Debug: provide for SIGALRM tracking
[exim.git] / src / src / transports / appendfile.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8
9 #include "../exim.h"
10 #include "appendfile.h"
11
12 #ifdef SUPPORT_MAILDIR
13 #include "tf_maildir.h"
14 #endif
15
16
17 /* Options specific to the appendfile transport. They must be in alphabetic
18 order (note that "_" comes before the lower case letters). Some of them are
19 stored in the publicly visible instance block - these are flagged with the
20 opt_public flag. */
21
22 optionlist appendfile_transport_options[] = {
23 #ifdef SUPPORT_MAILDIR
24 { "*expand_maildir_use_size_file", opt_stringptr,
25 (void *)offsetof(appendfile_transport_options_block, expand_maildir_use_size_file) },
26 #endif
27 { "*set_use_fcntl_lock",opt_bool | opt_hidden,
28 (void *)offsetof(appendfile_transport_options_block, set_use_fcntl) },
29 { "*set_use_flock_lock",opt_bool | opt_hidden,
30 (void *)offsetof(appendfile_transport_options_block, set_use_flock) },
31 { "*set_use_lockfile", opt_bool | opt_hidden,
32 (void *)offsetof(appendfile_transport_options_block, set_use_lockfile) },
33 #ifdef SUPPORT_MBX
34 { "*set_use_mbx_lock", opt_bool | opt_hidden,
35 (void *)offsetof(appendfile_transport_options_block, set_use_mbx_lock) },
36 #endif
37 { "allow_fifo", opt_bool,
38 (void *)offsetof(appendfile_transport_options_block, allow_fifo) },
39 { "allow_symlink", opt_bool,
40 (void *)offsetof(appendfile_transport_options_block, allow_symlink) },
41 { "batch_id", opt_stringptr | opt_public,
42 (void *)offsetof(transport_instance, batch_id) },
43 { "batch_max", opt_int | opt_public,
44 (void *)offsetof(transport_instance, batch_max) },
45 { "check_group", opt_bool,
46 (void *)offsetof(appendfile_transport_options_block, check_group) },
47 { "check_owner", opt_bool,
48 (void *)offsetof(appendfile_transport_options_block, check_owner) },
49 { "check_string", opt_stringptr,
50 (void *)offsetof(appendfile_transport_options_block, check_string) },
51 { "create_directory", opt_bool,
52 (void *)offsetof(appendfile_transport_options_block, create_directory) },
53 { "create_file", opt_stringptr,
54 (void *)offsetof(appendfile_transport_options_block, create_file_string) },
55 { "directory", opt_stringptr,
56 (void *)offsetof(appendfile_transport_options_block, dirname) },
57 { "directory_file", opt_stringptr,
58 (void *)offsetof(appendfile_transport_options_block, dirfilename) },
59 { "directory_mode", opt_octint,
60 (void *)offsetof(appendfile_transport_options_block, dirmode) },
61 { "escape_string", opt_stringptr,
62 (void *)offsetof(appendfile_transport_options_block, escape_string) },
63 { "file", opt_stringptr,
64 (void *)offsetof(appendfile_transport_options_block, filename) },
65 { "file_format", opt_stringptr,
66 (void *)offsetof(appendfile_transport_options_block, file_format) },
67 { "file_must_exist", opt_bool,
68 (void *)offsetof(appendfile_transport_options_block, file_must_exist) },
69 { "lock_fcntl_timeout", opt_time,
70 (void *)offsetof(appendfile_transport_options_block, lock_fcntl_timeout) },
71 { "lock_flock_timeout", opt_time,
72 (void *)offsetof(appendfile_transport_options_block, lock_flock_timeout) },
73 { "lock_interval", opt_time,
74 (void *)offsetof(appendfile_transport_options_block, lock_interval) },
75 { "lock_retries", opt_int,
76 (void *)offsetof(appendfile_transport_options_block, lock_retries) },
77 { "lockfile_mode", opt_octint,
78 (void *)offsetof(appendfile_transport_options_block, lockfile_mode) },
79 { "lockfile_timeout", opt_time,
80 (void *)offsetof(appendfile_transport_options_block, lockfile_timeout) },
81 { "mailbox_filecount", opt_stringptr,
82 (void *)offsetof(appendfile_transport_options_block, mailbox_filecount_string) },
83 { "mailbox_size", opt_stringptr,
84 (void *)offsetof(appendfile_transport_options_block, mailbox_size_string) },
85 #ifdef SUPPORT_MAILDIR
86 { "maildir_format", opt_bool,
87 (void *)offsetof(appendfile_transport_options_block, maildir_format ) } ,
88 { "maildir_quota_directory_regex", opt_stringptr,
89 (void *)offsetof(appendfile_transport_options_block, maildir_dir_regex) },
90 { "maildir_retries", opt_int,
91 (void *)offsetof(appendfile_transport_options_block, maildir_retries) },
92 { "maildir_tag", opt_stringptr,
93 (void *)offsetof(appendfile_transport_options_block, maildir_tag) },
94 { "maildir_use_size_file", opt_expand_bool,
95 (void *)offsetof(appendfile_transport_options_block, maildir_use_size_file ) } ,
96 { "maildirfolder_create_regex", opt_stringptr,
97 (void *)offsetof(appendfile_transport_options_block, maildirfolder_create_regex ) },
98 #endif /* SUPPORT_MAILDIR */
99 #ifdef SUPPORT_MAILSTORE
100 { "mailstore_format", opt_bool,
101 (void *)offsetof(appendfile_transport_options_block, mailstore_format ) },
102 { "mailstore_prefix", opt_stringptr,
103 (void *)offsetof(appendfile_transport_options_block, mailstore_prefix ) },
104 { "mailstore_suffix", opt_stringptr,
105 (void *)offsetof(appendfile_transport_options_block, mailstore_suffix ) },
106 #endif /* SUPPORT_MAILSTORE */
107 #ifdef SUPPORT_MBX
108 { "mbx_format", opt_bool,
109 (void *)offsetof(appendfile_transport_options_block, mbx_format ) } ,
110 #endif /* SUPPORT_MBX */
111 { "message_prefix", opt_stringptr,
112 (void *)offsetof(appendfile_transport_options_block, message_prefix) },
113 { "message_suffix", opt_stringptr,
114 (void *)offsetof(appendfile_transport_options_block, message_suffix) },
115 { "mode", opt_octint,
116 (void *)offsetof(appendfile_transport_options_block, mode) },
117 { "mode_fail_narrower",opt_bool,
118 (void *)offsetof(appendfile_transport_options_block, mode_fail_narrower) },
119 { "notify_comsat", opt_bool,
120 (void *)offsetof(appendfile_transport_options_block, notify_comsat) },
121 { "quota", opt_stringptr,
122 (void *)offsetof(appendfile_transport_options_block, quota) },
123 { "quota_directory", opt_stringptr,
124 (void *)offsetof(appendfile_transport_options_block, quota_directory) },
125 { "quota_filecount", opt_stringptr,
126 (void *)offsetof(appendfile_transport_options_block, quota_filecount) },
127 { "quota_is_inclusive", opt_bool,
128 (void *)offsetof(appendfile_transport_options_block, quota_is_inclusive) },
129 { "quota_size_regex", opt_stringptr,
130 (void *)offsetof(appendfile_transport_options_block, quota_size_regex) },
131 { "quota_warn_message", opt_stringptr | opt_public,
132 (void *)offsetof(transport_instance, warn_message) },
133 { "quota_warn_threshold", opt_stringptr,
134 (void *)offsetof(appendfile_transport_options_block, quota_warn_threshold) },
135 { "use_bsmtp", opt_bool,
136 (void *)offsetof(appendfile_transport_options_block, use_bsmtp) },
137 { "use_crlf", opt_bool,
138 (void *)offsetof(appendfile_transport_options_block, use_crlf) },
139 { "use_fcntl_lock", opt_bool_set,
140 (void *)offsetof(appendfile_transport_options_block, use_fcntl) },
141 { "use_flock_lock", opt_bool_set,
142 (void *)offsetof(appendfile_transport_options_block, use_flock) },
143 { "use_lockfile", opt_bool_set,
144 (void *)offsetof(appendfile_transport_options_block, use_lockfile) },
145 #ifdef SUPPORT_MBX
146 { "use_mbx_lock", opt_bool_set,
147 (void *)offsetof(appendfile_transport_options_block, use_mbx_lock) },
148 #endif /* SUPPORT_MBX */
149 };
150
151 /* Size of the options list. An extern variable has to be used so that its
152 address can appear in the tables drtables.c. */
153
154 int appendfile_transport_options_count =
155 sizeof(appendfile_transport_options)/sizeof(optionlist);
156
157
158 #ifdef MACRO_PREDEF
159
160 /* Dummy values */
161 appendfile_transport_options_block appendfile_transport_option_defaults = {0};
162 void appendfile_transport_init(transport_instance *tblock) {}
163 BOOL appendfile_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
164
165 #else /*!MACRO_PREDEF*/
166
167 /* Default private options block for the appendfile transport. */
168
169 appendfile_transport_options_block appendfile_transport_option_defaults = {
170 NULL, /* filename */
171 NULL, /* dirname */
172 US"q${base62:$tod_epoch}-$inode", /* dirfilename */
173 NULL, /* message_prefix (default reset in init if not bsmtp) */
174 NULL, /* message_suffix (ditto) */
175 US"anywhere", /* create_file_string (string value for create_file) */
176 NULL, /* quota */
177 NULL, /* quota_directory */
178 NULL, /* quota_filecount */
179 NULL, /* quota_size_regex */
180 NULL, /* quota_warn_threshold */
181 NULL, /* mailbox_size_string */
182 NULL, /* mailbox_filecount_string */
183 NULL, /* expand_maildir_use_size_file */
184 US"^(?:cur|new|\\..*)$", /* maildir_dir_regex */
185 NULL, /* maildir_tag */
186 NULL, /* maildirfolder_create_regex */
187 NULL, /* mailstore_prefix */
188 NULL, /* mailstore_suffix */
189 NULL, /* check_string (default changed for non-bsmtp file)*/
190 NULL, /* escape_string (ditto) */
191 NULL, /* file_format */
192 0, /* quota_value */
193 0, /* quota_warn_threshold_value */
194 -1, /* mailbox_size_value */
195 -1, /* mailbox_filecount_value */
196 0, /* quota_filecount_value */
197 APPENDFILE_MODE, /* mode */
198 APPENDFILE_DIRECTORY_MODE, /* dirmode */
199 APPENDFILE_LOCKFILE_MODE, /* lockfile_mode */
200 30*60, /* lockfile_timeout */
201 0, /* lock_fcntl_timeout */
202 0, /* lock_flock_timeout */
203 10, /* lock_retries */
204 3, /* lock_interval */
205 10, /* maildir_retries */
206 create_anywhere,/* create_file */
207 0, /* options */
208 FALSE, /* allow_fifo */
209 FALSE, /* allow_symlink */
210 FALSE, /* check_group */
211 TRUE, /* check_owner */
212 TRUE, /* create_directory */
213 FALSE, /* notify_comsat */
214 TRUE, /* use_lockfile */
215 FALSE, /* set_use_lockfile */
216 TRUE, /* use_fcntl */
217 FALSE, /* set_use_fcntl */
218 FALSE, /* use_flock */
219 FALSE, /* set_use_flock */
220 FALSE, /* use_mbx_lock */
221 FALSE, /* set_use_mbx_lock */
222 FALSE, /* use_bsmtp */
223 FALSE, /* use_crlf */
224 FALSE, /* file_must_exist */
225 TRUE, /* mode_fail_narrower */
226 FALSE, /* maildir_format */
227 FALSE, /* maildir_use_size_file */
228 FALSE, /* mailstore_format */
229 FALSE, /* mbx_format */
230 FALSE, /* quota_warn_threshold_is_percent */
231 TRUE, /* quota_is_inclusive */
232 FALSE, /* quota_no_check */
233 FALSE /* quota_filecount_no_check */
234 };
235
236
237 /* Encodings for mailbox formats, and their names. MBX format is actually
238 supported only if SUPPORT_MBX is set. */
239
240 enum { mbf_unix, mbf_mbx, mbf_smail, mbf_maildir, mbf_mailstore };
241
242 static const char *mailbox_formats[] = {
243 "unix", "mbx", "smail", "maildir", "mailstore" };
244
245
246 /* Check warn threshold only if quota size set or not a percentage threshold
247 percentage check should only be done if quota > 0 */
248
249 #define THRESHOLD_CHECK (ob->quota_warn_threshold_value > 0 && \
250 (!ob->quota_warn_threshold_is_percent || ob->quota_value > 0))
251
252
253
254 /*************************************************
255 * Setup entry point *
256 *************************************************/
257
258 /* Called for each delivery in the privileged state, just before the uid/gid
259 are changed and the main entry point is called. We use this function to
260 expand any quota settings, so that it can access files that may not be readable
261 by the user. It is also used to pick up external mailbox size information, if
262 set.
