tidying
[exim.git] / src / src / transports / appendfile.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8
9 #include "../exim.h"
10 #include "appendfile.h"
11
12 #ifdef SUPPORT_MAILDIR
13 #include "tf_maildir.h"
14 #endif
15
16
17 /* Options specific to the appendfile transport. They must be in alphabetic
18 order (note that "_" comes before the lower case letters). Some of them are
19 stored in the publicly visible instance block - these are flagged with the
20 opt_public flag. */
21
22 optionlist appendfile_transport_options[] = {
23 #ifdef SUPPORT_MAILDIR
24 { "*expand_maildir_use_size_file", opt_stringptr,
25 (void *)offsetof(appendfile_transport_options_block, expand_maildir_use_size_file) },
26 #endif
27 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
28 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
29 { "*set_use_flock_lock",opt_bool | opt_hidden,
30 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
31 { "*set_use_lockfile", opt_bool | opt_hidden,
32 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
33 #ifdef SUPPORT_MBX
34 { "*set_use_mbx_lock", opt_bool | opt_hidden,
35 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
36 #endif
37 { "allow_fifo", opt_bool,
38 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
39 { "allow_symlink", opt_bool,
40 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
41 { "batch_id", opt_stringptr | opt_public,
42 (void *)offsetof(transport_instance, batch_id) },
43 { "batch_max", opt_int | opt_public,
44 (void *)offsetof(transport_instance, batch_max) },
45 { "check_group", opt_bool,
46 (void *)offsetof(appendfile_transport_options_block, check_group) },
47 { "check_owner", opt_bool,
48 (void *)offsetof(appendfile_transport_options_block, check_owner) },
49 { "check_string", opt_stringptr,
50 (void *)offsetof(appendfile_transport_options_block, check_string) },
51 { "create_directory", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, create_directory) },
53 { "create_file", opt_stringptr,
54 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
55 { "directory", opt_stringptr,
56 (void *)offsetof(appendfile_transport_options_block, dirname) },
57 { "directory_file", opt_stringptr,
58 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
59 { "directory_mode", opt_octint,
60 (void *)offsetof(appendfile_transport_options_block, dirmode) },
61 { "escape_string", opt_stringptr,
62 (void *)offsetof(appendfile_transport_options_block, escape_string) },
63 { "file", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, filename) },
65 { "file_format", opt_stringptr,
66 (void *)offsetof(appendfile_transport_options_block, file_format) },
67 { "file_must_exist", opt_bool,
68 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
69 { "lock_fcntl_timeout", opt_time,
70 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
71 { "lock_flock_timeout", opt_time,
72 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
73 { "lock_interval", opt_time,
74 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
75 { "lock_retries", opt_int,
76 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
77 { "lockfile_mode", opt_octint,
78 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
79 { "lockfile_timeout", opt_time,
80 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
81 { "mailbox_filecount", opt_stringptr,
82 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
83 { "mailbox_size", opt_stringptr,
84 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
85 #ifdef SUPPORT_MAILDIR
86 { "maildir_format", opt_bool,
87 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
88 { "maildir_quota_directory_regex", opt_stringptr,
89 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
90 { "maildir_retries", opt_int,
91 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
92 { "maildir_tag", opt_stringptr,
93 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
94 { "maildir_use_size_file", opt_expand_bool,
95 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
96 { "maildirfolder_create_regex", opt_stringptr,
97 (void *)offsetof(appendfile_transport_options_block, maildirfolder_create_regex ) },
98 #endif /* SUPPORT_MAILDIR */
99 #ifdef SUPPORT_MAILSTORE
100 { "mailstore_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
102 { "mailstore_prefix", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
104 { "mailstore_suffix", opt_stringptr,
105 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
106 #endif /* SUPPORT_MAILSTORE */
107 #ifdef SUPPORT_MBX
108 { "mbx_format", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
110 #endif /* SUPPORT_MBX */
111 { "message_prefix", opt_stringptr,
112 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
113 { "message_suffix", opt_stringptr,
114 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
115 { "mode", opt_octint,
116 (void *)offsetof(appendfile_transport_options_block, mode) },
117 { "mode_fail_narrower",opt_bool,
118 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
119 { "notify_comsat", opt_bool,
120 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
121 { "quota", opt_stringptr,
122 (void *)offsetof(appendfile_transport_options_block, quota) },
123 { "quota_directory", opt_stringptr,
124 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
125 { "quota_filecount", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
127 { "quota_is_inclusive", opt_bool,
128 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
129 { "quota_size_regex", opt_stringptr,
130 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
131 { "quota_warn_message", opt_stringptr | opt_public,
132 (void *)offsetof(transport_instance, warn_message) },
133 { "quota_warn_threshold", opt_stringptr,
134 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
135 { "use_bsmtp", opt_bool,
136 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
137 { "use_crlf", opt_bool,
138 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
139 { "use_fcntl_lock", opt_bool_set,
140 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
141 { "use_flock_lock", opt_bool_set,
142 (void *)offsetof(appendfile_transport_options_block, use_flock) },
143 { "use_lockfile", opt_bool_set,
144 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
145 #ifdef SUPPORT_MBX
146 { "use_mbx_lock", opt_bool_set,
147 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
148 #endif /* SUPPORT_MBX */
149 };
150
151 /* Size of the options list. An extern variable has to be used so that its
152 address can appear in the tables drtables.c. */
153
154 int appendfile_transport_options_count =
155 sizeof(appendfile_transport_options)/sizeof(optionlist);
156
157
158 #ifdef MACRO_PREDEF
159
160 /* Dummy values */
161 appendfile_transport_options_block appendfile_transport_option_defaults = {0};
162 void appendfile_transport_init(transport_instance *tblock) {}
163 BOOL appendfile_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
164
165 #else /*!MACRO_PREDEF*/
166
167 /* Default private options block for the appendfile transport. */
168
169 appendfile_transport_options_block appendfile_transport_option_defaults = {
170 NULL, /* filename */
171 NULL, /* dirname */
172 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
173 NULL, /* message_prefix (default reset in init if not bsmtp) */
174 NULL, /* message_suffix (ditto) */
175 US"anywhere", /* create_file_string (string value for create_file) */
176 NULL, /* quota */
177 NULL, /* quota_directory */
178 NULL, /* quota_filecount */
179 NULL, /* quota_size_regex */
180 NULL, /* quota_warn_threshold */
181 NULL, /* mailbox_size_string */
182 NULL, /* mailbox_filecount_string */
183 NULL, /* expand_maildir_use_size_file */
184 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
185 NULL, /* maildir_tag */
186 NULL, /* maildirfolder_create_regex */
187 NULL, /* mailstore_prefix */
188 NULL, /* mailstore_suffix */
189 NULL, /* check_string (default changed for non-bsmtp file)*/
190 NULL, /* escape_string (ditto) */
191 NULL, /* file_format */
192 0, /* quota_value */
193 0, /* quota_warn_threshold_value */
194 -1, /* mailbox_size_value */
195 -1, /* mailbox_filecount_value */
196 0, /* quota_filecount_value */
197 APPENDFILE_MODE, /* mode */
198 APPENDFILE_DIRECTORY_MODE, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere,/* create_file */
207 0, /* options */
208 FALSE, /* allow_fifo */
209 FALSE, /* allow_symlink */
210 FALSE, /* check_group */
211 TRUE, /* check_owner */
212 TRUE, /* create_directory */
213 FALSE, /* notify_comsat */
214 TRUE, /* use_lockfile */
215 FALSE, /* set_use_lockfile */
216 TRUE, /* use_fcntl */
217 FALSE, /* set_use_fcntl */
218 FALSE, /* use_flock */
219 FALSE, /* set_use_flock */
220 FALSE, /* use_mbx_lock */
221 FALSE, /* set_use_mbx_lock */
222 FALSE, /* use_bsmtp */
223 FALSE, /* use_crlf */
224 FALSE, /* file_must_exist */
225 TRUE, /* mode_fail_narrower */
226 FALSE, /* maildir_format */
227 FALSE, /* maildir_use_size_file */
228 FALSE, /* mailstore_format */
229 FALSE, /* mbx_format */
230 FALSE, /* quota_warn_threshold_is_percent */
231 TRUE, /* quota_is_inclusive */
232 FALSE, /* quota_no_check */
233 FALSE /* quota_filecount_no_check */
234 };
235
236
237 /* Encodings for mailbox formats, and their names. MBX format is actually
238 supported only if SUPPORT_MBX is set. */
239
240 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
241
242 static const char *mailbox_formats[] = {
243 "unix", "mbx", "smail", "maildir", "mailstore" };
244
245
246 /* Check warn threshold only if quota size set or not a percentage threshold
247 percentage check should only be done if quota > 0 */
248
249 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
250 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
251
252
253
254 /*************************************************
255 * Setup entry point *
256 *************************************************/
257
258 /* Called for each delivery in the privileged state, just before the uid/gid
259 are changed and the main entry point is called. We use this function to
260 expand any quota settings, so that it can access files that may not be readable
261 by the user. It is also used to pick up external mailbox size information, if
262 set.
263
264 Arguments:
265 tblock points to the transport instance
266 addrlist addresses about to be delivered (not used)
267 dummy not used (doesn't pass back data)
268 uid the uid that will be set (not used)
269 gid the gid that will be set (not used)
270 errmsg where to put an error message
271
272 Returns: OK, FAIL, or DEFER
273 */
274
275 static int
276 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
277 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
278 {
279 appendfile_transport_options_block *ob =
280 (appendfile_transport_options_block *)(tblock->options_block);
281 uschar *q = ob->quota;
282 double default_value = 0.0;
283 int i;
284
285 addrlist = addrlist; /* Keep picky compilers happy */
286 dummy = dummy;
287 uid = uid;
288 gid = gid;
289
290 if (ob->expand_maildir_use_size_file)
291 ob->maildir_use_size_file = expand_check_condition(ob->expand_maildir_use_size_file,
292 US"`maildir_use_size_file` in transport", tblock->name);
293
294 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
295 mailbox_filecount */
296
297 for (i = 0; i < 5; i++)
298 {
299 double d;
300 int no_check = 0;
301 uschar *which = NULL;
302
303 if (q == NULL) d = default_value;
304 else
305 {
306 uschar *rest;
307 uschar *s = expand_string(q);
308
309 if (s == NULL)
310 {
311 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
312 "%s", q, tblock->name, expand_string_message);
313 return search_find_defer? DEFER : FAIL;
314 }
315
316 d = Ustrtod(s, &rest);
317
318 /* Handle following characters K, M, G, %, the latter being permitted
319 for quota_warn_threshold only. A threshold with no quota setting is
320 just ignored. */
321
322 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
323 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
324 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
325 else if (*rest == '%' && i == 2)
326 {
327 if (ob->quota_value <= 0 && !ob->maildir_use_size_file) d = 0;
328 else if ((int)d < 0 || (int)d > 100)
329 {
330 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
331 " for %s transport", (int)d, tblock->name);
332 return FAIL;
333 }
334 ob->quota_warn_threshold_is_percent = TRUE;
335 rest++;
336 }
337
338
339 /* For quota and quota_filecount there may be options
340 appended. Currently only "no_check", so we can be lazy parsing it */
341 if (i < 2 && Ustrstr(rest, "/no_check") == rest)
342 {
343 no_check = 1;
344 rest += sizeof("/no_check") - 1;
345 }
346
347 while (isspace(*rest)) rest++;
348
349 if (*rest != 0)
350 {
351 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
352 "in %s transport", s, q, tblock->name);
353 return FAIL;
354 }
355 }
356
357 /* Set each value, checking for possible overflow. */
358
359 switch (i)
360 {
361 case 0:
362 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4) which = US"quota";
363 ob->quota_value = (off_t)d;
364 ob->quota_no_check = no_check;
365 q = ob->quota_filecount;
366 break;
367
368 case 1:
369 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"quota_filecount";
370 ob->quota_filecount_value = (int)d;
371 ob->quota_filecount_no_check = no_check;
372 q = ob->quota_warn_threshold;
373 break;
374
375 case 2:
376 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
377 which = US"quota_warn_threshold";
378 ob->quota_warn_threshold_value = (off_t)d;
379 q = ob->mailbox_size_string;
380 default_value = -1.0;
381 break;
382
383 case 3:
384 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
385 which = US"mailbox_size";;
386 ob->mailbox_size_value = (off_t)d;
387 q = ob->mailbox_filecount_string;
388 break;
389
390 case 4:
391 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"mailbox_filecount";
392 ob->mailbox_filecount_value = (int)d;
393 break;
394 }
395
396 if (which != NULL)
397 {
398 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
399 "%s transport", which, d, tblock->name);
400 return FAIL;
401 }
402 }
403
404 return OK;
405 }
406
407
408
409 /*************************************************
410 * Initialization entry point *
411 *************************************************/
412
413 /* Called for each instance, after its options have been read, to
414 enable consistency checks to be done, or anything else that needs
415 to be set up. */
416
417 void
418 appendfile_transport_init(transport_instance *tblock)
419 {
420 appendfile_transport_options_block *ob =
421 (appendfile_transport_options_block *)(tblock->options_block);
422
423 /* Set up the setup entry point, to be called in the privileged state */
424
425 tblock->setup = appendfile_transport_setup;
426
427 /* Lock_retries must be greater than zero */
428
429 if (ob->lock_retries == 0) ob->lock_retries = 1;
430
431 /* Only one of a file name or directory name must be given. */
432
433 if (ob->filename != NULL && ob->dirname != NULL)
434 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
435 "only one of \"file\" or \"directory\" can be specified", tblock->name);
436
437 /* If a file name was specified, neither quota_filecount nor quota_directory
438 must be given. */
439
440 if (ob->filename != NULL)
441 {
442 if (ob->quota_filecount != NULL)
