Don't disable quota when maildirsize lost to races.
[exim.git] / src / src / transports / appendfile.c
1 /* $Cambridge: exim/src/src/transports/appendfile.c,v 1.27 2010/06/07 00:12:42 pdp Exp $ */
2
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
6
7 /* Copyright (c) University of Cambridge 1995 - 2009 */
8 /* See the file NOTICE for conditions of use and distribution. */
9
10
11 #include "../exim.h"
12 #include "appendfile.h"
13
14 #ifdef SUPPORT_MAILDIR
15 #include "tf_maildir.h"
16 #endif
17
18
19 /* Encodings for mailbox formats, and their names. MBX format is actually
20 supported only if SUPPORT_MBX is set. */
21
22 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
23
24 static char *mailbox_formats[] = {
25 "unix", "mbx", "smail", "maildir", "mailstore" };
26
27
28 /* Check warn threshold only if quota size set or not a percentage threshold
29 percentage check should only be done if quota > 0 */
30
31 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
32 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
33
34
35 /* Options specific to the appendfile transport. They must be in alphabetic
36 order (note that "_" comes before the lower case letters). Some of them are
37 stored in the publicly visible instance block - these are flagged with the
38 opt_public flag. */
39
40 optionlist appendfile_transport_options[] = {
41 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
42 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
43 { "*set_use_flock_lock",opt_bool | opt_hidden,
44 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
45 { "*set_use_lockfile", opt_bool | opt_hidden,
46 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
47 #ifdef SUPPORT_MBX
48 { "*set_use_mbx_lock", opt_bool | opt_hidden,
49 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
50 #endif
51 { "allow_fifo", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
53 { "allow_symlink", opt_bool,
54 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
55 { "batch_id", opt_stringptr | opt_public,
56 (void *)offsetof(transport_instance, batch_id) },
57 { "batch_max", opt_int | opt_public,
58 (void *)offsetof(transport_instance, batch_max) },
59 { "check_group", opt_bool,
60 (void *)offsetof(appendfile_transport_options_block, check_group) },
61 { "check_owner", opt_bool,
62 (void *)offsetof(appendfile_transport_options_block, check_owner) },
63 { "check_string", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, check_string) },
65 { "create_directory", opt_bool,
66 (void *)offsetof(appendfile_transport_options_block, create_directory) },
67 { "create_file", opt_stringptr,
68 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
69 { "directory", opt_stringptr,
70 (void *)offsetof(appendfile_transport_options_block, dirname) },
71 { "directory_file", opt_stringptr,
72 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
73 { "directory_mode", opt_octint,
74 (void *)offsetof(appendfile_transport_options_block, dirmode) },
75 { "escape_string", opt_stringptr,
76 (void *)offsetof(appendfile_transport_options_block, escape_string) },
77 { "file", opt_stringptr,
78 (void *)offsetof(appendfile_transport_options_block, filename) },
79 { "file_format", opt_stringptr,
80 (void *)offsetof(appendfile_transport_options_block, file_format) },
81 { "file_must_exist", opt_bool,
82 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
83 { "lock_fcntl_timeout", opt_time,
84 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
85 { "lock_flock_timeout", opt_time,
86 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
87 { "lock_interval", opt_time,
88 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
89 { "lock_retries", opt_int,
90 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
91 { "lockfile_mode", opt_octint,
92 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
93 { "lockfile_timeout", opt_time,
94 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
95 { "mailbox_filecount", opt_stringptr,
96 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
97 { "mailbox_size", opt_stringptr,
98 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
99 #ifdef SUPPORT_MAILDIR
100 { "maildir_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
102 { "maildir_quota_directory_regex", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
104 { "maildir_retries", opt_int,
105 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
106 { "maildir_tag", opt_stringptr,
107 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
108 { "maildir_use_size_file", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
110 { "maildirfolder_create_regex", opt_stringptr,
111 (void *)offsetof(appendfile_transport_options_block, maildirfolder_create_regex ) },
112 #endif /* SUPPORT_MAILDIR */
113 #ifdef SUPPORT_MAILSTORE
114 { "mailstore_format", opt_bool,
115 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
116 { "mailstore_prefix", opt_stringptr,
117 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
118 { "mailstore_suffix", opt_stringptr,
119 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
120 #endif /* SUPPORT_MAILSTORE */
121 #ifdef SUPPORT_MBX
122 { "mbx_format", opt_bool,
123 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
124 #endif /* SUPPORT_MBX */
125 { "message_prefix", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
127 { "message_suffix", opt_stringptr,
128 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
129 { "mode", opt_octint,
130 (void *)offsetof(appendfile_transport_options_block, mode) },
131 { "mode_fail_narrower",opt_bool,
132 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
133 { "notify_comsat", opt_bool,
134 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
135 { "quota", opt_stringptr,
136 (void *)offsetof(appendfile_transport_options_block, quota) },
137 { "quota_directory", opt_stringptr,
138 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
139 { "quota_filecount", opt_stringptr,
140 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
141 { "quota_is_inclusive", opt_bool,
142 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
143 { "quota_size_regex", opt_stringptr,
144 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
145 { "quota_warn_message", opt_stringptr | opt_public,
146 (void *)offsetof(transport_instance, warn_message) },
147 { "quota_warn_threshold", opt_stringptr,
148 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
149 { "use_bsmtp", opt_bool,
150 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
151 { "use_crlf", opt_bool,
152 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
153 { "use_fcntl_lock", opt_bool_set,
154 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
155 { "use_flock_lock", opt_bool_set,
156 (void *)offsetof(appendfile_transport_options_block, use_flock) },
157 { "use_lockfile", opt_bool_set,
158 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
159 #ifdef SUPPORT_MBX
160 { "use_mbx_lock", opt_bool_set,
161 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
162 #endif /* SUPPORT_MBX */
163 };
164
165 /* Size of the options list. An extern variable has to be used so that its
166 address can appear in the tables drtables.c. */
167
168 int appendfile_transport_options_count =
169 sizeof(appendfile_transport_options)/sizeof(optionlist);
170
171 /* Default private options block for the appendfile transport. */
172
173 appendfile_transport_options_block appendfile_transport_option_defaults = {
174 NULL, /* filename */
175 NULL, /* dirname */
176 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
177 NULL, /* message_prefix (default reset in init if not bsmtp) */
178 NULL, /* message_suffix (ditto) */
179 US"anywhere", /* create_file_string (string value for create_file) */
180 NULL, /* quota */
181 NULL, /* quota_directory */
182 NULL, /* quota_filecount */
183 NULL, /* quota_size_regex */
184 NULL, /* quota_warn_threshold */
185 NULL, /* mailbox_size_string */
186 NULL, /* mailbox_filecount_string */
187 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
188 NULL, /* maildir_tag */
189 NULL, /* maildirfolder_create_regex */
190 NULL, /* mailstore_prefix */
191 NULL, /* mailstore_suffix */
192 NULL, /* check_string (default changed for non-bsmtp file)*/
193 NULL, /* escape_string (ditto) */
194 NULL, /* file_format */
195 0, /* quota_value */
196 0, /* quota_warn_threshold_value */
197 -1, /* mailbox_size_value */
198 -1, /* mailbox_filecount_value */
199 0, /* quota_filecount_value */
200 APPENDFILE_MODE, /* mode */
201 APPENDFILE_DIRECTORY_MODE, /* dirmode */
202 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
203 30*60, /* lockfile_timeout */
204 0, /* lock_fcntl_timeout */
205 0, /* lock_flock_timeout */
206 10, /* lock_retries */
207 3, /* lock_interval */
208 10, /* maildir_retries */
209 create_anywhere,/* create_file */
210 0, /* options */
211 FALSE, /* allow_fifo */
212 FALSE, /* allow_symlink */
213 FALSE, /* check_group */
214 TRUE, /* check_owner */
215 TRUE, /* create_directory */
216 FALSE, /* notify_comsat */
217 TRUE, /* use_lockfile */
218 FALSE, /* set_use_lockfile */
219 TRUE, /* use_fcntl */
220 FALSE, /* set_use_fcntl */
221 FALSE, /* use_flock */
222 FALSE, /* set_use_flock */
223 FALSE, /* use_mbx_lock */
224 FALSE, /* set_use_mbx_lock */
225 FALSE, /* use_bsmtp */
226 FALSE, /* use_crlf */
227 FALSE, /* file_must_exist */
228 TRUE, /* mode_fail_narrower */
229 FALSE, /* maildir_format */
230 FALSE, /* maildir_use_size_file */
231 FALSE, /* mailstore_format */
232 FALSE, /* mbx_format */
233 FALSE, /* quota_warn_threshold_is_percent */
234 TRUE /* quota_is_inclusive */
235 };
236
237
238
239 /*************************************************
240 * Setup entry point *
241 *************************************************/
242
243 /* Called for each delivery in the privileged state, just before the uid/gid
244 are changed and the main entry point is called. We use this function to
245 expand any quota settings, so that it can access files that may not be readable
246 by the user. It is also used to pick up external mailbox size information, if
247 set.
248
249 Arguments:
250 tblock points to the transport instance
251 addrlist addresses about to be delivered (not used)
252 dummy not used (doesn't pass back data)
253 uid the uid that will be set (not used)
254 gid the gid that will be set (not used)
255 errmsg where to put an error message
256
257 Returns: OK, FAIL, or DEFER
258 */
259
260 static int
261 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
262 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
263 {
264 appendfile_transport_options_block *ob =
265 (appendfile_transport_options_block *)(tblock->options_block);
266 uschar *q = ob->quota;
267 double default_value = 0.0;
268 int i;
269
270 addrlist = addrlist; /* Keep picky compilers happy */
271 dummy = dummy;
272 uid = uid;
273 gid = gid;
274
275 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
276 mailbox_filecount */
277
278 for (i = 0; i < 5; i++)
279 {
280 double d;
281 uschar *which = NULL;
282
283 if (q == NULL) d = default_value; else
284 {
285 uschar *rest;
286 uschar *s = expand_string(q);
287
288 if (s == NULL)
289 {
290 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
291 "%s", q, tblock->name, expand_string_message);
292 return search_find_defer? DEFER : FAIL;
293 }
294
295 d = Ustrtod(s, &rest);
296
297 /* Handle following characters K, M, G, %, the latter being permitted
298 for quota_warn_threshold only. A threshold with no quota setting is
299 just ignored. */
300
301 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
302 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
303 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
304 else if (*rest == '%' && i == 2)
305 {
306 if (ob->quota_value <= 0 && !ob->maildir_use_size_file) d = 0;
307 else if ((int)d < 0 || (int)d > 100)
308 {
309 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
310 " for %s transport", (int)d, tblock->name);
311 return FAIL;
312 }
313 ob->quota_warn_threshold_is_percent = TRUE;
314 rest++;
315 }
316
317 while (isspace(*rest)) rest++;
318
319 if (*rest != 0)
320 {
321 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
322 "in %s transport", s, q, tblock->name);
323 return FAIL;
324 }
325 }
326
327 /* Set each value, checking for possible overflow. */
328
329 switch (i)
330 {
331 case 0:
332 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4) which = US"quota";
333 ob->quota_value = (off_t)d;
334 q = ob->quota_filecount;
335 break;
336
337 case 1:
338 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"quota_filecount";
339 ob->quota_filecount_value = (int)d;
340 q = ob->quota_warn_threshold;
341 break;
342
343 case 2:
344 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
345 which = US"quota_warn_threshold";
346 ob->quota_warn_threshold_value = (off_t)d;
347 q = ob->mailbox_size_string;
348 default_value = -1.0;
349 break;
350
351 case 3:
352 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
353 which = US"mailbox_size";;
354 ob->mailbox_size_value = (off_t)d;
355 q = ob->mailbox_filecount_string;
356 break;
357
358 case 4:
359 if (d >= 2.0*1024.0*1024.0*1024.0) which = US"mailbox_filecount";
360 ob->mailbox_filecount_value = (int)d;
361 break;
362 }
363
364 if (which != NULL)
365 {
366 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
367 "%s transport", which, d, tblock->name);
368 return FAIL;
369 }
370 }
371
372 return OK;
373 }
374
375
376
377 /*************************************************
378 * Initialization entry point *
379 *************************************************/
380
381 /* Called for each instance, after its options have been read, to
382 enable consistency checks to be done, or anything else that needs
383 to be set up. */
384
385 void
386 appendfile_transport_init(transport_instance *tblock)
387 {
388 appendfile_transport_options_block *ob =
389 (appendfile_transport_options_block *)(tblock->options_block);
390
391 /* Set up the setup entry point, to be called in the privileged state */
392
393 tblock->setup = appendfile_transport_setup;
394
395 /* Lock_retries must be greater than zero */
396
397 if (ob->lock_retries == 0) ob->lock_retries = 1;
398
399 /* Only one of a file name or directory name must be given. */
400
401 if (ob->filename != NULL && ob->dirname != NULL)
402 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
403 "only one of \"file\" or \"directory\" can be specified", tblock->name);
404
405 /* If a file name was specified, neither quota_filecount nor quota_directory
406 must be given. */
407
408 if (ob->filename != NULL)
409 {
410 if (ob->quota_filecount != NULL)
411 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
412 "quota_filecount must not be set without \"directory\"", tblock->name);
413 if (ob->quota_directory != NULL)
414 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
415 "quota_directory must not be set without \"directory\"", tblock->name);
416 }
417