263
264 Arguments:
265 tblock points to the transport instance
266 addrlist addresses about to be delivered (not used)
267 dummy not used (doesn't pass back data)
268 uid the uid that will be set (not used)
269 gid the gid that will be set (not used)
270 errmsg where to put an error message
271
272 Returns: OK, FAIL, or DEFER
273 */
274
275 static int
276 appendfile_transport_setup(transport_instance *tblock, address_item *addrlist,
277 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
278 {
279 appendfile_transport_options_block *ob =
280 (appendfile_transport_options_block *)(tblock->options_block);
281 uschar *q = ob->quota;
282 double default_value = 0.0;
283 int i;
284
285 addrlist = addrlist; /* Keep picky compilers happy */
286 dummy = dummy;
287 uid = uid;
288 gid = gid;
289
290 if (ob->expand_maildir_use_size_file)
291 ob->maildir_use_size_file = expand_check_condition(ob->expand_maildir_use_size_file,
292 US"`maildir_use_size_file` in transport", tblock->name);
293
294 /* Loop for quota, quota_filecount, quota_warn_threshold, mailbox_size,
295 mailbox_filecount */
296
297 for (i = 0; i < 5; i++)
298 {
299 double d;
300 int no_check = 0;
301 uschar *which = NULL;
302
303 if (q == NULL) d = default_value;
304 else
305 {
306 uschar *rest;
307 uschar *s = expand_string(q);
308
309 if (!s)
310 {
311 *errmsg = string_sprintf("Expansion of \"%s\" in %s transport failed: "
312 "%s", q, tblock->name, expand_string_message);
313 return f.search_find_defer ? DEFER : FAIL;
314 }
315
316 d = Ustrtod(s, &rest);
317
318 /* Handle following characters K, M, G, %, the latter being permitted
319 for quota_warn_threshold only. A threshold with no quota setting is
320 just ignored. */
321
322 if (tolower(*rest) == 'k') { d *= 1024.0; rest++; }
323 else if (tolower(*rest) == 'm') { d *= 1024.0*1024.0; rest++; }
324 else if (tolower(*rest) == 'g') { d *= 1024.0*1024.0*1024.0; rest++; }
325 else if (*rest == '%' && i == 2)
326 {
327 if (ob->quota_value <= 0 && !ob->maildir_use_size_file)
328 d = 0;
329 else if ((int)d < 0 || (int)d > 100)
330 {
331 *errmsg = string_sprintf("Invalid quota_warn_threshold percentage (%d)"
332 " for %s transport", (int)d, tblock->name);
333 return FAIL;
334 }
335 ob->quota_warn_threshold_is_percent = TRUE;
336 rest++;
337 }
338
339
340 /* For quota and quota_filecount there may be options
341 appended. Currently only "no_check", so we can be lazy parsing it */
342 if (i < 2 && Ustrstr(rest, "/no_check") == rest)
343 {
344 no_check = 1;
345 rest += sizeof("/no_check") - 1;
346 }
347
348 while (isspace(*rest)) rest++;
349
350 if (*rest != 0)
351 {
352 *errmsg = string_sprintf("Malformed value \"%s\" (expansion of \"%s\") "
353 "in %s transport", s, q, tblock->name);
354 return FAIL;
355 }
356 }
357
358 /* Set each value, checking for possible overflow. */
359
360 switch (i)
361 {
362 case 0:
363 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
364 which = US"quota";
365 ob->quota_value = (off_t)d;
366 ob->quota_no_check = no_check;
367 q = ob->quota_filecount;
368 break;
369
370 case 1:
371 if (d >= 2.0*1024.0*1024.0*1024.0)
372 which = US"quota_filecount";
373 ob->quota_filecount_value = (int)d;
374 ob->quota_filecount_no_check = no_check;
375 q = ob->quota_warn_threshold;
376 break;
377
378 case 2:
379 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
380 which = US"quota_warn_threshold";
381 ob->quota_warn_threshold_value = (off_t)d;
382 q = ob->mailbox_size_string;
383 default_value = -1.0;
384 break;
385
386 case 3:
387 if (d >= 2.0*1024.0*1024.0*1024.0 && sizeof(off_t) <= 4)
388 which = US"mailbox_size";;
389 ob->mailbox_size_value = (off_t)d;
390 q = ob->mailbox_filecount_string;
391 break;
392
393 case 4:
394 if (d >= 2.0*1024.0*1024.0*1024.0)
395 which = US"mailbox_filecount";
396 ob->mailbox_filecount_value = (int)d;
397 break;
398 }
399
400 if (which)
401 {
402 *errmsg = string_sprintf("%s value %.10g is too large (overflow) in "
403 "%s transport", which, d, tblock->name);
404 return FAIL;
405 }
406 }
407
408 return OK;
409 }
410
411
412
413 /*************************************************
414 * Initialization entry point *
415 *************************************************/
416
417 /* Called for each instance, after its options have been read, to
418 enable consistency checks to be done, or anything else that needs
419 to be set up. */
420
421 void
422 appendfile_transport_init(transport_instance *tblock)
423 {
424 appendfile_transport_options_block *ob =
425 (appendfile_transport_options_block *)(tblock->options_block);
426
427 /* Set up the setup entry point, to be called in the privileged state */
428
429 tblock->setup = appendfile_transport_setup;
430
431 /* Lock_retries must be greater than zero */
432
433 if (ob->lock_retries == 0) ob->lock_retries = 1;
434
435 /* Only one of a file name or directory name must be given. */
436
437 if (ob->filename != NULL && ob->dirname != NULL)
438 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
439 "only one of \"file\" or \"directory\" can be specified", tblock->name);
440
441 /* If a file name was specified, neither quota_filecount nor quota_directory
442 must be given. */
443
444 if (ob->filename != NULL)
445 {
446 if (ob->quota_filecount != NULL)
447 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
448 "quota_filecount must not be set without \"directory\"", tblock->name);
449 if (ob->quota_directory != NULL)
450 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
451 "quota_directory must not be set without \"directory\"", tblock->name);
452 }
453
454 /* The default locking depends on whether MBX is set or not. Change the
455 built-in default if none of the lock options has been explicitly set. At least
456 one form of locking is required in all cases, but mbx locking changes the
457 meaning of fcntl and flock locking. */
458
459 /* Not all operating systems provide flock(). For those that do, if flock is
460 requested, the default for fcntl is FALSE. */
461
462 if (ob->use_flock)
463 {
464 #ifdef NO_FLOCK
465 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
466 "flock() support was not available in the operating system when this "
467 "binary was built", tblock->name);
468 #endif /* NO_FLOCK */
469 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
470 }
471
472 #ifdef SUPPORT_MBX
473 if (ob->mbx_format)
474 {
475 if (!ob->set_use_lockfile && !ob->set_use_fcntl && !ob->set_use_flock &&
476 !ob->set_use_mbx_lock)
477 {
478 ob->use_lockfile = ob->use_flock = FALSE;
479 ob->use_mbx_lock = ob->use_fcntl = TRUE;
480 }
481 else if (ob->use_mbx_lock)
482 {
483 if (!ob->set_use_lockfile) ob->use_lockfile = FALSE;
484 if (!ob->set_use_fcntl) ob->use_fcntl = FALSE;
485 if (!ob->set_use_flock) ob->use_flock = FALSE;
486 if (!ob->use_fcntl && !ob->use_flock) ob->use_fcntl = TRUE;
487 }
488 }
489 #endif /* SUPPORT_MBX */
490
491 if (!ob->use_fcntl && !ob->use_flock && !ob->use_lockfile && !ob->use_mbx_lock)
492 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
493 "no locking configured", tblock->name);
494
495 /* Unset timeouts for non-used locking types */
496
497 if (!ob->use_fcntl) ob->lock_fcntl_timeout = 0;
498 if (!ob->use_flock) ob->lock_flock_timeout = 0;
499
500 /* If a directory name was specified, only one of maildir or mailstore may be
501 specified, and if quota_filecount or quota_directory is given, quota must
502 be set. */
503
504 if (ob->dirname != NULL)
505 {
506 if (ob->maildir_format && ob->mailstore_format)
507 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
508 "only one of maildir and mailstore may be specified", tblock->name);
509 if (ob->quota_filecount != NULL && ob->quota == NULL)
510 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
511 "quota must be set if quota_filecount is set", tblock->name);
512 if (ob->quota_directory != NULL && ob->quota == NULL)
513 log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s transport:\n "
514 "quota must be set if quota_directory is set", tblock->name);
515 }
516
517 /* If a fixed uid field is set, then a gid field must also be set. */
518
519 if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
520 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
521 "user set without group for the %s transport", tblock->name);
522
523 /* If "create_file" is set, check that a valid option is given, and set the
524 integer variable. */
525
526 if (ob->create_file_string != NULL)
527 {
528 int value = 0;
529 if (Ustrcmp(ob->create_file_string, "anywhere") == 0) value = create_anywhere;
530 else if (Ustrcmp(ob->create_file_string, "belowhome") == 0) value =
531 create_belowhome;
532 else if (Ustrcmp(ob->create_file_string, "inhome") == 0)
533 value = create_inhome;
534 else
535 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
536 "invalid value given for \"file_create\" for the %s transport: %s",
537 tblock->name, ob->create_file_string);
538 ob->create_file = value;
539 }
540
541 /* If quota_warn_threshold is set, set up default for warn_message. It may
542 not be used if the actual threshold for a given delivery ends up as zero,
543 of if it's given as a percentage and there's no quota setting. */
544
545 if (ob->quota_warn_threshold != NULL)
546 {
547 if (tblock->warn_message == NULL) tblock->warn_message = US
548 "To: $local_part@$domain\n"
549 "Subject: Your mailbox\n\n"
550 "This message is automatically created by mail delivery software (Exim).\n\n"
551 "The size of your mailbox has exceeded a warning threshold that is\n"
552 "set by the system administrator.\n";
553 }
554
555 /* If batch SMTP is set, force the check and escape strings, and arrange that
556 headers are also escaped. */
557
558 if (ob->use_bsmtp)
559 {
560 ob->check_string = US".";
561 ob->escape_string = US"..";
562 ob->options |= topt_escape_headers;
563 }
564
565 /* If not batch SMTP, not maildir, not mailstore, and directory is not set,
566 insert default values for for the affixes and the check/escape strings. */
567
568 else if (ob->dirname == NULL && !ob->maildir_format && !ob->mailstore_format)
569 {
570 if (ob->message_prefix == NULL) ob->message_prefix =
571 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
572 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
573 if (ob->check_string == NULL) ob->check_string = US"From ";
574 if (ob->escape_string == NULL) ob->escape_string = US">From ";
575
576 }
577
578 /* Set up the bitwise options for transport_write_message from the various
579 driver options. Only one of body_only and headers_only can be set. */
580
581 ob->options |=
582 (tblock->body_only ? topt_no_headers : 0) |
583 (tblock->headers_only ? topt_no_body : 0) |
584 (tblock->return_path_add ? topt_add_return_path : 0) |
585 (tblock->delivery_date_add ? topt_add_delivery_date : 0) |
586 (tblock->envelope_to_add ? topt_add_envelope_to : 0) |
587 ((ob->use_crlf || ob->mbx_format) ? topt_use_crlf : 0);
588 }
589
590
591
592 /*************************************************
593 * Notify comsat *
594 *************************************************/
595
596 /* The comsat daemon is the thing that provides asynchronous notification of
597 the arrival of local messages, if requested by the user by "biff y". It is a
598 BSD thing that uses a TCP/IP protocol for communication. A message consisting
599 of the text "user@offset" must be sent, where offset is the place in the
600 mailbox where new mail starts. There is no scope for telling it which file to
601 look at, which makes it a less than useful if mail is being delivered into a
602 non-standard place such as the user's home directory. In fact, it doesn't seem
603 to pay much attention to the offset.
604
605 Arguments:
606 user user name
607 offset offset in mailbox
608
609 Returns: nothing
610 */
611
612 static void
613 notify_comsat(uschar *user, off_t offset)
614 {
615 struct servent *sp;
616 host_item host;
617 host_item *h;
618 uschar buffer[256];
619
620 DEBUG(D_transport) debug_printf("notify_comsat called\n");
621
622 sprintf(CS buffer, "%.200s@" OFF_T_FMT "\n", user, offset);
623
624 if ((sp = getservbyname("biff", "udp")) == NULL)
625 {
626 DEBUG(D_transport) debug_printf("biff/udp is an unknown service");
627 return;
628 }
629
630 host.name = US"localhost";
631 host.next = NULL;
632
633
634 /* This code is all set up to look up "localhost" and use all its addresses
635 until one succeeds. However, it appears that at least on some systems, comsat
636 doesn't listen on the ::1 address. So for the moment, just force the address to
637 be 127.0.0.1. At some future stage, when IPv6 really is superseding IPv4, this
638 can be changed. (But actually, comsat is probably dying out anyway.) */
639
640 /******
641 if (host_find_byname(&host, NULL, 0, NULL, FALSE) == HOST_FIND_FAILED)
642 {
643 DEBUG(D_transport) debug_printf("\"localhost\" unknown\n");
644 return;
645 }
646 ******/
647
648 host.address = US"127.0.0.1";
649
650
651 for (h = &host; h; h = h->next)
652 {
653 int sock, rc;
654 int host_af = Ustrchr(h->address, ':') != NULL ? AF_INET6 : AF_INET;
655
656 DEBUG(D_transport) debug_printf("calling comsat on %s\n", h->address);
657
658 if ((sock = ip_socket(SOCK_DGRAM, host_af)) < 0) continue;
659
660 /* Connect never fails for a UDP socket, so don't set a timeout. */
661
662 (void)ip_connect(sock, host_af, h->address, ntohs(sp->s_port), 0, NULL);
663 rc = send(sock, buffer, Ustrlen(buffer) + 1, 0);
664 (void)close(sock);
665
666 if (rc >= 0) break;
667 DEBUG(D_transport)
668 debug_printf("send to comsat failed for %s: %s\n", strerror(errno),
669 h->address);
670 }
671 }
672
673
674
675 /*************************************************
676 * Check the format of a file *
677 *************************************************/
678
679 /* This function is called when file_format is set, to check that an existing
680 file has the right format. The format string contains text/transport pairs. The
681 string matching is literal. we just read big_buffer_size bytes, because this is
682 all about the first few bytes of a file.
683
684 Arguments:
685 cfd the open file
686 tblock the transport block
687 addr the address block - for inserting error data
688
689 Returns: pointer to the required transport, or NULL
690 */
691
692 transport_instance *
693 check_file_format(int cfd, transport_instance *tblock, address_item *addr)
694 {
695 const uschar *format =
696 ((appendfile_transport_options_block *)(tblock->options_block))->file_format;
697 uschar data[256];
698 int len = read(cfd, data, sizeof(data));
699 int sep = 0;
700 uschar *s;
701
702 DEBUG(D_transport) debug_printf("checking file format\n");
703
704 /* An empty file matches the current transport */
705
706 if (len == 0) return tblock;
707
708 /* Search the formats for a match */
709
710 while ((s = string_nextinlist(&format,&sep,big_buffer,big_buffer_size)))
711 {
712 int slen = Ustrlen(s);
713 BOOL match = len >= slen && Ustrncmp(data, s, slen) == 0;
714 uschar *tp = string_nextinlist(&format, &sep, big_buffer, big_buffer_size);
715
716 if (match && tp)
717 {
718 transport_instance *tt;
719 for (tt = transports; tt; tt = tt->next)
720 if (Ustrcmp(tp, tt->name) == 0)
721 {
722 DEBUG(D_transport)
723 debug_printf("file format -> %s transport\n", tt->name);
724 return tt;
725 }
726 addr->basic_errno = ERRNO_BADTRANSPORT;
727 addr->message = string_sprintf("%s transport (for %.*s format) not found",
728 tp, slen, data);
729 return NULL;
730 }
731 }
732
733 /* Failed to find a match */
734
735 addr->basic_errno = ERRNO_FORMATUNKNOWN;
736 addr->message = US"mailbox file format unrecognized";
737 return NULL;
738 }
739
740
741
742
743 /*************************************************
744 * Check directory's files for quota *
745 *************************************************/
746
747 /* This function is called if quota is set for one of the delivery modes that
748 delivers into a specific directory. It scans the directory and stats all the
749 files in order to get a total size and count. This is an expensive thing to do,
750 but some people are prepared to bear the cost. Alternatively, if size_regex is
751 set, it is used as a regex to try to extract the size from the file name, a
752 strategy that some people use on maildir files on systems where the users have
753 no shell access.
754
755 The function is global, because it is also called from tf_maildir.c for maildir
756 folders (which should contain only regular files).
757
758 Note: Any problems can be written to debugging output, but cannot be written to
759 the log, because we are running as an unprivileged user here.
760
761 Arguments:
762 dirname the name of the directory
763 countptr where to add the file count (because this function recurses)
764 regex a compiled regex to get the size from a name
765
766 Returns: the sum of the sizes of the stattable files
767 zero if the directory cannot be opened
768 */
769
770 off_t
771 check_dir_size(uschar *dirname, int *countptr, const pcre *regex)
772 {
773 DIR *dir;
774 off_t sum = 0;
775 int count = *countptr;
776 struct dirent *ent;
777 struct stat statbuf;
778
779 dir = opendir(CS dirname);
780 if (dir == NULL) return 0;
781
782 while ((ent = readdir(dir)) != NULL)
783 {
784 uschar *name = US ent->d_name;
785 uschar buffer[1024];
786
787 if (Ustrcmp(name, ".") == 0 || Ustrcmp(name, "..") == 0) continue;
788
789 count++;
790
791 /* If there's a regex, try to find the size using it */
792
793 if (regex != NULL)
794 {
795 int ovector[6];
796 if (pcre_exec(regex, NULL, CS name, Ustrlen(name), 0, 0, ovector,6) >= 2)
797 {
798 uschar *endptr;
799 off_t size = (off_t)Ustrtod(name + ovector[2], &endptr);
800 if (endptr == name + ovector[3])
801 {
802 sum += size;
803 DEBUG(D_transport)
804 debug_printf("check_dir_size: size from %s is " OFF_T_FMT "\n", name,
805 size);
806 continue;
807 }
808 }
809 DEBUG(D_transport)
810 debug_printf("check_dir_size: regex did not match %s\n", name);
811 }
812
813 /* No regex or no match for the regex, or captured non-digits */
814
815 if (!string_format(buffer, sizeof(buffer), "%s/%s", dirname, name))
816 {
817 DEBUG(D_transport)
818 debug_printf("check_dir_size: name too long: dir=%s name=%s\n", dirname,
819 name);
820 continue;
821 }
822
823 if (Ustat(buffer, &statbuf) < 0)
824 {
825 DEBUG(D_transport)
826 debug_printf("check_dir_size: stat error %d for %s: %s\n", errno, buffer,
827 strerror(errno));
828 continue;
829 }
830
831 if ((statbuf.st_mode & S_IFMT) == S_IFREG)
832 sum += statbuf.st_size;
833 else if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
834 sum += check_dir_size(buffer, &count, regex);
835 }
836
837 closedir(dir);
838 DEBUG(D_transport)
839 debug_printf("check_dir_size: dir=%s sum=" OFF_T_FMT " count=%d\n", dirname,
840 sum, count);
841
842 *countptr = count;
843 return sum;
844 }
845
846
847
848
849 /*************************************************
850 * Apply a lock to a file descriptor *
851 *************************************************/
852
853 /* This function applies a lock to a file descriptor, using a blocking or
854 non-blocking lock, depending on the timeout value. It can apply either or
855 both of a fcntl() and a flock() lock. However, not all OS support flock();
856 for those that don't, the use_flock option cannot be set.