443 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
444 "quota_filecount must not be set without \"directory\"", tblock->name);
445 if (ob->quota_directory != NULL)
446 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
447 "quota_directory must not be set without \"directory\"", tblock->name);
448 }
449
450 /* The default locking depends on whether MBX is set or not. Change the
451 built-in default if none of the lock options has been explicitly set. At least
452 one form of locking is required in all cases, but mbx locking changes the
453 meaning of fcntl and flock locking. */
454
455 /* Not all operating systems provide flock(). For those that do, if flock is
456 requested, the default for fcntl is FALSE. */
457
458 if (ob->use_flock)
459 {
460 #ifdef NO_FLOCK
461 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
462 "flock() support was not available in the operating system when this "
463 "binary was built", tblock->name);
464 #endif /* NO_FLOCK */
465 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
466 }
467
468 #ifdef SUPPORT_MBX
469 if (ob->mbx_format)
470 {
471 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
472 !ob->set_use_mbx_lock)
473 {
474 ob->use_lockfile = ob->use_flock = FALSE;
475 ob->use_mbx_lock = ob->use_fcntl = TRUE;
476 }
477 else if (ob->use_mbx_lock)
478 {
479 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
480 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
481 if (!ob->set_use_flock) ob->use_flock = FALSE;
482 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
483 }
484 }
485 #endif /* SUPPORT_MBX */
486
487 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
488 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
489 "no locking configured", tblock->name);
490
491 /* Unset timeouts for non-used locking types */
492
493 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
494 if (!ob->use_flock) ob->lock_flock_timeout = 0;
495
496 /* If a directory name was specified, only one of maildir or mailstore may be
497 specified, and if quota_filecount or quota_directory is given, quota must
498 be set. */
499
500 if (ob->dirname != NULL)
501 {
502 if (ob->maildir_format && ob->mailstore_format)
503 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
504 "only one of maildir and mailstore may be specified", tblock->name);
505 if (ob->quota_filecount != NULL && ob->quota == NULL)
506 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
507 "quota must be set if quota_filecount is set", tblock->name);
508 if (ob->quota_directory != NULL && ob->quota == NULL)
509 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
510 "quota must be set if quota_directory is set", tblock->name);
511 }
512
513 /* If a fixed uid field is set, then a gid field must also be set. */
514
515 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
516 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
517 "user set without group for the %s transport", tblock->name);
518
519 /* If "create_file" is set, check that a valid option is given, and set the
520 integer variable. */
521
522 if (ob->create_file_string != NULL)
523 {
524 int value = 0;
525 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
526 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
527 create_belowhome;
528 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
529 value = create_inhome;
530 else
531 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
532 "invalid value given for \"file_create\" for the %s transport: %s",
533 tblock->name, ob->create_file_string);
534 ob->create_file = value;
535 }
536
537 /* If quota_warn_threshold is set, set up default for warn_message. It may
538 not be used if the actual threshold for a given delivery ends up as zero,
539 of if it's given as a percentage and there's no quota setting. */
540
541 if (ob->quota_warn_threshold != NULL)
542 {
543 if (tblock->warn_message == NULL) tblock->warn_message = US
544 "To: $local_part@$domain\n"
545 "Subject: Your mailbox\n\n"
546 "This message is automatically created by mail delivery software (Exim).\n\n"
547 "The size of your mailbox has exceeded a warning threshold that is\n"
548 "set by the system administrator.\n";
549 }
550
551 /* If batch SMTP is set, force the check and escape strings, and arrange that
552 headers are also escaped. */
553
554 if (ob->use_bsmtp)
555 {
556 ob->check_string = US".";
557 ob->escape_string = US"..";
558 ob->options |= topt_escape_headers;
559 }
560
561 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
562 insert default values for for the affixes and the check/escape strings. */
563
564 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
565 {
566 if (ob->message_prefix == NULL) ob->message_prefix =
567 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
568 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
569 if (ob->check_string == NULL) ob->check_string = US"From ";
570 if (ob->escape_string == NULL) ob->escape_string = US">From ";
571
572 }
573
574 /* Set up the bitwise options for transport_write_message from the various
575 driver options. Only one of body_only and headers_only can be set. */
576
577 ob->options |=
578 (tblock->body_only? topt_no_headers : 0) |
579 (tblock->headers_only? topt_no_body : 0) |
580 (tblock->return_path_add? topt_add_return_path : 0) |
581 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
582 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
583 ((ob->use_crlf || ob->mbx_format)? topt_use_crlf : 0);
584 }
585
586
587
588 /*************************************************
589 * Notify comsat *
590 *************************************************/
591
592 /* The comsat daemon is the thing that provides asynchronous notification of
593 the arrival of local messages, if requested by the user by "biff y". It is a
594 BSD thing that uses a TCP/IP protocol for communication. A message consisting
595 of the text "user@offset" must be sent, where offset is the place in the
596 mailbox where new mail starts. There is no scope for telling it which file to
597 look at, which makes it a less than useful if mail is being delivered into a
598 non-standard place such as the user's home directory. In fact, it doesn't seem
599 to pay much attention to the offset.
600
601 Arguments:
602 user user name
603 offset offset in mailbox
604
605 Returns: nothing
606 */
607
608 static void
609 notify_comsat(uschar *user, off_t offset)
610 {
611 struct servent *sp;
612 host_item host;
613 host_item *h;
614 uschar buffer[256];
615
616 DEBUG(D_transport) debug_printf("notify_comsat called\n");
617
618 sprintf(CS buffer, "%.200s@" OFF_T_FMT "\n", user, offset);
619
620 if ((sp = getservbyname("biff", "udp")) == NULL)
621 {
622 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
623 return;
624 }
625
626 host.name = US"localhost";
627 host.next = NULL;
628
629
630 /* This code is all set up to look up "localhost" and use all its addresses
631 until one succeeds. However, it appears that at least on some systems, comsat
632 doesn't listen on the ::1 address. So for the moment, just force the address to
633 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
634 can be changed. (But actually, comsat is probably dying out anyway.) */
635
636 /******
637 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
638 {
639 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
640 return;
641 }
642 ******/
643
644 host.address = US"127.0.0.1";
645
646
647 for (h = &host; h; h = h->next)
648 {
649 int sock, rc;
650 int host_af = Ustrchr(h->address, ':') != NULL ? AF_INET6 : AF_INET;
651
652 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
653
654 if ((sock = ip_socket(SOCK_DGRAM, host_af)) < 0) continue;
655
656 /* Connect never fails for a UDP socket, so don't set a timeout. */
657
658 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0, FALSE);
659 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
660 (void)close(sock);
661
662 if (rc >= 0) break;
663 DEBUG(D_transport)
664 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
665 h->address);
666 }
667 }
668
669
670
671 /*************************************************
672 * Check the format of a file *
673 *************************************************/
674
675 /* This function is called when file_format is set, to check that an existing
676 file has the right format. The format string contains text/transport pairs. The
677 string matching is literal. we just read big_buffer_size bytes, because this is
678 all about the first few bytes of a file.
679
680 Arguments:
681 cfd the open file
682 tblock the transport block
683 addr the address block - for inserting error data
684
685 Returns: pointer to the required transport, or NULL
686 */
687
688 transport_instance *
689 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
690 {
691 const uschar *format =
692 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
693 uschar data[256];
694 int len = read(cfd, data, sizeof(data));
695 int sep = 0;
696 uschar *s;
697
698 DEBUG(D_transport) debug_printf("checking file format\n");
699
700 /* An empty file matches the current transport */
701
702 if (len == 0) return tblock;
703
704 /* Search the formats for a match */
705
706 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size)))
707 {
708 int slen = Ustrlen(s);
709 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
710 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
711
712 if (match && tp)
713 {
714 transport_instance *tt;
715 for (tt = transports; tt; tt = tt->next)
716 if (Ustrcmp(tp, tt->name) == 0)
717 {
718 DEBUG(D_transport)
719 debug_printf("file format -> %s transport\n", tt->name);
720 return tt;
721 }
722 addr->basic_errno = ERRNO_BADTRANSPORT;
723 addr->message = string_sprintf("%s transport (for %.*s format) not found",
724 tp, slen, data);
725 return NULL;
726 }
727 }
728
729 /* Failed to find a match */
730
731 addr->basic_errno = ERRNO_FORMATUNKNOWN;
732 addr->message = US"mailbox file format unrecognized";
733 return NULL;
734 }
735
736
737
738
739 /*************************************************
740 * Check directory's files for quota *
741 *************************************************/
742
743 /* This function is called if quota is set for one of the delivery modes that
744 delivers into a specific directory. It scans the directory and stats all the
745 files in order to get a total size and count. This is an expensive thing to do,
746 but some people are prepared to bear the cost. Alternatively, if size_regex is
747 set, it is used as a regex to try to extract the size from the file name, a
748 strategy that some people use on maildir files on systems where the users have
749 no shell access.
750
751 The function is global, because it is also called from tf_maildir.c for maildir
752 folders (which should contain only regular files).
753
754 Note: Any problems can be written to debugging output, but cannot be written to
755 the log, because we are running as an unprivileged user here.
756
757 Arguments:
758 dirname the name of the directory
759 countptr where to add the file count (because this function recurses)
760 regex a compiled regex to get the size from a name
761
762 Returns: the sum of the sizes of the stattable files
763 zero if the directory cannot be opened
764 */
765
766 off_t
767 check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
768 {
769 DIR *dir;
770 off_t sum = 0;
771 int count = *countptr;
772 struct dirent *ent;
773 struct stat statbuf;
774
775 dir = opendir(CS dirname);
776 if (dir == NULL) return 0;
777
778 while ((ent = readdir(dir)) != NULL)
779 {
780 uschar *name = US ent->d_name;
781 uschar buffer[1024];
782
783 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
784
785 count++;
786
787 /* If there's a regex, try to find the size using it */
788
789 if (regex != NULL)
790 {
791 int ovector[6];
792 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
793 {
794 uschar *endptr;
795 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
796 if (endptr == name + ovector[3])
797 {
798 sum += size;
799 DEBUG(D_transport)
800 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
801 size);
802 continue;
803 }
804 }
805 DEBUG(D_transport)
806 debug_printf("check_dir_size: regex did not match %s\n", name);
807 }
808
809 /* No regex or no match for the regex, or captured non-digits */
810
811 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
812 {
813 DEBUG(D_transport)
814 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
815 name);
816 continue;
817 }
818
819 if (Ustat(buffer, &statbuf) < 0)
820 {
821 DEBUG(D_transport)
822 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
823 strerror(errno));
824 continue;
825 }
826
827 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
828 sum += statbuf.st_size;
829 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
830 sum += check_dir_size(buffer, &count, regex);
831 }
832
833 closedir(dir);
834 DEBUG(D_transport)
835 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
836 sum, count);
837
838 *countptr = count;
839 return sum;
840 }
841
842
843
844
845 /*************************************************
846 * Apply a lock to a file descriptor *
847 *************************************************/
848
849 /* This function applies a lock to a file descriptor, using a blocking or
850 non-blocking lock, depending on the timeout value. It can apply either or
851 both of a fcntl() and a flock() lock. However, not all OS support flock();
852 for those that don't, the use_flock option cannot be set.
853
854 Arguments:
855 fd the file descriptor
856 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
857 fcntl() format); the flock() type is deduced if needed
858 dofcntl do fcntl() locking
859 fcntltime non-zero to use blocking fcntl()
860 doflock do flock() locking
861 flocktime non-zero to use blocking flock()
862
863 Returns: yield of the fcntl() or flock() call, with errno preserved;
864 sigalrm_seen set if there has been a timeout
865 */
866
867 static int
868 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
869 int flocktime)
870 {
871 int yield = 0;
872 int save_errno;
873 struct flock lock_data;
874 lock_data.l_type = fcntltype;
875 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
876
877 sigalrm_seen = FALSE;
878
879 if (dofcntl)
880 {
881 if (fcntltime > 0)
882 {
883 alarm(fcntltime);
884 yield = fcntl(fd, F_SETLKW, &lock_data);
885 save_errno = errno;
886 alarm(0);
887 errno = save_errno;
888 }
889 else yield = fcntl(fd, F_SETLK, &lock_data);
890 }
891
892 #ifndef NO_FLOCK
893 if (doflock && (yield >= 0))
894 {
895 int flocktype = (fcntltype == F_WRLCK)? LOCK_EX : LOCK_SH;
896 if (flocktime > 0)
897 {
898 alarm(flocktime);
899 yield = flock(fd, flocktype);
900 save_errno = errno;
901 alarm(0);
902 errno = save_errno;
903 }
904 else yield = flock(fd, flocktype | LOCK_NB);
905 }
906 #endif /* NO_FLOCK */
907
908 return yield;
909 }
910
911
912
913
914 #ifdef SUPPORT_MBX
915 /*************************************************
916 * Copy message into MBX mailbox *
917 *************************************************/
918
919 /* This function is called when a message intended for a MBX mailbox has been
920 written to a temporary file. We can now get the size of the message and then
921 copy it in MBX format to the mailbox.
