile */
216 TRUE, /* use_fcntl */
217 FALSE, /* set_use_fcntl */
218 FALSE, /* use_flock */
219 FALSE, /* set_use_flock */
220 FALSE, /* use_mbx_lock */
221 FALSE, /* set_use_mbx_lock */
222 FALSE, /* use_bsmtp */
223 FALSE, /* use_crlf */
224 FALSE, /* file_must_exist */
225 TRUE, /* mode_fail_narrower */
226 FALSE, /* maildir_format */
227 FALSE, /* maildir_use_size_file */
228 FALSE, /* mailstore_format */
229 FALSE, /* mbx_format */
230 FALSE, /* quota_warn_threshold_is_percent */
231 TRUE, /* quota_is_inclusive */
232 FALSE, /* quota_no_check */
233 FALSE /* quota_filecount_no_check */
234 };
235
236
237 /* Encodings for mailbox formats, and their names. MBX format is actually
238 supported only if SUPPORT_MBX is set. */
239
240 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
241
242 static const char *mailbox_formats[] = {
243 "unix", "mbx", "smail", "maildir", "mailstore" };
244
245
246 /* Check warn threshold only if quota size set or not a percentage threshold
247 percentage check should only be done if quota > 0 */
248
249 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
250 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
251
252
253
254 /*************************************************
255 * Setup entry point *
256 *************************************************/
257
258 /* Called for each delivery in the privileged state, just before the uid/gid
259 are changed and the main entry point is called. We use this function to
260 expand any quota settings, so that it can access files that may not be readable
261 by the user. It is also used to pick up external mailbox size information, if
262 set.
263
264 Arguments:
265 tblock points to the transport instance
266 addrlist addresses about to be delivered (not used)
267 dummy not used (doesn't pass back data)
268 uid the uid that will be set (not used)
269 gid the gid that will be set (not used)
270 errmsg where to put an error message
271
272 Returns: OK, FAIL, or DEFER
273 */
274
275 static int
276 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
277 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
278 {
279 appendfile_transport_options_block *ob =
280 (appendfile_transport_options_block *)(tblock->options_block);
281 uschar *q = ob->quota;
282 double default_value = 0.0;
283
284 addrlist = addrlist; /* Keep picky compilers happy */
285 dummy = dummy;
286 uid = uid;
287 gid = gid;
288
289 if (ob->expand_maildir_use_size_file)
290 ob->maildir_use_size_file = expand_check_condition(ob->expand_maildir_use_size_file,
291 US"`maildir_use_size_file` in transport", tblock->name);
292
293 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
294 mailbox_filecount */
295
296 for (int i = 0; i < 5; i++)
297 {
298 double d;
299 int no_check = 0;
300 uschar *which = NULL;
301
302 if (q == NULL) d = default_value;
303 else
304 {
305 uschar *rest;
306 uschar *s = expand_string(q);
307
308 if (!s)
309 {
310 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
311 "%s", q, tblock->name, expand_string_message);
312 return f.search_find_defer ? DEFER : FAIL;
313 }
314
315 d = Ustrtod(s, &rest);
316
317 /* Handle following characters K, M, G, %, the latter being permitted
318 for quota_warn_threshold only. A threshold with no quota setting is
319 just ignored. */
320
321 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
322 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
323 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
324 else if (*rest == '%' && i == 2)
325 {
326 if (ob->quota_value <= 0 && !ob->maildir_use_size_file)
327 d = 0;
328 else if ((int)d < 0 || (int)d > 100)
329 {
330 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
331 " for %s transport", (int)d, tblock->name);
332 return FAIL;
333 }
334 ob->quota_warn_threshold_is_percent = TRUE;
335 rest++;
336 }
337
338
339 /* For quota and quota_filecount there may be options
340 appended. Currently only "no_check", so we can be lazy parsing it */
341 if (i < 2 && Ustrstr(rest, "/no_check") == rest)
342 {
343 no_check = 1;
344 rest += sizeof("/no_check") - 1;
345 }
346
347 while (isspace(*rest)) rest++;
348
349 if (*rest != 0)
350 {
351 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
352 "in %s transport", s, q, tblock->name);
353 return FAIL;
354 }
355 }
356
357 /* Set each value, checking for possible overflow. */
358
359 switch (i)
360 {
361 case 0:
362 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
363 which = US"quota";
364 ob->quota_value = (off_t)d;
365 ob->quota_no_check = no_check;
366 q = ob->quota_filecount;
367 break;
368
369 case 1:
370 if (d >= 2.0*1024.0*1024.0*1024.0)
371 which = US"quota_filecount";
372 ob->quota_filecount_value = (int)d;
373 ob->quota_filecount_no_check = no_check;
374 q = ob->quota_warn_threshold;
375 break;
376
377 case 2:
378 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
379 which = US"quota_warn_threshold";
380 ob->quota_warn_threshold_value = (off_t)d;
381 q = ob->mailbox_size_string;
382 default_value = -1.0;
383 break;
384
385 case 3:
386 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
387 which = US"mailbox_size";;
388 ob->mailbox_size_value = (off_t)d;
389 q = ob->mailbox_filecount_string;
390 break;
391
392 case 4:
393 if (d >= 2.0*1024.0*1024.0*1024.0)
394 which = US"mailbox_filecount";
395 ob->mailbox_filecount_value = (int)d;
396 break;
397 }
398
399 if (which)
400 {
401 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
402 "%s transport", which, d, tblock->name);
403 return FAIL;
404 }
405 }
406
407 return OK;
408 }
409
410
411
412 /*************************************************
413 * Initialization entry point *
414 *************************************************/
415
416 /* Called for each instance, after its options have been read, to
417 enable consistency checks to be done, or anything else that needs
418 to be set up. */
419
420 void
421 appendfile_transport_init(transport_instance *tblock)
422 {
423 appendfile_transport_options_block *ob =
424 (appendfile_transport_options_block *)(tblock->options_block);
425
426 /* Set up the setup entry point, to be called in the privileged state */
427
428 tblock->setup = appendfile_transport_setup;
429
430 /* Lock_retries must be greater than zero */
431
432 if (ob->lock_retries == 0) ob->lock_retries = 1;
433
434 /* Only one of a file name or directory name must be given. */
435
436 if (ob->filename != NULL && ob->dirname != NULL)
437 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
438 "only one of \"file\" or \"directory\" can be specified", tblock->name);
439
440 /* If a file name was specified, neither quota_filecount nor quota_directory
441 must be given. */
442
443 if (ob->filename != NULL)
444 {
445 if (ob->quota_filecount != NULL)
446 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
447 "quota_filecount must not be set without \"directory\"", tblock->name);
448 if (ob->quota_directory != NULL)
449 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
450 "quota_directory must not be set without \"directory\"", tblock->name);
451 }
452
453 /* The default locking depends on whether MBX is set or not. Change the
454 built-in default if none of the lock options has been explicitly set. At least
455 one form of locking is required in all cases, but mbx locking changes the
456 meaning of fcntl and flock locking. */
457
458 /* Not all operating systems provide flock(). For those that do, if flock is
459 requested, the default for fcntl is FALSE. */
460
461 if (ob->use_flock)
462 {
463 #ifdef NO_FLOCK
464 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
465 "flock() support was not available in the operating system when this "
466 "binary was built", tblock->name);
467 #endif /* NO_FLOCK */
468 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
469 }
470
471 #ifdef SUPPORT_MBX
472 if (ob->mbx_format)
473 {
474 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
475 !ob->set_use_mbx_lock)
476 {
477 ob->use_lockfile = ob->use_flock = FALSE;
478 ob->use_mbx_lock = ob->use_fcntl = TRUE;
479 }
480 else if (ob->use_mbx_lock)
481 {
482 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
483 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
484 if (!ob->set_use_flock) ob->use_flock = FALSE;
485 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
486 }
487 }
488 #endif /* SUPPORT_MBX */
489
490 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
491 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
492 "no locking configured", tblock->name);
493
494 /* Unset timeouts for non-used locking types */
495
496 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
497 if (!ob->use_flock) ob->lock_flock_timeout = 0;
498
499 /* If a directory name was specified, only one of maildir or mailstore may be
500 specified, and if quota_filecount or quota_directory is given, quota must
501 be set. */
502
503 if (ob->dirname != NULL)
504 {
505 if (ob->maildir_format && ob->mailstore_format)
506 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
507 "only one of maildir and mailstore may be specified", tblock->name);
508 if (ob->quota_filecount != NULL && ob->quota == NULL)
509 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
510 "quota must be set if quota_filecount is set", tblock->name);
511 if (ob->quota_directory != NULL && ob->quota == NULL)
512 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
513 "quota must be set if quota_directory is set", tblock->name);
514 }
515
516 /* If a fixed uid field is set, then a gid field must also be set. */
517
518 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
519 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
520 "user set without group for the %s transport", tblock->name);
521
522 /* If "create_file" is set, check that a valid option is given, and set the
523 integer variable. */
524
525 if (ob->create_file_string != NULL)
526 {
527 int value = 0;
528 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
529 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
530 create_belowhome;
531 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
532 value = create_inhome;
533 else
534 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
535 "invalid value given for \"file_create\" for the %s transport: %s",
536 tblock->name, ob->create_file_string);
537 ob->create_file = value;
538 }
539
540 /* If quota_warn_threshold is set, set up default for warn_message. It may
541 not be used if the actual threshold for a given delivery ends up as zero,
542 of if it's given as a percentage and there's no quota setting. */
543
544 if (ob->quota_warn_threshold != NULL)
545 {
546 if (tblock->warn_message == NULL) tblock->warn_message = US
547 "To: $local_part@$domain\n"
548 "Subject: Your mailbox\n\n"
549 "This message is automatically created by mail delivery software (Exim).\n\n"
550 "The size of your mailbox has exceeded a warning threshold that is\n"
551 "set by the system administrator.\n";
552 }
553
554 /* If batch SMTP is set, force the check and escape strings, and arrange that
555 headers are also escaped. */
556
557 if (ob->use_bsmtp)
558 {
559 ob->check_string = US".";
560 ob->escape_string = US"..";
561 ob->options |= topt_escape_headers;
562 }
563
564 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
565 insert default values for for the affixes and the check/escape strings. */
566
567 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
568 {
569 if (ob->message_prefix == NULL) ob->message_prefix =
570 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
571 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
572 if (ob->check_string == NULL) ob->check_string = US"From ";
573 if (ob->escape_string == NULL) ob->escape_string = US">From ";
574
575 }
576
577 /* Set up the bitwise options for transport_write_message from the various
578 driver options. Only one of body_only and headers_only can be set. */
579
580 ob->options |=
581 (tblock->body_only ? topt_no_headers : 0) |
582 (tblock->headers_only ? topt_no_body : 0) |
583 (tblock->return_path_add ? topt_add_return_path : 0) |
584 (tblock->delivery_date_add ? topt_add_delivery_date : 0) |
585 (tblock->envelope_to_add ? topt_add_envelope_to : 0) |
586 ((ob->use_crlf || ob->mbx_format) ? topt_use_crlf : 0);
587 }
588
589
590
591 /*************************************************
592 * Notify comsat *
593 *************************************************/
594
595 /* The comsat daemon is the thing that provides asynchronous notification of
596 the arrival of local messages, if requested by the user by "biff y". It is a
597 BSD thing that uses a TCP/IP protocol for communication. A message consisting
598 of the text "user@offset" must be sent, where offset is the place in the
599 mailbox where new mail starts. There is no scope for telling it which file to
600 look at, which makes it a less than useful if mail is being delivered into a
601 non-standard place such as the user's home directory. In fact, it doesn't seem
602 to pay much attention to the offset.
603
604 Arguments:
605 user user name
606 offset offset in mailbox
607
608 Returns: nothing
609 */
610
611 static void
612 notify_comsat(uschar *user, off_t offset)
613 {
614 struct servent *sp;
615 host_item host;
616 uschar buffer[256];
617
618 DEBUG(D_transport) debug_printf("notify_comsat called\n");
619
620 sprintf(CS buffer, "%.200s@" OFF_T_FMT "\n", user, offset);
621
622 if ((sp = getservbyname("biff", "udp")) == NULL)
623 {
624 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
625 return;
626 }
627
628 host.name = US"localhost";
629 host.next = NULL;
630
631
632 /* This code is all set up to look up "localhost" and use all its addresses
633 until one succeeds. However, it appears that at least on some systems, comsat
634 doesn't listen on the ::1 address. So for the moment, just force the address to
635 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
636 can be changed. (But actually, comsat is probably dying out anyway.) */
637
638 /******
639 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
640 {
641 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
642 return;
643 }
644 ******/
645
646 host.address = US"127.0.0.1";
647
648
649 for (host_item * h = &host; h; h = h->next)
650 {
651 int sock, rc;
652 int host_af = Ustrchr(h->address, ':') != NULL ? AF_INET6 : AF_INET;
653
654 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
655
656 if ((sock = ip_socket(SOCK_DGRAM, host_af)) < 0) continue;
657
658 /* Connect never fails for a UDP socket, so don't set a timeout. */
659
660 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0, NULL);
661 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
662 (void)close(sock);
663
664 if (rc >= 0) break;
665 DEBUG(D_transport)
666 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
667 h->address);
668 }
669 }
670
671
672
673 /*************************************************
674 * Check the format of a file *
675 *************************************************/
676
677 /* This function is called when file_format is set, to check that an existing
678 file has the right format. The format string contains text/transport pairs. The
679 string matching is literal. we just read big_buffer_size bytes, because this is
680 all about the first few bytes of a file.