857
858 Arguments:
859 fd the file descriptor
860 fcntltype type of lock, specified as F_WRLCK or F_RDLCK (that is, in
861 fcntl() format); the flock() type is deduced if needed
862 dofcntl do fcntl() locking
863 fcntltime non-zero to use blocking fcntl()
864 doflock do flock() locking
865 flocktime non-zero to use blocking flock()
866
867 Returns: yield of the fcntl() or flock() call, with errno preserved;
868 sigalrm_seen set if there has been a timeout
869 */
870
871 static int
872 apply_lock(int fd, int fcntltype, BOOL dofcntl, int fcntltime, BOOL doflock,
873 int flocktime)
874 {
875 int yield = 0;
876 int save_errno;
877 struct flock lock_data;
878 lock_data.l_type = fcntltype;
879 lock_data.l_whence = lock_data.l_start = lock_data.l_len = 0;
880
881 sigalrm_seen = FALSE;
882
883 if (dofcntl)
884 {
885 if (fcntltime > 0)
886 {
887 ALARM(fcntltime);
888 yield = fcntl(fd, F_SETLKW, &lock_data);
889 save_errno = errno;
890 ALARM_CLR(0);
891 errno = save_errno;
892 }
893 else yield = fcntl(fd, F_SETLK, &lock_data);
894 }
895
896 #ifndef NO_FLOCK
897 if (doflock && (yield >= 0))
898 {
899 int flocktype = (fcntltype == F_WRLCK) ? LOCK_EX : LOCK_SH;
900 if (flocktime > 0)
901 {
902 ALARM(flocktime);
903 yield = flock(fd, flocktype);
904 save_errno = errno;
905 ALARM_CLR(0);
906 errno = save_errno;
907 }
908 else yield = flock(fd, flocktype | LOCK_NB);
909 }
910 #endif /* NO_FLOCK */
911
912 return yield;
913 }
914
915
916
917
918 #ifdef SUPPORT_MBX
919 /*************************************************
920 * Copy message into MBX mailbox *
921 *************************************************/
922
923 /* This function is called when a message intended for a MBX mailbox has been
924 written to a temporary file. We can now get the size of the message and then
925 copy it in MBX format to the mailbox.
926
927 Arguments:
928 to_fd fd to write to (the real mailbox)
929 from_fd fd to read from (the temporary file)
930 saved_size current size of mailbox
931
932 Returns: OK if all went well, DEFER otherwise, with errno preserved
933 the number of bytes written are added to transport_count
934 by virtue of calling transport_write_block()
935 */
936
937 /* Values taken from c-client */
938
939 #define MBX_HDRSIZE 2048
940 #define MBX_NUSERFLAGS 30
941
942 static int
943 copy_mbx_message(int to_fd, int from_fd, off_t saved_size)
944 {
945 int used;
946 off_t size;
947 struct stat statbuf;
948 transport_ctx tctx = { .u={.fd = to_fd}, .options = topt_not_socket };
949
950 /* If the current mailbox size is zero, write a header block */
951
952 if (saved_size == 0)
953 {
954 int i;
955 uschar *s;
956 memset (deliver_out_buffer, '\0', MBX_HDRSIZE);
957 sprintf(CS(s = deliver_out_buffer), "*mbx*\015\012%08lx00000000\015\012",
958 (long int)time(NULL));
959 for (i = 0; i < MBX_NUSERFLAGS; i++)
960 sprintf (CS(s += Ustrlen(s)), "\015\012");
961 if (!transport_write_block (&tctx, deliver_out_buffer, MBX_HDRSIZE, FALSE))
962 return DEFER;
963 }
964
965 DEBUG(D_transport) debug_printf("copying MBX message from temporary file\n");
966
967 /* Now construct the message's header from the time and the RFC822 file
968 size, including CRLFs, which is the size of the input (temporary) file. */
969
970 if (fstat(from_fd, &statbuf) < 0) return DEFER;
971 size = statbuf.st_size;
972
973 sprintf (CS deliver_out_buffer, "%s," OFF_T_FMT ";%08lx%04x-%08x\015\012",
974 tod_stamp(tod_mbx), size, 0L, 0, 0);
975 used = Ustrlen(deliver_out_buffer);
976
977 /* Rewind the temporary file, and copy it over in chunks. */
978
979 if (lseek(from_fd, 0 , SEEK_SET) < 0) return DEFER;
980
981 while (size > 0)
982 {
983 int len = read(from_fd, deliver_out_buffer + used,
984 DELIVER_OUT_BUFFER_SIZE - used);
985 if (len <= 0)
986 {
987 if (len == 0) errno = ERRNO_MBXLENGTH;
988 return DEFER;
989 }
990 if (!transport_write_block(&tctx, deliver_out_buffer, used + len, FALSE))
991 return DEFER;
992 size -= len;
993 used = 0;
994 }
995
996 return OK;
997 }
998 #endif /* SUPPORT_MBX */
999
1000
1001
1002 /*************************************************
1003 * Check creation is permitted *
1004 *************************************************/
1005
1006 /* This function checks whether a given file name is permitted to be created,
1007 as controlled by the create_file option. If no home directory is set, however,
1008 we can't do any tests.
1009
1010 Arguments:
1011 filename the file name
1012 create_file the ob->create_file option
1013
1014 Returns: TRUE if creation is permitted
1015 */
1016
1017 static BOOL
1018 check_creation(uschar *filename, int create_file)
1019 {
1020 BOOL yield = TRUE;
1021
1022 if (deliver_home != NULL && create_file != create_anywhere)
1023 {
1024 int len = Ustrlen(deliver_home);
1025 uschar *file = filename;
1026
1027 while (file[0] == '/' && file[1] == '/') file++;
1028 if (Ustrncmp(file, deliver_home, len) != 0 || file[len] != '/' ||
1029 ( Ustrchr(file+len+2, '/') != NULL &&
1030 (
1031 create_file != create_belowhome ||
1032 Ustrstr(file+len, "/../") != NULL
1033 )
1034 )
1035 ) yield = FALSE;
1036
1037 /* If yield is TRUE, the file name starts with the home directory, and does
1038 not contain any instances of "/../" in the "belowhome" case. However, it may
1039 still contain symbolic links. We can check for this by making use of
1040 realpath(), which most Unixes seem to have (but make it possible to cut this
1041 out). We can't just use realpath() on the whole file name, because we know
1042 the file itself doesn't exist, and intermediate directories may also not
1043 exist. What we want to know is the real path of the longest existing part of
1044 the path. That must match the home directory's beginning, whichever is the
1045 shorter. */
1046
1047 #ifndef NO_REALPATH
1048 if (yield && create_file == create_belowhome)
1049 {
1050 uschar *slash, *next;
1051 uschar *rp = NULL;
1052 for (slash = Ustrrchr(file, '/'); /* There is known to be one */
1053 rp == NULL && slash > file; /* Stop if reached beginning */
1054 slash = next)
1055 {
1056 *slash = 0;
1057 rp = US realpath(CS file, CS big_buffer);
1058 next = Ustrrchr(file, '/');
1059 *slash = '/';
1060 }
1061
1062 /* If rp == NULL it means that none of the relevant directories exist.
1063 This is not a problem here - it means that no symbolic links can exist,
1064 which is all we are worried about. Otherwise, we must compare it
1065 against the start of the home directory. However, that may itself
1066 contain symbolic links, so we have to "realpath" it as well, if
1067 possible. */
1068
1069 if (rp != NULL)
1070 {
1071 uschar hdbuffer[PATH_MAX+1];
1072 uschar *rph = deliver_home;
1073 int rlen = Ustrlen(big_buffer);
1074
1075 rp = US realpath(CS deliver_home, CS hdbuffer);
1076 if (rp != NULL)
1077 {
1078 rph = hdbuffer;
1079 len = Ustrlen(rph);
1080 }
1081
1082 if (rlen > len) rlen = len;
1083 if (Ustrncmp(rph, big_buffer, rlen) != 0)
1084 {
1085 yield = FALSE;
1086 DEBUG(D_transport) debug_printf("Real path \"%s\" does not match \"%s\"\n",
1087 big_buffer, deliver_home);
1088 }
1089 }
1090 }
1091 #endif /* NO_REALPATH */
1092 }
1093
1094 return yield;
1095 }
1096
1097
1098
1099 /*************************************************
1100 * Main entry point *
1101 *************************************************/
1102
1103 /* See local README for general interface details. This transport always
1104 returns FALSE, indicating that the status which has been placed in the first
1105 address should be copied to any other addresses in a batch.
1106
1107 Appendfile delivery is tricky and has led to various security problems in other
1108 mailers. The logic used here is therefore laid out in some detail. When this
1109 function is called, we are running in a subprocess which has had its gid and
1110 uid set to the appropriate values. Therefore, we cannot write directly to the
1111 exim logs. Any errors must be handled by setting appropriate return codes.
1112 Note that the default setting for addr->transport_return is DEFER, so it need
1113 not be set unless some other value is required.
1114
1115 The code below calls geteuid() rather than getuid() to get the current uid
1116 because in weird configurations not running setuid root there may be a
1117 difference. In the standard configuration, where setuid() has been used in the
1118 delivery process, there will be no difference between the uid and the euid.
1119
1120 (1) If the af_file flag is set, this is a delivery to a file after .forward or
1121 alias expansion. Otherwise, there must be a configured file name or
1122 directory name.
1123
1124 The following items apply in the case when a file name (as opposed to a
1125 directory name) is given, that is, when appending to a single file:
1126
1127 (2f) Expand the file name.
1128
1129 (3f) If the file name is /dev/null, return success (optimization).
1130
1131 (4f) If the file_format options is set, open the file for reading, and check
1132 that the bytes at the start of the file match one of the given strings.
1133 If the check indicates a transport other than the current one should be
1134 used, pass control to that other transport. Otherwise continue. An empty
1135 or non-existent file matches the current transport. The file is closed
1136 after the check.
1137
1138 (5f) If a lock file is required, create it (see extensive separate comments
1139 below about the algorithm for doing this). It is important to do this
1140 before opening the mailbox if NFS is in use.
1141
1142 (6f) Stat the file, using lstat() rather than stat(), in order to pick up
1143 details of any symbolic link.
1144
1145 (7f) If the file already exists:
1146
1147 Check the owner and group if necessary, and defer if they are wrong.
1148
1149 If it is a symbolic link AND the allow_symlink option is set (NOT the
1150 default), go back to (6f) but this time use stat() instead of lstat().
1151
1152 If it's not a regular file (or FIFO when permitted), defer delivery.
1153
1154 Check permissions. If the required permissions are *less* than the
1155 existing ones, or supplied by the address (often by the user via filter),
1156 chmod() the file. Otherwise, defer.
1157
1158 Save the inode number.
1159
1160 Open with O_RDRW + O_APPEND, thus failing if the file has vanished.
1161
1162 If open fails because the file does not exist, go to (6f); on any other
1163 failure, defer.
1164
1165 Check the inode number hasn't changed - I realize this isn't perfect (an
1166 inode can be reused) but it's cheap and will catch some of the races.
1167
1168 Check it's still a regular file (or FIFO if permitted).
1169
1170 Check that the owner and permissions haven't changed.
1171
1172 If file_format is set, check that the file still matches the format for
1173 the current transport. If not, defer delivery.
1174
1175 (8f) If file does not exist initially:
1176
1177 Open with O_WRONLY + O_EXCL + O_CREAT with configured mode, unless we know
1178 this is via a symbolic link (only possible if allow_symlinks is set), in
1179 which case don't use O_EXCL, as it doesn't work.
1180
1181 If open fails because the file already exists, go to (6f). To avoid
1182 looping for ever in a situation where the file is continuously being
1183 created and deleted, all of this happens inside a loop that operates
1184 lock_retries times and includes the fcntl and flock locking. If the
1185 loop completes without the file getting opened, defer and request
1186 freezing, because something really weird is happening.
1187
1188 If open fails for any other reason, defer for subsequent delivery except
1189 when this is a file delivery resulting from an alias or forward expansion
1190 and the error is EPERM or ENOENT or EACCES, in which case FAIL as this is
1191 most likely a user rather than a configuration error.
1192
1193 (9f) We now have the file checked and open for writing. If so configured, lock
1194 it using fcntl, flock, or MBX locking rules. If this fails, close the file
1195 and goto (6f), up to lock_retries times, after sleeping for a while. If it
1196 still fails, give up and defer delivery.
1197
1198 (10f)Save the access time (for subsequent restoration) and the size of the
1199 file, for comsat and for re-setting if delivery fails in the middle -
1200 e.g. for quota exceeded.
1201
1202 The following items apply in the case when a directory name is given:
1203
1204 (2d) Create a new file in the directory using a temporary name, by opening for
1205 writing and with O_CREAT. If maildir format is being used, the file
1206 is created in a temporary subdirectory with a prescribed name. If
1207 mailstore format is being used, the envelope file is first created with a
1208 temporary name, then the data file.
1209
1210 The following items apply in all cases:
1211
1212 (11) We now have the file open for writing, and locked if it was given as a
1213 file name. Write the message and flush the file, unless there is a setting
1214 of the local quota option, in which case we can check for its excession
1215 without doing any writing.
1216
1217 In the case of MBX format mailboxes, the message is first written to a
1218 temporary file, in order to get its correct length. This is then copied to
1219 the real file, preceded by an MBX header.
1220
1221 If there is a quota error on writing, defer the address. Timeout logic
1222 will determine for how long retries are attempted. We restore the mailbox
1223 to its original length if it's a single file. There doesn't seem to be a
1224 uniform error code for quota excession (it even differs between SunOS4
1225 and some versions of SunOS5) so a system-dependent macro called
1226 ERRNO_QUOTA is used for it, and the value gets put into errno_quota at
1227 compile time.
1228
1229 For any other error (most commonly disk full), do the same.
1230
1231 The following applies after appending to a file:
1232
1233 (12f)Restore the atime; notify_comsat if required; close the file (which
1234 unlocks it if it was locked). Delete the lock file if it exists.
1235
1236 The following applies after writing a unique file in a directory:
1237
1238 (12d)For maildir format, rename the file into the new directory. For mailstore
1239 format, rename the envelope file to its correct name. Otherwise, generate
1240 a unique name from the directory_file option, and rename to that, possibly
1241 trying a few times if the file exists and re-expanding the name gives a
1242 different string.
1243
1244 This transport yields FAIL only when a file name is generated by an alias or
1245 forwarding operation and attempting to open it gives EPERM, ENOENT, or EACCES.