922
923 Arguments:
924 to_fd fd to write to (the real mailbox)
925 from_fd fd to read from (the temporary file)
926 saved_size current size of mailbox
927
928 Returns: OK if all went well, DEFER otherwise, with errno preserved
929 the number of bytes written are added to transport_count
930 by virtue of calling transport_write_block()
931 */
932
933 /* Values taken from c-client */
934
935 #define MBX_HDRSIZE 2048
936 #define MBX_NUSERFLAGS 30
937
938 static int
939 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
940 {
941 int used;
942 off_t size;
943 struct stat statbuf;
944 transport_ctx tctx = {{0}};
945
946 tctx.u.fd = to_fd;
947
948 /* If the current mailbox size is zero, write a header block */
949
950 if (saved_size == 0)
951 {
952 int i;
953 uschar *s;
954 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
955 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
956 (long int)time(NULL));
957 for (i = 0; i < MBX_NUSERFLAGS; i++)
958 sprintf (CS(s += Ustrlen(s)), "\015\012");
959 if (!transport_write_block (&tctx, deliver_out_buffer, MBX_HDRSIZE, FALSE))
960 return DEFER;
961 }
962
963 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
964
965 /* Now construct the message's header from the time and the RFC822 file
966 size, including CRLFs, which is the size of the input (temporary) file. */
967
968 if (fstat(from_fd, &statbuf) < 0) return DEFER;
969 size = statbuf.st_size;
970
971 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
972 tod_stamp(tod_mbx), size, 0L, 0, 0);
973 used = Ustrlen(deliver_out_buffer);
974
975 /* Rewind the temporary file, and copy it over in chunks. */
976
977 if (lseek(from_fd, 0 , SEEK_SET) < 0) return DEFER;
978
979 while (size > 0)
980 {
981 int len = read(from_fd, deliver_out_buffer + used,
982 DELIVER_OUT_BUFFER_SIZE - used);
983 if (len <= 0)
984 {
985 if (len == 0) errno = ERRNO_MBXLENGTH;
986 return DEFER;
987 }
988 if (!transport_write_block(&tctx, deliver_out_buffer, used + len, FALSE))
989 return DEFER;
990 size -= len;
991 used = 0;
992 }
993
994 return OK;
995 }
996 #endif /* SUPPORT_MBX */
997
998
999
1000 /*************************************************
1001 * Check creation is permitted *
1002 *************************************************/
1003
1004 /* This function checks whether a given file name is permitted to be created,
1005 as controlled by the create_file option. If no home directory is set, however,
1006 we can't do any tests.
1007
1008 Arguments:
1009 filename the file name
1010 create_file the ob->create_file option
1011
1012 Returns: TRUE if creation is permitted
1013 */
1014
1015 static BOOL
1016 check_creation(uschar *filename, int create_file)
1017 {
1018 BOOL yield = TRUE;
1019
1020 if (deliver_home != NULL && create_file != create_anywhere)
1021 {
1022 int len = Ustrlen(deliver_home);
1023 uschar *file = filename;
1024
1025 while (file[0] == '/' && file[1] == '/') file++;
1026 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
1027 ( Ustrchr(file+len+2, '/') != NULL &&
1028 (
1029 create_file != create_belowhome ||
1030 Ustrstr(file+len, "/../") != NULL
1031 )
1032 )
1033 ) yield = FALSE;
1034
1035 /* If yield is TRUE, the file name starts with the home directory, and does
1036 not contain any instances of "/../" in the "belowhome" case. However, it may
1037 still contain symbolic links. We can check for this by making use of
1038 realpath(), which most Unixes seem to have (but make it possible to cut this
1039 out). We can't just use realpath() on the whole file name, because we know
1040 the file itself doesn't exist, and intermediate directories may also not
1041 exist. What we want to know is the real path of the longest existing part of
1042 the path. That must match the home directory's beginning, whichever is the
1043 shorter. */
1044
1045 #ifndef NO_REALPATH
1046 if (yield && create_file == create_belowhome)
1047 {
1048 uschar *slash, *next;
1049 uschar *rp = NULL;
1050 for (slash = Ustrrchr(file, '/'); /* There is known to be one */
1051 rp == NULL && slash > file; /* Stop if reached beginning */
1052 slash = next)
1053 {
1054 *slash = 0;
1055 rp = US realpath(CS file, CS big_buffer);
1056 next = Ustrrchr(file, '/');
1057 *slash = '/';
1058 }
1059
1060 /* If rp == NULL it means that none of the relevant directories exist.
1061 This is not a problem here - it means that no symbolic links can exist,
1062 which is all we are worried about. Otherwise, we must compare it
1063 against the start of the home directory. However, that may itself
1064 contain symbolic links, so we have to "realpath" it as well, if
1065 possible. */
1066
1067 if (rp != NULL)
1068 {
1069 uschar hdbuffer[PATH_MAX+1];
1070 uschar *rph = deliver_home;
1071 int rlen = Ustrlen(big_buffer);
1072
1073 rp = US realpath(CS deliver_home, CS hdbuffer);
1074 if (rp != NULL)
1075 {
1076 rph = hdbuffer;
1077 len = Ustrlen(rph);
1078 }
1079
1080 if (rlen > len) rlen = len;
1081 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1082 {
1083 yield = FALSE;
1084 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1085 big_buffer, deliver_home);
1086 }
1087 }
1088 }
1089 #endif /* NO_REALPATH */
1090 }
1091
1092 return yield;
1093 }
1094
1095
1096
1097 /*************************************************
1098 * Main entry point *
1099 *************************************************/
1100
1101 /* See local README for general interface details. This transport always
1102 returns FALSE, indicating that the status which has been placed in the first
1103 address should be copied to any other addresses in a batch.
1104
1105 Appendfile delivery is tricky and has led to various security problems in other
1106 mailers. The logic used here is therefore laid out in some detail. When this
1107 function is called, we are running in a subprocess which has had its gid and
1108 uid set to the appropriate values. Therefore, we cannot write directly to the
1109 exim logs. Any errors must be handled by setting appropriate return codes.
1110 Note that the default setting for addr->transport_return is DEFER, so it need
1111 not be set unless some other value is required.
1112
1113 The code below calls geteuid() rather than getuid() to get the current uid
1114 because in weird configurations not running setuid root there may be a
1115 difference. In the standard configuration, where setuid() has been used in the
1116 delivery process, there will be no difference between the uid and the euid.
1117
1118 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1119 alias expansion. Otherwise, there must be a configured file name or
1120 directory name.
1121
1122 The following items apply in the case when a file name (as opposed to a
1123 directory name) is given, that is, when appending to a single file:
1124
1125 (2f) Expand the file name.
1126
1127 (3f) If the file name is /dev/null, return success (optimization).
1128
1129 (4f) If the file_format options is set, open the file for reading, and check
1130 that the bytes at the start of the file match one of the given strings.
1131 If the check indicates a transport other than the current one should be
1132 used, pass control to that other transport. Otherwise continue. An empty
1133 or non-existent file matches the current transport. The file is closed
1134 after the check.
1135
1136 (5f) If a lock file is required, create it (see extensive separate comments
1137 below about the algorithm for doing this). It is important to do this
1138 before opening the mailbox if NFS is in use.
1139
1140 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1141 details of any symbolic link.
1142
1143 (7f) If the file already exists:
1144
1145 Check the owner and group if necessary, and defer if they are wrong.
1146
1147 If it is a symbolic link AND the allow_symlink option is set (NOT the
1148 default), go back to (6f) but this time use stat() instead of lstat().
1149
1150 If it's not a regular file (or FIFO when permitted), defer delivery.
1151
1152 Check permissions. If the required permissions are *less* than the
1153 existing ones, or supplied by the address (often by the user via filter),
1154 chmod() the file. Otherwise, defer.
1155
1156 Save the inode number.
1157
1158 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1159
1160 If open fails because the file does not exist, go to (6f); on any other
1161 failure, defer.
1162
1163 Check the inode number hasn't changed - I realize this isn't perfect (an
1164 inode can be reused) but it's cheap and will catch some of the races.
1165
1166 Check it's still a regular file (or FIFO if permitted).
1167
1168 Check that the owner and permissions haven't changed.
1169
1170 If file_format is set, check that the file still matches the format for
1171 the current transport. If not, defer delivery.
1172
1173 (8f) If file does not exist initially:
1174
1175 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1176 this is via a symbolic link (only possible if allow_symlinks is set), in
1177 which case don't use O_EXCL, as it doesn't work.
1178
1179 If open fails because the file already exists, go to (6f). To avoid
1180 looping for ever in a situation where the file is continuously being
1181 created and deleted, all of this happens inside a loop that operates
1182 lock_retries times and includes the fcntl and flock locking. If the
1183 loop completes without the file getting opened, defer and request
1184 freezing, because something really weird is happening.
1185
1186 If open fails for any other reason, defer for subsequent delivery except
1187 when this is a file delivery resulting from an alias or forward expansion
1188 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1189 most likely a user rather than a configuration error.
1190
1191 (9f) We now have the file checked and open for writing. If so configured, lock
1192 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1193 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1194 still fails, give up and defer delivery.
1195
1196 (10f)Save the access time (for subsequent restoration) and the size of the
1197 file, for comsat and for re-setting if delivery fails in the middle -
1198 e.g. for quota exceeded.
1199
1200 The following items apply in the case when a directory name is given:
1201
1202 (2d) Create a new file in the directory using a temporary name, by opening for
1203 writing and with O_CREAT. If maildir format is being used, the file
1204 is created in a temporary subdirectory with a prescribed name. If
1205 mailstore format is being used, the envelope file is first created with a
1206 temporary name, then the data file.
1207
1208 The following items apply in all cases:
1209
1210 (11) We now have the file open for writing, and locked if it was given as a
1211 file name. Write the message and flush the file, unless there is a setting
1212 of the local quota option, in which case we can check for its excession
1213 without doing any writing.
1214
1215 In the case of MBX format mailboxes, the message is first written to a
1216 temporary file, in order to get its correct length. This is then copied to
1217 the real file, preceded by an MBX header.
1218
1219 If there is a quota error on writing, defer the address. Timeout logic
1220 will determine for how long retries are attempted. We restore the mailbox
1221 to its original length if it's a single file. There doesn't seem to be a
1222 uniform error code for quota excession (it even differs between SunOS4
1223 and some versions of SunOS5) so a system-dependent macro called
1224 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1225 compile time.
1226
1227 For any other error (most commonly disk full), do the same.
1228
1229 The following applies after appending to a file:
1230
1231 (12f)Restore the atime; notify_comsat if required; close the file (which
1232 unlocks it if it was locked). Delete the lock file if it exists.
1233
1234 The following applies after writing a unique file in a directory:
1235
1236 (12d)For maildir format, rename the file into the new directory. For mailstore
1237 format, rename the envelope file to its correct name. Otherwise, generate
1238 a unique name from the directory_file option, and rename to that, possibly
1239 trying a few times if the file exists and re-expanding the name gives a
1240 different string.
1241
1242 This transport yields FAIL only when a file name is generated by an alias or
1243 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1244 All other failures return DEFER (in addr->transport_return). */
1245
1246
1247 BOOL
1248 appendfile_transport_entry(
1249 transport_instance *tblock, /* data for this instantiation */
1250 address_item *addr) /* address we are working on */
1251 {
1252 appendfile_transport_options_block *ob =
1253 (appendfile_transport_options_block *)(tblock->options_block);
1254 struct stat statbuf;
1255 uschar *fdname = NULL;
1256 uschar *filename = NULL;
1257 uschar *hitchname = NULL;
1258 uschar *dataname = NULL;
1259 uschar *lockname = NULL;
1260 uschar *newname = NULL;
1261 uschar *nametag = NULL;
1262 uschar *cr = US"";
1263 uschar *filecount_msg = US"";
1264 uschar *path;
1265 struct utimbuf times;
1266 struct timeval msg_tv;
1267 BOOL disable_quota = FALSE;
1268 BOOL isdirectory = FALSE;
1269 BOOL isfifo = FALSE;
1270 BOOL wait_for_tick = FALSE;
1271 uid_t uid = geteuid(); /* See note above */
1272 gid_t gid = getegid();
1273 int mbformat;
1274 int mode = (addr->mode > 0)? addr->mode : ob->mode;
1275 off_t saved_size = -1;
1276 off_t mailbox_size = ob->mailbox_size_value;
1277 int mailbox_filecount = ob->mailbox_filecount_value;
1278 int hd = -1;
1279 int fd = -1;
1280 int yield = FAIL;
1281 int i;
1282
1283 #ifdef SUPPORT_MBX
1284 int save_fd = 0;
1285 int mbx_lockfd = -1;
1286 uschar mbx_lockname[40];
1287 FILE *temp_file = NULL;
1288 #endif /* SUPPORT_MBX */
1289
1290 #ifdef SUPPORT_MAILDIR
1291 int maildirsize_fd = -1; /* fd for maildirsize file */
1292 int maildir_save_errno;
1293 #endif
1294
1295
1296 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1297
1298 /* An "address_file" or "address_directory" transport is used to deliver to
1299 files specified via .forward or an alias file. Prior to release 4.20, the
1300 "file" and "directory" options were ignored in this case. This has been changed
1301 to allow the redirection data to specify what is in effect a folder, whose
1302 location is determined by the options on the transport.