681
682 Arguments:
683 cfd the open file
684 tblock the transport block
685 addr the address block - for inserting error data
686
687 Returns: pointer to the required transport, or NULL
688 */
689
690 transport_instance *
691 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
692 {
693 const uschar *format =
694 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
695 uschar data[256];
696 int len = read(cfd, data, sizeof(data));
697 int sep = 0;
698 uschar *s;
699
700 DEBUG(D_transport) debug_printf("checking file format\n");
701
702 /* An empty file matches the current transport */
703
704 if (len == 0) return tblock;
705
706 /* Search the formats for a match */
707
708 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size)))
709 {
710 int slen = Ustrlen(s);
711 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
712 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
713
714 if (match && tp)
715 {
716 for (transport_instance * tt = transports; tt; tt = tt->next)
717 if (Ustrcmp(tp, tt->name) == 0)
718 {
719 DEBUG(D_transport)
720 debug_printf("file format -> %s transport\n", tt->name);
721 return tt;
722 }
723 addr->basic_errno = ERRNO_BADTRANSPORT;
724 addr->message = string_sprintf("%s transport (for %.*s format) not found",
725 tp, slen, data);
726 return NULL;
727 }
728 }
729
730 /* Failed to find a match */
731
732 addr->basic_errno = ERRNO_FORMATUNKNOWN;
733 addr->message = US"mailbox file format unrecognized";
734 return NULL;
735 }
736
737
738
739
740 /*************************************************
741 * Check directory's files for quota *
742 *************************************************/
743
744 /* This function is called if quota is set for one of the delivery modes that
745 delivers into a specific directory. It scans the directory and stats all the
746 files in order to get a total size and count. This is an expensive thing to do,
747 but some people are prepared to bear the cost. Alternatively, if size_regex is
748 set, it is used as a regex to try to extract the size from the file name, a
749 strategy that some people use on maildir files on systems where the users have
750 no shell access.
751
752 The function is global, because it is also called from tf_maildir.c for maildir
753 folders (which should contain only regular files).
754
755 Note: Any problems can be written to debugging output, but cannot be written to
756 the log, because we are running as an unprivileged user here.
757
758 Arguments:
759 dirname the name of the directory
760 countptr where to add the file count (because this function recurses)
761 regex a compiled regex to get the size from a name
762
763 Returns: the sum of the sizes of the stattable files
764 zero if the directory cannot be opened
765 */
766
767 off_t
768 check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
769 {
770 DIR *dir;
771 off_t sum = 0;
772 int count = *countptr;
773 struct dirent *ent;
774 struct stat statbuf;
775
776 dir = opendir(CS dirname);
777 if (dir == NULL) return 0;
778
779 while ((ent = readdir(dir)) != NULL)
780 {
781 uschar *name = US ent->d_name;
782 uschar buffer[1024];
783
784 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
785
786 count++;
787
788 /* If there's a regex, try to find the size using it */
789
790 if (regex != NULL)
791 {
792 int ovector[6];
793 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
794 {
795 uschar *endptr;
796 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
797 if (endptr == name + ovector[3])
798 {
799 sum += size;
800 DEBUG(D_transport)
801 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
802 size);
803 continue;
804 }
805 }
806 DEBUG(D_transport)
807 debug_printf("check_dir_size: regex did not match %s\n", name);
808 }
809
810 /* No regex or no match for the regex, or captured non-digits */
811
812 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
813 {
814 DEBUG(D_transport)
815 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
816 name);
817 continue;
818 }
819
820 if (Ustat(buffer, &statbuf) < 0)
821 {
822 DEBUG(D_transport)
823 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
824 strerror(errno));
825 continue;
826 }
827
828 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
829 sum += statbuf.st_size;
830 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
831 sum += check_dir_size(buffer, &count, regex);
832 }
833
834 closedir(dir);
835 DEBUG(D_transport)
836 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
837 sum, count);
838
839 *countptr = count;
840 return sum;
841 }
842
843
844
845
846 /*************************************************
847 * Apply a lock to a file descriptor *
848 *************************************************/
849
850 /* This function applies a lock to a file descriptor, using a blocking or
851 non-blocking lock, depending on the timeout value. It can apply either or
852 both of a fcntl() and a flock() lock. However, not all OS support flock();
853 for those that don't, the use_flock option cannot be set.
854
855 Arguments:
856 fd the file descriptor
857 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
858 fcntl() format); the flock() type is deduced if needed
859 dofcntl do fcntl() locking
860 fcntltime non-zero to use blocking fcntl()
861 doflock do flock() locking
862 flocktime non-zero to use blocking flock()
863
864 Returns: yield of the fcntl() or flock() call, with errno preserved;
865 sigalrm_seen set if there has been a timeout
866 */
867
868 static int
869 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
870 int flocktime)
871 {
872 int yield = 0;
873 int save_errno;
874 struct flock lock_data;
875 lock_data.l_type = fcntltype;
876 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
877
878 sigalrm_seen = FALSE;
879
880 if (dofcntl)
881 {
882 if (fcntltime > 0)
883 {
884 ALARM(fcntltime);
885 yield = fcntl(fd, F_SETLKW, &lock_data);
886 save_errno = errno;
887 ALARM_CLR(0);
888 errno = save_errno;
889 }
890 else yield = fcntl(fd, F_SETLK, &lock_data);
891 }
892
893 #ifndef NO_FLOCK
894 if (doflock && (yield >= 0))
895 {
896 int flocktype = (fcntltype == F_WRLCK) ? LOCK_EX : LOCK_SH;
897 if (flocktime > 0)
898 {
899 ALARM(flocktime);
900 yield = flock(fd, flocktype);
901 save_errno = errno;
902 ALARM_CLR(0);
903 errno = save_errno;
904 }
905 else yield = flock(fd, flocktype | LOCK_NB);
906 }
907 #endif /* NO_FLOCK */
908
909 return yield;
910 }
911
912
913
914
915 #ifdef SUPPORT_MBX
916 /*************************************************
917 * Copy message into MBX mailbox *
918 *************************************************/
919
920 /* This function is called when a message intended for a MBX mailbox has been
921 written to a temporary file. We can now get the size of the message and then
922 copy it in MBX format to the mailbox.
923
924 Arguments:
925 to_fd fd to write to (the real mailbox)
926 from_fd fd to read from (the temporary file)
927 saved_size current size of mailbox
928
929 Returns: OK if all went well, DEFER otherwise, with errno preserved
930 the number of bytes written are added to transport_count
931 by virtue of calling transport_write_block()
932 */
933
934 /* Values taken from c-client */
935
936 #define MBX_HDRSIZE 2048
937 #define MBX_NUSERFLAGS 30
938
939 static int
940 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
941 {
942 int used;
943 off_t size;
944 struct stat statbuf;
945 transport_ctx tctx = { .u={.fd = to_fd}, .options = topt_not_socket };
946
947 /* If the current mailbox size is zero, write a header block */
948
949 if (saved_size == 0)
950 {
951 uschar *s;
952 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
953 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
954 (long int)time(NULL));
955 for (int i = 0; i < MBX_NUSERFLAGS; i++)
956 sprintf (CS(s += Ustrlen(s)), "\015\012");
957 if (!transport_write_block (&tctx, deliver_out_buffer, MBX_HDRSIZE, FALSE))
958 return DEFER;
959 }
960
961 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
962
963 /* Now construct the message's header from the time and the RFC822 file
964 size, including CRLFs, which is the size of the input (temporary) file. */
965
966 if (fstat(from_fd, &statbuf) < 0) return DEFER;
967 size = statbuf.st_size;
968
969 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
970 tod_stamp(tod_mbx), size, 0L, 0, 0);
971 used = Ustrlen(deliver_out_buffer);
972
973 /* Rewind the temporary file, and copy it over in chunks. */
974
975 if (lseek(from_fd, 0 , SEEK_SET) < 0) return DEFER;
976
977 while (size > 0)
978 {
979 int len = read(from_fd, deliver_out_buffer + used,
980 DELIVER_OUT_BUFFER_SIZE - used);
981 if (len <= 0)
982 {
983 if (len == 0) errno = ERRNO_MBXLENGTH;
984 return DEFER;
985 }
986 if (!transport_write_block(&tctx, deliver_out_buffer, used + len, FALSE))
987 return DEFER;
988 size -= len;
989 used = 0;
990 }
991
992 return OK;
993 }
994 #endif /* SUPPORT_MBX */
995
996
997
998 /*************************************************
999 * Check creation is permitted *
1000 *************************************************/
1001
1002 /* This function checks whether a given file name is permitted to be created,
1003 as controlled by the create_file option. If no home directory is set, however,
1004 we can't do any tests.
1005
1006 Arguments:
1007 filename the file name
1008 create_file the ob->create_file option
1009
1010 Returns: TRUE if creation is permitted
1011 */
1012
1013 static BOOL
1014 check_creation(uschar *filename, int create_file)
1015 {
1016 BOOL yield = TRUE;
1017
1018 if (deliver_home != NULL && create_file != create_anywhere)
1019 {
1020 int len = Ustrlen(deliver_home);
1021 uschar *file = filename;
1022
1023 while (file[0] == '/' && file[1] == '/') file++;
1024 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
1025 ( Ustrchr(file+len+2, '/') != NULL &&
1026 (
1027 create_file != create_belowhome ||
1028 Ustrstr(file+len, "/../") != NULL
1029 )
1030 )
1031 ) yield = FALSE;
1032
1033 /* If yield is TRUE, the file name starts with the home directory, and does
1034 not contain any instances of "/../" in the "belowhome" case. However, it may
1035 still contain symbolic links. We can check for this by making use of
1036 realpath(), which most Unixes seem to have (but make it possible to cut this
1037 out). We can't just use realpath() on the whole file name, because we know
1038 the file itself doesn't exist, and intermediate directories may also not
1039 exist. What we want to know is the real path of the longest existing part of
1040 the path. That must match the home directory's beginning, whichever is the
1041 shorter. */
1042
1043 #ifndef NO_REALPATH
1044 if (yield && create_file == create_belowhome)
1045 {
1046 uschar *next;
1047 uschar *rp = NULL;
1048 for (uschar * slash = Ustrrchr(file, '/'); /* There is known to be one */
1049 rp == NULL && slash > file; /* Stop if reached beginning */
1050 slash = next)
1051 {
1052 *slash = 0;
1053 rp = US realpath(CS file, CS big_buffer);
1054 next = Ustrrchr(file, '/');
1055 *slash = '/';
1056 }
1057
1058 /* If rp == NULL it means that none of the relevant directories exist.
1059 This is not a problem here - it means that no symbolic links can exist,
1060 which is all we are worried about. Otherwise, we must compare it
1061 against the start of the home directory. However, that may itself
1062 contain symbolic links, so we have to "realpath" it as well, if
1063 possible. */
1064
1065 if (rp != NULL)
1066 {
1067 uschar hdbuffer[PATH_MAX+1];
1068 uschar *rph = deliver_home;
1069 int rlen = Ustrlen(big_buffer);
1070
1071 rp = US realpath(CS deliver_home, CS hdbuffer);
1072 if (rp != NULL)
1073 {
1074 rph = hdbuffer;
1075 len = Ustrlen(rph);
1076 }
1077
1078 if (rlen > len) rlen = len;
1079 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1080 {
1081 yield = FALSE;
1082 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1083 big_buffer, deliver_home);
1084 }
1085 }
1086 }
1087 #endif /* NO_REALPATH */
1088 }
1089
1090 return yield;
1091 }
1092
1093
1094
1095 /*************************************************
1096 * Main entry point *
1097 *************************************************/
1098
1099 /* See local README for general interface details. This transport always
1100 returns FALSE, indicating that the status which has been placed in the first
1101 address should be copied to any other addresses in a batch.
1102
1103 Appendfile delivery is tricky and has led to various security problems in other
1104 mailers. The logic used here is therefore laid out in some detail. When this
1105 function is called, we are running in a subprocess which has had its gid and
1106 uid set to the appropriate values. Therefore, we cannot write directly to the
1107 exim logs. Any errors must be handled by setting appropriate return codes.
1108 Note that the default setting for addr->transport_return is DEFER, so it need
1109 not be set unless some other value is required.
1110
1111 The code below calls geteuid() rather than getuid() to get the current uid
1112 because in weird configurations not running setuid root there may be a
1113 difference. In the standard configuration, where setuid() has been used in the
1114 delivery process, there will be no difference between the uid and the euid.
1115
1116 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1117 alias expansion. Otherwise, there must be a configured file name or
1118 directory name.
1119
1120 The following items apply in the case when a file name (as opposed to a
1121 directory name) is given, that is, when appending to a single file:
1122
1123 (2f) Expand the file name.
1124
1125 (3f) If the file name is /dev/null, return success (optimization).