1246 All other failures return DEFER (in addr->transport_return). */
1247
1248
1249 BOOL
1250 appendfile_transport_entry(
1251 transport_instance *tblock, /* data for this instantiation */
1252 address_item *addr) /* address we are working on */
1253 {
1254 appendfile_transport_options_block *ob =
1255 (appendfile_transport_options_block *)(tblock->options_block);
1256 struct stat statbuf;
1257 uschar *fdname = NULL;
1258 uschar *filename = NULL;
1259 uschar *hitchname = NULL;
1260 uschar *dataname = NULL;
1261 uschar *lockname = NULL;
1262 uschar *newname = NULL;
1263 uschar *nametag = NULL;
1264 uschar *cr = US"";
1265 uschar *filecount_msg = US"";
1266 uschar *path;
1267 struct utimbuf times;
1268 struct timeval msg_tv;
1269 BOOL disable_quota = FALSE;
1270 BOOL isdirectory = FALSE;
1271 BOOL isfifo = FALSE;
1272 BOOL wait_for_tick = FALSE;
1273 uid_t uid = geteuid(); /* See note above */
1274 gid_t gid = getegid();
1275 int mbformat;
1276 int mode = (addr->mode > 0) ? addr->mode : ob->mode;
1277 off_t saved_size = -1;
1278 off_t mailbox_size = ob->mailbox_size_value;
1279 int mailbox_filecount = ob->mailbox_filecount_value;
1280 int hd = -1;
1281 int fd = -1;
1282 int yield = FAIL;
1283 int i;
1284
1285 #ifdef SUPPORT_MBX
1286 int save_fd = 0;
1287 int mbx_lockfd = -1;
1288 uschar mbx_lockname[40];
1289 FILE *temp_file = NULL;
1290 #endif /* SUPPORT_MBX */
1291
1292 #ifdef SUPPORT_MAILDIR
1293 int maildirsize_fd = -1; /* fd for maildirsize file */
1294 int maildir_save_errno;
1295 #endif
1296
1297
1298 DEBUG(D_transport) debug_printf("appendfile transport entered\n");
1299
1300 /* An "address_file" or "address_directory" transport is used to deliver to
1301 files specified via .forward or an alias file. Prior to release 4.20, the
1302 "file" and "directory" options were ignored in this case. This has been changed
1303 to allow the redirection data to specify what is in effect a folder, whose
1304 location is determined by the options on the transport.
1305
1306 Compatibility with the case when neither option is set is retained by forcing a
1307 value for the file or directory name. A directory delivery is assumed if the
1308 last character of the path from the router is '/'.
1309
1310 The file path is in the local part of the address, but not in the $local_part
1311 variable (that holds the parent local part). It is, however, in the
1312 $address_file variable. Below, we update the local part in the address if it
1313 changes by expansion, so that the final path ends up in the log. */
1314
1315 if (testflag(addr, af_file) &&
1316 ob->filename == NULL &&
1317 ob->dirname == NULL)
1318 {
1319 fdname = US"$address_file";
1320 if (address_file[Ustrlen(address_file)-1] == '/' ||
1321 ob->maildir_format ||
1322 ob->mailstore_format)
1323 isdirectory = TRUE;
1324 }
1325
1326 /* Handle (a) an "address file" delivery where "file" or "directory" is
1327 explicitly set and (b) a non-address_file delivery, where one of "file" or
1328 "directory" must be set; initialization ensures that they are not both set. */
1329
1330 if (fdname == NULL)
1331 {
1332 fdname = ob->filename;
1333 if (fdname == NULL)
1334 {
1335 fdname = ob->dirname;
1336 isdirectory = TRUE;
1337 }
1338 if (fdname == NULL)
1339 {
1340 addr->transport_return = PANIC;
1341 addr->message = string_sprintf("Mandatory file or directory option "
1342 "missing from %s transport", tblock->name);
1343 return FALSE;
1344 }
1345 }
1346
1347 /* Maildir and mailstore require a directory */
1348
1349 if ((ob->maildir_format || ob->mailstore_format) && !isdirectory)
1350 {
1351 addr->transport_return = PANIC;
1352 addr->message = string_sprintf("mail%s_format requires \"directory\" "
1353 "to be specified for the %s transport",
1354 ob->maildir_format ? "dir" : "store", tblock->name);
1355 return FALSE;
1356 }
1357
1358 path = expand_string(fdname);
1359
1360 if (path == NULL)
1361 {
1362 addr->transport_return = PANIC;
1363 addr->message = string_sprintf("Expansion of \"%s\" (file or directory "
1364 "name for %s transport) failed: %s", fdname, tblock->name,
1365 expand_string_message);
1366 return FALSE;
1367 }
1368
1369 if (path[0] != '/')
1370 {
1371 addr->message = string_sprintf("appendfile: file or directory name "
1372 "\"%s\" is not absolute", path);
1373 addr->basic_errno = ERRNO_NOTABSOLUTE;
1374 return FALSE;
1375 }
1376
1377 /* For a file delivery, make sure the local part in the address(es) is updated
1378 to the true local part. */
1379
1380 if (testflag(addr, af_file))
1381 {
1382 address_item *addr2;
1383 for (addr2 = addr; addr2 != NULL; addr2 = addr2->next)
1384 addr2->local_part = string_copy(path);
1385 }
1386
1387 /* The available mailbox formats depend on whether it is a directory or a file
1388 delivery. */
1389
1390 if (isdirectory)
1391 {
1392 mbformat =
1393 #ifdef SUPPORT_MAILDIR
1394 (ob->maildir_format) ? mbf_maildir :
1395 #endif
1396 #ifdef SUPPORT_MAILSTORE
1397 (ob->mailstore_format) ? mbf_mailstore :
1398 #endif
1399 mbf_smail;
1400 }
1401 else
1402 {
1403 mbformat =
1404 #ifdef SUPPORT_MBX
1405 (ob->mbx_format) ? mbf_mbx :
1406 #endif
1407 mbf_unix;
1408 }
1409
1410 DEBUG(D_transport)
1411 {
1412 debug_printf("appendfile: mode=%o notify_comsat=%d quota=" OFF_T_FMT
1413 "%s%s"
1414 " warning=" OFF_T_FMT "%s\n"
1415 " %s=%s format=%s\n message_prefix=%s\n message_suffix=%s\n "
1416 "maildir_use_size_file=%s\n",
1417 mode, ob->notify_comsat, ob->quota_value,
1418 ob->quota_no_check ? " (no_check)" : "",
1419 ob->quota_filecount_no_check ? " (no_check_filecount)" : "",
1420 ob->quota_warn_threshold_value,
1421 ob->quota_warn_threshold_is_percent ? "%" : "",
1422 isdirectory ? "directory" : "file",
1423 path, mailbox_formats[mbformat],
1424 (ob->message_prefix == NULL) ? US"null" : string_printing(ob->message_prefix),
1425 (ob->message_suffix == NULL) ? US"null" : string_printing(ob->message_suffix),
1426 (ob->maildir_use_size_file) ? "yes" : "no");
1427
1428 if (!isdirectory) debug_printf(" locking by %s%s%s%s%s\n",
1429 ob->use_lockfile ? "lockfile " : "",
1430 ob->use_mbx_lock ? "mbx locking (" : "",
1431 ob->use_fcntl ? "fcntl " : "",
1432 ob->use_flock ? "flock" : "",
1433 ob->use_mbx_lock ? ")" : "");
1434 }
1435
1436 /* If the -N option is set, can't do any more. */
1437
1438 if (f.dont_deliver)
1439 {
1440 DEBUG(D_transport)
1441 debug_printf("*** delivery by %s transport bypassed by -N option\n",
1442 tblock->name);
1443 addr->transport_return = OK;
1444 return FALSE;
1445 }
1446
1447 /* Handle the case of a file name. If the file name is /dev/null, we can save
1448 ourselves some effort and just give a success return right away. */
1449
1450 if (!isdirectory)
1451 {
1452 BOOL use_lstat = TRUE;
1453 BOOL file_opened = FALSE;
1454 BOOL allow_creation_here = TRUE;
1455
1456 if (Ustrcmp(path, "/dev/null") == 0)
1457 {
1458 addr->transport_return = OK;
1459 return FALSE;
1460 }
1461
1462 /* Set the name of the file to be opened, and the file to which the data
1463 is written, and find out if we are permitted to create a non-existent file. */
1464
1465 dataname = filename = path;
1466 allow_creation_here = check_creation(filename, ob->create_file);
1467
1468 /* If ob->create_directory is set, attempt to create the directories in
1469 which this mailbox lives, but only if we are permitted to create the file
1470 itself. We know we are dealing with an absolute path, because this was
1471 checked above. */
1472
1473 if (ob->create_directory && allow_creation_here)
1474 {
1475 uschar *p = Ustrrchr(path, '/');
1476 *p = '\0';
1477 if (!directory_make(NULL, path, ob->dirmode, FALSE))
1478 {
1479 addr->basic_errno = errno;
1480 addr->message =
1481 string_sprintf("failed to create directories for %s: %s", path,
1482 strerror(errno));
1483 DEBUG(D_transport) debug_printf("%s transport: %s\n", tblock->name, path);
1484 return FALSE;
1485 }
1486 *p = '/';
1487 }
1488
1489 /* If file_format is set we must check that any existing file matches one of
1490 the configured formats by checking the bytes it starts with. A match then
1491 indicates a specific transport - if it is not this one, pass control to it.
1492 Otherwise carry on here. An empty or non-existent file matches the current
1493 transport. We don't need to distinguish between non-existence and other open
1494 failures because if an existing file fails to open here, it will also fail
1495 again later when O_RDWR is used. */
1496
1497 if (ob->file_format != NULL)
1498 {
1499 int cfd = Uopen(path, O_RDONLY, 0);
1500 if (cfd >= 0)
1501 {
1502 transport_instance *tt = check_file_format(cfd, tblock, addr);
1503 (void)close(cfd);
1504
1505 /* If another transport is indicated, call it and return; if no transport
1506 was found, just return - the error data will have been set up.*/
1507
1508 if (tt != tblock)
1509 {
1510 if (tt != NULL)
1511 {
1512 set_process_info("delivering %s to %s using %s", message_id,
1513 addr->local_part, tt->name);
1514 debug_print_string(tt->debug_string);
1515 addr->transport = tt;
1516 (tt->info->code)(tt, addr);
1517 }
1518 return FALSE;
1519 }
1520 }
1521 }
1522
1523 /* The locking of mailbox files is worse than the naming of cats, which is
1524 known to be "a difficult matter" (T.S. Eliot) and just as cats must have
1525 three different names, so several different styles of locking are used.
1526
1527 Research in other programs that lock mailboxes shows that there is no
1528 universally standard method. Having mailboxes NFS-mounted on the system that
1529 is delivering mail is not the best thing, but people do run like this,
1530 and so the code must do its best to cope.
1531
1532 Three different locking mechanisms are supported. The initialization function
1533 checks that at least one is configured.
1534
1535 LOCK FILES
1536
1537 Unless no_use_lockfile is set, we attempt to build a lock file in a way that
1538 will work over NFS. Only after that is done do we actually open the mailbox
1539 and apply locks to it (if configured).
1540
1541 Originally, Exim got the file opened before doing anything about locking.
1542 However, a very occasional problem was observed on Solaris 2 when delivering
1543 over NFS. It is seems that when a file is opened with O_APPEND, the file size
1544 gets remembered at open time. If another process on another host (that's
1545 important) has the file open and locked and writes to it and then releases
1546 the lock while the first process is waiting to get the lock, the first
1547 process may fail to write at the new end point of the file - despite the very
1548 definite statement about O_APPEND in the man page for write(). Experiments
1549 have reproduced this problem, but I do not know any way of forcing a host to
1550 update its attribute cache for an open NFS file. It would be nice if it did
1551 so when a lock was taken out, but this does not seem to happen. Anyway, to
1552 reduce the risk of this problem happening, we now create the lock file
1553 (if configured) *before* opening the mailbox. That will prevent two different
1554 Exims opening the file simultaneously. It may not prevent clashes with MUAs,
1555 however, but Pine at least seems to operate in the same way.
1556
1557 Lockfiles should normally be used when NFS is involved, because of the above
1558 problem.
1559
1560 The logic for creating the lock file is:
1561
1562 . The name of the lock file is <mailbox-name>.lock
1563
1564 . First, create a "hitching post" name by adding the primary host name,
1565 current time and pid to the lock file name. This should be unique.
1566
1567 . Create the hitching post file using WRONLY + CREAT + EXCL.
1568
1569 . If that fails EACCES, we assume it means that the user is unable to create
1570 files in the mail spool directory. Some installations might operate in this
1571 manner, so there is a configuration option to allow this state not to be an
1572 error - we proceed to lock using fcntl only, after the file is open.
1573
1574 . Otherwise, an error causes a deferment of the address.
1575
1576 . Hard link the hitching post to the lock file name.
1577
1578 . If the link succeeds, we have successfully created the lock file. Simply
1579 close and unlink the hitching post file.
1580
1581 . If the link does not succeed, proceed as follows:
1582
1583 o Fstat the hitching post file, and then close and unlink it.
1584
1585 o Now examine the stat data. If the number of links to the file is exactly
1586 2, the linking succeeded but for some reason, e.g. an NFS server crash,
1587 the return never made it back, so the link() function gave a failure
1588 return.
1589
1590 . This method allows for the lock file to be created by some other process
1591 right up to the moment of the attempt to hard link it, and is also robust
1592 against NFS server crash-reboots, which would probably result in timeouts
1593 in the middle of link().
1594
1595 . System crashes may cause lock files to get left lying around, and some means
1596 of flushing them is required. The approach of writing a pid (used by smail
1597 and by elm) into the file isn't useful when NFS may be in use. Pine uses a
1598 timeout, which seems a better approach. Since any program that writes to a
1599 mailbox using a lock file should complete its task very quickly, Pine
1600 removes lock files that are older than 5 minutes. We allow the value to be
1601 configurable on the transport.
1602
1603 FCNTL LOCKING
1604
1605 If use_fcntl_lock is set, then Exim gets an exclusive fcntl() lock on the
1606 mailbox once it is open. This is done by default with a non-blocking lock.
1607 Failures to lock cause retries after a sleep, but only for a certain number
1608 of tries. A blocking lock is deliberately not used so that we don't hold the
1609 mailbox open. This minimizes the possibility of the NFS problem described
1610 under LOCK FILES above, if for some reason NFS deliveries are happening
1611 without lock files. However, the use of a non-blocking lock and sleep, though
1612 the safest approach, does not give the best performance on very busy systems.
1613 A blocking lock plus timeout does better. Therefore Exim has an option to
1614 allow it to work this way. If lock_fcntl_timeout is set greater than zero, it
1615 enables the use of blocking fcntl() calls.
1616
1617 FLOCK LOCKING
1618
1619 If use_flock_lock is set, then Exim gets an exclusive flock() lock in the
1620 same manner as for fcntl locking above. No-blocking/timeout is also set as
1621 above in lock_flock_timeout. Not all operating systems provide or support
1622 flock(). For those that don't (as determined by the definition of LOCK_SH in
1623 /usr/include/sys/file.h), use_flock_lock may not be set. For some OS, flock()
1624 is implemented (not precisely) on top of fcntl(), which means there's no
1625 point in actually using it.
1626
1627 MBX LOCKING
1628
1629 If use_mbx_lock is set (this is supported only if SUPPORT_MBX is defined)
1630 then the rules used for locking in c-client are used. Exim takes out a shared
1631 lock on the mailbox file, and an exclusive lock on the file whose name is
1632 /tmp/.<device-number>.<inode-number>. The shared lock on the mailbox stops
1633 any other MBX client from getting an exclusive lock on it and expunging it.