1303
1304 Compatibility with the case when neither option is set is retained by forcing a
1305 value for the file or directory name. A directory delivery is assumed if the
1306 last character of the path from the router is '/'.
1307
1308 The file path is in the local part of the address, but not in the $local_part
1309 variable (that holds the parent local part). It is, however, in the
1310 $address_file variable. Below, we update the local part in the address if it
1311 changes by expansion, so that the final path ends up in the log. */
1312
1313 if (testflag(addr, af_file) &&
1314 ob->filename == NULL &&
1315 ob->dirname == NULL)
1316 {
1317 fdname = US"$address_file";
1318 if (address_file[Ustrlen(address_file)-1] == '/' ||
1319 ob->maildir_format ||
1320 ob->mailstore_format)
1321 isdirectory = TRUE;
1322 }
1323
1324 /* Handle (a) an "address file" delivery where "file" or "directory" is
1325 explicitly set and (b) a non-address_file delivery, where one of "file" or
1326 "directory" must be set; initialization ensures that they are not both set. */
1327
1328 if (fdname == NULL)
1329 {
1330 fdname = ob->filename;
1331 if (fdname == NULL)
1332 {
1333 fdname = ob->dirname;
1334 isdirectory = TRUE;
1335 }
1336 if (fdname == NULL)
1337 {
1338 addr->transport_return = PANIC;
1339 addr->message = string_sprintf("Mandatory file or directory option "
1340 "missing from %s transport", tblock->name);
1341 return FALSE;
1342 }
1343 }
1344
1345 /* Maildir and mailstore require a directory */
1346
1347 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1348 {
1349 addr->transport_return = PANIC;
1350 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1351 "to be specified for the %s transport",
1352 ob->maildir_format? "dir" : "store", tblock->name);
1353 return FALSE;
1354 }
1355
1356 path = expand_string(fdname);
1357
1358 if (path == NULL)
1359 {
1360 addr->transport_return = PANIC;
1361 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1362 "name for %s transport) failed: %s", fdname, tblock->name,
1363 expand_string_message);
1364 return FALSE;
1365 }
1366
1367 if (path[0] != '/')
1368 {
1369 addr->message = string_sprintf("appendfile: file or directory name "
1370 "\"%s\" is not absolute", path);
1371 addr->basic_errno = ERRNO_NOTABSOLUTE;
1372 return FALSE;
1373 }
1374
1375 /* For a file delivery, make sure the local part in the address(es) is updated
1376 to the true local part. */
1377
1378 if (testflag(addr, af_file))
1379 {
1380 address_item *addr2;
1381 for (addr2 = addr; addr2 != NULL; addr2 = addr2->next)
1382 addr2->local_part = string_copy(path);
1383 }
1384
1385 /* The available mailbox formats depend on whether it is a directory or a file
1386 delivery. */
1387
1388 if (isdirectory)
1389 {
1390 mbformat =
1391 #ifdef SUPPORT_MAILDIR
1392 (ob->maildir_format)? mbf_maildir :
1393 #endif
1394 #ifdef SUPPORT_MAILSTORE
1395 (ob->mailstore_format)? mbf_mailstore :
1396 #endif
1397 mbf_smail;
1398 }
1399 else
1400 {
1401 mbformat =
1402 #ifdef SUPPORT_MBX
1403 (ob->mbx_format)? mbf_mbx :
1404 #endif
1405 mbf_unix;
1406 }
1407
1408 DEBUG(D_transport)
1409 {
1410 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1411 "%s%s"
1412 " warning=" OFF_T_FMT "%s\n"
1413 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1414 "maildir_use_size_file=%s\n",
1415 mode, ob->notify_comsat, ob->quota_value,
1416 ob->quota_no_check? " (no_check)" : "",
1417 ob->quota_filecount_no_check? " (no_check_filecount)" : "",
1418 ob->quota_warn_threshold_value,
1419 ob->quota_warn_threshold_is_percent? "%" : "",
1420 isdirectory? "directory" : "file",
1421 path, mailbox_formats[mbformat],
1422 (ob->message_prefix == NULL)? US"null" : string_printing(ob->message_prefix),
1423 (ob->message_suffix == NULL)? US"null" : string_printing(ob->message_suffix),
1424 (ob->maildir_use_size_file)? "yes" : "no");
1425
1426 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1427 ob->use_lockfile? "lockfile " : "",
1428 ob->use_mbx_lock? "mbx locking (" : "",
1429 ob->use_fcntl? "fcntl " : "",
1430 ob->use_flock? "flock" : "",
1431 ob->use_mbx_lock? ")" : "");
1432 }
1433
1434 /* If the -N option is set, can't do any more. */
1435
1436 if (dont_deliver)
1437 {
1438 DEBUG(D_transport)
1439 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1440 tblock->name);
1441 addr->transport_return = OK;
1442 return FALSE;
1443 }
1444
1445 /* Handle the case of a file name. If the file name is /dev/null, we can save
1446 ourselves some effort and just give a success return right away. */
1447
1448 if (!isdirectory)
1449 {
1450 BOOL use_lstat = TRUE;
1451 BOOL file_opened = FALSE;
1452 BOOL allow_creation_here = TRUE;
1453
1454 if (Ustrcmp(path, "/dev/null") == 0)
1455 {
1456 addr->transport_return = OK;
1457 return FALSE;
1458 }
1459
1460 /* Set the name of the file to be opened, and the file to which the data
1461 is written, and find out if we are permitted to create a non-existent file. */
1462
1463 dataname = filename = path;
1464 allow_creation_here = check_creation(filename, ob->create_file);
1465
1466 /* If ob->create_directory is set, attempt to create the directories in
1467 which this mailbox lives, but only if we are permitted to create the file
1468 itself. We know we are dealing with an absolute path, because this was
1469 checked above. */
1470
1471 if (ob->create_directory && allow_creation_here)
1472 {
1473 uschar *p = Ustrrchr(path, '/');
1474 *p = '\0';
1475 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1476 {
1477 addr->basic_errno = errno;
1478 addr->message =
1479 string_sprintf("failed to create directories for %s: %s", path,
1480 strerror(errno));
1481 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1482 return FALSE;
1483 }
1484 *p = '/';
1485 }
1486
1487 /* If file_format is set we must check that any existing file matches one of
1488 the configured formats by checking the bytes it starts with. A match then
1489 indicates a specific transport - if it is not this one, pass control to it.
1490 Otherwise carry on here. An empty or non-existent file matches the current
1491 transport. We don't need to distinguish between non-existence and other open
1492 failures because if an existing file fails to open here, it will also fail
1493 again later when O_RDWR is used. */
1494
1495 if (ob->file_format != NULL)
1496 {
1497 int cfd = Uopen(path, O_RDONLY, 0);
1498 if (cfd >= 0)
1499 {
1500 transport_instance *tt = check_file_format(cfd, tblock, addr);
1501 (void)close(cfd);
1502
1503 /* If another transport is indicated, call it and return; if no transport
1504 was found, just return - the error data will have been set up.*/
1505
1506 if (tt != tblock)
1507 {
1508 if (tt != NULL)
1509 {
1510 set_process_info("delivering %s to %s using %s", message_id,
1511 addr->local_part, tt->name);
1512 debug_print_string(tt->debug_string);
1513 addr->transport = tt;
1514 (tt->info->code)(tt, addr);
1515 }
1516 return FALSE;
1517 }
1518 }
1519 }
1520
1521 /* The locking of mailbox files is worse than the naming of cats, which is
1522 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1523 three different names, so several different styles of locking are used.
1524
1525 Research in other programs that lock mailboxes shows that there is no
1526 universally standard method. Having mailboxes NFS-mounted on the system that
1527 is delivering mail is not the best thing, but people do run like this,
1528 and so the code must do its best to cope.
1529
1530 Three different locking mechanisms are supported. The initialization function
1531 checks that at least one is configured.
1532
1533 LOCK FILES
1534
1535 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1536 will work over NFS. Only after that is done do we actually open the mailbox
1537 and apply locks to it (if configured).
1538
1539 Originally, Exim got the file opened before doing anything about locking.
1540 However, a very occasional problem was observed on Solaris 2 when delivering
1541 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1542 gets remembered at open time. If another process on another host (that's
1543 important) has the file open and locked and writes to it and then releases
1544 the lock while the first process is waiting to get the lock, the first
1545 process may fail to write at the new end point of the file - despite the very
1546 definite statement about O_APPEND in the man page for write(). Experiments
1547 have reproduced this problem, but I do not know any way of forcing a host to
1548 update its attribute cache for an open NFS file. It would be nice if it did
1549 so when a lock was taken out, but this does not seem to happen. Anyway, to
1550 reduce the risk of this problem happening, we now create the lock file
1551 (if configured) *before* opening the mailbox. That will prevent two different
1552 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1553 however, but Pine at least seems to operate in the same way.
1554
1555 Lockfiles should normally be used when NFS is involved, because of the above
1556 problem.
1557
1558 The logic for creating the lock file is:
1559
1560 . The name of the lock file is <mailbox-name>.lock
1561
1562 . First, create a "hitching post" name by adding the primary host name,
1563 current time and pid to the lock file name. This should be unique.
1564
1565 . Create the hitching post file using WRONLY + CREAT + EXCL.
1566
1567 . If that fails EACCES, we assume it means that the user is unable to create
1568 files in the mail spool directory. Some installations might operate in this
1569 manner, so there is a configuration option to allow this state not to be an
1570 error - we proceed to lock using fcntl only, after the file is open.
1571
1572 . Otherwise, an error causes a deferment of the address.
1573
1574 . Hard link the hitching post to the lock file name.
1575
1576 . If the link succeeds, we have successfully created the lock file. Simply
1577 close and unlink the hitching post file.
1578
1579 . If the link does not succeed, proceed as follows:
1580
1581 o Fstat the hitching post file, and then close and unlink it.
1582
1583 o Now examine the stat data. If the number of links to the file is exactly
1584 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1585 the return never made it back, so the link() function gave a failure
1586 return.
1587
1588 . This method allows for the lock file to be created by some other process
1589 right up to the moment of the attempt to hard link it, and is also robust
1590 against NFS server crash-reboots, which would probably result in timeouts
1591 in the middle of link().
1592
1593 . System crashes may cause lock files to get left lying around, and some means
1594 of flushing them is required. The approach of writing a pid (used by smail
1595 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1596 timeout, which seems a better approach. Since any program that writes to a
1597 mailbox using a lock file should complete its task very quickly, Pine
1598 removes lock files that are older than 5 minutes. We allow the value to be
1599 configurable on the transport.
1600
1601 FCNTL LOCKING
1602
1603 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1604 mailbox once it is open. This is done by default with a non-blocking lock.
1605 Failures to lock cause retries after a sleep, but only for a certain number
1606 of tries. A blocking lock is deliberately not used so that we don't hold the
1607 mailbox open. This minimizes the possibility of the NFS problem described
1608 under LOCK FILES above, if for some reason NFS deliveries are happening
1609 without lock files. However, the use of a non-blocking lock and sleep, though
1610 the safest approach, does not give the best performance on very busy systems.
1611 A blocking lock plus timeout does better. Therefore Exim has an option to
1612 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1613 enables the use of blocking fcntl() calls.
1614
1615 FLOCK LOCKING
1616
1617 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1618 same manner as for fcntl locking above. No-blocking/timeout is also set as
1619 above in lock_flock_timeout. Not all operating systems provide or support
1620 flock(). For those that don't (as determined by the definition of LOCK_SH in
1621 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1622 is implemented (not precisely) on top of fcntl(), which means there's no
1623 point in actually using it.
1624
1625 MBX LOCKING
1626
1627 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1628 then the rules used for locking in c-client are used. Exim takes out a shared
1629 lock on the mailbox file, and an exclusive lock on the file whose name is
1630 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1631 any other MBX client from getting an exclusive lock on it and expunging it.
1632 It also stops any other MBX client from unlinking the /tmp lock when it has
1633 finished with it.
1634
1635 The exclusive lock on the /tmp file prevents any other MBX client from
1636 updating the mailbox in any way. When writing is finished, if an exclusive
1637 lock on the mailbox can be obtained, indicating there are no current sharers,
1638 the /tmp file is unlinked.