418 /* The default locking depends on whether MBX is set or not. Change the
419 built-in default if none of the lock options has been explicitly set. At least
420 one form of locking is required in all cases, but mbx locking changes the
421 meaning of fcntl and flock locking. */
422
423 /* Not all operating systems provide flock(). For those that do, if flock is
424 requested, the default for fcntl is FALSE. */
425
426 if (ob->use_flock)
427 {
428 #ifdef NO_FLOCK
429 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
430 "flock() support was not available in the operating system when this "
431 "binary was built", tblock->name);
432 #endif /* NO_FLOCK */
433 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
434 }
435
436 #ifdef SUPPORT_MBX
437 if (ob->mbx_format)
438 {
439 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
440 !ob->set_use_mbx_lock)
441 {
442 ob->use_lockfile = ob->use_flock = FALSE;
443 ob->use_mbx_lock = ob->use_fcntl = TRUE;
444 }
445 else if (ob->use_mbx_lock)
446 {
447 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
448 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
449 if (!ob->set_use_flock) ob->use_flock = FALSE;
450 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
451 }
452 }
453 #endif /* SUPPORT_MBX */
454
455 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
456 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
457 "no locking configured", tblock->name);
458
459 /* Unset timeouts for non-used locking types */
460
461 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
462 if (!ob->use_flock) ob->lock_flock_timeout = 0;
463
464 /* If a directory name was specified, only one of maildir or mailstore may be
465 specified, and if quota_filecount or quota_directory is given, quota must
466 be set. */
467
468 if (ob->dirname != NULL)
469 {
470 if (ob->maildir_format && ob->mailstore_format)
471 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
472 "only one of maildir and mailstore may be specified", tblock->name);
473 if (ob->quota_filecount != NULL && ob->quota == NULL)
474 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
475 "quota must be set if quota_filecount is set", tblock->name);
476 if (ob->quota_directory != NULL && ob->quota == NULL)
477 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
478 "quota must be set if quota_directory is set", tblock->name);
479 }
480
481 /* If a fixed uid field is set, then a gid field must also be set. */
482
483 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
484 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
485 "user set without group for the %s transport", tblock->name);
486
487 /* If "create_file" is set, check that a valid option is given, and set the
488 integer variable. */
489
490 if (ob->create_file_string != NULL)
491 {
492 int value = 0;
493 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
494 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
495 create_belowhome;
496 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
497 value = create_inhome;
498 else
499 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
500 "invalid value given for \"file_create\" for the %s transport: %s",
501 tblock->name, ob->create_file_string);
502 ob->create_file = value;
503 }
504
505 /* If quota_warn_threshold is set, set up default for warn_message. It may
506 not be used if the actual threshold for a given delivery ends up as zero,
507 of if it's given as a percentage and there's no quota setting. */
508
509 if (ob->quota_warn_threshold != NULL)
510 {
511 if (tblock->warn_message == NULL) tblock->warn_message = US
512 "To: $local_part@$domain\n"
513 "Subject: Your mailbox\n\n"
514 "This message is automatically created by mail delivery software (Exim).\n\n"
515 "The size of your mailbox has exceeded a warning threshold that is\n"
516 "set by the system administrator.\n";
517 }
518
519 /* If batch SMTP is set, force the check and escape strings, and arrange that
520 headers are also escaped. */
521
522 if (ob->use_bsmtp)
523 {
524 ob->check_string = US".";
525 ob->escape_string = US"..";
526 ob->options |= topt_escape_headers;
527 }
528
529 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
530 insert default values for for the affixes and the check/escape strings. */
531
532 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
533 {
534 if (ob->message_prefix == NULL) ob->message_prefix =
535 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
536 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
537 if (ob->check_string == NULL) ob->check_string = US"From ";
538 if (ob->escape_string == NULL) ob->escape_string = US">From ";
539
540 }
541
542 /* Set up the bitwise options for transport_write_message from the various
543 driver options. Only one of body_only and headers_only can be set. */
544
545 ob->options |=
546 (tblock->body_only? topt_no_headers : 0) |
547 (tblock->headers_only? topt_no_body : 0) |
548 (tblock->return_path_add? topt_add_return_path : 0) |
549 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
550 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
551 ((ob->use_crlf || ob->mbx_format)? topt_use_crlf : 0);
552 }
553
554
555
556 /*************************************************
557 * Notify comsat *
558 *************************************************/
559
560 /* The comsat daemon is the thing that provides asynchronous notification of
561 the arrival of local messages, if requested by the user by "biff y". It is a
562 BSD thing that uses a TCP/IP protocol for communication. A message consisting
563 of the text "user@offset" must be sent, where offset is the place in the
564 mailbox where new mail starts. There is no scope for telling it which file to
565 look at, which makes it a less than useful if mail is being delivered into a
566 non-standard place such as the user's home directory. In fact, it doesn't seem
567 to pay much attention to the offset.
568
569 Arguments:
570 user user name
571 offset offset in mailbox
572
573 Returns: nothing
574 */
575
576 static void
577 notify_comsat(uschar *user, off_t offset)
578 {
579 struct servent *sp;
580 host_item host;
581 host_item *h;
582 uschar buffer[256];
583
584 DEBUG(D_transport) debug_printf("notify_comsat called\n");
585
586 sprintf(CS buffer, "%.200s@" OFF_T_FMT "\n", user, offset);
587
588 if ((sp = getservbyname("biff", "udp")) == NULL)
589 {
590 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
591 return;
592 }
593
594 host.name = US"localhost";
595 host.next = NULL;
596
597
598 /* This code is all set up to look up "localhost" and use all its addresses
599 until one succeeds. However, it appears that at least on some systems, comsat
600 doesn't listen on the ::1 address. So for the moment, just force the address to
601 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
602 can be changed. (But actually, comsat is probably dying out anyway.) */
603
604 /******
605 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
606 {
607 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
608 return;
609 }
610 ******/
611
612 host.address = US"127.0.0.1";
613
614
615 for (h = &host; h != NULL; h = h->next)
616 {
617 int sock, rc;
618 int host_af = (Ustrchr(h->address, ':') != NULL)? AF_INET6 : AF_INET;
619
620 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
621
622 sock = ip_socket(SOCK_DGRAM, host_af);
623 if (sock < 0) continue;
624
625 /* Connect never fails for a UDP socket, so don't set a timeout. */
626
627 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0);
628 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
629 (void)close(sock);
630
631 if (rc >= 0) break;
632 DEBUG(D_transport)
633 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
634 h->address);
635 }
636 }
637
638
639
640 /*************************************************
641 * Check the format of a file *
642 *************************************************/
643
644 /* This function is called when file_format is set, to check that an existing
645 file has the right format. The format string contains text/transport pairs. The
646 string matching is literal. we just read big_buffer_size bytes, because this is
647 all about the first few bytes of a file.
648
649 Arguments:
650 cfd the open file
651 tblock the transport block
652 addr the address block - for inserting error data
653
654 Returns: pointer to the required transport, or NULL
655 */
656
657 transport_instance *
658 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
659 {
660 uschar *format =
661 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
662 uschar data[256];
663 int len = read(cfd, data, sizeof(data));
664 int sep = 0;
665 uschar *s;
666
667 DEBUG(D_transport) debug_printf("checking file format\n");
668
669 /* An empty file matches the current transport */
670
671 if (len == 0) return tblock;
672
673 /* Search the formats for a match */
674
675 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size))!= NULL)
676 {
677 int slen = Ustrlen(s);
678 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
679 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
680 if (match)
681 {
682 transport_instance *tt;
683 for (tt = transports; tt != NULL; tt = tt->next)
684 if (Ustrcmp(tp, tt->name) == 0)
685 {
686 DEBUG(D_transport)
687 debug_printf("file format -> %s transport\n", tt->name);
688 return tt;
689 }
690 addr->basic_errno = ERRNO_BADTRANSPORT;
691 addr->message = string_sprintf("%s transport (for %.*s format) not found",
692 tp, slen, data);
693 return NULL;
694 }
695 }
696
697 /* Failed to find a match */
698
699 addr->basic_errno = ERRNO_FORMATUNKNOWN;
700 addr->message = US"mailbox file format unrecognized";
701 return NULL;
702 }
703
704
705
706
707 /*************************************************
708 * Check directory's files for quota *
709 *************************************************/
710
711 /* This function is called if quota is set for one of the delivery modes that
712 delivers into a specific directory. It scans the directory and stats all the
713 files in order to get a total size and count. This is an expensive thing to do,
714 but some people are prepared to bear the cost. Alternatively, if size_regex is
715 set, it is used as a regex to try to extract the size from the file name, a
716 strategy that some people use on maildir files on systems where the users have
717 no shell access.
718
719 The function is global, because it is also called from tf_maildir.c for maildir
720 folders (which should contain only regular files).
721
722 Note: Any problems can be written to debugging output, but cannot be written to
723 the log, because we are running as an unprivileged user here.
724
725 Arguments:
726 dirname the name of the directory
727 countptr where to add the file count (because this function recurses)
728 regex a compiled regex to get the size from a name
729
730 Returns: the sum of the sizes of the stattable files
731 zero if the directory cannot be opened
732 */
733
734 off_t
735 check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
736 {
737 DIR *dir;
738 off_t sum = 0;
739 int count = *countptr;
740 struct dirent *ent;
741 struct stat statbuf;
742
743 dir = opendir(CS dirname);
744 if (dir == NULL) return 0;
745
746 while ((ent = readdir(dir)) != NULL)
747 {
748 uschar *name = US ent->d_name;
749 uschar buffer[1024];
750
751 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
752
753 count++;
754
755 /* If there's a regex, try to find the size using it */
756
757 if (regex != NULL)
758 {
759 int ovector[6];
760 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
761 {
762 uschar *endptr;
763 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
764 if (endptr == name + ovector[3])
765 {
766 sum += size;
767 DEBUG(D_transport)
768 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
769 size);
770 continue;
771 }
772 }
773 DEBUG(D_transport)
774 debug_printf("check_dir_size: regex did not match %s\n", name);
775 }
776
777 /* No regex or no match for the regex, or captured non-digits */
778
779 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
780 {
781 DEBUG(D_transport)
782 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
783 name);
784 continue;
785 }
786
787 if (Ustat(buffer, &statbuf) < 0)
788 {
789 DEBUG(D_transport)
790 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
791 strerror(errno));
792 continue;
793 }
794
795 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
796 sum += statbuf.st_size;
797 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
798 sum += check_dir_size(buffer, &count, regex);
799 }
800
801 closedir(dir);
802 DEBUG(D_transport)
803 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
804 sum, count);
805
806 *countptr = count;
807 return sum;
808 }
809
810
811
812
813 /*************************************************
814 * Apply a lock to a file descriptor *
815 *************************************************/
816
817 /* This function applies a lock to a file descriptor, using a blocking or
818 non-blocking lock, depending on the timeout value. It can apply either or
819 both of a fcntl() and a flock() lock. However, not all OS support flock();
820 for those that don't, the use_flock option cannot be set.
821
822 Arguments:
823 fd the file descriptor
824 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
825 fcntl() format); the flock() type is deduced if needed
826 dofcntl do fcntl() locking
827 fcntltime non-zero to use blocking fcntl()
828 doflock do flock() locking
829 flocktime non-zero to use blocking flock()
830
831 Returns: yield of the fcntl() or flock() call, with errno preserved;
832 sigalrm_seen set if there has been a timeout
833 */
834
835 static int
836 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
837 int flocktime)
838 {
839 int yield = 0;
840 int save_errno;
841 struct flock lock_data;
842 lock_data.l_type = fcntltype;
843 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
844
845 sigalrm_seen = FALSE;
846
847 if (dofcntl)
848 {
849 if (fcntltime > 0)
850 {
851 alarm(fcntltime);
852 yield = fcntl(fd, F_SETLKW, &lock_data);
853 save_errno = errno;
854 alarm(0);
855 errno = save_errno;
856 }
857 else yield = fcntl(fd, F_SETLK, &lock_data);
858 }
859
860 #ifndef NO_FLOCK
861 if (doflock && (yield >= 0))
862 {
863 int flocktype = (fcntltype == F_WRLCK)? LOCK_EX : LOCK_SH;
864 if (flocktime > 0)
865 {
866 alarm(flocktime);
867 yield = flock(fd, flocktype);
868 save_errno = errno;
869 alarm(0);
870 errno = save_errno;
871 }
872 else yield = flock(fd, flocktype | LOCK_NB);
873 }
874 #endif /* NO_FLOCK */
875
876 return yield;
877 }
878
879
880
881
882 #ifdef SUPPORT_MBX
883 /*************************************************
884 * Copy message into MBX mailbox *
885 *************************************************/
886
887 /* This function is called when a message intended for a MBX mailbox has been
888 written to a temporary file. We can now get the size of the message and then
889 copy it in MBX format to the mailbox.