1634 It also stops any other MBX client from unlinking the /tmp lock when it has
1635 finished with it.
1636
1637 The exclusive lock on the /tmp file prevents any other MBX client from
1638 updating the mailbox in any way. When writing is finished, if an exclusive
1639 lock on the mailbox can be obtained, indicating there are no current sharers,
1640 the /tmp file is unlinked.
1641
1642 MBX locking can use either fcntl() or flock() locking. If neither
1643 use_fcntl_lock or use_flock_lock is set, it defaults to using fcntl() only.
1644 The calls for getting these locks are by default non-blocking, as for non-mbx
1645 locking, but can be made blocking by setting lock_fcntl_timeout and/or
1646 lock_flock_timeout as appropriate. As MBX delivery doesn't work over NFS, it
1647 probably makes sense to set timeouts for any MBX deliveries. */
1648
1649
1650 /* Build a lock file if configured to do so - the existence of a lock
1651 file is subsequently checked by looking for a non-negative value of the
1652 file descriptor hd - even though the file is no longer open. */
1653
1654 if (ob->use_lockfile)
1655 {
1656 /* cf. exim_lock.c */
1657 lockname = string_sprintf("%s.lock", filename);
1658 hitchname = string_sprintf( "%s.%s.%08x.%08x", lockname, primary_hostname,
1659 (unsigned int)(time(NULL)), (unsigned int)getpid());
1660
1661 DEBUG(D_transport) debug_printf("lock name: %s\nhitch name: %s\n", lockname,
1662 hitchname);
1663
1664 /* Lock file creation retry loop */
1665
1666 for (i = 0; i < ob->lock_retries; sleep(ob->lock_interval), i++)
1667 {
1668 int rc;
1669 hd = Uopen(hitchname, O_WRONLY | O_CREAT | O_EXCL, ob->lockfile_mode);
1670
1671 if (hd < 0)
1672 {
1673 addr->basic_errno = errno;
1674 addr->message =
1675 string_sprintf("creating lock file hitching post %s "
1676 "(euid=%ld egid=%ld)", hitchname, (long int)geteuid(),
1677 (long int)getegid());
1678 return FALSE;
1679 }
1680
1681 /* Attempt to hitch the hitching post to the lock file. If link()
1682 succeeds (the common case, we hope) all is well. Otherwise, fstat the
1683 file, and get rid of the hitching post. If the number of links was 2,
1684 the link was created, despite the failure of link(). If the hitch was
1685 not successful, try again, having unlinked the lock file if it is too
1686 old.
1687
1688 There's a version of Linux (2.0.27) which doesn't update its local cache
1689 of the inode after link() by default - which many think is a bug - but
1690 if the link succeeds, this code will be OK. It just won't work in the
1691 case when link() fails after having actually created the link. The Linux
1692 NFS person is fixing this; a temporary patch is available if anyone is
1693 sufficiently worried. */
1694
1695 if ((rc = Ulink(hitchname, lockname)) != 0) fstat(hd, &statbuf);
1696 (void)close(hd);
1697 Uunlink(hitchname);
1698 if (rc != 0 && statbuf.st_nlink != 2)
1699 {
1700 if (ob->lockfile_timeout > 0 && Ustat(lockname, &statbuf) == 0 &&
1701 time(NULL) - statbuf.st_ctime > ob->lockfile_timeout)
1702 {
1703 DEBUG(D_transport) debug_printf("unlinking timed-out lock file\n");
1704 Uunlink(lockname);
1705 }
1706 DEBUG(D_transport) debug_printf("link of hitching post failed - retrying\n");
1707 continue;
1708 }
1709
1710 DEBUG(D_transport) debug_printf("lock file created\n");
1711 break;
1712 }
1713
1714 /* Check for too many tries at creating the lock file */
1715
1716 if (i >= ob->lock_retries)
1717 {
1718 addr->basic_errno = ERRNO_LOCKFAILED;
1719 addr->message = string_sprintf("failed to lock mailbox %s (lock file)",
1720 filename);
1721 return FALSE;
1722 }
1723 }
1724
1725
1726 /* We now have to get the file open. First, stat() it and act on existence or
1727 non-existence. This is in a loop to handle the case of a file's being created
1728 or deleted as we watch, and also to handle retries when the locking fails.
1729 Rather than holding the file open while waiting for the fcntl() and/or
1730 flock() lock, we close and do the whole thing again. This should be safer,
1731 especially for NFS files, which might get altered from other hosts, making
1732 their cached sizes incorrect.
1733
1734 With the default settings, no symlinks are permitted, but there is an option
1735 to permit symlinks for those sysadmins that know what they are doing.
1736 Shudder. However, insist that the initial symlink is owned by the right user.
1737 Thus lstat() is used initially; if a symlink is discovered, the loop is
1738 repeated such that stat() is used, to look at the end file. */
1739
1740 for (i = 0; i < ob->lock_retries; i++)
1741 {
1742 int sleep_before_retry = TRUE;
1743 file_opened = FALSE;
1744
1745 if((use_lstat ? Ulstat(filename, &statbuf) : Ustat(filename, &statbuf)) != 0)
1746 {
1747 /* Let's hope that failure to stat (other than non-existence) is a
1748 rare event. */
1749
1750 if (errno != ENOENT)
1751 {
1752 addr->basic_errno = errno;
1753 addr->message = string_sprintf("attempting to stat mailbox %s",
1754 filename);
1755 goto RETURN;
1756 }
1757
1758 /* File does not exist. If it is required to pre-exist this state is an
1759 error. */
1760
1761 if (ob->file_must_exist)
1762 {
1763 addr->basic_errno = errno;
1764 addr->message = string_sprintf("mailbox %s does not exist, "
1765 "but file_must_exist is set", filename);
1766 goto RETURN;
1767 }
1768
1769 /* If not permitted to create this file because it isn't in or below
1770 the home directory, generate an error. */
1771
1772 if (!allow_creation_here)
1773 {
1774 addr->basic_errno = ERRNO_BADCREATE;
1775 addr->message = string_sprintf("mailbox %s does not exist, "
1776 "but creation outside the home directory is not permitted",
1777 filename);
1778 goto RETURN;
1779 }
1780
1781 /* Attempt to create and open the file. If open fails because of
1782 pre-existence, go round the loop again. For any other error, defer the
1783 address, except for an alias or forward generated file name with EPERM,
1784 ENOENT, or EACCES, as those are most likely to be user errors rather
1785 than Exim config errors. When a symbolic link is permitted and points
1786 to a non-existent file, we get here with use_lstat = FALSE. In this case
1787 we mustn't use O_EXCL, since it doesn't work. The file is opened RDRW for
1788 consistency and because MBX locking requires it in order to be able to
1789 get a shared lock. */
1790
1791 fd = Uopen(filename, O_RDWR | O_APPEND | O_CREAT |
1792 (use_lstat ? O_EXCL : 0), mode);
1793 if (fd < 0)
1794 {
1795 if (errno == EEXIST) continue;
1796 addr->basic_errno = errno;
1797 addr->message = string_sprintf("while creating mailbox %s",
1798 filename);
1799 if (testflag(addr, af_file) &&
1800 (errno == EPERM || errno == ENOENT || errno == EACCES))
1801 addr->transport_return = FAIL;
1802 goto RETURN;
1803 }
1804
1805 /* We have successfully created and opened the file. Ensure that the group
1806 and the mode are correct. */
1807
1808 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
1809 {
1810 addr->basic_errno = errno;
1811 addr->message = string_sprintf("while setting perms on mailbox %s",
1812 filename);
1813 addr->transport_return = FAIL;
1814 goto RETURN;
1815 }
1816 }
1817
1818
1819 /* The file already exists. Test its type, ownership, and permissions, and
1820 save the inode for checking later. If symlinks are permitted (not the
1821 default or recommended state) it may be a symlink that already exists.
1822 Check its ownership and then look for the file at the end of the link(s).
1823 This at least prevents one user creating a symlink for another user in
1824 a sticky directory. */
1825
1826 else
1827 {
1828 int oldmode = (int)statbuf.st_mode;
1829 ino_t inode = statbuf.st_ino;
1830 BOOL islink = (oldmode & S_IFMT) == S_IFLNK;
1831
1832 isfifo = FALSE; /* In case things are changing */
1833
1834 /* Check owner if required - the default. */
1835
1836 if (ob->check_owner && statbuf.st_uid != uid)
1837 {
1838 addr->basic_errno = ERRNO_BADUGID;
1839 addr->message = string_sprintf("mailbox %s%s has wrong uid "
1840 "(%ld != %ld)", filename,
1841 islink ? " (symlink)" : "",
1842 (long int)(statbuf.st_uid), (long int)uid);
1843 goto RETURN;
1844 }
1845
1846 /* Group is checked only if check_group is set. */
1847
1848 if (ob->check_group && statbuf.st_gid != gid)
1849 {
1850 addr->basic_errno = ERRNO_BADUGID;
1851 addr->message = string_sprintf("mailbox %s%s has wrong gid (%d != %d)",
1852 filename, islink ? " (symlink)" : "", statbuf.st_gid, gid);
1853 goto RETURN;
1854 }
1855
1856 /* Just in case this is a sticky-bit mail directory, we don't want
1857 users to be able to create hard links to other users' files. */
1858
1859 if (statbuf.st_nlink != 1)
1860 {
1861 addr->basic_errno = ERRNO_NOTREGULAR;
1862 addr->message = string_sprintf("mailbox %s%s has too many links (%d)",
1863 filename, islink ? " (symlink)" : "", statbuf.st_nlink);
1864 goto RETURN;
1865
1866 }
1867
1868 /* If symlinks are permitted (not recommended), the lstat() above will
1869 have found the symlink. Its ownership has just been checked; go round
1870 the loop again, using stat() instead of lstat(). That will never yield a
1871 mode of S_IFLNK. */
1872
1873 if (islink && ob->allow_symlink)
1874 {
1875 use_lstat = FALSE;
1876 i--; /* Don't count this time round */
1877 continue;
1878 }
1879
1880 /* An actual file exists. Check that it is a regular file, or FIFO
1881 if permitted. */
1882
1883 if (ob->allow_fifo && (oldmode & S_IFMT) == S_IFIFO) isfifo = TRUE;
1884
1885 else if ((oldmode & S_IFMT) != S_IFREG)
1886 {
1887 addr->basic_errno = ERRNO_NOTREGULAR;
1888 addr->message = string_sprintf("mailbox %s is not a regular file%s",
1889 filename, ob->allow_fifo ? " or named pipe" : "");
1890 goto RETURN;
1891 }
1892
1893 /* If the mode is not what it would be for a newly created file, change
1894 the permissions if the mode is supplied for the address. Otherwise,
1895 reduce but do not extend the permissions. If the newly created
1896 permissions are greater than the existing permissions, don't change
1897 things when the mode is not from the address. */
1898
1899 if ((oldmode = (oldmode & 07777)) != mode)
1900 {
1901 int diffs = oldmode ^ mode;
1902 if (addr->mode > 0 || (diffs & oldmode) == diffs)
1903 {
1904 DEBUG(D_transport) debug_printf("chmod %o %s\n", mode, filename);
1905 if (Uchmod(filename, mode) < 0)
1906 {
1907 addr->basic_errno = errno;
1908 addr->message = string_sprintf("attempting to chmod mailbox %s",
1909 filename);
1910 goto RETURN;
1911 }
1912 oldmode = mode;
1913 }
1914
1915 /* Mode not from address, and newly-created permissions are greater
1916 than existing permissions. Default is to complain, but it can be
1917 configured to go ahead and try to deliver anyway if that's what
1918 the administration wants. */
1919
1920 else if (ob->mode_fail_narrower)
1921 {
1922 addr->basic_errno = ERRNO_BADMODE;
1923 addr->message = string_sprintf("mailbox %s has the wrong mode %o "
1924 "(%o expected)", filename, oldmode, mode);
1925 goto RETURN;
1926 }
1927 }
1928
1929 /* We are happy with the existing file. Open it, and then do further
1930 tests to ensure that it is the same file that we were just looking at.
1931 If the file does not now exist, restart this loop, going back to using
1932 lstat again. For an NFS error, just defer; other opening errors are
1933 more serious. The file is opened RDWR so that its format can be checked,
1934 and also MBX locking requires the use of a shared (read) lock. However,
1935 a FIFO is opened WRONLY + NDELAY so that it fails if there is no process
1936 reading the pipe. */
1937
1938 fd = Uopen(filename, isfifo ? (O_WRONLY|O_NDELAY) : (O_RDWR|O_APPEND),
1939 mode);
1940 if (fd < 0)
1941 {
1942 if (errno == ENOENT)
1943 {
1944 use_lstat = TRUE;
1945 continue;
1946 }
1947 addr->basic_errno = errno;
1948 if (isfifo)
1949 {
1950 addr->message = string_sprintf("while opening named pipe %s "
1951 "(could mean no process is reading it)", filename);
1952 }
1953 else if (errno != EWOULDBLOCK)
1954 {
1955 addr->message = string_sprintf("while opening mailbox %s", filename);
1956 }
1957 goto RETURN;
1958 }
1959
1960 /* This fstat really shouldn't fail, as we have an open file! There's a
1961 dilemma here. We use fstat in order to be sure we are peering at the file
1962 we have got open. However, that won't tell us if the file was reached
1963 via a symbolic link. We checked this above, but there is a race exposure
1964 if the link was created between the previous lstat and the open. However,
1965 it would have to be created with the same inode in order to pass the
1966 check below. If ob->allow_symlink is set, causing the use of stat rather
1967 than lstat above, symbolic links may be there anyway, and the checking is
1968 weaker. */
1969
1970 if (fstat(fd, &statbuf) < 0)
1971 {
1972 addr->basic_errno = errno;
1973 addr->message = string_sprintf("attempting to stat open mailbox %s",
1974 filename);
1975 goto RETURN;
1976 }
1977
1978 /* Check the inode; this is isn't a perfect check, but gives some
1979 confidence. */
1980
1981 if (inode != statbuf.st_ino)
1982 {
1983 addr->basic_errno = ERRNO_INODECHANGED;
1984 addr->message = string_sprintf("opened mailbox %s inode number changed "
1985 "from " INO_T_FMT " to " INO_T_FMT, filename, inode, statbuf.st_ino);
1986 addr->special_action = SPECIAL_FREEZE;
1987 goto RETURN;
1988 }
1989
1990 /* Check it's still a regular file or FIFO, and the uid, gid, and
1991 permissions have not changed. */
1992
1993 if ((!isfifo && (statbuf.st_mode & S_IFMT) != S_IFREG) ||
1994 (isfifo && (statbuf.st_mode & S_IFMT) != S_IFIFO))
1995 {
1996 addr->basic_errno = ERRNO_NOTREGULAR;
1997 addr->message =
1998 string_sprintf("opened mailbox %s is no longer a %s", filename,
1999 isfifo ? "named pipe" : "regular file");
2000 addr->special_action = SPECIAL_FREEZE;
2001 goto RETURN;
2002 }
2003
2004 if ((ob->check_owner && statbuf.st_uid != uid) ||
2005 (ob->check_group && statbuf.st_gid != gid))
2006 {
2007 addr->basic_errno = ERRNO_BADUGID;
2008 addr->message =
2009 string_sprintf("opened mailbox %s has wrong uid or gid", filename);
2010 addr->special_action = SPECIAL_FREEZE;
2011 goto RETURN;
2012 }
2013
2014 if ((statbuf.st_mode & 07777) != oldmode)
2015 {
2016 addr->basic_errno = ERRNO_BADMODE;
2017 addr->message = string_sprintf("opened mailbox %s has wrong mode %o "
2018 "(%o expected)", filename, statbuf.st_mode & 07777, mode);
2019 addr->special_action = SPECIAL_FREEZE;
2020 goto RETURN;
2021 }
2022
2023 /* If file_format is set, check that the format of the file has not
2024 changed. Error data is set by the testing function. */
2025
2026 if (ob->file_format != NULL &&
2027 check_file_format(fd, tblock, addr) != tblock)
2028 {
2029 addr->message = US"open mailbox has changed format";
2030 goto RETURN;
2031 }
2032
2033 /* The file is OK. Carry on to do the locking. */
2034 }
2035
2036 /* We now have an open file, and must lock it using fcntl(), flock() or MBX
2037 locking rules if configured to do so. If a lock file is also required, it
2038 was created above and hd was left >= 0. At least one form of locking is
2039 required by the initialization function. If locking fails here, close the
2040 file and go round the loop all over again, after waiting for a bit, unless
2041 blocking locking was used. */
2042
2043 file_opened = TRUE;
2044 if ((ob->lock_fcntl_timeout > 0) || (ob->lock_flock_timeout > 0))
2045 sleep_before_retry = FALSE;
2046
2047 /* Simple fcntl() and/or flock() locking */
2048
2049 if (!ob->use_mbx_lock && (ob->use_fcntl || ob->use_flock))
2050 {
2051 if (apply_lock(fd, F_WRLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2052 ob->use_flock, ob->lock_flock_timeout) >= 0) break;
2053 }
2054
2055 /* MBX locking rules */
2056
2057 #ifdef SUPPORT_MBX
2058 else if (ob->use_mbx_lock)
2059 {
2060 int mbx_tmp_oflags;
2061 struct stat lstatbuf, statbuf2;
2062 if (apply_lock(fd, F_RDLCK, ob->use_fcntl, ob->lock_fcntl_timeout,
2063 ob->use_flock, ob->lock_flock_timeout) >= 0 &&
2064 fstat(fd, &statbuf) >= 0)
2065 {
2066 sprintf(CS mbx_lockname, "/tmp/.%lx.%lx", (long)statbuf.st_dev,
2067 (long)statbuf.st_ino);
2068
2069 /*
2070 * 2010-05-29: SECURITY
2071 * Dan Rosenberg reported the presence of a race-condition in the
2072 * original code here. Beware that many systems still allow symlinks
2073 * to be followed in /tmp so an attacker can create a symlink pointing
2074 * elsewhere between a stat and an open, which we should avoid
2075 * following.