1639
1640 MBX locking can use either fcntl() or flock() locking. If neither
1641 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1642 The calls for getting these locks are by default non-blocking, as for non-mbx
1643 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1644 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1645 probably makes sense to set timeouts for any MBX deliveries. */
1646
1647
1648 /* Build a lock file if configured to do so - the existence of a lock
1649 file is subsequently checked by looking for a non-negative value of the
1650 file descriptor hd - even though the file is no longer open. */
1651
1652 if (ob->use_lockfile)
1653 {
1654 /* cf. exim_lock.c */
1655 lockname = string_sprintf("%s.lock", filename);
1656 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1657 (unsigned int)(time(NULL)), (unsigned int)getpid());
1658
1659 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1660 hitchname);
1661
1662 /* Lock file creation retry loop */
1663
1664 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1665 {
1666 int rc;
1667 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1668
1669 if (hd < 0)
1670 {
1671 addr->basic_errno = errno;
1672 addr->message =
1673 string_sprintf("creating lock file hitching post %s "
1674 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1675 (long int)getegid());
1676 return FALSE;
1677 }
1678
1679 /* Attempt to hitch the hitching post to the lock file. If link()
1680 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1681 file, and get rid of the hitching post. If the number of links was 2,
1682 the link was created, despite the failure of link(). If the hitch was
1683 not successful, try again, having unlinked the lock file if it is too
1684 old.
1685
1686 There's a version of Linux (2.0.27) which doesn't update its local cache
1687 of the inode after link() by default - which many think is a bug - but
1688 if the link succeeds, this code will be OK. It just won't work in the
1689 case when link() fails after having actually created the link. The Linux
1690 NFS person is fixing this; a temporary patch is available if anyone is
1691 sufficiently worried. */
1692
1693 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1694 (void)close(hd);
1695 Uunlink(hitchname);
1696 if (rc != 0 && statbuf.st_nlink != 2)
1697 {
1698 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1699 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1700 {
1701 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1702 Uunlink(lockname);
1703 }
1704 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1705 continue;
1706 }
1707
1708 DEBUG(D_transport) debug_printf("lock file created\n");
1709 break;
1710 }
1711
1712 /* Check for too many tries at creating the lock file */
1713
1714 if (i >= ob->lock_retries)
1715 {
1716 addr->basic_errno = ERRNO_LOCKFAILED;
1717 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1718 filename);
1719 return FALSE;
1720 }
1721 }
1722
1723
1724 /* We now have to get the file open. First, stat() it and act on existence or
1725 non-existence. This is in a loop to handle the case of a file's being created
1726 or deleted as we watch, and also to handle retries when the locking fails.
1727 Rather than holding the file open while waiting for the fcntl() and/or
1728 flock() lock, we close and do the whole thing again. This should be safer,
1729 especially for NFS files, which might get altered from other hosts, making
1730 their cached sizes incorrect.
1731
1732 With the default settings, no symlinks are permitted, but there is an option
1733 to permit symlinks for those sysadmins that know what they are doing.
1734 Shudder. However, insist that the initial symlink is owned by the right user.
1735 Thus lstat() is used initially; if a symlink is discovered, the loop is
1736 repeated such that stat() is used, to look at the end file. */
1737
1738 for (i = 0; i < ob->lock_retries; i++)
1739 {
1740 int sleep_before_retry = TRUE;
1741 file_opened = FALSE;
1742
1743 if((use_lstat? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1744 {
1745 /* Let's hope that failure to stat (other than non-existence) is a
1746 rare event. */
1747
1748 if (errno != ENOENT)
1749 {
1750 addr->basic_errno = errno;
1751 addr->message = string_sprintf("attempting to stat mailbox %s",
1752 filename);
1753 goto RETURN;
1754 }
1755
1756 /* File does not exist. If it is required to pre-exist this state is an
1757 error. */
1758
1759 if (ob->file_must_exist)
1760 {
1761 addr->basic_errno = errno;
1762 addr->message = string_sprintf("mailbox %s does not exist, "
1763 "but file_must_exist is set", filename);
1764 goto RETURN;
1765 }
1766
1767 /* If not permitted to create this file because it isn't in or below
1768 the home directory, generate an error. */
1769
1770 if (!allow_creation_here)
1771 {
1772 addr->basic_errno = ERRNO_BADCREATE;
1773 addr->message = string_sprintf("mailbox %s does not exist, "
1774 "but creation outside the home directory is not permitted",
1775 filename);
1776 goto RETURN;
1777 }
1778
1779 /* Attempt to create and open the file. If open fails because of
1780 pre-existence, go round the loop again. For any other error, defer the
1781 address, except for an alias or forward generated file name with EPERM,
1782 ENOENT, or EACCES, as those are most likely to be user errors rather
1783 than Exim config errors. When a symbolic link is permitted and points
1784 to a non-existent file, we get here with use_lstat = FALSE. In this case
1785 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1786 consistency and because MBX locking requires it in order to be able to
1787 get a shared lock. */
1788
1789 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1790 (use_lstat? O_EXCL : 0), mode);
1791 if (fd < 0)
1792 {
1793 if (errno == EEXIST) continue;
1794 addr->basic_errno = errno;
1795 addr->message = string_sprintf("while creating mailbox %s",
1796 filename);
1797 if (testflag(addr, af_file) &&
1798 (errno == EPERM || errno == ENOENT || errno == EACCES))
1799 addr->transport_return = FAIL;
1800 goto RETURN;
1801 }
1802
1803 /* We have successfully created and opened the file. Ensure that the group
1804 and the mode are correct. */
1805
1806 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
1807 {
1808 addr->basic_errno = errno;
1809 addr->message = string_sprintf("while setting perms on mailbox %s",
1810 filename);
1811 addr->transport_return = FAIL;
1812 goto RETURN;
1813 }
1814 }
1815
1816
1817 /* The file already exists. Test its type, ownership, and permissions, and
1818 save the inode for checking later. If symlinks are permitted (not the
1819 default or recommended state) it may be a symlink that already exists.
1820 Check its ownership and then look for the file at the end of the link(s).
1821 This at least prevents one user creating a symlink for another user in
1822 a sticky directory. */
1823
1824 else
1825 {
1826 int oldmode = (int)statbuf.st_mode;
1827 ino_t inode = statbuf.st_ino;
1828 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1829
1830 isfifo = FALSE; /* In case things are changing */
1831
1832 /* Check owner if required - the default. */
1833
1834 if (ob->check_owner && statbuf.st_uid != uid)
1835 {
1836 addr->basic_errno = ERRNO_BADUGID;
1837 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1838 "(%ld != %ld)", filename,
1839 islink? " (symlink)" : "",
1840 (long int)(statbuf.st_uid), (long int)uid);
1841 goto RETURN;
1842 }
1843
1844 /* Group is checked only if check_group is set. */
1845
1846 if (ob->check_group && statbuf.st_gid != gid)
1847 {
1848 addr->basic_errno = ERRNO_BADUGID;
1849 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1850 filename, islink? " (symlink)" : "", statbuf.st_gid, gid);
1851 goto RETURN;
1852 }
1853
1854 /* Just in case this is a sticky-bit mail directory, we don't want
1855 users to be able to create hard links to other users' files. */
1856
1857 if (statbuf.st_nlink != 1)
1858 {
1859 addr->basic_errno = ERRNO_NOTREGULAR;
1860 addr->message = string_sprintf("mailbox %s%s has too many links (%d)",
1861 filename, islink? " (symlink)" : "", statbuf.st_nlink);
1862 goto RETURN;
1863
1864 }
1865
1866 /* If symlinks are permitted (not recommended), the lstat() above will
1867 have found the symlink. Its ownership has just been checked; go round
1868 the loop again, using stat() instead of lstat(). That will never yield a
1869 mode of S_IFLNK. */
1870
1871 if (islink && ob->allow_symlink)
1872 {
1873 use_lstat = FALSE;
1874 i--; /* Don't count this time round */
1875 continue;
1876 }
1877
1878 /* An actual file exists. Check that it is a regular file, or FIFO
1879 if permitted. */
1880
1881 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1882
1883 else if ((oldmode & S_IFMT) != S_IFREG)
1884 {
1885 addr->basic_errno = ERRNO_NOTREGULAR;
1886 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1887 filename, ob->allow_fifo? " or named pipe" : "");
1888 goto RETURN;
1889 }
1890
1891 /* If the mode is not what it would be for a newly created file, change
1892 the permissions if the mode is supplied for the address. Otherwise,
1893 reduce but do not extend the permissions. If the newly created
1894 permissions are greater than the existing permissions, don't change
1895 things when the mode is not from the address. */
1896
1897 if ((oldmode = (oldmode & 07777)) != mode)
1898 {
1899 int diffs = oldmode ^ mode;
1900 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1901 {
1902 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1903 if (Uchmod(filename, mode) < 0)
1904 {
1905 addr->basic_errno = errno;
1906 addr->message = string_sprintf("attempting to chmod mailbox %s",
1907 filename);
1908 goto RETURN;
1909 }
1910 oldmode = mode;
1911 }
1912
1913 /* Mode not from address, and newly-created permissions are greater
1914 than existing permissions. Default is to complain, but it can be
1915 configured to go ahead and try to deliver anyway if that's what
1916 the administration wants. */
1917
1918 else if (ob->mode_fail_narrower)
1919 {
1920 addr->basic_errno = ERRNO_BADMODE;
1921 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1922 "(%o expected)", filename, oldmode, mode);
1923 goto RETURN;
1924 }
1925 }
1926
1927 /* We are happy with the existing file. Open it, and then do further
1928 tests to ensure that it is the same file that we were just looking at.
1929 If the file does not now exist, restart this loop, going back to using
1930 lstat again. For an NFS error, just defer; other opening errors are
1931 more serious. The file is opened RDWR so that its format can be checked,
1932 and also MBX locking requires the use of a shared (read) lock. However,
1933 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1934 reading the pipe. */
1935
1936 fd = Uopen(filename, isfifo? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1937 mode);
1938 if (fd < 0)
1939 {
1940 if (errno == ENOENT)
1941 {
1942 use_lstat = TRUE;
1943 continue;
1944 }
1945 addr->basic_errno = errno;
1946 if (isfifo)
1947 {
1948 addr->message = string_sprintf("while opening named pipe %s "
1949 "(could mean no process is reading it)", filename);
1950 }
1951 else if (errno != EWOULDBLOCK)
1952 {
1953 addr->message = string_sprintf("while opening mailbox %s", filename);
1954 }
1955 goto RETURN;
1956 }
1957
1958 /* This fstat really shouldn't fail, as we have an open file! There's a
1959 dilemma here. We use fstat in order to be sure we are peering at the file
1960 we have got open. However, that won't tell us if the file was reached
1961 via a symbolic link. We checked this above, but there is a race exposure
1962 if the link was created between the previous lstat and the open. However,
1963 it would have to be created with the same inode in order to pass the
1964 check below. If ob->allow_symlink is set, causing the use of stat rather
1965 than lstat above, symbolic links may be there anyway, and the checking is
1966 weaker. */
1967
1968 if (fstat(fd, &statbuf) < 0)
1969 {
1970 addr->basic_errno = errno;
1971 addr->message = string_sprintf("attempting to stat open mailbox %s",
1972 filename);
1973 goto RETURN;
1974 }
1975
1976 /* Check the inode; this is isn't a perfect check, but gives some
1977 confidence. */
1978
1979 if (inode != statbuf.st_ino)
1980 {
1981 addr->basic_errno = ERRNO_INODECHANGED;
1982 addr->message = string_sprintf("opened mailbox %s inode number changed "
1983 "from %d to %ld", filename, inode, statbuf.st_ino);
1984 addr->special_action = SPECIAL_FREEZE;
1985 goto RETURN;
1986 }
1987
1988 /* Check it's still a regular file or FIFO, and the uid, gid, and
1989 permissions have not changed. */
1990
1991 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1992 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1993 {
1994 addr->basic_errno = ERRNO_NOTREGULAR;
1995 addr->message =
1996 string_sprintf("opened mailbox %s is no longer a %s", filename,
1997 isfifo? "named pipe" : "regular file");
1998 addr->special_action = SPECIAL_FREEZE;
1999 goto RETURN;
2000 }
2001
2002 if ((ob->check_owner && statbuf.st_uid != uid) ||
2003 (ob->check_group && statbuf.st_gid != gid))
2004 {
2005 addr->basic_errno = ERRNO_BADUGID;
2006 addr->message =
2007 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
2008 addr->special_action = SPECIAL_FREEZE;
2009 goto RETURN;
2010 }
2011
2012 if ((statbuf.st_mode & 07777) != oldmode)
2013 {
2014 addr->basic_errno = ERRNO_BADMODE;
2015 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
2016 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
2017 addr->special_action = SPECIAL_FREEZE;
2018 goto RETURN;
2019 }
2020
2021 /* If file_format is set, check that the format of the file has not
2022 changed. Error data is set by the testing function. */
2023
2024 if (ob->file_format != NULL &&
2025 check_file_format(fd, tblock, addr) != tblock)
2026 {
2027 addr->message = US"open mailbox has changed format";
2028 goto RETURN;
2029 }
2030
2031 /* The file is OK. Carry on to do the locking. */
2032 }
2033
2034 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
2035 locking rules if configured to do so. If a lock file is also required, it
2036 was created above and hd was left >= 0. At least one form of locking is
2037 required by the initialization function. If locking fails here, close the
2038 file and go round the loop all over again, after waiting for a bit, unless
2039 blocking locking was used. */
2040
2041 file_opened = TRUE;
2042 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
2043 sleep_before_retry = FALSE;
2044
2045 /* Simple fcntl() and/or flock() locking */
2046
2047 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
2048 {
2049 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2050 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
2051 }
2052
2053 /* MBX locking rules */
2054
2055 #ifdef SUPPORT_MBX
2056 else if (ob->use_mbx_lock)
2057 {
2058 int mbx_tmp_oflags;
2059 struct stat lstatbuf, statbuf2;
2060 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2061 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
2062 fstat(fd, &statbuf) >= 0)
2063 {
2064 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
2065 (long)statbuf.st_ino);
2066
2067 /*
2068 * 2010-05-29: SECURITY
2069 * Dan Rosenberg reported the presence of a race-condition in the
2070 * original code here. Beware that many systems still allow symlinks
2071 * to be followed in /tmp so an attacker can create a symlink pointing
2072 * elsewhere between a stat and an open, which we should avoid
2073 * following.