890
891 Arguments:
892 to_fd fd to write to (the real mailbox)
893 from_fd fd to read from (the temporary file)
894 saved_size current size of mailbox
895
896 Returns: OK if all went well, DEFER otherwise, with errno preserved
897 the number of bytes written are added to transport_count
898 by virtue of calling transport_write_block()
899 */
900
901 /* Values taken from c-client */
902
903 #define MBX_HDRSIZE 2048
904 #define MBX_NUSERFLAGS 30
905
906 static int
907 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
908 {
909 int used;
910 off_t size;
911 struct stat statbuf;
912
913 /* If the current mailbox size is zero, write a header block */
914
915 if (saved_size == 0)
916 {
917 int i;
918 uschar *s;
919 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
920 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
921 (long int)time(NULL));
922 for (i = 0; i < MBX_NUSERFLAGS; i++)
923 sprintf (CS(s += Ustrlen(s)), "\015\012");
924 if (!transport_write_block (to_fd, deliver_out_buffer, MBX_HDRSIZE))
925 return DEFER;
926 }
927
928 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
929
930 /* Now construct the message's header from the time and the RFC822 file
931 size, including CRLFs, which is the size of the input (temporary) file. */
932
933 if (fstat(from_fd, &statbuf) < 0) return DEFER;
934 size = statbuf.st_size;
935
936 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
937 tod_stamp(tod_mbx), size, 0L, 0, 0);
938 used = Ustrlen(deliver_out_buffer);
939
940 /* Rewind the temporary file, and copy it over in chunks. */
941
942 lseek(from_fd, 0 , SEEK_SET);
943
944 while (size > 0)
945 {
946 int len = read(from_fd, deliver_out_buffer + used,
947 DELIVER_OUT_BUFFER_SIZE - used);
948 if (len <= 0)
949 {
950 if (len == 0) errno = ERRNO_MBXLENGTH;
951 return DEFER;
952 }
953 if (!transport_write_block(to_fd, deliver_out_buffer, used + len))
954 return DEFER;
955 size -= len;
956 used = 0;
957 }
958
959 return OK;
960 }
961 #endif /* SUPPORT_MBX */
962
963
964
965 /*************************************************
966 * Check creation is permitted *
967 *************************************************/
968
969 /* This function checks whether a given file name is permitted to be created,
970 as controlled by the create_file option. If no home directory is set, however,
971 we can't do any tests.
972
973 Arguments:
974 filename the file name
975 create_file the ob->create_file option
976
977 Returns: TRUE if creation is permitted
978 */
979
980 static BOOL
981 check_creation(uschar *filename, int create_file)
982 {
983 BOOL yield = TRUE;
984
985 if (deliver_home != NULL && create_file != create_anywhere)
986 {
987 int len = Ustrlen(deliver_home);
988 uschar *file = filename;
989
990 while (file[0] == '/' && file[1] == '/') file++;
991 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
992 ( Ustrchr(file+len+2, '/') != NULL &&
993 (
994 create_file != create_belowhome ||
995 Ustrstr(file+len, "/../") != NULL
996 )
997 )
998 ) yield = FALSE;
999
1000 /* If yield is TRUE, the file name starts with the home directory, and does
1001 not contain any instances of "/../" in the "belowhome" case. However, it may
1002 still contain symbolic links. We can check for this by making use of
1003 realpath(), which most Unixes seem to have (but make it possible to cut this
1004 out). We can't just use realpath() on the whole file name, because we know
1005 the file itself doesn't exist, and intermediate directories may also not
1006 exist. What we want to know is the real path of the longest existing part of
1007 the path. That must match the home directory's beginning, whichever is the
1008 shorter. */
1009
1010 #ifndef NO_REALPATH
1011 if (yield && create_file == create_belowhome)
1012 {
1013 uschar *slash, *next;
1014 uschar *rp = NULL;
1015 for (slash = Ustrrchr(file, '/'); /* There is known to be one */
1016 rp == NULL && slash > file; /* Stop if reached beginning */
1017 slash = next)
1018 {
1019 *slash = 0;
1020 rp = US realpath(CS file, CS big_buffer);
1021 next = Ustrrchr(file, '/');
1022 *slash = '/';
1023 }
1024
1025 /* If rp == NULL it means that none of the relevant directories exist.
1026 This is not a problem here - it means that no symbolic links can exist,
1027 which is all we are worried about. Otherwise, we must compare it
1028 against the start of the home directory. However, that may itself
1029 contain symbolic links, so we have to "realpath" it as well, if
1030 possible. */
1031
1032 if (rp != NULL)
1033 {
1034 uschar hdbuffer[PATH_MAX+1];
1035 uschar *rph = deliver_home;
1036 int rlen = Ustrlen(big_buffer);
1037
1038 rp = US realpath(CS deliver_home, CS hdbuffer);
1039 if (rp != NULL)
1040 {
1041 rph = hdbuffer;
1042 len = Ustrlen(rph);
1043 }
1044
1045 if (rlen > len) rlen = len;
1046 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1047 {
1048 yield = FALSE;
1049 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1050 big_buffer, deliver_home);
1051 }
1052 }
1053 }
1054 #endif /* NO_REALPATH */
1055 }
1056
1057 return yield;
1058 }
1059
1060
1061
1062 /*************************************************
1063 * Main entry point *
1064 *************************************************/
1065
1066 /* See local README for general interface details. This transport always
1067 returns FALSE, indicating that the status which has been placed in the first
1068 address should be copied to any other addresses in a batch.
1069
1070 Appendfile delivery is tricky and has led to various security problems in other
1071 mailers. The logic used here is therefore laid out in some detail. When this
1072 function is called, we are running in a subprocess which has had its gid and
1073 uid set to the appropriate values. Therefore, we cannot write directly to the
1074 exim logs. Any errors must be handled by setting appropriate return codes.
1075 Note that the default setting for addr->transport_return is DEFER, so it need
1076 not be set unless some other value is required.
1077
1078 The code below calls geteuid() rather than getuid() to get the current uid
1079 because in weird configurations not running setuid root there may be a
1080 difference. In the standard configuration, where setuid() has been used in the
1081 delivery process, there will be no difference between the uid and the euid.
1082
1083 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1084 alias expansion. Otherwise, there must be a configured file name or
1085 directory name.
1086
1087 The following items apply in the case when a file name (as opposed to a
1088 directory name) is given, that is, when appending to a single file:
1089
1090 (2f) Expand the file name.
1091
1092 (3f) If the file name is /dev/null, return success (optimization).
1093
1094 (4f) If the file_format options is set, open the file for reading, and check
1095 that the bytes at the start of the file match one of the given strings.
1096 If the check indicates a transport other than the current one should be
1097 used, pass control to that other transport. Otherwise continue. An empty
1098 or non-existent file matches the current transport. The file is closed
1099 after the check.
1100
1101 (5f) If a lock file is required, create it (see extensive separate comments
1102 below about the algorithm for doing this). It is important to do this
1103 before opening the mailbox if NFS is in use.
1104
1105 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1106 details of any symbolic link.
1107
1108 (7f) If the file already exists:
1109
1110 Check the owner and group if necessary, and defer if they are wrong.
1111
1112 If it is a symbolic link AND the allow_symlink option is set (NOT the
1113 default), go back to (6f) but this time use stat() instead of lstat().
1114
1115 If it's not a regular file (or FIFO when permitted), defer delivery.
1116
1117 Check permissions. If the required permissions are *less* than the
1118 existing ones, or supplied by the address (often by the user via filter),
1119 chmod() the file. Otherwise, defer.
1120
1121 Save the inode number.
1122
1123 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1124
1125 If open fails because the file does not exist, go to (6f); on any other
1126 failure, defer.
1127
1128 Check the inode number hasn't changed - I realize this isn't perfect (an
1129 inode can be reused) but it's cheap and will catch some of the races.
1130
1131 Check it's still a regular file (or FIFO if permitted).
1132
1133 Check that the owner and permissions haven't changed.
1134
1135 If file_format is set, check that the file still matches the format for
1136 the current transport. If not, defer delivery.
1137
1138 (8f) If file does not exist initially:
1139
1140 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1141 this is via a symbolic link (only possible if allow_symlinks is set), in
1142 which case don't use O_EXCL, as it dosn't work.
1143
1144 If open fails because the file already exists, go to (6f). To avoid
1145 looping for ever in a situation where the file is continuously being
1146 created and deleted, all of this happens inside a loop that operates
1147 lock_retries times and includes the fcntl and flock locking. If the
1148 loop completes without the file getting opened, defer and request
1149 freezing, because something really weird is happening.
1150
1151 If open fails for any other reason, defer for subsequent delivery except
1152 when this is a file delivery resulting from an alias or forward expansion
1153 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1154 most likely a user rather than a configuration error.
1155
1156 (9f) We now have the file checked and open for writing. If so configured, lock
1157 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1158 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1159 still fails, give up and defer delivery.
1160
1161 (10f)Save the access time (for subsequent restoration) and the size of the
1162 file, for comsat and for re-setting if delivery fails in the middle -
1163 e.g. for quota exceeded.
1164
1165 The following items apply in the case when a directory name is given:
1166
1167 (2d) Create a new file in the directory using a temporary name, by opening for
1168 writing and with O_CREAT. If maildir format is being used, the file
1169 is created in a temporary subdirectory with a prescribed name. If
1170 mailstore format is being used, the envelope file is first created with a
1171 temporary name, then the data file.
1172
1173 The following items apply in all cases:
1174
1175 (11) We now have the file open for writing, and locked if it was given as a
1176 file name. Write the message and flush the file, unless there is a setting
1177 of the local quota option, in which case we can check for its excession
1178 without doing any writing.
1179
1180 In the case of MBX format mailboxes, the message is first written to a
1181 temporary file, in order to get its correct length. This is then copied to
1182 the real file, preceded by an MBX header.
1183
1184 If there is a quota error on writing, defer the address. Timeout logic
1185 will determine for how long retries are attempted. We restore the mailbox
1186 to its original length if it's a single file. There doesn't seem to be a
1187 uniform error code for quota excession (it even differs between SunOS4
1188 and some versions of SunOS5) so a system-dependent macro called
1189 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1190 compile time.
1191
1192 For any other error (most commonly disk full), do the same.
1193
1194 The following applies after appending to a file:
1195
1196 (12f)Restore the atime; notify_comsat if required; close the file (which
1197 unlocks it if it was locked). Delete the lock file if it exists.
1198
1199 The following applies after writing a unique file in a directory:
1200
1201 (12d)For maildir format, rename the file into the new directory. For mailstore
1202 format, rename the envelope file to its correct name. Otherwise, generate
1203 a unique name from the directory_file option, and rename to that, possibly
1204 trying a few times if the file exists and re-expanding the name gives a
1205 different string.
1206
1207 This transport yields FAIL only when a file name is generated by an alias or
1208 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1209 All other failures return DEFER (in addr->transport_return). */
1210
1211
1212 BOOL
1213 appendfile_transport_entry(
1214 transport_instance *tblock, /* data for this instantiation */
1215 address_item *addr) /* address we are working on */
1216 {
1217 appendfile_transport_options_block *ob =
1218 (appendfile_transport_options_block *)(tblock->options_block);
1219 struct stat statbuf;
1220 uschar *fdname = NULL;
1221 uschar *filename = NULL;
1222 uschar *hitchname = NULL;
1223 uschar *dataname = NULL;
1224 uschar *lockname = NULL;
1225 uschar *newname = NULL;
1226 uschar *nametag = NULL;
1227 uschar *cr = US"";
1228 uschar *filecount_msg = US"";
1229 uschar *path;
1230 struct utimbuf times;
1231 struct timeval msg_tv;
1232 BOOL disable_quota = FALSE;
1233 BOOL isdirectory = FALSE;
1234 BOOL isfifo = FALSE;
1235 BOOL wait_for_tick = FALSE;
1236 uid_t uid = geteuid(); /* See note above */
1237 gid_t gid = getegid();
1238 int mbformat;
1239 int mode = (addr->mode > 0)? addr->mode : ob->mode;
1240 off_t saved_size = -1;
1241 off_t mailbox_size = ob->mailbox_size_value;
1242 int mailbox_filecount = ob->mailbox_filecount_value;
1243 int hd = -1;
1244 int fd = -1;
1245 int yield = FAIL;
1246 int i;
1247
1248 #ifdef SUPPORT_MBX
1249 int save_fd = 0;
1250 int mbx_lockfd = -1;
1251 uschar mbx_lockname[40];
1252 FILE *temp_file = NULL;
1253 #endif /* SUPPORT_MBX */
1254
1255 #ifdef SUPPORT_MAILDIR
1256 int maildirsize_fd = -1; /* fd for maildirsize file */
1257 int maildir_save_errno;
1258 #endif
1259
1260
1261 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1262
1263 /* An "address_file" or "address_directory" transport is used to deliver to
1264 files specified via .forward or an alias file. Prior to release 4.20, the
1265 "file" and "directory" options were ignored in this case. This has been changed
1266 to allow the redirection data to specify what is in effect a folder, whose
1267 location is determined by the options on the transport.
1268
1269 Compatibility with the case when neither option is set is retained by forcing a
1270 value for the file or directory name. A directory delivery is assumed if the
1271 last character of the path from the router is '/'.