2076 *
2077 * It's unfortunate that we can't just use all the heavily debugged
2078 * locking from above.
2079 *
2080 * Also: remember to mirror changes into exim_lock.c */
2081
2082 /* first leave the old pre-check in place, it provides better
2083 * diagnostics for common cases */
2084 if (Ulstat(mbx_lockname, &statbuf) >= 0)
2085 {
2086 if ((statbuf.st_mode & S_IFMT) == S_IFLNK)
2087 {
2088 addr->basic_errno = ERRNO_LOCKFAILED;
2089 addr->message = string_sprintf("symbolic link on MBX lock file %s",
2090 mbx_lockname);
2091 goto RETURN;
2092 }
2093 if (statbuf.st_nlink > 1)
2094 {
2095 addr->basic_errno = ERRNO_LOCKFAILED;
2096 addr->message = string_sprintf("hard link to MBX lock file %s",
2097 mbx_lockname);
2098 goto RETURN;
2099 }
2100 }
2101
2102 /* If we could just declare "we must be the ones who create this
2103 * file" then a hitching post in a subdir would work, since a
2104 * subdir directly in /tmp/ which we create wouldn't follow links
2105 * but this isn't our locking logic, so we can't safely change the
2106 * file existence rules. */
2107
2108 /* On systems which support O_NOFOLLOW, it's the easiest and most
2109 * obviously correct security fix */
2110 mbx_tmp_oflags = O_RDWR | O_CREAT;
2111 #ifdef O_NOFOLLOW
2112 mbx_tmp_oflags |= O_NOFOLLOW;
2113 #endif
2114 mbx_lockfd = Uopen(mbx_lockname, mbx_tmp_oflags, ob->lockfile_mode);
2115 if (mbx_lockfd < 0)
2116 {
2117 addr->basic_errno = ERRNO_LOCKFAILED;
2118 addr->message = string_sprintf("failed to open MBX lock file %s :%s",
2119 mbx_lockname, strerror(errno));
2120 goto RETURN;
2121 }
2122
2123 if (Ulstat(mbx_lockname, &lstatbuf) < 0)
2124 {
2125 addr->basic_errno = ERRNO_LOCKFAILED;
2126 addr->message = string_sprintf("attempting to lstat open MBX "
2127 "lock file %s: %s", mbx_lockname, strerror(errno));
2128 goto RETURN;
2129 }
2130 if (fstat(mbx_lockfd, &statbuf2) < 0)
2131 {
2132 addr->basic_errno = ERRNO_LOCKFAILED;
2133 addr->message = string_sprintf("attempting to stat fd of open MBX "
2134 "lock file %s: %s", mbx_lockname, strerror(errno));
2135 goto RETURN;
2136 }
2137
2138 /*
2139 * At this point:
2140 * statbuf: if exists, is file which existed prior to opening the
2141 * lockfile, might have been replaced since then
2142 * statbuf2: result of stat'ing the open fd, is what was actually
2143 * opened
2144 * lstatbuf: result of lstat'ing the filename immediately after
2145 * the open but there's a race condition again between
2146 * those two steps: before open, symlink to foo, after
2147 * open but before lstat have one of:
2148 * * was no symlink, so is the opened file
2149 * (we created it, no messing possible after that point)
2150 * * hardlink to foo
2151 * * symlink elsewhere
2152 * * hardlink elsewhere
2153 * * new file/other
2154 * Don't want to compare to device of /tmp because some modern systems
2155 * have regressed to having /tmp be the safe actual filesystem as
2156 * valuable data, so is mostly worthless, unless we assume that *only*
2157 * Linux systems do this and that all Linux has O_NOFOLLOW. Something
2158 * for further consideration.
2159 * No point in doing a readlink on the lockfile as that will always be
2160 * at a different point in time from when we open it, so tells us
2161 * nothing; attempts to clean up and delete after ourselves would risk
2162 * deleting a *third* filename.
2163 */
2164 if ((statbuf2.st_nlink > 1) ||
2165 (lstatbuf.st_nlink > 1) ||
2166 (!S_ISREG(lstatbuf.st_mode)) ||
2167 (lstatbuf.st_dev != statbuf2.st_dev) ||
2168 (lstatbuf.st_ino != statbuf2.st_ino))
2169 {
2170 addr->basic_errno = ERRNO_LOCKFAILED;
2171 addr->message = string_sprintf("RACE CONDITION detected: "
2172 "mismatch post-initial-checks between \"%s\" and opened "
2173 "fd lead us to abort!", mbx_lockname);
2174 goto RETURN;
2175 }
2176
2177 (void)Uchmod(mbx_lockname, ob->lockfile_mode);
2178
2179 if (apply_lock(mbx_lockfd, F_WRLCK, ob->use_fcntl,
2180 ob->lock_fcntl_timeout, ob->use_flock, ob->lock_flock_timeout) >= 0)
2181 {
2182 struct stat ostatbuf;
2183
2184 /* This tests for a specific race condition. Ensure that we still
2185 have the same file. */
2186
2187 if (Ulstat(mbx_lockname, &statbuf) == 0 &&
2188 fstat(mbx_lockfd, &ostatbuf) == 0 &&
2189 statbuf.st_dev == ostatbuf.st_dev &&
2190 statbuf.st_ino == ostatbuf.st_ino)
2191 break;
2192 DEBUG(D_transport) debug_printf("MBX lockfile %s changed "
2193 "between creation and locking\n", mbx_lockname);
2194 }
2195
2196 DEBUG(D_transport) debug_printf("failed to lock %s: %s\n", mbx_lockname,
2197 strerror(errno));
2198 (void)close(mbx_lockfd);
2199 mbx_lockfd = -1;
2200 }
2201 else
2202 {
2203 DEBUG(D_transport) debug_printf("failed to fstat or get read lock on %s: %s\n",
2204 filename, strerror(errno));
2205 }
2206 }
2207 #endif /* SUPPORT_MBX */
2208
2209 else break; /* No on-file locking required; break the open/lock loop */
2210
2211 DEBUG(D_transport)
2212 debug_printf("fcntl(), flock(), or MBX locking failed - retrying\n");
2213
2214 (void)close(fd);
2215 fd = -1;
2216 use_lstat = TRUE; /* Reset to use lstat first */
2217
2218
2219 /* If a blocking call timed out, break the retry loop if the total time
2220 so far is not less than than retries * interval. Use the larger of the
2221 flock() and fcntl() timeouts. */
2222
2223 if (sigalrm_seen &&
2224 (i+1) * ((ob->lock_fcntl_timeout > ob->lock_flock_timeout)?
2225 ob->lock_fcntl_timeout : ob->lock_flock_timeout) >=
2226 ob->lock_retries * ob->lock_interval)
2227 i = ob->lock_retries;
2228
2229 /* Wait a bit before retrying, except when it was a blocked fcntl() or
2230 flock() that caused the problem. */
2231
2232 if (i < ob->lock_retries && sleep_before_retry) sleep(ob->lock_interval);
2233 }
2234
2235 /* Test for exceeding the maximum number of tries. Either the file remains
2236 locked, or, if we haven't got it open, something is terribly wrong... */
2237
2238 if (i >= ob->lock_retries)
2239 {
2240 if (!file_opened)
2241 {
2242 addr->basic_errno = ERRNO_EXISTRACE;
2243 addr->message = string_sprintf("mailbox %s: existence unclear", filename);
2244 addr->special_action = SPECIAL_FREEZE;
2245 }
2246 else
2247 {
2248 addr->basic_errno = ERRNO_LOCKFAILED;
2249 addr->message = string_sprintf("failed to lock mailbox %s (fcntl/flock)",
2250 filename);
2251 }
2252 goto RETURN;
2253 }
2254
2255 DEBUG(D_transport) debug_printf("mailbox %s is locked\n", filename);
2256
2257 /* Save access time (for subsequent restoration), modification time (for
2258 restoration if updating fails), size of file (for comsat and for re-setting if
2259 delivery fails in the middle - e.g. for quota exceeded). */
2260
2261 if (fstat(fd, &statbuf) < 0)
2262 {
2263 addr->basic_errno = errno;
2264 addr->message = string_sprintf("while fstatting opened mailbox %s",
2265 filename);
2266 goto RETURN;
2267 }
2268
2269 times.actime = statbuf.st_atime;
2270 times.modtime = statbuf.st_mtime;
2271 saved_size = statbuf.st_size;
2272 if (mailbox_size < 0) mailbox_size = saved_size;
2273 mailbox_filecount = 0; /* Not actually relevant for single-file mailbox */
2274 }
2275
2276 /* Prepare for writing to a new file (as opposed to appending to an old one).
2277 There are several different formats, but there is preliminary stuff concerned
2278 with quotas that applies to all of them. Finding the current size by directory
2279 scanning is expensive; for maildirs some fudges have been invented:
2280
2281 (1) A regex can be used to extract a file size from its name;
2282 (2) If maildir_use_size is set, a maildirsize file is used to cache the
2283 mailbox size.
2284 */
2285
2286 else
2287 {
2288 uschar *check_path = path; /* Default quota check path */
2289 const pcre *regex = NULL; /* Regex for file size from file name */
2290
2291 if (!check_creation(string_sprintf("%s/any", path), ob->create_file))
2292 {
2293 addr->basic_errno = ERRNO_BADCREATE;
2294 addr->message = string_sprintf("tried to create file in %s, but "
2295 "file creation outside the home directory is not permitted", path);
2296 goto RETURN;
2297 }
2298
2299 #ifdef SUPPORT_MAILDIR
2300 /* For a maildir delivery, ensure that all the relevant directories exist,
2301 and a maildirfolder file if necessary. */
2302
2303 if (mbformat == mbf_maildir && !maildir_ensure_directories(path, addr,
2304 ob->create_directory, ob->dirmode, ob->maildirfolder_create_regex))
2305 return FALSE;
2306 #endif /* SUPPORT_MAILDIR */
2307
2308 /* If we are going to do a quota check, of if maildir_use_size_file is set
2309 for a maildir delivery, compile the regular expression if there is one. We
2310 may also need to adjust the path that is used. We need to do this for
2311 maildir_use_size_file even if the quota is unset, because we still want to
2312 create the file. When maildir support is not compiled,
2313 ob->maildir_use_size_file is always FALSE. */
2314
2315 if (ob->quota_value > 0 || THRESHOLD_CHECK || ob->maildir_use_size_file)
2316 {
2317 const uschar *error;
2318 int offset;
2319
2320 /* Compile the regex if there is one. */
2321
2322 if (ob->quota_size_regex != NULL)
2323 {
2324 regex = pcre_compile(CS ob->quota_size_regex, PCRE_COPT,
2325 (const char **)&error, &offset, NULL);
2326 if (regex == NULL)
2327 {
2328 addr->message = string_sprintf("appendfile: regular expression "
2329 "error: %s at offset %d while compiling %s", error, offset,
2330 ob->quota_size_regex);
2331 return FALSE;
2332 }
2333 DEBUG(D_transport) debug_printf("using regex for file sizes: %s\n",
2334 ob->quota_size_regex);
2335 }
2336
2337 /* Use an explicitly configured directory if set */
2338
2339 if (ob->quota_directory != NULL)
2340 {
2341 check_path = expand_string(ob->quota_directory);
2342 if (check_path == NULL)
2343 {
2344 addr->transport_return = PANIC;
2345 addr->message = string_sprintf("Expansion of \"%s\" (quota_directory "
2346 "name for %s transport) failed: %s", ob->quota_directory,
2347 tblock->name, expand_string_message);
2348 return FALSE;
2349 }
2350
2351 if (check_path[0] != '/')
2352 {
2353 addr->message = string_sprintf("appendfile: quota_directory name "
2354 "\"%s\" is not absolute", check_path);
2355 addr->basic_errno = ERRNO_NOTABSOLUTE;
2356 return FALSE;
2357 }
2358 }
2359
2360 #ifdef SUPPORT_MAILDIR
2361 /* Otherwise, if we are handling a maildir delivery, and the directory
2362 contains a file called maildirfolder, this is a maildir++ feature telling
2363 us that this is a sub-directory of the real inbox. We should therefore do
2364 the quota check on the parent directory. Beware of the special case when
2365 the directory name itself ends in a slash. */
2366
2367 else if (mbformat == mbf_maildir)
2368 {
2369 struct stat statbuf;
2370 if (Ustat(string_sprintf("%s/maildirfolder", path), &statbuf) >= 0)
2371 {
2372 uschar *new_check_path = string_copy(check_path);
2373 uschar *slash = Ustrrchr(new_check_path, '/');
2374 if (slash != NULL)
2375 {
2376 if (slash[1] == 0)
2377 {
2378 *slash = 0;
2379 slash = Ustrrchr(new_check_path, '/');
2380 }
2381 if (slash != NULL)
2382 {
2383 *slash = 0;
2384 check_path = new_check_path;
2385 DEBUG(D_transport) debug_printf("maildirfolder file exists: "
2386 "quota check directory changed to %s\n", check_path);
2387 }
2388 }
2389 }
2390 }
2391 #endif /* SUPPORT_MAILDIR */
2392 }
2393
2394 /* If we are using maildirsize files, we need to ensure that such a file
2395 exists and, if necessary, recalculate its contents. As a byproduct of this,
2396 we obtain the current size of the maildir. If no quota is to be enforced
2397 (ob->quota_value == 0), we still need the size if a threshold check will
2398 happen later.