1126
1127 (4f) If the file_format options is set, open the file for reading, and check
1128 that the bytes at the start of the file match one of the given strings.
1129 If the check indicates a transport other than the current one should be
1130 used, pass control to that other transport. Otherwise continue. An empty
1131 or non-existent file matches the current transport. The file is closed
1132 after the check.
1133
1134 (5f) If a lock file is required, create it (see extensive separate comments
1135 below about the algorithm for doing this). It is important to do this
1136 before opening the mailbox if NFS is in use.
1137
1138 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1139 details of any symbolic link.
1140
1141 (7f) If the file already exists:
1142
1143 Check the owner and group if necessary, and defer if they are wrong.
1144
1145 If it is a symbolic link AND the allow_symlink option is set (NOT the
1146 default), go back to (6f) but this time use stat() instead of lstat().
1147
1148 If it's not a regular file (or FIFO when permitted), defer delivery.
1149
1150 Check permissions. If the required permissions are *less* than the
1151 existing ones, or supplied by the address (often by the user via filter),
1152 chmod() the file. Otherwise, defer.
1153
1154 Save the inode number.
1155
1156 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1157
1158 If open fails because the file does not exist, go to (6f); on any other
1159 failure, defer.
1160
1161 Check the inode number hasn't changed - I realize this isn't perfect (an
1162 inode can be reused) but it's cheap and will catch some of the races.
1163
1164 Check it's still a regular file (or FIFO if permitted).
1165
1166 Check that the owner and permissions haven't changed.
1167
1168 If file_format is set, check that the file still matches the format for
1169 the current transport. If not, defer delivery.
1170
1171 (8f) If file does not exist initially:
1172
1173 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1174 this is via a symbolic link (only possible if allow_symlinks is set), in
1175 which case don't use O_EXCL, as it doesn't work.
1176
1177 If open fails because the file already exists, go to (6f). To avoid
1178 looping for ever in a situation where the file is continuously being
1179 created and deleted, all of this happens inside a loop that operates
1180 lock_retries times and includes the fcntl and flock locking. If the
1181 loop completes without the file getting opened, defer and request
1182 freezing, because something really weird is happening.
1183
1184 If open fails for any other reason, defer for subsequent delivery except
1185 when this is a file delivery resulting from an alias or forward expansion
1186 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1187 most likely a user rather than a configuration error.
1188
1189 (9f) We now have the file checked and open for writing. If so configured, lock
1190 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1191 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1192 still fails, give up and defer delivery.
1193
1194 (10f)Save the access time (for subsequent restoration) and the size of the
1195 file, for comsat and for re-setting if delivery fails in the middle -
1196 e.g. for quota exceeded.
1197
1198 The following items apply in the case when a directory name is given:
1199
1200 (2d) Create a new file in the directory using a temporary name, by opening for
1201 writing and with O_CREAT. If maildir format is being used, the file
1202 is created in a temporary subdirectory with a prescribed name. If
1203 mailstore format is being used, the envelope file is first created with a
1204 temporary name, then the data file.
1205
1206 The following items apply in all cases:
1207
1208 (11) We now have the file open for writing, and locked if it was given as a
1209 file name. Write the message and flush the file, unless there is a setting
1210 of the local quota option, in which case we can check for its excession
1211 without doing any writing.
1212
1213 In the case of MBX format mailboxes, the message is first written to a
1214 temporary file, in order to get its correct length. This is then copied to
1215 the real file, preceded by an MBX header.
1216
1217 If there is a quota error on writing, defer the address. Timeout logic
1218 will determine for how long retries are attempted. We restore the mailbox
1219 to its original length if it's a single file. There doesn't seem to be a
1220 uniform error code for quota excession (it even differs between SunOS4
1221 and some versions of SunOS5) so a system-dependent macro called
1222 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1223 compile time.
1224
1225 For any other error (most commonly disk full), do the same.
1226
1227 The following applies after appending to a file:
1228
1229 (12f)Restore the atime; notify_comsat if required; close the file (which
1230 unlocks it if it was locked). Delete the lock file if it exists.
1231
1232 The following applies after writing a unique file in a directory:
1233
1234 (12d)For maildir format, rename the file into the new directory. For mailstore
1235 format, rename the envelope file to its correct name. Otherwise, generate
1236 a unique name from the directory_file option, and rename to that, possibly
1237 trying a few times if the file exists and re-expanding the name gives a
1238 different string.
1239
1240 This transport yields FAIL only when a file name is generated by an alias or
1241 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1242 All other failures return DEFER (in addr->transport_return). */
1243
1244
1245 BOOL
1246 appendfile_transport_entry(
1247 transport_instance *tblock, /* data for this instantiation */
1248 address_item *addr) /* address we are working on */
1249 {
1250 appendfile_transport_options_block *ob =
1251 (appendfile_transport_options_block *)(tblock->options_block);
1252 struct stat statbuf;
1253 uschar *fdname = NULL;
1254 uschar *filename = NULL;
1255 uschar *hitchname = NULL;
1256 uschar *dataname = NULL;
1257 uschar *lockname = NULL;
1258 uschar *newname = NULL;
1259 uschar *nametag = NULL;
1260 uschar *cr = US"";
1261 uschar *filecount_msg = US"";
1262 uschar *path;
1263 struct utimbuf times;
1264 struct timeval msg_tv;
1265 BOOL disable_quota = FALSE;
1266 BOOL isdirectory = FALSE;
1267 BOOL isfifo = FALSE;
1268 BOOL wait_for_tick = FALSE;
1269 uid_t uid = geteuid(); /* See note above */
1270 gid_t gid = getegid();
1271 int mbformat;
1272 int mode = (addr->mode > 0) ? addr->mode : ob->mode;
1273 off_t saved_size = -1;
1274 off_t mailbox_size = ob->mailbox_size_value;
1275 int mailbox_filecount = ob->mailbox_filecount_value;
1276 int hd = -1;
1277 int fd = -1;
1278 int yield = FAIL;
1279 int i;
1280
1281 #ifdef SUPPORT_MBX
1282 int save_fd = 0;
1283 int mbx_lockfd = -1;
1284 uschar mbx_lockname[40];
1285 FILE *temp_file = NULL;
1286 #endif /* SUPPORT_MBX */
1287
1288 #ifdef SUPPORT_MAILDIR
1289 int maildirsize_fd = -1; /* fd for maildirsize file */
1290 int maildir_save_errno;
1291 #endif
1292
1293
1294 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1295
1296 /* An "address_file" or "address_directory" transport is used to deliver to
1297 files specified via .forward or an alias file. Prior to release 4.20, the
1298 "file" and "directory" options were ignored in this case. This has been changed
1299 to allow the redirection data to specify what is in effect a folder, whose
1300 location is determined by the options on the transport.
1301
1302 Compatibility with the case when neither option is set is retained by forcing a
1303 value for the file or directory name. A directory delivery is assumed if the
1304 last character of the path from the router is '/'.
1305
1306 The file path is in the local part of the address, but not in the $local_part
1307 variable (that holds the parent local part). It is, however, in the
1308 $address_file variable. Below, we update the local part in the address if it
1309 changes by expansion, so that the final path ends up in the log. */
1310
1311 if (testflag(addr, af_file) &&
1312 ob->filename == NULL &&
1313 ob->dirname == NULL)
1314 {
1315 fdname = US"$address_file";
1316 if (address_file[Ustrlen(address_file)-1] == '/' ||
1317 ob->maildir_format ||
1318 ob->mailstore_format)
1319 isdirectory = TRUE;
1320 }
1321
1322 /* Handle (a) an "address file" delivery where "file" or "directory" is
1323 explicitly set and (b) a non-address_file delivery, where one of "file" or
1324 "directory" must be set; initialization ensures that they are not both set. */
1325
1326 if (fdname == NULL)
1327 {
1328 fdname = ob->filename;
1329 if (fdname == NULL)
1330 {
1331 fdname = ob->dirname;
1332 isdirectory = TRUE;
1333 }
1334 if (fdname == NULL)
1335 {
1336 addr->transport_return = PANIC;
1337 addr->message = string_sprintf("Mandatory file or directory option "
1338 "missing from %s transport", tblock->name);
1339 return FALSE;
1340 }
1341 }
1342
1343 /* Maildir and mailstore require a directory */
1344
1345 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1346 {
1347 addr->transport_return = PANIC;
1348 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1349 "to be specified for the %s transport",
1350 ob->maildir_format ? "dir" : "store", tblock->name);
1351 return FALSE;
1352 }
1353
1354 path = expand_string(fdname);
1355
1356 if (path == NULL)
1357 {
1358 addr->transport_return = PANIC;
1359 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1360 "name for %s transport) failed: %s", fdname, tblock->name,
1361 expand_string_message);
1362 return FALSE;
1363 }
1364
1365 if (path[0] != '/')
1366 {
1367 addr->message = string_sprintf("appendfile: file or directory name "
1368 "\"%s\" is not absolute", path);
1369 addr->basic_errno = ERRNO_NOTABSOLUTE;
1370 return FALSE;
1371 }
1372
1373 /* For a file delivery, make sure the local part in the address(es) is updated
1374 to the true local part. */
1375
1376 if (testflag(addr, af_file))
1377 for (address_item * addr2 = addr; addr2 != NULL; addr2 = addr2->next)
1378 addr2->local_part = string_copy(path);
1379
1380 /* The available mailbox formats depend on whether it is a directory or a file
1381 delivery. */
1382
1383 if (isdirectory)
1384 {
1385 mbformat =
1386 #ifdef SUPPORT_MAILDIR
1387 (ob->maildir_format) ? mbf_maildir :
1388 #endif
1389 #ifdef SUPPORT_MAILSTORE
1390 (ob->mailstore_format) ? mbf_mailstore :
1391 #endif
1392 mbf_smail;
1393 }
1394 else
1395 {
1396 mbformat =
1397 #ifdef SUPPORT_MBX
1398 (ob->mbx_format) ? mbf_mbx :
1399 #endif
1400 mbf_unix;
1401 }
1402
1403 DEBUG(D_transport)
1404 {
1405 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1406 "%s%s"
1407 " warning=" OFF_T_FMT "%s\n"
1408 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1409 "maildir_use_size_file=%s\n",
1410 mode, ob->notify_comsat, ob->quota_value,
1411 ob->quota_no_check ? " (no_check)" : "",
1412 ob->quota_filecount_no_check ? " (no_check_filecount)" : "",
1413 ob->quota_warn_threshold_value,
1414 ob->quota_warn_threshold_is_percent ? "%" : "",
1415 isdirectory ? "directory" : "file",
1416 path, mailbox_formats[mbformat],
1417 (ob->message_prefix == NULL) ? US"null" : string_printing(ob->message_prefix),
1418 (ob->message_suffix == NULL) ? US"null" : string_printing(ob->message_suffix),
1419 (ob->maildir_use_size_file) ? "yes" : "no");
1420
1421 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1422 ob->use_lockfile ? "lockfile " : "",
1423 ob->use_mbx_lock ? "mbx locking (" : "",
1424 ob->use_fcntl ? "fcntl " : "",
1425 ob->use_flock ? "flock" : "",
1426 ob->use_mbx_lock ? ")" : "");
1427 }
1428
1429 /* If the -N option is set, can't do any more. */
1430
1431 if (f.dont_deliver)
1432 {
1433 DEBUG(D_transport)
1434 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1435 tblock->name);
1436 addr->transport_return = OK;
1437 return FALSE;
1438 }
1439
1440 /* Handle the case of a file name. If the file name is /dev/null, we can save
1441 ourselves some effort and just give a success return right away. */
1442
1443 if (!isdirectory)
1444 {
1445 BOOL use_lstat = TRUE;
1446 BOOL file_opened = FALSE;
1447 BOOL allow_creation_here = TRUE;
1448
1449 if (Ustrcmp(path, "/dev/null") == 0)
1450 {
1451 addr->transport_return = OK;
1452 return FALSE;
1453 }
1454
1455 /* Set the name of the file to be opened, and the file to which the data
1456 is written, and find out if we are permitted to create a non-existent file. */
1457
1458 dataname = filename = path;
1459 allow_creation_here = check_creation(filename, ob->create_file);
1460
1461 /* If ob->create_directory is set, attempt to create the directories in
1462 which this mailbox lives, but only if we are permitted to create the file
1463 itself. We know we are dealing with an absolute path, because this was
1464 checked above. */
1465
1466 if (ob->create_directory && allow_creation_here)
1467 {
1468 uschar *p = Ustrrchr(path, '/');
1469 *p = '\0';
1470 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1471 {
1472 addr->basic_errno = errno;
1473 addr->message =
1474 string_sprintf("failed to create directories for %s: %s", path,
1475 strerror(errno));
1476 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1477 return FALSE;
1478 }
1479 *p = '/';
1480 }
1481
1482 /* If file_format is set we must check that any existing file matches one of
1483 the configured formats by checking the bytes it starts with. A match then
1484 indicates a specific transport - if it is not this one, pass control to it.