1272
1273 The file path is in the local part of the address, but not in the $local_part
1274 variable (that holds the parent local part). It is, however, in the
1275 $address_file variable. Below, we update the local part in the address if it
1276 changes by expansion, so that the final path ends up in the log. */
1277
1278 if (testflag(addr, af_file) &&
1279 ob->filename == NULL &&
1280 ob->dirname == NULL)
1281 {
1282 fdname = US"$address_file";
1283 if (address_file[Ustrlen(address_file)-1] == '/' ||
1284 ob->maildir_format ||
1285 ob->mailstore_format)
1286 isdirectory = TRUE;
1287 }
1288
1289 /* Handle (a) an "address file" delivery where "file" or "directory" is
1290 explicitly set and (b) a non-address_file delivery, where one of "file" or
1291 "directory" must be set; initialization ensures that they are not both set. */
1292
1293 if (fdname == NULL)
1294 {
1295 fdname = ob->filename;
1296 if (fdname == NULL)
1297 {
1298 fdname = ob->dirname;
1299 isdirectory = TRUE;
1300 }
1301 if (fdname == NULL)
1302 {
1303 addr->transport_return = PANIC;
1304 addr->message = string_sprintf("Mandatory file or directory option "
1305 "missing from %s transport", tblock->name);
1306 return FALSE;
1307 }
1308 }
1309
1310 /* Maildir and mailstore require a directory */
1311
1312 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1313 {
1314 addr->transport_return = PANIC;
1315 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1316 "to be specified for the %s transport",
1317 ob->maildir_format? "dir" : "store", tblock->name);
1318 return FALSE;
1319 }
1320
1321 path = expand_string(fdname);
1322
1323 if (path == NULL)
1324 {
1325 addr->transport_return = PANIC;
1326 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1327 "name for %s transport) failed: %s", fdname, tblock->name,
1328 expand_string_message);
1329 return FALSE;
1330 }
1331
1332 if (path[0] != '/')
1333 {
1334 addr->message = string_sprintf("appendfile: file or directory name "
1335 "\"%s\" is not absolute", path);
1336 addr->basic_errno = ERRNO_NOTABSOLUTE;
1337 return FALSE;
1338 }
1339
1340 /* For a file delivery, make sure the local part in the address(es) is updated
1341 to the true local part. */
1342
1343 if (testflag(addr, af_file))
1344 {
1345 address_item *addr2;
1346 for (addr2 = addr; addr2 != NULL; addr2 = addr2->next)
1347 addr2->local_part = string_copy(path);
1348 }
1349
1350 /* The available mailbox formats depend on whether it is a directory or a file
1351 delivery. */
1352
1353 if (isdirectory)
1354 {
1355 mbformat =
1356 #ifdef SUPPORT_MAILDIR
1357 (ob->maildir_format)? mbf_maildir :
1358 #endif
1359 #ifdef SUPPORT_MAILSTORE
1360 (ob->mailstore_format)? mbf_mailstore :
1361 #endif
1362 mbf_smail;
1363 }
1364 else
1365 {
1366 mbformat =
1367 #ifdef SUPPORT_MBX
1368 (ob->mbx_format)? mbf_mbx :
1369 #endif
1370 mbf_unix;
1371 }
1372
1373 DEBUG(D_transport)
1374 {
1375 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1376 " warning=" OFF_T_FMT "%s\n"
1377 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1378 "maildir_use_size_file=%s\n",
1379 mode, ob->notify_comsat, ob->quota_value,
1380 ob->quota_warn_threshold_value,
1381 ob->quota_warn_threshold_is_percent? "%" : "",
1382 isdirectory? "directory" : "file",
1383 path, mailbox_formats[mbformat],
1384 (ob->message_prefix == NULL)? US"null" : string_printing(ob->message_prefix),
1385 (ob->message_suffix == NULL)? US"null" : string_printing(ob->message_suffix),
1386 (ob->maildir_use_size_file)? "yes" : "no");
1387
1388 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1389 ob->use_lockfile? "lockfile " : "",
1390 ob->use_mbx_lock? "mbx locking (" : "",
1391 ob->use_fcntl? "fcntl " : "",
1392 ob->use_flock? "flock" : "",
1393 ob->use_mbx_lock? ")" : "");
1394 }
1395
1396 /* If the -N option is set, can't do any more. */
1397
1398 if (dont_deliver)
1399 {
1400 DEBUG(D_transport)
1401 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1402 tblock->name);
1403 addr->transport_return = OK;
1404 return FALSE;
1405 }
1406
1407 /* Handle the case of a file name. If the file name is /dev/null, we can save
1408 ourselves some effort and just give a success return right away. */
1409
1410 if (!isdirectory)
1411 {
1412 BOOL use_lstat = TRUE;
1413 BOOL file_opened = FALSE;
1414 BOOL allow_creation_here = TRUE;
1415
1416 if (Ustrcmp(path, "/dev/null") == 0)
1417 {
1418 addr->transport_return = OK;
1419 return FALSE;
1420 }
1421
1422 /* Set the name of the file to be opened, and the file to which the data
1423 is written, and find out if we are permitted to create a non-existent file. */
1424
1425 dataname = filename = path;
1426 allow_creation_here = check_creation(filename, ob->create_file);
1427
1428 /* If ob->create_directory is set, attempt to create the directories in
1429 which this mailbox lives, but only if we are permitted to create the file
1430 itself. We know we are dealing with an absolute path, because this was
1431 checked above. */
1432
1433 if (ob->create_directory && allow_creation_here)
1434 {
1435 uschar *p = Ustrrchr(path, '/');
1436 *p = '\0';
1437 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1438 {
1439 addr->basic_errno = errno;
1440 addr->message =
1441 string_sprintf("failed to create directories for %s: %s", path,
1442 strerror(errno));
1443 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1444 return FALSE;
1445 }
1446 *p = '/';
1447 }
1448
1449 /* If file_format is set we must check that any existing file matches one of
1450 the configured formats by checking the bytes it starts with. A match then
1451 indicates a specific transport - if it is not this one, pass control to it.
1452 Otherwise carry on here. An empty or non-existent file matches the current
1453 transport. We don't need to distinguish between non-existence and other open
1454 failures because if an existing file fails to open here, it will also fail
1455 again later when O_RDWR is used. */
1456
1457 if (ob->file_format != NULL)
1458 {
1459 int cfd = Uopen(path, O_RDONLY, 0);
1460 if (cfd >= 0)
1461 {
1462 transport_instance *tt = check_file_format(cfd, tblock, addr);
1463 (void)close(cfd);
1464
1465 /* If another transport is indicated, call it and return; if no transport
1466 was found, just return - the error data will have been set up.*/
1467
1468 if (tt != tblock)
1469 {
1470 if (tt != NULL)
1471 {
1472 set_process_info("delivering %s to %s using %s", message_id,
1473 addr->local_part, tt->name);
1474 debug_print_string(tt->debug_string);
1475 addr->transport = tt;
1476 (tt->info->code)(tt, addr);
1477 }
1478 return FALSE;
1479 }
1480 }
1481 }
1482
1483 /* The locking of mailbox files is worse than the naming of cats, which is
1484 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1485 three different names, so several different styles of locking are used.
1486
1487 Research in other programs that lock mailboxes shows that there is no
1488 universally standard method. Having mailboxes NFS-mounted on the system that
1489 is delivering mail is not the best thing, but people do run like this,
1490 and so the code must do its best to cope.
1491
1492 Three different locking mechanisms are supported. The initialization function
1493 checks that at least one is configured.
1494
1495 LOCK FILES
1496
1497 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1498 will work over NFS. Only after that is done do we actually open the mailbox
1499 and apply locks to it (if configured).
1500
1501 Originally, Exim got the file opened before doing anything about locking.
1502 However, a very occasional problem was observed on Solaris 2 when delivering
1503 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1504 gets remembered at open time. If another process on another host (that's
1505 important) has the file open and locked and writes to it and then releases
1506 the lock while the first process is waiting to get the lock, the first
1507 process may fail to write at the new end point of the file - despite the very
1508 definite statement about O_APPEND in the man page for write(). Experiments
1509 have reproduced this problem, but I do not know any way of forcing a host to
1510 update its attribute cache for an open NFS file. It would be nice if it did
1511 so when a lock was taken out, but this does not seem to happen. Anyway, to
1512 reduce the risk of this problem happening, we now create the lock file
1513 (if configured) *before* opening the mailbox. That will prevent two different
1514 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1515 however, but Pine at least seems to operate in the same way.
1516
1517 Lockfiles should normally be used when NFS is involved, because of the above
1518 problem.
1519
1520 The logic for creating the lock file is:
1521
1522 . The name of the lock file is <mailbox-name>.lock
1523
1524 . First, create a "hitching post" name by adding the primary host name,
1525 current time and pid to the lock file name. This should be unique.
1526
1527 . Create the hitching post file using WRONLY + CREAT + EXCL.
1528
1529 . If that fails EACCES, we assume it means that the user is unable to create
1530 files in the mail spool directory. Some installations might operate in this
1531 manner, so there is a configuration option to allow this state not to be an
1532 error - we proceed to lock using fcntl only, after the file is open.
1533
1534 . Otherwise, an error causes a deferment of the address.
1535
1536 . Hard link the hitching post to the lock file name.
1537
1538 . If the link succeeds, we have successfully created the lock file. Simply
1539 close and unlink the hitching post file.
1540
1541 . If the link does not succeed, proceed as follows:
1542
1543 o Fstat the hitching post file, and then close and unlink it.
1544
1545 o Now examine the stat data. If the number of links to the file is exactly
1546 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1547 the return never made it back, so the link() function gave a failure
1548 return.
1549
1550 . This method allows for the lock file to be created by some other process
1551 right up to the moment of the attempt to hard link it, and is also robust
1552 against NFS server crash-reboots, which would probably result in timeouts
1553 in the middle of link().
1554
1555 . System crashes may cause lock files to get left lying around, and some means
1556 of flushing them is required. The approach of writing a pid (used by smail
1557 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1558 timeout, which seems a better approach. Since any program that writes to a
1559 mailbox using a lock file should complete its task very quickly, Pine
1560 removes lock files that are older than 5 minutes. We allow the value to be
1561 configurable on the transport.
1562
1563 FCNTL LOCKING
1564
1565 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1566 mailbox once it is open. This is done by default with a non-blocking lock.
1567 Failures to lock cause retries after a sleep, but only for a certain number
1568 of tries. A blocking lock is deliberately not used so that we don't hold the
1569 mailbox open. This minimizes the possibility of the NFS problem described
1570 under LOCK FILES above, if for some reason NFS deliveries are happening
1571 without lock files. However, the use of a non-blocking lock and sleep, though
1572 the safest approach, does not give the best performance on very busy systems.
1573 A blocking lock plus timeout does better. Therefore Exim has an option to
1574 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1575 enables the use of blocking fcntl() calls.
1576
1577 FLOCK LOCKING
1578
1579 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1580 same manner as for fcntl locking above. No-blocking/timeout is also set as
1581 above in lock_flock_timeout. Not all operating systems provide or support
1582 flock(). For those that don't (as determined by the definition of LOCK_SH in
1583 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1584 is implemented (not precisely) on top of fcntl(), which means there's no
1585 point in actually using it.
1586
1587 MBX LOCKING
1588
1589 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1590 then the rules used for locking in c-client are used. Exim takes out a shared
1591 lock on the mailbox file, and an exclusive lock on the file whose name is
1592 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1593 any other MBX client from getting an exclusive lock on it and expunging it.
1594 It also stops any other MBX client from unlinking the /tmp lock when it has
1595 finished with it.
1596
1597 The exclusive lock on the /tmp file prevents any other MBX client from
1598 updating the mailbox in any way. When writing is finished, if an exclusive
1599 lock on the mailbox can be obtained, indicating there are no current sharers,
1600 the /tmp file is unlinked.
1601
1602 MBX locking can use either fcntl() or flock() locking. If neither
1603 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1604 The calls for getting these locks are by default non-blocking, as for non-mbx
1605 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1606 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1607 probably makes sense to set timeouts for any MBX deliveries. */
1608
1609
1610 /* Build a lock file if configured to do so - the existence of a lock
1611 file is subsequently checked by looking for a non-negative value of the
1612 file descriptor hd - even though the file is no longer open. */
1613
1614 if (ob->use_lockfile)
1615 {
1616 lockname = string_sprintf("%s.lock", filename);
1617 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1618 (unsigned int)(time(NULL)), (unsigned int)getpid());
1619
1620 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1621 hitchname);
1622
1623 /* Lock file creation retry loop */
1624
1625 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1626 {
1627 int rc;
1628 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1629
1630 if (hd < 0)
1631 {
1632 addr->basic_errno = errno;
1633 addr->message =
1634 string_sprintf("creating lock file hitching post %s "
1635 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1636 (long int)getegid());
1637 return FALSE;
1638 }
1639
1640 /* Attempt to hitch the hitching post to the lock file. If link()
1641 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1642 file, and get rid of the hitching post. If the number of links was 2,
1643 the link was created, despite the failure of link(). If the hitch was
1644 not successful, try again, having unlinked the lock file if it is too
1645 old.