2399
2400 Another regular expression is used to determine which directories inside the
2401 maildir are going to be counted. */
2402
2403 #ifdef SUPPORT_MAILDIR
2404 if (ob->maildir_use_size_file)
2405 {
2406 const pcre *dir_regex = NULL;
2407 const uschar *error;
2408 int offset;
2409
2410 if (ob->maildir_dir_regex != NULL)
2411 {
2412 int check_path_len = Ustrlen(check_path);
2413
2414 dir_regex = pcre_compile(CS ob->maildir_dir_regex, PCRE_COPT,
2415 (const char **)&error, &offset, NULL);
2416 if (dir_regex == NULL)
2417 {
2418 addr->message = string_sprintf("appendfile: regular expression "
2419 "error: %s at offset %d while compiling %s", error, offset,
2420 ob->maildir_dir_regex);
2421 return FALSE;
2422 }
2423
2424 DEBUG(D_transport)
2425 debug_printf("using regex for maildir directory selection: %s\n",
2426 ob->maildir_dir_regex);
2427
2428 /* Check to see if we are delivering into an ignored directory, that is,
2429 if the delivery path starts with the quota check path, and the rest
2430 of the deliver path matches the regex; if so, set a flag to disable quota
2431 checking and maildirsize updating. */
2432
2433 if (Ustrncmp(path, check_path, check_path_len) == 0)
2434 {
2435 uschar *s = path + check_path_len;
2436 while (*s == '/') s++;
2437 s = (*s == 0) ? US "new" : string_sprintf("%s/new", s);
2438 if (pcre_exec(dir_regex, NULL, CS s, Ustrlen(s), 0, 0, NULL, 0) < 0)
2439 {
2440 disable_quota = TRUE;
2441 DEBUG(D_transport) debug_printf("delivery directory does not match "
2442 "maildir_quota_directory_regex: disabling quota\n");
2443 }
2444 }
2445 }
2446
2447 /* Quota enforcement; create and check the file. There is some discussion
2448 about whether this should happen if the quota is unset. At present, Exim
2449 always creates the file. If we ever want to change this, uncomment
2450 appropriate lines below, possibly doing a check on some option. */
2451
2452 /* if (???? || ob->quota_value > 0) */
2453
2454 if (!disable_quota)
2455 {
2456 off_t size;
2457 int filecount;
2458
2459 maildirsize_fd = maildir_ensure_sizefile(check_path, ob, regex, dir_regex,
2460 &size, &filecount);
2461
2462 if (maildirsize_fd == -1)
2463 {
2464 addr->basic_errno = errno;
2465 addr->message = string_sprintf("while opening or reading "
2466 "%s/maildirsize", check_path);
2467 return FALSE;
2468 }
2469 /* can also return -2, which means that the file was removed because of
2470 raciness; but in this case, the size & filecount will still have been
2471 updated. */
2472
2473 if (mailbox_size < 0) mailbox_size = size;
2474 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2475 }
2476
2477 /* No quota enforcement; ensure file does *not* exist; calculate size if
2478 needed. */
2479
2480 /* else
2481 * {
2482 * time_t old_latest;
2483 * (void)unlink(CS string_sprintf("%s/maildirsize", check_path));
2484 * if (THRESHOLD_CHECK)
2485 * mailbox_size = maildir_compute_size(check_path, &mailbox_filecount, &old_latest,
2486 * regex, dir_regex, FALSE);
2487 * }
2488 */
2489
2490 }
2491 #endif /* SUPPORT_MAILDIR */
2492
2493 /* Otherwise if we are going to do a quota check later on, and the mailbox
2494 size is not set, find the current size of the mailbox. Ditto for the file
2495 count. Note that ob->quota_filecount_value cannot be set without
2496 ob->quota_value being set. */
2497
2498 if (!disable_quota &&
2499 (ob->quota_value > 0 || THRESHOLD_CHECK) &&
2500 (mailbox_size < 0 ||
2501 (mailbox_filecount < 0 && ob->quota_filecount_value > 0)))
2502 {
2503 off_t size;
2504 int filecount = 0;
2505 DEBUG(D_transport)
2506 debug_printf("quota checks on directory %s\n", check_path);
2507 size = check_dir_size(check_path, &filecount, regex);
2508 if (mailbox_size < 0) mailbox_size = size;
2509 if (mailbox_filecount < 0) mailbox_filecount = filecount;
2510 }
2511
2512 /* Handle the case of creating a unique file in a given directory (not in
2513 maildir or mailstore format - this is how smail did it). A temporary name is
2514 used to create the file. Later, when it is written, the name is changed to a
2515 unique one. There is no need to lock the file. An attempt is made to create
2516 the directory if it does not exist. */
2517
2518 if (mbformat == mbf_smail)
2519 {
2520 DEBUG(D_transport)
2521 debug_printf("delivering to new file in %s\n", path);
2522 filename = dataname =
2523 string_sprintf("%s/temp.%d.%s", path, (int)getpid(), primary_hostname);
2524 fd = Uopen(filename, O_WRONLY|O_CREAT, mode);
2525 if (fd < 0 && /* failed to open, and */
2526 (errno != ENOENT || /* either not non-exist */
2527 !ob->create_directory || /* or not allowed to make */
2528 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2529 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2530 {
2531 addr->basic_errno = errno;
2532 addr->message = string_sprintf("while creating file %s", filename);
2533 return FALSE;
2534 }
2535 }
2536
2537 #ifdef SUPPORT_MAILDIR
2538
2539 /* Handle the case of a unique file in maildir format. The file is written to
2540 the tmp subdirectory, with a prescribed form of name. */
2541
2542 else if (mbformat == mbf_maildir)
2543 {
2544 DEBUG(D_transport)
2545 debug_printf("delivering in maildir format in %s\n", path);
2546
2547 nametag = ob->maildir_tag;
2548
2549 /* Check that nametag expands successfully; a hard failure causes a panic
2550 return. The actual expansion for use happens again later, when
2551 $message_size is accurately known. */
2552
2553 if (nametag != NULL && expand_string(nametag) == NULL &&
2554 !f.expand_string_forcedfail)
2555 {
2556 addr->transport_return = PANIC;
2557 addr->message = string_sprintf("Expansion of \"%s\" (maildir_tag "
2558 "for %s transport) failed: %s", nametag, tblock->name,
2559 expand_string_message);
2560 return FALSE;
2561 }
2562
2563 /* We ensured the existence of all the relevant directories above. Attempt
2564 to open the temporary file a limited number of times. I think this rather
2565 scary-looking for statement is actually OK. If open succeeds, the loop is
2566 broken; if not, there is a test on the value of i. Get the time again
2567 afresh each time round the loop. Its value goes into a variable that is
2568 checked at the end, to make sure we don't release this process until the
2569 clock has ticked. */
2570
2571 for (i = 1;; i++)
2572 {
2573 uschar *basename;
2574
2575 (void)gettimeofday(&msg_tv, NULL);
2576 basename = string_sprintf(TIME_T_FMT ".H%luP" PID_T_FMT ".%s",
2577 msg_tv.tv_sec, msg_tv.tv_usec, getpid(), primary_hostname);
2578
2579 filename = dataname = string_sprintf("tmp/%s", basename);
2580 newname = string_sprintf("new/%s", basename);
2581
2582 if (Ustat(filename, &statbuf) == 0)
2583 errno = EEXIST;
2584 else if (errno == ENOENT)
2585 {
2586 fd = Uopen(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
2587 if (fd >= 0) break;
2588 DEBUG (D_transport) debug_printf ("open failed for %s: %s\n",
2589 filename, strerror(errno));
2590 }
2591
2592 /* Too many retries - give up */
2593
2594 if (i >= ob->maildir_retries)
2595 {
2596 addr->message = string_sprintf ("failed to open %s (%d tr%s)",
2597 filename, i, (i == 1) ? "y" : "ies");
2598 addr->basic_errno = errno;
2599 if (errno == errno_quota || errno == ENOSPC)
2600 addr->user_message = US"mailbox is full";
2601 return FALSE;
2602 }
2603
2604 /* Open or stat failed but we haven't tried too many times yet. */
2605
2606 sleep(2);
2607 }
2608
2609 /* Note that we have to ensure the clock has ticked before leaving */
2610
2611 wait_for_tick = TRUE;
2612
2613 /* Why are these here? Put in because they are present in the non-maildir
2614 directory case above. */
2615
2616 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2617 {
2618 addr->basic_errno = errno;
2619 addr->message = string_sprintf("while setting perms on maildir %s",
2620 filename);
2621 return FALSE;
2622 }
2623 }
2624
2625 #endif /* SUPPORT_MAILDIR */
2626
2627 #ifdef SUPPORT_MAILSTORE
2628
2629 /* Handle the case of a unique file in mailstore format. First write the
2630 envelope to a temporary file, then open the main file. The unique base name
2631 for the files consists of the message id plus the pid of this delivery
2632 process. */
2633
2634 else
2635 {
2636 FILE *env_file;
2637 address_item *taddr;
2638 mailstore_basename = string_sprintf("%s/%s-%s", path, message_id,
2639 string_base62((long int)getpid()));
2640
2641 DEBUG(D_transport)
2642 debug_printf("delivering in mailstore format in %s\n", path);
2643
2644 filename = string_sprintf("%s.tmp", mailstore_basename);
2645 newname = string_sprintf("%s.env", mailstore_basename);
2646 dataname = string_sprintf("%s.msg", mailstore_basename);
2647
2648 fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
2649 if (fd < 0 && /* failed to open, and */
2650 (errno != ENOENT || /* either not non-exist */
2651 !ob->create_directory || /* or not allowed to make */
2652 !directory_make(NULL, path, ob->dirmode, FALSE) || /* or failed to create dir */
2653 (fd = Uopen(filename, O_WRONLY|O_CREAT|O_EXCL, mode)) < 0)) /* or then failed to open */
2654 {
2655 addr->basic_errno = errno;
2656 addr->message = string_sprintf("while creating file %s", filename);
2657 return FALSE;
2658 }
2659
2660 /* Why are these here? Put in because they are present in the non-maildir
2661 directory case above. */
2662
2663 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2664 {
2665 addr->basic_errno = errno;
2666 addr->message = string_sprintf("while setting perms on file %s",
2667 filename);
2668 return FALSE;
2669 }
2670
2671 /* Built a C stream from the open file descriptor. */
2672
2673 if ((env_file = fdopen(fd, "wb")) == NULL)
2674 {
2675 addr->basic_errno = errno;
2676 addr->transport_return = PANIC;
2677 addr->message = string_sprintf("fdopen of %s ("
2678 "for %s transport) failed", filename, tblock->name);
2679 (void)close(fd);
2680 Uunlink(filename);
2681 return FALSE;
2682 }
2683
2684 /* Write the envelope file, then close it. */
2685
2686 if (ob->mailstore_prefix != NULL)
2687 {
2688 uschar *s = expand_string(ob->mailstore_prefix);
2689 if (s == NULL)
2690 {
2691 if (!f.expand_string_forcedfail)
2692 {
2693 addr->transport_return = PANIC;
2694 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2695 "prefix for %s transport) failed: %s", ob->mailstore_prefix,
2696 tblock->name, expand_string_message);
2697 (void)fclose(env_file);
2698 Uunlink(filename);
2699 return FALSE;
2700 }
2701 }
2702 else
2703 {
2704 int n = Ustrlen(s);
2705 fprintf(env_file, "%s", CS s);
2706 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2707 }
2708 }
2709
2710 fprintf(env_file, "%s\n", sender_address);
2711
2712 for (taddr = addr; taddr!= NULL; taddr = taddr->next)
2713 fprintf(env_file, "%s@%s\n", taddr->local_part, taddr->domain);
2714
2715 if (ob->mailstore_suffix != NULL)
2716 {
2717 uschar *s = expand_string(ob->mailstore_suffix);
2718 if (s == NULL)
2719 {
2720 if (!f.expand_string_forcedfail)
2721 {
2722 addr->transport_return = PANIC;
2723 addr->message = string_sprintf("Expansion of \"%s\" (mailstore "
2724 "suffix for %s transport) failed: %s", ob->mailstore_suffix,
2725 tblock->name, expand_string_message);
2726 (void)fclose(env_file);
2727 Uunlink(filename);
2728 return FALSE;
2729 }
2730 }
2731 else
2732 {
2733 int n = Ustrlen(s);
2734 fprintf(env_file, "%s", CS s);
2735 if (n == 0 || s[n-1] != '\n') fprintf(env_file, "\n");
2736 }
2737 }
2738
2739 if (fclose(env_file) != 0)
2740 {
2741 addr->basic_errno = errno;
2742 addr->message = string_sprintf("while closing %s", filename);
2743 Uunlink(filename);
2744 return FALSE;
2745 }
2746
2747 DEBUG(D_transport) debug_printf("Envelope file %s written\n", filename);
2748
2749 /* Now open the data file, and ensure that it has the correct ownership and
2750 mode. */
2751
2752 fd = Uopen(dataname, O_WRONLY|O_CREAT|O_EXCL, mode);
2753 if (fd < 0)
2754 {
2755 addr->basic_errno = errno;
2756 addr->message = string_sprintf("while creating file %s", dataname);
2757 Uunlink(filename);
2758 return FALSE;
2759 }
2760 if(Uchown(dataname, uid, gid) || Uchmod(dataname, mode))
2761 {
2762 addr->basic_errno = errno;
2763 addr->message = string_sprintf("while setting perms on file %s",
2764 dataname);
2765 return FALSE;
2766 }
2767 }
2768
2769 #endif /* SUPPORT_MAILSTORE */
2770
2771
2772 /* In all cases of writing to a new file, ensure that the file which is
2773 going to be renamed has the correct ownership and mode. */
2774
2775 if(Uchown(filename, uid, gid) || Uchmod(filename, mode))
2776 {
2777 addr->basic_errno = errno;
2778 addr->message = string_sprintf("while setting perms on file %s",
2779 filename);
2780 return FALSE;
2781 }
2782 }
2783
2784
2785 /* At last we can write the message to the file, preceded by any configured
2786 prefix line, and followed by any configured suffix line. If there are any
2787 writing errors, we must defer. */
2788
2789 DEBUG(D_transport) debug_printf("writing to file %s\n", dataname);
2790
2791 yield = OK;
2792 errno = 0;
2793
2794 /* If there is a local quota setting, check that we are not going to exceed it
2795 with this message if quota_is_inclusive is set; if it is not set, the check
2796 is for the mailbox already being over quota (i.e. the current message is not
2797 included in the check). */
2798
2799 if (!disable_quota && ob->quota_value > 0)
2800 {
2801 DEBUG(D_transport)
2802 {
2803 debug_printf("Exim quota = " OFF_T_FMT " old size = " OFF_T_FMT
2804 " this message = %d (%sincluded)\n",
2805 ob->quota_value, mailbox_size, message_size,
2806 ob->quota_is_inclusive ? "" : "not ");
2807 debug_printf(" file count quota = %d count = %d\n",
2808 ob->quota_filecount_value, mailbox_filecount);
2809 }
2810
2811 if (mailbox_size + (ob->quota_is_inclusive ? message_size:0) > ob->quota_value)
2812 {
2813
2814 if (!ob->quota_no_check)
2815 {
2816 DEBUG(D_transport) debug_printf("mailbox quota exceeded\n");
2817 yield = DEFER;
2818 errno = ERRNO_EXIMQUOTA;
2819 }
2820 else DEBUG(D_transport) debug_printf("mailbox quota exceeded but ignored\n");
2821
2822 }
2823
2824 if (ob->quota_filecount_value > 0
2825 && mailbox_filecount + (ob->quota_is_inclusive ? 1:0) >
2826 ob->quota_filecount_value)
2827 if(!ob->quota_filecount_no_check)
2828 {
2829 DEBUG(D_transport) debug_printf("mailbox file count quota exceeded\n");
2830 yield = DEFER;
2831 errno = ERRNO_EXIMQUOTA;
2832 filecount_msg = US" filecount";
2833 }
2834 else DEBUG(D_transport) if (ob->quota_filecount_no_check)
2835 debug_printf("mailbox file count quota exceeded but ignored\n");
2836
2837 }
2838
2839 /* If we are writing in MBX format, what we actually do is to write the message
2840 to a temporary file, and then copy it to the real file once we know its size.