1485 Otherwise carry on here. An empty or non-existent file matches the current
1486 transport. We don't need to distinguish between non-existence and other open
1487 failures because if an existing file fails to open here, it will also fail
1488 again later when O_RDWR is used. */
1489
1490 if (ob->file_format != NULL)
1491 {
1492 int cfd = Uopen(path, O_RDONLY, 0);
1493 if (cfd >= 0)
1494 {
1495 transport_instance *tt = check_file_format(cfd, tblock, addr);
1496 (void)close(cfd);
1497
1498 /* If another transport is indicated, call it and return; if no transport
1499 was found, just return - the error data will have been set up.*/
1500
1501 if (tt != tblock)
1502 {
1503 if (tt != NULL)
1504 {
1505 set_process_info("delivering %s to %s using %s", message_id,
1506 addr->local_part, tt->name);
1507 debug_print_string(tt->debug_string);
1508 addr->transport = tt;
1509 (tt->info->code)(tt, addr);
1510 }
1511 return FALSE;
1512 }
1513 }
1514 }
1515
1516 /* The locking of mailbox files is worse than the naming of cats, which is
1517 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1518 three different names, so several different styles of locking are used.
1519
1520 Research in other programs that lock mailboxes shows that there is no
1521 universally standard method. Having mailboxes NFS-mounted on the system that
1522 is delivering mail is not the best thing, but people do run like this,
1523 and so the code must do its best to cope.
1524
1525 Three different locking mechanisms are supported. The initialization function
1526 checks that at least one is configured.
1527
1528 LOCK FILES
1529
1530 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1531 will work over NFS. Only after that is done do we actually open the mailbox
1532 and apply locks to it (if configured).
1533
1534 Originally, Exim got the file opened before doing anything about locking.
1535 However, a very occasional problem was observed on Solaris 2 when delivering
1536 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1537 gets remembered at open time. If another process on another host (that's
1538 important) has the file open and locked and writes to it and then releases
1539 the lock while the first process is waiting to get the lock, the first
1540 process may fail to write at the new end point of the file - despite the very
1541 definite statement about O_APPEND in the man page for write(). Experiments
1542 have reproduced this problem, but I do not know any way of forcing a host to
1543 update its attribute cache for an open NFS file. It would be nice if it did
1544 so when a lock was taken out, but this does not seem to happen. Anyway, to
1545 reduce the risk of this problem happening, we now create the lock file
1546 (if configured) *before* opening the mailbox. That will prevent two different
1547 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1548 however, but Pine at least seems to operate in the same way.
1549
1550 Lockfiles should normally be used when NFS is involved, because of the above
1551 problem.
1552
1553 The logic for creating the lock file is:
1554
1555 . The name of the lock file is <mailbox-name>.lock
1556
1557 . First, create a "hitching post" name by adding the primary host name,
1558 current time and pid to the lock file name. This should be unique.
1559
1560 . Create the hitching post file using WRONLY + CREAT + EXCL.
1561
1562 . If that fails EACCES, we assume it means that the user is unable to create
1563 files in the mail spool directory. Some installations might operate in this
1564 manner, so there is a configuration option to allow this state not to be an
1565 error - we proceed to lock using fcntl only, after the file is open.
1566
1567 . Otherwise, an error causes a deferment of the address.
1568
1569 . Hard link the hitching post to the lock file name.
1570
1571 . If the link succeeds, we have successfully created the lock file. Simply
1572 close and unlink the hitching post file.
1573
1574 . If the link does not succeed, proceed as follows:
1575
1576 o Fstat the hitching post file, and then close and unlink it.
1577
1578 o Now examine the stat data. If the number of links to the file is exactly
1579 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1580 the return never made it back, so the link() function gave a failure
1581 return.
1582
1583 . This method allows for the lock file to be created by some other process
1584 right up to the moment of the attempt to hard link it, and is also robust
1585 against NFS server crash-reboots, which would probably result in timeouts
1586 in the middle of link().
1587
1588 . System crashes may cause lock files to get left lying around, and some means
1589 of flushing them is required. The approach of writing a pid (used by smail
1590 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1591 timeout, which seems a better approach. Since any program that writes to a
1592 mailbox using a lock file should complete its task very quickly, Pine
1593 removes lock files that are older than 5 minutes. We allow the value to be
1594 configurable on the transport.
1595
1596 FCNTL LOCKING
1597
1598 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1599 mailbox once it is open. This is done by default with a non-blocking lock.
1600 Failures to lock cause retries after a sleep, but only for a certain number
1601 of tries. A blocking lock is deliberately not used so that we don't hold the
1602 mailbox open. This minimizes the possibility of the NFS problem described
1603 under LOCK FILES above, if for some reason NFS deliveries are happening
1604 without lock files. However, the use of a non-blocking lock and sleep, though
1605 the safest approach, does not give the best performance on very busy systems.
1606 A blocking lock plus timeout does better. Therefore Exim has an option to
1607 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1608 enables the use of blocking fcntl() calls.
1609
1610 FLOCK LOCKING
1611
1612 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1613 same manner as for fcntl locking above. No-blocking/timeout is also set as
1614 above in lock_flock_timeout. Not all operating systems provide or support
1615 flock(). For those that don't (as determined by the definition of LOCK_SH in
1616 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1617 is implemented (not precisely) on top of fcntl(), which means there's no
1618 point in actually using it.
1619
1620 MBX LOCKING
1621
1622 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1623 then the rules used for locking in c-client are used. Exim takes out a shared
1624 lock on the mailbox file, and an exclusive lock on the file whose name is
1625 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1626 any other MBX client from getting an exclusive lock on it and expunging it.
1627 It also stops any other MBX client from unlinking the /tmp lock when it has
1628 finished with it.
1629
1630 The exclusive lock on the /tmp file prevents any other MBX client from
1631 updating the mailbox in any way. When writing is finished, if an exclusive
1632 lock on the mailbox can be obtained, indicating there are no current sharers,
1633 the /tmp file is unlinked.
1634
1635 MBX locking can use either fcntl() or flock() locking. If neither
1636 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1637 The calls for getting these locks are by default non-blocking, as for non-mbx
1638 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1639 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1640 probably makes sense to set timeouts for any MBX deliveries. */
1641
1642
1643 /* Build a lock file if configured to do so - the existence of a lock
1644 file is subsequently checked by looking for a non-negative value of the
1645 file descriptor hd - even though the file is no longer open. */
1646
1647 if (ob->use_lockfile)
1648 {
1649 /* cf. exim_lock.c */
1650 lockname = string_sprintf("%s.lock", filename);
1651 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1652 (unsigned int)(time(NULL)), (unsigned int)getpid());
1653
1654 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1655 hitchname);
1656
1657 /* Lock file creation retry loop */
1658
1659 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1660 {
1661 int rc;
1662 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1663
1664 if (hd < 0)
1665 {
1666 addr->basic_errno = errno;
1667 addr->message =
1668 string_sprintf("creating lock file hitching post %s "
1669 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1670 (long int)getegid());
1671 return FALSE;
1672 }
1673
1674 /* Attempt to hitch the hitching post to the lock file. If link()
1675 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1676 file, and get rid of the hitching post. If the number of links was 2,
1677 the link was created, despite the failure of link(). If the hitch was
1678 not successful, try again, having unlinked the lock file if it is too
1679 old.
1680
1681 There's a version of Linux (2.0.27) which doesn't update its local cache
1682 of the inode after link() by default - which many think is a bug - but
1683 if the link succeeds, this code will be OK. It just won't work in the
1684 case when link() fails after having actually created the link. The Linux
1685 NFS person is fixing this; a temporary patch is available if anyone is
1686 sufficiently worried. */
1687
1688 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1689 (void)close(hd);
1690 Uunlink(hitchname);
1691 if (rc != 0 && statbuf.st_nlink != 2)
1692 {
1693 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1694 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1695 {
1696 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1697 Uunlink(lockname);
1698 }
1699 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1700 continue;
1701 }
1702
1703 DEBUG(D_transport) debug_printf("lock file created\n");
1704 break;
1705 }
1706
1707 /* Check for too many tries at creating the lock file */
1708
1709 if (i >= ob->lock_retries)
1710 {
1711 addr->basic_errno = ERRNO_LOCKFAILED;
1712 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1713 filename);
1714 return FALSE;
1715 }
1716 }
1717
1718
1719 /* We now have to get the file open. First, stat() it and act on existence or
1720 non-existence. This is in a loop to handle the case of a file's being created
1721 or deleted as we watch, and also to handle retries when the locking fails.
1722 Rather than holding the file open while waiting for the fcntl() and/or
1723 flock() lock, we close and do the whole thing again. This should be safer,
1724 especially for NFS files, which might get altered from other hosts, making
1725 their cached sizes incorrect.
1726
1727 With the default settings, no symlinks are permitted, but there is an option
1728 to permit symlinks for those sysadmins that know what they are doing.
1729 Shudder. However, insist that the initial symlink is owned by the right user.
1730 Thus lstat() is used initially; if a symlink is discovered, the loop is
1731 repeated such that stat() is used, to look at the end file. */
1732
1733 for (i = 0; i < ob->lock_retries; i++)
1734 {
1735 int sleep_before_retry = TRUE;
1736 file_opened = FALSE;
1737
1738 if((use_lstat ? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1739 {
1740 /* Let's hope that failure to stat (other than non-existence) is a
1741 rare event. */
1742
1743 if (errno != ENOENT)
1744 {
1745 addr->basic_errno = errno;
1746 addr->message = string_sprintf("attempting to stat mailbox %s",
1747 filename);
1748 goto RETURN;
1749 }
1750
1751 /* File does not exist. If it is required to pre-exist this state is an
1752 error. */
1753
1754 if (ob->file_must_exist)
1755 {
1756 addr->basic_errno = errno;
1757 addr->message = string_sprintf("mailbox %s does not exist, "
1758 "but file_must_exist is set", filename);
1759 goto RETURN;
1760 }
1761
1762 /* If not permitted to create this file because it isn't in or below
1763 the home directory, generate an error. */
1764
1765 if (!allow_creation_here)
1766 {
1767 addr->basic_errno = ERRNO_BADCREATE;
1768 addr->message = string_sprintf("mailbox %s does not exist, "
1769 "but creation outside the home directory is not permitted",
1770 filename);
1771 goto RETURN;
1772 }
1773
1774 /* Attempt to create and open the file. If open fails because of
1775 pre-existence, go round the loop again. For any other error, defer the
1776 address, except for an alias or forward generated file name with EPERM,
1777 ENOENT, or EACCES, as those are most likely to be user errors rather
1778 than Exim config errors. When a symbolic link is permitted and points
1779 to a non-existent file, we get here with use_lstat = FALSE. In this case
1780 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1781 consistency and because MBX locking requires it in order to be able to
1782 get a shared lock. */
1783
1784 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1785 (use_lstat ? O_EXCL : 0), mode);
1786 if (fd < 0)
1787 {
1788 if (errno == EEXIST) continue;
1789 addr->basic_errno = errno;
1790 addr->message = string_sprintf("while creating mailbox %s",
1791 filename);
1792 if (testflag(addr, af_file) &&
1793 (errno == EPERM || errno == ENOENT || errno == EACCES))
1794 addr->transport_return = FAIL;
1795 goto RETURN;
1796 }
1797
1798 /* We have successfully created and opened the file. Ensure that the group
1799 and the mode are correct. */
1800
1801 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
1802 {
1803 addr->basic_errno = errno;
1804 addr->message = string_sprintf("while setting perms on mailbox %s",
1805 filename);
1806 addr->transport_return = FAIL;
1807 goto RETURN;
1808 }
1809 }
1810
1811
1812 /* The file already exists. Test its type, ownership, and permissions, and
1813 save the inode for checking later. If symlinks are permitted (not the
1814 default or recommended state) it may be a symlink that already exists.