1646
1647 There's a version of Linux (2.0.27) which doesn't update its local cache
1648 of the inode after link() by default - which many think is a bug - but
1649 if the link succeeds, this code will be OK. It just won't work in the
1650 case when link() fails after having actually created the link. The Linux
1651 NFS person is fixing this; a temporary patch is available if anyone is
1652 sufficiently worried. */
1653
1654 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1655 (void)close(hd);
1656 Uunlink(hitchname);
1657 if (rc != 0 && statbuf.st_nlink != 2)
1658 {
1659 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1660 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1661 {
1662 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1663 Uunlink(lockname);
1664 }
1665 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1666 continue;
1667 }
1668
1669 DEBUG(D_transport) debug_printf("lock file created\n");
1670 break;
1671 }
1672
1673 /* Check for too many tries at creating the lock file */
1674
1675 if (i >= ob->lock_retries)
1676 {
1677 addr->basic_errno = ERRNO_LOCKFAILED;
1678 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1679 filename);
1680 return FALSE;
1681 }
1682 }
1683
1684
1685 /* We now have to get the file open. First, stat() it and act on existence or
1686 non-existence. This is in a loop to handle the case of a file's being created
1687 or deleted as we watch, and also to handle retries when the locking fails.
1688 Rather than holding the file open while waiting for the fcntl() and/or
1689 flock() lock, we close and do the whole thing again. This should be safer,
1690 especially for NFS files, which might get altered from other hosts, making
1691 their cached sizes incorrect.
1692
1693 With the default settings, no symlinks are permitted, but there is an option
1694 to permit symlinks for those sysadmins that know what they are doing.
1695 Shudder. However, insist that the initial symlink is owned by the right user.
1696 Thus lstat() is used initially; if a symlink is discovered, the loop is
1697 repeated such that stat() is used, to look at the end file. */
1698
1699 for (i = 0; i < ob->lock_retries; i++)
1700 {
1701 int sleep_before_retry = TRUE;
1702 file_opened = FALSE;
1703
1704 if((use_lstat? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1705 {
1706 /* Let's hope that failure to stat (other than non-existence) is a
1707 rare event. */
1708
1709 if (errno != ENOENT)
1710 {
1711 addr->basic_errno = errno;
1712 addr->message = string_sprintf("attempting to stat mailbox %s",
1713 filename);
1714 goto RETURN;
1715 }
1716
1717 /* File does not exist. If it is required to pre-exist this state is an
1718 error. */
1719
1720 if (ob->file_must_exist)
1721 {
1722 addr->basic_errno = errno;
1723 addr->message = string_sprintf("mailbox %s does not exist, "
1724 "but file_must_exist is set", filename);
1725 goto RETURN;
1726 }
1727
1728 /* If not permitted to create this file because it isn't in or below
1729 the home directory, generate an error. */
1730
1731 if (!allow_creation_here)
1732 {
1733 addr->basic_errno = ERRNO_BADCREATE;
1734 addr->message = string_sprintf("mailbox %s does not exist, "
1735 "but creation outside the home directory is not permitted",
1736 filename);
1737 goto RETURN;
1738 }
1739
1740 /* Attempt to create and open the file. If open fails because of
1741 pre-existence, go round the loop again. For any other error, defer the
1742 address, except for an alias or forward generated file name with EPERM,
1743 ENOENT, or EACCES, as those are most likely to be user errors rather
1744 than Exim config errors. When a symbolic link is permitted and points
1745 to a non-existent file, we get here with use_lstat = FALSE. In this case
1746 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1747 consistency and because MBX locking requires it in order to be able to
1748 get a shared lock. */
1749
1750 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1751 (use_lstat? O_EXCL : 0), mode);
1752 if (fd < 0)
1753 {
1754 if (errno == EEXIST) continue;
1755 addr->basic_errno = errno;
1756 addr->message = string_sprintf("while creating mailbox %s",
1757 filename);
1758 if (testflag(addr, af_file) &&
1759 (errno == EPERM || errno == ENOENT || errno == EACCES))
1760 addr->transport_return = FAIL;
1761 goto RETURN;
1762 }
1763
1764 /* We have successfully created and opened the file. Ensure that the group
1765 and the mode are correct. */
1766
1767 (void)Uchown(filename, uid, gid);
1768 (void)Uchmod(filename, mode);
1769 }
1770
1771
1772 /* The file already exists. Test its type, ownership, and permissions, and
1773 save the inode for checking later. If symlinks are permitted (not the
1774 default or recommended state) it may be a symlink that already exists.
1775 Check its ownership and then look for the file at the end of the link(s).
1776 This at least prevents one user creating a symlink for another user in
1777 a sticky directory. */
1778
1779 else
1780 {
1781 int oldmode = (int)statbuf.st_mode;
1782 ino_t inode = statbuf.st_ino;
1783 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1784
1785 isfifo = FALSE; /* In case things are changing */
1786
1787 /* Check owner if required - the default. */
1788
1789 if (ob->check_owner && statbuf.st_uid != uid)
1790 {
1791 addr->basic_errno = ERRNO_BADUGID;
1792 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1793 "(%ld != %ld)", filename,
1794 islink? " (symlink)" : "",
1795 (long int)(statbuf.st_uid), (long int)uid);
1796 goto RETURN;
1797 }
1798
1799 /* Group is checked only if check_group is set. */
1800
1801 if (ob->check_group && statbuf.st_gid != gid)
1802 {
1803 addr->basic_errno = ERRNO_BADUGID;
1804 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1805 filename, islink? " (symlink)" : "", statbuf.st_gid, gid);
1806 goto RETURN;
1807 }
1808
1809 /* Just in case this is a sticky-bit mail directory, we don't want
1810 users to be able to create hard links to other users' files. */
1811
1812 if (statbuf.st_nlink != 1)
1813 {
1814 addr->basic_errno = ERRNO_NOTREGULAR;
1815 addr->message = string_sprintf("mailbox %s%s has too many links (%d)",
1816 filename, islink? " (symlink)" : "", statbuf.st_nlink);
1817 goto RETURN;
1818
1819 }
1820
1821 /* If symlinks are permitted (not recommended), the lstat() above will
1822 have found the symlink. Its ownership has just been checked; go round
1823 the loop again, using stat() instead of lstat(). That will never yield a
1824 mode of S_IFLNK. */
1825
1826 if (islink && ob->allow_symlink)
1827 {
1828 use_lstat = FALSE;
1829 i--; /* Don't count this time round */
1830 continue;
1831 }
1832
1833 /* An actual file exists. Check that it is a regular file, or FIFO
1834 if permitted. */
1835
1836 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1837
1838 else if ((oldmode & S_IFMT) != S_IFREG)
1839 {
1840 addr->basic_errno = ERRNO_NOTREGULAR;
1841 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1842 filename, ob->allow_fifo? " or named pipe" : "");
1843 goto RETURN;
1844 }
1845
1846 /* If the mode is not what it would be for a newly created file, change
1847 the permissions if the mode is supplied for the address. Otherwise,
1848 reduce but do not extend the permissions. If the newly created
1849 permissions are greater than the existing permissions, don't change
1850 things when the mode is not from the address. */
1851
1852 if ((oldmode = (oldmode & 07777)) != mode)
1853 {
1854 int diffs = oldmode ^ mode;
1855 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1856 {
1857 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1858 if (Uchmod(filename, mode) < 0)
1859 {
1860 addr->basic_errno = errno;
1861 addr->message = string_sprintf("attempting to chmod mailbox %s",
1862 filename);
1863 goto RETURN;
1864 }
1865 oldmode = mode;
1866 }
1867
1868 /* Mode not from address, and newly-created permissions are greater
1869 than existing permissions. Default is to complain, but it can be
1870 configured to go ahead and try to deliver anyway if that's what
1871 the administration wants. */
1872
1873 else if (ob->mode_fail_narrower)
1874 {
1875 addr->basic_errno = ERRNO_BADMODE;
1876 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1877 "(%o expected)", filename, oldmode, mode);
1878 goto RETURN;
1879 }
1880 }
1881
1882 /* We are happy with the existing file. Open it, and then do further
1883 tests to ensure that it is the same file that we were just looking at.
1884 If the file does not now exist, restart this loop, going back to using
1885 lstat again. For an NFS error, just defer; other opening errors are
1886 more serious. The file is opened RDWR so that its format can be checked,
1887 and also MBX locking requires the use of a shared (read) lock. However,
1888 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1889 reading the pipe. */
1890
1891 fd = Uopen(filename, isfifo? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1892 mode);
1893 if (fd < 0)
1894 {
1895 if (errno == ENOENT)
1896 {
1897 use_lstat = TRUE;
1898 continue;
1899 }
1900 addr->basic_errno = errno;
1901 if (isfifo)
1902 {
1903 addr->message = string_sprintf("while opening named pipe %s "
1904 "(could mean no process is reading it)", filename);
1905 }
1906 else if (errno != EWOULDBLOCK)
1907 {
1908 addr->message = string_sprintf("while opening mailbox %s", filename);
1909 }
1910 goto RETURN;
1911 }
1912
1913 /* This fstat really shouldn't fail, as we have an open file! There's a
1914 dilemma here. We use fstat in order to be sure we are peering at the file
1915 we have got open. However, that won't tell us if the file was reached
1916 via a symbolic link. We checked this above, but there is a race exposure
1917 if the link was created between the previous lstat and the open. However,
1918 it would have to be created with the same inode in order to pass the
1919 check below. If ob->allow_symlink is set, causing the use of stat rather
1920 than lstat above, symbolic links may be there anyway, and the checking is
1921 weaker. */
1922
1923 if (fstat(fd, &statbuf) < 0)
1924 {
1925 addr->basic_errno = errno;
1926 addr->message = string_sprintf("attempting to stat open mailbox %s",
1927 filename);
1928 goto RETURN;
1929 }
1930
1931 /* Check the inode; this is isn't a perfect check, but gives some
1932 confidence. */
1933
1934 if (inode != statbuf.st_ino)
1935 {
1936 addr->basic_errno = ERRNO_INODECHANGED;
1937 addr->message = string_sprintf("opened mailbox %s inode number changed "
1938 "from %d to %ld", filename, inode, statbuf.st_ino);
1939 addr->special_action = SPECIAL_FREEZE;
1940 goto RETURN;
1941 }
1942
1943 /* Check it's still a regular file or FIFO, and the uid, gid, and
1944 permissions have not changed. */
1945
1946 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1947 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1948 {
1949 addr->basic_errno = ERRNO_NOTREGULAR;
1950 addr->message =
1951 string_sprintf("opened mailbox %s is no longer a %s", filename,
1952 isfifo? "named pipe" : "regular file");
1953 addr->special_action = SPECIAL_FREEZE;
1954 goto RETURN;
1955 }
1956
1957 if ((ob->check_owner && statbuf.st_uid != uid) ||
1958 (ob->check_group && statbuf.st_gid != gid))
1959 {
1960 addr->basic_errno = ERRNO_BADUGID;
1961 addr->message =
1962 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
1963 addr->special_action = SPECIAL_FREEZE;
1964 goto RETURN;
1965 }
1966
1967 if ((statbuf.st_mode & 07777) != oldmode)
1968 {
1969 addr->basic_errno = ERRNO_BADMODE;
1970 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
1971 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
1972 addr->special_action = SPECIAL_FREEZE;
1973 goto RETURN;
1974 }
1975
1976 /* If file_format is set, check that the format of the file has not
1977 changed. Error data is set by the testing function. */
1978
1979 if (ob->file_format != NULL &&
1980 check_file_format(fd, tblock, addr) != tblock)
1981 {
1982 addr->message = US"open mailbox has changed format";
1983 goto RETURN;
1984 }
1985
1986 /* The file is OK. Carry on to do the locking. */
1987 }
1988
1989 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
1990 locking rules if configured to do so. If a lock file is also required, it
1991 was created above and hd was left >= 0. At least one form of locking is
1992 required by the initialization function. If locking fails here, close the
1993 file and go round the loop all over again, after waiting for a bit, unless
1994 blocking locking was used. */
1995
1996 file_opened = TRUE;
1997 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
1998 sleep_before_retry = FALSE;
1999
2000 /* Simple fcntl() and/or flock() locking */
2001
2002 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
2003 {
2004 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2005 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
2006 }
2007
2008 /* MBX locking rules */
2009
2010 #ifdef SUPPORT_MBX
2011 else if (ob->use_mbx_lock)
2012 {
2013 int mbx_tmp_oflags;
2014 struct stat lstatbuf, statbuf2;
2015 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2016 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
2017 fstat(fd, &statbuf) >= 0)
2018 {
2019 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
2020 (long)statbuf.st_ino);
2021
2022 /*
2023 * 2010-05-29: SECURITY
2024 * Dan Rosenberg reported the presence of a race-condition in the
2025 * original code here. Beware that many systems still allow symlinks
2026 * to be followed in /tmp so an attacker can create a symlink pointing
2027 * elsewhere between a stat and an open, which we should avoid
2028 * following.
2029 *
2030 * It's unfortunate that we can't just use all the heavily debugged
2031 * locking from above.