2074 *
2075 * It's unfortunate that we can't just use all the heavily debugged
2076 * locking from above.
2077 *
2078 * Also: remember to mirror changes into exim_lock.c */
2079
2080 /* first leave the old pre-check in place, it provides better
2081 * diagnostics for common cases */
2082 if (Ulstat(mbx_lockname, &statbuf) >= 0)
2083 {
2084 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
2085 {
2086 addr->basic_errno = ERRNO_LOCKFAILED;
2087 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2088 mbx_lockname);
2089 goto RETURN;
2090 }
2091 if (statbuf.st_nlink > 1)
2092 {
2093 addr->basic_errno = ERRNO_LOCKFAILED;
2094 addr->message = string_sprintf("hard link to MBX lock file %s",
2095 mbx_lockname);
2096 goto RETURN;
2097 }
2098 }
2099
2100 /* If we could just declare "we must be the ones who create this
2101 * file" then a hitching post in a subdir would work, since a
2102 * subdir directly in /tmp/ which we create wouldn't follow links
2103 * but this isn't our locking logic, so we can't safely change the
2104 * file existence rules. */
2105
2106 /* On systems which support O_NOFOLLOW, it's the easiest and most
2107 * obviously correct security fix */
2108 mbx_tmp_oflags = O_RDWR | O_CREAT;
2109 #ifdef O_NOFOLLOW
2110 mbx_tmp_oflags |= O_NOFOLLOW;
2111 #endif
2112 mbx_lockfd = Uopen(mbx_lockname, mbx_tmp_oflags, ob->lockfile_mode);
2113 if (mbx_lockfd < 0)
2114 {
2115 addr->basic_errno = ERRNO_LOCKFAILED;
2116 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2117 mbx_lockname, strerror(errno));
2118 goto RETURN;
2119 }
2120
2121 if (Ulstat(mbx_lockname, &lstatbuf) < 0)
2122 {
2123 addr->basic_errno = ERRNO_LOCKFAILED;
2124 addr->message = string_sprintf("attempting to lstat open MBX "
2125 "lock file %s: %s", mbx_lockname, strerror(errno));
2126 goto RETURN;
2127 }
2128 if (fstat(mbx_lockfd, &statbuf2) < 0)
2129 {
2130 addr->basic_errno = ERRNO_LOCKFAILED;
2131 addr->message = string_sprintf("attempting to stat fd of open MBX "
2132 "lock file %s: %s", mbx_lockname, strerror(errno));
2133 goto RETURN;
2134 }
2135
2136 /*
2137 * At this point:
2138 * statbuf: if exists, is file which existed prior to opening the
2139 * lockfile, might have been replaced since then
2140 * statbuf2: result of stat'ing the open fd, is what was actually
2141 * opened
2142 * lstatbuf: result of lstat'ing the filename immediately after
2143 * the open but there's a race condition again between
2144 * those two steps: before open, symlink to foo, after
2145 * open but before lstat have one of:
2146 * * was no symlink, so is the opened file
2147 * (we created it, no messing possible after that point)
2148 * * hardlink to foo
2149 * * symlink elsewhere
2150 * * hardlink elsewhere
2151 * * new file/other
2152 * Don't want to compare to device of /tmp because some modern systems
2153 * have regressed to having /tmp be the safe actual filesystem as
2154 * valuable data, so is mostly worthless, unless we assume that *only*
2155 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2156 * for further consideration.
2157 * No point in doing a readlink on the lockfile as that will always be
2158 * at a different point in time from when we open it, so tells us
2159 * nothing; attempts to clean up and delete after ourselves would risk
2160 * deleting a *third* filename.
2161 */
2162 if ((statbuf2.st_nlink > 1) ||
2163 (lstatbuf.st_nlink > 1) ||
2164 (!S_ISREG(lstatbuf.st_mode)) ||
2165 (lstatbuf.st_dev != statbuf2.st_dev) ||
2166 (lstatbuf.st_ino != statbuf2.st_ino))
2167 {
2168 addr->basic_errno = ERRNO_LOCKFAILED;
2169 addr->message = string_sprintf("RACE CONDITION detected: "
2170 "mismatch post-initial-checks between \"%s\" and opened "
2171 "fd lead us to abort!", mbx_lockname);
2172 goto RETURN;
2173 }
2174
2175 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2176
2177 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2178 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2179 {
2180 struct stat ostatbuf;
2181
2182 /* This tests for a specific race condition. Ensure that we still
2183 have the same file. */
2184
2185 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2186 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2187 statbuf.st_dev == ostatbuf.st_dev &&
2188 statbuf.st_ino == ostatbuf.st_ino)
2189 break;
2190 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2191 "between creation and locking\n", mbx_lockname);
2192 }
2193
2194 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2195 strerror(errno));
2196 (void)close(mbx_lockfd);
2197 mbx_lockfd = -1;
2198 }
2199 else
2200 {
2201 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2202 filename, strerror(errno));
2203 }
2204 }
2205 #endif /* SUPPORT_MBX */
2206
2207 else break; /* No on-file locking required; break the open/lock loop */
2208
2209 DEBUG(D_transport)
2210 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2211
2212 (void)close(fd);
2213 fd = -1;
2214 use_lstat = TRUE; /* Reset to use lstat first */
2215
2216
2217 /* If a blocking call timed out, break the retry loop if the total time
2218 so far is not less than than retries * interval. Use the larger of the
2219 flock() and fcntl() timeouts. */
2220
2221 if (sigalrm_seen &&
2222 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2223 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2224 ob->lock_retries * ob->lock_interval)
2225 i = ob->lock_retries;
2226
2227 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2228 flock() that caused the problem. */
2229
2230 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2231 }
2232
2233 /* Test for exceeding the maximum number of tries. Either the file remains
2234 locked, or, if we haven't got it open, something is terribly wrong... */
2235
2236 if (i >= ob->lock_retries)
2237 {
2238 if (!file_opened)
2239 {
2240 addr->basic_errno = ERRNO_EXISTRACE;
2241 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2242 addr->special_action = SPECIAL_FREEZE;
2243 }
2244 else
2245 {
2246 addr->basic_errno = ERRNO_LOCKFAILED;
2247 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2248 filename);
2249 }
2250 goto RETURN;
2251 }
2252
2253 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2254
2255 /* Save access time (for subsequent restoration), modification time (for
2256 restoration if updating fails), size of file (for comsat and for re-setting if
2257 delivery fails in the middle - e.g. for quota exceeded). */
2258
2259 if (fstat(fd, &statbuf) < 0)
2260 {
2261 addr->basic_errno = errno;
2262 addr->message = string_sprintf("while fstatting opened mailbox %s",
2263 filename);
2264 goto RETURN;
2265 }
2266
2267 times.actime = statbuf.st_atime;
2268 times.modtime = statbuf.st_mtime;
2269 saved_size = statbuf.st_size;
2270 if (mailbox_size < 0) mailbox_size = saved_size;
2271 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2272 }
2273
2274 /* Prepare for writing to a new file (as opposed to appending to an old one).
2275 There are several different formats, but there is preliminary stuff concerned
2276 with quotas that applies to all of them. Finding the current size by directory
2277 scanning is expensive; for maildirs some fudges have been invented:
2278
2279 (1) A regex can be used to extract a file size from its name;
2280 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2281 mailbox size.
2282 */
2283
2284 else
2285 {
2286 uschar *check_path = path; /* Default quota check path */
2287 const pcre *regex = NULL; /* Regex for file size from file name */
2288
2289 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2290 {
2291 addr->basic_errno = ERRNO_BADCREATE;
2292 addr->message = string_sprintf("tried to create file in %s, but "
2293 "file creation outside the home directory is not permitted", path);
2294 goto RETURN;
2295 }
2296
2297 #ifdef SUPPORT_MAILDIR
2298 /* For a maildir delivery, ensure that all the relevant directories exist,
2299 and a maildirfolder file if necessary. */
2300
2301 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2302 ob->create_directory, ob->dirmode, ob->maildirfolder_create_regex))
2303 return FALSE;
2304 #endif /* SUPPORT_MAILDIR */
2305
2306 /* If we are going to do a quota check, of if maildir_use_size_file is set
2307 for a maildir delivery, compile the regular expression if there is one. We
2308 may also need to adjust the path that is used. We need to do this for
2309 maildir_use_size_file even if the quota is unset, because we still want to
2310 create the file. When maildir support is not compiled,
2311 ob->maildir_use_size_file is always FALSE. */
2312
2313 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2314 {
2315 const uschar *error;
2316 int offset;
2317
2318 /* Compile the regex if there is one. */
2319
2320 if (ob->quota_size_regex != NULL)
2321 {
2322 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2323 (const char **)&error, &offset, NULL);
2324 if (regex == NULL)
2325 {
2326 addr->message = string_sprintf("appendfile: regular expression "
2327 "error: %s at offset %d while compiling %s", error, offset,
2328 ob->quota_size_regex);
2329 return FALSE;
2330 }
2331 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2332 ob->quota_size_regex);
2333 }
2334
2335 /* Use an explicitly configured directory if set */
2336
2337 if (ob->quota_directory != NULL)
2338 {
2339 check_path = expand_string(ob->quota_directory);
2340 if (check_path == NULL)
2341 {
2342 addr->transport_return = PANIC;
2343 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2344 "name for %s transport) failed: %s", ob->quota_directory,
2345 tblock->name, expand_string_message);
2346 return FALSE;
2347 }
2348
2349 if (check_path[0] != '/')
2350 {
2351 addr->message = string_sprintf("appendfile: quota_directory name "
2352 "\"%s\" is not absolute", check_path);
2353 addr->basic_errno = ERRNO_NOTABSOLUTE;
2354 return FALSE;
2355 }
2356 }
2357
2358 #ifdef SUPPORT_MAILDIR
2359 /* Otherwise, if we are handling a maildir delivery, and the directory
2360 contains a file called maildirfolder, this is a maildir++ feature telling
2361 us that this is a sub-directory of the real inbox. We should therefore do
2362 the quota check on the parent directory. Beware of the special case when
2363 the directory name itself ends in a slash. */
2364
2365 else if (mbformat == mbf_maildir)
2366 {
2367 struct stat statbuf;
2368 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2369 {
2370 uschar *new_check_path = string_copy(check_path);
2371 uschar *slash = Ustrrchr(new_check_path, '/');
2372 if (slash != NULL)
2373 {
2374 if (slash[1] == 0)
2375 {
2376 *slash = 0;
2377 slash = Ustrrchr(new_check_path, '/');
2378 }
2379 if (slash != NULL)
2380 {
2381 *slash = 0;
2382 check_path = new_check_path;
2383 DEBUG(D_transport) debug_printf("maildirfolder file exists: "
2384 "quota check directory changed to %s\n", check_path);
2385 }
2386 }
2387 }
2388 }
2389 #endif /* SUPPORT_MAILDIR */
2390 }
2391
2392 /* If we are using maildirsize files, we need to ensure that such a file
2393 exists and, if necessary, recalculate its contents. As a byproduct of this,
2394 we obtain the current size of the maildir. If no quota is to be enforced
2395 (ob->quota_value == 0), we still need the size if a threshold check will
2396 happen later.