1815 Check its ownership and then look for the file at the end of the link(s).
1816 This at least prevents one user creating a symlink for another user in
1817 a sticky directory. */
1818
1819 else
1820 {
1821 int oldmode = (int)statbuf.st_mode;
1822 ino_t inode = statbuf.st_ino;
1823 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1824
1825 isfifo = FALSE; /* In case things are changing */
1826
1827 /* Check owner if required - the default. */
1828
1829 if (ob->check_owner && statbuf.st_uid != uid)
1830 {
1831 addr->basic_errno = ERRNO_BADUGID;
1832 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1833 "(%ld != %ld)", filename,
1834 islink ? " (symlink)" : "",
1835 (long int)(statbuf.st_uid), (long int)uid);
1836 goto RETURN;
1837 }
1838
1839 /* Group is checked only if check_group is set. */
1840
1841 if (ob->check_group && statbuf.st_gid != gid)
1842 {
1843 addr->basic_errno = ERRNO_BADUGID;
1844 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1845 filename, islink ? " (symlink)" : "", statbuf.st_gid, gid);
1846 goto RETURN;
1847 }
1848
1849 /* Just in case this is a sticky-bit mail directory, we don't want
1850 users to be able to create hard links to other users' files. */
1851
1852 if (statbuf.st_nlink != 1)
1853 {
1854 addr->basic_errno = ERRNO_NOTREGULAR;
1855 addr->message = string_sprintf("mailbox %s%s has too many links (%d)",
1856 filename, islink ? " (symlink)" : "", statbuf.st_nlink);
1857 goto RETURN;
1858
1859 }
1860
1861 /* If symlinks are permitted (not recommended), the lstat() above will
1862 have found the symlink. Its ownership has just been checked; go round
1863 the loop again, using stat() instead of lstat(). That will never yield a
1864 mode of S_IFLNK. */
1865
1866 if (islink && ob->allow_symlink)
1867 {
1868 use_lstat = FALSE;
1869 i--; /* Don't count this time round */
1870 continue;
1871 }
1872
1873 /* An actual file exists. Check that it is a regular file, or FIFO
1874 if permitted. */
1875
1876 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1877
1878 else if ((oldmode & S_IFMT) != S_IFREG)
1879 {
1880 addr->basic_errno = ERRNO_NOTREGULAR;
1881 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1882 filename, ob->allow_fifo ? " or named pipe" : "");
1883 goto RETURN;
1884 }
1885
1886 /* If the mode is not what it would be for a newly created file, change
1887 the permissions if the mode is supplied for the address. Otherwise,
1888 reduce but do not extend the permissions. If the newly created
1889 permissions are greater than the existing permissions, don't change
1890 things when the mode is not from the address. */
1891
1892 if ((oldmode = (oldmode & 07777)) != mode)
1893 {
1894 int diffs = oldmode ^ mode;
1895 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1896 {
1897 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1898 if (Uchmod(filename, mode) < 0)
1899 {
1900 addr->basic_errno = errno;
1901 addr->message = string_sprintf("attempting to chmod mailbox %s",
1902 filename);
1903 goto RETURN;
1904 }
1905 oldmode = mode;
1906 }
1907
1908 /* Mode not from address, and newly-created permissions are greater
1909 than existing permissions. Default is to complain, but it can be
1910 configured to go ahead and try to deliver anyway if that's what
1911 the administration wants. */
1912
1913 else if (ob->mode_fail_narrower)
1914 {
1915 addr->basic_errno = ERRNO_BADMODE;
1916 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1917 "(%o expected)", filename, oldmode, mode);
1918 goto RETURN;
1919 }
1920 }
1921
1922 /* We are happy with the existing file. Open it, and then do further
1923 tests to ensure that it is the same file that we were just looking at.
1924 If the file does not now exist, restart this loop, going back to using
1925 lstat again. For an NFS error, just defer; other opening errors are
1926 more serious. The file is opened RDWR so that its format can be checked,
1927 and also MBX locking requires the use of a shared (read) lock. However,
1928 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1929 reading the pipe. */
1930
1931 fd = Uopen(filename, isfifo ? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1932 mode);
1933 if (fd < 0)
1934 {
1935 if (errno == ENOENT)
1936 {
1937 use_lstat = TRUE;
1938 continue;
1939 }
1940 addr->basic_errno = errno;
1941 if (isfifo)
1942 {
1943 addr->message = string_sprintf("while opening named pipe %s "
1944 "(could mean no process is reading it)", filename);
1945 }
1946 else if (errno != EWOULDBLOCK)
1947 {
1948 addr->message = string_sprintf("while opening mailbox %s", filename);
1949 }
1950 goto RETURN;
1951 }
1952
1953 /* This fstat really shouldn't fail, as we have an open file! There's a
1954 dilemma here. We use fstat in order to be sure we are peering at the file
1955 we have got open. However, that won't tell us if the file was reached
1956 via a symbolic link. We checked this above, but there is a race exposure
1957 if the link was created between the previous lstat and the open. However,
1958 it would have to be created with the same inode in order to pass the
1959 check below. If ob->allow_symlink is set, causing the use of stat rather
1960 than lstat above, symbolic links may be there anyway, and the checking is
1961 weaker. */
1962
1963 if (fstat(fd, &statbuf) < 0)
1964 {
1965 addr->basic_errno = errno;
1966 addr->message = string_sprintf("attempting to stat open mailbox %s",
1967 filename);
1968 goto RETURN;
1969 }
1970
1971 /* Check the inode; this is isn't a perfect check, but gives some
1972 confidence. */
1973
1974 if (inode != statbuf.st_ino)
1975 {
1976 addr->basic_errno = ERRNO_INODECHANGED;
1977 addr->message = string_sprintf("opened mailbox %s inode number changed "
1978 "from " INO_T_FMT " to " INO_T_FMT, filename, inode, statbuf.st_ino);
1979 addr->special_action = SPECIAL_FREEZE;
1980 goto RETURN;
1981 }
1982
1983 /* Check it's still a regular file or FIFO, and the uid, gid, and
1984 permissions have not changed. */
1985
1986 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1987 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1988 {
1989 addr->basic_errno = ERRNO_NOTREGULAR;
1990 addr->message =
1991 string_sprintf("opened mailbox %s is no longer a %s", filename,
1992 isfifo ? "named pipe" : "regular file");
1993 addr->special_action = SPECIAL_FREEZE;
1994 goto RETURN;
1995 }
1996
1997 if ((ob->check_owner && statbuf.st_uid != uid) ||
1998 (ob->check_group && statbuf.st_gid != gid))
1999 {
2000 addr->basic_errno = ERRNO_BADUGID;
2001 addr->message =
2002 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
2003 addr->special_action = SPECIAL_FREEZE;
2004 goto RETURN;
2005 }
2006
2007 if ((statbuf.st_mode & 07777) != oldmode)
2008 {
2009 addr->basic_errno = ERRNO_BADMODE;
2010 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
2011 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
2012 addr->special_action = SPECIAL_FREEZE;
2013 goto RETURN;
2014 }
2015
2016 /* If file_format is set, check that the format of the file has not
2017 changed. Error data is set by the testing function. */
2018
2019 if (ob->file_format != NULL &&
2020 check_file_format(fd, tblock, addr) != tblock)
2021 {
2022 addr->message = US"open mailbox has changed format";
2023 goto RETURN;
2024 }
2025
2026 /* The file is OK. Carry on to do the locking. */
2027 }
2028
2029 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
2030 locking rules if configured to do so. If a lock file is also required, it
2031 was created above and hd was left >= 0. At least one form of locking is
2032 required by the initialization function. If locking fails here, close the
2033 file and go round the loop all over again, after waiting for a bit, unless
2034 blocking locking was used. */
2035
2036 file_opened = TRUE;
2037 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
2038 sleep_before_retry = FALSE;
2039
2040 /* Simple fcntl() and/or flock() locking */
2041
2042 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
2043 {
2044 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2045 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
2046 }
2047
2048 /* MBX locking rules */
2049
2050 #ifdef SUPPORT_MBX
2051 else if (ob->use_mbx_lock)
2052 {
2053 int mbx_tmp_oflags;
2054 struct stat lstatbuf, statbuf2;
2055 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2056 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
2057 fstat(fd, &statbuf) >= 0)
2058 {
2059 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
2060 (long)statbuf.st_ino);
2061
2062 /*
2063 * 2010-05-29: SECURITY
2064 * Dan Rosenberg reported the presence of a race-condition in the
2065 * original code here. Beware that many systems still allow symlinks
2066 * to be followed in /tmp so an attacker can create a symlink pointing
2067 * elsewhere between a stat and an open, which we should avoid
2068 * following.
2069 *
2070 * It's unfortunate that we can't just use all the heavily debugged
2071 * locking from above.
2072 *
2073 * Also: remember to mirror changes into exim_lock.c */
2074
2075 /* first leave the old pre-check in place, it provides better
2076 * diagnostics for common cases */
2077 if (Ulstat(mbx_lockname, &statbuf) >= 0)
2078 {
2079 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
2080 {
2081 addr->basic_errno = ERRNO_LOCKFAILED;
2082 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2083 mbx_lockname);
2084 goto RETURN;
2085 }
2086 if (statbuf.st_nlink > 1)
2087 {
2088 addr->basic_errno = ERRNO_LOCKFAILED;
2089 addr->message = string_sprintf("hard link to MBX lock file %s",
2090 mbx_lockname);
2091 goto RETURN;
2092 }
2093 }
2094
2095 /* If we could just declare "we must be the ones who create this
2096 * file" then a hitching post in a subdir would work, since a
2097 * subdir directly in /tmp/ which we create wouldn't follow links
2098 * but this isn't our locking logic, so we can't safely change the
2099 * file existence rules. */
2100
2101 /* On systems which support O_NOFOLLOW, it's the easiest and most
2102 * obviously correct security fix */
2103 mbx_tmp_oflags = O_RDWR | O_CREAT;
2104 #ifdef O_NOFOLLOW
2105 mbx_tmp_oflags |= O_NOFOLLOW;
2106 #endif
2107 mbx_lockfd = Uopen(mbx_lockname, mbx_tmp_oflags, ob->lockfile_mode);
2108 if (mbx_lockfd < 0)
2109 {
2110 addr->basic_errno = ERRNO_LOCKFAILED;
2111 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2112 mbx_lockname, strerror(errno));
2113 goto RETURN;
2114 }
2115
2116 if (Ulstat(mbx_lockname, &lstatbuf) < 0)
2117 {
2118 addr->basic_errno = ERRNO_LOCKFAILED;
2119 addr->message = string_sprintf("attempting to lstat open MBX "
2120 "lock file %s: %s", mbx_lockname, strerror(errno));
2121 goto RETURN;
2122 }
2123 if (fstat(mbx_lockfd, &statbuf2) < 0)
2124 {
2125 addr->basic_errno = ERRNO_LOCKFAILED;
2126 addr->message = string_sprintf("attempting to stat fd of open MBX "
2127 "lock file %s: %s", mbx_lockname, strerror(errno));
2128 goto RETURN;
2129 }
2130
2131 /*
2132 * At this point:
2133 * statbuf: if exists, is file which existed prior to opening the
2134 * lockfile, might have been replaced since then
2135 * statbuf2: result of stat'ing the open fd, is what was actually
2136 * opened
2137 * lstatbuf: result of lstat'ing the filename immediately after
2138 * the open but there's a race condition again between
2139 * those two steps: before open, symlink to foo, after
2140 * open but before lstat have one of:
2141 * * was no symlink, so is the opened file
2142 * (we created it, no messing possible after that point)
2143 * * hardlink to foo
2144 * * symlink elsewhere
2145 * * hardlink elsewhere
2146 * * new file/other
2147 * Don't want to compare to device of /tmp because some modern systems
2148 * have regressed to having /tmp be the safe actual filesystem as
2149 * valuable data, so is mostly worthless, unless we assume that *only*
2150 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2151 * for further consideration.
2152 * No point in doing a readlink on the lockfile as that will always be
2153 * at a different point in time from when we open it, so tells us
2154 * nothing; attempts to clean up and delete after ourselves would risk
2155 * deleting a *third* filename.
2156 */
2157 if ((statbuf2.st_nlink > 1) ||
2158 (lstatbuf.st_nlink > 1) ||
2159 (!S_ISREG(lstatbuf.st_mode)) ||
2160 (lstatbuf.st_dev != statbuf2.st_dev) ||
2161 (lstatbuf.st_ino != statbuf2.st_ino))
2162 {
2163 addr->basic_errno = ERRNO_LOCKFAILED;
2164 addr->message = string_sprintf("RACE CONDITION detected: "
2165 "mismatch post-initial-checks between \"%s\" and opened "
2166 "fd lead us to abort!", mbx_lockname);
2167 goto RETURN;
2168 }
2169
2170 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2171
2172 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2173 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2174 {
2175 struct stat ostatbuf;
2176
2177 /* This tests for a specific race condition. Ensure that we still
2178 have the same file. */
2179
2180 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2181 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2182 statbuf.st_dev == ostatbuf.st_dev &&
2183 statbuf.st_ino == ostatbuf.st_ino)
2184 break;
2185 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2186 "between creation and locking\n", mbx_lockname);
2187 }
2188
2189 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2190 strerror(errno));
2191 (void)close(mbx_lockfd);
2192 mbx_lockfd = -1;
2193 }
2194 else
2195 {
2196 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2197 filename, strerror(errno));
2198 }
2199 }
2200 #endif /* SUPPORT_MBX */
2201
2202 else break; /* No on-file locking required; break the open/lock loop */
2203
2204 DEBUG(D_transport)
2205 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2206
2207 (void)close(fd);
2208 fd = -1;
2209 use_lstat = TRUE; /* Reset to use lstat first */
2210
2211
2212 /* If a blocking call timed out, break the retry loop if the total time
2213 so far is not less than than retries * interval. Use the larger of the
2214 flock() and fcntl() timeouts. */
2215
2216 if (sigalrm_seen &&
2217 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2218 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2219 ob->lock_retries * ob->lock_interval)
2220 i = ob->lock_retries;
2221
2222 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2223 flock() that caused the problem. */
2224
2225 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2226 }
2227
2228 /* Test for exceeding the maximum number of tries. Either the file remains
2229 locked, or, if we haven't got it open, something is terribly wrong... */
2230
2231 if (i >= ob->lock_retries)
2232 {
2233 if (!file_opened)
2234 {
2235 addr->basic_errno = ERRNO_EXISTRACE;
2236 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2237 addr->special_action = SPECIAL_FREEZE;
2238 }
2239 else
2240 {
2241 addr->basic_errno = ERRNO_LOCKFAILED;
2242 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2243 filename);
2244 }
2245 goto RETURN;
2246 }
2247
2248 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2249
2250 /* Save access time (for subsequent restoration), modification time (for
2251 restoration if updating fails), size of file (for comsat and for re-setting if
2252 delivery fails in the middle - e.g. for quota exceeded). */
2253
2254 if (fstat(fd, &statbuf) < 0)
2255 {
2256 addr->basic_errno = errno;
2257 addr->message = string_sprintf("while fstatting opened mailbox %s",
2258 filename);
2259 goto RETURN;
2260 }
2261
2262 times.actime = statbuf.st_atime;
2263 times.modtime = statbuf.st_mtime;
2264 saved_size = statbuf.st_size;
2265 if (mailbox_size < 0) mailbox_size = saved_size;
2266 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2267 }
2268
2269 /* Prepare for writing to a new file (as opposed to appending to an old one).