2032 *
2033 * Also: remember to mirror changes into exim_lock.c */
2034
2035 /* first leave the old pre-check in place, it provides better
2036 * diagnostics for common cases */
2037 if (Ulstat(mbx_lockname, &statbuf) >= 0)
2038 {
2039 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
2040 {
2041 addr->basic_errno = ERRNO_LOCKFAILED;
2042 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2043 mbx_lockname);
2044 goto RETURN;
2045 }
2046 if (statbuf.st_nlink > 1)
2047 {
2048 addr->basic_errno = ERRNO_LOCKFAILED;
2049 addr->message = string_sprintf("hard link to MBX lock file %s",
2050 mbx_lockname);
2051 goto RETURN;
2052 }
2053 }
2054
2055 /* If we could just declare "we must be the ones who create this
2056 * file" then a hitching post in a subdir would work, since a
2057 * subdir directly in /tmp/ which we create wouldn't follow links
2058 * but this isn't our locking logic, so we can't safely change the
2059 * file existence rules. */
2060
2061 /* On systems which support O_NOFOLLOW, it's the easiest and most
2062 * obviously correct security fix */
2063 mbx_tmp_oflags = O_RDWR | O_CREAT;
2064 #ifdef O_NOFOLLOW
2065 mbx_tmp_oflags |= O_NOFOLLOW;
2066 #endif
2067 mbx_lockfd = Uopen(mbx_lockname, mbx_tmp_oflags, ob->lockfile_mode);
2068 if (mbx_lockfd < 0)
2069 {
2070 addr->basic_errno = ERRNO_LOCKFAILED;
2071 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2072 mbx_lockname, strerror(errno));
2073 goto RETURN;
2074 }
2075
2076 if (Ulstat(mbx_lockname, &lstatbuf) < 0)
2077 {
2078 addr->basic_errno = ERRNO_LOCKFAILED;
2079 addr->message = string_sprintf("attempting to lstat open MBX "
2080 "lock file %s: %s", mbx_lockname, strerror(errno));
2081 goto RETURN;
2082 }
2083 if (fstat(mbx_lockfd, &statbuf2) < 0)
2084 {
2085 addr->basic_errno = ERRNO_LOCKFAILED;
2086 addr->message = string_sprintf("attempting to stat fd of open MBX "
2087 "lock file %s: %s", mbx_lockname, strerror(errno));
2088 goto RETURN;
2089 }
2090
2091 /*
2092 * At this point:
2093 * statbuf: if exists, is file which existed prior to opening the
2094 * lockfile, might have been replaced since then
2095 * statbuf2: result of stat'ing the open fd, is what was actually
2096 * opened
2097 * lstatbuf: result of lstat'ing the filename immediately after
2098 * the open but there's a race condition again between
2099 * those two steps: before open, symlink to foo, after
2100 * open but before lstat have one of:
2101 * * was no symlink, so is the opened file
2102 * (we created it, no messing possible after that point)
2103 * * hardlink to foo
2104 * * symlink elsewhere
2105 * * hardlink elsewhere
2106 * * new file/other
2107 * Don't want to compare to device of /tmp because some modern systems
2108 * have regressed to having /tmp be the safe actual filesystem as
2109 * valuable data, so is mostly worthless, unless we assume that *only*
2110 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2111 * for further consideration.
2112 * No point in doing a readlink on the lockfile as that will always be
2113 * at a different point in time from when we open it, so tells us
2114 * nothing; attempts to clean up and delete after ourselves would risk
2115 * deleting a *third* filename.
2116 */
2117 if ((statbuf2.st_nlink > 1) ||
2118 (lstatbuf.st_nlink > 1) ||
2119 (!S_ISREG(lstatbuf.st_mode)) ||
2120 (lstatbuf.st_dev != statbuf2.st_dev) ||
2121 (lstatbuf.st_ino != statbuf2.st_ino))
2122 {
2123 addr->basic_errno = ERRNO_LOCKFAILED;
2124 addr->message = string_sprintf("RACE CONDITION detected: "
2125 "mismatch post-initial-checks between \"%s\" and opened "
2126 "fd lead us to abort!", mbx_lockname);
2127 goto RETURN;
2128 }
2129
2130 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2131
2132 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2133 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2134 {
2135 struct stat ostatbuf;
2136
2137 /* This tests for a specific race condition. Ensure that we still
2138 have the same file. */
2139
2140 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2141 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2142 statbuf.st_dev == ostatbuf.st_dev &&
2143 statbuf.st_ino == ostatbuf.st_ino)
2144 break;
2145 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2146 "between creation and locking\n", mbx_lockname);
2147 }
2148
2149 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2150 strerror(errno));
2151 (void)close(mbx_lockfd);
2152 mbx_lockfd = -1;
2153 }
2154 else
2155 {
2156 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2157 filename, strerror(errno));
2158 }
2159 }
2160 #endif /* SUPPORT_MBX */
2161
2162 else break; /* No on-file locking required; break the open/lock loop */
2163
2164 DEBUG(D_transport)
2165 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2166
2167 (void)close(fd);
2168 fd = -1;
2169 use_lstat = TRUE; /* Reset to use lstat first */
2170
2171
2172 /* If a blocking call timed out, break the retry loop if the total time
2173 so far is not less than than retries * interval. Use the larger of the
2174 flock() and fcntl() timeouts. */
2175
2176 if (sigalrm_seen &&
2177 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2178 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2179 ob->lock_retries * ob->lock_interval)
2180 i = ob->lock_retries;
2181
2182 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2183 flock() that caused the problem. */
2184
2185 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2186 }
2187
2188 /* Test for exceeding the maximum number of tries. Either the file remains
2189 locked, or, if we haven't got it open, something is terribly wrong... */
2190
2191 if (i >= ob->lock_retries)
2192 {
2193 if (!file_opened)
2194 {
2195 addr->basic_errno = ERRNO_EXISTRACE;
2196 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2197 addr->special_action = SPECIAL_FREEZE;
2198 }
2199 else
2200 {
2201 addr->basic_errno = ERRNO_LOCKFAILED;
2202 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2203 filename);
2204 }
2205 goto RETURN;
2206 }
2207
2208 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2209
2210 /* Save access time (for subsequent restoration), modification time (for
2211 restoration if updating fails), size of file (for comsat and for re-setting if
2212 delivery fails in the middle - e.g. for quota exceeded). */
2213
2214 if (fstat(fd, &statbuf) < 0)
2215 {
2216 addr->basic_errno = errno;
2217 addr->message = string_sprintf("while fstatting opened mailbox %s",
2218 filename);
2219 goto RETURN;
2220 }
2221
2222 times.actime = statbuf.st_atime;
2223 times.modtime = statbuf.st_mtime;
2224 saved_size = statbuf.st_size;
2225 if (mailbox_size < 0) mailbox_size = saved_size;
2226 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2227 }
2228
2229 /* Prepare for writing to a new file (as opposed to appending to an old one).
2230 There are several different formats, but there is preliminary stuff concerned
2231 with quotas that applies to all of them. Finding the current size by directory
2232 scanning is expensive; for maildirs some fudges have been invented:
2233
2234 (1) A regex can be used to extract a file size from its name;
2235 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2236 mailbox size.
2237 */
2238
2239 else
2240 {
2241 uschar *check_path = path; /* Default quota check path */
2242 const pcre *regex = NULL; /* Regex for file size from file name */
2243
2244 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2245 {
2246 addr->basic_errno = ERRNO_BADCREATE;
2247 addr->message = string_sprintf("tried to create file in %s, but "
2248 "file creation outside the home directory is not permitted", path);
2249 goto RETURN;
2250 }
2251
2252 #ifdef SUPPORT_MAILDIR
2253 /* For a maildir delivery, ensure that all the relevant directories exist,
2254 and a maildirfolder file if necessary. */
2255
2256 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2257 ob->create_directory, ob->dirmode, ob->maildirfolder_create_regex))
2258 return FALSE;
2259 #endif /* SUPPORT_MAILDIR */
2260
2261 /* If we are going to do a quota check, of if maildir_use_size_file is set
2262 for a maildir delivery, compile the regular expression if there is one. We
2263 may also need to adjust the path that is used. We need to do this for
2264 maildir_use_size_file even if the quota is unset, because we still want to
2265 create the file. When maildir support is not compiled,
2266 ob->maildir_use_size_file is always FALSE. */
2267
2268 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2269 {
2270 const uschar *error;
2271 int offset;
2272
2273 /* Compile the regex if there is one. */
2274
2275 if (ob->quota_size_regex != NULL)
2276 {
2277 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2278 (const char **)&error, &offset, NULL);
2279 if (regex == NULL)
2280 {
2281 addr->message = string_sprintf("appendfile: regular expression "
2282 "error: %s at offset %d while compiling %s", error, offset,
2283 ob->quota_size_regex);
2284 return FALSE;
2285 }
2286 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2287 ob->quota_size_regex);
2288 }
2289
2290 /* Use an explicitly configured directory if set */
2291
2292 if (ob->quota_directory != NULL)
2293 {
2294 check_path = expand_string(ob->quota_directory);
2295 if (check_path == NULL)
2296 {
2297 addr->transport_return = PANIC;
2298 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2299 "name for %s transport) failed: %s", ob->quota_directory,
2300 tblock->name, expand_string_message);
2301 return FALSE;
2302 }
2303
2304 if (check_path[0] != '/')
2305 {
2306 addr->message = string_sprintf("appendfile: quota_directory name "
2307 "\"%s\" is not absolute", check_path);
2308 addr->basic_errno = ERRNO_NOTABSOLUTE;
2309 return FALSE;
2310 }
2311 }
2312
2313 #ifdef SUPPORT_MAILDIR
2314 /* Otherwise, if we are handling a maildir delivery, and the directory
2315 contains a file called maildirfolder, this is a maildir++ feature telling
2316 us that this is a sub-directory of the real inbox. We should therefore do
2317 the quota check on the parent directory. Beware of the special case when
2318 the directory name itself ends in a slash. */
2319
2320 else if (mbformat == mbf_maildir)
2321 {
2322 struct stat statbuf;
2323 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2324 {
2325 uschar *new_check_path = string_copy(check_path);
2326 uschar *slash = Ustrrchr(new_check_path, '/');
2327 if (slash != NULL)
2328 {
2329 if (slash[1] == 0)
2330 {
2331 *slash = 0;
2332 slash = Ustrrchr(new_check_path, '/');
2333 }
2334 if (slash != NULL)
2335 {
2336 *slash = 0;
2337 check_path = new_check_path;
2338 DEBUG(D_transport) debug_printf("maildirfolder file exists: "
2339 "quota check directory changed to %s\n", check_path);
2340 }
2341 }
2342 }
2343 }
2344 #endif /* SUPPORT_MAILDIR */
2345 }
2346
2347 /* If we are using maildirsize files, we need to ensure that such a file
2348 exists and, if necessary, recalculate its contents. As a byproduct of this,
2349 we obtain the current size of the maildir. If no quota is to be enforced
2350 (ob->quota_value == 0), we still need the size if a threshold check will
2351 happen later.