2397
2398 Another regular expression is used to determine which directories inside the
2399 maildir are going to be counted. */
2400
2401 #ifdef SUPPORT_MAILDIR
2402 if (ob->maildir_use_size_file)
2403 {
2404 const pcre *dir_regex = NULL;
2405 const uschar *error;
2406 int offset;
2407
2408 if (ob->maildir_dir_regex != NULL)
2409 {
2410 int check_path_len = Ustrlen(check_path);
2411
2412 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2413 (const char **)&error, &offset, NULL);
2414 if (dir_regex == NULL)
2415 {
2416 addr->message = string_sprintf("appendfile: regular expression "
2417 "error: %s at offset %d while compiling %s", error, offset,
2418 ob->maildir_dir_regex);
2419 return FALSE;
2420 }
2421
2422 DEBUG(D_transport)
2423 debug_printf("using regex for maildir directory selection: %s\n",
2424 ob->maildir_dir_regex);
2425
2426 /* Check to see if we are delivering into an ignored directory, that is,
2427 if the delivery path starts with the quota check path, and the rest
2428 of the deliver path matches the regex; if so, set a flag to disable quota
2429 checking and maildirsize updating. */
2430
2431 if (Ustrncmp(path, check_path, check_path_len) == 0)
2432 {
2433 uschar *s = path + check_path_len;
2434 while (*s == '/') s++;
2435 s = (*s == 0)? US "new" : string_sprintf("%s/new", s);
2436 if (pcre_exec(dir_regex, NULL, CS s, Ustrlen(s), 0, 0, NULL, 0) < 0)
2437 {
2438 disable_quota = TRUE;
2439 DEBUG(D_transport) debug_printf("delivery directory does not match "
2440 "maildir_quota_directory_regex: disabling quota\n");
2441 }
2442 }
2443 }
2444
2445 /* Quota enforcement; create and check the file. There is some discussion
2446 about whether this should happen if the quota is unset. At present, Exim
2447 always creates the file. If we ever want to change this, uncomment
2448 appropriate lines below, possibly doing a check on some option. */
2449
2450 /* if (???? || ob->quota_value > 0) */
2451
2452 if (!disable_quota)
2453 {
2454 off_t size;
2455 int filecount;
2456
2457 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2458 &size, &filecount);
2459
2460 if (maildirsize_fd == -1)
2461 {
2462 addr->basic_errno = errno;
2463 addr->message = string_sprintf("while opening or reading "
2464 "%s/maildirsize", check_path);
2465 return FALSE;
2466 }
2467 /* can also return -2, which means that the file was removed because of
2468 raciness; but in this case, the size & filecount will still have been
2469 updated. */
2470
2471 if (mailbox_size < 0) mailbox_size = size;
2472 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2473 }
2474
2475 /* No quota enforcement; ensure file does *not* exist; calculate size if
2476 needed. */
2477
2478 /* else
2479 * {
2480 * time_t old_latest;
2481 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2482 * if (THRESHOLD_CHECK)
2483 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2484 * regex, dir_regex, FALSE);
2485 * }
2486 */
2487
2488 }
2489 #endif /* SUPPORT_MAILDIR */
2490
2491 /* Otherwise if we are going to do a quota check later on, and the mailbox
2492 size is not set, find the current size of the mailbox. Ditto for the file
2493 count. Note that ob->quota_filecount_value cannot be set without
2494 ob->quota_value being set. */
2495
2496 if (!disable_quota &&
2497 (ob->quota_value > 0 || THRESHOLD_CHECK) &&
2498 (mailbox_size < 0 ||
2499 (mailbox_filecount < 0 && ob->quota_filecount_value > 0)))
2500 {
2501 off_t size;
2502 int filecount = 0;
2503 DEBUG(D_transport)
2504 debug_printf("quota checks on directory %s\n", check_path);
2505 size = check_dir_size(check_path, &filecount, regex);
2506 if (mailbox_size < 0) mailbox_size = size;
2507 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2508 }
2509
2510 /* Handle the case of creating a unique file in a given directory (not in
2511 maildir or mailstore format - this is how smail did it). A temporary name is
2512 used to create the file. Later, when it is written, the name is changed to a
2513 unique one. There is no need to lock the file. An attempt is made to create
2514 the directory if it does not exist. */
2515
2516 if (mbformat == mbf_smail)
2517 {
2518 DEBUG(D_transport)
2519 debug_printf("delivering to new file in %s\n", path);
2520 filename = dataname =
2521 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2522 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2523 if (fd < 0 && /* failed to open, and */
2524 (errno != ENOENT || /* either not non-exist */
2525 !ob->create_directory || /* or not allowed to make */
2526 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2527 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2528 {
2529 addr->basic_errno = errno;
2530 addr->message = string_sprintf("while creating file %s", filename);
2531 return FALSE;
2532 }
2533 }
2534
2535 #ifdef SUPPORT_MAILDIR
2536
2537 /* Handle the case of a unique file in maildir format. The file is written to
2538 the tmp subdirectory, with a prescribed form of name. */
2539
2540 else if (mbformat == mbf_maildir)
2541 {
2542 DEBUG(D_transport)
2543 debug_printf("delivering in maildir format in %s\n", path);
2544
2545 nametag = ob->maildir_tag;
2546
2547 /* Check that nametag expands successfully; a hard failure causes a panic
2548 return. The actual expansion for use happens again later, when
2549 $message_size is accurately known. */
2550
2551 if (nametag != NULL && expand_string(nametag) == NULL &&
2552 !expand_string_forcedfail)
2553 {
2554 addr->transport_return = PANIC;
2555 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2556 "for %s transport) failed: %s", nametag, tblock->name,
2557 expand_string_message);
2558 return FALSE;
2559 }
2560
2561 /* We ensured the existence of all the relevant directories above. Attempt
2562 to open the temporary file a limited number of times. I think this rather
2563 scary-looking for statement is actually OK. If open succeeds, the loop is
2564 broken; if not, there is a test on the value of i. Get the time again
2565 afresh each time round the loop. Its value goes into a variable that is
2566 checked at the end, to make sure we don't release this process until the
2567 clock has ticked. */
2568
2569 for (i = 1;; i++)
2570 {
2571 uschar *basename;
2572
2573 (void)gettimeofday(&msg_tv, NULL);
2574 basename = string_sprintf(TIME_T_FMT ".H%luP%lu.%s",
2575 msg_tv.tv_sec, msg_tv.tv_usec, getpid(), primary_hostname);
2576
2577 filename = dataname = string_sprintf("tmp/%s", basename);
2578 newname = string_sprintf("new/%s", basename);
2579
2580 if (Ustat(filename, &statbuf) == 0)
2581 errno = EEXIST;
2582 else if (errno == ENOENT)
2583 {
2584 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2585 if (fd >= 0) break;
2586 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2587 filename, strerror(errno));
2588 }
2589
2590 /* Too many retries - give up */
2591
2592 if (i >= ob->maildir_retries)
2593 {
2594 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2595 filename, i, (i == 1)? "y" : "ies");
2596 addr->basic_errno = errno;
2597 if (errno == errno_quota || errno == ENOSPC)
2598 addr->user_message = US"mailbox is full";
2599 return FALSE;
2600 }
2601
2602 /* Open or stat failed but we haven't tried too many times yet. */
2603
2604 sleep(2);
2605 }
2606
2607 /* Note that we have to ensure the clock has ticked before leaving */
2608
2609 wait_for_tick = TRUE;
2610
2611 /* Why are these here? Put in because they are present in the non-maildir
2612 directory case above. */
2613
2614 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2615 {
2616 addr->basic_errno = errno;
2617 addr->message = string_sprintf("while setting perms on maildir %s",
2618 filename);
2619 return FALSE;
2620 }
2621 }
2622
2623 #endif /* SUPPORT_MAILDIR */
2624
2625 #ifdef SUPPORT_MAILSTORE
2626
2627 /* Handle the case of a unique file in mailstore format. First write the
2628 envelope to a temporary file, then open the main file. The unique base name
2629 for the files consists of the message id plus the pid of this delivery
2630 process. */
2631
2632 else
2633 {
2634 FILE *env_file;
2635 address_item *taddr;
2636 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2637 string_base62((long int)getpid()));
2638
2639 DEBUG(D_transport)
2640 debug_printf("delivering in mailstore format in %s\n", path);
2641
2642 filename = string_sprintf("%s.tmp", mailstore_basename);
2643 newname = string_sprintf("%s.env", mailstore_basename);
2644 dataname = string_sprintf("%s.msg", mailstore_basename);
2645
2646 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2647 if (fd < 0 && /* failed to open, and */
2648 (errno != ENOENT || /* either not non-exist */
2649 !ob->create_directory || /* or not allowed to make */
2650 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2651 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2652 {
2653 addr->basic_errno = errno;
2654 addr->message = string_sprintf("while creating file %s", filename);
2655 return FALSE;
2656 }
2657
2658 /* Why are these here? Put in because they are present in the non-maildir
2659 directory case above. */
2660
2661 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2662 {
2663 addr->basic_errno = errno;
2664 addr->message = string_sprintf("while setting perms on file %s",
2665 filename);
2666 return FALSE;
2667 }
2668
2669 /* Built a C stream from the open file descriptor. */
2670
2671 if ((env_file = fdopen(fd, "wb")) == NULL)
2672 {
2673 addr->basic_errno = errno;
2674 addr->transport_return = PANIC;
2675 addr->message = string_sprintf("fdopen of %s ("
2676 "for %s transport) failed", filename, tblock->name);
2677 (void)close(fd);
2678 Uunlink(filename);
2679 return FALSE;
2680 }
2681
2682 /* Write the envelope file, then close it. */
2683
2684 if (ob->mailstore_prefix != NULL)
2685 {
2686 uschar *s = expand_string(ob->mailstore_prefix);
2687 if (s == NULL)
2688 {
2689 if (!expand_string_forcedfail)
2690 {
2691 addr->transport_return = PANIC;
2692 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2693 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2694 tblock->name, expand_string_message);
2695 (void)fclose(env_file);
2696 Uunlink(filename);
2697 return FALSE;
2698 }
2699 }
2700 else
2701 {
2702 int n = Ustrlen(s);
2703 fprintf(env_file, "%s", CS s);
2704 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2705 }
2706 }
2707
2708 fprintf(env_file, "%s\n", sender_address);
2709
2710 for (taddr = addr; taddr!= NULL; taddr = taddr->next)
2711 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2712
2713 if (ob->mailstore_suffix != NULL)
2714 {
2715 uschar *s = expand_string(ob->mailstore_suffix);
2716 if (s == NULL)
2717 {
2718 if (!expand_string_forcedfail)
2719 {
2720 addr->transport_return = PANIC;
2721 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2722 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2723 tblock->name, expand_string_message);
2724 (void)fclose(env_file);
2725 Uunlink(filename);
2726 return FALSE;
2727 }
2728 }
2729 else
2730 {
2731 int n = Ustrlen(s);
2732 fprintf(env_file, "%s", CS s);
2733 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2734 }
2735 }
2736
2737 if (fclose(env_file) != 0)
2738 {
2739 addr->basic_errno = errno;
2740 addr->message = string_sprintf("while closing %s", filename);
2741 Uunlink(filename);
2742 return FALSE;
2743 }
2744
2745 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2746
2747 /* Now open the data file, and ensure that it has the correct ownership and
2748 mode. */
2749
2750 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2751 if (fd < 0)
2752 {
2753 addr->basic_errno = errno;
2754 addr->message = string_sprintf("while creating file %s", dataname);
2755 Uunlink(filename);
2756 return FALSE;
2757 }
2758 if(Uchown(dataname, uid, gid) || Uchmod(dataname, mode))
2759 {
2760 addr->basic_errno = errno;
2761 addr->message = string_sprintf("while setting perms on file %s",
2762 dataname);
2763 return FALSE;
2764 }
2765 }
2766
2767 #endif /* SUPPORT_MAILSTORE */
2768
2769
2770 /* In all cases of writing to a new file, ensure that the file which is
2771 going to be renamed has the correct ownership and mode. */
2772
2773 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2774 {
2775 addr->basic_errno = errno;
2776 addr->message = string_sprintf("while setting perms on file %s",
2777 filename);
2778 return FALSE;
2779 }
2780 }
2781
2782
2783 /* At last we can write the message to the file, preceded by any configured
2784 prefix line, and followed by any configured suffix line. If there are any
2785 writing errors, we must defer. */
2786
2787 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2788
2789 yield = OK;
2790 errno = 0;
2791
2792 /* If there is a local quota setting, check that we are not going to exceed it
2793 with this message if quota_is_inclusive is set; if it is not set, the check
2794 is for the mailbox already being over quota (i.e. the current message is not
2795 included in the check). */
2796
2797 if (!disable_quota && ob->quota_value > 0)
2798 {
2799 DEBUG(D_transport)
2800 {
2801 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2802 " this message = %d (%sincluded)\n",
2803 ob->quota_value, mailbox_size, message_size,
2804 ob->quota_is_inclusive? "" : "not ");
2805 debug_printf(" file count quota = %d count = %d\n",
2806 ob->quota_filecount_value, mailbox_filecount);
2807 }
2808
2809 if (mailbox_size + (ob->quota_is_inclusive? message_size:0) > ob->quota_value)
2810 {
2811
2812 if (!ob->quota_no_check)
2813 {
2814 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2815 yield = DEFER;
2816 errno = ERRNO_EXIMQUOTA;
2817 }
2818 else DEBUG(D_transport) debug_printf("mailbox quota exceeded but ignored\n");
2819
2820 }
2821
2822 if (ob->quota_filecount_value > 0
2823 && mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2824 ob->quota_filecount_value)
2825 if(!ob->quota_filecount_no_check)
2826 {
2827 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2828 yield = DEFER;
2829 errno = ERRNO_EXIMQUOTA;
2830 filecount_msg = US" filecount";
2831 }
2832 else DEBUG(D_transport) if (ob->quota_filecount_no_check)
2833 debug_printf("mailbox file count quota exceeded but ignored\n");
2834
2835 }
2836
2837 /* If we are writing in MBX format, what we actually do is to write the message
2838 to a temporary file, and then copy it to the real file once we know its size.