2270 There are several different formats, but there is preliminary stuff concerned
2271 with quotas that applies to all of them. Finding the current size by directory
2272 scanning is expensive; for maildirs some fudges have been invented:
2273
2274 (1) A regex can be used to extract a file size from its name;
2275 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2276 mailbox size.
2277 */
2278
2279 else
2280 {
2281 uschar *check_path = path; /* Default quota check path */
2282 const pcre *regex = NULL; /* Regex for file size from file name */
2283
2284 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2285 {
2286 addr->basic_errno = ERRNO_BADCREATE;
2287 addr->message = string_sprintf("tried to create file in %s, but "
2288 "file creation outside the home directory is not permitted", path);
2289 goto RETURN;
2290 }
2291
2292 #ifdef SUPPORT_MAILDIR
2293 /* For a maildir delivery, ensure that all the relevant directories exist,
2294 and a maildirfolder file if necessary. */
2295
2296 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2297 ob->create_directory, ob->dirmode, ob->maildirfolder_create_regex))
2298 return FALSE;
2299 #endif /* SUPPORT_MAILDIR */
2300
2301 /* If we are going to do a quota check, of if maildir_use_size_file is set
2302 for a maildir delivery, compile the regular expression if there is one. We
2303 may also need to adjust the path that is used. We need to do this for
2304 maildir_use_size_file even if the quota is unset, because we still want to
2305 create the file. When maildir support is not compiled,
2306 ob->maildir_use_size_file is always FALSE. */
2307
2308 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2309 {
2310 const uschar *error;
2311 int offset;
2312
2313 /* Compile the regex if there is one. */
2314
2315 if (ob->quota_size_regex != NULL)
2316 {
2317 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2318 (const char **)&error, &offset, NULL);
2319 if (regex == NULL)
2320 {
2321 addr->message = string_sprintf("appendfile: regular expression "
2322 "error: %s at offset %d while compiling %s", error, offset,
2323 ob->quota_size_regex);
2324 return FALSE;
2325 }
2326 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2327 ob->quota_size_regex);
2328 }
2329
2330 /* Use an explicitly configured directory if set */
2331
2332 if (ob->quota_directory != NULL)
2333 {
2334 check_path = expand_string(ob->quota_directory);
2335 if (check_path == NULL)
2336 {
2337 addr->transport_return = PANIC;
2338 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2339 "name for %s transport) failed: %s", ob->quota_directory,
2340 tblock->name, expand_string_message);
2341 return FALSE;
2342 }
2343
2344 if (check_path[0] != '/')
2345 {
2346 addr->message = string_sprintf("appendfile: quota_directory name "
2347 "\"%s\" is not absolute", check_path);
2348 addr->basic_errno = ERRNO_NOTABSOLUTE;
2349 return FALSE;
2350 }
2351 }
2352
2353 #ifdef SUPPORT_MAILDIR
2354 /* Otherwise, if we are handling a maildir delivery, and the directory
2355 contains a file called maildirfolder, this is a maildir++ feature telling
2356 us that this is a sub-directory of the real inbox. We should therefore do
2357 the quota check on the parent directory. Beware of the special case when
2358 the directory name itself ends in a slash. */
2359
2360 else if (mbformat == mbf_maildir)
2361 {
2362 struct stat statbuf;
2363 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2364 {
2365 uschar *new_check_path = string_copy(check_path);
2366 uschar *slash = Ustrrchr(new_check_path, '/');
2367 if (slash != NULL)
2368 {
2369 if (slash[1] == 0)
2370 {
2371 *slash = 0;
2372 slash = Ustrrchr(new_check_path, '/');
2373 }
2374 if (slash != NULL)
2375 {
2376 *slash = 0;
2377 check_path = new_check_path;
2378 DEBUG(D_transport) debug_printf("maildirfolder file exists: "
2379 "quota check directory changed to %s\n", check_path);
2380 }
2381 }
2382 }
2383 }
2384 #endif /* SUPPORT_MAILDIR */
2385 }
2386
2387 /* If we are using maildirsize files, we need to ensure that such a file
2388 exists and, if necessary, recalculate its contents. As a byproduct of this,
2389 we obtain the current size of the maildir. If no quota is to be enforced
2390 (ob->quota_value == 0), we still need the size if a threshold check will
2391 happen later.
2392
2393 Another regular expression is used to determine which directories inside the
2394 maildir are going to be counted. */
2395
2396 #ifdef SUPPORT_MAILDIR
2397 if (ob->maildir_use_size_file)
2398 {
2399 const pcre *dir_regex = NULL;
2400 const uschar *error;
2401 int offset;
2402
2403 if (ob->maildir_dir_regex != NULL)
2404 {
2405 int check_path_len = Ustrlen(check_path);
2406
2407 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2408 (const char **)&error, &offset, NULL);
2409 if (dir_regex == NULL)
2410 {
2411 addr->message = string_sprintf("appendfile: regular expression "
2412 "error: %s at offset %d while compiling %s", error, offset,
2413 ob->maildir_dir_regex);
2414 return FALSE;
2415 }
2416
2417 DEBUG(D_transport)
2418 debug_printf("using regex for maildir directory selection: %s\n",
2419 ob->maildir_dir_regex);
2420
2421 /* Check to see if we are delivering into an ignored directory, that is,
2422 if the delivery path starts with the quota check path, and the rest
2423 of the deliver path matches the regex; if so, set a flag to disable quota
2424 checking and maildirsize updating. */
2425
2426 if (Ustrncmp(path, check_path, check_path_len) == 0)
2427 {
2428 uschar *s = path + check_path_len;
2429 while (*s == '/') s++;
2430 s = (*s == 0) ? US "new" : string_sprintf("%s/new", s);
2431 if (pcre_exec(dir_regex, NULL, CS s, Ustrlen(s), 0, 0, NULL, 0) < 0)
2432 {
2433 disable_quota = TRUE;
2434 DEBUG(D_transport) debug_printf("delivery directory does not match "
2435 "maildir_quota_directory_regex: disabling quota\n");
2436 }
2437 }
2438 }
2439
2440 /* Quota enforcement; create and check the file. There is some discussion
2441 about whether this should happen if the quota is unset. At present, Exim
2442 always creates the file. If we ever want to change this, uncomment
2443 appropriate lines below, possibly doing a check on some option. */
2444
2445 /* if (???? || ob->quota_value > 0) */
2446
2447 if (!disable_quota)
2448 {
2449 off_t size;
2450 int filecount;
2451
2452 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2453 &size, &filecount);
2454
2455 if (maildirsize_fd == -1)
2456 {
2457 addr->basic_errno = errno;
2458 addr->message = string_sprintf("while opening or reading "
2459 "%s/maildirsize", check_path);
2460 return FALSE;
2461 }
2462 /* can also return -2, which means that the file was removed because of
2463 raciness; but in this case, the size & filecount will still have been
2464 updated. */
2465
2466 if (mailbox_size < 0) mailbox_size = size;
2467 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2468 }
2469
2470 /* No quota enforcement; ensure file does *not* exist; calculate size if
2471 needed. */
2472
2473 /* else
2474 * {
2475 * time_t old_latest;
2476 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2477 * if (THRESHOLD_CHECK)
2478 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2479 * regex, dir_regex, FALSE);
2480 * }
2481 */
2482
2483 }
2484 #endif /* SUPPORT_MAILDIR */
2485
2486 /* Otherwise if we are going to do a quota check later on, and the mailbox
2487 size is not set, find the current size of the mailbox. Ditto for the file
2488 count. Note that ob->quota_filecount_value cannot be set without
2489 ob->quota_value being set. */
2490
2491 if (!disable_quota &&
2492 (ob->quota_value > 0 || THRESHOLD_CHECK) &&
2493 (mailbox_size < 0 ||
2494 (mailbox_filecount < 0 && ob->quota_filecount_value > 0)))
2495 {
2496 off_t size;
2497 int filecount = 0;
2498 DEBUG(D_transport)
2499 debug_printf("quota checks on directory %s\n", check_path);
2500 size = check_dir_size(check_path, &filecount, regex);
2501 if (mailbox_size < 0) mailbox_size = size;
2502 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2503 }
2504
2505 /* Handle the case of creating a unique file in a given directory (not in
2506 maildir or mailstore format - this is how smail did it). A temporary name is
2507 used to create the file. Later, when it is written, the name is changed to a
2508 unique one. There is no need to lock the file. An attempt is made to create
2509 the directory if it does not exist. */
2510
2511 if (mbformat == mbf_smail)
2512 {
2513 DEBUG(D_transport)
2514 debug_printf("delivering to new file in %s\n", path);
2515 filename = dataname =
2516 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2517 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2518 if (fd < 0 && /* failed to open, and */
2519 (errno != ENOENT || /* either not non-exist */
2520 !ob->create_directory || /* or not allowed to make */
2521 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2522 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2523 {
2524 addr->basic_errno = errno;
2525 addr->message = string_sprintf("while creating file %s", filename);
2526 return FALSE;
2527 }
2528 }
2529
2530 #ifdef SUPPORT_MAILDIR
2531
2532 /* Handle the case of a unique file in maildir format. The file is written to
2533 the tmp subdirectory, with a prescribed form of name. */
2534
2535 else if (mbformat == mbf_maildir)
2536 {
2537 DEBUG(D_transport)
2538 debug_printf("delivering in maildir format in %s\n", path);
2539
2540 nametag = ob->maildir_tag;
2541
2542 /* Check that nametag expands successfully; a hard failure causes a panic
2543 return. The actual expansion for use happens again later, when
2544 $message_size is accurately known. */
2545
2546 if (nametag != NULL && expand_string(nametag) == NULL &&
2547 !f.expand_string_forcedfail)
2548 {
2549 addr->transport_return = PANIC;
2550 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2551 "for %s transport) failed: %s", nametag, tblock->name,
2552 expand_string_message);
2553 return FALSE;
2554 }
2555
2556 /* We ensured the existence of all the relevant directories above. Attempt
2557 to open the temporary file a limited number of times. I think this rather
2558 scary-looking for statement is actually OK. If open succeeds, the loop is
2559 broken; if not, there is a test on the value of i. Get the time again
2560 afresh each time round the loop. Its value goes into a variable that is
2561 checked at the end, to make sure we don't release this process until the
2562 clock has ticked. */
2563
2564 for (int i = 1;; i++)
2565 {
2566 uschar *basename;
2567
2568 (void)gettimeofday(&msg_tv, NULL);
2569 basename = string_sprintf(TIME_T_FMT ".H%luP" PID_T_FMT ".%s",
2570 msg_tv.tv_sec, msg_tv.tv_usec, getpid(), primary_hostname);
2571
2572 filename = dataname = string_sprintf("tmp/%s", basename);
2573 newname = string_sprintf("new/%s", basename);
2574
2575 if (Ustat(filename, &statbuf) == 0)
2576 errno = EEXIST;
2577 else if (errno == ENOENT)
2578 {
2579 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2580 if (fd >= 0) break;
2581 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2582 filename, strerror(errno));
2583 }
2584
2585 /* Too many retries - give up */
2586
2587 if (i >= ob->maildir_retries)
2588 {
2589 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2590 filename, i, (i == 1) ? "y" : "ies");
2591 addr->basic_errno = errno;
2592 if (errno == errno_quota || errno == ENOSPC)
2593 addr->user_message = US"mailbox is full";
2594 return FALSE;
2595 }
2596
2597 /* Open or stat failed but we haven't tried too many times yet. */
2598
2599 sleep(2);
2600 }
2601
2602 /* Note that we have to ensure the clock has ticked before leaving */
2603
2604 wait_for_tick = TRUE;
2605
2606 /* Why are these here? Put in because they are present in the non-maildir
2607 directory case above. */
2608
2609 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2610 {
2611 addr->basic_errno = errno;
2612 addr->message = string_sprintf("while setting perms on maildir %s",
2613 filename);
2614 return FALSE;
2615 }
2616 }
2617
2618 #endif /* SUPPORT_MAILDIR */
2619
2620 #ifdef SUPPORT_MAILSTORE
2621
2622 /* Handle the case of a unique file in mailstore format. First write the
2623 envelope to a temporary file, then open the main file. The unique base name
2624 for the files consists of the message id plus the pid of this delivery
2625 process. */
2626
2627 else
2628 {
2629 FILE *env_file;
2630 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2631 string_base62((long int)getpid()));
2632
2633 DEBUG(D_transport)
2634 debug_printf("delivering in mailstore format in %s\n", path);
2635
2636 filename = string_sprintf("%s.tmp", mailstore_basename);
2637 newname = string_sprintf("%s.env", mailstore_basename);
2638 dataname = string_sprintf("%s.msg", mailstore_basename);