2352
2353 Another regular expression is used to determine which directories inside the
2354 maildir are going to be counted. */
2355
2356 #ifdef SUPPORT_MAILDIR
2357 if (ob->maildir_use_size_file)
2358 {
2359 const pcre *dir_regex = NULL;
2360 const uschar *error;
2361 int offset;
2362
2363 if (ob->maildir_dir_regex != NULL)
2364 {
2365 int check_path_len = Ustrlen(check_path);
2366
2367 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2368 (const char **)&error, &offset, NULL);
2369 if (dir_regex == NULL)
2370 {
2371 addr->message = string_sprintf("appendfile: regular expression "
2372 "error: %s at offset %d while compiling %s", error, offset,
2373 ob->maildir_dir_regex);
2374 return FALSE;
2375 }
2376
2377 DEBUG(D_transport)
2378 debug_printf("using regex for maildir directory selection: %s\n",
2379 ob->maildir_dir_regex);
2380
2381 /* Check to see if we are delivering into an ignored directory, that is,
2382 if the delivery path starts with the quota check path, and the rest
2383 of the deliver path matches the regex; if so, set a flag to disable quota
2384 checking and maildirsize updating. */
2385
2386 if (Ustrncmp(path, check_path, check_path_len) == 0)
2387 {
2388 uschar *s = path + check_path_len;
2389 while (*s == '/') s++;
2390 s = (*s == 0)? US "new" : string_sprintf("%s/new", s);
2391 if (pcre_exec(dir_regex, NULL, CS s, Ustrlen(s), 0, 0, NULL, 0) < 0)
2392 {
2393 disable_quota = TRUE;
2394 DEBUG(D_transport) debug_printf("delivery directory does not match "
2395 "maildir_quota_directory_regex: disabling quota\n");
2396 }
2397 }
2398 }
2399
2400 /* Quota enforcement; create and check the file. There is some discussion
2401 about whether this should happen if the quota is unset. At present, Exim
2402 always creates the file. If we ever want to change this, uncomment
2403 appropriate lines below, possibly doing a check on some option. */
2404
2405 /* if (???? || ob->quota_value > 0) */
2406
2407 if (!disable_quota)
2408 {
2409 off_t size;
2410 int filecount;
2411
2412 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2413 &size, &filecount);
2414
2415 if (maildirsize_fd == -1)
2416 {
2417 addr->basic_errno = errno;
2418 addr->message = string_sprintf("while opening or reading "
2419 "%s/maildirsize", check_path);
2420 return FALSE;
2421 }
2422 /* can also return -2, which means that the file was removed because of
2423 raciness; but in this case, the size & filecount will still have been
2424 updated. */
2425
2426 if (mailbox_size < 0) mailbox_size = size;
2427 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2428 }
2429
2430 /* No quota enforcement; ensure file does *not* exist; calculate size if
2431 needed. */
2432
2433 /* else
2434 * {
2435 * time_t old_latest;
2436 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2437 * if (THRESHOLD_CHECK)
2438 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2439 * regex, dir_regex, FALSE);
2440 * }
2441 */
2442
2443 }
2444 #endif /* SUPPORT_MAILDIR */
2445
2446 /* Otherwise if we are going to do a quota check later on, and the mailbox
2447 size is not set, find the current size of the mailbox. Ditto for the file
2448 count. Note that ob->quota_filecount_value cannot be set without
2449 ob->quota_value being set. */
2450
2451 if (!disable_quota &&
2452 (ob->quota_value > 0 || THRESHOLD_CHECK) &&
2453 (mailbox_size < 0 ||
2454 (mailbox_filecount < 0 && ob->quota_filecount_value > 0)))
2455 {
2456 off_t size;
2457 int filecount = 0;
2458 DEBUG(D_transport)
2459 debug_printf("quota checks on directory %s\n", check_path);
2460 size = check_dir_size(check_path, &filecount, regex);
2461 if (mailbox_size < 0) mailbox_size = size;
2462 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2463 }
2464
2465 /* Handle the case of creating a unique file in a given directory (not in
2466 maildir or mailstore format - this is how smail did it). A temporary name is
2467 used to create the file. Later, when it is written, the name is changed to a
2468 unique one. There is no need to lock the file. An attempt is made to create
2469 the directory if it does not exist. */
2470
2471 if (mbformat == mbf_smail)
2472 {
2473 DEBUG(D_transport)
2474 debug_printf("delivering to new file in %s\n", path);
2475 filename = dataname =
2476 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2477 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2478 if (fd < 0 && /* failed to open, and */
2479 (errno != ENOENT || /* either not non-exist */
2480 !ob->create_directory || /* or not allowed to make */
2481 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2482 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2483 {
2484 addr->basic_errno = errno;
2485 addr->message = string_sprintf("while creating file %s", filename);
2486 return FALSE;
2487 }
2488 }
2489
2490 #ifdef SUPPORT_MAILDIR
2491
2492 /* Handle the case of a unique file in maildir format. The file is written to
2493 the tmp subdirectory, with a prescribed form of name. */
2494
2495 else if (mbformat == mbf_maildir)
2496 {
2497 DEBUG(D_transport)
2498 debug_printf("delivering in maildir format in %s\n", path);
2499
2500 nametag = ob->maildir_tag;
2501
2502 /* Check that nametag expands successfully; a hard failure causes a panic
2503 return. The actual expansion for use happens again later, when
2504 $message_size is accurately known. */
2505
2506 if (nametag != NULL && expand_string(nametag) == NULL &&
2507 !expand_string_forcedfail)
2508 {
2509 addr->transport_return = PANIC;
2510 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2511 "for %s transport) failed: %s", nametag, tblock->name,
2512 expand_string_message);
2513 return FALSE;
2514 }
2515
2516 /* We ensured the existence of all the relevant directories above. Attempt
2517 to open the temporary file a limited number of times. I think this rather
2518 scary-looking for statement is actually OK. If open succeeds, the loop is
2519 broken; if not, there is a test on the value of i. Get the time again
2520 afresh each time round the loop. Its value goes into a variable that is
2521 checked at the end, to make sure we don't release this process until the
2522 clock has ticked. */
2523
2524 for (i = 1;; i++)
2525 {
2526 uschar *basename;
2527
2528 (void)gettimeofday(&msg_tv, NULL);
2529 basename = string_sprintf("%lu.H%luP%lu.%s", msg_tv.tv_sec,
2530 msg_tv.tv_usec, getpid(), primary_hostname);
2531
2532 filename = dataname = string_sprintf("tmp/%s", basename);
2533 newname = string_sprintf("new/%s", basename);
2534
2535 if (Ustat(filename, &statbuf) == 0)
2536 errno = EEXIST;
2537 else if (errno == ENOENT)
2538 {
2539 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2540 if (fd >= 0) break;
2541 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2542 filename, strerror(errno));
2543 }
2544
2545 /* Too many retries - give up */
2546
2547 if (i >= ob->maildir_retries)
2548 {
2549 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2550 filename, i, (i == 1)? "y" : "ies");
2551 addr->basic_errno = errno;
2552 if (errno == errno_quota || errno == ENOSPC)
2553 addr->user_message = US"mailbox is full";
2554 return FALSE;
2555 }
2556
2557 /* Open or stat failed but we haven't tried too many times yet. */
2558
2559 sleep(2);
2560 }
2561
2562 /* Note that we have to ensure the clock has ticked before leaving */
2563
2564 wait_for_tick = TRUE;
2565
2566 /* Why are these here? Put in because they are present in the non-maildir
2567 directory case above. */
2568
2569 (void)Uchown(filename, uid, gid);
2570 (void)Uchmod(filename, mode);
2571 }
2572
2573 #endif /* SUPPORT_MAILDIR */
2574
2575 #ifdef SUPPORT_MAILSTORE
2576
2577 /* Handle the case of a unique file in mailstore format. First write the
2578 envelope to a temporary file, then open the main file. The unique base name
2579 for the files consists of the message id plus the pid of this delivery
2580 process. */
2581
2582 else
2583 {
2584 FILE *env_file;
2585 address_item *taddr;
2586 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2587 string_base62((long int)getpid()));
2588
2589 DEBUG(D_transport)
2590 debug_printf("delivering in mailstore format in %s\n", path);
2591
2592 filename = string_sprintf("%s.tmp", mailstore_basename);
2593 newname = string_sprintf("%s.env", mailstore_basename);
2594 dataname = string_sprintf("%s.msg", mailstore_basename);
2595
2596 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2597 if (fd < 0 && /* failed to open, and */
2598 (errno != ENOENT || /* either not non-exist */
2599 !ob->create_directory || /* or not allowed to make */
2600 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2601 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2602 {
2603 addr->basic_errno = errno;
2604 addr->message = string_sprintf("while creating file %s", filename);
2605 return FALSE;
2606 }
2607
2608 /* Why are these here? Put in because they are present in the non-maildir
2609 directory case above. */
2610
2611 (void)Uchown(filename, uid, gid);
2612 (void)Uchmod(filename, mode);
2613
2614 /* Built a C stream from the open file descriptor. */
2615
2616 if ((env_file = fdopen(fd, "wb")) == NULL)
2617 {
2618 addr->basic_errno = errno;
2619 addr->transport_return = PANIC;
2620 addr->message = string_sprintf("fdopen of %s ("
2621 "for %s transport) failed", filename, tblock->name);
2622 (void)close(fd);
2623 Uunlink(filename);
2624 return FALSE;
2625 }
2626
2627 /* Write the envelope file, then close it. */
2628
2629 if (ob->mailstore_prefix != NULL)
2630 {
2631 uschar *s = expand_string(ob->mailstore_prefix);
2632 if (s == NULL)
2633 {
2634 if (!expand_string_forcedfail)
2635 {
2636 addr->transport_return = PANIC;
2637 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2638 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2639 tblock->name, expand_string_message);
2640 (void)fclose(env_file);
2641 Uunlink(filename);
2642 return FALSE;
2643 }
2644 }
2645 else
2646 {
2647 int n = Ustrlen(s);
2648 fprintf(env_file, "%s", CS s);
2649 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2650 }
2651 }
2652
2653 fprintf(env_file, "%s\n", sender_address);
2654
2655 for (taddr = addr; taddr!= NULL; taddr = taddr->next)
2656 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2657
2658 if (ob->mailstore_suffix != NULL)
2659 {
2660 uschar *s = expand_string(ob->mailstore_suffix);
2661 if (s == NULL)
2662 {
2663 if (!expand_string_forcedfail)
2664 {
2665 addr->transport_return = PANIC;
2666 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2667 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2668 tblock->name, expand_string_message);
2669 (void)fclose(env_file);
2670 Uunlink(filename);
2671 return FALSE;
2672 }
2673 }
2674 else
2675 {
2676 int n = Ustrlen(s);
2677 fprintf(env_file, "%s", CS s);
2678 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2679 }
2680 }
2681
2682 if (fclose(env_file) != 0)
2683 {
2684 addr->basic_errno = errno;
2685 addr->message = string_sprintf("while closing %s", filename);
2686 Uunlink(filename);
2687 return FALSE;
2688 }
2689
2690 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2691
2692 /* Now open the data file, and ensure that it has the correct ownership and
2693 mode. */
2694
2695 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2696 if (fd < 0)
2697 {
2698 addr->basic_errno = errno;
2699 addr->message = string_sprintf("while creating file %s", dataname);
2700 Uunlink(filename);
2701 return FALSE;
2702 }
2703 (void)Uchown(dataname, uid, gid);
2704 (void)Uchmod(dataname, mode);
2705 }
2706
2707 #endif /* SUPPORT_MAILSTORE */
2708
2709
2710 /* In all cases of writing to a new file, ensure that the file which is
2711 going to be renamed has the correct ownership and mode. */
2712
2713 (void)Uchown(filename, uid, gid);
2714 (void)Uchmod(filename, mode);
2715 }
2716
2717
2718 /* At last we can write the message to the file, preceded by any configured
2719 prefix line, and followed by any configured suffix line. If there are any
2720 writing errors, we must defer. */
2721
2722 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2723
2724 yield = OK;
2725 errno = 0;
2726
2727 /* If there is a local quota setting, check that we are not going to exceed it
2728 with this message if quota_is_inclusive is set; if it is not set, the check
2729 is for the mailbox already being over quota (i.e. the current message is not
2730 included in the check). */
2731
2732 if (!disable_quota && ob->quota_value > 0)
2733 {
2734 DEBUG(D_transport)
2735 {
2736 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2737 " this message = %d (%sincluded)\n",
2738 ob->quota_value, mailbox_size, message_size,
2739 ob->quota_is_inclusive? "" : "not ");
2740 debug_printf(" file count quota = %d count = %d\n",
2741 ob->quota_filecount_value, mailbox_filecount);
2742 }
2743 if (mailbox_size + (ob->quota_is_inclusive? message_size:0) > ob->quota_value)
2744 {
2745 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2746 yield = DEFER;
2747 errno = ERRNO_EXIMQUOTA;
2748 }
2749 else if (ob->quota_filecount_value > 0 &&
2750 mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2751 ob->quota_filecount_value)
2752 {
2753 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2754 yield = DEFER;
2755 errno = ERRNO_EXIMQUOTA;
2756 filecount_msg = US" filecount";
2757 }
2758 }
2759
2760 /* If we are writing in MBX format, what we actually do is to write the message
2761 to a temporary file, and then copy it to the real file once we know its size.
2762 This is the most straightforward way of getting the correct length in the
2763 separator line. So, what we do here is to save the real file descriptor, and
2764 replace it with one for a temporary file. The temporary file gets unlinked once
2765 opened, so that it goes away on closure. */
2766
2767 #ifdef SUPPORT_MBX
2768 if (yield == OK && ob->mbx_format)
2769 {
2770 temp_file = tmpfile();
2771 if (temp_file == NULL)
2772 {
2773 addr->basic_errno = errno;
2774 addr->message = US"while setting up temporary file";
2775 yield = DEFER;
2776 goto RETURN;
2777 }
2778 save_fd = fd;
2779 fd = fileno(temp_file);
2780 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2781 }
2782 #endif /* SUPPORT_MBX */
2783
2784 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2785 functions. */
2786
2787 transport_count = 0;
2788 transport_newlines = 0;
2789
2790 /* Write any configured prefix text first */
2791
2792 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2793 {
2794 uschar *prefix = expand_string(ob->message_prefix);
2795 if (prefix == NULL)
2796 {
2797 errno = ERRNO_EXPANDFAIL;
2798 addr->transport_return = PANIC;
2799 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2800 "transport) failed", ob->message_prefix, tblock->name);
2801 yield = DEFER;
2802 }
2803 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2804 }
2805
2806 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2807 various different values for batching are handled outside; if there is more
2808 than one address available here, all must be included. If any address is a
2809 file, use its parent in the RCPT TO. */
2810
2811 if (yield == OK && ob->use_bsmtp)
2812 {
2813 transport_count = 0;
2814 transport_newlines = 0;
2815 if (ob->use_crlf) cr = US"\r";
2816 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2817 yield = DEFER;
2818 else
2819 {
2820 address_item *a;
2821 transport_newlines++;
2822 for (a = addr; a != NULL; a = a->next)
2823 {
2824 address_item *b = testflag(a, af_pfr)? a->parent: a;
2825 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2826 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2827 { yield = DEFER; break; }
2828 transport_newlines++;
2829 }
2830 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2831 yield = DEFER;
2832 else
2833 transport_newlines++;
2834 }
2835 }
2836
2837 /* Now the message itself. The options for transport_write_message were set up
2838 at initialization time. */
2839
2840 if (yield == OK)
2841 {
2842 if (!transport_write_message(addr, fd, ob->options, 0, tblock->add_headers,
2843 tblock->remove_headers, ob->check_string, ob->escape_string,
2844 tblock->rewrite_rules, tblock->rewrite_existflags))
2845 yield = DEFER;
2846 }
2847
2848 /* Now a configured suffix. */
2849
2850 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2851 {
2852 uschar *suffix = expand_string(ob->message_suffix);
2853 if (suffix == NULL)
2854 {
2855 errno = ERRNO_EXPANDFAIL;
2856 addr->transport_return = PANIC;
2857 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2858 "transport) failed", ob->message_suffix, tblock->name);
2859 yield = DEFER;
2860 }
2861 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2862 }
2863
2864 /* If batch smtp, write the terminating dot. */
2865
2866 if (yield == OK && ob->use_bsmtp ) {
2867 if(!transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2868 else transport_newlines++;
2869 }
2870
2871 /* If MBX format is being used, all that writing was to the temporary file.