2839 This is the most straightforward way of getting the correct length in the
2840 separator line. So, what we do here is to save the real file descriptor, and
2841 replace it with one for a temporary file. The temporary file gets unlinked once
2842 opened, so that it goes away on closure. */
2843
2844 #ifdef SUPPORT_MBX
2845 if (yield == OK && ob->mbx_format)
2846 {
2847 temp_file = tmpfile();
2848 if (temp_file == NULL)
2849 {
2850 addr->basic_errno = errno;
2851 addr->message = US"while setting up temporary file";
2852 yield = DEFER;
2853 goto RETURN;
2854 }
2855 save_fd = fd;
2856 fd = fileno(temp_file);
2857 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2858 }
2859 #endif /* SUPPORT_MBX */
2860
2861 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2862 functions. */
2863
2864 transport_count = 0;
2865 transport_newlines = 0;
2866
2867 /* Write any configured prefix text first */
2868
2869 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2870 {
2871 uschar *prefix = expand_string(ob->message_prefix);
2872 if (prefix == NULL)
2873 {
2874 errno = ERRNO_EXPANDFAIL;
2875 addr->transport_return = PANIC;
2876 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2877 "transport) failed", ob->message_prefix, tblock->name);
2878 yield = DEFER;
2879 }
2880 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2881 }
2882
2883 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2884 various different values for batching are handled outside; if there is more
2885 than one address available here, all must be included. If any address is a
2886 file, use its parent in the RCPT TO. */
2887
2888 if (yield == OK && ob->use_bsmtp)
2889 {
2890 transport_count = 0;
2891 transport_newlines = 0;
2892 if (ob->use_crlf) cr = US"\r";
2893 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2894 yield = DEFER;
2895 else
2896 {
2897 address_item *a;
2898 transport_newlines++;
2899 for (a = addr; a != NULL; a = a->next)
2900 {
2901 address_item *b = testflag(a, af_pfr)? a->parent: a;
2902 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2903 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2904 { yield = DEFER; break; }
2905 transport_newlines++;
2906 }
2907 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2908 yield = DEFER;
2909 else
2910 transport_newlines++;
2911 }
2912 }
2913
2914 /* Now the message itself. The options for transport_write_message were set up
2915 at initialization time. */
2916
2917 if (yield == OK)
2918 {
2919 transport_ctx tctx = {
2920 {fd},
2921 tblock,
2922 addr,
2923 ob->check_string,
2924 ob->escape_string,
2925 ob->options
2926 };
2927 if (!transport_write_message(&tctx, 0))
2928 yield = DEFER;
2929 }
2930
2931 /* Now a configured suffix. */
2932
2933 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2934 {
2935 uschar *suffix = expand_string(ob->message_suffix);
2936 if (suffix == NULL)
2937 {
2938 errno = ERRNO_EXPANDFAIL;
2939 addr->transport_return = PANIC;
2940 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2941 "transport) failed", ob->message_suffix, tblock->name);
2942 yield = DEFER;
2943 }
2944 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2945 }
2946
2947 /* If batch smtp, write the terminating dot. */
2948
2949 if (yield == OK && ob->use_bsmtp ) {
2950 if(!transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2951 else transport_newlines++;
2952 }
2953
2954 /* If MBX format is being used, all that writing was to the temporary file.
2955 However, if there was an earlier failure (Exim quota exceeded, for example),
2956 the temporary file won't have got opened - and no writing will have been done.
2957 If writing was OK, we restore the fd, and call a function that copies the
2958 message in MBX format into the real file. Otherwise use the temporary name in
2959 any messages. */
2960
2961 #ifdef SUPPORT_MBX
2962 if (temp_file != NULL && ob->mbx_format)
2963 {
2964 int mbx_save_errno;
2965 fd = save_fd;
2966
2967 if (yield == OK)
2968 {
2969 transport_count = 0; /* Reset transport count for actual write */
2970 /* No need to reset transport_newlines as we're just using a block copy
2971 * routine so the number won't be affected */
2972 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2973 }
2974 else if (errno >= 0) dataname = US"temporary file";
2975
2976 /* Preserve errno while closing the temporary file. */
2977
2978 mbx_save_errno = errno;
2979 (void)fclose(temp_file);
2980 errno = mbx_save_errno;
2981 }
2982 #endif /* SUPPORT_MBX */
2983
2984 /* Force out the remaining data to check for any errors; some OS don't allow
2985 fsync() to be called for a FIFO. */
2986
2987 if (yield == OK && !isfifo && EXIMfsync(fd) < 0) yield = DEFER;
2988
2989 /* Update message_size and message_linecount to the accurate count of bytes
2990 written, including added headers. Note; we subtract 1 from message_linecount as
2991 this variable doesn't count the new line between the header and the body of the
2992 message. */
2993
2994 message_size = transport_count;
2995 message_linecount = transport_newlines - 1;
2996
2997 /* If using a maildir++ quota file, add this message's size to it, and
2998 close the file descriptor, except when the quota has been disabled because we
2999 are delivering into an uncounted folder. */
3000
3001 #ifdef SUPPORT_MAILDIR
3002 if (!disable_quota)
3003 {
3004 if (yield == OK && maildirsize_fd >= 0)
3005 maildir_record_length(maildirsize_fd, message_size);
3006 maildir_save_errno = errno; /* Preserve errno while closing the file */
3007 if (maildirsize_fd >= 0)
3008 (void)close(maildirsize_fd);
3009 errno = maildir_save_errno;
3010 }
3011 #endif /* SUPPORT_MAILDIR */
3012
3013 /* If there is a quota warning threshold and we are have crossed it with this
3014 message, set the SPECIAL_WARN flag in the address, to cause a warning message
3015 to be sent. */
3016
3017 if (!disable_quota && THRESHOLD_CHECK)
3018 {
3019 off_t threshold = ob->quota_warn_threshold_value;
3020 if (ob->quota_warn_threshold_is_percent)
3021 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
3022 DEBUG(D_transport)
3023 debug_printf("quota = " OFF_T_FMT
3024 " threshold = " OFF_T_FMT
3025 " old size = " OFF_T_FMT
3026 " message size = %d\n",
3027 ob->quota_value, threshold, mailbox_size,
3028 message_size);
3029 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
3030 addr->special_action = SPECIAL_WARN;
3031
3032 /******* You might think that the test ought to be this:
3033 *
3034 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
3035 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
3036 *
3037 * (indeed, I was sent a patch with that in). However, it is possible to
3038 * have a warning threshold without actually imposing a quota, and I have
3039 * therefore kept Exim backwards compatible.
3040 ********/
3041
3042 }
3043
3044 /* Handle error while writing the file. Control should come here directly after
3045 the error, with the reason in errno. In the case of expansion failure in prefix
3046 or suffix, it will be ERRNO_EXPANDFAIL. */
3047
3048 if (yield != OK)
3049 {
3050 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
3051
3052 /* Save the error number. If positive, it will ultimately cause a strerror()
3053 call to generate some text. */
3054
3055 addr->basic_errno = errno;
3056
3057 /* For system or Exim quota excession, or disk full, set more_errno to the
3058 time since the file was last read. If delivery was into a directory, the
3059 time since last read logic is not relevant, in general. However, for maildir
3060 deliveries we can approximate it by looking at the last modified time of the
3061 "new" subdirectory. Since Exim won't be adding new messages, a change to the
3062 "new" subdirectory implies that an MUA has moved a message from there to the
3063 "cur" directory. */
3064
3065 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
3066 {
3067 addr->more_errno = 0;
3068 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
3069
3070 #ifdef SUPPORT_MAILDIR
3071 else if (mbformat == mbf_maildir)
3072 {
3073 struct stat statbuf;
3074 if (Ustat("new", &statbuf) < 0)
3075 {
3076 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
3077 "stat error %d for \"new\": %s\n", errno, strerror(errno));
3078 }
3079 else /* Want a repeatable time when in test harness */
3080 {
3081 addr->more_errno = running_in_test_harness? 10 :
3082 (int)time(NULL) - statbuf.st_mtime;
3083 }
3084 DEBUG(D_transport)
3085 debug_printf("maildir: time since \"new\" directory modified = %s\n",
3086 readconf_printtime(addr->more_errno));
3087 }
3088 #endif /* SUPPORT_MAILDIR */
3089 }
3090
3091 /* Handle system quota excession. Add an explanatory phrase for the error
3092 message, since some systems don't have special quota-excession errors,
3093 and on those that do, "quota" doesn't always mean anything to the user. */
3094
3095 if (errno == errno_quota)
3096 {
3097 #ifndef EDQUOT
3098 addr->message = string_sprintf("mailbox is full "
3099 "(quota exceeded while writing to file %s)", filename);
3100 #else
3101 addr->message = string_sprintf("mailbox is full");
3102 #endif /* EDQUOT */
3103 addr->user_message = US"mailbox is full";
3104 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
3105 dataname,
3106 isdirectory? US"" : US": time since file read = ",
3107 isdirectory? US"" : readconf_printtime(addr->more_errno));
3108 }
3109
3110 /* Handle Exim's own quota-imposition */
3111
3112 else if (errno == ERRNO_EXIMQUOTA)
3113 {
3114 addr->message = string_sprintf("mailbox is full "
3115 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
3116 dataname);
3117 addr->user_message = US"mailbox is full";
3118 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3119 filecount_msg, dataname,
3120 isdirectory? US"" : US": time since file read = ",
3121 isdirectory? US"" : readconf_printtime(addr->more_errno));
3122 }
3123
3124 /* Handle a process failure while writing via a filter; the return
3125 from child_close() is in more_errno. */
3126
3127 else if (errno == ERRNO_FILTER_FAIL)
3128 {
3129 yield = PANIC;
3130 addr->message = string_sprintf("transport filter process failed (%d) "
3131 "while writing to %s%s", addr->more_errno, dataname,
3132 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
3133 }
3134
3135 /* Handle failure to expand header changes */
3136
3137 else if (errno == ERRNO_CHHEADER_FAIL)
3138 {
3139 yield = PANIC;
3140 addr->message =
3141 string_sprintf("failed to expand headers_add or headers_remove while "
3142 "writing to %s: %s", dataname, expand_string_message);
3143 }
3144
3145 /* Handle failure to complete writing of a data block */
3146
3147 else if (errno == ERRNO_WRITEINCOMPLETE)
3148 {
3149 addr->message = string_sprintf("failed to write data block while "
3150 "writing to %s", dataname);
3151 }
3152
3153 /* Handle length mismatch on MBX copying */
3154
3155 #ifdef SUPPORT_MBX
3156 else if (errno == ERRNO_MBXLENGTH)
3157 {
3158 addr->message = string_sprintf("length mismatch while copying MBX "
3159 "temporary file to %s", dataname);
3160 }
3161 #endif /* SUPPORT_MBX */
3162
3163 /* For other errors, a general-purpose explanation, if the message is
3164 not already set. */
3165
3166 else if (addr->message == NULL)
3167 addr->message = string_sprintf("error while writing to %s", dataname);
3168
3169 /* For a file, reset the file size to what it was before we started, leaving
3170 the last modification time unchanged, so it will get reset also. All systems
3171 investigated so far have ftruncate(), whereas not all have the F_FREESP
3172 fcntl() call (BSDI & FreeBSD do not). */
3173
3174 if (!isdirectory && ftruncate(fd, saved_size))
3175 DEBUG(D_transport) debug_printf("Error resetting file size\n");
3176 }
3177
3178 /* Handle successful writing - we want the modification time to be now for
3179 appended files. Remove the default backstop error number. For a directory, now
3180 is the time to rename the file with a unique name. As soon as such a name
3181 appears it may get used by another process, so we close the file first and
3182 check that all is well. */
3183
3184 else
3185 {
3186 times.modtime = time(NULL);
3187 addr->basic_errno = 0;
3188
3189 /* Handle the case of writing to a new file in a directory. This applies
3190 to all single-file formats - maildir, mailstore, and "smail format". */
3191
3192 if (isdirectory)
3193 {
3194 if (fstat(fd, &statbuf) < 0)
3195 {
3196 addr->basic_errno = errno;
3197 addr->message = string_sprintf("while fstatting opened message file %s",
3198 filename);
3199 yield = DEFER;
3200 }
3201
3202 else if (close(fd) < 0)
3203 {
3204 addr->basic_errno = errno;
3205 addr->message = string_sprintf("close() error for %s",
3206 (ob->mailstore_format)? dataname : filename);
3207 yield = DEFER;
3208 }
3209
3210 /* File is successfully written and closed. Arrange to rename it. For the
3211 different kinds of single-file delivery, some games can be played with the
3212 name. The message size is by this time set to the accurate value so that
3213 its value can be used in expansions. */
3214
3215 else
3216 {
3217 uschar *renamename = newname;
3218 fd = -1;
3219
3220 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3221
3222 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3223 situation. The name is built by expanding the directory_file option, and
3224 we make the inode number available for use in this. The expansion was
3225 checked for syntactic validity above, before we wrote the file.
3226
3227 We have to be careful here, in case the file name exists. (In the other
3228 cases, the names used are constructed to be unique.) The rename()
3229 function just replaces an existing file - we don't want that! So instead
3230 of calling rename(), we must use link() and unlink().
3231
3232 In this case, if the link fails because of an existing file, we wait
3233 for one second and try the expansion again, to see if it produces a
3234 different value. Do this up to 5 times unless the name stops c