2639
2640 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2641 if (fd < 0 && /* failed to open, and */
2642 (errno != ENOENT || /* either not non-exist */
2643 !ob->create_directory || /* or not allowed to make */
2644 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2645 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2646 {
2647 addr->basic_errno = errno;
2648 addr->message = string_sprintf("while creating file %s", filename);
2649 return FALSE;
2650 }
2651
2652 /* Why are these here? Put in because they are present in the non-maildir
2653 directory case above. */
2654
2655 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2656 {
2657 addr->basic_errno = errno;
2658 addr->message = string_sprintf("while setting perms on file %s",
2659 filename);
2660 return FALSE;
2661 }
2662
2663 /* Built a C stream from the open file descriptor. */
2664
2665 if ((env_file = fdopen(fd, "wb")) == NULL)
2666 {
2667 addr->basic_errno = errno;
2668 addr->transport_return = PANIC;
2669 addr->message = string_sprintf("fdopen of %s ("
2670 "for %s transport) failed", filename, tblock->name);
2671 (void)close(fd);
2672 Uunlink(filename);
2673 return FALSE;
2674 }
2675
2676 /* Write the envelope file, then close it. */
2677
2678 if (ob->mailstore_prefix != NULL)
2679 {
2680 uschar *s = expand_string(ob->mailstore_prefix);
2681 if (s == NULL)
2682 {
2683 if (!f.expand_string_forcedfail)
2684 {
2685 addr->transport_return = PANIC;
2686 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2687 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2688 tblock->name, expand_string_message);
2689 (void)fclose(env_file);
2690 Uunlink(filename);
2691 return FALSE;
2692 }
2693 }
2694 else
2695 {
2696 int n = Ustrlen(s);
2697 fprintf(env_file, "%s", CS s);
2698 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2699 }
2700 }
2701
2702 fprintf(env_file, "%s\n", sender_address);
2703
2704 for (address_item * taddr = addr; taddr; taddr = taddr->next)
2705 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2706
2707 if (ob->mailstore_suffix != NULL)
2708 {
2709 uschar *s = expand_string(ob->mailstore_suffix);
2710 if (s == NULL)
2711 {
2712 if (!f.expand_string_forcedfail)
2713 {
2714 addr->transport_return = PANIC;
2715 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2716 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2717 tblock->name, expand_string_message);
2718 (void)fclose(env_file);
2719 Uunlink(filename);
2720 return FALSE;
2721 }
2722 }
2723 else
2724 {
2725 int n = Ustrlen(s);
2726 fprintf(env_file, "%s", CS s);
2727 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2728 }
2729 }
2730
2731 if (fclose(env_file) != 0)
2732 {
2733 addr->basic_errno = errno;
2734 addr->message = string_sprintf("while closing %s", filename);
2735 Uunlink(filename);
2736 return FALSE;
2737 }
2738
2739 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2740
2741 /* Now open the data file, and ensure that it has the correct ownership and
2742 mode. */
2743
2744 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2745 if (fd < 0)
2746 {
2747 addr->basic_errno = errno;
2748 addr->message = string_sprintf("while creating file %s", dataname);
2749 Uunlink(filename);
2750 return FALSE;
2751 }
2752 if(Uchown(dataname, uid, gid) || Uchmod(dataname, mode))
2753 {
2754 addr->basic_errno = errno;
2755 addr->message = string_sprintf("while setting perms on file %s",
2756 dataname);
2757 return FALSE;
2758 }
2759 }
2760
2761 #endif /* SUPPORT_MAILSTORE */
2762
2763
2764 /* In all cases of writing to a new file, ensure that the file which is
2765 going to be renamed has the correct ownership and mode. */
2766
2767 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2768 {
2769 addr->basic_errno = errno;
2770 addr->message = string_sprintf("while setting perms on file %s",
2771 filename);
2772 return FALSE;
2773 }
2774 }
2775
2776
2777 /* At last we can write the message to the file, preceded by any configured
2778 prefix line, and followed by any configured suffix line. If there are any
2779 writing errors, we must defer. */
2780
2781 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2782
2783 yield = OK;
2784 errno = 0;
2785
2786 /* If there is a local quota setting, check that we are not going to exceed it
2787 with this message if quota_is_inclusive is set; if it is not set, the check
2788 is for the mailbox already being over quota (i.e. the current message is not
2789 included in the check). */
2790
2791 if (!disable_quota && ob->quota_value > 0)
2792 {
2793 DEBUG(D_transport)
2794 {
2795 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2796 " this message = %d (%sincluded)\n",
2797 ob->quota_value, mailbox_size, message_size,
2798 ob->quota_is_inclusive ? "" : "not ");
2799 debug_printf(" file count quota = %d count = %d\n",
2800 ob->quota_filecount_value, mailbox_filecount);
2801 }
2802
2803 if (mailbox_size + (ob->quota_is_inclusive ? message_size:0) > ob->quota_value)
2804 {
2805
2806 if (!ob->quota_no_check)
2807 {
2808 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2809 yield = DEFER;
2810 errno = ERRNO_EXIMQUOTA;
2811 }
2812 else DEBUG(D_transport) debug_printf("mailbox quota exceeded but ignored\n");
2813
2814 }
2815
2816 if (ob->quota_filecount_value > 0
2817 && mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2818 ob->quota_filecount_value)
2819 if(!ob->quota_filecount_no_check)
2820 {
2821 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2822 yield = DEFER;
2823 errno = ERRNO_EXIMQUOTA;
2824 filecount_msg = US" filecount";
2825 }
2826 else DEBUG(D_transport) if (ob->quota_filecount_no_check)
2827 debug_printf("mailbox file count quota exceeded but ignored\n");
2828
2829 }
2830
2831 /* If we are writing in MBX format, what we actually do is to write the message
2832 to a temporary file, and then copy it to the real file once we know its size.
2833 This is the most straightforward way of getting the correct length in the
2834 separator line. So, what we do here is to save the real file descriptor, and
2835 replace it with one for a temporary file. The temporary file gets unlinked once
2836 opened, so that it goes away on closure. */
2837
2838 #ifdef SUPPORT_MBX
2839 if (yield == OK && ob->mbx_format)
2840 {
2841 temp_file = tmpfile();
2842 if (temp_file == NULL)
2843 {
2844 addr->basic_errno = errno;
2845 addr->message = US"while setting up temporary file";
2846 yield = DEFER;
2847 goto RETURN;
2848 }
2849 save_fd = fd;
2850 fd = fileno(temp_file);
2851 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2852 }
2853 #endif /* SUPPORT_MBX */
2854
2855 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2856 functions. */
2857
2858 transport_count = 0;
2859 transport_newlines = 0;
2860
2861 /* Write any configured prefix text first */
2862
2863 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2864 {
2865 uschar *prefix = expand_string(ob->message_prefix);
2866 if (prefix == NULL)
2867 {
2868 errno = ERRNO_EXPANDFAIL;
2869 addr->transport_return = PANIC;
2870 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2871 "transport) failed", ob->message_prefix, tblock->name);
2872 yield = DEFER;
2873 }
2874 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2875 }
2876
2877 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2878 various different values for batching are handled outside; if there is more
2879 than one address available here, all must be included. If any address is a
2880 file, use its parent in the RCPT TO. */
2881
2882 if (yield == OK && ob->use_bsmtp)
2883 {
2884 transport_count = 0;
2885 transport_newlines = 0;
2886 if (ob->use_crlf) cr = US"\r";
2887 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2888 yield = DEFER;
2889 else
2890 {
2891 transport_newlines++;
2892 for (address_item * a = addr; a != NULL; a = a->next)
2893 {
2894 address_item *b = testflag(a, af_pfr) ? a->parent: a;
2895 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2896 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2897 { yield = DEFER; break; }
2898 transport_newlines++;
2899 }
2900 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2901 yield = DEFER;
2902 else
2903 transport_newlines++;
2904 }
2905 }
2906
2907 /* Now the message itself. The options for transport_write_message were set up
2908 at initialization time. */
2909
2910 if (yield == OK)
2911 {
2912 transport_ctx tctx = {
2913 .u = {.fd=fd},
2914 .tblock = tblock,
2915 .addr = addr,
2916 .check_string = ob->check_string,
2917 .escape_string = ob->escape_string,
2918 .options = ob->options | topt_not_socket
2919 };
2920 if (!transport_write_message(&tctx, 0))
2921 yield = DEFER;
2922 }
2923
2924 /* Now a configured suffix. */
2925
2926 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2927 {
2928 uschar *suffix = expand_string(ob->message_suffix);
2929 if (suffix == NULL)
2930 {
2931 errno = ERRNO_EXPANDFAIL;
2932 addr->transport_return = PANIC;
2933 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2934 "transport) failed", ob->message_suffix, tblock->name);
2935 yield = DEFER;
2936 }
2937 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2938 }
2939
2940 /* If batch smtp, write the terminating dot. */
2941
2942 if (yield == OK && ob->use_bsmtp ) {
2943 if(!transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2944 else transport_newlines++;
2945 }
2946
2947 /* If MBX format is being used, all that writing was to the temporary file.
2948 However, if there was an earlier failure (Exim quota exceeded, for example),
2949 the temporary file won't have got opened - and no writing will have been done.
2950 If writing was OK, we restore the fd, and call a function that copies the
2951 message in MBX format into the real file. Otherwise use the temporary name in
2952 any messages. */
2953
2954 #ifdef SUPPORT_MBX
2955 if (temp_file != NULL && ob->mbx_format)
2956 {
2957 int mbx_save_errno;
2958 fd = save_fd;
2959
2960 if (yield == OK)
2961 {
2962 transport_count = 0; /* Reset transport count for actual write */
2963 /* No need to reset transport_newlines as we're just using a block copy
2964 * routine so the number won't be affected */
2965 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2966 }
2967 else if (errno >= 0) dataname = US"temporary file";
2968
2969 /* Preserve errno while closing the temporary file. */
2970
2971 mbx_save_errno = errno;
2972 (void)fclose(temp_file);
2973 errno = mbx_save_errno;
2974 }
2975 #endif /* SUPPORT_MBX */
2976
2977 /* Force out the remaining data to check for any errors; some OS don't allow
2978 fsync() to be called for a FIFO. */
2979
2980 if (yield == OK && !isfifo && EXIMfsync(fd) < 0) yield = DEFER;
2981
2982 /* Update message_size and message_linecount to the accurate count of bytes
2983 written, including added headers. Note; we subtract 1 from message_linecount as
2984 this variable doesn't count the new line between the header and the body of the
2985 message. */
2986
2987 message_size = transport_count;
2988 message_linecount = transport_newlines - 1;
2989
2990 /* If using a maildir++ quota file, add this message's size to it, and
2991 close the file descriptor, except when the quota has been disabled because we
2992 are delivering into an uncounted folder. */
2993
2994 #ifdef SUPPORT_MAILDIR
2995 if (!disable_quota)
2996 {
2997 if (yield == OK && maildirsize_fd >= 0)
2998 maildir_record_length(maildirsize_fd, message_size);
2999 maildir_save_errno = errno; /* Preserve errno while closing the file */
3000 if (maildirsize_fd >= 0)
3001 (void)close(maildirsize_fd);
3002 errno = maildir_save_errno;
3003 }
3004 #endif /* SUPPORT_MAILDIR */
3005
3006 /* If there is a quota warning threshold and we are have crossed it with this
3007 message, set the SPECIAL_WARN flag in the address, to cause a warning message
3008 to be sent. */
3009
3010 if (!disable_quota && THRESHOLD_CHECK)
3011 {
3012 off_t threshold = ob->quota_warn_threshold_value;
3013 if (ob->quota_warn_threshold_is_percent)
3014 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
3015 DEBUG(D_transport)
3016 debug_printf("quota = " OFF_T_FMT
3017 " threshold = " OFF_T_FMT
3018 " old size = " OFF_T_FMT
3019 " message size = %d\n",
3020 ob->quota_value, threshold, mailbox_size,
3021 message_size);
3022 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
3023 addr->special_action = SPECIAL_WARN;
3024
3025 /******* You might think that the test ought to be this:
3026 *
3027 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
3028 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
3029 *
3030 * (indeed, I was sent a patch with that in). However, it is possible to
3031 * have a warning threshold without actually imposing a quota, and I have
3032 * therefore kept Exim backwards compatible.