2872 However, if there was an earlier failure (Exim quota exceeded, for example),
2873 the temporary file won't have got opened - and no writing will have been done.
2874 If writing was OK, we restore the fd, and call a function that copies the
2875 message in MBX format into the real file. Otherwise use the temporary name in
2876 any messages. */
2877
2878 #ifdef SUPPORT_MBX
2879 if (temp_file != NULL && ob->mbx_format)
2880 {
2881 int mbx_save_errno;
2882 fd = save_fd;
2883
2884 if (yield == OK)
2885 {
2886 transport_count = 0; /* Reset transport count for actual write */
2887 /* No need to reset transport_newlines as we're just using a block copy
2888 * routine so the number won't be affected */
2889 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2890 }
2891 else if (errno >= 0) dataname = US"temporary file";
2892
2893 /* Preserve errno while closing the temporary file. */
2894
2895 mbx_save_errno = errno;
2896 (void)fclose(temp_file);
2897 errno = mbx_save_errno;
2898 }
2899 #endif /* SUPPORT_MBX */
2900
2901 /* Force out the remaining data to check for any errors; some OS don't allow
2902 fsync() to be called for a FIFO. */
2903
2904 if (yield == OK && !isfifo && EXIMfsync(fd) < 0) yield = DEFER;
2905
2906 /* Update message_size and message_linecount to the accurate count of bytes
2907 written, including added headers. Note; we subtract 1 from message_linecount as
2908 this variable doesn't count the new line between the header and the body of the
2909 message. */
2910
2911 message_size = transport_count;
2912 message_linecount = transport_newlines - 1;
2913
2914 /* If using a maildir++ quota file, add this message's size to it, and
2915 close the file descriptor, except when the quota has been disabled because we
2916 are delivering into an uncounted folder. */
2917
2918 #ifdef SUPPORT_MAILDIR
2919 if (!disable_quota)
2920 {
2921 if (yield == OK && maildirsize_fd >= 0)
2922 maildir_record_length(maildirsize_fd, message_size);
2923 maildir_save_errno = errno; /* Preserve errno while closing the file */
2924 if (maildirsize_fd >= 0)
2925 (void)close(maildirsize_fd);
2926 errno = maildir_save_errno;
2927 }
2928 #endif /* SUPPORT_MAILDIR */
2929
2930 /* If there is a quota warning threshold and we are have crossed it with this
2931 message, set the SPECIAL_WARN flag in the address, to cause a warning message
2932 to be sent. */
2933
2934 if (!disable_quota && THRESHOLD_CHECK)
2935 {
2936 off_t threshold = ob->quota_warn_threshold_value;
2937 if (ob->quota_warn_threshold_is_percent)
2938 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
2939 DEBUG(D_transport)
2940 debug_printf("quota = " OFF_T_FMT
2941 " threshold = " OFF_T_FMT
2942 " old size = " OFF_T_FMT
2943 " message size = %d\n",
2944 ob->quota_value, threshold, mailbox_size,
2945 message_size);
2946 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
2947 addr->special_action = SPECIAL_WARN;
2948
2949 /******* You might think that the test ought to be this:
2950 *
2951 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
2952 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
2953 *
2954 * (indeed, I was sent a patch with that in). However, it is possible to
2955 * have a warning threshold without actually imposing a quota, and I have
2956 * therefore kept Exim backwards compatible.
2957 ********/
2958
2959 }
2960
2961 /* Handle error while writing the file. Control should come here directly after
2962 the error, with the reason in errno. In the case of expansion failure in prefix
2963 or suffix, it will be ERRNO_EXPANDFAIL. */
2964
2965 if (yield != OK)
2966 {
2967 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
2968
2969 /* Save the error number. If positive, it will ultimately cause a strerror()
2970 call to generate some text. */
2971
2972 addr->basic_errno = errno;
2973
2974 /* For system or Exim quota excession, or disk full, set more_errno to the
2975 time since the file was last read. If delivery was into a directory, the
2976 time since last read logic is not relevant, in general. However, for maildir
2977 deliveries we can approximate it by looking at the last modified time of the
2978 "new" subdirectory. Since Exim won't be adding new messages, a change to the
2979 "new" subdirectory implies that an MUA has moved a message from there to the
2980 "cur" directory. */
2981
2982 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
2983 {
2984 addr->more_errno = 0;
2985 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
2986
2987 #ifdef SUPPORT_MAILDIR
2988 else if (mbformat == mbf_maildir)
2989 {
2990 struct stat statbuf;
2991 if (Ustat("new", &statbuf) < 0)
2992 {
2993 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
2994 "stat error %d for \"new\": %s\n", errno, strerror(errno));
2995 }
2996 else /* Want a repeatable time when in test harness */
2997 {
2998 addr->more_errno = running_in_test_harness? 10 :
2999 (int)time(NULL) - statbuf.st_mtime;
3000 }
3001 DEBUG(D_transport)
3002 debug_printf("maildir: time since \"new\" directory modified = %s\n",
3003 readconf_printtime(addr->more_errno));
3004 }
3005 #endif /* SUPPORT_MAILDIR */
3006 }
3007
3008 /* Handle system quota excession. Add an explanatory phrase for the error
3009 message, since some systems don't have special quota-excession errors,
3010 and on those that do, "quota" doesn't always mean anything to the user. */
3011
3012 if (errno == errno_quota)
3013 {
3014 #ifndef EDQUOT
3015 addr->message = string_sprintf("mailbox is full "
3016 "(quota exceeded while writing to file %s)", filename);
3017 #else
3018 addr->message = string_sprintf("mailbox is full");
3019 #endif /* EDQUOT */
3020 addr->user_message = US"mailbox is full";
3021 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
3022 dataname,
3023 isdirectory? US"" : US": time since file read = ",
3024 isdirectory? US"" : readconf_printtime(addr->more_errno));
3025 }
3026
3027 /* Handle Exim's own quota-imposition */
3028
3029 else if (errno == ERRNO_EXIMQUOTA)
3030 {
3031 addr->message = string_sprintf("mailbox is full "
3032 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
3033 dataname);
3034 addr->user_message = US"mailbox is full";
3035 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3036 filecount_msg, dataname,
3037 isdirectory? US"" : US": time since file read = ",
3038 isdirectory? US"" : readconf_printtime(addr->more_errno));
3039 }
3040
3041 /* Handle a process failure while writing via a filter; the return
3042 from child_close() is in more_errno. */
3043
3044 else if (errno == ERRNO_FILTER_FAIL)
3045 {
3046 yield = PANIC;
3047 addr->message = string_sprintf("transport filter process failed (%d) "
3048 "while writing to %s%s", addr->more_errno, dataname,
3049 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
3050 }
3051
3052 /* Handle failure to expand header changes */
3053
3054 else if (errno == ERRNO_CHHEADER_FAIL)
3055 {
3056 yield = PANIC;
3057 addr->message =
3058 string_sprintf("failed to expand headers_add or headers_remove while "
3059 "writing to %s: %s", dataname, expand_string_message);
3060 }
3061
3062 /* Handle failure to complete writing of a data block */
3063
3064 else if (errno == ERRNO_WRITEINCOMPLETE)
3065 {
3066 addr->message = string_sprintf("failed to write data block while "
3067 "writing to %s", dataname);
3068 }
3069
3070 /* Handle length mismatch on MBX copying */
3071
3072 #ifdef SUPPORT_MBX
3073 else if (errno == ERRNO_MBXLENGTH)
3074 {
3075 addr->message = string_sprintf("length mismatch while copying MBX "
3076 "temporary file to %s", dataname);
3077 }
3078 #endif /* SUPPORT_MBX */
3079
3080 /* For other errors, a general-purpose explanation, if the message is
3081 not already set. */
3082
3083 else if (addr->message == NULL)
3084 addr->message = string_sprintf("error while writing to %s", dataname);
3085
3086 /* For a file, reset the file size to what it was before we started, leaving
3087 the last modification time unchanged, so it will get reset also. All systems
3088 investigated so far have ftruncate(), whereas not all have the F_FREESP
3089 fcntl() call (BSDI & FreeBSD do not). */
3090
3091 if (!isdirectory) (void)ftruncate(fd, saved_size);
3092 }
3093
3094 /* Handle successful writing - we want the modification time to be now for
3095 appended files. Remove the default backstop error number. For a directory, now
3096 is the time to rename the file with a unique name. As soon as such a name
3097 appears it may get used by another process, so we close the file first and
3098 check that all is well. */
3099
3100 else
3101 {
3102 times.modtime = time(NULL);
3103 addr->basic_errno = 0;
3104
3105 /* Handle the case of writing to a new file in a directory. This applies
3106 to all single-file formats - maildir, mailstore, and "smail format". */
3107
3108 if (isdirectory)
3109 {
3110 if (fstat(fd, &statbuf) < 0)
3111 {
3112 addr->basic_errno = errno;
3113 addr->message = string_sprintf("while fstatting opened message file %s",
3114 filename);
3115 yield = DEFER;
3116 }
3117
3118 else if (close(fd) < 0)
3119 {
3120 addr->basic_errno = errno;
3121 addr->message = string_sprintf("close() error for %s",
3122 (ob->mailstore_format)? dataname : filename);
3123 yield = DEFER;
3124 }
3125
3126 /* File is successfully written and closed. Arrange to rename it. For the
3127 different kinds of single-file delivery, some games can be played with the
3128 name. The message size is by this time set to the accurate value so that
3129 its value can be used in expansions. */
3130
3131 else
3132 {
3133 uschar *renamename = newname;
3134 fd = -1;
3135
3136 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3137
3138 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3139 situation. The name is built by expanding the directory_file option, and
3140 we make the inode number available for use in this. The expansion was
3141 checked for syntactic validity above, before we wrote the file.
3142
3143 We have to be careful here, in case the file name exists. (In the other
3144 cases, the names used are constructed to be unique.) The rename()
3145 function just replaces an existing file - we don't want that! So instead
3146 of calling rename(), we must use link() and unlink().
3147
3148 In this case, if the link fails because of an existing file, we wait
3149 for one second and try the expansion again, to see if it produces a
3150 different value. Do this up to 5 times unless the name stops changing.
3151 This makes it possible to build values that are based on the time, and
3152 still cope with races from multiple simultaneous deliveries. */
3153
3154 if (newname == NULL)
3155 {
3156 int i;
3157 uschar *renameleaf;
3158 uschar *old_renameleaf = US"";
3159
3160 for (i = 0; ; sleep(1), i++)
3161 {
3162 deliver_inode = statbuf.st_ino;
3163 renameleaf = expand_string(ob->dirfilename);
3164 deliver_inode = 0;
3165
3166 if (renameleaf == NULL)
3167 {
3168 addr->transport_return = PANIC;
3169 addr->message = string_sprintf("Expansion of \"%s\" "
3170 "(directory_file for %s transport) failed: %s",
3171 ob->dirfilename, tblock->name, expand_string_message);
3172 goto RETURN;
3173 }
3174
3175 renamename = string_sprintf("%s/%s", path, renameleaf);
3176 if (Ulink(filename, renamename) < 0)
3177 {
3178 DEBUG(D_transport) debug_printf("link failed: %s\n",
3179 strerror(errno));
3180 if (errno != EEXIST || i >= 4 ||
3181 Ustrcmp(renameleaf, old_renameleaf) == 0)
3182 {
3183 addr->basic_errno = errno;
3184 addr->message = string_sprintf("while renaming %s as %s",
3185 filename, renamename);
3186 yield = DEFER;
3187 break;
3188 }
3189 old_renameleaf = renameleaf;
3190 DEBUG(D_transport) debug_printf("%s exists - trying again\n",
3191 renamename);
3192 }
3193 else
3194 {
3195 Uunlink(filename);
3196 filename = NULL;
3197 break;
3198 }
3199 } /* re-expand loop */
3200 } /* not mailstore or maildir */
3201
3202 /* For maildir and mailstore formats, the new name was created earlier,
3203 except that for maildir, there is the possibility of adding a "tag" on
3204 the end of the name by expanding the value of nametag. This usually
3205 includes a reference to the message size. The expansion of nametag was
3206 checked above, before the file was opened. It either succeeded, or
3207 provoked a soft failure. So any failure here can be treated as soft.
3208 Ignore non-printing characters and / and put a colon at the start if the
3209 first character is alphanumeric. */
3210
3211 else
3212 {
3213 if (nametag != NULL)
3214 {
3215 uschar *iptr = expand_string(nametag);
3216 if (iptr != NULL)
3217 {
3218 uschar *etag = store_get(Ustrlen(iptr) + 2);
3219 uschar *optr = etag;
3220 while (*iptr != 0)
3221 {
3222 if (mac_isgraph(*iptr) && *iptr != '/')
3223 {
3224 if (optr == etag && isalnum(*iptr)) *optr++ = ':';
3225 *optr++ = *iptr;
3226 }
3227 iptr++;
3228 }
3229 *optr = 0;
3230 renamename = string_sprintf