2841 This is the most straightforward way of getting the correct length in the
2842 separator line. So, what we do here is to save the real file descriptor, and
2843 replace it with one for a temporary file. The temporary file gets unlinked once
2844 opened, so that it goes away on closure. */
2845
2846 #ifdef SUPPORT_MBX
2847 if (yield == OK && ob->mbx_format)
2848 {
2849 temp_file = tmpfile();
2850 if (temp_file == NULL)
2851 {
2852 addr->basic_errno = errno;
2853 addr->message = US"while setting up temporary file";
2854 yield = DEFER;
2855 goto RETURN;
2856 }
2857 save_fd = fd;
2858 fd = fileno(temp_file);
2859 DEBUG(D_transport) debug_printf("writing to temporary file\n");
2860 }
2861 #endif /* SUPPORT_MBX */
2862
2863 /* Zero the count of bytes written. It is incremented by the transport_xxx()
2864 functions. */
2865
2866 transport_count = 0;
2867 transport_newlines = 0;
2868
2869 /* Write any configured prefix text first */
2870
2871 if (yield == OK && ob->message_prefix != NULL && ob->message_prefix[0] != 0)
2872 {
2873 uschar *prefix = expand_string(ob->message_prefix);
2874 if (prefix == NULL)
2875 {
2876 errno = ERRNO_EXPANDFAIL;
2877 addr->transport_return = PANIC;
2878 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
2879 "transport) failed", ob->message_prefix, tblock->name);
2880 yield = DEFER;
2881 }
2882 else if (!transport_write_string(fd, "%s", prefix)) yield = DEFER;
2883 }
2884
2885 /* If the use_bsmtp option is on, we need to write SMTP prefix information. The
2886 various different values for batching are handled outside; if there is more
2887 than one address available here, all must be included. If any address is a
2888 file, use its parent in the RCPT TO. */
2889
2890 if (yield == OK && ob->use_bsmtp)
2891 {
2892 transport_count = 0;
2893 transport_newlines = 0;
2894 if (ob->use_crlf) cr = US"\r";
2895 if (!transport_write_string(fd, "MAIL FROM:<%s>%s\n", return_path, cr))
2896 yield = DEFER;
2897 else
2898 {
2899 address_item *a;
2900 transport_newlines++;
2901 for (a = addr; a != NULL; a = a->next)
2902 {
2903 address_item *b = testflag(a, af_pfr) ? a->parent: a;
2904 if (!transport_write_string(fd, "RCPT TO:<%s>%s\n",
2905 transport_rcpt_address(b, tblock->rcpt_include_affixes), cr))
2906 { yield = DEFER; break; }
2907 transport_newlines++;
2908 }
2909 if (yield == OK && !transport_write_string(fd, "DATA%s\n", cr))
2910 yield = DEFER;
2911 else
2912 transport_newlines++;
2913 }
2914 }
2915
2916 /* Now the message itself. The options for transport_write_message were set up
2917 at initialization time. */
2918
2919 if (yield == OK)
2920 {
2921 transport_ctx tctx = {
2922 .u = {.fd=fd},
2923 .tblock = tblock,
2924 .addr = addr,
2925 .check_string = ob->check_string,
2926 .escape_string = ob->escape_string,
2927 .options = ob->options | topt_not_socket
2928 };
2929 if (!transport_write_message(&tctx, 0))
2930 yield = DEFER;
2931 }
2932
2933 /* Now a configured suffix. */
2934
2935 if (yield == OK && ob->message_suffix != NULL && ob->message_suffix[0] != 0)
2936 {
2937 uschar *suffix = expand_string(ob->message_suffix);
2938 if (suffix == NULL)
2939 {
2940 errno = ERRNO_EXPANDFAIL;
2941 addr->transport_return = PANIC;
2942 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
2943 "transport) failed", ob->message_suffix, tblock->name);
2944 yield = DEFER;
2945 }
2946 else if (!transport_write_string(fd, "%s", suffix)) yield = DEFER;
2947 }
2948
2949 /* If batch smtp, write the terminating dot. */
2950
2951 if (yield == OK && ob->use_bsmtp ) {
2952 if(!transport_write_string(fd, ".%s\n", cr)) yield = DEFER;
2953 else transport_newlines++;
2954 }
2955
2956 /* If MBX format is being used, all that writing was to the temporary file.
2957 However, if there was an earlier failure (Exim quota exceeded, for example),
2958 the temporary file won't have got opened - and no writing will have been done.
2959 If writing was OK, we restore the fd, and call a function that copies the
2960 message in MBX format into the real file. Otherwise use the temporary name in
2961 any messages. */
2962
2963 #ifdef SUPPORT_MBX
2964 if (temp_file != NULL && ob->mbx_format)
2965 {
2966 int mbx_save_errno;
2967 fd = save_fd;
2968
2969 if (yield == OK)
2970 {
2971 transport_count = 0; /* Reset transport count for actual write */
2972 /* No need to reset transport_newlines as we're just using a block copy
2973 * routine so the number won't be affected */
2974 yield = copy_mbx_message(fd, fileno(temp_file), saved_size);
2975 }
2976 else if (errno >= 0) dataname = US"temporary file";
2977
2978 /* Preserve errno while closing the temporary file. */
2979
2980 mbx_save_errno = errno;
2981 (void)fclose(temp_file);
2982 errno = mbx_save_errno;
2983 }
2984 #endif /* SUPPORT_MBX */
2985
2986 /* Force out the remaining data to check for any errors; some OS don't allow
2987 fsync() to be called for a FIFO. */
2988
2989 if (yield == OK && !isfifo && EXIMfsync(fd) < 0) yield = DEFER;
2990
2991 /* Update message_size and message_linecount to the accurate count of bytes
2992 written, including added headers. Note; we subtract 1 from message_linecount as
2993 this variable doesn't count the new line between the header and the body of the
2994 message. */
2995
2996 message_size = transport_count;
2997 message_linecount = transport_newlines - 1;
2998
2999 /* If using a maildir++ quota file, add this message's size to it, and
3000 close the file descriptor, except when the quota has been disabled because we
3001 are delivering into an uncounted folder. */
3002
3003 #ifdef SUPPORT_MAILDIR
3004 if (!disable_quota)
3005 {
3006 if (yield == OK && maildirsize_fd >= 0)
3007 maildir_record_length(maildirsize_fd, message_size);
3008 maildir_save_errno = errno; /* Preserve errno while closing the file */
3009 if (maildirsize_fd >= 0)
3010 (void)close(maildirsize_fd);
3011 errno = maildir_save_errno;
3012 }
3013 #endif /* SUPPORT_MAILDIR */
3014
3015 /* If there is a quota warning threshold and we are have crossed it with this
3016 message, set the SPECIAL_WARN flag in the address, to cause a warning message
3017 to be sent. */
3018
3019 if (!disable_quota && THRESHOLD_CHECK)
3020 {
3021 off_t threshold = ob->quota_warn_threshold_value;
3022 if (ob->quota_warn_threshold_is_percent)
3023 threshold = (off_t)(((double)ob->quota_value * threshold) / 100);
3024 DEBUG(D_transport)
3025 debug_printf("quota = " OFF_T_FMT
3026 " threshold = " OFF_T_FMT
3027 " old size = " OFF_T_FMT
3028 " message size = %d\n",
3029 ob->quota_value, threshold, mailbox_size,
3030 message_size);
3031 if (mailbox_size <= threshold && mailbox_size + message_size > threshold)
3032 addr->special_action = SPECIAL_WARN;
3033
3034 /******* You might think that the test ought to be this:
3035 *
3036 * if (ob->quota_value > 0 && threshold > 0 && mailbox_size > 0 &&
3037 * mailbox_size <= threshold && mailbox_size + message_size > threshold)
3038 *
3039 * (indeed, I was sent a patch with that in). However, it is possible to
3040 * have a warning threshold without actually imposing a quota, and I have
3041 * therefore kept Exim backwards compatible.
3042 ********/
3043
3044 }
3045
3046 /* Handle error while writing the file. Control should come here directly after
3047 the error, with the reason in errno. In the case of expansion failure in prefix
3048 or suffix, it will be ERRNO_EXPANDFAIL. */
3049
3050 if (yield != OK)
3051 {
3052 addr->special_action = SPECIAL_NONE; /* Cancel any quota warning */
3053
3054 /* Save the error number. If positive, it will ultimately cause a strerror()
3055 call to generate some text. */
3056
3057 addr->basic_errno = errno;
3058
3059 /* For system or Exim quota excession, or disk full, set more_errno to the
3060 time since the file was last read. If delivery was into a directory, the
3061 time since last read logic is not relevant, in general. However, for maildir
3062 deliveries we can approximate it by looking at the last modified time of the
3063 "new" subdirectory. Since Exim won't be adding new messages, a change to the
3064 "new" subdirectory implies that an MUA has moved a message from there to the
3065 "cur" directory. */
3066
3067 if (errno == errno_quota || errno == ERRNO_EXIMQUOTA || errno == ENOSPC)
3068 {
3069 addr->more_errno = 0;
3070 if (!isdirectory) addr->more_errno = (int)(time(NULL) - times.actime);
3071
3072 #ifdef SUPPORT_MAILDIR
3073 else if (mbformat == mbf_maildir)
3074 {
3075 struct stat statbuf;
3076 if (Ustat("new", &statbuf) < 0)
3077 {
3078 DEBUG(D_transport) debug_printf("maildir quota exceeded: "
3079 "stat error %d for \"new\": %s\n", errno, strerror(errno));
3080 }
3081 else /* Want a repeatable time when in test harness */
3082 {
3083 addr->more_errno = f.running_in_test_harness ? 10 :
3084 (int)time(NULL) - statbuf.st_mtime;
3085 }
3086 DEBUG(D_transport)
3087 debug_printf("maildir: time since \"new\" directory modified = %s\n",
3088 readconf_printtime(addr->more_errno));
3089 }
3090 #endif /* SUPPORT_MAILDIR */
3091 }
3092
3093 /* Handle system quota excession. Add an explanatory phrase for the error
3094 message, since some systems don't have special quota-excession errors,
3095 and on those that do, "quota" doesn't always mean anything to the user. */
3096
3097 if (errno == errno_quota)
3098 {
3099 #ifndef EDQUOT
3100 addr->message = string_sprintf("mailbox is full "
3101 "(quota exceeded while writing to file %s)", filename);
3102 #else
3103 addr->message = string_sprintf("mailbox is full");
3104 #endif /* EDQUOT */
3105 addr->user_message = US"mailbox is full";
3106 DEBUG(D_transport) debug_printf("System quota exceeded for %s%s%s\n",
3107 dataname,
3108 isdirectory ? US"" : US": time since file read = ",
3109 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3110 }
3111
3112 /* Handle Exim's own quota-imposition */
3113
3114 else if (errno == ERRNO_EXIMQUOTA)
3115 {
3116 addr->message = string_sprintf("mailbox is full "
3117 "(MTA-imposed%s quota exceeded while writing to %s)", filecount_msg,
3118 dataname);
3119 addr->user_message = US"mailbox is full";
3120 DEBUG(D_transport) debug_printf("Exim%s quota exceeded for %s%s%s\n",
3121 filecount_msg, dataname,
3122 isdirectory ? US"" : US": time since file read = ",
3123 isdirectory ? US"" : readconf_printtime(addr->more_errno));
3124 }
3125
3126 /* Handle a process failure while writing via a filter; the return
3127 from child_close() is in more_errno. */
3128
3129 else if (errno == ERRNO_FILTER_FAIL)
3130 {
3131 yield = PANIC;
3132 addr->message = string_sprintf("transport filter process failed (%d) "
3133 "while writing to %s%s", addr->more_errno, dataname,
3134 (addr->more_errno == EX_EXECFAILED) ? ": unable to execute command" : "");
3135 }
3136
3137 /* Handle failure to expand header changes */
3138
3139 else if (errno == ERRNO_CHHEADER_FAIL)
3140 {
3141 yield = PANIC;
3142 addr->message =
3143 string_sprintf("failed to expand headers_add or headers_remove while "
3144 "writing to %s: %s", dataname, expand_string_message);
3145 }
3146
3147 /* Handle failure to complete writing of a data block */
3148
3149 else if (errno == ERRNO_WRITEINCOMPLETE)
3150 {
3151 addr->message = string_sprintf("failed to write data block while "
3152 "writing to %s", dataname);
3153 }
3154
3155 /* Handle length mismatch on MBX copying */
3156
3157 #ifdef SUPPORT_MBX
3158 else if (errno == ERRNO_MBXLENGTH)
3159 {
3160 addr->message = string_sprintf("length mismatch while copying MBX "
3161 "temporary file to %s", dataname);
3162 }
3163 #endif /* SUPPORT_MBX */
3164
3165 /* For other errors, a general-purpose explanation, if the message is
3166 not already set. */
3167
3168 else if (addr->message == NULL)
3169 addr->message = string_sprintf("error while writing to %s", dataname);
3170
3171 /* For a file, reset the file size to what it was before we started, leaving
3172 the last modification time unchanged, so it will get reset also. All systems
3173 investigated so far have ftruncate(), whereas not all have the F_FREESP
3174 fcntl() call (BSDI & FreeBSD do not). */
3175
3176 if (!isdirectory && ftruncate(fd, saved_size))
3177 DEBUG(D_transport) debug_printf("Error resetting file size\n");
3178 }
3179
3180 /* Handle successful writing - we want the modification time to be now for
3181 appended files. Remove the default backstop error number. For a directory, now
3182 is the time to rename the file with a unique name. As soon as such a name
3183 appears it may get used by another process, so we close the file first and
3184 check that all is well. */
3185
3186 else
3187 {
3188 times.modtime = time(NULL);
3189 addr->basic_errno = 0;
3190
3191 /* Handle the case of writing to a new file in a directory. This applies
3192 to all single-file formats - maildir, mailstore, and "smail format". */
3193
3194 if (isdirectory)
3195 {
3196 if (fstat(fd, &statbuf) < 0)
3197 {
3198 addr->basic_errno = errno;
3199 addr->message = string_sprintf("while fstatting opened message file %s",
3200 filename);
3201 yield = DEFER;
3202 }
3203
3204 else if (close(fd) < 0)
3205 {
3206 addr->basic_errno = errno;
3207 addr->message = string_sprintf("close() error for %s",
3208 (ob->mailstore_format) ? dataname : filename);
3209 yield = DEFER;
3210 }
3211
3212 /* File is successfully written and closed. Arrange to rename it. For the
3213 different kinds of single-file delivery, some games can be played with the
3214 name. The message size is by this time set to the accurate value so that
3215 its value can be used in expansions. */
3216
3217 else
3218 {
3219 uschar *renamename = newname;
3220 fd = -1;
3221
3222 DEBUG(D_transport) debug_printf("renaming temporary file\n");
3223
3224 /* If there is no rename name set, we are in a non-maildir, non-mailstore
3225 situation. The name is built by expanding the directory_file option, and
3226 we make the inode number available for use in this. The expansion was
3227 checked for syntactic validity above, before we wrote the file.
3228
3229 We have to be careful here, in case the file name exists. (In the other
3230 cases, the names used are constructed to be unique.) The rename()
3231 function just replaces an existing file - we don't want that! So instead
3232