3033 ********/
3034
3035 }
3036
3037 /* Handle error while writing the file. Control should come here directly after
3038 the error, with the reason in errno. In the case of expansion failure in prefix
3039 or suffix, it will be ERRNO_EXPANDFAIL. */
3040
3041 if (yield != OK)
3042 {
3043 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
3044
3045 /* Save the error number. If positive, it will ultimately cause a strerror()
3046 call to generate some text. */
3047
3048 addr->basic_errno = errno;
3049
3050 /* For system or Exim quota excession, or disk full, set more_errno to the
3051 time since the file was last read. If delivery was into a directory, the
3052 time since last read logic is not relevant, in general. However, for maildir
3053 deliveries we can approximate it by looking at the last modified time of the
3054 "new" subdirectory. Since Exim won't be adding new messages, a change to the
3055 "new" subdirectory implies that an MUA has moved a message from there to the
3056 "cur" directory. */
3057
3058 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
3059 {
3060 addr->more_errno = 0;
3061 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
3062
3063 #ifdef SUPPORT_MAILDIR
3064 else if (mbformat == mbf_maildir)
3065 {
3066 struct stat statbuf;
3067 if (Ustat("new", &statbuf) < 0)
3068 {
3069 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
3070 "stat error %d for \"new\": %s\n", errno, strerror(errno));
3071 }
3072 else /* Want a repeatable time when in test harness */
3073 {
3074 addr->more_errno = f.running_in_test_harness ? 10 :
3075 (int)time(NULL) - statbuf.st_mtime;
3076 }
3077 DEBUG(D_transport)
3078 debug_printf("maildir: time since \"new\" directory modified = %s\n",
3079 readconf_printtime(addr->more_errno));
3080 }
3081 #endif /* SUPPORT_MAILDIR */
3082 }
3083
3084 /* Handle system quota excession. Add an explanatory phrase for the error
3085 message, since some systems don't have special quota-excession errors,
3086 and on those that do, "quota" doesn't always mean anything to the user. */
3087
3088 if (errno == errno_quota)
3089 {
3090 #ifndef EDQUOT
3091 addr->message = string_sprintf("mailbox is full "
3092 "(quota exceeded while writing to file %s)", filename);
3093 #else
3094 addr->message = string_sprintf("mailbox is full");
3095 #endif /* EDQUOT */
3096 addr->user_message = US"mailbox is full";
3097 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
3098 dataname,
3099 isdirectory ? US"" : US": time since file read = ",
3100 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3101 }
3102
3103 /* Handle Exim's own quota-imposition */
3104
3105 else if (errno == ERRNO_EXIMQUOTA)
3106 {
3107 addr->message = string_sprintf("mailbox is full "
3108 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
3109 dataname);
3110 addr->user_message = US"mailbox is full";
3111 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3112 filecount_msg, dataname,
3113 isdirectory ? US"" : US": time since file read = ",
3114 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3115 }
3116
3117 /* Handle a process failure while writing via a filter; the return
3118 from child_close() is in more_errno. */
3119
3120 else if (errno == ERRNO_FILTER_FAIL)
3121 {
3122 yield = PANIC;
3123 addr->message = string_sprintf("transport filter process failed (%d) "
3124 "while writing to %s%s", addr->more_errno, dataname,
3125 (addr->more_errno == EX_EXECFAILED) ? ": unable to execute command" : "");
3126 }
3127
3128 /* Handle failure to expand header changes */
3129
3130 else if (errno == ERRNO_CHHEADER_FAIL)
3131 {
3132 yield = PANIC;
3133 addr->message =
3134 string_sprintf("failed to expand headers_add or headers_remove while "
3135 "writing to %s: %s", dataname, expand_string_message);
3136 }
3137
3138 /* Handle failure to complete writing of a data block */
3139
3140 else if (errno == ERRNO_WRITEINCOMPLETE)
3141 {
3142 addr->message = string_sprintf("failed to write data block while "
3143 "writing to %s", dataname);
3144 }
3145
3146 /* Handle length mismatch on MBX copying */
3147
3148 #ifdef SUPPORT_MBX
3149 else if (errno == ERRNO_MBXLENGTH)
3150 {
3151 addr->message = string_sprintf("length mismatch while copying MBX "
3152 "temporary file to %s", dataname);
3153 }
3154 #endif /* SUPPORT_MBX */
3155
3156 /* For other errors, a general-purpose explanation, if the message is
3157 not already set. */
3158
3159 else if (addr->message == NULL)
3160 addr->message = string_sprintf("error while writing to %s", dataname);
3161
3162 /* For a file, reset the file size to what it was before we started, leaving
3163 the last modification time unchanged, so it will get reset also. All systems
3164 investigated so far have ftruncate(), whereas not all have the F_FREESP
3165 fcntl() call (BSDI & FreeBSD do not). */
3166
3167 if (!isdirectory && ftruncate(fd, saved_size))
3168 DEBUG(D_transport) debug_printf("Error resetting file size\n");
3169 }
3170
3171 /* Handle successful writing - we want the modification time to be now for
3172 appended files. Remove the default backstop error number. For a directory, now
3173 is the time to rename the file with a unique name. As soon as such a name
3174 appears it may get used by another process, so we close the file first and
3175 check that all is well. */
3176
3177 else
3178 {
3179 times.modtime = time(NULL);
3180 addr->basic_errno = 0;
3181
3182 /* Handle the case of writing to a new file in a directory. This applies
3183 to all single-file formats - maildir, mailstore, and "smail format". */
3184
3185 if (isdirectory)
3186 {
3187 if (fstat(fd, &statbuf) < 0)
3188 {
3189 addr->basic_errno = errno;
3190 addr->message = string_sprintf("while fstatting opened message file %s",
3191 filename);
3192 yield = DEFER;
3193 }
3194
3195 else if (close(fd) < 0)
3196 {
3197 addr->basic_errno = errno;
3198 addr->message = string_sprintf("close() error for %s",
3199 (ob->mailstore_format) ? dataname : filename);
3200 yield = DEFER;
3201 }
3202
3203 /* File is successfully written and closed. Arrange to rename it. For the
3204 different kinds of single-file delivery, some games can be played with the
3205 name. The message size is by this time set to the accurate value so that
3206 its value can be used in expansions. */
3207
3208 else
3209 {
3210 uschar *renamename = newname;
3211 fd = -1;
3212
3213 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3214
3215 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3216 situation. The name is built by expanding the directory_file option, and
3217 we make the inode number available for use in this. The expansion was
3218 checked for syntactic validity above, before we wrote the file.
3219
3220 We have to be careful here, in case the file name exists. (In the other
3221 cases, the names used are constructed to be unique.) The rename()
3222 function just replaces an existing file - we don't want that! So instead
3223 of calling rename(), we must use link() and unlink().
3224
3225 In this case, if the link fails because of an existing file, we wait
3226 for one second and try the expansion again, to see if it produces a
3227 different value. Do this up to 5 times unless the name stops changing.
3228 This makes it possible to build values that are based on the time, and
3229 still cope with races from multiple simultaneous deliveries. */
3230
3231 if (newname == NULL)
3232 {
3233 uschar *renameleaf;
3234 uschar *old_renameleaf = US"";
3235
3236 for (int i = 0; ; sleep(1), i++)
3237 {
3238 deliver_inode = statbuf.st_ino;
3239 renameleaf = expand_string(ob->dirfilename);
3240 deliver_inode = 0;
3241
3242 if (renameleaf == NULL)
3243 {
3244 addr->transport_return = PANIC;
3245 addr->message = string_sprintf("Expansion of \"%s\" "
3246 "(directory_file for %s transport) failed: %s",
3247 ob->dirfilename, tblock->name, expand_string_message);
3248 goto RETURN;
3249 }
3250
3251 renamename = string_sprintf("%s/%s", path, renameleaf);
3252 if (Ulink(filename, renamename) < 0)
3253 {
3254 DEBUG(D_transport) debug_printf("link failed: %s\n",
3255 strerror(errno));
3256 if (errno != EEXIST || i >= 4 ||
3257 Ustrcmp(renameleaf, old_renameleaf) == 0)
3258 {
3259 addr->basic_errno = errno;
3260 addr->message = string_sprintf("while renaming %s as %s",
3261 filename, renamename);
3262 yield = DEFER;
3263 break;
3264 }
3265 old_renameleaf = renameleaf;
3266 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3267 renamename);
3268 }
3269 else
3270 {
3271 Uunlink(filename);
3272 filename = NULL;
3273 break;
3274 }
3275 } /* re-expand loop */
3276 } /* not mailstore or maildir */
3277
3278 /* For maildir and mailstore formats, the new name was created earlier,
3279 except that for maildir, there is the possibility of adding a "tag" on
3280 the end of the name by expanding the value of nametag. This usually
3281 includes a reference to the message size. The expansion of nametag was
3282 checked above, before the file was opened. It either succeeded, or
3283 provoked a soft failure. So any failure here can be treated as soft.
3284 Ignore non-printing characters and / and put a colon at the start if the
3285 first character is alphanumeric. */
3286
3287 else
3288 {
3289 if (nametag != NULL)
3290 {
3291 uschar *iptr = expand_string(nametag);
3292 if (iptr != NULL)
3293 {
3294 uschar *etag = store_get(Ustrlen(iptr) + 2);
3295 uschar *optr = etag;
3296 while (*iptr != 0)
3297 {
3298 if (mac_isgraph(*iptr) && *iptr != '/')
3299 {
3300 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3301 *optr++ = *iptr;
3302 }
3303 iptr++;
3304 }
3305 *optr = 0;
3306 renamename = string_sprintf("%s%s", newname, etag);
3307 }
3308 }
3309
3310 /* Do the rename. If the name is too long and a tag exists, try again
3311 without the tag. */
3312
3313 if (Urename(filename, renamename) < 0 &&
3314 (nametag == NULL || errno != ENAMETOOLONG ||
3315 (renamename = newname, Urename(filename, renamename) < 0)))
3316 {
3317 addr->basic_errno = errno;
3318 addr->message = string_sprintf("while renaming %s as %s",
3319 filename, renamename);
3320 yield = DEFER;
3321 }
3322
3323 /* Rename succeeded */
3324
3325 else
3326 {
3327 DEBUG(D_transport) debug_printf("renamed %s as %s\n", filename,
3328 renamename);
3329 filename = dataname = NULL; /* Prevents attempt to unlink at end */
3330 }
3331 } /* maildir or mailstore */
3332 } /* successful write + close */
3333 } /* isdirectory */
3334 } /* write success */
3335
3336
3337 /* For a file, restore the last access time (atime), and set the modification
3338 time as required - changed if write succeeded, unchanged if not. */
3339
3340 if (!isdirectory) utime(CS filename, &times);
3341
3342 /* Notify comsat if configured to do so. It only makes sense if the configured
3343 file is the one that the comsat daemon knows about. */
3344
3345 if (ob->notify_comsat && yield == OK && deliver_localpart != NULL)
3346 notify_comsat(deliver_localpart, saved_size);
3347
3348 /* Pass back the final return code in the address structure */
3349
3350 DEBUG(D_transport)
3351 debug_printf("appendfile yields %d with errno=%d more_errno=%d\n",
3352 yield, addr->basic_errno, addr->more_errno);
3353
3354 addr->transport_return = yield;
3355
3356 /* Close the file, which will release the fcntl lock. For a directory write it
3357 is closed above, except in cases of error which goto RETURN, when we also need
3358 to remove the original file(s). For MBX locking, if all has gone well, before
3359 closing the file, see if we can get an exclusive lock on it, in which case we
3360 can unlink the /tmp lock file before closing it. This is always a non-blocking
3361 lock; there's no need to wait if we can't get it. If everything has gone right
3362 but close fails, defer the message. Then unlink the lock file, if present. This
3363 point in the code is jumped to from a number of places when errors are
3364 detected, in order to get the file closed and the lock file tidied away. */
3365
3366 RETURN:
3367
3368 #ifdef SUPPORT_MBX
3369 if (mbx_lockfd >= 0)
3370 {
3371 if (yield == OK && apply_lock(fd, F_WRLCK, ob->use_fcntl, 0,
3372 ob->use_flock, 0) >= 0)
3373 {
3374 DEBUG(D_transport)
3375 debug_printf("unlinking MBX lock file %s\n", mbx_lockname);
3376 Uunlink(mbx_lockname);
3377 }
3378 (void)close(mbx_lockfd);
3379 }
3380 #endif /* SUPPORT_MBX */
3381
3382 if (fd >= 0 && close(fd) < 0 && yield == OK)
3383 {
3384 addr->basic_errno = errno;
3385 addr->message = string_sprintf("while closing %s", filename);
3386 addr->transport_return = DEFER;
3387 }
3388
3389 if (hd >= 0) Uunlink(lockname);
3390
3391 /* We get here with isdirectory and filename set only in error situations. */
3392
3393 if (isdirectory && filename != NULL)
3394 {
3395 Uunlink(filename);
3396 if (dataname != filename) Uunlink(dataname);
3397 }
3398
3399 /* If wait_for_tick is TRUE, we have done a delivery where the uniqueness of a
3400 file name relies on time + pid. We must not allow the process to finish until
3401 the clock has move on by at least one microsecond. Usually we expect this
3402 already to be the case, but machines keep getting faster... */
3403
3404 if (wait_for_tick) exim_wait_tick(&msg_tv, 1);
3405
3406 /* A return of FALSE means that if there was an error, a common error was
3407 put in the first address of a batch. */
3408
3409 return FALSE;
3410 }
3411
3412 #endif /*!MACRO_PREDEF*/
3413 /* End of transport/appendfile.c */